diff --git a/Examples/Example-04-GPOinformation.ps1 b/Examples/Example-04-GPOinformation.ps1 new file mode 100644 index 0000000..b197f3d --- /dev/null +++ b/Examples/Example-04-GPOinformation.ps1 @@ -0,0 +1,12 @@ +Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force + +$GPOS = Get-GPOZaurr +$GPOS | Format-Table -AutoSize + +$GPOS[0] | Format-List + +$GPOs[0].ACL | Format-Table -AutoSize + +$GPOs.Links | Format-Table -AutoSize + +$GPOS | Format-Table -AutoSize Name, WmiFilter, WMIDescription \ No newline at end of file diff --git a/Examples/Example-05-WMIFilters.ps1 b/Examples/Example-05-WMIFilters.ps1 new file mode 100644 index 0000000..fe1dc0f --- /dev/null +++ b/Examples/Example-05-WMIFilters.ps1 @@ -0,0 +1,3 @@ +Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force + +Get-GPOZaurrWMI | Format-Table -AutoSize * \ No newline at end of file diff --git a/GPOZaurr.psd1 b/GPOZaurr.psd1 index 2e106ab..8b88782 100644 --- a/GPOZaurr.psd1 +++ b/GPOZaurr.psd1 @@ -5,9 +5,9 @@ CompatiblePSEditions = 'Desktop' Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.' Description = 'Group Policy Eater' - FunctionsToExport = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Remove-GPOZaurr', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles' + FunctionsToExport = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrWMI', 'Remove-GPOZaurr', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles' GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde' - ModuleVersion = '0.0.5' + ModuleVersion = '0.0.6' PowerShellVersion = '5.1' PrivateData = @{ PSData = @{ diff --git a/Private/Get-XMLGPO.ps1 b/Private/Get-XMLGPO.ps1 index 4a2ca66..cb3be02 100644 --- a/Private/Get-XMLGPO.ps1 +++ b/Private/Get-XMLGPO.ps1 @@ -1,7 +1,8 @@ function Get-XMLGPO { [cmdletBinding()] param( - [XML] $XMLContent + [XML] $XMLContent, + $GPO ) if ($XMLContent.GPO.LinksTo) { $Linked = $true @@ -27,9 +28,9 @@ $Enabled = 'Enabled' } elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $false) { $Enabled = 'All settings disabled' - }elseif ($UserEnabled -eq $true -and $ComputerEnabled -eq $false) { + } elseif ($UserEnabled -eq $true -and $ComputerEnabled -eq $false) { $Enabled = 'Computer configuration settings disabled' - }elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) { + } elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) { $Enabled = 'User configuration settings disabled' } @@ -58,16 +59,37 @@ 'WMIFilter' = $GPO.WmiFilter.name 'WMIFilterDescription' = $GPO.WmiFilter.Description 'Path' = $GPO.Path - #'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' } + 'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' } + 'Owner' = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text' + 'OwnerSID' = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text' 'ACL' = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process { - [PsCustomObject] @{ - 'User' = $_.trustee.name.'#Text' - 'Permission Type' = $_.type.PermissionType - 'Inherited' = $_.Inherited - 'Permissions' = $_.Standard.GPOGroupedAccessEnum + if ($_) { + [PsCustomObject] @{ + 'Name' = $_.trustee.name.'#Text' + 'Sid' = $_.trustee.SID.'#Text' + 'PermissionType' = $_.type.PermissionType + 'Inherited' = $_.Inherited + 'Permissions' = $_.Standard.GPOGroupedAccessEnum + } } } - 'Links' = $XMLContent.GPO.LinksTo #| Select-Object -ExpandProperty SOMPath + 'Auditing' = if ($XMLContent.GPO.SecurityDescriptor.AuditingPresent.'#text' -eq 'true') { $true } else { $false } + 'Links' = $XMLContent.GPO.LinksTo | ForEach-Object -Process { + if ($_) { + [PSCustomObject] @{ + CanonicalName = $_.SOMPath + Enabled = $_.Enabled + NoOverride = $_.NoOverride + } + } + } + <# + SOMName SOMPath Enabled NoOverride + ------- ------- ------- ---------- + ad ad.evotec.xyz true false + #> + + #| Select-Object -ExpandProperty SOMPath } #break diff --git a/Public/Get-GPOZaurr.ps1 b/Public/Get-GPOZaurr.ps1 index 3a9d4da..16e3f3b 100644 --- a/Public/Get-GPOZaurr.ps1 +++ b/Public/Get-GPOZaurr.ps1 @@ -18,7 +18,7 @@ Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object { Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain" $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain - Get-XMLGPO -XMLContent $XMLContent + Get-XMLGPO -XMLContent $XMLContent -GPO $_ } } } else { diff --git a/Public/Get-GPOZaurrWmi.ps1 b/Public/Get-GPOZaurrWmi.ps1 new file mode 100644 index 0000000..2720b6c --- /dev/null +++ b/Public/Get-GPOZaurrWmi.ps1 @@ -0,0 +1,113 @@ +function Get-GPOZaurrWMI { + [cmdletBinding()] + Param( + [Guid[]] $Guid, + [string[]] $Name, + [alias('ForestName')][string] $Forest, + [string[]] $ExcludeDomains, + [alias('Domain', 'Domains')][string[]] $IncludeDomains, + [System.Collections.IDictionary] $ExtendedForestInformation + ) + $wmiFilterAttr = "msWMI-Name", "msWMI-Parm1", "msWMI-Parm2", "msWMI-Author", "msWMI-ID", 'CanonicalName', 'Created', 'Modified' + + $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation + foreach ($Domain in $ForestInformation.Domains) { + $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0] + if ($Guid -or $Name) { + foreach ($N in $Name) { + $ldapFilter = "(&(objectClass=msWMI-Som)(msWMI-Name=$N))" + Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process { + $WMI = $_.'msWMI-Parm2' -split ';' + [PSCustomObject] @{ + Name = $_.'msWMI-Name' + Description = $_.'msWMI-Parm1' + Domain = $Domain + NameSpace = $WMI[5] + Query = $WMI[6] + Author = $_.'msWMI-Author' + ID = $_.'msWMI-ID' + Created = $_.Created + Modified = $_.Modified + ObjectGUID = $_.'ObjectGUID' + CanonicalName = $_.CanonicalName + DistinguishedName = $_.'DistinguishedName' + } + } + } + foreach ($G in $GUID) { + $ldapFilter = "(&(objectClass=msWMI-Som)(Name={$G}))" + Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process { + $WMI = $_.'msWMI-Parm2' -split ';' + [PSCustomObject] @{ + Name = $_.'msWMI-Name' + Description = $_.'msWMI-Parm1' + Domain = $Domain + NameSpace = $WMI[5] + Query = $WMI[6] + Author = $_.'msWMI-Author' + ID = $_.'msWMI-ID' + Created = $_.Created + Modified = $_.Modified + ObjectGUID = $_.'ObjectGUID' + CanonicalName = $_.CanonicalName + DistinguishedName = $_.'DistinguishedName' + } + } + } + } else { + $ldapFilter = "(objectClass=msWMI-Som)" + Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process { + $WMI = $_.'msWMI-Parm2' -split ';' + [PSCustomObject] @{ + Name = $_.'msWMI-Name' + Description = $_.'msWMI-Parm1' + Domain = $Domain + NameSpace = $WMI[5] + Query = $WMI[6] + Author = $_.'msWMI-Author' + ID = $_.'msWMI-ID' + Created = $_.Created + Modified = $_.Modified + ObjectGUID = $_.'ObjectGUID' + CanonicalName = $_.CanonicalName + DistinguishedName = $_.'DistinguishedName' + } + } + } + } +} +<# +CanonicalName : ad.evotec.xyz/System/WMIPolicy/SOM/{E988C890-BDBC-4946-87B5-BF70F39F4686} +CN : {E988C890-BDBC-4946-87B5-BF70F39F4686} +Created : 08.04.2020 19:04:06 +createTimeStamp : 08.04.2020 19:04:06 +Deleted : +Description : +DisplayName : +DistinguishedName : CN={E988C890-BDBC-4946-87B5-BF70F39F4686},CN=SOM,CN=WMIPolicy,CN=System,DC=ad,DC=evotec,DC=xyz +dSCorePropagationData : {01.01.1601 01:00:00} +instanceType : 4 +isDeleted : +LastKnownParent : +Modified : 08.04.2020 19:04:06 +modifyTimeStamp : 08.04.2020 19:04:06 +msWMI-Author : przemyslaw.klys@evotec.pl +msWMI-ChangeDate : 20200408170406.280000-000 +msWMI-CreationDate : 20200408170406.280000-000 +msWMI-ID : {E988C890-BDBC-4946-87B5-BF70F39F4686} +msWMI-Name : Virtual Machines +msWMI-Parm1 : Oh my description +msWMI-Parm2 : 1;3;10;66;WQL;root\CIMv2;SELECT * FROM Win32_ComputerSystem WHERE Model = "Virtual Machine"; +Name : {E988C890-BDBC-4946-87B5-BF70F39F4686} +nTSecurityDescriptor : System.DirectoryServices.ActiveDirectorySecurity +ObjectCategory : CN=ms-WMI-Som,CN=Schema,CN=Configuration,DC=ad,DC=evotec,DC=xyz +ObjectClass : msWMI-Som +ObjectGUID : c1ee708d-7a67-46e2-b13f-d11a573d2597 +ProtectedFromAccidentalDeletion : False +sDRightsEffective : 15 +showInAdvancedViewOnly : True +uSNChanged : 12785589 +uSNCreated : 12785589 +whenChanged : 08.04.2020 19:04:06 +whenCreated : 08.04.2020 19:04:06 +#> \ No newline at end of file