public sealed class WindowsGroupPolicyClientGPMC operations for an explicit domain and controller, using the caller's Windows identity.
Remarks
Requires GPMC/RSAT. Long native operations run on an owned apartment; cancellation after native execution starts does not imply rollback.
Constructors
WindowsGroupPolicyClient
public WindowsGroupPolicyClient(string domainName, string domainController)Creates a client with no implicit domain-controller selection.
Methods
BackupAsync
public Task<GroupPolicyOperationResult<GroupPolicyBackup>> BackupAsync(Guid id, string directory, string comment = "", CancellationToken cancellationToken = default)Backs up a selected GPO to an explicit directory. Completion includes GPMC overall status.
CreateAsync
public Task<GroupPolicySnapshot> CreateAsync(string displayName, CancellationToken cancellationToken = default)Creates a new GPO and assigns its display name. Naming failure may leave a newly created GPO; no automatic deletion occurs.
CreateLinkAsync
public Task CreateLinkAsync(Guid id, string targetDistinguishedName, int order = -1, bool enabled = true, bool enforced = false, CancellationToken cancellationToken = default)Creates a link at a one-based position; -1 appends at lowest precedence. An existing link is a conflict.
DeleteAsync
public Task<bool> DeleteAsync(Guid id, CancellationToken cancellationToken = default)Deletes a GPO through GPMC. Returns false only if absent.
DeleteLinkAsync
public Task<bool> DeleteLinkAsync(Guid id, string targetDistinguishedName, CancellationToken cancellationToken = default)Deletes a direct link. Returns false if that link is absent.
EnumerateAsync
public Task<ImmutableArray<GroupPolicySnapshot>> EnumerateAsync(CancellationToken cancellationToken = default)Enumerates all GPOs; display names are not assumed to be unique.
EnumerateBackupsAsync
public static Task<ImmutableArray<GroupPolicyBackup>> EnumerateBackupsAsync(string directory, CancellationToken cancellationToken = default)Enumerates every backup in an explicit GPMC backup directory, without selecting by name or recency.
Remarks
Requires local GPMC but does not connect to the configured domain. No partial results are returned on failure or cancellation.
FindAsync
public Task<GroupPolicySnapshot?> FindAsync(Guid id, CancellationToken cancellationToken = default)Finds a GPO by GUID; null means absent.
GenerateReportAsync
public Task<GroupPolicyOperationResult<string>> GenerateReportAsync(Guid id, GroupPolicyReportFormat format, CancellationToken cancellationToken = default)Generates XML or HTML with native operation status.
GetInheritanceBlockedAsync
public Task<bool> GetInheritanceBlockedAsync(string targetDistinguishedName, CancellationToken cancellationToken = default)Reads whether the target blocks inherited policy links.
GetLinksAsync
public Task<ImmutableArray<GroupPolicyLink>> GetLinksAsync(string targetDistinguishedName, CancellationToken cancellationToken = default)Reads direct links in native precedence order.
GetPermissionsAsync
public Task<ImmutableArray<GroupPolicyPermissionEntry>> GetPermissionsAsync(Guid id, CancellationToken cancellationToken = default)Reads security filtering/delegation including inherited and custom permission entries.
GrantPermissionAsync
public Task GrantPermissionAsync(Guid id, string trustee, GroupPolicyPermissionLevel level, bool inheritable = false, CancellationToken cancellationToken = default)Grants a curated permission to an explicit trustee name or SID, retaining other trustees.
ImportAsync
public Task<GroupPolicyOperationResult<GroupPolicySnapshot>> ImportAsync(Guid destinationId, string backupDirectory, Guid backupId, GroupPolicyImportOptions? options = null, CancellationToken cancellationToken = default)Imports policy settings into an existing GPO, replacing its settings while retaining its identity and links.
RemoveTrusteePermissionsAsync
public Task RemoveTrusteePermissionsAsync(Guid id, string trustee, CancellationToken cancellationToken = default)Removes explicit permissions for one trustee. Inherited permissions remain governed by their parent.
RenameAsync
public Task RenameAsync(Guid id, string displayName, CancellationToken cancellationToken = default)Renames a GPO without changing its identity or policy settings.
RestoreAsync
public Task<GroupPolicyOperationResult<GroupPolicySnapshot>> RestoreAsync(string backupDirectory, Guid backupId, CancellationToken cancellationToken = default)Restores an explicitly selected backup through GPMC, preserving its original GPO identity.
SetEnabledAsync
public Task SetEnabledAsync(Guid id, bool? userEnabled = null, bool? computerEnabled = null, CancellationToken cancellationToken = default)Enables/disables selected policy halves; null preserves a half's current state.
SetInheritanceBlockedAsync
public Task SetInheritanceBlockedAsync(string targetDistinguishedName, bool blocked, CancellationToken cancellationToken = default)Changes blocked inheritance without changing direct links.
SetLinkOrderAsync
public Task SetLinkOrderAsync(string targetDistinguishedName, ImmutableArray<Guid> highestPrecedenceFirst, CancellationToken cancellationToken = default)Reorders every direct link, highest precedence first. Retains exact link text/options and rejects concurrent changes.
SetWmiFilterAsync
public Task SetWmiFilterAsync(Guid id, string? filterPath, CancellationToken cancellationToken = default)Associates an explicit WMI-filter directory path; null removes the association.
UpdateLinkAsync
public Task UpdateLinkAsync(Guid id, string targetDistinguishedName, bool? enabled = null, bool? enforced = null, CancellationToken cancellationToken = default)Updates selected direct-link flags. Separate native changes are not transactional.