gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-07-26 11:49:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-10-22 13:42:27 +02:00
parent b3e15d66ea
commit 191b709ccf
6 changed files with 57 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
GPOZaurr.psd1
+1 -1
View File
@@ -8,7 +8,7 @@
Description = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
FunctionsToExport = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Show-GPOZaurr')
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
ModuleVersion = '0.0.65'
ModuleVersion = '0.0.66'
PowerShellVersion = '5.1'
PrivateData = @{
PSData = @{
Private/Test-SysvolFolders.ps1
+4 -4
View File
@@ -13,7 +13,7 @@
$GPOGUIDS = $GPOs.ID.GUID
$SysVolPath = "\\$($Server)\SYSVOL\$Domain\Policies"
try {
$SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -Exclude 'PolicyDefinitions' -ErrorAction Stop
$SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -Exclude 'PolicyDefinitions' -ErrorAction Stop -Verbose:$false
} catch {
$Sysvol = $Null
}
@@ -50,11 +50,11 @@
if ($null -ne $SysvolHash[$GPO.Id.GUID].FullName) {
$FullPath = $SysvolHash[$GPO.Id.GUID].FullName
try {
$ACL = Get-Acl -Path $SysvolHash[$GPO.Id.GUID].FullName -ErrorAction Stop
$ACL = Get-Acl -Path $SysvolHash[$GPO.Id.GUID].FullName -ErrorAction Stop -Verbose:$false
$Owner = $ACL.Owner
$ErrorMessage = ''
} catch {
Write-Warning "Get-GPOZaurrSysvol - ACL reading (1) failed for $FullPath with error: $($_.Exception.Message)"
Write-Warning "Get-GPOZaurrBroken - ACL reading (1) failed for $FullPath with error: $($_.Exception.Message)"
$ACL = $null
$Owner = ''
$ErrorMessage = $_.Exception.Message
@@ -100,7 +100,7 @@
$Owner = $ACL.Owner
$ErrorMessage = ''
} catch {
Write-Warning "Get-GPOZaurrSysvol - ACL reading (2) failed for $FullPath with error: $($_.Exception.Message)"
Write-Warning "Get-GPOZaurrBroken - ACL reading (2) failed for $FullPath with error: $($_.Exception.Message)"
$ACL = $null
$Owner = $null
$ErrorMessage = $_.Exception.Message
Public/Get-GPOZaurrBroken.ps1
+7 -4
View File
@@ -14,7 +14,8 @@
)
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExcludeDomainControllers $ExcludeDomainControllers -IncludeDomainControllers $IncludeDomainControllers -SkipRODC:$SkipRODC -ExtendedForestInformation $ExtendedForestInformation -Extended
foreach ($Domain in $ForestInformation.Domains) {
Write-Verbose "Get-WinADGPOSysvolFolders - Processing $Domain"
$TimeLog = Start-TimeLog
Write-Verbose "Get-GPOZaurrBroken - Starting process for $Domain"
$QueryServer = $ForestInformation['QueryServers']["$Domain"].HostName[0]
$SystemsContainer = $ForestInformation['DomainsExtended'][$Domain].SystemsContainer
$PoliciesAD = @{}
@@ -35,7 +36,7 @@
Try {
[Array]$GPOs = Get-GPO -All -Domain $Domain -Server $QueryServer
} catch {
Write-Warning "Get-GPOZaurrSysvol - Couldn't get GPOs from $Domain. Error: $($_.Exception.Message)"
Write-Warning "Get-GPOZaurrBroken - Couldn't get GPOs from $Domain. Error: $($_.Exception.Message)"
continue
}
if ($GPOs.Count -ge 2) {
@@ -43,12 +44,14 @@
Test-SysVolFolders -GPOs $GPOs -Server $Domain -Domain $Domain -PoliciesAD $PoliciesAD -PoliciesSearchBase $PoliciesSearchBase
} else {
foreach ($Server in $ForestInformation['DomainDomainControllers']["$Domain"]) {
Write-Verbose "Get-GPOZaurrSysvol - Processing $Domain \ $($Server.HostName.Trim())"
Write-Verbose "Get-GPOZaurrBroken - Processing $Domain \ $($Server.HostName.Trim())"
Test-SysVolFolders -GPOs $GPOs -Server $Server.Hostname -Domain $Domain -PoliciesAD $PoliciesAD -PoliciesSearchBase $PoliciesSearchBase
}
}
} else {
Write-Warning "Get-GPOZaurrSysvol - GPO count for $Domain is less then 2. This is not expected for fully functioning domain. Skipping processing SYSVOL folder."
Write-Warning "Get-GPOZaurrBroken - GPO count for $Domain is less then 2. This is not expected for fully functioning domain. Skipping processing SYSVOL folder."
