Undocumented Behaviour

[Air-Git]

There seems to be some undocumented behaviour in the way that Group Policy permissions are Get and Set.
If you use Get-GPPermissions with the -All parameter, you might get two permission objects for the same trustee. For example, a trustee might have both a "GpoApply" permission object, and a "GpoEdit". The difference seems to relate to "Apply" permissions and "Delegation" permissions. "Apply" is Apply or Deny, while Delegation is Read, Edit, or EditDeleteModifySecurity. This corresponds to Security Filtering, and Delegation, in the GUI.
When you use Set-GPPermission, you need to specify the trustee (both the "targetName" and the "targetType", e.g. "Domain Admins, Group). But if permissions are already set, which of the two permissions would it target? If you set -PermissionLevel to be GpoRead, would this overwrite the Apply permission or the GpoEdit permission?

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: 4bd298c8-2295-4e08-1eb8-9bdd8ee3638a
• Version Independent ID: 5975ed60-c9af-e80a-5289-a904fc5ec2aa
• Content: Set-GPPermission (GroupPolicy)
• Content Source: docset/winserver2022-ps/grouppolicy/Set-GPPermission.md
• Product: w10
• GitHub Login: @JasonGerend
• Microsoft Alias: jgerend

[officedocspr5]

To make it easier for you to submit feedback on articles on learn.microsoft.com, we're transitioning our feedback system from GitHub Issues to a new experience.

As part of the transition, this GitHub Issue will be moved to a private repository. We're moving Issues to another repository so we can continue working on Issues that were open at the time of the transition. When this Issue is moved, you'll no longer be able to access it.

If you want to provide additional information before this Issue is moved, please update this Issue before December 15th, 2023.

With the new experience, you no longer need to sign in to GitHub to enter and submit your feedback. Instead, you can choose directly on each article's page whether the article was helpful. Then you can then choose one or more reasons for your feedback and optionally provide additional context before you select Submit.

Here's what the new experience looks like.

Note: The new experience is being rolled out across learn.microsoft.com in phases. If you don't see the new experience on an article, please check back later.

First, select whether the article was helpful:

Then, choose at least one reason for your feedback and optionally provide additional details about your feedback:

Article was helpful	Article was unhelpful

Finally, select Submit and you're done!