gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-07-26 11:49:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-11-11 22:34:29 +01:00
parent a6a847d720
commit 25a59572dd
4 changed files with 149 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Examples/Example-16-AddRemoveGPOPermission01.ps1
+14 -12
View File
@@ -1,21 +1,23 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
#$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-IncludeGPOObject #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
#$T | Format-Table -AutoSize *
$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-IncludeGPOObject #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
$T | Format-Table -AutoSize *
#Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'CN=Przemysław Kłys,OU=Users,OU=Accounts,OU=Production,DC=ad,DC=evotec,DC=xyz' -PrincipalType DistinguishedName -Verbose #-WhatIf
#Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose #-WhatIf
#Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'S-1-5-21-853615985-2870445339-3163598659-1105' -PrincipalType Sid -Verbose #-WhatIf
#Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'CN=Administrator,OU=Special,OU=Accounts,OU=Production,DC=ad,DC=evotec,DC=xyz' -PrincipalType DistinguishedName -Verbose #-WhatIf
#$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
#$T | Format-Table -AutoSize *
Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose #-WhatIf
Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'S-1-5-21-853615985-2870445339-3163598659-1105' -PrincipalType Sid -Verbose #-WhatIf
$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
$T | Format-Table -AutoSize *
Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -PrincipalType Name -Verbose #-WhatIf
#Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose #-WhatIf
#Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'EVOTEC\przemyslaw.klys' -PrincipalType NetbiosName -Verbose #-WhatIf
#Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'CN=Przemysław Kłys,OU=Users,OU=Accounts,OU=Production,DC=ad,DC=evotec,DC=xyz' -PrincipalType DistinguishedName -Verbose #-WhatIf
#Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Type NotAdministrative -Verbose
Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose #-WhatIf
Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'EVOTEC\przemyslaw.klys' -PrincipalType NetbiosName -Verbose #-WhatIf
Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'CN=Przemysław Kłys,OU=Users,OU=Accounts,OU=Production,DC=ad,DC=evotec,DC=xyz' -PrincipalType DistinguishedName -Verbose #-WhatIf
Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Type NotAdministrative -Verbose
Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEditDeleteModifySecurity -PrincipalType DistinguishedName -Principal 'CN=Domain Admins,CN=Users,DC=ad,DC=evotec,DC=pl' -Verbose
#$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
#$T | Format-Table -AutoSize *
$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
$T | Format-Table -AutoSize *
GPOZaurr.Tests.ps1
+59
View File
@@ -0,0 +1,59 @@
$ModuleName = (Get-ChildItem $PSScriptRoot\*.psd1).BaseName
$PrimaryModule = Get-ChildItem -Path $PSScriptRoot -Filter '*.psd1' -Recurse -ErrorAction SilentlyContinue -Depth 1
if (-not $PrimaryModule) {
throw "Path $PSScriptRoot doesn't contain PSD1 files. Failing tests."
}
if ($PrimaryModule.Count -ne 1) {
throw 'More than one PSD1 files detected. Failing tests.'
