diff --git a/GPOZaurr.psd1 b/GPOZaurr.psd1 index 5a54783..30ff47a 100644 --- a/GPOZaurr.psd1 +++ b/GPOZaurr.psd1 @@ -3,7 +3,7 @@ # # Generated by: Przemyslaw Klys # -# Generated on: 17.02.2020 +# Generated on: 19.02.2020 # @{ @@ -12,7 +12,7 @@ RootModule = 'GPOZaurr.psm1' # Version number of this module. - ModuleVersion = '0.0.2' + ModuleVersion = '0.0.3' # Supported PSEditions CompatiblePSEditions = 'Desktop' @@ -69,8 +69,7 @@ # NestedModules = @() # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export. - FunctionsToExport = 'Get-GPOZaurr', 'Get-GPOZaurrPassword', 'Invoke-GPOZaurr', - 'Save-GPOZaurrFiles' + FunctionsToExport = 'Get-GPOZaurr', 'Get-GPOZaurrPassword', 'Save-GPOZaurrFiles' # Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export. CmdletsToExport = @() diff --git a/Public/Invoke-GPOZaurr.ps1 b/Private/Invoke-GPOZaurr.ps1 similarity index 100% rename from Public/Invoke-GPOZaurr.ps1 rename to Private/Invoke-GPOZaurr.ps1 diff --git a/Public/Get-GPOZaurr.ps1 b/Public/Get-GPOZaurr.ps1 index 5f483e8..8d99e57 100644 --- a/Public/Get-GPOZaurr.ps1 +++ b/Public/Get-GPOZaurr.ps1 @@ -7,7 +7,6 @@ [System.Collections.IDictionary] $ExtendedForestInformation, [string[]] $GPOPath ) - if (-not $GPOPath) { if (-not $ExtendedForestInformation) { $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains @@ -16,9 +15,9 @@ } foreach ($Domain in $ForestInformation.Domains) { - Get-GPO -All -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain | ForEach-Object { - $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain - Get-XMLGPO -XMLContent $XMLContent + Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object { + $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain + Get-XMLGPO -XMLContent $XMLContent } } } else { diff --git a/Public/Get-GPOZaurrPassword.ps1 b/Public/Get-GPOZaurrPassword.ps1 index 5479c71..d8c8528 100644 --- a/Public/Get-GPOZaurrPassword.ps1 +++ b/Public/Get-GPOZaurrPassword.ps1 @@ -7,7 +7,6 @@ [System.Collections.IDictionary] $ExtendedForestInformation, [string[]] $GPOPath ) - if (-not $GPOPath) { if (-not $ExtendedForestInformation) { $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains @@ -19,11 +18,9 @@ -join ('\\', $Domain, '\SYSVOL\', $Domain, '\Policies') } } - if (-not $GPOPath) { return } - foreach ($Path in $GPOPath) { #Extract the all XML files in the Folders $Items = Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml @@ -54,61 +51,69 @@ [Byte[]] $OutBlock = $DecryptorObject.TransformFinalBlock($Base64Decoded, 0, $Base64Decoded.length) #Convert Hash variable in a String valute $Password = [System.Text.UnicodeEncoding]::Unicode.GetString($OutBlock) - #[string]$GPOguid = [regex]::matches($XMLFileName.DirectoryName, '(?<=\{).+?(?=\})') - #$GPODetail = Get-GPO -guid $GPOguid - [xml] $XMLContent = $XMLString - - if (-not $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword -and -not $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword) { - Write-Host '' - } - - - [PsCustomObject] @{ - 'Name' = $XMLContent.GPO.Name - 'Links' = $XMLContent.GPO.LinksTo #| Select-Object -ExpandProperty SOMPath - 'Enabled' = $XMLContent.GPO.GpoStatus - #'GPO' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups - 'User' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.name - 'Cpassword' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword - 'CpasswordMap' = $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword - 'Password' = $Password - 'GUID' = $XMLContent.GPO.Identifier.Identifier.InnerText - - 'Domain' = $XMLContent.GPO.Identifier.Domain - - 'ComputerSettingsAvailable' = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true } - 'ComputerSettingsStatus' = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" } - 'ComputerEnabled' = [bool] $XMLContent.GPO.Computer.Enabled - 'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false } - 'ComputerSettings' = $XMLContent.GPO.Computer.ExtensionData.Extension - - 'UserSettingsAvailable' = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true } - 'UserEnabled' = [bool] $XMLContent.GPO.User.Enabled - 'UserSettingsStatus' = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" } - 'UserSettingsVersionIdentical' = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false } - 'UserSettings' = $XMLContent.GPO.User.ExtensionData.Extension - - - 'CreationTime' = [DateTime] $XMLContent.GPO.CreatedTime - 'ModificationTime' = [DateTime] $XMLContent.GPO.ModifiedTime - 'ReadTime' = [DateTime] $XMLContent.GPO.ReadTime - - 'WMIFilter' = $GPO.WmiFilter.name - 'WMIFilterDescription' = $GPO.WmiFilter.Description - 'Path' = $GPO.Path - #'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' } - 'ACL' = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process { - [PSCustomObject] @{ - 'User' = $_.trustee.name.'