mirror of
https://github.com/EvotecIT/GPOZaurr.git
synced 2026-08-06 17:09:28 +00:00
Fix for Get-GPOZaurrLink and SearchBase parameter
Added some error logging
This commit is contained in:
Przemyslaw Klys
+34
-17
@@ -77,7 +77,11 @@
|
||||
#}
|
||||
$Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
$OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
foreach ($OutputGPO in $OutputGPOs) {
|
||||
@@ -101,7 +105,11 @@
|
||||
# }
|
||||
$Splat['Filter'] = "objectClass -eq 'domainDNS'"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
$OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
foreach ($OutputGPO in $OutputGPOs) {
|
||||
@@ -127,7 +135,11 @@
|
||||
#}
|
||||
$Splat['Filter'] = "(objectClass -eq 'site')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
}
|
||||
@@ -141,7 +153,11 @@
|
||||
#}
|
||||
$Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
if ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) {
|
||||
# other skips Domain Root
|
||||
@@ -174,7 +190,8 @@
|
||||
}
|
||||
if ($PSBoundParameters.ContainsKey('SearchBase')) {
|
||||
$DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
|
||||
if ($SearchBase -notlike "*$DomainDistinguishedName") {
|
||||
$SearchBaseDC = ConvertFrom-DistinguishedName -DistinguishedName $SearchBase -ToDC
|
||||
if ($SearchBaseDC -ne $DomainDistinguishedName) {
|
||||
# we check if SearchBase is part of domain distinugishname. If it isn't we skip
|
||||
continue
|
||||
}
|
||||
@@ -187,22 +204,22 @@
|
||||
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
$OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
foreach ($OutputGPO in $OutputGPOs) {
|
||||
if (-not $SkipDuplicates) {
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
$OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
foreach ($OutputGPO in $OutputGPOs) {
|
||||
if (-not $SkipDuplicates) {
|
||||
$OutputGPO
|
||||
} else {
|
||||
$UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
|
||||
if (-not $CacheReturnedGPOs[$UniqueGuid]) {
|
||||
$CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
|
||||
$OutputGPO
|
||||
} else {
|
||||
$UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
|
||||
if (-not $CacheReturnedGPOs[$UniqueGuid]) {
|
||||
$CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
|
||||
$OutputGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Processing error $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -71,6 +71,7 @@
|
||||
Server = $QueryServer
|
||||
ErrorAction = 'SilentlyContinue'
|
||||
}
|
||||
$TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / Name: $GPOName) with:"
|
||||
} elseif ($GPOGuid) {
|
||||
$getGPOSplat = @{
|
||||
Guid = $GPOGuid
|
||||
@@ -78,6 +79,7 @@
|
||||
Server = $QueryServer
|
||||
ErrorAction = 'SilentlyContinue'
|
||||
}
|
||||
$TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / GUID: $GPOGuid) with:"
|
||||
} else {
|
||||
$getGPOSplat = @{
|
||||
All = $true
|
||||
@@ -85,48 +87,58 @@
|
||||
Server = $QueryServer
|
||||
ErrorAction = 'SilentlyContinue'
|
||||
}
|
||||
$TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / All: $True) with:"
|
||||
}
|
||||
Get-GPO @getGPOSplat | ForEach-Object -Process {
|
||||
$GPOSecurity = $_.GetSecurityInfo()
|
||||
$getPrivPermissionSplat = @{
|
||||
Principal = $Principal
|
||||
PrincipalType = $PrincipalType
|
||||
PermitType = $PermitType
|
||||
Accounts = $Accounts
|
||||
Type = $Type
|
||||
GPO = $_
|
||||
SkipWellKnown = $SkipWellKnown.IsPresent
|
||||
SkipAdministrative = $SkipAdministrative.IsPresent
|
||||
IncludeOwner = $IncludeOwner.IsPresent
|
||||
IncludeGPOObject = $IncludeGPOObject.IsPresent
|
||||
IncludePermissionType = $IncludePermissionType
|
||||
ExcludePermissionType = $ExcludePermissionType
|
||||
ExcludePrincipal = $ExcludePrincipal
|
||||
ExcludePrincipalType = $ExcludePrincipalType
|
||||
ADAdministrativeGroups = $ADAdministrativeGroups
|
||||
ExtendedForestInformation = $ForestInformation
|
||||
SecurityRights = $GPOSecurity
|
||||
}
|
||||
$Output = Get-PrivPermission @getPrivPermissionSplat
|
||||
if (-not $Output) {
|
||||
if ($ReturnSecurityWhenNoData) {
|
||||
# there is no data to return, but we need to have GPO information to process ADD permissions.
|
||||
$ReturnObject = [PSCustomObject] @{
|
||||
DisplayName = $_.DisplayName # : ALL | Enable RDP
|
||||
GUID = $_.ID
|
||||
DomainName = $_.DomainName # : ad.evotec.xyz
|
||||
Enabled = $_.GpoStatus
|
||||
Description = $_.Description
|
||||
CreationDate = $_.CreationTime
|
||||
ModificationTime = $_.ModificationTime
|
||||
GPOObject = $_
|
||||
GPOSecurity = $GPOSecurity
|
||||
}
|
||||
$ReturnObject
|
||||
Try {
|
||||
Get-GPO @getGPOSplat | ForEach-Object -Process {
|
||||
$GPOSecurity = $_.GetSecurityInfo()
|
||||
$getPrivPermissionSplat = @{
|
||||
Principal = $Principal
|
||||
PrincipalType = $PrincipalType
|
||||
PermitType = $PermitType
|
||||
Accounts = $Accounts
|
||||
Type = $Type
|
||||
GPO = $_
|
||||
SkipWellKnown = $SkipWellKnown.IsPresent
|
||||
SkipAdministrative = $SkipAdministrative.IsPresent
|
||||
IncludeOwner = $IncludeOwner.IsPresent
|
||||
IncludeGPOObject = $IncludeGPOObject.IsPresent
|
||||
IncludePermissionType = $IncludePermissionType
|
||||
ExcludePermissionType = $ExcludePermissionType
|
||||
ExcludePrincipal = $ExcludePrincipal
|
||||
ExcludePrincipalType = $ExcludePrincipalType
|
||||
ADAdministrativeGroups = $ADAdministrativeGroups
|
||||
ExtendedForestInformation = $ForestInformation
|
||||
SecurityRights = $GPOSecurity
|
||||
}
|
||||
try {
|
||||
$Output = Get-PrivPermission @getPrivPermissionSplat
|
||||
} catch {
|
||||
$Output = $null
|
||||
Write-Warning "Get-GPOZaurrPermission - Error running Get-PrivPermission: $($_.Exception.Message)"
|
||||
}
|
||||
if (-not $Output) {
|
||||
if ($ReturnSecurityWhenNoData) {
|
||||
# there is no data to return, but we need to have GPO information to process ADD permissions.
|
||||
$ReturnObject = [PSCustomObject] @{
|
||||
DisplayName = $_.DisplayName # : ALL | Enable RDP
|
||||
GUID = $_.ID
|
||||
DomainName = $_.DomainName # : ad.evotec.xyz
|
||||
Enabled = $_.GpoStatus
|
||||
Description = $_.Description
|
||||
CreationDate = $_.CreationTime
|
||||
ModificationTime = $_.ModificationTime
|
||||
GPOObject = $_
|
||||
GPOSecurity = $GPOSecurity
|
||||
}
|
||||
$ReturnObject
|
||||
}
|
||||
} else {
|
||||
$Output
|
||||
}
|
||||
} else {
|
||||
$Output
|
||||
}
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrPermission - $TextForError $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user