title: vbscript GPO permissions - set group to deny "Apply Group Policy"
body: <p>Background (these facts are all set in stone and cannot be changed):</p>
  
  <ul>
  <li>SettingA is to apply to all users EXCEPT TestGroup</li>
  <li>All Users are in the same OU</li>
  <li>There is no group (and I cannot create one) which encompasses "all users EXCEPT TestGroup"</li>
  <li>I need to do this using vbscript</li>
  <li>Using Server 2003</li>
  </ul>
  
  <p>So therefore to apply SettingA I need to set TestGPO (which has SettingA) with permissions: </p>
  
  <ul>
  <li>Authenticated Users with read and apply (the default permissions)</li>
  <li>TestGroup set to deny "Apply Group Policy".</li>
  </ul>
  
  <p>i have looked at Microsoft's provided SetGPOPermissions.wsf (available here - <a href="https://gallery.technet.microsoft.com/group-policy-management-17a5f840" rel="nofollow noreferrer">https://gallery.technet.microsoft.com/group-policy-management-17a5f840</a>) but this only covers the basis permissions (note that the PermGPORead permission, while it does not have "Apply Group Policy" permission, all users are in "Authenticated Users" so would get the Apply GPO permissions from here, so this does not equate to deny)</p>
  
  <p>I have customised the script here for my purposes (but kept same var names, etc.,), and it works as the script describes, but I can't work out how to get it to work with custom permissions. (<a href="https://books.google.co.uk/books?id=Ga1nLk_xqcUC&amp;pg=PA430&amp;dq=objGPOlist+item+1+getsecurityinfor&amp;hl=en&amp;sa=X&amp;ved=0ahUKEwj67qq56-baAhUU3YMKHURTA1kQ6AEILTAA#v=onepage&amp;q=objGPOlist%20item%201%20getsecurityinfor&amp;f=false" rel="nofollow noreferrer">https://books.google.co.uk/books?id=Ga1nLk_xqcUC&amp;pg=PA430&amp;dq=objGPOlist+item+1+getsecurityinfor&amp;hl=en&amp;sa=X&amp;ved=0ahUKEwj67qq56-baAhUU3YMKHURTA1kQ6AEILTAA#v=onepage&amp;q=objGPOlist%20item%201%20getsecurityinfor&amp;f=false</a>)  </p>
  
  <p>When it comes to the following line, I can see that I can change the method/property at the end from "PermGPOApply" to "PermGPOCustom", but I can't find examples of what I could put in here.</p>
  
  <pre><code>set objGPMPerm = 
  objGPM.CreatePermissions(strGroupAdd,objGPMConstants.PermGPOApply, False)
  </code></pre>
  
  <p>Following this line from the script:</p>
  
  <pre><code>setObjsecurityinfo = objGPOlist.item(1).GetSecurityInfo()
  </code></pre>
  
  <p>I added the following, adapted from DumpGPOInfo.wsf (<a href="https://gallery.technet.microsoft.com/group-policy-management-17a5f840" rel="nofollow noreferrer">https://gallery.technet.microsoft.com/group-policy-management-17a5f840</a>):</p>
  
  <pre><code>For each GPOPermission in objSecurityInfo
      wscript.echo "GPO trustee is: " &amp; GPOPermission.Trustee.Trusteename
      wscript.echo "GPO permission is: " &amp; GPOPermission.Permission
  Next
  </code></pre>
  
  <p>And from this I can see that "Custom" permission shows as 65795. However, this does not determine a specific custom permission, but rather any permission which does not fall in the bracket of "read" or "edit" - so Read, Execute, Edit and Deny "Apply Group Policy" would show as 65795, as would simply Deny "Apply Group Policy". In other words it is of no use to me.</p>
  
  <p>I did find a tantalising reference to how to set permissions on the following website, but then could not find any more useful information from this link.</p>
  
  <p>"To set Deny or Custom permissions on these objects, you still need to use Active Directory Service Interfaces—ADSI—tools such as IADsSecurityDescriptor or Microsoft's adssecurity.dll." (<a href="http://www.itprotoday.com/management-mobility/scripting-group-policy-permissions" rel="nofollow noreferrer">http://www.itprotoday.com/management-mobility/scripting-group-policy-permissions</a>)</p>
  
  <p>So in summary:
  Please can someone advise how to use vbscript to set a GPO to deny "Apply Group Policy" for a specified group. Thanks!</p>