mirror of
https://github.com/EvotecIT/GPOZaurr.git
synced 2026-07-26 11:49:17 +00:00
Update 0.0.6
This commit is contained in:
Przemysław Kłys
@@ -0,0 +1,12 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
$GPOS = Get-GPOZaurr
|
||||
$GPOS | Format-Table -AutoSize
|
||||
|
||||
$GPOS[0] | Format-List
|
||||
|
||||
$GPOs[0].ACL | Format-Table -AutoSize
|
||||
|
||||
$GPOs.Links | Format-Table -AutoSize
|
||||
|
||||
$GPOS | Format-Table -AutoSize Name, WmiFilter, WMIDescription
|
||||
@@ -0,0 +1,3 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
Get-GPOZaurrWMI | Format-Table -AutoSize *
|
||||
+2
-2
@@ -5,9 +5,9 @@
|
||||
CompatiblePSEditions = 'Desktop'
|
||||
Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
|
||||
Description = 'Group Policy Eater'
|
||||
FunctionsToExport = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Remove-GPOZaurr', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles'
|
||||
FunctionsToExport = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrWMI', 'Remove-GPOZaurr', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles'
|
||||
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
|
||||
ModuleVersion = '0.0.5'
|
||||
ModuleVersion = '0.0.6'
|
||||
PowerShellVersion = '5.1'
|
||||
PrivateData = @{
|
||||
PSData = @{
|
||||
|
||||
+32
-10
@@ -1,7 +1,8 @@
|
||||
function Get-XMLGPO {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[XML] $XMLContent
|
||||
[XML] $XMLContent,
|
||||
$GPO
|
||||
)
|
||||
if ($XMLContent.GPO.LinksTo) {
|
||||
$Linked = $true
|
||||
@@ -27,9 +28,9 @@
|
||||
$Enabled = 'Enabled'
|
||||
} elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $false) {
|
||||
$Enabled = 'All settings disabled'
|
||||
}elseif ($UserEnabled -eq $true -and $ComputerEnabled -eq $false) {
|
||||
} elseif ($UserEnabled -eq $true -and $ComputerEnabled -eq $false) {
|
||||
$Enabled = 'Computer configuration settings disabled'
|
||||
}elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) {
|
||||
} elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) {
|
||||
$Enabled = 'User configuration settings disabled'
|
||||
}
|
||||
|
||||
@@ -58,16 +59,37 @@
|
||||
'WMIFilter' = $GPO.WmiFilter.name
|
||||
'WMIFilterDescription' = $GPO.WmiFilter.Description
|
||||
'Path' = $GPO.Path
|
||||
#'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
|
||||
'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
|
||||
'Owner' = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
|
||||
'OwnerSID' = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
|
||||
'ACL' = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
|
||||
[PsCustomObject] @{
|
||||
'User' = $_.trustee.name.'#Text'
|
||||
'Permission Type' = $_.type.PermissionType
|
||||
'Inherited' = $_.Inherited
|
||||
'Permissions' = $_.Standard.GPOGroupedAccessEnum
|
||||
if ($_) {
|
||||
[PsCustomObject] @{
|
||||
'Name' = $_.trustee.name.'#Text'
|
||||
'Sid' = $_.trustee.SID.'#Text'
|
||||
'PermissionType' = $_.type.PermissionType
|
||||
'Inherited' = $_.Inherited
|
||||
'Permissions' = $_.Standard.GPOGroupedAccessEnum
|
||||
}
|
||||
}
|
||||
}
|
||||
'Links' = $XMLContent.GPO.LinksTo #| Select-Object -ExpandProperty SOMPath
|
||||
'Auditing' = if ($XMLContent.GPO.SecurityDescriptor.AuditingPresent.'#text' -eq 'true') { $true } else { $false }
|
||||
'Links' = $XMLContent.GPO.LinksTo | ForEach-Object -Process {
|
||||
if ($_) {
|
||||
[PSCustomObject] @{
|
||||
CanonicalName = $_.SOMPath
|
||||
Enabled = $_.Enabled
|
||||
NoOverride = $_.NoOverride
|
||||
}
|
||||
}
|
||||
}
|
||||
<#
|
||||
SOMName SOMPath Enabled NoOverride
|
||||
------- ------- ------- ----------
|
||||
ad ad.evotec.xyz true false
|
||||
#>
|
||||
|
||||
#| Select-Object -ExpandProperty SOMPath
|
||||
|
||||
}
|
||||
#break
|
||||
|
||||
@@ -18,7 +18,7 @@
|
||||
Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
|
||||
Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
|
||||
$XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
|
||||
Get-XMLGPO -XMLContent $XMLContent
|
||||
Get-XMLGPO -XMLContent $XMLContent -GPO $_
|
||||
}
|
||||
}
|
||||
} else {
