From 1b70d39984d352cb54f539be246994a0180a170e Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Fri, 28 Aug 2020 09:49:26 +0200 Subject: [PATCH] Update --- Examples/Example-29-FindGPO0.ps1 | 2 +- Examples/Example-29-FindGPO1.ps1 | 19 +++++-- Examples/Example-34-GPOSupport.ps1 | 56 ++++++++++++++++++-- Examples/Example-37-GPOPermissionSummary.ps1 | 4 ++ Examples/Example-38-GPOPermissionSummary.ps1 | 4 ++ GPOZaurr.psd1 | 4 +- README.md | 8 +++ 7 files changed, 88 insertions(+), 9 deletions(-) create mode 100644 Examples/Example-37-GPOPermissionSummary.ps1 create mode 100644 Examples/Example-38-GPOPermissionSummary.ps1 diff --git a/Examples/Example-29-FindGPO0.ps1 b/Examples/Example-29-FindGPO0.ps1 index 1c9078c..c46e0d6 100644 --- a/Examples/Example-29-FindGPO0.ps1 +++ b/Examples/Example-29-FindGPO0.ps1 @@ -2,11 +2,11 @@ # Asses GPO based on exported data $Output = Invoke-GPOZaurr -GPOPath $Env:USERPROFILE\Desktop\GPOExport -Verbose -#$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -Verbose $Output | Format-Table * # Export to Excel foreach ($Key in $Output.Reports.Keys) { $Output.Reports[$Key] | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\EFGPOAnalysis.xlsx -ExcelWorkSheetName $Key -AutoFilter -AutoFit -FreezeTopRowFirstColumn } +# Show the Excel Start-Process "$Env:USERPROFILE\Desktop\EFGPOAnalysis.xlsx" \ No newline at end of file diff --git a/Examples/Example-29-FindGPO1.ps1 b/Examples/Example-29-FindGPO1.ps1 index 3d5fdb1..3999225 100644 --- a/Examples/Example-29-FindGPO1.ps1 +++ b/Examples/Example-29-FindGPO1.ps1 @@ -1,9 +1,22 @@ Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force -$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportEvotec1' +$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPODefender' +#$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' + $Output | Format-Table -$Output.Reports.RegistrySettings | Format-Table * -$Output.Reports.InternetExplorerZones | Format-Table * +$Output.Reports | Format-Table +$Output.Reports.WindowsDefenderExploitGuard +#$Output.Reports.RegistrySetting | Format-Table +#$Output.CategoriesFull | Format-Table +<# +$Output.Reports.Policies | Format-Table +$Output.Reports.SecurityOptions | Format-Table +$Output.Reports.PublicKeyPoliciesCertificates | Format-Table +$Output.Reports.PublicKeyPoliciesEnrollmentPolicy | Format-Table +$Output.Reports.PublicKeyPoliciesAuto | Format-Table * +#> + +return # Report to Excel of translated reports foreach ($Key in $Output.Reports.Keys) { diff --git a/Examples/Example-34-GPOSupport.ps1 b/Examples/Example-34-GPOSupport.ps1 index 715636e..320e137 100644 --- a/Examples/Example-34-GPOSupport.ps1 +++ b/Examples/Example-34-GPOSupport.ps1 @@ -1,5 +1,55 @@ Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force -Invoke-GPOZaurrSupport -ComputerName 'AD1' -UserName 'przemyslaw.klys' -Type HTML -#$Support -# $Support.ComputerResults.GPO | select name, @{LABEL=”LinkOrder“;EXPRESSION={$_.link.linkorder}} | sort linkorder +#Invoke-GPOZaurrSupport -ComputerName 'AD1' -UserName 'przemyslaw.klys' -Type HTML +#$Support1 = Invoke-GPOZaurrSupport -ComputerName 'AD1' -UserName 'przemyslaw.klys' -Type Object +#$Support = Invoke-GPOZaurrSupport -ComputerName 'AD1' -UserName 'EVOTEC\Administrator' -Type Object +#$Support.ComputerResults.ExtensionData + + +foreach ($GpoType in @('UserResults', 'ComputerResults')) { + if ($Support.$GpoType.ExtensionData) { + foreach ($Extension in $Support.$GpoType.ExtensionData) { + $GPOSettingTypeSplit = ($Extension.type -split ':') + #$Extension + #$Extension | Get-Member -MemberType Properties -ErrorAction Stop + $KeysToLoop = $Extension | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin @($GPOSettingTypeSplit[0], 'xmlns', 'blocked', 'type') } + foreach ($GpoSettings in $KeysToLoop.Name) { + $Extension.