From 4189ad12f2068a27385acecab0cf60f08ca1b584 Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Sun, 11 Apr 2021 20:11:46 +0200 Subject: [PATCH] Improvements --- Private/Invoke.GPOZaurrBlockedInheritance.ps1 | 25 ++++++++++++++----- Public/Get-GPOZaurrInheritance.ps1 | 25 +++++++++++++++++-- 2 files changed, 42 insertions(+), 8 deletions(-) diff --git a/Private/Invoke.GPOZaurrBlockedInheritance.ps1 b/Private/Invoke.GPOZaurrBlockedInheritance.ps1 index 241d114..e1a8236 100644 --- a/Private/Invoke.GPOZaurrBlockedInheritance.ps1 +++ b/Private/Invoke.GPOZaurrBlockedInheritance.ps1 @@ -4,7 +4,7 @@ ActionRequired = $null Data = $null Execute = { - Get-GPOZaurrInheritance -IncludeBlockedObjects -IncludeExcludedObjects -OnlyBlockedInheritance -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains + Get-GPOZaurrInheritance -IncludeBlockedObjects -IncludeExcludedObjects -OnlyBlockedInheritance -IncludeGroupPoliciesForBlockedObjects -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains } Processing = { foreach ($GPO in $Script:Reporting['GPOBlockedInheritance']['Data']) { @@ -33,6 +33,10 @@ $Script:Reporting['GPOBlockedInheritance']['Variables']['DeletionHarmless']++ $Script:Reporting['GPOBlockedInheritance']['Variables']['DeletionHarmlessPerDomain'][$GPO.DomainName]++ } + # add gpo from blocked inheritance to create additional table + #foreach ($GpoBlocked in $Script:Reporting['GPOBlockedInheritance']['Data'].GroupPolicies) { + #$Script:Reporting['GPOBlockedInheritance']['Variables']['GroupPolicies'].Add($GpoBlocked) + #} } if ($Script:Reporting['GPOBlockedInheritance']['Variables']['RequiresInvesigation'] -gt 0 -or $Script:Reporting['GPOBlockedInheritance']['Variables']['DeletionHarmless'] -gt 0) { $Script:Reporting['GPOBlockedInheritance']['ActionRequired'] = $true @@ -56,6 +60,7 @@ ComputersAffected = 0 ComputersAffectedIncludingExcluded = 0 ComputersAffectedExcluded = 0 + GroupPolicies = [System.Collections.Generic.List[PSCustomObject]]::new() } Overview = { @@ -86,10 +91,10 @@ if ($Script:Reporting['GPOBlockedInheritance']['Data'].Count -ne 0) { New-HTMLText -Text 'Users & Computers affected by inheritance blocks:' -FontSize 10pt -FontWeight bold New-HTMLList -Type Unordered { - New-HTMLListItem -Text $Script:Reporting['GPOBlockedInheritance']['Variables']['UsersAffected'], ' users affected due to inheritance blocks' - New-HTMLListItem -Text $Script:Reporting['GPOBlockedInheritance']['Variables']['UsersAffectedExcluded'], ' users affected, but approved/excluded, due to inheritance blocks' - New-HTMLListItem -Text $Script:Reporting['GPOBlockedInheritance']['Variables']['ComputersAffected'], ' computers affected due to inheritance blocks' - New-HTMLListItem -Text $Script:Reporting['GPOBlockedInheritance']['Variables']['ComputersAffectedExcluded'], ' computers affected, but approved/excluded, due to inheritance blocks' + New-HTMLListItem -Text $Script:Reporting['GPOBlockedInheritance']['Variables']['UsersAffected'], ' users affected due to inheritance blocks' -FontWeight bold, normal + New-HTMLListItem -Text $Script:Reporting['GPOBlockedInheritance']['Variables']['UsersAffectedExcluded'], ' users affected, but approved/excluded, due to inheritance blocks' -FontWeight bold, normal + New-HTMLListItem -Text $Script:Reporting['GPOBlockedInheritance']['Variables']['ComputersAffected'], ' computers affected due to inheritance blocks' -FontWeight bold, normal + New-HTMLListItem -Text $Script:Reporting['GPOBlockedInheritance']['Variables']['ComputersAffectedExcluded'], ' computers affected, but approved/excluded, due to inheritance blocks' -FontWeight bold, normal } -FontSize 10pt New-HTMLText -Text 'Following domains