gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-12 03:36:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-11-07 16:13:02 +01:00
parent 2a92c90b0c
commit 3e5c5fd6fb
9 changed files with 92 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/Invoke.GPOZaurrAnalysis.ps1
+9 -9
View File
@@ -1,21 +1,21 @@
$GPOZaurrAnalysis = [ordered] @{
Name = 'Group Policy Content'
Enabled = $true
Action = $null
Data = $null
Execute = {
Name = 'Group Policy Content'
Enabled = $true
ActionRequired = $null
Data = $null
Execute = {
Invoke-GPOZaurrContent
}
Processing = {
Processing = {
}
Variables = @{
Variables = @{
}
Overview = {
Overview = {
}
Solution = {
Solution = {
foreach ($Key in $Script:Reporting['GPOAnalysis']['Data'].Keys) {
New-HTMLTab -Name $Key {
New-HTMLTable -DataTable $Script:Reporting['GPOAnalysis']['Data'][$Key] -Filtering -Title $Key
Private/Invoke.GPOZaurrBlockedInheritance.ps1
+9 -9
View File
@@ -1,21 +1,21 @@
$GPOZaurrBlockedInheritance = [ordered] @{
Name = 'Group Policy Blocked Inhertiance'
Enabled = $true
Action = $null
Data = $null
Execute = {
Name = 'Group Policy Blocked Inhertiance'
Enabled = $true
ActionRequired = $null
Data = $null
Execute = {
Get-GPOZaurrInheritance -IncludeBlockedObjects -OnlyBlockedInheritance
}
Processing = {
Processing = {
}
Variables = @{
Variables = @{
}
Overview = {
Overview = {
}
Solution = {
Solution = {
New-HTMLTable -DataTable $Script:Reporting['GPOBlockedInheritance']['Data'] -Filtering
}
}
Private/Invoke.GPOZaurrConsistency.ps1
+12 -12
View File
@@ -1,10 +1,10 @@
$GPOZaurrConsistency = [ordered] @{
Name = 'GPO Permissions Consistency'
Enabled = $true
Action = $null
Data = $null
Execute = { Get-GPOZaurrPermissionConsistency -Type All -VerifyInheritance }
Processing = {
Name = 'GPO Permissions Consistency'
Enabled = $true
ActionRequired = $null
Data = $null
Execute = { Get-GPOZaurrPermissionConsistency -Type All -VerifyInheritance }
Processing = {
foreach ($GPO in $Script:Reporting['GPOConsistency']['Data']) {
if ($GPO.ACLConsistent -eq $true) {
$Script:Reporting['GPOConsistency']['Variables']['Consistent']++
@@ -18,18 +18,18 @@
}
}
if ($Script:Reporting['GPOConsistency']['Variables']['Inconsistent'].Count -gt 0 -or $Script:Reporting['GPOConsistency']['Variables']['InconsistentInside'].Count -gt 0 ) {
$Script:Reporting['GPOConsistency']['Action'] = $true
$Script:Reporting['GPOConsistency']['ActionRequired'] = $true
} else {
$Script:Reporting['GPOConsistency']['Action'] = $false
$Script:Reporting['GPOConsistency']['ActionRequired'] = $false
}
}
Variables = @{
Variables = @{
Consistent = 0
Inconsistent = 0
ConsistentInside = 0
InconsistentInside = 0
}
Overview = {
Overview = {
New-HTMLPanel {
New-HTMLText -Text 'Following chart presents ', 'permissions consistency between Active Directory and SYSVOL for Group Policies' -FontSize 10pt -FontWeight normal, bold
New-HTMLList -Type Unordered {
@@ -48,7 +48,7 @@
} -Title 'Permissions Consistency' -TitleAlignment center
}
}
Summary = {
Summary = {
New-HTMLText -FontSize 10pt -TextBlock {
"When GPO is created it creates an entry in Active Directory (metadata) and SYSVOL (content). "
"Two different places meens two different sets of permissions. Group Policy module is making sure the data in both places is correct. "
@@ -66,7 +66,7 @@
New-HTMLText -FontSize 10pt -Text 'Having incosistent permissions on AD in comparison to those on SYSVOL can lead to uncontrolled ability to modify them. Please notice that if ', `
' Not available ', 'is visible in the table you should first fix related, more pressing issue, before fixing permissions inconsistency.' -FontWeight normal, bold, normal
}
Solution = {
Solution = {
New-HTMLSection -Invisible {
New-HTMLPanel {
& $Script:GPOConfiguration['GPOConsistency']['Summary']
