From 3e5c5fd6fba6d1e3fccc65c4316b2f6826e8cb21 Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Sat, 7 Nov 2020 16:13:02 +0100 Subject: [PATCH] Update --- Private/Invoke.GPOZaurrAnalysis.ps1 | 18 ++++++------ Private/Invoke.GPOZaurrBlockedInheritance.ps1 | 18 ++++++------ Private/Invoke.GPOZaurrConsistency.ps1 | 24 ++++++++-------- Private/Invoke.GPOZaurrFiles.ps1 | 18 ++++++------ Private/Invoke.GPOZaurrList.ps1 | 5 ++++ .../Invoke.GPOZaurrNetLogonPermissions.ps1 | 22 +++++++-------- Private/Invoke.GPOZaurrOrphans.ps1 | 28 ++++++++++++------- Private/Invoke.GPOZaurrOwners.ps1 | 24 ++++++++-------- Public/Invoke-GPOZaurr.ps1 | 14 +++++----- 9 files changed, 92 insertions(+), 79 deletions(-) diff --git a/Private/Invoke.GPOZaurrAnalysis.ps1 b/Private/Invoke.GPOZaurrAnalysis.ps1 index cba899b..9a12b78 100644 --- a/Private/Invoke.GPOZaurrAnalysis.ps1 +++ b/Private/Invoke.GPOZaurrAnalysis.ps1 @@ -1,21 +1,21 @@ $GPOZaurrAnalysis = [ordered] @{ - Name = 'Group Policy Content' - Enabled = $true - Action = $null - Data = $null - Execute = { + Name = 'Group Policy Content' + Enabled = $true + ActionRequired = $null + Data = $null + Execute = { Invoke-GPOZaurrContent } - Processing = { + Processing = { } - Variables = @{ + Variables = @{ } - Overview = { + Overview = { } - Solution = { + Solution = { foreach ($Key in $Script:Reporting['GPOAnalysis']['Data'].Keys) { New-HTMLTab -Name $Key { New-HTMLTable -DataTable $Script:Reporting['GPOAnalysis']['Data'][$Key] -Filtering -Title $Key diff --git a/Private/Invoke.GPOZaurrBlockedInheritance.ps1 b/Private/Invoke.GPOZaurrBlockedInheritance.ps1 index 36b4480..320d31e 100644 --- a/Private/Invoke.GPOZaurrBlockedInheritance.ps1 +++ b/Private/Invoke.GPOZaurrBlockedInheritance.ps1 @@ -1,21 +1,21 @@ $GPOZaurrBlockedInheritance = [ordered] @{ - Name = 'Group Policy Blocked Inhertiance' - Enabled = $true - Action = $null - Data = $null - Execute = { + Name = 'Group Policy Blocked Inhertiance' + Enabled = $true + ActionRequired = $null + Data = $null + Execute = { Get-GPOZaurrInheritance -IncludeBlockedObjects -OnlyBlockedInheritance } - Processing = { + Processing = { } - Variables = @{ + Variables = @{ } - Overview = { + Overview = { } - Solution = { + Solution = { New-HTMLTable -DataTable $Script:Reporting['GPOBlockedInheritance']['Data'] -Filtering } } \ No newline at end of file diff --git a/Private/Invoke.GPOZaurrConsistency.ps1 b/Private/Invoke.GPOZaurrConsistency.ps1 index ce2dcd2..0a0699b 100644 --- a/Private/Invoke.GPOZaurrConsistency.ps1 +++ b/Private/Invoke.GPOZaurrConsistency.ps1 @@ -1,10 +1,10 @@ $GPOZaurrConsistency = [ordered] @{ - Name = 'GPO Permissions Consistency' - Enabled = $true - Action = $null - Data = $null - Execute = { Get-GPOZaurrPermissionConsistency -Type All -VerifyInheritance } - Processing = { + Name = 'GPO Permissions Consistency' + Enabled = $true + ActionRequired = $null + Data = $null + Execute = { Get-GPOZaurrPermissionConsistency -Type All -VerifyInheritance } + Processing = { foreach ($GPO in $Script:Reporting['GPOConsistency']['Data']) { if ($GPO.ACLConsistent -eq $true) { $Script:Reporting['GPOConsistency']['Variables']['Consistent']++ @@ -18,18 +18,18 @@ } } if ($Script:Reporting['GPOConsistency']['Variables']['Inconsistent'].Count -gt 0 -or $Script:Reporting['GPOConsistency']['Variables']['InconsistentInside'].Count -gt 0 ) { - $Script:Reporting['GPOConsistency']['Action'] = $true + $Script:Reporting['GPOConsistency']['ActionRequired'] = $true } else { - $Script:Reporting['GPOConsistency']['Action'] = $false + $Script:Reporting['GPOConsistency']['ActionRequired'] = $false } } - Variables = @{ + Variables = @{ Consistent = 0 Inconsistent = 0 ConsistentInside = 0 InconsistentInside = 0 } - Overview = { + Overview = { New-HTMLPanel { New-HTMLText -Text 'Following chart presents ', 'permissions consistency between Active Directory and SYSVOL for Group Policies' -FontSize 10pt -FontWeight normal, bold New-HTMLList -Type Unordered { @@ -48,7 +48,7 @@ } -Title 'Permissions Consistency' -TitleAlignment center } } - Summary = { + Summary = { New-HTMLText -FontSize 10pt -TextBlock { "When GPO is created it creates an entry in Active Directory (metadata) and SYSVOL (content). " "Two different places meens two different sets of permissions. Group Policy module is making sure the data in both places is correct. " @@ -66,7 +66,7 @@ New-HTMLText -FontSize 10pt -Text 'Having incosistent permissions on AD in comparison to those on SYSVOL can lead to uncontrolled ability to modify them. Please notice that if ', ` ' Not available ', 'is visible in the table you should first fix related, more pressing issue, before fixing permissions inconsistency.' -FontWeight normal, bold, normal } - Solution = { + Solution = { New-HTMLSection -Invisible { New-HTMLPanel { & $Script:GPOConfiguration['GPOConsistency']['Summary'] diff --git a/Private/Invoke.GPOZaurrFiles.ps1 b/Private/Invoke.GPOZaurrFiles.ps1 index d41cdd7..060a7ac 100644 --- a/Private/Invoke.GPOZaurrFiles.ps1 +++ b/Private/Invoke.GPOZaurrFiles.ps1 @@ -1,21 +1,21 @@ $GPOZaurrFiles = [ordered] @{ - Name = 'SYSVOL (NetLogon) Files List' - Enabled = $true - Action = $null - Data = $null - Execute = { + Name = 'SYSVOL (NetLogon) Files List' + Enabled = $true + ActionRequired = $null + Data = $null + Execute = { Get-GPOZaurrFiles } - Processing = { + Processing = { } - Variables = @{ + Variables = @{ } - Overview = { + Overview = { } - Solution = { + Solution = { New-HTMLTable -DataTable $Script:Reporting['GPOFiles']['Data'] -Filtering } } \ No newline at end of file diff --git a/Private/Invoke.GPOZaurrList.ps1 b/Private/Invoke.GPOZaurrList.ps1 index 3cabc80..892ab4b 100644 --- a/Private/Invoke.GPOZaurrList.ps1 +++ b/Private/Invoke.GPOZaurrList.ps1 @@ -41,6 +41,11 @@ } } $Script:Reporting['GPOList']['Variables']['GPOTotal'] = $Script:Reporting['GPOList']['Data'].Count + if ($Script:Reporting['GPOList']['Variables']['GPOEmptyOrUnlinked'].Count -gt 0) { + $Script:Reporting['GPOList']['ActionRequired'] = $true + } else { + $Script:Reporting['GPOList']['ActionRequired'] = $false + } } Variables = @{ GPONotLinked = 0 diff --git a/Private/Invoke.GPOZaurrNetLogonPermissions.ps1 b/Private/Invoke.GPOZaurrNetLogonPermissions.ps1 index f357242..ef6118f 100644 --- a/Private/Invoke.GPOZaurrNetLogonPermissions.ps1 +++ b/Private/Invoke.GPOZaurrNetLogonPermissions.ps1 @@ -1,12 +1,12 @@ $GPOZaurrNetLogonPermissions = [ordered] @{ - Name = 'NetLogon Permissions' - Enabled = $true - Action = $null - Data = $null - Execute = { + Name = 