require:' -FontSize 10pt -FontWeight bold @@ -118,6 +123,7 @@ } New-HTMLSection -Name 'Organizational Units with Group Policy Blocked Inheritance' { New-HTMLTable -DataTable $Script:Reporting['GPOBlockedInheritance']['Data'] -Filtering { + New-TableEvent -TableID 'TableWithGroupPoliciesBlockedInheritance' -SourceColumnID 8 -TargetColumnID 9 New-TableConditionGroup { New-TableCondition -Name 'BlockedInheritance' -Value $true New-TableCondition -Name 'Excluded' -Value $false @@ -126,7 +132,14 @@ New-TableCondition -Name 'UsersCount' -Value 0 New-TableCondition -Name 'ComputersCount' -Value 0 } -BackgroundColor Salmon -FailBackgroundColor Amber -HighlightHeaders 'UsersCount', 'ComputersCount' - } -PagingOptions 10, 20, 30, 40, 50 -SearchBuilder + } -PagingOptions 10, 20, 30, 40, 50 -SearchBuilder -ExcludeProperty GroupPolicies + } + New-HTMLSection -Name 'Group Policies affecting objects in Organizational Units with Blocked Inheritance' { + New-HTMLTable -DataTable $Script:Reporting['GPOBlockedInheritance']['Data'].GroupPolicies -Filtering { + New-TableCondition -Name 'Enabled' -Value $true -BackgroundColor SpringGreen -FailBackgroundColor Salmon + New-TableCondition -Name 'Enforced' -Value $true -BackgroundColor Amber -FailBackgroundColor AirForceBlue + New-TableCondition -Name 'LinkedDirectly' -Value $true -BackgroundColor Amber -FailBackgroundColor AirForceBlue + } -PagingOptions 10, 20, 30, 40, 50 -SearchBuilder -ExcludeProperty GroupPolicies -DataTableID 'TableWithGroupPoliciesBlockedInheritance' } if ($Script:Reporting['Settings']['HideSteps'] -eq $false) { New-HTMLSection -Name 'Steps to fix - Organizational Units with Group Policy Blocked Inheritance' { diff --git a/Public/Get-GPOZaurrInheritance.ps1 b/Public/Get-GPOZaurrInheritance.ps1 index 36915fa..918dcb6 100644 --- a/Public/Get-GPOZaurrInheritance.ps1 +++ b/Public/Get-GPOZaurrInheritance.ps1 @@ -42,6 +42,7 @@ [switch] $IncludeBlockedObjects, [switch] $OnlyBlockedInheritance, [switch] $IncludeExcludedObjects, + [switch] $IncludeGroupPoliciesForBlockedObjects, [string[]] $Exclusions, [alias('ForestName')][string] $Forest, @@ -64,7 +65,26 @@ CanonicalName = $OU.canonicalName BlockedInheritance = if ($OU.gpOptions -eq 1) { $true } else { $false } Excluded = $false - DomainName = ConvertFrom-DistinguishedName -ToDomainCN -DistinguishedName $OU.DistinguishedName + DomainName = ConvertFrom-DistinguishedName -ToDomainCN -DistinguishedName $OU.DistinguishedName + } + if ($InheritanceInformation.BlockedInheritance -and $IncludeGroupPoliciesForBlockedObjects.IsPresent) { + $GPInheritance = Get-GPInheritance -Target $OU.distinguishedName + $ActiveGroupPolicies = foreach ($GPO in $GPInheritance.InheritedGpoLinks) { + [PSCustomObject] @{ + OrganizationalUnit = $OU.canonicalName + DisplayName = $GPO.DisplayName + DomainName = $GPO.GpoDomainName + LinkedDirectly = if ($OU.DistinguishedName -eq $GPO.Target) { $true } else { $false } + GPOID = $GPO.GPOID + Enabled = $GPO.Enabled + Enforced = $GPO.Enforced + Order = $GPO.Order + LinkedTo = $GPO.Target + OrganizationalUnitDN = $OU.DistinguishedName + } + } + } else { + $ActiveGroupPolicies = $null } if ($Exclusions) { if ($ExclusionsCache[$OU.canonicalName]) { @@ -100,6 +120,8 @@ $InheritanceInformation['Computers'] = $null } } + $InheritanceInformation['DistinguishedName'] = $OU.DistinguishedName + $InheritanceInformation['GroupPolicies'] = $ActiveGroupPolicies if ($OnlyBlockedInheritance) { if ($InheritanceInformation.BlockedInheritance -eq $true) { [PSCustomObject] $InheritanceInformation @@ -108,7 +130,6 @@ [PSCustomObject] $InheritanceInformation } } - $InheritanceInformation['DistinguishedName'] = $OU.DistinguishedName } } }