#Text' - 'Permission Type' = $_.type.PermissionType - 'Inherited' = $_.Inherited - 'Permissions' = $_.Standard.GPOGroupedAccessEnum - } - } - - } - #Write-Host "I find a Password [ " $Password " ] The GPO named:" $GPODetail" and th file is:" $XMLFileName + } else { + $Password = '' } + #[string]$GPOguid = [regex]::matches($XMLFileName.DirectoryName, '(?<=\{).+?(?=\})') + #$GPODetail = Get-GPO -guid $GPOguid + [xml] $XMLContent = $XMLString + + #if (-not $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword -and -not $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword) { + #Write-Host '' + #} + if ($Password) { + $PasswordStatus = $true + } else { + $PasswordStatus = $false + } + + [PsCustomObject] @{ + 'Name' = $XMLContent.GPO.Name + 'Links' = $XMLContent.GPO.LinksTo #| Select-Object -ExpandProperty SOMPath + 'Enabled' = $XMLContent.GPO.GpoStatus + 'PasswordStatus' = $PasswordStatus + #'GPO' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups + 'User' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.name + 'Cpassword' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword + 'CpasswordMap' = $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword + 'Password' = $Password + 'GUID' = $XMLContent.GPO.Identifier.Identifier.InnerText + + 'Domain' = $XMLContent.GPO.Identifier.Domain + + 'ComputerSettingsAvailable' = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true } + 'ComputerSettingsStatus' = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" } + 'ComputerEnabled' = [bool] $XMLContent.GPO.Computer.Enabled + 'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false } + 'ComputerSettings' = $XMLContent.GPO.Computer.ExtensionData.Extension + + 'UserSettingsAvailable' = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true } + 'UserEnabled' = [bool] $XMLContent.GPO.User.Enabled + 'UserSettingsStatus' = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" } + 'UserSettingsVersionIdentical' = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false } + 'UserSettings' = $XMLContent.GPO.User.ExtensionData.Extension + + + 'CreationTime' = [DateTime] $XMLContent.GPO.CreatedTime + 'ModificationTime' = [DateTime] $XMLContent.GPO.ModifiedTime + 'ReadTime' = [DateTime] $XMLContent.GPO.ReadTime + + 'WMIFilter' = $GPO.WmiFilter.name + 'WMIFilterDescription' = $GPO.WmiFilter.Description + 'Path' = $GPO.Path + #'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' } + 'ACL' = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process { + [PSCustomObject] @{ + 'User' = $_.trustee.name.'#Text' + 'Permission Type' = $_.type.PermissionType + 'Inherited' = $_.Inherited + 'Permissions' = $_.Standard.GPOGroupedAccessEnum + } + } + + } + #Write-Host "I find a Password [ " $Password " ] The GPO named:" $GPODetail" and th file is:" $XMLFileName + } #if($XMLContent.Contains("cpassword") } $Output diff --git a/Public/Save-GPOZaurrFiles.ps1 b/Public/Save-GPOZaurrFiles.ps1 index 2bdf851..4bad711 100644 --- a/Public/Save-GPOZaurrFiles.ps1 +++ b/Public/Save-GPOZaurrFiles.ps1 @@ -15,8 +15,8 @@ } $null = New-Item -ItemType Directory -Path $GPOPath -Force foreach ($Domain in $ForestInformation.Domains) { - Get-GPO -All -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain | ForEach-Object { - $XMLContent = Get-GPOReport -ID $_.ID.Guid -ReportType XML -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain + Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object { + $XMLContent = Get-GPOReport -ID $_.ID.Guid -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain $Path = [io.path]::Combine($GPOPath, "$($_.ID.Guid).xml") $XMLContent | Set-Content -LiteralPath $Path -Force -Encoding Unicode