diff --git a/Examples/Example-16-KeepPermissions02.ps1 b/Examples/Example-16-KeepPermissions02.ps1 index d01a11f..318aed5 100644 --- a/Examples/Example-16-KeepPermissions02.ps1 +++ b/Examples/Example-16-KeepPermissions02.ps1 @@ -6,7 +6,7 @@ Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.pl' { Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow -} -WhatIf +} -WhatIf -SkipDuplicates # Apply perrmissions for Domain Controllers @@ -15,7 +15,7 @@ Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow -} -WhatIf +} -WhatIf -SkipDuplicates # Apply permissions for Regions, with exclusions for those 4 groups $Exclude = @( @@ -27,7 +27,8 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow -} #-WhatIf +} -WhatIf -SkipDuplicates + $Exclude = @( 'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz' @@ -40,4 +41,4 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow -} #-WhatIf +} -WhatIf -SkipDuplicates diff --git a/GPOZaurr.psd1 b/GPOZaurr.psd1 index ff5954c..53335eb 100644 --- a/GPOZaurr.psd1 +++ b/GPOZaurr.psd1 @@ -7,7 +7,7 @@ Description = 'Group Policy Eater' FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner' GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde' - ModuleVersion = '0.0.40' + ModuleVersion = '0.0.41' PowerShellVersion = '5.1' PrivateData = @{ PSData = @{ diff --git a/Public/Invoke-GPOZaurrPermission.ps1 b/Public/Invoke-GPOZaurrPermission.ps1 index da094a7..24bb30a 100644 --- a/Public/Invoke-GPOZaurrPermission.ps1 +++ b/Public/Invoke-GPOZaurrPermission.ps1 @@ -118,7 +118,14 @@ [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] [parameter(ParameterSetName = 'Level')] - [switch] $LimitAdministrativeGroupsToDomain + [switch] $LimitAdministrativeGroupsToDomain, + + [Parameter(ParameterSetName = 'GPOGUID')] + [Parameter(ParameterSetName = 'GPOName')] + [parameter(ParameterSetName = 'Filter')] + [parameter(ParameterSetName = 'ADObject')] + [parameter(ParameterSetName = 'Linked')] + [switch] $SkipDuplicates ) if ($PermissionRules) { $Rules = & $PermissionRules @@ -139,6 +146,7 @@ IncludeDomains = $IncludeDomains ExcludeDomains = $ExcludeDomains ExtendedForestInformation = $ForestInformation + SkipDuplicates = $SkipDuplicates.IsPresent } if ($ADObject) { $Splat['ADObject'] = $ADObject diff --git a/README.md b/README.md index d73e197..35b92a0 100644 --- a/README.md +++ b/README.md @@ -39,6 +39,8 @@ That's it. Whenever there's a new version, you run the command, and you can enjo ## Changelog +- 0.0.41 - 18.06.2020 + - Added paramerter `SkipDuplicates` to `Invoke-GPOZaurrPermission` which prevents applying permissions over and over again if 1 GPO is linked to a multiple OU's within another OU - 0.0.40 - 18.06.2020 - Fix for error `Get-GPOZaurrLink` - same issue as described on my [earlier blog - Get-ADObject : The server has returned the following error: invalid enumeration context.](https://evotec.xyz/get-adobject-the-server-has-returned-the-following-error-invalid-enumeration-context/). - `WARNING: Get-GPOZaurrLink - Processing error The server has returned the following error: invalid enumeration context.`