diff --git a/Public/Get-GPOZaurrLink.ps1 b/Public/Get-GPOZaurrLink.ps1 index ef475e0..d1a7042 100644 --- a/Public/Get-GPOZaurrLink.ps1 +++ b/Public/Get-GPOZaurrLink.ps1 @@ -77,7 +77,11 @@ #} $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')" $Splat['SearchBase'] = $SearchBase - $ADObjectGPO = Get-ADObject @Splat + try { + $ADObjectGPO = Get-ADObject @Splat + } catch { + Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" + } foreach ($_ in $ADObjectGPO) { $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache foreach ($OutputGPO in $OutputGPOs) { @@ -101,7 +105,11 @@ # } $Splat['Filter'] = "objectClass -eq 'domainDNS'" $Splat['SearchBase'] = $SearchBase - $ADObjectGPO = Get-ADObject @Splat + try { + $ADObjectGPO = Get-ADObject @Splat + } catch { + Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" + } foreach ($_ in $ADObjectGPO) { $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache foreach ($OutputGPO in $OutputGPOs) { @@ -127,7 +135,11 @@ #} $Splat['Filter'] = "(objectClass -eq 'site')" $Splat['SearchBase'] = $SearchBase - $ADObjectGPO = Get-ADObject @Splat + try { + $ADObjectGPO = Get-ADObject @Splat + } catch { + Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" + } foreach ($_ in $ADObjectGPO) { Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache } @@ -141,7 +153,11 @@ #} $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')" $Splat['SearchBase'] = $SearchBase - $ADObjectGPO = Get-ADObject @Splat + try { + $ADObjectGPO = Get-ADObject @Splat + } catch { + Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" + } foreach ($_ in $ADObjectGPO) { if ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) { # other skips Domain Root @@ -174,7 +190,8 @@ } if ($PSBoundParameters.ContainsKey('SearchBase')) { $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'] - if ($SearchBase -notlike "*$DomainDistinguishedName") { + $SearchBaseDC = ConvertFrom-DistinguishedName -DistinguishedName $SearchBase -ToDC + if ($SearchBaseDC -ne $DomainDistinguishedName) { # we check if SearchBase is part of domain distinugishname. If it isn't we skip continue } @@ -187,22 +204,22 @@ try { $ADObjectGPO = Get-ADObject @Splat - foreach ($_ in $ADObjectGPO) { - $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache - foreach ($OutputGPO in $OutputGPOs) { - if (-not $SkipDuplicates) { + } catch { + Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)" + } + foreach ($_ in $ADObjectGPO) { + $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache + foreach ($OutputGPO in $OutputGPOs) { + if (-not $SkipDuplicates) { + $OutputGPO + } else { + $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid) + if (-not $CacheReturnedGPOs[$UniqueGuid]) { + $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO $OutputGPO - } else { - $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid) - if (-not $CacheReturnedGPOs[$UniqueGuid]) { - $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO - $OutputGPO - } } } } - } catch { - Write-Warning "Get-GPOZaurrLink - Processing error $($_.Exception.Message)" } } } diff --git a/Public/Get-GPOZaurrPermission.ps1 b/Public/Get-GPOZaurrPermission.ps1 index fef74ac..ab108e2 100644 --- a/Public/Get-GPOZaurrPermission.ps1 +++ b/Public/Get-GPOZaurrPermission.ps1 @@ -71,6 +71,7 @@ Server = $QueryServer ErrorAction = 'SilentlyContinue' } + $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / Name: $GPOName) with:" } elseif ($GPOGuid) { $getGPOSplat = @{ Guid = $GPOGuid @@ -78,6 +79,7 @@ Server = $QueryServer ErrorAction = 'SilentlyContinue' } + $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / GUID: $GPOGuid) with:" } else { $getGPOSplat = @{ All = $true @@ -85,48 +87,58 @@ Server = $QueryServer ErrorAction = 'SilentlyContinue' } + $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / All: $True) with:" } - Get-GPO @getGPOSplat | ForEach-Object -Process { - $GPOSecurity = $_.GetSecurityInfo() - $getPrivPermissionSplat = @{ - Principal = $Principal - PrincipalType = $PrincipalType - PermitType = $PermitType - Accounts = $Accounts - Type = $Type - GPO = $_ - SkipWellKnown = $SkipWellKnown.IsPresent - SkipAdministrative = $SkipAdministrative.IsPresent - IncludeOwner = $IncludeOwner.IsPresent - IncludeGPOObject = $IncludeGPOObject.IsPresent - IncludePermissionType = $IncludePermissionType - ExcludePermissionType = $ExcludePermissionType - ExcludePrincipal = $ExcludePrincipal - ExcludePrincipalType = $ExcludePrincipalType - ADAdministrativeGroups = $ADAdministrativeGroups - ExtendedForestInformation = $ForestInformation - SecurityRights = $GPOSecurity - } - $Output = Get-PrivPermission @getPrivPermissionSplat - if (-not $Output) { - if ($ReturnSecurityWhenNoData) { - # there is no data to return, but we need to have GPO information to process ADD permissions. - $ReturnObject = [PSCustomObject] @{ - DisplayName = $_.DisplayName # : ALL | Enable RDP - GUID = $_.ID - DomainName = $_.DomainName # : ad.evotec.xyz - Enabled = $_.GpoStatus - Description = $_.Description - CreationDate = $_.CreationTime - ModificationTime = $_.ModificationTime - GPOObject = $_ - GPOSecurity = $GPOSecurity - } - $ReturnObject + Try { + Get-GPO @getGPOSplat | ForEach-Object -Process { + $GPOSecurity = $_.GetSecurityInfo() + $getPrivPermissionSplat = @{ + Principal = $Principal + PrincipalType = $PrincipalType + PermitType = $PermitType + Accounts = $Accounts + Type = $Type + GPO = $_ + SkipWellKnown = $SkipWellKnown.IsPresent + SkipAdministrative = $SkipAdministrative.IsPresent + IncludeOwner = $IncludeOwner.IsPresent + IncludeGPOObject = $IncludeGPOObject.IsPresent + IncludePermissionType = $IncludePermissionType + ExcludePermissionType = $ExcludePermissionType + ExcludePrincipal = $ExcludePrincipal + ExcludePrincipalType = $ExcludePrincipalType + ADAdministrativeGroups = $ADAdministrativeGroups + ExtendedForestInformation = $ForestInformation + SecurityRights = $GPOSecurity + } + try { + $Output = Get-PrivPermission @getPrivPermissionSplat + } catch { + $Output = $null + Write-Warning "Get-GPOZaurrPermission - Error running Get-PrivPermission: $($_.Exception.Message)" + } + if (-not $Output) { + if ($ReturnSecurityWhenNoData) { + # there is no data to return, but we need to have GPO information to process ADD permissions. + $ReturnObject = [PSCustomObject] @{ + DisplayName = $_.DisplayName # : ALL | Enable RDP + GUID = $_.ID + DomainName = $_.DomainName # : ad.evotec.xyz + Enabled = $_.GpoStatus + Description = $_.Description + CreationDate = $_.CreationTime + ModificationTime = $_.ModificationTime + GPOObject = $_ + GPOSecurity = $GPOSecurity + } + $ReturnObject + } + } else { + $Output } - } else { - $Output } + } catch { + Write-Warning "Get-GPOZaurrPermission - $TextForError $($_.Exception.Message)" } } }