gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-09-04 14:45:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-12-28 11:42:04 +01:00
parent 8a009bf288
commit 25bbf8d52e
2 changed files with 93 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/Get-GPOZaurrLinkLoop.ps1
+82 -19
View File
@@ -8,10 +8,67 @@ function Get-GPOZaurrLinkLoop {
[string] $SearchBase, [string] $SearchBase,
[Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope, [Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
[string] $Filter, [string] $Filter,
[switch] $SkipDuplicates [switch] $SkipDuplicates,
[string[]] $Site
) )
if (-not $ADObject) { if (-not $ADObject) {
if (-not $Filter) { if ($Site) {
foreach ($S in $Site) {
foreach ($Domain in $ForestInformation.Domains) {
Write-Verbose "Get-GPOZaurrLink - Getting GPO links for site $Site"
# Sites are defined only in primary domain
if ($ForestInformation['DomainsExtended'][$Domain]['DNSRoot'] -eq $ForestInformation['DomainsExtended'][$Domain]['Forest']) {
$Splat = @{
#Filter = $Filter
Properties = 'distinguishedName', 'gplink', 'CanonicalName'
# Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')"
Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
}
$Splat['Filter'] = "(objectClass -eq 'site') -and (name -eq '$S')"
$Splat['SearchBase'] = -join ("CN=Configuration,", $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'])
try {
$ADObjectGPO = Get-ADObject @Splat
} catch {
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
}
if ($ADObjectGPO) {
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates
}
}
}
}
} elseif ($SearchBase -or $SearchScope -or $Filter) {
foreach ($Domain in $ForestInformation.Domains) {
if (-not $Filter) {
$Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')"
}
$Splat = @{
Filter = $Filter
Properties = 'distinguishedName', 'gplink', 'CanonicalName'
Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
}
if ($PSBoundParameters.ContainsKey('SearchBase')) {
$DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
$SearchBaseDC = ConvertFrom-DistinguishedName -DistinguishedName $SearchBase -ToDC
if ($SearchBaseDC -ne $DomainDistinguishedName) {
# we check if SearchBase is part of domain distinugishname. If it isn't we skip
continue
}
$Splat['SearchBase'] = $SearchBase
}
if ($PSBoundParameters.ContainsKey('SearchScope')) {
$Splat['SearchScope'] = $SearchScope
}
try {
$ADObjectGPO = Get-ADObject @Splat
} catch {
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
}
if ($ADObjectGPO) {
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates
}
}
} elseif (-not $Filter) {
# if not linked, we force it to All # if not linked, we force it to All
if (-not $Linked) { if (-not $Linked) {
$Linked = 'All' $Linked = 'All'
@@ -26,63 +83,68 @@ function Get-GPOZaurrLinkLoop {
} }
if ($Linked -contains 'Root' -or $Linked -contains 'All') { if ($Linked -contains 'Root' -or $Linked -contains 'All') {
Write-Verbose "Get-GPOZaurrLink - Getting GPO links for domain $Domain at ROOT level" Write-Verbose "Get-GPOZaurrLink - Getting GPO links for domain $Domain at ROOT level"
$SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
$Splat['Filter'] = "objectClass -eq 'domainDNS'" $Splat['Filter'] = "objectClass -eq 'domainDNS'"
$Splat['SearchBase'] = $SearchBase $Splat['SearchBase'] = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
try { try {
$ADObjectGPO = Get-ADObject @Splat $ADObjectGPO = Get-ADObject @Splat
} catch { } catch {
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
} }
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates if ($ADObjectGPO) {
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates
}
} }
if ($Linked -contains 'Site' -or $Linked -contains 'All') { if ($Linked -contains 'Site' -or $Linked -contains 'All') {
Write-Verbose "Get-GPOZaurrLink - Getting GPO links for domain $Domain at SITE level" Write-Verbose "Get-GPOZaurrLink - Getting GPO links for domain $Domain at SITE level"
# Sites are defined only in primary domain # Sites are defined only in primary domain
if ($ForestInformation['DomainsExtended'][$Domain]['DNSRoot'] -eq $ForestInformation['DomainsExtended'][$Domain]['Forest']) { if ($ForestInformation['DomainsExtended'][$Domain]['DNSRoot'] -eq $ForestInformation['DomainsExtended'][$Domain]['Forest']) {
