SOLVED: Script To Search All GPO’s For Software Installs

A few days ago we had a client who had some software get reinstalled automatically after they manually uninstalled it. The tech that had originally managed this software has left the company and we are now managing their infrastructure. Naturally the client turned to us and asked if we could search through all of their Group Policies to figure out which one was reinstalling this software.

The problem here was this is a medium sized client with hundreds of GPOs and a software install could be included in any of them including the default domain policy, although that would be odd. Naturally we turn to our scripting genius, Khalid Abdullahi, who developed this simple script which searches through all GPO’s and then lists the ones that it finds with Software Installations.

So that the entire script would fit on the screen with the results we also ran this on a much smaller clients and you can see the output here:

# Khalid Abdullahi of www.URTech.ca - Oct 2024
# Import Group Policy module
Import-Module GroupPolicy

# Get all GPOs and sort them alphabetically
$GPOs = Get-GPO -All | Sort-Object DisplayName

# Initialize an array to store GPOs with software installations
$SoftwareInstallationGPOs = @()

# Loop through each GPO and check for software installations
foreach ($GPO in $GPOs) {
    Write-Output "Checking GPO: '$($GPO.DisplayName)'"
    $Report = Get-GPOReport -Guid $GPO.Id -ReportType XML
    if ($Report -match "<Name>Software Installation</Name>") {
        $SoftwareInstallationGPOs += $GPO.DisplayName
    }
}

# Output list of GPOs with software installations or that there are none
if ($SoftwareInstallationGPOs.Count -gt 0) {
    Write-Output "The following GPOs have software installations:"
    $SoftwareInstallationGPOs | Sort-Object | ForEach-Object { Write-Output $_ }
} else {
    Write-Output "There are no GPOs in this domain that push software installation."
}

Our techs were then able to review the half a dozen GPO’s that deployed software, and figure out which GPO was reinstalling the software and making our client nuts. Thanks Khalid!