mirror of
https://github.com/EvotecIT/GPOZaurr.git
synced 2026-08-31 20:58:04 +00:00
Improve Optimize-GPOZaurr
This commit is contained in:
Przemyslaw Klys
@@ -1,7 +1,46 @@
|
|||||||
function Optimize-GPOZaurr {
|
function Optimize-GPOZaurr {
|
||||||
[cmdletBinding(SupportsShouldProcess)]
|
<#
|
||||||
|
.SYNOPSIS
|
||||||
|
Enables or disables user/computer section of group policy based on it's content.
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
Long description
|
||||||
|
|
||||||
|
.PARAMETER ExcludeGroupPolicies
|
||||||
|
Provide a list of group policies to skip using Skip-GroupPolicy cmdlet
|
||||||
|
|
||||||
|
.PARAMETER LimitProcessing
|
||||||
|
Allows to specify maximum number of items that will be fixed in a single run. It doesn't affect amount of GPOs processed
|
||||||
|
|
||||||
|
.PARAMETER Forest
|
||||||
|
Target different Forest, by default current forest is used
|
||||||
|
|
||||||
|
.PARAMETER ExcludeDomains
|
||||||
|
Exclude domain from search, by default whole forest is scanned
|
||||||
|
|
||||||
|
.PARAMETER IncludeDomains
|
||||||
|
Include only specific domains, by default whole forest is scanned
|
||||||
|
|
||||||
|
.PARAMETER ExtendedForestInformation
|
||||||
|
Ability to provide Forest Information from another command to speed up processing
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
Optimize-GPOZaurr -All -WhatIf -Verbose -LimitProcessing 2
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
Optimize-GPOZaurr -All -WhatIf -Verbose -LimitProcessing 2 {
|
||||||
|
Skip-GroupPolicy -Name 'TEST | Drive Mapping 1'
|
||||||
|
Skip-GroupPolicy -Name 'TEST | Drive Mapping 2'
|
||||||
|
}
|
||||||
|
.NOTES
|
||||||
|
General notes
|
||||||
|
#>
|
||||||
|
[cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'GPOName')]
|
||||||
param(
|
param(
|
||||||
[Parameter(Position = 1)][scriptblock] $ExcludeGroupPolicies,
|
[Parameter(Position = 1)][scriptblock] $ExcludeGroupPolicies,
|
||||||
|
[alias('Name', 'DisplayName')][Parameter(ParameterSetName = 'GPOName', Mandatory)][string] $GPOName,
|
||||||
|
[Parameter(ParameterSetName = 'GPOGUID', Mandatory)][alias('GUID', 'GPOID')][string] $GPOGuid,
|
||||||
|
[Parameter(ParameterSetName = 'All', Mandatory)][switch] $All,
|
||||||
[int] $LimitProcessing,
|
[int] $LimitProcessing,
|
||||||
[alias('ForestName')][string] $Forest,
|
[alias('ForestName')][string] $Forest,
|
||||||
[string[]] $ExcludeDomains,
|
[string[]] $ExcludeDomains,
|
||||||
@@ -12,46 +51,59 @@
|
|||||||
$Count = 0
|
$Count = 0
|
||||||
}
|
}
|
||||||
Process {
|
Process {
|
||||||
Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -ExcludeGroupPolicies $ExcludeGroupPolicies | ForEach-Object {
|
$getGPOZaurrSplat = @{
|
||||||
|
GpoName = $GPOName
|
||||||
|
GPOGUID = $GPOGuid
|
||||||
|
Forest = $Forest
|
||||||
|
IncludeDomains = $IncludeDomains
|
||||||
|
ExcludeDomains = $ExcludeDomains
|
||||||
|
ExtendedForestInformation = $ExtendedForestInformation
|
||||||
|
ExcludeGroupPolicies = $ExcludeGroupPolicies
|
||||||
|
}
|
||||||
|
Remove-EmptyValue -Hashtable $getGPOZaurrSplat
|
||||||
|
|
||||||
|
Get-GPOZaurr @getGPOZaurrSplat | ForEach-Object {
|
||||||
$GPO = $_
|
$GPO = $_
|
||||||
if ($GPO.Optimized -eq $false -and $GPO.Problem -eq $false) {
|
if (-not $GPO.Exclude) {
|
||||||
if ($GPO.Empty) {
|
if ($GPO.Optimized -eq $false -and $GPO.Problem -eq $false) {
|
||||||
Write-Verbose "Optimize-GPOZaurr - GPO ($($GPO.DisplayName)) / $($GPO.DomainName)) is not optimized, but GPO is empty, so leaving as is."
|
if ($GPO.Empty) {
|
||||||
} else {
|
Write-Verbose "Optimize-GPOZaurr - GPO ($($GPO.DisplayName)) / $($GPO.DomainName)) is not optimized, but GPO is empty, so leaving as is."