Private/Invoke.GPOZaurrFiles.ps1
+9 -9
View File
@@ -1,21 +1,21 @@
$GPOZaurrFiles = [ordered] @{
Name = 'SYSVOL (NetLogon) Files List'
Enabled = $true
Action = $null
Data = $null
Execute = {
Name = 'SYSVOL (NetLogon) Files List'
Enabled = $true
ActionRequired = $null
Data = $null
Execute = {
Get-GPOZaurrFiles
}
Processing = {
Processing = {
}
Variables = @{
Variables = @{
}
Overview = {
Overview = {
}
Solution = {
Solution = {
New-HTMLTable -DataTable $Script:Reporting['GPOFiles']['Data'] -Filtering
}
}
Private/Invoke.GPOZaurrList.ps1
+5
View File
@@ -41,6 +41,11 @@
}
}
$Script:Reporting['GPOList']['Variables']['GPOTotal'] = $Script:Reporting['GPOList']['Data'].Count
if ($Script:Reporting['GPOList']['Variables']['GPOEmptyOrUnlinked'].Count -gt 0) {
$Script:Reporting['GPOList']['ActionRequired'] = $true
} else {
$Script:Reporting['GPOList']['ActionRequired'] = $false
}
}
Variables = @{
GPONotLinked = 0
Private/Invoke.GPOZaurrNetLogonPermissions.ps1
+11 -11
View File
@@ -1,12 +1,12 @@
$GPOZaurrNetLogonPermissions = [ordered] @{
Name = 'NetLogon Permissions'
Enabled = $true
Action = $null
Data = $null
Execute = {
Name = 'NetLogon Permissions'
Enabled = $true
ActionRequired = $null
Data = $null
Execute = {
Get-GPOZaurrNetLogon
}
Processing = {
Processing = {
foreach ($File in $Script:Reporting['NetLogonPermissions']['Data']) {
if ($File.FileSystemRights -eq 'Owner') {
$Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwners']++
@@ -31,12 +31,12 @@
}
}
if ($Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'].Count -gt 0) {
$Script:Reporting['NetLogonPermissions']['Action'] = $true
$Script:Reporting['NetLogonPermissions']['ActionRequired'] = $true
} else {
$Script:Reporting['NetLogonPermissions']['Action'] = $false
$Script:Reporting['NetLogonPermissions']['ActionRequired'] = $false
}
}
Variables = @{
Variables = @{
NetLogonOwners = 0
NetLogonOwnersAdministrators = 0
NetLogonOwnersNotAdministrative = 0
@@ -46,7 +46,7 @@
Owner = [System.Collections.Generic.List[PSCustomObject]]::new()
NonOwner = [System.Collections.Generic.List[PSCustomObject]]::new()
}
Overview = {
Overview = {
New-HTMLPanel {
New-HTMLText -Text 'Following chart presents ', 'NetLogon Summary' -FontSize 10pt -FontWeight normal, bold
New-HTMLList -Type Unordered {
@@ -69,7 +69,7 @@
}
}
Solution = {
Solution = {
New-HTMLTab -Name 'NetLogon Owners' {
New-HTMLSection -Invisible {
New-HTMLPanel {
Private/Invoke.GPOZaurrOrphans.ps1
+18 -10
View File
@@ -1,28 +1,36 @@
$GPOZaurrOrphans = [ordered] @{
Name = 'Orphaned Group Policies'
Enabled = $true
Action = $null
Data = $null
Execute = {
Name = 'Orphaned Group Policies'
Enabled = $true
ActionRequired = $null
Data = $null
Execute = {
Get-GPOZaurrBroken
}
Processing = {
Processing = {
foreach ($GPO in $Script:Reporting['GPOOrphans']['Data']) {
if ($GPO.Status -eq 'Not available in AD') {
$Script:Reporting['GPOOrphans']['Variables']['NotAvailableInAD']++
$Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted']++
} elseif ($GPO.Status -eq 'Not available on SYSVOL') {
$Script:Reporting['GPOOrphans']['Variables']['NotAvailableOnSysvol']++
$Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted']++
} elseif ($GPO.Status -eq 'Permissions issue') {
$Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssue']++
}
}
if ($Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted'].Count -gt 0) {
$Script:Reporting['GPOOrphans']['ActionRequired'] = $true
} else {
$Script:Reporting['GPOOrphans']['ActionRequired'] = $false
}
}
Variables = @{
Variables = @{
NotAvailableInAD = 0
NotAvailableOnSysvol = 0
NotAvailablePermissionIssue = 0
ToBeDeleted = 0
}
Overview = {
Overview = {
New-HTMLPanel {
New-HTMLText -TextBlock {
"Group Policies are stored in two places - Active Directory (metadata) and SYSVOL (content)."
