gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-05 16:39:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemysław Kłys
2020-02-19 08:46:01 +01:00
parent 1f3229e73a
commit 43f99beca7
5 changed files with 70 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
GPOZaurr.psd1
+3 -4
View File
@@ -3,7 +3,7 @@
#
# Generated by: Przemyslaw Klys
#
# Generated on: 17.02.2020
# Generated on: 19.02.2020
#
@{
@@ -12,7 +12,7 @@
RootModule = 'GPOZaurr.psm1'
# Version number of this module.
ModuleVersion = '0.0.2'
ModuleVersion = '0.0.3'
# Supported PSEditions
CompatiblePSEditions = 'Desktop'
@@ -69,8 +69,7 @@
# NestedModules = @()
# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
FunctionsToExport = 'Get-GPOZaurr', 'Get-GPOZaurrPassword', 'Invoke-GPOZaurr',
'Save-GPOZaurrFiles'
FunctionsToExport = 'Get-GPOZaurr', 'Get-GPOZaurrPassword', 'Save-GPOZaurrFiles'
# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
CmdletsToExport = @()
Public/Invoke-GPOZaurr.ps1 → Private/Invoke-GPOZaurr.ps1
View File
Public/Get-GPOZaurr.ps1
+3 -4
View File
@@ -7,7 +7,6 @@
[System.Collections.IDictionary] $ExtendedForestInformation,
[string[]] $GPOPath
)
if (-not $GPOPath) {
if (-not $ExtendedForestInformation) {
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
@@ -16,9 +15,9 @@
}
foreach ($Domain in $ForestInformation.Domains) {
Get-GPO -All -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain | ForEach-Object {
$XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain
Get-XMLGPO -XMLContent $XMLContent
Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
$XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
Get-XMLGPO -XMLContent $XMLContent
}
}
} else {
Public/Get-GPOZaurrPassword.ps1
+62 -57
View File
@@ -7,7 +7,6 @@
[System.Collections.IDictionary] $ExtendedForestInformation,
[string[]] $GPOPath
)
if (-not $GPOPath) {
if (-not $ExtendedForestInformation) {
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
@@ -19,11 +18,9 @@
-join ('\\', $Domain, '\SYSVOL\', $Domain, '\Policies')
}
}
if (-not $GPOPath) {
return
}
foreach ($Path in $GPOPath) {
#Extract the all XML files in the Folders
$Items = Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml
@@ -54,61 +51,69 @@
[Byte[]] $OutBlock = $DecryptorObject.TransformFinalBlock($Base64Decoded, 0, $Base64Decoded.length)
#Convert Hash variable in a String valute
$Password = [System.Text.UnicodeEncoding]::Unicode.GetString($OutBlock)
#[string]$GPOguid = [regex]::matches($XMLFileName.DirectoryName, '(?<=\{).+?(?=\})')
#$GPODetail = Get-GPO -guid $GPOguid
[xml] $XMLContent = $XMLString
if (-not $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword -and -not $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword) {
Write-Host ''
}
[PsCustomObject] @{
'Name' = $XMLContent.GPO.Name
'Links' = $XMLContent.GPO.LinksTo #| Select-Object -ExpandProperty SOMPath
'Enabled' = $XMLContent.GPO.GpoStatus
#'GPO' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups
'User' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.name
'Cpassword' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword
'CpasswordMap' = $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword
'Password' = $Password
'GUID' = $XMLContent.GPO.Identifier.Identifier.InnerText
'Domain' = $XMLContent.GPO.Identifier.Domain
'ComputerSettingsAvailable' = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true }
'ComputerSettingsStatus' = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
'ComputerEnabled' = [bool] $XMLContent.GPO.Computer.Enabled
'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false }
'ComputerSettings' = $XMLContent.GPO.Computer.ExtensionData.Extension
'UserSettingsAvailable' = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true }
'UserEnabled' = [bool] $XMLContent.GPO.User.Enabled
'UserSettingsStatus' = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