'NetLogon Permissions' + Enabled = $true + ActionRequired = $null + Data = $null + Execute = { Get-GPOZaurrNetLogon } - Processing = { + Processing = { foreach ($File in $Script:Reporting['NetLogonPermissions']['Data']) { if ($File.FileSystemRights -eq 'Owner') { $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwners']++ @@ -31,12 +31,12 @@ } } if ($Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'].Count -gt 0) { - $Script:Reporting['NetLogonPermissions']['Action'] = $true + $Script:Reporting['NetLogonPermissions']['ActionRequired'] = $true } else { - $Script:Reporting['NetLogonPermissions']['Action'] = $false + $Script:Reporting['NetLogonPermissions']['ActionRequired'] = $false } } - Variables = @{ + Variables = @{ NetLogonOwners = 0 NetLogonOwnersAdministrators = 0 NetLogonOwnersNotAdministrative = 0 @@ -46,7 +46,7 @@ Owner = [System.Collections.Generic.List[PSCustomObject]]::new() NonOwner = [System.Collections.Generic.List[PSCustomObject]]::new() } - Overview = { + Overview = { New-HTMLPanel { New-HTMLText -Text 'Following chart presents ', 'NetLogon Summary' -FontSize 10pt -FontWeight normal, bold New-HTMLList -Type Unordered { @@ -69,7 +69,7 @@ } } - Solution = { + Solution = { New-HTMLTab -Name 'NetLogon Owners' { New-HTMLSection -Invisible { New-HTMLPanel { diff --git a/Private/Invoke.GPOZaurrOrphans.ps1 b/Private/Invoke.GPOZaurrOrphans.ps1 index 74a9e5b..fd45439 100644 --- a/Private/Invoke.GPOZaurrOrphans.ps1 +++ b/Private/Invoke.GPOZaurrOrphans.ps1 @@ -1,28 +1,36 @@ $GPOZaurrOrphans = [ordered] @{ - Name = 'Orphaned Group Policies' - Enabled = $true - Action = $null - Data = $null - Execute = { + Name = 'Orphaned Group Policies' + Enabled = $true + ActionRequired = $null + Data = $null + Execute = { Get-GPOZaurrBroken } - Processing = { + Processing = { foreach ($GPO in $Script:Reporting['GPOOrphans']['Data']) { if ($GPO.Status -eq 'Not available in AD') { $Script:Reporting['GPOOrphans']['Variables']['NotAvailableInAD']++ + $Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted']++ } elseif ($GPO.Status -eq 'Not available on SYSVOL') { $Script:Reporting['GPOOrphans']['Variables']['NotAvailableOnSysvol']++ + $Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted']++ } elseif ($GPO.Status -eq 'Permissions issue') { $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssue']++ } } + if ($Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted'].Count -gt 0) { + $Script:Reporting['GPOOrphans']['ActionRequired'] = $true + } else { + $Script:Reporting['GPOOrphans']['ActionRequired'] = $false + } } - Variables = @{ + Variables = @{ NotAvailableInAD = 0 NotAvailableOnSysvol = 0 NotAvailablePermissionIssue = 0 + ToBeDeleted = 0 } - Overview = { + Overview = { New-HTMLPanel { New-HTMLText -TextBlock { "Group Policies are stored in two places - Active Directory (metadata) and SYSVOL (content)." @@ -48,7 +56,7 @@ } -Title 'Broken / Orphaned Group Policies' -TitleAlignment center } } - Summary = { + Summary = { New-HTMLPanel { New-HTMLText -TextBlock { "Group Policies are stored in two places - Active Directory (metadata) and SYSVOL (content)." @@ -70,7 +78,7 @@ New-HTMLText -Text "Please review output in table and follow the steps below table to get Active Directory Group Policies in healthy