@@ -48,7 +56,7 @@
} -Title 'Broken / Orphaned Group Policies' -TitleAlignment center
}
}
Summary = {
Summary = {
New-HTMLPanel {
New-HTMLText -TextBlock {
"Group Policies are stored in two places - Active Directory (metadata) and SYSVOL (content)."
@@ -70,7 +78,7 @@
New-HTMLText -Text "Please review output in table and follow the steps below table to get Active Directory Group Policies in healthy state." -FontSize 10pt
}
}
Solution = {
Solution = {
New-HTMLSection -Invisible {
& $Script:GPOConfiguration['GPOOrphans']['Summary']
New-HTMLPanel {
Private/Invoke.GPOZaurrOwners.ps1
+12 -12
View File
@@ -1,10 +1,10 @@
$GPOZaurrOwners = [ordered] @{
Name = 'Group Policy Owners'
Enabled = $true
Action = $null
Data = $null
Execute = { Get-GPOZaurrOwner -IncludeSysvol }
Processing = {
Name = 'Group Policy Owners'
Enabled = $true
ActionRequired = $null
Data = $null
Execute = { Get-GPOZaurrOwner -IncludeSysvol }
Processing = {
foreach ($GPO in $Script:Reporting['GPOOwners']['Data']) {
if ($GPO.IsOwnerConsistent) {
$Script:Reporting['GPOOwners']['Variables']['IsConsistent']++
@@ -25,12 +25,12 @@
}
}
if ($Script:Reporting['GPOOwners']['Variables']['WillFix'].Count -gt 0) {
$Script:Reporting['GPOOwners']['Action'] = $true
$Script:Reporting['GPOOwners']['ActionRequired'] = $true
} else {
$Script:Reporting['GPOOwners']['Action'] = $false
$Script:Reporting['GPOOwners']['ActionRequired'] = $false
}
}
Variables = @{
Variables = @{
IsAdministrative = 0
IsNotAdministrative = 0
IsConsistent = 0
@@ -39,7 +39,7 @@
RequiresDiffFix = 0
WillNotTouch = 0
}
Overview = {
Overview = {
New-HTMLPanel {
New-HTMLText -Text 'Following chart presents Group Policy owners and whether they are administrative and consistent. By design an owner of Group Policy should be Domain Admins or Enterprise Admins group only to prevent malicious takeover. ', `
"It's also important that owner in Active Directory matches owner on SYSVOL (file system)." -FontSize 10pt
@@ -57,7 +57,7 @@
} -Title 'Group Policy Owners' -TitleAlignment center
}
}
Summary = {
Summary = {
New-HTMLText -FontSize 10pt -TextBlock {
"By default GPO creation is usually maintained by Domain Admins or Enterprise Admins. "
"When GPO is created by member of Domain Admins or Enterprise Admins group the GPO Owner is set to Domain Admins. "
@@ -84,7 +84,7 @@
New-HTMLListItem -Text "Group Policies unaffected: ", $Script:Reporting['GPOOwners']['Variables']['WillNotTouch'] -FontWeight normal, bold
} -FontSize 10pt
}
Solution = {
Solution = {
New-HTMLSection -Invisible {
New-HTMLPanel {
& $Script:GPOConfiguration['GPOOwners']['Summary']
Public/Invoke-GPOZaurr.ps1
+7 -7
View File
@@ -44,13 +44,13 @@
foreach ($T in $Script:GPOConfiguration.Keys) {
if ($Script:GPOConfiguration[$T].Enabled -eq $true) {
$Script:Reporting[$T] = [ordered] @{
Name = $Script:GPOConfiguration[$T].Name
Action = $null
Data = $null
Errors = $null
Warnings = $null
Time = $null
Variables = Copy-Dictionary -Dictionary $Script:GPOConfiguration[$T]['Variables']
Name = $Script:GPOConfiguration[$T].Name
ActionRequired = $null
Data = $null
Errors = $null
Warnings = $null
Time = $null
Variables = Copy-Dictionary -Dictionary $Script:GPOConfiguration[$T]['Variables']
}
$TimeLogGPOList = Start-TimeLog
Write-Color -Text '[i]', '[Start] ', $($Script:GPOConfiguration[$T]['Name']) -Color Yellow, DarkGray, Yellow