diff --git a/Examples/Example-09-RemovingGPOPermissionUnknown.ps1 b/Examples/Example-09-RemovingGPOPermissionUnknown.ps1 index fd0a2e5..9f272fe 100644 --- a/Examples/Example-09-RemovingGPOPermissionUnknown.ps1 +++ b/Examples/Example-09-RemovingGPOPermissionUnknown.ps1 @@ -1,3 +1,3 @@ Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force - -Remove-GPOZaurrPermission -Verbose -Type Unknown -WhatIf -LimitProcessing 1 \ No newline at end of file +#Clear-Host +Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 1 #-WhatIf \ No newline at end of file diff --git a/Public/Remove-GPOZaurrPermission.ps1 b/Public/Remove-GPOZaurrPermission.ps1 index ff7e178..e238825 100644 --- a/Public/Remove-GPOZaurrPermission.ps1 +++ b/Public/Remove-GPOZaurrPermission.ps1 @@ -26,8 +26,6 @@ ) Begin { $Count = 0 - $StopMe = $false - $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation if ($Type -eq 'Unknown') { @@ -89,8 +87,10 @@ ADAdministrativeGroups = $ADAdministrativeGroups } [Array] $GPOPermissions = Get-PrivPermission @getPrivPermissionSplat - foreach ($Permission in $GPOPermissions) { - Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission #-IncludeDomains $GPO.DomainName + if ($GPOPermissions.Count -gt 0) { + foreach ($Permission in $GPOPermissions) { + Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission #-IncludeDomains $GPO.DomainName + } $Count++ if ($Count -eq $LimitProcessing) { # skipping skips per removed permission not per gpo.