state." -FontSize 10pt } } - Solution = { + Solution = { New-HTMLSection -Invisible { & $Script:GPOConfiguration['GPOOrphans']['Summary'] New-HTMLPanel { diff --git a/Private/Invoke.GPOZaurrOwners.ps1 b/Private/Invoke.GPOZaurrOwners.ps1 index f2e5ace..f66b557 100644 --- a/Private/Invoke.GPOZaurrOwners.ps1 +++ b/Private/Invoke.GPOZaurrOwners.ps1 @@ -1,10 +1,10 @@ $GPOZaurrOwners = [ordered] @{ - Name = 'Group Policy Owners' - Enabled = $true - Action = $null - Data = $null - Execute = { Get-GPOZaurrOwner -IncludeSysvol } - Processing = { + Name = 'Group Policy Owners' + Enabled = $true + ActionRequired = $null + Data = $null + Execute = { Get-GPOZaurrOwner -IncludeSysvol } + Processing = { foreach ($GPO in $Script:Reporting['GPOOwners']['Data']) { if ($GPO.IsOwnerConsistent) { $Script:Reporting['GPOOwners']['Variables']['IsConsistent']++ @@ -25,12 +25,12 @@ } } if ($Script:Reporting['GPOOwners']['Variables']['WillFix'].Count -gt 0) { - $Script:Reporting['GPOOwners']['Action'] = $true + $Script:Reporting['GPOOwners']['ActionRequired'] = $true } else { - $Script:Reporting['GPOOwners']['Action'] = $false + $Script:Reporting['GPOOwners']['ActionRequired'] = $false } } - Variables = @{ + Variables = @{ IsAdministrative = 0 IsNotAdministrative = 0 IsConsistent = 0 @@ -39,7 +39,7 @@ RequiresDiffFix = 0 WillNotTouch = 0 } - Overview = { + Overview = { New-HTMLPanel { New-HTMLText -Text 'Following chart presents Group Policy owners and whether they are administrative and consistent. By design an owner of Group Policy should be Domain Admins or Enterprise Admins group only to prevent malicious takeover. ', ` "It's also important that owner in Active Directory matches owner on SYSVOL (file system)." -FontSize 10pt @@ -57,7 +57,7 @@ } -Title 'Group Policy Owners' -TitleAlignment center } } - Summary = { + Summary = { New-HTMLText -FontSize 10pt -TextBlock { "By default GPO creation is usually maintained by Domain Admins or Enterprise Admins. " "When GPO is created by member of Domain Admins or Enterprise Admins group the GPO Owner is set to Domain Admins. " @@ -84,7 +84,7 @@ New-HTMLListItem -Text "Group Policies unaffected: ", $Script:Reporting['GPOOwners']['Variables']['WillNotTouch'] -FontWeight normal, bold } -FontSize 10pt } - Solution = { + Solution = { New-HTMLSection -Invisible { New-HTMLPanel { & $Script:GPOConfiguration['GPOOwners']['Summary'] diff --git a/Public/Invoke-GPOZaurr.ps1 b/Public/Invoke-GPOZaurr.ps1 index 4bad81c..5e6f318 100644 --- a/Public/Invoke-GPOZaurr.ps1 +++ b/Public/Invoke-GPOZaurr.ps1 @@ -44,13 +44,13 @@ foreach ($T in $Script:GPOConfiguration.Keys) { if ($Script:GPOConfiguration[$T].Enabled -eq $true) { $Script:Reporting[$T] = [ordered] @{ - Name = $Script:GPOConfiguration[$T].Name - Action = $null - Data = $null - Errors = $null - Warnings = $null - Time = $null - Variables = Copy-Dictionary -Dictionary $Script:GPOConfiguration[$T]['Variables'] + Name = $Script:GPOConfiguration[$T].Name + ActionRequired = $null + Data = $null + Errors = $null + Warnings = $null + Time = $null + Variables = Copy-Dictionary -Dictionary $Script:GPOConfiguration[$T]['Variables'] } $TimeLogGPOList = Start-TimeLog Write-Color -Text '[i]', '[Start] ', $($Script:GPOConfiguration[$T]['Name']) -Color Yellow, DarkGray, Yellow