gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-26 02:07:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemysław Kłys
2020-02-19 08:46:01 +01:00
parent 1f3229e73a
commit 43f99beca7
5 changed files with 70 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Public/Get-GPOZaurr.ps1
+3 -4
View File
@@ -7,7 +7,6 @@
[System.Collections.IDictionary] $ExtendedForestInformation,
[string[]] $GPOPath
)
if (-not $GPOPath) {
if (-not $ExtendedForestInformation) {
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
@@ -16,9 +15,9 @@
}
foreach ($Domain in $ForestInformation.Domains) {
Get-GPO -All -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain | ForEach-Object {
$XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain
Get-XMLGPO -XMLContent $XMLContent
Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
$XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
Get-XMLGPO -XMLContent $XMLContent
}
}
} else {
Public/Get-GPOZaurrPassword.ps1
+62 -57
View File
@@ -7,7 +7,6 @@
[System.Collections.IDictionary] $ExtendedForestInformation,
[string[]] $GPOPath
)
if (-not $GPOPath) {
if (-not $ExtendedForestInformation) {
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
@@ -19,11 +18,9 @@
-join ('\\', $Domain, '\SYSVOL\', $Domain, '\Policies')
}
}
if (-not $GPOPath) {
return
}
foreach ($Path in $GPOPath) {
#Extract the all XML files in the Folders
$Items = Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml
@@ -54,61 +51,69 @@
[Byte[]] $OutBlock = $DecryptorObject.TransformFinalBlock($Base64Decoded, 0, $Base64Decoded.length)
#Convert Hash variable in a String valute
$Password = [System.Text.UnicodeEncoding]::Unicode.GetString($OutBlock)
#[string]$GPOguid = [regex]::matches($XMLFileName.DirectoryName, '(?<=\{).+?(?=\})')
#$GPODetail = Get-GPO -guid $GPOguid
[xml] $XMLContent = $XMLString
if (-not $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword -and -not $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword) {
Write-Host ''
}
[PsCustomObject] @{
'Name' = $XMLContent.GPO.Name
'Links' = $XMLContent.GPO.LinksTo #| Select-Object -ExpandProperty SOMPath
'Enabled' = $XMLContent.GPO.GpoStatus
#'GPO' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups
'User' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.name
'Cpassword' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword
'CpasswordMap' = $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword
'Password' = $Password
'GUID' = $XMLContent.GPO.Identifier.Identifier.InnerText
'Domain' = $XMLContent.GPO.Identifier.Domain
'ComputerSettingsAvailable' = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true }
'ComputerSettingsStatus' = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
'ComputerEnabled' = [bool] $XMLContent.GPO.Computer.Enabled
'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false }
'ComputerSettings' = $XMLContent.GPO.Computer.ExtensionData.Extension
'UserSettingsAvailable' = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true }
'UserEnabled' = [bool] $XMLContent.GPO.User.Enabled
'UserSettingsStatus' = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
'UserSettingsVersionIdentical' = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
'UserSettings' = $XMLContent.GPO.User.ExtensionData.Extension
'CreationTime' = [DateTime] $XMLContent.GPO.CreatedTime
'ModificationTime' = [DateTime] $XMLContent.GPO.ModifiedTime
'ReadTime' = [DateTime] $XMLContent.GPO.ReadTime
'WMIFilter' = $GPO.WmiFilter.name
'WMIFilterDescription' = $GPO.WmiFilter.Description
'Path' = $GPO.Path
#'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
'ACL' = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
[PSCustomObject] @{
'User' = $_.trustee.name.'#Text'
'Permission Type' = $_.type.PermissionType
'Inherited' = $_.Inherited
'Permissions' = $_.Standard.GPOGroupedAccessEnum
}
}
}
#Write-Host "I find a Password [ " $Password " ] The GPO named:" $GPODetail" and th file is:" $XMLFileName
} else {
$Password = ''
}
#[string]$GPOguid = [regex]::matches($XMLFileName.DirectoryName, '(?<=\{).+?(?=\})')
#$GPODetail = Get-GPO -guid $GPOguid
[xml] $XMLContent = $XMLString
#if (-not $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword -and -not $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword) {
#Write-Host ''
#}
if ($Password) {
$PasswordStatus = $true
} else {
$PasswordStatus = $false
}
[PsCustomObject] @{
'Name' = $XMLContent.GPO.Name
'Links' = $XMLContent.GPO.LinksTo #| Select-Object -ExpandProperty SOMPath
'Enabled' = $XMLContent.GPO.GpoStatus
'PasswordStatus' = $PasswordStatus
#'GPO' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups
'User' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.name
'Cpassword' = $XMLContent.gpo.Computer.ExtensionData.Extension.LocalUsersAndGroups.User.Properties.cpassword
'CpasswordMap' = $XMLContent.gpo.User.ExtensionData.Extension.DriveMapSettings.Drive.Properties.cpassword
'Password' = $Password
'GUID' = $XMLContent.GPO.Identifier.Identifier.InnerText
'Domain' = $XMLContent.GPO.Identifier.Domain
'ComputerSettingsAvailable' = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true }
'ComputerSettingsStatus' = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
'ComputerEnabled' = [bool] $XMLContent.GPO.Computer.Enabled
'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false }
'ComputerSettings' = $XMLContent.GPO.Computer.ExtensionData.Extension
'UserSettingsAvailable' = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true }
'UserEnabled' = [bool] $XMLContent.GPO.User.Enabled
'UserSettingsStatus' = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
'UserSettingsVersionIdentical' = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
'UserSettings' = $XMLContent.GPO.User.ExtensionData.Extension
'CreationTime' = [DateTime] $XMLContent.GPO.CreatedTime
'ModificationTime' = [DateTime] $XMLContent.GPO.ModifiedTime
'ReadTime' = [DateTime] $XMLContent.GPO.ReadTime
'WMIFilter' = $GPO.WmiFilter.name
'WMIFilterDescription' = $GPO.WmiFilter.Description
'Path' = $GPO.Path
#'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
'ACL' = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
[PSCustomObject] @{
'User' = $_.trustee.name.'#Text'
'Permission Type' = $_.type.PermissionType
'Inherited' = $_.Inherited
'Permissions' = $_.Standard.GPOGroupedAccessEnum
}
}
}
#Write-Host "I find a Password [ " $Password " ] The GPO named:" $GPODetail" and th file is:" $XMLFileName
} #if($XMLContent.Contains("cpassword")
}
$Output
Public/Invoke-GPOZaurr.ps1
-6
View File
@@ -1,6 +0,0 @@
function Invoke-GPOZaurr {
[cmdletBinding()]
param(
)
}
Public/Save-GPOZaurrFiles.ps1
+2 -2
View File
@@ -15,8 +15,8 @@
}
$null = New-Item -ItemType Directory -Path $GPOPath -Force
foreach ($Domain in $ForestInformation.Domains) {
Get-GPO -All -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain | ForEach-Object {
$XMLContent = Get-GPOReport -ID $_.ID.Guid -ReportType XML -Server $ForestInformation.QueryServers[$Domain] -Domain $Domain
Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
$XMLContent = Get-GPOReport -ID $_.ID.Guid -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
$Path = [io.path]::Combine($GPOPath, "$($_.ID.Guid).xml")
$XMLContent | Set-Content -LiteralPath $Path -Force -Encoding Unicode