From 1e3a7a78c8ca10c48d4da07e2344b35808988edc Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Sat, 18 Jul 2020 15:54:19 +0200 Subject: [PATCH] Update --- Private/ConvertTo-XMLTaskScheduler.ps1 | 224 +++++++++++++++++++++---- 1 file changed, 196 insertions(+), 28 deletions(-) diff --git a/Private/ConvertTo-XMLTaskScheduler.ps1 b/Private/ConvertTo-XMLTaskScheduler.ps1 index 3a32ceb..0d11243 100644 --- a/Private/ConvertTo-XMLTaskScheduler.ps1 +++ b/Private/ConvertTo-XMLTaskScheduler.ps1 @@ -23,7 +23,6 @@ function ConvertTo-XMLTaskScheduler { Filter = $Entry.Filter Name = $Entry.Name - Status = $Entry.status Action = $Script:Actions["$($Entry.Properties.action)"] ThisDrive = $Entry.Properties.thisDrive AllDrives = $Entry.Properties.allDrives @@ -41,35 +40,204 @@ function ConvertTo-XMLTaskScheduler { $CreateGPO['Links'] = $GPO.Links [PSCustomObject] $CreateGPO } else { - foreach ($Entry in $GPO.DataSet.Drive) { - $CreateGPO = [ordered]@{ - DisplayName = $GPO.DisplayName - DomainName = $GPO.DomainName - GUID = $GPO.GUID - GpoType = $GPO.GpoType - #GpoCategory = $GPOEntry.GpoCategory - #GpoSettings = $GPOEntry.GpoSettings - Changed = [DateTime] $Entry.changed - #uid = $Entry.uid - GPOSettingOrder = $Entry.GPOSettingOrder - Filter = $Entry.Filter + foreach ($Type in @('TaskV2', 'Task', 'ImmediateTaskV2', 'ImmediateTask')) { + foreach ($Entry in $GPO.DataSet.$Type) { + $ListActions = foreach ($LoopAction in $Entry.Properties.Task.Actions) { - Name = $Entry.Name - Status = $Entry.status - Action = $Script:Actions["$($Entry.Properties.action)"] - ThisDrive = $Entry.Properties.thisDrive - AllDrives = $Entry.Properties.allDrives - UserName = $Entry.Properties.userName - Path = $Entry.Properties.path - Label = $Entry.Properties.label - Persistent = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent }; - UseLetter = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter }; - Letter = $Entry.Properties.letter + foreach ($InternalAction in $LoopAction.Exec) { + $Action = [ordered] @{ + ActionType = 'Execute' + Command = $InternalAction.Command # : cmd + Arguments = $InternalAction.Arguments # : / c wevtutil qe security / rd:true / f:text / c:1 / q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4727 or EventID=4759 or EventID=4754 or EventID=4731)]]" >group-creation.txt + WorkingDirectory = $InternalAction.WorkingDirectory# : % windir % \temp + Server = $Null + Subject = $Null + To = $Null + From = $Null + Body = $Null + Attachments = $Null + } + $Action + } + foreach ($InternalAction in $LoopAction.SendEmail) { + $Action = [ordered] @{ + ActionType = 'SendEmail' + Command = $null + Arguments = $null # : / c wevtutil qe security / rd:true / f:text / c:1 / q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4727 or EventID=4759 or EventID=4754 or EventID=4731)]]" >group-creation.txt + WorkingDirectory = $null # : % windir % \temp + Server = $InternalAction.Server # : smtp-de + Subject = $InternalAction.Subject # : AD Group creation + To = $InternalAction.To # : gm6b@eurofins.de,RalphThomasAussem@eurofins.de,karlthomaseggert@eurofins.de + From = $InternalAction.From # : %computername%@eurofins.local + Body = $InternalAction.Body # : A new security group has been created. Check attachment for further details. + Attachments = $InternalAction.Attachments.File -join '; ' # : Attachments + } + $Action + } + } + + + <# + [DBG]: PS C:\Support\GitHub\GpoZaurr> $Entry.Properties.Task.Triggers.EventTrigger + + Enabled Subscription + ------- ------------ + true + true + true + false + #> + if ($ListActions.Count -eq 0) { + $ListActions = @( + + if ($Entry.Properties.appName) { + # This supports Scheduled Task (legacy) + $Action = [ordered] @{ + ActionType = $Script:Actions["$($Entry.Properties.action)"] + Command = $Entry.Properties.appName + Arguments = $Entry.Properties.args # + WorkingDirectory = $Entry.Properties.startIn # : % windir % \temp + Server = $null # : smtp-de + Subject = $null # : AD Group creation + To = $null + From = $null + Body = $null + Attachments = $null + } + $Action + } else { + + $Action = [ordered] @{ + ActionType = $Script:Actions["$($Entry.Properties.action)"] + Command = $null + Arguments = $null # + WorkingDirectory = $null # : % windir % \temp + Server = $null # : smtp-de + Subject = $null # : AD Group creation + To = $null + From = $null + Body = $null + Attachments = $null + } + $Action + } + ) + } + foreach ($Action in $ListActions) { + $CreateGPO = [ordered]@{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.GUID + GpoType = $GPO.GpoType + #GpoCategory = $GPOEntry.GpoCategory + #GpoSettings = $GPOEntry.GpoSettings + Type = $Type + Changed = [DateTime] $Entry.changed + GPOSettingOrder = $Entry.GPOSettingOrder + userContext = '' + + Name = $Entry.Name + Status = $Entry.status + Action = $Script:Actions["$($Entry.Properties.action)"] + + + runAs = $Entry.Properties.runAs #: NT AUTHORITY\System + #logonType = $Entry.Properties.logonType #: InteractiveToken + #Task = $Entry.Properties.Task #: Task + + Comment = $Entry.Properties.comment + } + if ($Entry.Properties.startOnlyIfIdle) { + # Old legacy task + $Middle = [ordered] @{ + AllowStartOnDemand = $null #: true + DisallowStartIfOnBatteries = $Entry.Properties.noStartIfOnBatteries #: false + StopIfGoingOnBatteries = $Entry.Properties.stopIfGoingOnBatteries #: false + AllowHardTerminate = $null #: true + Enabled = $Entry.Properties.enabled #: true + Hidden = $null #: false + MultipleInstancesPolicy = $null #: IgnoreNew + Priority = $null #: 7 + ExecutionTimeLimit = $null #: PT1H + #IdleSettings = $Entry.Properties.Task.Settings.IdleSettings #: IdleSettings + + IdleDuration = $Entry.Properties.deadlineMinutes # : PT5M + IdleWaitTimeout = $null # : PT1H + IdleStopOnIdleEnd = $Entry.Properties.stopOnIdleEnd # : false + IdleRestartOnIdle = $Entry.Properties.startOnlyIfIdle # : false + + RegistrationInfoAuthor = $null + RegistrationInfoDescription = $null + deleteWhenDone = $Entry.Properties.deleteWhenDone + + <# + action : U + name : Task Name + appName : Run command + args : args for command + startIn : start me in + comment : Oops i did it again + enabled : 1 + deleteWhenDone : 1 + maxRunTime : 259200000 + startOnlyIfIdle : 1 + idleMinutes : 10 + deadlineMinutes : 60 + stopOnIdleEnd : 1 + noStartIfOnBatteries : 1 + stopIfGoingOnBatteries : 1 + systemRequired : 0 + Triggers : Triggers + #> + } + } else { + $Middle = [ordered] @{ + AllowStartOnDemand = $Entry.Properties.Task.Settings.AllowStartOnDemand #: true + DisallowStartIfOnBatteries = $Entry.Properties.Task.Settings.DisallowStartIfOnBatteries #: false + StopIfGoingOnBatteries = $Entry.Properties.Task.Settings.StopIfGoingOnBatteries #: false + AllowHardTerminate = $Entry.Properties.Task.Settings.AllowHardTerminate #: true + Enabled = $Entry.Properties.Task.Settings.Enabled #: true + Hidden = $Entry.Properties.Task.Settings.Hidden #: false + MultipleInstancesPolicy = $Entry.Properties.Task.Settings.MultipleInstancesPolicy #: IgnoreNew + Priority = $Entry.Properties.Task.Settings.Priority #: 7 + ExecutionTimeLimit = $Entry.Properties.Task.Settings.ExecutionTimeLimit #: PT1H + #IdleSettings = $Entry.Properties.Task.Settings.IdleSettings #: IdleSettings + + IdleDuration = $Entry.Properties.Task.Settings.IdleSettings.Duration # : PT5M + IdleWaitTimeout = $Entry.Properties.Task.Settings.IdleSettings.WaitTimeout # : PT1H + IdleStopOnIdleEnd = $Entry.Properties.Task.Settings.IdleSettings.StopOnIdleEnd # : false + IdleRestartOnIdle = $Entry.Properties.Task.Settings.IdleSettings.RestartOnIdle # : false + + RegistrationInfoAuthor = $Entry.Properties.Task.RegistrationInfo.Author + RegistrationInfoDescription = $Entry.Properties.Task.RegistrationInfo.Description + + deleteWhenDone = $Entry.Properties.deleteWhenDone + } + } + $End = [ordered] @{ + id = $Entry.Properties.Principals.Principal.id # : Author + UserId = $Entry.Properties.Principals.Principal.UserId # : NT AUTHORITY\System + LogonType = $Entry.Properties.Principals.Principal.LogonType # : InteractiveToken + RunLevel = $Entry.Properties.Principals.Principal.RunLevel # : HighestAvailable + + #Persistent = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent }; + #UseLetter = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter }; + #Letter = $Entry.Properties.letter + } + $CreateGPO = $CreateGPO + $Middle + $End + $Action + $Last = [ordered] @{ + #Uid = $Group.uid #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A} + RunInLoggedOnUserSecurityContext = if ($Entry.userContext -eq '1') { 'Enabled' } elseif ($Entry.userContext -eq '0') { 'Disabled' } else { $Entry.userContext }; + RemoveThisItemWhenItIsNoLongerApplied = if ($Entry.removePolicy -eq '1') { 'Enabled' } elseif ($Entry.removePolicy -eq '0') { 'Disabled' } else { $Entry.removePolicy }; + Filters = $Group.Filters #:: + } + $CreateGPO = $CreateGPO + $Last + $CreateGPO['Linked'] = $GPO.Linked + $CreateGPO['LinksCount'] = $GPO.LinksCount + $CreateGPO['Links'] = $GPO.Links + [PSCustomObject] $CreateGPO + } } - $CreateGPO['Linked'] = $GPO.Linked - $CreateGPO['LinksCount'] = $GPO.LinksCount - $CreateGPO['Links'] = $GPO.Links - [PSCustomObject] $CreateGPO } } } \ No newline at end of file