diff --git a/Private/ConvertTo-XMLTaskScheduler.ps1 b/Private/ConvertTo-XMLTaskScheduler.ps1
index 3a32ceb..0d11243 100644
--- a/Private/ConvertTo-XMLTaskScheduler.ps1
+++ b/Private/ConvertTo-XMLTaskScheduler.ps1
@@ -23,7 +23,6 @@ function ConvertTo-XMLTaskScheduler {
Filter = $Entry.Filter
Name = $Entry.Name
- Status = $Entry.status
Action = $Script:Actions["$($Entry.Properties.action)"]
ThisDrive = $Entry.Properties.thisDrive
AllDrives = $Entry.Properties.allDrives
@@ -41,35 +40,204 @@ function ConvertTo-XMLTaskScheduler {
$CreateGPO['Links'] = $GPO.Links
[PSCustomObject] $CreateGPO
} else {
- foreach ($Entry in $GPO.DataSet.Drive) {
- $CreateGPO = [ordered]@{
- DisplayName = $GPO.DisplayName
- DomainName = $GPO.DomainName
- GUID = $GPO.GUID
- GpoType = $GPO.GpoType
- #GpoCategory = $GPOEntry.GpoCategory
- #GpoSettings = $GPOEntry.GpoSettings
- Changed = [DateTime] $Entry.changed
- #uid = $Entry.uid
- GPOSettingOrder = $Entry.GPOSettingOrder
- Filter = $Entry.Filter
+ foreach ($Type in @('TaskV2', 'Task', 'ImmediateTaskV2', 'ImmediateTask')) {
+ foreach ($Entry in $GPO.DataSet.$Type) {
+ $ListActions = foreach ($LoopAction in $Entry.Properties.Task.Actions) {
- Name = $Entry.Name
- Status = $Entry.status
- Action = $Script:Actions["$($Entry.Properties.action)"]
- ThisDrive = $Entry.Properties.thisDrive
- AllDrives = $Entry.Properties.allDrives
- UserName = $Entry.Properties.userName
- Path = $Entry.Properties.path
- Label = $Entry.Properties.label
- Persistent = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
- UseLetter = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
- Letter = $Entry.Properties.letter
+ foreach ($InternalAction in $LoopAction.Exec) {
+ $Action = [ordered] @{
+ ActionType = 'Execute'
+ Command = $InternalAction.Command # : cmd
+ Arguments = $InternalAction.Arguments # : / c wevtutil qe security / rd:true / f:text / c:1 / q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4727 or EventID=4759 or EventID=4754 or EventID=4731)]]" >group-creation.txt
+ WorkingDirectory = $InternalAction.WorkingDirectory# : % windir % \temp
+ Server = $Null
+ Subject = $Null
+ To = $Null
+ From = $Null
+ Body = $Null
+ Attachments = $Null
+ }
+ $Action
+ }
+ foreach ($InternalAction in $LoopAction.SendEmail) {
+ $Action = [ordered] @{
+ ActionType = 'SendEmail'
+ Command = $null
+ Arguments = $null # : / c wevtutil qe security / rd:true / f:text / c:1 / q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4727 or EventID=4759 or EventID=4754 or EventID=4731)]]" >group-creation.txt
+ WorkingDirectory = $null # : % windir % \temp
+ Server = $InternalAction.Server # : smtp-de
+ Subject = $InternalAction.Subject # : AD Group creation
+ To = $InternalAction.To # : gm6b@eurofins.de,RalphThomasAussem@eurofins.de,karlthomaseggert@eurofins.de
+ From = $InternalAction.From # : %computername%@eurofins.local
+ Body = $InternalAction.Body # : A new security group has been created. Check attachment for further details.
