diff --git a/Private/Get-GPOZaurrLinkLoop.ps1 b/Private/Get-GPOZaurrLinkLoop.ps1 index 3bb09bc..e6b67c7 100644 --- a/Private/Get-GPOZaurrLinkLoop.ps1 +++ b/Private/Get-GPOZaurrLinkLoop.ps1 @@ -8,10 +8,67 @@ function Get-GPOZaurrLinkLoop { [string] $SearchBase, [Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope, [string] $Filter, - [switch] $SkipDuplicates + [switch] $SkipDuplicates, + [string[]] $Site ) if (-not $ADObject) { - if (-not $Filter) { + if ($Site) { + foreach ($S in $Site) { + foreach ($Domain in $ForestInformation.Domains) { + Write-Verbose "Get-GPOZaurrLink - Getting GPO links for site $Site" + # Sites are defined only in primary domain + if ($ForestInformation['DomainsExtended'][$Domain]['DNSRoot'] -eq $ForestInformation['DomainsExtended'][$Domain]['Forest']) { + $Splat = @{ + #Filter = $Filter + Properties = 'distinguishedName', 'gplink', 'CanonicalName' + # Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')" + Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0] + } + $Splat['Filter'] = "(objectClass -eq 'site') -and (name -eq '$S')" + $Splat['SearchBase'] = -join ("CN=Configuration,", $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) + try { + $ADObjectGPO = Get-ADObject @Splat + } catch { + Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" + } + if ($ADObjectGPO) { + Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates + } + } + } + } + } elseif ($SearchBase -or $SearchScope -or $Filter) { + foreach ($Domain in $ForestInformation.Domains) { + if (-not $Filter) { + $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')" + } + $Splat = @{ + Filter = $Filter + Properties = 'distinguishedName', 'gplink', 'CanonicalName' + Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0] + } + if ($PSBoundParameters.ContainsKey('SearchBase')) { + $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'] + $SearchBaseDC = ConvertFrom-DistinguishedName -DistinguishedName $SearchBase -ToDC + if ($SearchBaseDC -ne $DomainDistinguishedName) { + # we check if SearchBase is part of domain distinugishname. If it isn't we skip + continue + } + $Splat['SearchBase'] = $SearchBase + } + if ($PSBoundParameters.ContainsKey('SearchScope')) { + $Splat['SearchScope'] = $SearchScope + } + try { + $ADObjectGPO = Get-ADObject @Splat + } catch { + Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" + } + if ($ADObjectGPO) { + Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates + } + } + } elseif (-not $Filter) { # if not linked, we force it to All if (-not $Linked) { $Linked = 'All' @@ -26,63 +83,68 @@ function Get-GPOZaurrLinkLoop { } if ($Linked -contains 'Root' -or $Linked -contains 'All') { Write-Verbose "Get-GPOZaurrLink - Getting GPO links for domain $Domain at ROOT level" - $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'] $Splat['Filter'] = "objectClass -eq 'domainDNS'" - $Splat['SearchBase'] = $SearchBase + $Splat['SearchBase'] = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'] try { $ADObjectGPO = Get-ADObject @Splat } catch { Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" } - Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates + if ($ADObjectGPO) { + Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates + } } if ($Linked -contains 'Site' -or $Linked -contains 'All') { Write-Verbose "Get-GPOZaurrLink - Getting GPO links for domain $Domain at SITE level" # Sites are defined only in primary domain if ($ForestInformation['DomainsExtended'][$Domain]['DNSRoot'] -eq $ForestInformation['DomainsExtended'][$Domain]['Forest']) { - $SearchBase = -join ("CN=Configuration,", $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) $Splat['Filter'] = "(objectClass -eq 'site')" - $Splat['SearchBase'] = $SearchBase + $Splat['SearchBase'] = -join ("CN=Configuration,", $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) try { $ADObjectGPO = Get-ADObject @Splat } catch { Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" } - Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates + if ($ADObjectGPO) { + Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates + } } } if ($Linked -contains 'DomainControllers' -or $Linked -contains 'All') { Write-Verbose "Get-GPOZaurrLink - Getting GPO links for domain $Domain at DC level" - $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer'] $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')" - $Splat['SearchBase'] = $SearchBase + $Splat['SearchBase'] = $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer'] try { $ADObjectGPO = Get-ADObject @Splat } catch { Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" } - Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates + if ($ADObjectGPO) { + Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates + } } if ($Linked -contains 'OrganizationalUnit' -or $Linked -contains 'All') { Write-Verbose "Get-GPOZaurrLink - Getting GPO links for domain $Domain at OU level" - $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'] $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')" - $Splat['SearchBase'] = $SearchBase + $Splat['SearchBase'] = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'] try { $ADObjectGPO = Get-ADObject @Splat } catch { Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" } - Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -SkipDomainRoot -SkipDomainControllers -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates + if ($ADObjectGPO) { + Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -SkipDomainRoot -SkipDomainControllers -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates + } } } - } elseif ($Filter) { + } + <# + elseif ($Filter) { foreach ($Domain in $ForestInformation.Domains) { $Splat = @{ Filter = $Filter Properties = 'distinguishedName', 'gplink', 'CanonicalName' Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0] - } if ($PSBoundParameters.ContainsKey('SearchBase')) { $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'] @@ -92,20 +154,21 @@ function Get-GPOZaurrLinkLoop { continue } $Splat['SearchBase'] = $SearchBase - } if ($PSBoundParameters.ContainsKey('SearchScope')) { $Splat['SearchScope'] = $SearchScope } - try { $ADObjectGPO = Get-ADObject @Splat } catch { Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" } - Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates + if ($ADObjectGPO) { + Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates + } } } + #> } else { Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObject -Domain '' -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates } diff --git a/Public/Get-GPOZaurrLink.ps1 b/Public/Get-GPOZaurrLink.ps1 index 12c6131..c22c70b 100644 --- a/Public/Get-GPOZaurrLink.ps1 +++ b/Public/Get-GPOZaurrLink.ps1 @@ -2,13 +2,15 @@ [cmdletbinding(DefaultParameterSetName = 'Linked')] param( [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject, - # weirdly enough site doesn't really work this way unless you give it 'CN=Configuration,DC=ad,DC=evotec,DC=xyz' as SearchBase + # site doesn't really work this way unless you give it 'CN=Configuration,DC=ad,DC=evotec,DC=xyz' as SearchBase [parameter(ParameterSetName = 'Filter')][string] $Filter, # "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')" [parameter(ParameterSetName = 'Filter')][string] $SearchBase, [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope, [parameter(ParameterSetName = 'Linked')][validateset('All', 'Root', 'DomainControllers', 'Site', 'OrganizationalUnit')][string[]] $Linked, + [parameter(ParameterSetName = 'Site')][string[]] $Site, + [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] @@ -19,36 +21,43 @@ [parameter(ParameterSetName = 'Linked')] [switch] $SkipDuplicates, + [parameter(ParameterSetName = 'Site')] [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] [System.Collections.IDictionary] $GPOCache, + [parameter(ParameterSetName = 'Site')] [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] [alias('ForestName')][string] $Forest, + [parameter(ParameterSetName = 'Site')] [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] [string[]] $ExcludeDomains, + [parameter(ParameterSetName = 'Site')] [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] [alias('Domain', 'Domains')][string[]] $IncludeDomains, + [parameter(ParameterSetName = 'Site')] [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] [System.Collections.IDictionary] $ExtendedForestInformation, + [parameter(ParameterSetName = 'Site')] [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] [switch] $AsHashTable, + [parameter(ParameterSetName = 'Site')] [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] @@ -79,6 +88,7 @@ ADObject = $ADObject Filter = $Filter SkipDuplicates = $SkipDuplicates + Site = $Site } Remove-EmptyValue -Hashtable $getGPOLoopSplat -Recursive $getGPOLoopSplat['CacheReturnedGPOs'] = $CacheReturnedGPOs