gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-07-26 11:49:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update 0.0.6

Browse Source
This commit is contained in:
Przemysław Kłys
2020-04-08 20:23:08 +02:00
parent 7dfe5b0e41
commit 238f84309b
6 changed files with 163 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Examples/Example-04-GPOinformation.ps1
+12
View File
@@ -0,0 +1,12 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
$GPOS = Get-GPOZaurr
$GPOS | Format-Table -AutoSize
$GPOS[0] | Format-List
$GPOs[0].ACL | Format-Table -AutoSize
$GPOs.Links | Format-Table -AutoSize
$GPOS | Format-Table -AutoSize Name, WmiFilter, WMIDescription
Examples/Example-05-WMIFilters.ps1
+3
View File
@@ -0,0 +1,3 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
Get-GPOZaurrWMI | Format-Table -AutoSize *
GPOZaurr.psd1
+2 -2
View File
@@ -5,9 +5,9 @@
CompatiblePSEditions = 'Desktop' CompatiblePSEditions = 'Desktop'
Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.' Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
Description = 'Group Policy Eater' Description = 'Group Policy Eater'
FunctionsToExport = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Remove-GPOZaurr', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles' FunctionsToExport = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrWMI', 'Remove-GPOZaurr', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles'
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde' GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
ModuleVersion = '0.0.5' ModuleVersion = '0.0.6'
PowerShellVersion = '5.1' PowerShellVersion = '5.1'
PrivateData = @{ PrivateData = @{
PSData = @{ PSData = @{
Private/Get-XMLGPO.ps1
+32 -10
View File
@@ -1,7 +1,8 @@
function Get-XMLGPO { function Get-XMLGPO {
[cmdletBinding()] [cmdletBinding()]
param( param(
[XML] $XMLContent [XML] $XMLContent,
$GPO
) )
if ($XMLContent.GPO.LinksTo) { if ($XMLContent.GPO.LinksTo) {
$Linked = $true $Linked = $true
@@ -27,9 +28,9 @@
$Enabled = 'Enabled' $Enabled = 'Enabled'
} elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $false) { } elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $false) {
$Enabled = 'All settings disabled' $Enabled = 'All settings disabled'
}elseif ($UserEnabled -eq $true -and $ComputerEnabled -eq $false) { } elseif ($UserEnabled -eq $true -and $ComputerEnabled -eq $false) {
$Enabled = 'Computer configuration settings disabled' $Enabled = 'Computer configuration settings disabled'
}elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) { } elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) {
$Enabled = 'User configuration settings disabled' $Enabled = 'User configuration settings disabled'
} }
@@ -58,16 +59,37 @@
'WMIFilter' = $GPO.WmiFilter.name 'WMIFilter' = $GPO.WmiFilter.name
'WMIFilterDescription' = $GPO.WmiFilter.Description 'WMIFilterDescription' = $GPO.WmiFilter.Description
'Path' = $GPO.Path 'Path' = $GPO.Path
#'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' } 'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
'Owner' = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
'OwnerSID' = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
'ACL' = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process { 'ACL' = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
[PsCustomObject] @{ if ($_) {
'User' = $_.trustee.name.'#Text' [PsCustomObject] @{
'Permission Type' = $_.type.PermissionType 'Name' = $_.trustee.name.'#Text'
'Inherited' = $_.Inherited 'Sid' = $_.trustee.SID.'#Text'
'Permissions' = $_.Standard.GPOGroupedAccessEnum 'PermissionType' = $_.type.PermissionType
'Inherited' = $_.Inherited
'Permissions' = $_.Standard.GPOGroupedAccessEnum
}
} }
} }
'Links' = $XMLContent.GPO.LinksTo #| Select-Object -ExpandProperty SOMPath 'Auditing' = if ($XMLContent.GPO.SecurityDescriptor.AuditingPresent.'#text' -eq 'true') { $true } else { $false }
'Links' = $XMLContent.GPO.LinksTo | ForEach-Object -Process {
if ($_) {
[PSCustomObject] @{
CanonicalName = $_.SOMPath
Enabled = $_.Enabled
