From 1499b2166d73c6cedb40809a4d82a546a093c7a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Przemys=C5=82aw=20K=C5=82ys?= Date: Tue, 28 Apr 2020 22:31:45 +0200 Subject: [PATCH] Update --- .../Example-16-AddRemoveGPOPermission01.ps1 | 4 +- ...> Example-16-AddRemoveGPOPermission03.ps1} | 3 +- .../Example-16-AddRemoveGPOPermission04.ps1 | 11 + Public/Get-GPOZaurr.ps1 | 9 +- Public/Get-GPOZaurrLink.ps1 | 37 +++- Public/Invoke-GPOZaurrPermission.ps1 | 208 ++++++++++++------ Public/Set-GPOZaurrOwner.ps1 | 6 +- 7 files changed, 192 insertions(+), 86 deletions(-) rename Examples/{Example-16-AddRemoveGPOPermission.ps1 => Example-16-AddRemoveGPOPermission03.ps1} (80%) create mode 100644 Examples/Example-16-AddRemoveGPOPermission04.ps1 diff --git a/Examples/Example-16-AddRemoveGPOPermission01.ps1 b/Examples/Example-16-AddRemoveGPOPermission01.ps1 index 32d750e..e598d1e 100644 --- a/Examples/Example-16-AddRemoveGPOPermission01.ps1 +++ b/Examples/Example-16-AddRemoveGPOPermission01.ps1 @@ -5,13 +5,13 @@ Clear-Host $T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-IncludeGPOObject #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject $T | Format-Table -AutoSize * -Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoApply -Principal 'przemyslaw.klys' -Verbose +Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -Verbose $T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject $T | Format-Table -AutoSize * Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -Verbose -Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose +Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose $T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject $T | Format-Table -AutoSize * \ No newline at end of file diff --git a/Examples/Example-16-AddRemoveGPOPermission.ps1 b/Examples/Example-16-AddRemoveGPOPermission03.ps1 similarity index 80% rename from Examples/Example-16-AddRemoveGPOPermission.ps1 rename to Examples/Example-16-AddRemoveGPOPermission03.ps1 index 1c5b947..0f0d6f6 100644 --- a/Examples/Example-16-AddRemoveGPOPermission.ps1 +++ b/Examples/Example-16-AddRemoveGPOPermission03.ps1 @@ -9,8 +9,7 @@ $RootGroups = @( ) - -Invoke-GPOZaurrPermission -Linked Root -Verbose { #-IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -Type NotAdministrative, NotWellKnownAdministrative -Verbose { +Invoke-GPOZaurrPermission -Linked Root -Verbose { Set-GPOOwner -Type Administrative #Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins' #Set-GPOOwner -Principal 'Domain Admins' diff --git a/Examples/Example-16-AddRemoveGPOPermission04.ps1 b/Examples/Example-16-AddRemoveGPOPermission04.ps1 new file mode 100644 index 0000000..e05229a --- /dev/null +++ b/Examples/Example-16-AddRemoveGPOPermission04.ps1 @@ -0,0 +1,11 @@ +Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force + +Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=Computers,OU=Production,DC=ad,DC=evotec,DC=xyz' { + Set-GPOOwner -Type Administrative + #Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins' + #Set-GPOOwner -Principal 'Domain Admins' + #Remove-GPOPermission -Type Administrative -IncludePermissionType GPOCustom + Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity + #Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity + #Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity +} #-WhatIf #| Format-Table * \ No newline at end of file diff --git a/Public/Get-GPOZaurr.ps1 b/Public/Get-GPOZaurr.ps1 index dd32767..3d0d575 100644 --- a/Public/Get-GPOZaurr.ps1 +++ b/Public/Get-GPOZaurr.ps1 @@ -12,10 +12,15 @@ [switch] $PermissionsOnly, [switch] $OwnerOnly, - [switch] $Limited + [switch] $Limited, + + [System.Collections.IDictionary] $ADAdministrativeGroups ) Begin { - $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation + if (-not $ADAdministrativeGroups) { + Write-Verbose "Get-GPOZaurr - Getting ADAdministrativeGroups" + $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation + } if (-not $GPOPath) { $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation } diff --git a/Public/Get-GPOZaurrLink.ps1 b/Public/Get-GPOZaurrLink.ps1 index 53d1228..1509cce 100644 --- a/Public/Get-GPOZaurrLink.ps1 +++ b/Public/Get-GPOZaurrLink.ps1 @@ -1,19 +1,42 @@ function Get-GPOZaurrLink { [cmdletbinding()] param( - [parameter(ValueFromPipeline, ValueFromPipelineByPropertyName)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject, - [switch] $Limited, - [System.Collections.IDictionary] $GPOCache, + [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject, # weirdly enough site doesn't really work this way unless you give it 'CN=Configuration,DC=ad,DC=evotec,DC=xyz' as SearchBase - [string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')", - [string] $SearchBase, - [Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope, + [parameter(ParameterSetName = 'Filter')][string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')", + [parameter(ParameterSetName = 