}
$PSDInformation = Import-PowerShellDataFile -Path $PrimaryModule.FullName
$RequiredModules = @(
'Pester'
'PSWriteColor'
'PSParseHTML'
if ($PSDInformation.RequiredModules) {
$PSDInformation.RequiredModules
}
)
foreach ($Module in $RequiredModules) {
if ($Module -is [System.Collections.IDictionary]) {
$Exists = Get-Module -ListAvailable -Name $Module.ModuleName
if (-not $Exists) {
Write-Warning "$ModuleName - Downloading $($Module.ModuleName) from PSGallery"
Install-Module -Name $Module.ModuleName -Force -SkipPublisherCheck
}
} else {
$Exists = Get-Module -ListAvailable $Module -ErrorAction SilentlyContinue
if (-not $Exists) {
Install-Module -Name $Module -Force -SkipPublisherCheck
}
}
}
Write-Color 'ModuleName: ', $ModuleName, ' Version: ', $PSDInformation.ModuleVersion -Color Yellow, Green, Yellow, Green -LinesBefore 2
Write-Color 'PowerShell Version: ', $PSVersionTable.PSVersion -Color Yellow, Green
Write-Color 'PowerShell Edition: ', $PSVersionTable.PSEdition -Color Yellow, Green
Write-Color 'Required modules: ' -Color Yellow
foreach ($Module in $PSDInformation.RequiredModules) {
if ($Module -is [System.Collections.IDictionary]) {
Write-Color ' [>] ', $Module.ModuleName, ' Version: ', $Module.ModuleVersion -Color Yellow, Green, Yellow, Green
} else {
Write-Color ' [>] ', $Module -Color Yellow, Green
}
}
Write-Color
Import-Module $PSScriptRoot\*.psd1 -Force
Import-Module Pester -Force
$Configuration = [PesterConfiguration]::Default
$Configuration.Run.Path = "$PSScriptRoot\Tests"
$Configuration.Run.Exit = $true
$Configuration.Should.ErrorAction = 'Continue'
$Configuration.CodeCoverage.Enabled = $false
$Configuration.Output.Verbosity = 'Detailed'
$Result = Invoke-Pester -Configuration $Configuration
#$result = Invoke-Pester -Script $PSScriptRoot\Tests -Verbose -Output Detailed #-EnableExit
if ($Result.FailedCount -gt 0) {
throw "$($Result.FailedCount) tests failed."
}
Public/Add-GPOZaurrPermission.ps1
+7
View File
@@ -153,6 +153,13 @@
if ($Type -eq 'Default') {
Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
$CountFixed++
if ($PrincipalType -eq 'DistinguishedName') {
$ADIdentity = Get-WinADObject -Identity $Principal
if ($ADIdentity) {
Write-Verbose "Add-GPOZaurrPermission - Need to convert DN $Principal to SID $($ADIdentity.ObjectSID) to $($GPO.DisplayName) at $($GPO.DomainName)"
$Principal = $ADIdentity.ObjectSID
}
}
if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
try {
Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal)"
Tests/GetAddRemoveGPOPermissions.Tests.ps1
+69
View File
@@ -0,0 +1,69 @@
Describe 'GPO Permissions Management - Simple' {
BeforeAll {
# just in case some tests failed before and added user stays
Remove-GPOZaurrPermission -GPOName 'TEST | GPOZaurr Permissions Testing' -PermissionType GpoEdit -Principal 'EVOTEC\przemyslaw.klys' -PrincipalType NetbiosName -Verbose
}
It 'Get-GPOZaurrPermission - Should return proper data' {
$GPOPermissions = Get-GPOZaurrPermission -GPOName 'TEST | GPOZaurr Permissions Testing'
($GPOPermissions | Where-Object { $_.Permission -eq 'GPOApply' }) | Should -BeOfType PSCustomObject
($GPOPermissions | Where-Object { $_.Permission -eq 'GPOApply' }).PrincipalNetBiosName | Should -Be 'NT AUTHORITY\Authenticated Users'
$GPOPermissions = Get-GPOZaurrPermission -GPOName 'TEST | GPOZaurr Permissions Testing' -IncludePermissionType GpoEditDeleteModifySecurity -Type NotAdministrative
$GPOPermissions.PrincipalNetBiosName | Should -Be 'NT AUTHORITY\SYSTEM'
$GPOPermissions.PrincipalSidType | Should -Be 'WellKnownAdministrative'