$GpoSettings | Format-Table + } + } + } +} + +# $env:LOGONSERVER +# if($env:LOGONSERVER -match "MicrosoftAccount") {"Logged on with Windows account"} + +# If it reports \\MicrosoftAccount, they are using their Windows account to sign in instead of domain credentials. +#You can check this by using the IF statement as shown here: + + +#[System.DirectoryServices.ActiveDirectory.ActiveDirectorySite]::GetComputerSite().Name + +#[System.DirectoryServices.ActiveDirectory.DomainController]:: + +# https://concurrency.com/blog/may-2018/domain-controller-selection +#echo %logonserver% - This shows the DC that was used to authenticate and log in the current user +#nltest /dsgetsite - This shows the AD site that the current server has detected that it's in +#nltest /dclist: (include the colon at the end) - This shows the list of DCs in the current domain, including which site each is in. +# nslookup -type=srv _ldap._tcp.mydomain.local. - This will query the primary DNS server for all domain controller SRV records. This should return all of the DCs in the domain. In this example, MGLABDC4 and MGLABDC5 are returned. +# nslookup -type=srv _ldap._tcp.mysitename._sites.dc._msdcs.mydomain.local. - This will query the primary DNS server for domain controllers that are registered in "mysitename". In this example, only MGLABDC4 is in the site that was queried, which matches the information we found with nltest /dclist: previously. + + +# Windows 10 + +#Add-WindowsCapability -Online -Name 'Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0' +#Add-WindowsCapability -Online -Name 'Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0' +#Remove-WindowsCapability -Online -Name 'Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0' + +echo %logonserver% +nltest /dsgetsite +nltest /dclist: + +$env:LOGONSERVER +[System.DirectoryServices.ActiveDirectory.ActiveDirectorySite]::GetComputerSite().Name +nslookup -type=srv _ldap._tcp.ad.colmore.com. +nslookup -type=srv _ldap._tcp.birmingham._sites.dc._msdcs.ad.colmore.com. \ No newline at end of file diff --git a/Examples/Example-37-GPOPermissionSummary.ps1 b/Examples/Example-37-GPOPermissionSummary.ps1 new file mode 100644 index 0000000..4adbded --- /dev/null +++ b/Examples/Example-37-GPOPermissionSummary.ps1 @@ -0,0 +1,4 @@ +Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force + +$SummaryPermission = Get-GPOZaurrPermissionSummary -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity +$SummaryPermission | Sort-Object -Property Permission \ No newline at end of file diff --git a/Examples/Example-38-GPOPermissionSummary.ps1 b/Examples/Example-38-GPOPermissionSummary.ps1 new file mode 100644 index 0000000..bc2b4bf --- /dev/null +++ b/Examples/Example-38-GPOPermissionSummary.ps1 @@ -0,0 +1,4 @@ +Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force + +$SummaryPermission = Get-GPOZaurrPermissionSummary -IncludeOwner +$SummaryPermission | Sort-Object -Property Permission | Format-Table * \ No newline at end of file diff --git a/GPOZaurr.psd1 b/GPOZaurr.psd1 index c5cd724..76f2996 100644 --- a/GPOZaurr.psd1 +++ b/GPOZaurr.psd1 @@ -7,7 +7,7 @@ Description = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.' FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvol', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner' GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde' - ModuleVersion = '0.0.59' + ModuleVersion = '0.0.60' PowerShellVersion = '5.1' PrivateData = @{ PSData = @{ @@ -21,7 +21,7 @@ ModuleName = 'PSSharedGoods' Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe' }, @{ - ModuleVersion = '0.0.67' + ModuleVersion = '0.0.68' ModuleName = 'ADEssentials' Guid = '9fc9fd61-7f11-4f4b-a527-084086f1905f' }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility' diff --git a/README.md b/README.md index 5a41b5b..21bf225 100644 --- a/README.md +++ b/README.md @@ -49,6 +49,14 @@ That's it. Whenever there's a new version, you run the command, and you can enjo ## Changelog +- 0.0.62 - 28.08.2020 + - Improvement to `Get-GPOZaurrPermissionSummary` + - Update to `ConvertFrom-CSExtension` + - Update to `Find-CSExtension` +- 0.0.61 - 26.08.2020 + - Improvement to `Get-GPOZaurrPermissionSummary` + - Fixes to `ConvertFrom-CSExtension` + - Fixes to `Find-CSExtension` - 0.0.59 - 26.08.2020 - Improvement to `Get-GPOZaurrPermissionSummary` - 0.0.58 - 26.08.2020