From 191b709ccfb653568b471bf0c8608ef5d6df9fec Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Thu, 22 Oct 2020 13:42:27 +0200 Subject: [PATCH] Update --- GPOZaurr.psd1 | 2 +- Private/Test-SysvolFolders.ps1 | 8 ++-- Public/Get-GPOZaurrBroken.ps1 | 11 ++++-- Public/Get-GPOZaurrPermissionConsistency.ps1 | 4 ++ Public/Get-GPOZaurrPermissionRoot.ps1 | 5 +-- Public/Show-GPOZaurr.ps1 | 40 +++++++++++++++++++- 6 files changed, 57 insertions(+), 13 deletions(-) diff --git a/GPOZaurr.psd1 b/GPOZaurr.psd1 index 696cdea..72a966a 100644 --- a/GPOZaurr.psd1 +++ b/GPOZaurr.psd1 @@ -8,7 +8,7 @@ Description = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.' FunctionsToExport = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Show-GPOZaurr') GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde' - ModuleVersion = '0.0.65' + ModuleVersion = '0.0.66' PowerShellVersion = '5.1' PrivateData = @{ PSData = @{ diff --git a/Private/Test-SysvolFolders.ps1 b/Private/Test-SysvolFolders.ps1 index 4a96452..68ede98 100644 --- a/Private/Test-SysvolFolders.ps1 +++ b/Private/Test-SysvolFolders.ps1 @@ -13,7 +13,7 @@ $GPOGUIDS = $GPOs.ID.GUID $SysVolPath = "\\$($Server)\SYSVOL\$Domain\Policies" try { - $SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -Exclude 'PolicyDefinitions' -ErrorAction Stop + $SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -Exclude 'PolicyDefinitions' -ErrorAction Stop -Verbose:$false } catch { $Sysvol = $Null } @@ -50,11 +50,11 @@ if ($null -ne $SysvolHash[$GPO.Id.GUID].FullName) { $FullPath = $SysvolHash[$GPO.Id.GUID].FullName try { - $ACL = Get-Acl -Path $SysvolHash[$GPO.Id.GUID].FullName -ErrorAction Stop + $ACL = Get-Acl -Path $SysvolHash[$GPO.Id.GUID].FullName -ErrorAction Stop -Verbose:$false $Owner = $ACL.Owner $ErrorMessage = '' } catch { - Write-Warning "Get-GPOZaurrSysvol - ACL reading (1) failed for $FullPath with error: $($_.Exception.Message)" + Write-Warning "Get-GPOZaurrBroken - ACL reading (1) failed for $FullPath with error: $($_.Exception.Message)" $ACL = $null $Owner = '' $ErrorMessage = $_.Exception.Message @@ -100,7 +100,7 @@ $Owner = $ACL.Owner $ErrorMessage = '' } catch { - Write-Warning "Get-GPOZaurrSysvol - ACL reading (2) failed for $FullPath with error: $($_.Exception.Message)" + Write-Warning "Get-GPOZaurrBroken - ACL reading (2) failed for $FullPath with error: $($_.Exception.Message)" $ACL = $null $Owner = $null $ErrorMessage = $_.Exception.Message diff --git a/Public/Get-GPOZaurrBroken.ps1 b/Public/Get-GPOZaurrBroken.ps1 index e28dfe4..35ab948 100644 --- a/Public/Get-GPOZaurrBroken.ps1 +++ b/Public/Get-GPOZaurrBroken.ps1 @@ -14,7 +14,8 @@ ) $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExcludeDomainControllers $ExcludeDomainControllers -IncludeDomainControllers $IncludeDomainControllers -SkipRODC:$SkipRODC -ExtendedForestInformation $ExtendedForestInformation -Extended foreach ($Domain in $ForestInformation.Domains) { - Write-Verbose "Get-WinADGPOSysvolFolders - Processing $Domain" + $TimeLog = Start-TimeLog + Write-Verbose "Get-GPOZaurrBroken - Starting process for $Domain" $QueryServer = $ForestInformation['QueryServers']["$Domain"].HostName[0] $SystemsContainer = $ForestInformation['DomainsExtended'][$Domain].SystemsContainer $PoliciesAD = @{} @@ -35,7 +36,7 @@ Try { [Array]$GPOs = Get-GPO -All -Domain $Domain -Server $QueryServer } catch { - Write-Warning "Get-GPOZaurrSysvol - Couldn't get GPOs from $Domain. Error: $($_.Exception.Message)" + Write-Warning "Get-GPOZaurrBroken - Couldn't get GPOs from $Domain. Error: $($_.Exception.Message)" continue } if ($GPOs.Count -ge 2) { @@ -43,12 +44,14 @@ Test-SysVolFolders -GPOs $GPOs -Server $Domain -Domain $Domain -PoliciesAD $PoliciesAD -PoliciesSearchBase $PoliciesSearchBase } else { foreach ($Server in $ForestInformation['DomainDomainControllers']["$Domain"]) { - Write-Verbose "Get-GPOZaurrSysvol - Processing $Domain \ $($Server.HostName.Trim())" + Write-Verbose "Get-GPOZaurrBroken - Processing $Domain \ $($Server.HostName.Trim())" Test-SysVolFolders -GPOs $GPOs -Server $Server.Hostname -Domain $Domain -PoliciesAD $PoliciesAD -PoliciesSearchBase $PoliciesSearchBase } } } else { - Write-Warning "Get-GPOZaurrSysvol - GPO count for $Domain is less then 2. This is not expected for fully functioning domain. Skipping processing SYSVOL folder." + Write-Warning "Get-GPOZaurrBroken - GPO count for $Domain is less then 2. This is not expected for fully functioning domain. Skipping processing SYSVOL folder." } + $TimeEnd = Stop-TimeLog -Time $TimeLog -Option OneLiner + Write-Verbose "Get-GPOZaurrBroken - Finishing process for $Domain (Time to process: $TimeEnd)" } } \ No newline at end of file diff --git a/Public/Get-GPOZaurrPermissionConsistency.ps1 b/Public/Get-GPOZaurrPermissionConsistency.ps1 index 6593c49..4a90e79 100644 --- a/Public/Get-GPOZaurrPermissionConsistency.ps1 +++ b/Public/Get-GPOZaurrPermissionConsistency.ps1 @@ -16,6 +16,8 @@ } Process { foreach ($Domain in $ForestInformation.Domains) { + $TimeLog = Start-TimeLog + Write-Verbose "Get-GPOZaurrPermissionConsistency - Starting process for $Domain" $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0] if ($GPOName) { $getGPOSplat = @{ @@ -120,6 +122,8 @@ } } } + $TimeEnd = Stop-TimeLog -Time $TimeLog -Option OneLiner + Write-Verbose "Get-GPOZaurrPermissionConsistency - Finishing process for $Domain (Time to process: $TimeEnd)" } } End { diff --git a/Public/Get-GPOZaurrPermissionRoot.ps1 b/Public/Get-GPOZaurrPermissionRoot.ps1 index 557d1c3..7b665c0 100644 --- a/Public/Get-GPOZaurrPermissionRoot.ps1 +++ b/Public/Get-GPOZaurrPermissionRoot.ps1 @@ -23,9 +23,8 @@ ADRightsAsArray = $true ResolveTypes = $true } - $GPOPermissionsGlobal = Get-ADACL @getADACLSplat #-Verbose - - $GPOs = Get-ADObject -SearchBase "CN=Policies,CN=System,$DomainDistinguishedName" -SearchScope OneLevel -Filter * -Properties DisplayName -Server $QueryServer + $GPOPermissionsGlobal = Get-ADACL @getADACLSplat -Verbose:$false + $GPOs = Get-ADObject -SearchBase "CN=Policies,CN=System,$DomainDistinguishedName" -SearchScope OneLevel -Filter * -Properties DisplayName -Server $QueryServer -Verbose:$false foreach ($Permission in $GPOPermissionsGlobal) { $CustomPermission = foreach ($_ in $Permission.ActiveDirectoryRights) { if ($_ -in 'WriteDACL', 'WriteOwner', 'GenericAll' ) { diff --git a/Public/Show-GPOZaurr.ps1 b/Public/Show-GPOZaurr.ps1 index 2a8126c..ddc56d1 100644 --- a/Public/Show-GPOZaurr.ps1 +++ b/Public/Show-GPOZaurr.ps1 @@ -7,8 +7,31 @@ 'GPOConsistency', 'GPOOwners', 'GPOAnalysis', 'NetLogon' )][string[]] $Type ) + $Script:Reporting = [ordered] @{ + + } + # Provide version check for easy use + $GPOZaurrVersion = Get-Command -Name 'Show-GPOZaurr' -ErrorAction SilentlyContinue + + [Array] $GitHubReleases = (Get-GitHubLatestRelease -Url "https://api.github.com/repos/evotecit/GpoZaurr/releases") + + $LatestVersion = $GitHubReleases[0] + if (-not $LatestVersion.Errors) { + if ($GPOZaurrVersion.Version -eq $LatestVersion.Version) { + $Script:Reporting['Version'] = "GPOZaurr Current/Latest: $($LatestVersion.Version) at $($LatestVersion.PublishDate)" + } elseif ($GPOZaurrVersion.Version -lt $LatestVersion.Version) { + $Script:Reporting['Version'] = "GPOZaurr Current: $($GPOZaurrVersion.Version), Published: $($LatestVersion.Version) at $($LatestVersion.PublishDate). Update?" + } elseif ($GPOZaurrVersion.Version -gt $LatestVersion.Version) { + $Script:Reporting['Version'] = "GPOZaurr Current: $($GPOZaurrVersion.Version), Published: $($LatestVersion.Version) at $($LatestVersion.PublishDate). Lucky you!" + } + } else { + $Script:Reporting['Version'] = "GPOZaurr Current: $($GPOZaurrVersion.Version)" + } + + # Gather data + $TimeLog = Start-TimeLog if ($Type -contains 'GPOList' -or $null -eq $Type) { - #Write-Color -Text "[Info] ", "Processing GPO List" -Color Yellow, White + $TimeLogGPOList = Start-TimeLog Write-Verbose -Message "Show-GPOZaurr - Processing GPO List" $GPOSummary = Get-GPOZaurr $GPOLinkedStatus = $GPOSummary.Where( { $_.Linked -eq $true }, 'split') @@ -18,6 +41,7 @@ [Array] $GPOEmpty = $GPOEmptyStatus[0] [Array] $GPONotEmpty = $GPOEmptyStatus[1] $GPOTotal = $GPOSummary.Count + $TimeEndGPOList = Stop-TimeLog -Time $TimeLog -Option OneLiner } if ($Type -contains 'GPOOrphans' -or $null -eq $Type) { #Write-Color -Text "[Info] ", "Processing GPOOrphans" -Color Yellow, White @@ -70,13 +94,27 @@ Write-Verbose "Show-GPOZaurr - Processing GPOFiles" $GPOFiles = Get-GPOZaurrFiles } + $TimeEnd = Stop-TimeLog -Time $TimeLog -Option OneLiner + # Generate pretty HTML Write-Verbose "Show-GPOZaurr - Generating HTML" New-HTML { New-HTMLTabStyle -BorderRadius 0px -TextTransform capitalize -BackgroundColorActive SlateGrey New-HTMLSectionStyle -BorderRadius 0px -HeaderBackGroundColor Grey -RemoveShadow New-HTMLPanelStyle -BorderRadius 0px -RemoveShadow New-HTMLTableOption -DataStore JavaScript -BoolAsString + + New-HTMLHeader { + New-HTMLSection -Invisible { + New-HTMLSection { + New-HTMLText -Text "Report generated on $(Get-Date)" -Color Blue + } -JustifyContent flex-start -Invisible + New-HTMLSection { + New-HTMLText -Text $Script:Reporting['Version'] -Color Blue + } -JustifyContent flex-end -Invisible + } + } + New-HTMLTab -Name 'Overview' { if ($Type -contains 'GPOConsistency' -or $Type -contains 'GPOList' -or $null -eq $Type) { New-HTMLSection -Invisible {