$SearchBase = -join ("CN=Configuration,", $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'])
$Splat['Filter'] = "(objectClass -eq 'site')" $Splat['Filter'] = "(objectClass -eq 'site')"
$Splat['SearchBase'] = $SearchBase $Splat['SearchBase'] = -join ("CN=Configuration,", $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'])
try { try {
$ADObjectGPO = Get-ADObject @Splat $ADObjectGPO = Get-ADObject @Splat
} catch { } catch {
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
} }
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates if ($ADObjectGPO) {
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates
}
} }
} }
if ($Linked -contains 'DomainControllers' -or $Linked -contains 'All') { if ($Linked -contains 'DomainControllers' -or $Linked -contains 'All') {
Write-Verbose "Get-GPOZaurrLink - Getting GPO links for domain $Domain at DC level" Write-Verbose "Get-GPOZaurrLink - Getting GPO links for domain $Domain at DC level"
$SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']
$Splat['Filter'] = "(objectClass -eq 'organizationalUnit')" $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
$Splat['SearchBase'] = $SearchBase $Splat['SearchBase'] = $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']
try { try {
$ADObjectGPO = Get-ADObject @Splat $ADObjectGPO = Get-ADObject @Splat
} catch { } catch {
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
} }
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates if ($ADObjectGPO) {
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates
}
} }
if ($Linked -contains 'OrganizationalUnit' -or $Linked -contains 'All') { if ($Linked -contains 'OrganizationalUnit' -or $Linked -contains 'All') {
Write-Verbose "Get-GPOZaurrLink - Getting GPO links for domain $Domain at OU level" Write-Verbose "Get-GPOZaurrLink - Getting GPO links for domain $Domain at OU level"
$SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
$Splat['Filter'] = "(objectClass -eq 'organizationalUnit')" $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
$Splat['SearchBase'] = $SearchBase $Splat['SearchBase'] = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
try { try {
$ADObjectGPO = Get-ADObject @Splat $ADObjectGPO = Get-ADObject @Splat
} catch { } catch {
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
} }
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -SkipDomainRoot -SkipDomainControllers -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates if ($ADObjectGPO) {
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -SkipDomainRoot -SkipDomainControllers -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates
}
} }
} }
} elseif ($Filter) { }
<#
elseif ($Filter) {
foreach ($Domain in $ForestInformation.Domains) { foreach ($Domain in $ForestInformation.Domains) {
$Splat = @{ $Splat = @{
Filter = $Filter Filter = $Filter
Properties = 'distinguishedName', 'gplink', 'CanonicalName' Properties = 'distinguishedName', 'gplink', 'CanonicalName'
Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0] Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
} }
if ($PSBoundParameters.ContainsKey('SearchBase')) { if ($PSBoundParameters.ContainsKey('SearchBase')) {
$DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'] $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
@@ -92,20 +154,21 @@ function Get-GPOZaurrLinkLoop {
continue continue
} }
$Splat['SearchBase'] = $SearchBase $Splat['SearchBase'] = $SearchBase
} }
if ($PSBoundParameters.ContainsKey('SearchScope')) { if ($PSBoundParameters.ContainsKey('SearchScope')) {
$Splat['SearchScope'] = $SearchScope $Splat['SearchScope'] = $SearchScope
} }
try { try {
$ADObjectGPO = Get-ADObject @Splat $ADObjectGPO = Get-ADObject @Splat
} catch { } catch {
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
} }
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates if ($ADObjectGPO) {
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates
}
} }
} }
#>
} else { } else {
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObject -Domain '' -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObject -Domain '' -ForestInformation $ForestInformation -AsHashTable:$AsHashTable -SkipDuplicates:$SkipDuplicates
} }
Public/Get-GPOZaurrLink.ps1
+11 -1
View File
@@ -2,13 +2,15 @@
[cmdletbinding(DefaultParameterSetName = 'Linked')] [cmdletbinding(DefaultParameterSetName = 'Linked')]