+ Attachments = $InternalAction.Attachments.File -join '; ' # : Attachments
+ }
+ $Action
+ }
+ }
+
+
+ <#
+ [DBG]: PS C:\Support\GitHub\GpoZaurr> $Entry.Properties.Task.Triggers.EventTrigger
+
+ Enabled Subscription
+ ------- ------------
+ true
+ true
+ true
+ false
+ #>
+ if ($ListActions.Count -eq 0) {
+ $ListActions = @(
+
+ if ($Entry.Properties.appName) {
+ # This supports Scheduled Task (legacy)
+ $Action = [ordered] @{
+ ActionType = $Script:Actions["$($Entry.Properties.action)"]
+ Command = $Entry.Properties.appName
+ Arguments = $Entry.Properties.args #
+ WorkingDirectory = $Entry.Properties.startIn # : % windir % \temp
+ Server = $null # : smtp-de
+ Subject = $null # : AD Group creation
+ To = $null
+ From = $null
+ Body = $null
+ Attachments = $null
+ }
+ $Action
+ } else {
+
+ $Action = [ordered] @{
+ ActionType = $Script:Actions["$($Entry.Properties.action)"]
+ Command = $null
+ Arguments = $null #
+ WorkingDirectory = $null # : % windir % \temp
+ Server = $null # : smtp-de
+ Subject = $null # : AD Group creation
+ To = $null
+ From = $null
+ Body = $null
+ Attachments = $null
+ }
+ $Action
+ }
+ )
+ }
+ foreach ($Action in $ListActions) {
+ $CreateGPO = [ordered]@{
+ DisplayName = $GPO.DisplayName
+ DomainName = $GPO.DomainName
+ GUID = $GPO.GUID
+ GpoType = $GPO.GpoType
+ #GpoCategory = $GPOEntry.GpoCategory
+ #GpoSettings = $GPOEntry.GpoSettings
+ Type = $Type
+ Changed = [DateTime] $Entry.changed
+ GPOSettingOrder = $Entry.GPOSettingOrder
+ userContext = ''
+
+ Name = $Entry.Name
+ Status = $Entry.status
+ Action = $Script:Actions["$($Entry.Properties.action)"]
+
+
+ runAs = $Entry.Properties.runAs #: NT AUTHORITY\System
+ #logonType = $Entry.Properties.logonType #: InteractiveToken
+ #Task = $Entry.Properties.Task #: Task
+
+ Comment = $Entry.Properties.comment
+ }
+ if ($Entry.Properties.startOnlyIfIdle) {
+ # Old legacy task
+ $Middle = [ordered] @{
+ AllowStartOnDemand = $null #: true
+ DisallowStartIfOnBatteries = $Entry.Properties.noStartIfOnBatteries #: false
+ StopIfGoingOnBatteries = $Entry.Properties.stopIfGoingOnBatteries #: false
+ AllowHardTerminate = $null #: true
+ Enabled = $Entry.Properties.enabled #: true
+ Hidden = $null #: false
+ MultipleInstancesPolicy = $null #: IgnoreNew
+ Priority = $null #: 7
+ ExecutionTimeLimit = $null #: PT1H
+ #IdleSettings = $Entry.Properties.Task.Settings.IdleSettings #: IdleSettings
+
+ IdleDuration = $Entry.Properties.deadlineMinutes # : PT5M
+ IdleWaitTimeout = $null # : PT1H
+ IdleStopOnIdleEnd = $Entry.Properties.stopOnIdleEnd # : false
+ IdleRestartOnIdle = $Entry.Properties.startOnlyIfIdle # : false
+
+ RegistrationInfoAuthor = $null
+ RegistrationInfoDescription = $null
+ deleteWhenDone = $Entry.Properties.deleteWhenDone
+
+ <#
+ action : U
+ name : Task Name
+ appName : Run command
+ args : args for command
+ startIn : start me in
+ comment : Oops i did it again
+ enabled : 1
+ deleteWhenDone : 1
+ maxRunTime : 259200000
+ startOnlyIfIdle : 1