NoOverride = $_.NoOverride
}
}
}
<#
SOMName SOMPath Enabled NoOverride
------- ------- ------- ----------
ad ad.evotec.xyz true false
#>
#| Select-Object -ExpandProperty SOMPath
} }
#break #break
Public/Get-GPOZaurr.ps1
+1 -1
View File
@@ -18,7 +18,7 @@
Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object { Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain" Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
$XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
Get-XMLGPO -XMLContent $XMLContent Get-XMLGPO -XMLContent $XMLContent -GPO $_
} }
} }
} else { } else {
Public/Get-GPOZaurrWmi.ps1
+113
View File
@@ -0,0 +1,113 @@
function Get-GPOZaurrWMI {
[cmdletBinding()]
Param(
[Guid[]] $Guid,
[string[]] $Name,
[alias('ForestName')][string] $Forest,
[string[]] $ExcludeDomains,
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
[System.Collections.IDictionary] $ExtendedForestInformation
)
$wmiFilterAttr = "msWMI-Name", "msWMI-Parm1", "msWMI-Parm2", "msWMI-Author", "msWMI-ID", 'CanonicalName', 'Created', 'Modified'
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
foreach ($Domain in $ForestInformation.Domains) {
$QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
if ($Guid -or $Name) {
foreach ($N in $Name) {
$ldapFilter = "(&(objectClass=msWMI-Som)(msWMI-Name=$N))"
Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
$WMI = $_.'msWMI-Parm2' -split ';'
[PSCustomObject] @{
Name = $_.'msWMI-Name'
Description = $_.'msWMI-Parm1'
Domain = $Domain
NameSpace = $WMI[5]
Query = $WMI[6]
Author = $_.'msWMI-Author'
ID = $_.'msWMI-ID'
Created = $_.Created
Modified = $_.Modified
ObjectGUID = $_.'ObjectGUID'
CanonicalName = $_.CanonicalName
DistinguishedName = $_.'DistinguishedName'
}
}
}
foreach ($G in $GUID) {
$ldapFilter = "(&(objectClass=msWMI-Som)(Name={$G}))"
Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
$WMI = $_.'msWMI-Parm2' -split ';'
[PSCustomObject] @{
Name = $_.'msWMI-Name'
Description = $_.'msWMI-Parm1'
Domain = $Domain
NameSpace = $WMI[5]
Query = $WMI[6]
Author = $_.'msWMI-Author'
ID = $_.'msWMI-ID'
Created = $_.Created
Modified = $_.Modified
ObjectGUID = $_.'ObjectGUID'
CanonicalName = $_.CanonicalName
DistinguishedName = $_.'DistinguishedName'
}
}
}
} else {
$ldapFilter = "(objectClass=msWMI-Som)"
Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
$WMI = $_.'msWMI-Parm2' -split ';'
[PSCustomObject] @{
Name = $_.'msWMI-Name'
Description = $_.'msWMI-Parm1'
Domain = $Domain
NameSpace = $WMI[5]
Query = $WMI[6]
Author = $_.'msWMI-Author'
ID = $_.'msWMI-ID'
Created = $_.Created
Modified = $_.Modified
ObjectGUID = $_.'ObjectGUID'
CanonicalName = $_.CanonicalName
DistinguishedName = $_.'DistinguishedName'
}
}
}
}
}
<#
CanonicalName : ad.evotec.xyz/System/WMIPolicy/SOM/{E988C890-BDBC-4946-87B5-BF70F39F4686}
CN : {E988C890-BDBC-4946-87B5-BF70F39F4686}
Created : 08.04.2020 19:04:06
createTimeStamp : 08.04.2020 19:04:06
Deleted :
Description :
DisplayName :
DistinguishedName : CN={E988C890-BDBC-4946-87B5-BF70F39F4686},CN=SOM,CN=WMIPolicy,CN=System,DC=ad,DC=evotec,DC=xyz
dSCorePropagationData : {01.01.1601 01:00:00}
instanceType : 4
isDeleted :
LastKnownParent :
Modified : 08.04.2020 19:04:06
modifyTimeStamp : 08.04.2020 19:04:06
msWMI-Author : przemyslaw.klys@evotec.pl
msWMI-ChangeDate : 20200408170406.280000-000
msWMI-CreationDate : 20200408170406.280000-000
msWMI-ID : {E988C890-BDBC-4946-87B5-BF70F39F4686}
msWMI-Name : Virtual Machines
msWMI-Parm1 : Oh my description
msWMI-Parm2 : 1;3;10;66;WQL;root\CIMv2;SELECT * FROM Win32_ComputerSystem WHERE Model = "Virtual Machine";
Name : {E988C890-BDBC-4946-87B5-BF70F39F4686}
nTSecurityDescriptor : System.DirectoryServices.ActiveDirectorySecurity
ObjectCategory : CN=ms-WMI-Som,CN=Schema,CN=Configuration,DC=ad,DC=evotec,DC=xyz
ObjectClass : msWMI-Som
ObjectGUID : c1ee708d-7a67-46e2-b13f-d11a573d2597
ProtectedFromAccidentalDeletion : False
sDRightsEffective : 15
showInAdvancedViewOnly : True
uSNChanged : 12785589
uSNCreated : 12785589
whenChanged : 08.04.2020 19:04:06
whenCreated : 08.04.2020 19:04:06
#>