$GPOPermissions.PrincipalObjectClass | Should -Be 'foreignSecurityPrincipal'
$GPOPermissions.DisplayName | Should -be 'TEST | GPOZaurr Permissions Testing'
$GPOPermissions.Permission | Should -Be 'GpoEditDeleteModifySecurity'
[Array] $GPOPermissions = Get-GPOZaurrPermission -GPOName 'TEST | GPOZaurr Permissions Testing' -IncludePermissionType GpoEditDeleteModifySecurity
$GPOPermissions.Count | Should -be 3
$SYSTEM = $GPOPermissions | Where-Object { $_.PrincipalNetBiosName -eq 'NT AUTHORITY\SYSTEM' }
$SYSTEM.PrincipalNetBiosName | Should -Be 'NT AUTHORITY\SYSTEM'
$SYSTEM.PrincipalSidType | Should -Be 'WellKnownAdministrative'
$SYSTEM.PrincipalObjectClass | Should -Be 'foreignSecurityPrincipal'
$SYSTEM.DisplayName | Should -be 'TEST | GPOZaurr Permissions Testing'
$SYSTEM.Permission | Should -Be 'GpoEditDeleteModifySecurity'
$DomainAdmins = $GPOPermissions | Where-Object { $_.PrincipalNetBiosName -eq 'EVOTEC\Domain Admins' }
$DomainAdmins.PrincipalNetBiosName | Should -Be 'EVOTEC\Domain Admins'
$DomainAdmins.PrincipalSidType | Should -Be 'Administrative'
$DomainAdmins.PrincipalObjectClass | Should -Be 'group'
$DomainAdmins.DisplayName | Should -be 'TEST | GPOZaurr Permissions Testing'
$DomainAdmins.Permission | Should -Be 'GpoEditDeleteModifySecurity'
$EnterpriseAdmins = $GPOPermissions | Where-Object { $_.PrincipalNetBiosName -eq 'EVOTEC\Enterprise Admins' }
$EnterpriseAdmins.PrincipalNetBiosName | Should -Be 'EVOTEC\Enterprise Admins'
$EnterpriseAdmins.PrincipalSidType | Should -Be 'Administrative'
$EnterpriseAdmins.PrincipalObjectClass | Should -Be 'group'
$EnterpriseAdmins.DisplayName | Should -be 'TEST | GPOZaurr Permissions Testing'
$EnterpriseAdmins.Permission | Should -Be 'GpoEditDeleteModifySecurity'
}
It 'Add-GPOZaurrPermission - With WHATIF works' {
# Tests WHATIF
Add-GPOZaurrPermission -GPOName 'TEST | GPOZaurr Permissions Testing' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose -WhatIf
$GPOPermissions = Get-GPOZaurrPermission -GPOName 'TEST | GPOZaurr Permissions Testing' -IncludePermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name
$GPOPermissions | Should -be $null
}
It 'Add-GPOZaurrPermission - Without WHATIF works' {
Add-GPOZaurrPermission -GPOName 'TEST | GPOZaurr Permissions Testing' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
$GPOPermissions = Get-GPOZaurrPermission -GPOName 'TEST | GPOZaurr Permissions Testing' -IncludePermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name
$GPOPermissions | Should -be -Not $null
$GPOPermissions.PrincipalNetBiosName | Should -Be 'EVOTEC\przemyslaw.klys'
}
It 'Remove-GPOZaurrPermission - With WHATIF' {
# Tests WHATIF
Remove-GPOZaurrPermission -GPOName 'TEST | GPOZaurr Permissions Testing' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose -WhatIf
$GPOPermissions = Get-GPOZaurrPermission -GPOName 'TEST | GPOZaurr Permissions Testing' -IncludePermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name
$GPOPermissions | Should -be -Not $null
$GPOPermissions.PrincipalNetBiosName | Should -Be 'EVOTEC\przemyslaw.klys'
}
It 'Remove-GPOZaurrPermission - Without WHATIF' {
Remove-GPOZaurrPermission -GPOName 'TEST | GPOZaurr Permissions Testing' -PermissionType GpoEdit -Principal 'EVOTEC\przemyslaw.klys' -PrincipalType NetbiosName -Verbose
$GPOPermissions = Get-GPOZaurrPermission -GPOName 'TEST | GPOZaurr Permissions Testing' -IncludePermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name
$GPOPermissions | Should -be $null
}
}