'Filter')][string] $SearchBase, + [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope, - [validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked, + [parameter(ParameterSetName = 'Linked',Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked, + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] + [switch] $Limited, + + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] + [System.Collections.IDictionary] $GPOCache, + + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] [alias('ForestName')][string] $Forest, + + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] [string[]] $ExcludeDomains, + + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] [alias('Domain', 'Domains')][string[]] $IncludeDomains, + + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] [System.Collections.IDictionary] $ExtendedForestInformation ) Begin { diff --git a/Public/Invoke-GPOZaurrPermission.ps1 b/Public/Invoke-GPOZaurrPermission.ps1 index d54b5e1..d959af7 100644 --- a/Public/Invoke-GPOZaurrPermission.ps1 +++ b/Public/Invoke-GPOZaurrPermission.ps1 @@ -1,18 +1,100 @@ function Invoke-GPOZaurrPermission { [cmdletBinding(SupportsShouldProcess)] param( + [Parameter(ParameterSetName = 'GPOGUID')] + [Parameter(ParameterSetName = 'GPOName')] + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] + [parameter(Position = 0)] [scriptblock] $PermissionRules, - [validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked, - [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType, - [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType, + + [Parameter(ParameterSetName = 'GPOName')][string] $GPOName, + + [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid, + + + [parameter(ParameterSetName = 'Linked', Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked, + + [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject, + + [parameter(ParameterSetName = 'Filter')][string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')", + [parameter(ParameterSetName = 'Filter')][string] $SearchBase, + [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope, + + [Parameter(ParameterSetName = 'GPOGUID')] + [Parameter(ParameterSetName = 'GPOName')] + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'All')][string[]] $Type, + + [Parameter(ParameterSetName = 'GPOGUID')] + [Parameter(ParameterSetName = 'GPOName')] + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] [Array] $ApprovedGroups, + + [Parameter(ParameterSetName = 'GPOGUID')] + [Parameter(ParameterSetName = 'GPOName')] + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] [alias('Principal')][Array] $Trustee, + + [Parameter(ParameterSetName = 'GPOGUID')] + [Parameter(ParameterSetName = 'GPOName')] + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] [Microsoft.GroupPolicy.GPPermissionType] $TrusteePermissionType, - [alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName' + + [Parameter(ParameterSetName = 'GPOGUID')] + [Parameter(ParameterSetName = 'GPOName')] + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] + [alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName', + + [Parameter(ParameterSetName = 'GPOGUID')] + [Parameter(ParameterSetName = 'GPOName')] + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] + [System.Collections.IDictionary] $GPOCache, + + [Parameter(ParameterSetName = 'GPOGUID')] + [Parameter(ParameterSetName = 'GPOName')] + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] + [alias('ForestName')][string] $Forest, + + [Parameter(ParameterSetName = 'GPOGUID')] + [Parameter(ParameterSetName = 'GPOName')] + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] + [string[]] $ExcludeDomains, + + [Parameter(ParameterSetName = 'GPOGUID')] + [Parameter(ParameterSetName = 'GPOName')] + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] + [alias('Domain', 'Domains')][string[]] $IncludeDomains, + + [Parameter(ParameterSetName = 'GPOGUID')] + [Parameter(ParameterSetName = 'GPOName')] + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] + [System.Collections.IDictionary] $ExtendedForestInformation ) Begin { $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation + <# $Script:Actions = @{ GpoApply = @{ Remove = @{ @@ -65,10 +147,13 @@ } } } + #> } Process { + if ($PermissionRules) { $Rules = & $PermissionRules + <# foreach ($Rule in $Rules) { #$Actions["$Rule."] @@ -80,81 +165,62 @@ #$Actions.Remove.NotAdministrative = $true } } - #$RemoveRules = $Rules | Where-Object { $_.Action -eq 'Remove' } - #$AddRules = $Rules | Where-Object { $_.Action -eq 'Add' } + #> } - Get-GPOZaurrLink -Linked $Linked | ForEach-Object -Process { - $GPO = $_ - #$GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID <#-IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -Type $Type#> -IncludeGPOObject - #foreach ($Permission in $Script:Actions.Keys) { - # $Script:Actions[$Permission] - #} + if ($GPOName -or $GPOGuid) { - foreach ($Rule in $Rules) { - if ($Rule.Action -eq 'Owner') { - if ($Rule.Type -eq 'Administrative') { - $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"] - if (-not $AdministrativeGroup) { - $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] - Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal" - Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference + } else { + + $Splat = @{ } + if ($ADObject) { + $Splat['ADObject'] = $ADObject + } elseif ($Linked) { + $Splat['Linked'] = $Linked + } else { + if ($Filter) { + $Splat['Filter'] = $Filter + } + if ($SearchBase) { + $Splat['SearchBase'] = $SearchBase + } + if ($SearchScope) { + $Splat['SearchScope'] = $SearchScope + } + } + + Get-GPOZaurrLink @Splat | ForEach-Object -Process { + $GPO = $_ + foreach ($Rule in $Rules) { + if ($Rule.Action -eq 'Owner') { + if ($Rule.Type -eq 'Administrative') { + $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"] + if (-not $AdministrativeGroup) { + $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] + Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal" + Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference + } + } elseif ($Rule.Type -eq 'Default') { + Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)" + Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference } - } elseif ($Rule.Type -eq 'Default') { - Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)" - Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference + continue } - continue - } - if ($Rule.Action -eq 'Remove') { - $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject - foreach ($Permission in $GPOPermissions) { - Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission -IncludeDomains $GPO.DomainName + if ($Rule.Action -eq 'Remove') { + $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject + foreach ($Permission in $GPOPermissions) { + Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission #-IncludeDomains $GPO.DomainName + } + continue + } + if ($Rule.Action -eq 'Add') { + #$GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type 'All' -IncludeGPOObject + # foreach ($Permission in $GPOPermissions) { + Add-GPOZaurrPermission -GPOGuid $_.GUID -IncludeDomains $GPO.DomainName -Type $Rule.Type -PermissionType $Rule.IncludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups + # } } - continue - } - if ($Rule.Action -eq 'Add') { - #$GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type 'All' -IncludeGPOObject - # foreach ($Permission in $GPOPermissions) { - Add-GPOZaurrPermission -GPOGuid $_.GUID -IncludeDomains $GPO.DomainName -Type $Rule.Type -PermissionType $Rule.IncludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups - # } } } - - <# - foreach ($Rule in $Rules) { - if ($Rule.Action -eq 'Remove') { - foreach ($Permission in $GPOPermissions) { - - #$Permission - #Write-Verbose "Remove-GPOZaurrPermission1 - Removing permission $IncludePermissionType for $($Permission.Name) / $($Permission.Permission)" - Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission - # $Permission - #Remove-GPOZaurrPermission -Type 'Default' -Principal $Permission.Sid - - } - } - if ($Rule.Action -eq 'Add') { - foreach ($Permission in $GPOPermissions) { - - } - } - } - #> - <# - Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -Type $Type -IncludeGPOObject | ForEach-Object { - $Permission = $_ - $Permission | Format-Table -a * - foreach ($Rule in $Rules) { - if ($Rule.Action -eq 'Remove') { - #$Permission - Write-Verbose "Remove-GPOZaurrPermission1 - Removing permission $IncludePermissionType for $($Permission.Name) / $($Permission.Permission)" - Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission - # $Permission - #Remove-GPOZaurrPermission -Type 'Default' -Principal $Permission.Sid - - } - } - } - #> } } End { diff --git a/Public/Set-GPOZaurrOwner.ps1 b/Public/Set-GPOZaurrOwner.ps1 index 6b3b1ac..03af7dc 100644 --- a/Public/Set-GPOZaurrOwner.ps1 +++ b/Public/Set-GPOZaurrOwner.ps1 @@ -32,12 +32,14 @@ [int] $LimitProcessing ) Begin { + Write-Verbose "Set-GPOZaurrOwner - Getting ADAdministrativeGroups" $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation $Count = 0 + Write-Verbose "Set-GPOZaurrOwner - Processing GPOs for Type $Type" } Process { if ($Type) { - Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Verbose:$false | ForEach-Object -Process { + Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -ADAdministrativeGroups $ADAdministrativeGroups -OwnerOnly | ForEach-Object -Process { $GPO = $_ if ($Type -contains 'All') { # Regardless who is the owner it is overwritten @@ -91,7 +93,7 @@ } } } else { - Get-GPOZaurr -GPOName $GPOName -GPOGuid $GPOGUiD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Verbose:$false | ForEach-Object -Process { + Get-GPOZaurr -GPOName $GPOName -GPOGuid $GPOGUiD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Verbose:$false -ADAdministrativeGroups $ADAdministrativeGroups | ForEach-Object -Process { $GPO = $_ if ($Principal) { Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"