Creates and links group policies in the specified domain for provisioning required access settings on the servers managed by the computer running the IPAM server.
Networking / Security · Risk: High · Documentation Verified
Last verified: 2026-10-26
Microsoft IpamServer reference: Creates and links group policies in the specified domain for provisioning required access settings on the servers managed by the computer running the IPAM server. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Invoke-IpamGpoProvisioning. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / IpamServer · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-Confirm
Prompts you for confirmation before running the cmdlet.
-DelegatedGpoGroup
Specifies the comma separated list of domain groups which are delegated edit permissions on the three IPAM GPOs created by this cmdlet. The standard GPO delegation privilege of Edit settings, Delete, Modify Security is enabled for these groups. Delegation for users or groups without domain administrator privileges can also be enabled from GPMC or GPO cmdlets for the existing IPAM GPOs. This delegation is leveraged by the computer running the IPAM server to automatically edit the GPO filter list in security context of the logged in user who is modifying the server manageability status from the IPAM server inventory view.
-DelegatedGpoUser
Specifies the comma separated list of domain users which are delegated edit permissions on the three IPAM GPOs created by this cmdlet. The standard GPO delegation privilege of Edit settings, Delete, Modify Security is enabled for these users. Delegation for users or groups without domain administrator privileges can also be enabled from GPMC or GPO cmdlets for the existing IPAM GPOs. This delegation is leveraged by the computer running the IPAM server to automatically edit the GPO filter list in security context of the logged in user who is modifying the server manageability status from the IPAM server inventory view.
-Domain (required)
Specifies the FQDN of the domain for which the IPAM GPOs are created and linked. Specify only one domain name at a time. This cmdlet needs to be invoked one by one for each domain in the Active Directory (AD) forest that needs to be managed by the computer running IPAM server.
-DomainController
Specifies the name of the domain controller that is contacted to complete the GPO operation. Either the FQDN or simply the host name of the domain controller can be specified. A valid domain controller name for the specified domain must be provided. By default, the computer running the IPAM server contacts the PDC emulator of the specified domain unless this parameter is explicitly provided.
-Force
Forces the command to run without asking for user confirmation.
-GpoPrefixName (required)
Specifies the unique GPO prefix name to use when creating the group policy objects. The GPO prefix name, such as IPAMGPO_ServerX, specified here must be same as the one specified in the IPAM provisioning wizard while selecting Group Policy based provisioning method. The three IPAM GPOs are created with the suffixes _DHCP, _DNS, and _DC_NPS appended to this parameter value, such as IPAMGPO_ServerX_DHCP, IPAMGPO_ServerX_DNS, and IPAMGPO_ServerX_DC_NPS. These suffixes signify the three different types of access settings that are propagated by them depending on the type of server role managed by the computer running the IPAM server.
-IpamServerFqdn
Specifies the FQDN of the computer running the IPAM server for which the GPOs enables access settings. By default, IPAM uses the FQDN of the computer running the IPAM server from where the cmdlet is running to enable access settings. The specified computer account is added to the universal group named IPAMUG created by this cmdlet.
-PassThru
Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.
Prerequisites
Windows with the IpamServer module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.
This command creates the universal group IPAMUG in the domain named child.contoso,com, if not already present, and adds the computer account of the local computer running the IPAM server to the group. This cmdlet creates and links the following IPAM GPOs: IPAM1_DHCP, IPAM1_DNS, and IPAM1_DC_NPS in the child.contoso.com domain to enable access for the group IPAMUG. This cmdlet also enables DNS read access for IPAMUG using domain wide DNS ACL. Since the domain controller is not explicitly specified, this cmdlet contacts the PDC emulator to complete the GPO operations. This cmdlet suppresses the default confirmation text. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.