'UserSettingsVersionIdentical' = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
'UserSettings' = $XMLContent.GPO.User.ExtensionData.Extension
'CreationTime' = [DateTime] $XMLContent.GPO.CreatedTime
'ModificationTime' = [DateTime] $XMLContent.GPO.ModifiedTime
'ReadTime' = [DateTime] $XMLContent.GPO.ReadTime
'WMIFilter' = $GPO.WmiFilter.name
'WMIFilterDescription' = $GPO.WmiFilter.Description
'Path' = $GPO.Path
#'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
'ACL' = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
[PSCustomObject] @{
'User' = $_.trustee.name.'#Text'
'Permission Type' = $_.type.PermissionType
'Inherited' = $_.Inherited
'Permissions' = $_.Standard.GPOGroupedAccessEnum
}
}
}
#Write-Host "I find a Password [ " $Password " ] The GPO named:" $GPODetail" and th file is:" $XMLFileName
} else {
$Password = ''
}
#[string]$GPOguid = [regex]::matches($XMLFileName.DirectoryName, '(?<=\{).+?(?=\})')
#$GPODetail = Get-GPO -guid $GPOguid
[xml] $XMLContent = $XMLString
#if (-not $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword -and -not $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword) {
#Write-Host ''
#}
if ($Password) {
$PasswordStatus = $true
} else {
$PasswordStatus = $false
}
[PsCustomObject] @{
'Name' = $XMLContent.GPO.Name
'Links' = $XMLContent.GPO.LinksTo #| Select-Object -ExpandProperty SOMPath
'Enabled' = $XMLContent.GPO.GpoStatus
'PasswordStatus' = $PasswordStatus
#'GPO' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups
'User' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.name
'Cpassword' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword
'CpasswordMap' = $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword
'Password' = $Password
'GUID' = $XMLContent.GPO.Identifier.Identifier.InnerText
'Domain' = $XMLContent.GPO.Identifier.Domain
'ComputerSettingsAvailable' = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true }
'ComputerSettingsStatus' = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
'ComputerEnabled' = [bool] $XMLContent.GPO.Computer.Enabled
'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false }
'ComputerSettings' = $XMLContent.GPO.Computer.ExtensionData.Extension
'UserSettingsAvailable' = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true }
'UserEnabled' = [bool] $XMLContent.GPO.User.Enabled
'UserSettingsStatus' = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
'UserSettingsVersionIdentical' = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
'UserSettings' = $XMLContent.GPO.User.ExtensionData.Extension
'CreationTime' = [DateTime] $XMLContent.GPO.CreatedTime
'ModificationTime' = [DateTime] $XMLContent.GPO.ModifiedTime
'ReadTime' = [DateTime] $XMLContent.GPO.ReadTime
'WMIFilter' = $GPO.WmiFilter.name
'WMIFilterDescription' = $GPO.WmiFilter.Description
'Path' = $GPO.Path
#'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
'ACL' = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
[PSCustomObject] @{
'User' = $_.trustee.name.'#Text'
'Permission Type' = $_.type.PermissionType
'Inherited' = $_.Inherited
'Permissions' = $_.Standard.GPOGroupedAccessEnum
}
}
}
#Write-Host "I find a Password [ " $Password " ] The GPO named:" $GPODetail" and th file is:" $XMLFileName
} #if($XMLContent.Contains("cpassword")
}
$Output
Public/Save-GPOZaurrFiles.ps1
+2 -2
View File
@@ -15,8 +15,8 @@
}
$null = New-Item -ItemType Directory -Path $GPOPath -Force
foreach ($Domain in $ForestInformation.Domains) {
Get-GPO -All -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain | ForEach-Object {
$XMLContent = Get-GPOReport -ID $_.ID.Guid -ReportType XML -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain
Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
$XMLContent = Get-GPOReport -ID $_.ID.Guid -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
$Path = [io.path]::Combine($GPOPath, "$($_.ID.Guid).xml")
$XMLContent | Set-Content -LiteralPath $Path -Force -Encoding Unicode