|
||||||
if ($GPO.UserSettingsAvailable -and $GPO.ComputerSettingsAvailable) {
|
} else {
|
||||||
Write-Verbose "Optimize-GPOZaurr - "
|
if ($GPO.UserSettingsAvailable -and $GPO.ComputerSettingsAvailable) {
|
||||||
if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Enabling computer and user settings in domain $($GPO.DomainName)")) {
|
Write-Verbose "Optimize-GPOZaurr - "
|
||||||
try {
|
if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Enabling computer and user settings in domain $($GPO.DomainName)")) {
|
||||||
$GPO.GPOObject.GpoStatus = [Microsoft.GroupPolicy.GpoStatus]::AllSettingsEnabled
|
try {
|
||||||
} catch {
|
$GPO.GPOObject.GpoStatus = [Microsoft.GroupPolicy.GpoStatus]::AllSettingsEnabled
|
||||||
Write-Warning -Message "Optimize-GPOZaurr - Couldn't set $($GPO.DisplayName) / $($GPO.DomainName) to $Status. Error $($_.Exception.Message)"
|
} catch {
|
||||||
|
Write-Warning -Message "Optimize-GPOZaurr - Couldn't set $($GPO.DisplayName) / $($GPO.DomainName) to $Status. Error $($_.Exception.Message)"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
} elseif ($GPO.UserSettingsAvailable) {
|
||||||
} elseif ($GPO.UserSettingsAvailable) {
|
if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Disabling computer setings in domain $($GPO.DomainName)")) {
|
||||||
if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Disabling computer setings in domain $($GPO.DomainName)")) {
|
try {
|
||||||
try {
|
$GPO.GPOObject.GpoStatus = [Microsoft.GroupPolicy.GpoStatus]::ComputerSettingsDisabled
|
||||||
$GPO.GPOObject.GpoStatus = [Microsoft.GroupPolicy.GpoStatus]::ComputerSettingsDisabled
|
} catch {
|
||||||
} catch {
|
Write-Warning -Message "Optimize-GPOZaurr - Couldn't set $($GPO.DisplayName) / $($GPO.DomainName) to $Status. Error $($_.Exception.Message)"
|
||||||
Write-Warning -Message "Optimize-GPOZaurr - Couldn't set $($GPO.DisplayName) / $($GPO.DomainName) to $Status. Error $($_.Exception.Message)"
|
}
|
||||||
}
|
}
|
||||||
}
|
} elseif ($GPO.ComputerSettingsAvailable) {
|
||||||
} elseif ($GPO.ComputerSettingsAvailable) {
|
if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Disabling user setings in domain $($GPO.DomainName)")) {
|
||||||
if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Disabling user setings in domain $($GPO.DomainName)")) {
|
try {
|
||||||
try {
|
$GPO.GPOObject.GpoStatus = [Microsoft.GroupPolicy.GpoStatus]::UserSettingsDisabled
|
||||||
$GPO.GPOObject.GpoStatus = [Microsoft.GroupPolicy.GpoStatus]::UserSettingsDisabled
|
} catch {
|
||||||
} catch {
|
Write-Warning -Message "Optimize-GPOZaurr - Couldn't set $($GPO.DisplayName) / $($GPO.DomainName) to $Status. Error $($_.Exception.Message)"
|
||||||
Write-Warning -Message "Optimize-GPOZaurr - Couldn't set $($GPO.DisplayName) / $($GPO.DomainName) to $Status. Error $($_.Exception.Message)"
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
|
||||||
|
|
||||||
$Count++
|
$Count++
|
||||||
if ($LimitProcessing -eq $Count) {
|
if ($LimitProcessing -eq $Count) {
|
||||||
break
|
break
|
||||||
|
}
|
||||||
|
} elseif ($GPO.Optimized -eq $false) {
|
||||||
|
Write-Warning "Optimize-GPOZaurr - GPO ($($GPO.DisplayName)) / $($GPO.DomainName)) is not optimized, but GPO is marked as one with problem. Skipping."
|
||||||
}
|
}
|
||||||
} elseif ($GPO.Optimized -eq $false) {
|
|
||||||
Write-Warning "Optimize-GPOZaurr - GPO ($($GPO.DisplayName)) / $($GPO.DomainName)) is not optimized, but GPO is marked as one with problem. Skipping."
|
|
||||||
}
|
}
|
||||||
<#
|
<#
|
||||||
if ($GPO.UserSettingsAvailable -eq $false -and $GPO.ComputerSettingsAvailable -eq $false) {
|
if ($GPO.UserSettingsAvailable -eq $false -and $GPO.ComputerSettingsAvailable -eq $false) {
|
||||||
|
|||||||
Reference in New Issue
Block a user