}
$TimeEnd = Stop-TimeLog -Time $TimeLog -Option OneLiner
Write-Verbose "Get-GPOZaurrBroken - Finishing process for $Domain (Time to process: $TimeEnd)"
}
}
Public/Get-GPOZaurrPermissionConsistency.ps1
+4
View File
@@ -16,6 +16,8 @@
}
Process {
foreach ($Domain in $ForestInformation.Domains) {
$TimeLog = Start-TimeLog
Write-Verbose "Get-GPOZaurrPermissionConsistency - Starting process for $Domain"
$QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
if ($GPOName) {
$getGPOSplat = @{
@@ -120,6 +122,8 @@
}
}
}
$TimeEnd = Stop-TimeLog -Time $TimeLog -Option OneLiner
Write-Verbose "Get-GPOZaurrPermissionConsistency - Finishing process for $Domain (Time to process: $TimeEnd)"
}
}
End {
Public/Get-GPOZaurrPermissionRoot.ps1
+2 -3
View File
@@ -23,9 +23,8 @@
ADRightsAsArray = $true
ResolveTypes = $true
}
$GPOPermissionsGlobal = Get-ADACL @getADACLSplat #-Verbose
$GPOs = Get-ADObject -SearchBase "CN=Policies,CN=System,$DomainDistinguishedName" -SearchScope OneLevel -Filter * -Properties DisplayName -Server $QueryServer
$GPOPermissionsGlobal = Get-ADACL @getADACLSplat -Verbose:$false
$GPOs = Get-ADObject -SearchBase "CN=Policies,CN=System,$DomainDistinguishedName" -SearchScope OneLevel -Filter * -Properties DisplayName -Server $QueryServer -Verbose:$false
foreach ($Permission in $GPOPermissionsGlobal) {
$CustomPermission = foreach ($_ in $Permission.ActiveDirectoryRights) {
if ($_ -in 'WriteDACL', 'WriteOwner', 'GenericAll' ) {
Public/Show-GPOZaurr.ps1
+39 -1
View File
@@ -7,8 +7,31 @@
'GPOConsistency', 'GPOOwners', 'GPOAnalysis', 'NetLogon'
)][string[]] $Type
)
$Script:Reporting = [ordered] @{
}
# Provide version check for easy use
$GPOZaurrVersion = Get-Command -Name 'Show-GPOZaurr' -ErrorAction SilentlyContinue
[Array] $GitHubReleases = (Get-GitHubLatestRelease -Url "https://api.github.com/repos/evotecit/GpoZaurr/releases")
$LatestVersion = $GitHubReleases[0]
if (-not $LatestVersion.Errors) {
if ($GPOZaurrVersion.Version -eq $LatestVersion.Version) {
$Script:Reporting['Version'] = "GPOZaurr Current/Latest: $($LatestVersion.Version) at $($LatestVersion.PublishDate)"
} elseif ($GPOZaurrVersion.Version -lt $LatestVersion.Version) {
$Script:Reporting['Version'] = "GPOZaurr Current: $($GPOZaurrVersion.Version), Published: $($LatestVersion.Version) at $($LatestVersion.PublishDate). Update?"
} elseif ($GPOZaurrVersion.Version -gt $LatestVersion.Version) {
$Script:Reporting['Version'] = "GPOZaurr Current: $($GPOZaurrVersion.Version), Published: $($LatestVersion.Version) at $($LatestVersion.PublishDate). Lucky you!"
}
} else {
$Script:Reporting['Version'] = "GPOZaurr Current: $($GPOZaurrVersion.Version)"
}
# Gather data
$TimeLog = Start-TimeLog
if ($Type -contains 'GPOList' -or $null -eq $Type) {
#Write-Color -Text "[Info] ", "Processing GPO List" -Color Yellow, White
$TimeLogGPOList = Start-TimeLog
Write-Verbose -Message "Show-GPOZaurr - Processing GPO List"
$GPOSummary = Get-GPOZaurr
$GPOLinkedStatus = $GPOSummary.Where( { $_.Linked -eq $true }, 'split')
@@ -18,6 +41,7 @@
[Array] $GPOEmpty = $GPOEmptyStatus[0]
[Array] $GPONotEmpty = $GPOEmptyStatus[1]
$GPOTotal = $GPOSummary.Count
$TimeEndGPOList = Stop-TimeLog -Time $TimeLog -Option OneLiner
}
if ($Type -contains 'GPOOrphans' -or $null -eq $Type) {
#Write-Color -Text "[Info] ", "Processing GPOOrphans" -Color Yellow, White
@@ -70,13 +94,27 @@
Write-Verbose "Show-GPOZaurr - Processing GPOFiles"
$GPOFiles = Get-GPOZaurrFiles
}
$TimeEnd = Stop-TimeLog -Time $TimeLog -Option OneLiner
# Generate pretty HTML
Write-Verbose "Show-GPOZaurr - Generating HTML"
New-HTML {
New-HTMLTabStyle -BorderRadius 0px -TextTransform capitalize -BackgroundColorActive SlateGrey
New-HTMLSectionStyle -BorderRadius 0px -HeaderBackGroundColor Grey -RemoveShadow
New-HTMLPanelStyle -BorderRadius 0px -RemoveShadow
New-HTMLTableOption -DataStore JavaScript -BoolAsString
New-HTMLHeader {
New-HTMLSection -Invisible {
New-HTMLSection {
New-HTMLText -Text "Report generated on $(Get-Date)" -Color Blue
} -JustifyContent flex-start -Invisible
New-HTMLSection {
New-HTMLText -Text $Script:Reporting['Version'] -Color Blue
} -JustifyContent flex-end -Invisible
}
}
New-HTMLTab -Name 'Overview' {
if ($Type -contains 'GPOConsistency' -or $Type -contains 'GPOList' -or $null -eq $Type) {
New-HTMLSection -Invisible {