From 2286f0cb0b79959e7ea2f096583851dbe4150e3d Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Sat, 27 Jun 2020 10:26:06 +0200 Subject: [PATCH] XML parsing improvements --- Private/Get-XMLAutologon.ps1 | 59 ++++++++++++++++++ Private/Get-XMLGPO.ps1 | 3 + Private/Get-XMLLocalUserGroups.ps1 | 96 ++++++++++++++++++++++++++++++ 3 files changed, 158 insertions(+) create mode 100644 Private/Get-XMLAutologon.ps1 create mode 100644 Private/Get-XMLLocalUserGroups.ps1 diff --git a/Private/Get-XMLAutologon.ps1 b/Private/Get-XMLAutologon.ps1 new file mode 100644 index 0000000..3e0a2c8 --- /dev/null +++ b/Private/Get-XMLAutologon.ps1 @@ -0,0 +1,59 @@ +function Get-XMLAutologon { + [cmdletBinding()] + param( + [PSCustomObject] $GPO, + [System.Xml.XmlElement[]] $GPOOutput + ) + if ($GPOOutput.LinksTo) { + $Linked = $true + $LinksCount = ([Array] $GPOOutput.LinksTo).Count + } else { + $Linked = $false + $LinksCount = 0 + } + foreach ($Type in @('User', 'Computer')) { + if ($GPOOutput.$Type.ExtensionData.Extension.RegistrySettings) { + foreach ($Key in $GPOOutput.$Type.ExtensionData.Extension.RegistrySettings.Registry) { + #$Key + <# + clsid : {9CD4B2F4-923D-47f5-A062-E897DD1DAD50} + name : AutoAdminLogon + status : AutoAdminLogon + image : 7 + changed : 2013-02-06 09:57:45 + uid : {23AD1B6F-0D90-49B5-926D-AAA6E1E2F4B3} + GPOSettingOrder : 1 + Properties : Properties + Filters : + #> + + <# $Key.properties + action : U + displayDecimal : 0 + default : 0 + hive : HKEY_LOCAL_MACHINE + key : SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon + name : AutoAdminLogon + type : REG_SZ + value : 1 + Values : + #> + [PSCustomObject] @{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.Guid + Linked = $Linked + LinksCount = $LinksCount + Changed = [DateTime] $Key.changed + GPOSettingOrder = $Key.GPOSettingOrder + hive = $Key.Properties.hive #: HKEY_LOCAL_MACHINE + key = $Key.Properties.key #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon + name = $Key.Properties.name #: AutoAdminLogon + type = $Key.Properties.type #: REG_SZ + value = $Key.Properties.value # + Filters = $Key.Filters + } + } + } + } +} \ No newline at end of file diff --git a/Private/Get-XMLGPO.ps1 b/Private/Get-XMLGPO.ps1 index 30a5584..4ad247b 100644 --- a/Private/Get-XMLGPO.ps1 +++ b/Private/Get-XMLGPO.ps1 @@ -112,6 +112,9 @@ 'UserSettingsVersionIdentical' = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false } 'UserSettings' = $XMLContent.GPO.User.ExtensionData.Extension + ComputerPolicies = $XMLContent.GPO.Computer.ExtensionData.Name -join ", " + UserPolicies = $XMLContent.GPO.User.ExtensionData.Name -join ", " + 'CreationTime' = [DateTime] $XMLContent.GPO.CreatedTime 'ModificationTime' = [DateTime] $XMLContent.GPO.ModifiedTime 'ReadTime' = [DateTime] $XMLContent.GPO.ReadTime diff --git a/Private/Get-XMLLocalUserGroups.ps1 b/Private/Get-XMLLocalUserGroups.ps1 new file mode 100644 index 0000000..b2081f4 --- /dev/null +++ b/Private/Get-XMLLocalUserGroups.ps1 @@ -0,0 +1,96 @@ + +function Get-XMLLocalUserGroups { + [cmdletBinding()] + param( + [PSCustomObject] $GPO, + [System.Xml.XmlElement[]] $GPOOutput + ) + if ($GPOOutput.LinksTo) { + $Linked = $true + $LinksCount = ([Array] $GPOOutput.LinksTo).Count + } else { + $Linked = $false + $LinksCount = 0 + } + foreach ($Type in @('User', 'Computer')) { + if ($GPOOutput.$Type.ExtensionData.Extension.LocalUsersAndGroups) { + foreach ($NestedType in @('User', 'Group')) { + if ($GPOOutput.$Type.ExtensionData.Extension.LocalUsersAndGroups.$NestedType) { + foreach ($Entry in $GPOOutput.$Type.ExtensionData.Extension.LocalUsersAndGroups.$NestedType) { + if ($Entry.Properties.Members) { + foreach ($Members in $Entry.Properties.Members) { + foreach ($Member in $Members.Member) { + [PSCustomObject] @{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.Guid + Linked = $Linked + LinksCount = $LinksCount + GpoType = $Type + Name = $Entry.name + Changed = [DateTime] $Entry.changed + GPOSettingOrder = $Entry.GPOSettingOrder + Filters = $Entry.Filters + ActionType = $NestedType + Action = $Entry.Properties.Action + UserName = $Entry.Properties.userName + NewName = $Entry.Properties.newName + Description = $Entry.Properties.description + DeleteAllUsers = [bool] $Entry.Properties.deleteAllUsers + DeleteAllGroups = [bool] $Entry.Properties.deleteAllGroups + RemoveAccounts = [bool] $Entry.Properties.removeAccounts + GroupSid = $Entry.Properties.groupSid + GroupName = $Entry.Properties.groupName + MembersName = $Member.Name + MembersAction = $Member.Action + MembersSid = $Member.Sid + FullName = $Entry.Properties.fullName + AccountCpassword = $Entry.Properties.cpassword + AccountChangeLogon = [bool] $Entry.Properties.changeLogon + AccountNoChange = [bool] $Entry.Properties.noChange + AccountNeverExpires = [bool] $Entry.Properties.neverExpires + AccountDisabled = [bool] $Entry.Properties.acctDisabled + SubAuthority = $Entry.Properties.subAuthority + } + } + } + } else { + [PSCustomObject] @{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.Guid + Linked = $Linked + LinksCount = $LinksCount + GpoType = $Type + Name = $Entry.name + Changed = [DateTime] $Entry.changed + GPOSettingOrder = $Entry.GPOSettingOrder + Filters = $Entry.Filters + ActionType = $NestedType + Action = $Entry.Properties.Action + UserName = $Entry.Properties.userName + NewName = $Entry.Properties.newName + Description = $Entry.Properties.description + DeleteAllUsers = [bool] $Entry.Properties.deleteAllUsers + DeleteAllGroups = [bool] $Entry.Properties.deleteAllGroups + RemoveAccounts = [bool] $Entry.Properties.removeAccounts + GroupSid = $Entry.Properties.groupSid + GroupName = $Entry.Properties.groupName + MembersName = $null + MembersAction = $null + MembersSid = $null + FullName = $Entry.Properties.fullName + AccountCpassword = $Entry.Properties.cpassword + AccountChangeLogon = [bool] $Entry.Properties.changeLogon + AccountNoChange = [bool] $Entry.Properties.noChange + AccountNeverExpires = [bool] $Entry.Properties.neverExpires + AccountDisabled = [bool] $Entry.Properties.acctDisabled + SubAuthority = $Entry.Properties.subAuthority + } + } + } + } + } + } + } +} \ No newline at end of file