From 0c8e23f6af03cb197426c071c529665a5a5ef29f Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Thu, 5 Nov 2020 23:36:24 +0100 Subject: [PATCH] Update --- Private/Invoke.GPOZaurrOwners.ps1 | 53 ++++++++++++++++--------------- Public/Invoke-GPOZaurr.ps1 | 5 +-- 2 files changed, 31 insertions(+), 27 deletions(-) diff --git a/Private/Invoke.GPOZaurrOwners.ps1 b/Private/Invoke.GPOZaurrOwners.ps1 index 1f6ab39..4118d9a 100644 --- a/Private/Invoke.GPOZaurrOwners.ps1 +++ b/Private/Invoke.GPOZaurrOwners.ps1 @@ -52,34 +52,37 @@ } -Title 'Group Policy Owners' -TitleAlignment center } } + Summary = { + New-HTMLText -FontSize 10pt -TextBlock { + "By default GPO creation is usually maintained by Domain Admins or Enterprise Admins. " + "When GPO is created by member of Domain Admins or Enterprise Admins group the GPO Owner is set to Domain Admins. " + "When GPO is created by member of Group Policy Creator Owners or other group has delegated rights to create a GPO the owner of said GPO is not Domain Admins group but is assigned to relevant user. " + "GPO Owners should be Domain Admins or Enterprise Admins to prevent abuse. If that isn't so it means owner is able to fully control GPO and potentially change it's settings in uncontrolled way. " + "While at the moment of creation of new GPO it's not a problem, in long term it's possible such person may no longer be admin, yet keep their rights over GPO. " + } + New-HTMLText -FontSize 10pt -TextBlock { + "As you're aware Group Policies are stored in 2 places. In Active Directory (metadata) and SYSVOL (settings). This means that there are 2 places where GPO Owners exists. " + "This also means that for multiple reasons AD and SYSVOL can be out of sync when it comes to their permissions which can lead to uncontrolled ability to modify them. " + "Ownership in Active Directory and Ownership of SYSVOL for said GPO are required to be the same. " + } + New-HTMLText -Text "Here's a short summary of ", "Group Policy Owners", ": " -FontSize 10pt -FontWeight normal, bold, normal + New-HTMLList -Type Unordered { + New-HTMLListItem -Text 'Administrative Owners: ', $GpoZaurrOwners['Variables']['IsAdministrative'] -FontWeight normal, bold + New-HTMLListItem -Text 'Non-Administrative Owners: ', $GpoZaurrOwners['Variables']['IsNotAdministrative'] -FontWeight normal, bold + New-HTMLListItem -Text "Owners consistent in AD and SYSVOL: ", $GpoZaurrOwners['Variables']['IsConsistent'] -FontWeight normal, bold + New-HTMLListItem -Text "Owners not-consistent in AD and SYSVOL: ", $GpoZaurrOwners['Variables']['IsNotConsistent'] -FontWeight normal, bold + } -FontSize 10pt + New-HTMLText -FontSize 10pt -Text "This gives us: " + New-HTMLList -Type Unordered { + New-HTMLListItem -Text 'Group Policies requiring owner change: ', $GpoZaurrOwners['Variables']['WillFix'] -FontWeight normal, bold + New-HTMLListItem -Text "Group Policies which can't be fixed (no SYSVOL?): ", $GpoZaurrOwners['Variables']['RequiresDiffFix'] -FontWeight normal, bold + New-HTMLListItem -Text "Group Policies unaffected: ", $GpoZaurrOwners['Variables']['WillNotTouch'] -FontWeight normal, bold + } -FontSize 10pt + } Solution = { New-HTMLSection -Invisible { New-HTMLPanel { - New-HTMLText -FontSize 10pt -TextBlock { - "By default GPO creation is usually maintained by Domain Admins or Enterprise Admins. " - "When GPO is created by member of Domain Admins or Enterprise Admins group the GPO Owner is set to Domain Admins. " - "When GPO is created by member of Group Policy Creator Owners or other group has delegated rights to create a GPO the owner of said GPO is not Domain Admins group but is assigned to relevant user. " - "GPO Owners should be Domain Admins or Enterprise Admins to prevent abuse. If that isn't so it means owner is able to fully control GPO and potentially change it's settings in uncontrolled way. " - "While at the moment of creation of new GPO it's not a problem, in long term it's possible such person may no longer be admin, yet keep their rights over GPO. " - } - New-HTMLText -FontSize 10pt -TextBlock { - "As you're aware Group Policies are stored in 2 places. In Active Directory (metadata) and SYSVOL (settings). This means that there are 2 places where GPO Owners exists. " - "This also means that for multiple reasons AD and SYSVOL can be out of sync when it comes to their permissions which can lead to uncontrolled ability to modify them. " - "Ownership in Active Directory and Ownership of SYSVOL for said GPO are required to be the same. " - } - New-HTMLText -Text "Here's a short summary of ", "Group Policy Owners", ": " -FontSize 10pt -FontWeight normal, bold, normal - New-HTMLList -Type Unordered { - New-HTMLListItem -Text 'Administrative Owners: ', $GpoZaurrOwners['Variables']['IsAdministrative'] -FontWeight normal, bold - New-HTMLListItem -Text 'Non-Administrative Owners: ', $GpoZaurrOwners['Variables']['IsNotAdministrative'] -FontWeight normal, bold - New-HTMLListItem -Text "Owners consistent in AD and SYSVOL: ", $GpoZaurrOwners['Variables']['IsConsistent'] -FontWeight normal, bold - New-HTMLListItem -Text "Owners not-consistent in AD and SYSVOL: ", $GpoZaurrOwners['Variables']['IsNotConsistent'] -FontWeight normal, bold - } -FontSize 10pt - New-HTMLText -FontSize 10pt -Text "This gives us: " - New-HTMLList -Type Unordered { - New-HTMLListItem -Text 'Group Policies requiring owner change: ', $GpoZaurrOwners['Variables']['WillFix'] -FontWeight normal, bold - New-HTMLListItem -Text "Group Policies which can't be fixed (no SYSVOL?): ", $GpoZaurrOwners['Variables']['RequiresDiffFix'] -FontWeight normal, bold - New-HTMLListItem -Text "Group Policies unaffected: ", $GpoZaurrOwners['Variables']['WillNotTouch'] -FontWeight normal, bold - } -FontSize 10pt + & $GpoZaurrOwners['Summary'] } New-HTMLPanel { New-HTMLChart { diff --git a/Public/Invoke-GPOZaurr.ps1 b/Public/Invoke-GPOZaurr.ps1 index 565b508..4ef2daf 100644 --- a/Public/Invoke-GPOZaurr.ps1 +++ b/Public/Invoke-GPOZaurr.ps1 @@ -4,7 +4,8 @@ param( [string] $FilePath, [string[]] $Type, - [switch] $PassThru + [switch] $PassThru, + [switch] $HideHTML ) Reset-GPOZaurrStatus # This makes sure types are at it's proper status @@ -102,7 +103,7 @@ } } } - } -Online -ShowHTML -FilePath $FilePath + } -Online -ShowHTML:(-not $HideHTML) -FilePath $FilePath if ($PassThru) { $OutputData = Export-GPOZaurr