param( param(
[parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject, [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
# weirdly enough site doesn't really work this way unless you give it 'CN=Configuration,DC=ad,DC=evotec,DC=xyz' as SearchBase # site doesn't really work this way unless you give it 'CN=Configuration,DC=ad,DC=evotec,DC=xyz' as SearchBase
[parameter(ParameterSetName = 'Filter')][string] $Filter, # "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')" [parameter(ParameterSetName = 'Filter')][string] $Filter, # "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')"
[parameter(ParameterSetName = 'Filter')][string] $SearchBase, [parameter(ParameterSetName = 'Filter')][string] $SearchBase,
[parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope, [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
[parameter(ParameterSetName = 'Linked')][validateset('All', 'Root', 'DomainControllers', 'Site', 'OrganizationalUnit')][string[]] $Linked, [parameter(ParameterSetName = 'Linked')][validateset('All', 'Root', 'DomainControllers', 'Site', 'OrganizationalUnit')][string[]] $Linked,
[parameter(ParameterSetName = 'Site')][string[]] $Site,
[parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'Filter')]
[parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'ADObject')]
[parameter(ParameterSetName = 'Linked')] [parameter(ParameterSetName = 'Linked')]
@@ -19,36 +21,43 @@
[parameter(ParameterSetName = 'Linked')] [parameter(ParameterSetName = 'Linked')]
[switch] $SkipDuplicates, [switch] $SkipDuplicates,
[parameter(ParameterSetName = 'Site')]
[parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'Filter')]
[parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'ADObject')]
[parameter(ParameterSetName = 'Linked')] [parameter(ParameterSetName = 'Linked')]
[System.Collections.IDictionary] $GPOCache, [System.Collections.IDictionary] $GPOCache,
[parameter(ParameterSetName = 'Site')]
[parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'Filter')]
[parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'ADObject')]
[parameter(ParameterSetName = 'Linked')] [parameter(ParameterSetName = 'Linked')]
[alias('ForestName')][string] $Forest, [alias('ForestName')][string] $Forest,
[parameter(ParameterSetName = 'Site')]
[parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'Filter')]
[parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'ADObject')]
[parameter(ParameterSetName = 'Linked')] [parameter(ParameterSetName = 'Linked')]
[string[]] $ExcludeDomains, [string[]] $ExcludeDomains,
[parameter(ParameterSetName = 'Site')]
[parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'Filter')]
[parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'ADObject')]
[parameter(ParameterSetName = 'Linked')] [parameter(ParameterSetName = 'Linked')]
[alias('Domain', 'Domains')][string[]] $IncludeDomains, [alias('Domain', 'Domains')][string[]] $IncludeDomains,
[parameter(ParameterSetName = 'Site')]
[parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'Filter')]
[parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'ADObject')]
[parameter(ParameterSetName = 'Linked')] [parameter(ParameterSetName = 'Linked')]
[System.Collections.IDictionary] $ExtendedForestInformation, [System.Collections.IDictionary] $ExtendedForestInformation,
[parameter(ParameterSetName = 'Site')]
[parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'Filter')]
[parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'ADObject')]
[parameter(ParameterSetName = 'Linked')] [parameter(ParameterSetName = 'Linked')]
[switch] $AsHashTable, [switch] $AsHashTable,
[parameter(ParameterSetName = 'Site')]
[parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'Filter')]
[parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'ADObject')]
[parameter(ParameterSetName = 'Linked')] [parameter(ParameterSetName = 'Linked')]
@@ -79,6 +88,7 @@
ADObject = $ADObject ADObject = $ADObject
Filter = $Filter Filter = $Filter
SkipDuplicates = $SkipDuplicates SkipDuplicates = $SkipDuplicates
Site = $Site
} }
Remove-EmptyValue -Hashtable $getGPOLoopSplat -Recursive Remove-EmptyValue -Hashtable $getGPOLoopSplat -Recursive
$getGPOLoopSplat['CacheReturnedGPOs'] = $CacheReturnedGPOs $getGPOLoopSplat['CacheReturnedGPOs'] = $CacheReturnedGPOs