|
||||
|
||||
@@ -0,0 +1,113 @@
|
||||
function Get-GPOZaurrWMI {
|
||||
[cmdletBinding()]
|
||||
Param(
|
||||
[Guid[]] $Guid,
|
||||
[string[]] $Name,
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
[System.Collections.IDictionary] $ExtendedForestInformation
|
||||
)
|
||||
$wmiFilterAttr = "msWMI-Name", "msWMI-Parm1", "msWMI-Parm2", "msWMI-Author", "msWMI-ID", 'CanonicalName', 'Created', 'Modified'
|
||||
|
||||
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
$QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
|
||||
if ($Guid -or $Name) {
|
||||
foreach ($N in $Name) {
|
||||
$ldapFilter = "(&(objectClass=msWMI-Som)(msWMI-Name=$N))"
|
||||
Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
|
||||
$WMI = $_.'msWMI-Parm2' -split ';'
|
||||
[PSCustomObject] @{
|
||||
Name = $_.'msWMI-Name'
|
||||
Description = $_.'msWMI-Parm1'
|
||||
Domain = $Domain
|
||||
NameSpace = $WMI[5]
|
||||
Query = $WMI[6]
|
||||
Author = $_.'msWMI-Author'
|
||||
ID = $_.'msWMI-ID'
|
||||
Created = $_.Created
|
||||
Modified = $_.Modified
|
||||
ObjectGUID = $_.'ObjectGUID'
|
||||
CanonicalName = $_.CanonicalName
|
||||
DistinguishedName = $_.'DistinguishedName'
|
||||
}
|
||||
}
|
||||
}
|
||||
foreach ($G in $GUID) {
|
||||
$ldapFilter = "(&(objectClass=msWMI-Som)(Name={$G}))"
|
||||
Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
|
||||
$WMI = $_.'msWMI-Parm2' -split ';'
|
||||
[PSCustomObject] @{
|
||||
Name = $_.'msWMI-Name'
|
||||
Description = $_.'msWMI-Parm1'
|
||||
Domain = $Domain
|
||||
NameSpace = $WMI[5]
|
||||
Query = $WMI[6]
|
||||
Author = $_.'msWMI-Author'
|
||||
ID = $_.'msWMI-ID'
|
||||
Created = $_.Created
|
||||
Modified = $_.Modified
|
||||
ObjectGUID = $_.'ObjectGUID'
|
||||
CanonicalName = $_.CanonicalName
|
||||
DistinguishedName = $_.'DistinguishedName'
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
$ldapFilter = "(objectClass=msWMI-Som)"
|
||||
Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
|
||||
$WMI = $_.'msWMI-Parm2' -split ';'
|
||||
[PSCustomObject] @{
|
||||
Name = $_.'msWMI-Name'
|
||||
Description = $_.'msWMI-Parm1'
|
||||
Domain = $Domain
|
||||
NameSpace = $WMI[5]
|
||||
Query = $WMI[6]
|
||||
Author = $_.'msWMI-Author'
|
||||
ID = $_.'msWMI-ID'
|
||||
Created = $_.Created
|
||||
Modified = $_.Modified
|
||||
ObjectGUID = $_.'ObjectGUID'
|
||||
CanonicalName = $_.CanonicalName
|
||||
DistinguishedName = $_.'DistinguishedName'
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
<#
|
||||
CanonicalName : ad.evotec.xyz/System/WMIPolicy/SOM/{E988C890-BDBC-4946-87B5-BF70F39F4686}
|
||||
CN : {E988C890-BDBC-4946-87B5-BF70F39F4686}
|
||||
Created : 08.04.2020 19:04:06
|
||||
createTimeStamp : 08.04.2020 19:04:06
|
||||
Deleted :
|
||||
Description :
|
||||
DisplayName :
|
||||
DistinguishedName : CN={E988C890-BDBC-4946-87B5-BF70F39F4686},CN=SOM,CN=WMIPolicy,CN=System,DC=ad,DC=evotec,DC=xyz
|
||||
dSCorePropagationData : {01.01.1601 01:00:00}
|
||||
instanceType : 4
|
||||
isDeleted :
|
||||
LastKnownParent :
|
||||
Modified : 08.04.2020 19:04:06
|
||||
modifyTimeStamp : 08.04.2020 19:04:06
|
||||
msWMI-Author : przemyslaw.klys@evotec.pl
|
||||
msWMI-ChangeDate : 20200408170406.280000-000
|
||||
msWMI-CreationDate : 20200408170406.280000-000
|
||||
msWMI-ID : {E988C890-BDBC-4946-87B5-BF70F39F4686}
|
||||
msWMI-Name : Virtual Machines
|
||||
msWMI-Parm1 : Oh my description
|
||||
msWMI-Parm2 : 1;3;10;66;WQL;root\CIMv2;SELECT * FROM Win32_ComputerSystem WHERE Model = "Virtual Machine";
|
||||
Name : {E988C890-BDBC-4946-87B5-BF70F39F4686}
|
||||
nTSecurityDescriptor : System.DirectoryServices.ActiveDirectorySecurity
|
||||
ObjectCategory : CN=ms-WMI-Som,CN=Schema,CN=Configuration,DC=ad,DC=evotec,DC=xyz
|
||||
ObjectClass : msWMI-Som
|
||||
ObjectGUID : c1ee708d-7a67-46e2-b13f-d11a573d2597
|
||||
ProtectedFromAccidentalDeletion : False
|
||||
sDRightsEffective : 15
|
||||
showInAdvancedViewOnly : True
|
||||
uSNChanged : 12785589
|
||||
uSNCreated : 12785589
|
||||
whenChanged : 08.04.2020 19:04:06
|
||||
whenCreated : 08.04.2020 19:04:06
|
||||
#>
|
||||
Reference in New Issue
Block a user