Local group policy toolset

Useful toolset from Microsoft for turning text into policy settings and applying local group policies:

local group policy toolset posted on the FDCC blog

RSOP through WMI

I've noticed a lot of people with problems retrieving user Resultant Set Of Policy - RSOP information from WMI using root/RSOP... computer RSOP works fine:

strComputer = "."
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\rsop\computer")
Set colItems = objWMIService.ExecQuery("Select * from RSOP_GPO")
For Each objItem In colItems
Wscript.Echo "Name: " & objItem.Name
Wscript.Echo "GUID Name: " & objItem.GUIDNameWscript.Echo "ID: " & objItem.ID
Wscript.Echo "Access Denied: " & objItem.AccessDenied
Wscript.Echo "Enabled: " & objItem.Enabled
Wscript.Echo "File System path: " & objItem.FileSystemPath
Wscript.Echo "Filter Allowed: " & objItem.FilterAllowed
Wscript.Echo "Filter ID: " & objItem.FilterId
Wscript.Echo "Version: " & objItem.Version
Wscript.Echo
Next

Works without issue but root\rsop\user\%SID% does not retrieve anything... to fix you must replace the hyphens - in the SID with underscores _ !!

So:
S-1-5-21-1708537768-688789844-1994488-12833 should be S_1_5_21_1708537768_688789844_1994488_12833

so:

strComputer = "."
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set objAccount = objWMIService.Get("Win32_UserAccount.Name='joeblow',Domain='YourDomain'")
Wscript.Echo objAccount.SID
strWMISID = replace (objAccount.SID,"-","_")
Set objWMIService = Nothing
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\rsop\user\" & strWMISID)
Set colItems = objWMIService.ExecQuery("Select * from RSOP_GPO")
For Each objItem In colItems
Wscript.Echo "Name: " & objItem.Name
Wscript.Echo "GUID Name: " & objItem.GUIDNameWscript.Echo "ID: " & objItem.ID
Wscript.Echo "Access Denied: " & objItem.AccessDenied
Wscript.Echo "Enabled: " & objItem.Enabled
Wscript.Echo "File System path: " & objItem.FileSystemPath
Wscript.Echo "Filter Allowed: " & objItem.FilterAllowed
Wscript.Echo "Filter ID: " & objItem.FilterId
Wscript.Echo "Version: " & objItem.Version
Wscript.Echo
Next

Voila! it now works...

FYI - Get the logged on user with:

Set colSessions = objWMI.ExecQuery("Select * from Win32_LogonSession Where LogonType = 2")
If colSessions.Count = 0 Then
Wscript.Echo "No interactive users found"
Else
For Each objSession in colSessions
Set colList = objWMI.ExecQuery("Associators of {Win32_LogonSession.LogonId=" & objSession.LogonId & "} Where AssocClass=Win32_LoggedOnUser Role=Dependent" )
For Each objItem in colList
WScript.Echo "Username: " & objItem.Name & " SID: " & objItem.SID
WScript.Echo "WMISID: " & replace(objItem.SID,"-","_")
Next
Next
End If

Consistency is a wonderful thing... maybe the WMI namespace adheres to some standard that prevents hyphens but allows underscores... who knows...