+ idleMinutes : 10
+ deadlineMinutes : 60
+ stopOnIdleEnd : 1
+ noStartIfOnBatteries : 1
+ stopIfGoingOnBatteries : 1
+ systemRequired : 0
+ Triggers : Triggers
+ #>
+ }
+ } else {
+ $Middle = [ordered] @{
+ AllowStartOnDemand = $Entry.Properties.Task.Settings.AllowStartOnDemand #: true
+ DisallowStartIfOnBatteries = $Entry.Properties.Task.Settings.DisallowStartIfOnBatteries #: false
+ StopIfGoingOnBatteries = $Entry.Properties.Task.Settings.StopIfGoingOnBatteries #: false
+ AllowHardTerminate = $Entry.Properties.Task.Settings.AllowHardTerminate #: true
+ Enabled = $Entry.Properties.Task.Settings.Enabled #: true
+ Hidden = $Entry.Properties.Task.Settings.Hidden #: false
+ MultipleInstancesPolicy = $Entry.Properties.Task.Settings.MultipleInstancesPolicy #: IgnoreNew
+ Priority = $Entry.Properties.Task.Settings.Priority #: 7
+ ExecutionTimeLimit = $Entry.Properties.Task.Settings.ExecutionTimeLimit #: PT1H
+ #IdleSettings = $Entry.Properties.Task.Settings.IdleSettings #: IdleSettings
+
+ IdleDuration = $Entry.Properties.Task.Settings.IdleSettings.Duration # : PT5M
+ IdleWaitTimeout = $Entry.Properties.Task.Settings.IdleSettings.WaitTimeout # : PT1H
+ IdleStopOnIdleEnd = $Entry.Properties.Task.Settings.IdleSettings.StopOnIdleEnd # : false
+ IdleRestartOnIdle = $Entry.Properties.Task.Settings.IdleSettings.RestartOnIdle # : false
+
+ RegistrationInfoAuthor = $Entry.Properties.Task.RegistrationInfo.Author
+ RegistrationInfoDescription = $Entry.Properties.Task.RegistrationInfo.Description
+
+ deleteWhenDone = $Entry.Properties.deleteWhenDone
+ }
+ }
+ $End = [ordered] @{
+ id = $Entry.Properties.Principals.Principal.id # : Author
+ UserId = $Entry.Properties.Principals.Principal.UserId # : NT AUTHORITY\System
+ LogonType = $Entry.Properties.Principals.Principal.LogonType # : InteractiveToken
+ RunLevel = $Entry.Properties.Principals.Principal.RunLevel # : HighestAvailable
+
+ #Persistent = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
+ #UseLetter = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
+ #Letter = $Entry.Properties.letter
+ }
+ $CreateGPO = $CreateGPO + $Middle + $End + $Action
+ $Last = [ordered] @{
+ #Uid = $Group.uid #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
+ RunInLoggedOnUserSecurityContext = if ($Entry.userContext -eq '1') { 'Enabled' } elseif ($Entry.userContext -eq '0') { 'Disabled' } else { $Entry.userContext };
+ RemoveThisItemWhenItIsNoLongerApplied = if ($Entry.removePolicy -eq '1') { 'Enabled' } elseif ($Entry.removePolicy -eq '0') { 'Disabled' } else { $Entry.removePolicy };
+ Filters = $Group.Filters #::
+ }
+ $CreateGPO = $CreateGPO + $Last
+ $CreateGPO['Linked'] = $GPO.Linked
+ $CreateGPO['LinksCount'] = $GPO.LinksCount
+ $CreateGPO['Links'] = $GPO.Links
+ [PSCustomObject] $CreateGPO
+ }
}
- $CreateGPO['Linked'] = $GPO.Linked
- $CreateGPO['LinksCount'] = $GPO.LinksCount
- $CreateGPO['Links'] = $GPO.Links
- [PSCustomObject] $CreateGPO
}
}
}
\ No newline at end of file