Updates

2026-08-22 16:07:03 +00:00 · 2020-07-21 12:59:25 +02:00
parent fd7c7e1b30
commit 5071c0da07
2 changed files with 121 additions and 30 deletions
@@ -3,6 +3,7 @@
    param(
        [ValidateSet('All', 'Netlogon', 'Sysvol')][string[]] $Type = 'All',
        [ValidateSet('None', 'MACTripleDES', 'MD5', 'RIPEMD160', 'SHA1', 'SHA256', 'SHA384', 'SHA512')][string] $HashAlgorithm = 'None',
+        [switch] $Limited,
        [alias('ForestName')][string] $Forest,
        [string[]] $ExcludeDomains,
        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
@@ -12,7 +13,10 @@
    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
    $GPOList = Get-GPOZaurrAD -ExtendedForestInformation $ForestInformation
    foreach ($GPO in $GPOList) {
-        $GPOCache[$GPO.GUID] = $GPO
+        if (-not $GPOCache[$GPO.DomainName]) {
+            $GPOCache[$GPO.DomainName] = @{}
+        }
+        $GPOCache[$($GPO.DomainName)][($GPO.GUID)] = $GPO
    }
    foreach ($Domain in $ForestInformation.Domains) {
        $Path = @(
@@ -26,13 +30,13 @@
                "\\$Domain\NETLOGON"
            }
        )
-        $Folders = @{
+        # Order does matter
+        $Folders = [ordered] @{
            "\\$Domain\SYSVOL\$Domain\policies\PolicyDefinitions" = @{
                Name = 'SYSVOL PolicyDefinitions'
            }
            "\\$Domain\SYSVOL\$Domain\policies"                   = @{
                Name = 'SYSVOL Policies'
-
            }
            "\\$Domain\SYSVOL\$Domain\scripts"                    = @{
                Name = 'NETLOGON Scripts'
@@ -44,13 +48,13 @@
                Name = 'NETLOGON Scripts'
            }
        }
-
-
-
        Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File | ForEach-Object {
+            # Lets reset values just to be sure those are empty
+            $GPO = $null
            $BelongsToGPO = $false
            $GPODisplayName = $null
            $SuggestedAction = $null
+            $SuggestedActionComment = $null
            $FileType = foreach ($Key in $Folders.Keys) {
                if ($_.FullName -like "$Key*") {
                    $Folders[$Key]
@@ -58,31 +62,126 @@
                }
            }
            if ($FileType.Name -eq 'SYSVOL Policies') {
-                $Test = $_.FullName -match '[\da-zA-Z]{8}-([\da-zA-Z]{4}-){3}[\da-zA-Z]{12}'
-                if ($Test) {
-                    $GPO = $GPOCache[$matches[0]]
+                $FoundGUID = $_.FullName -match '[\da-zA-Z]{8}-([\da-zA-Z]{4}-){3}[\da-zA-Z]{12}'
+                if ($FoundGUID) {
+                    $GPO = $GPOCache[$Domain][$matches[0]]
                    if ($GPO) {
                        $BelongsToGPO = $true
                        $GPODisplayName = $GPO.DisplayName
                    }
                }
-            }
-            if ($_.Extension -eq '.adm') {
-                $SuggestedAction = 'Delete legacy ADM file'
-            } elseif ($_.Extension -in @('.admx', '.adml') -and $FileType.Name -eq 'SYSVOL PolicyDefinitions') {
-                $SuggestedAction = 'Skip assesment'
-            }
+                if ($GPO) {
+                    $Correct = @(
+                        [System.IO.Path]::Combine($GPO.Path, 'GPT.INI')
+                        [System.IO.Path]::Combine($GPO.Path, 'GPO.cmt')
+                        foreach ($TypeM in @('Machine', 'User')) {
+                            [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Registry\Registry.xml')
+                            [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Printers\Printers.xml')
+                            [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Registry.pol')
+                            [System.IO.Path]::Combine($GPO.Path, $TypeM, 'comment.cmtx')
+                            [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\ScheduledTasks\ScheduledTasks.xml')
+                            [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Services\Services.xml')
+                            [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Groups\Groups.xml')

+                            if ($_.Extension -eq '.aas') {
+                                [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Applications', $_.Name)
+                            }
+                        }
+                        [System.IO.Path]::Combine($GPO.Path, 'Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf')
+                        [System.IO.Path]::Combine($GPO.Path, 'Machine\Microsoft\Windows NT\Audit\audit.csv')
+                    )
+                } else {
+                    $Correct = @()
+                }
+                if ($_.FullName -in $Correct) {
+                    $SuggestedAction = 'Skip assesment'
+                    $SuggestedActionComment = 'Correctly placed in SYSVOL'
+                } elseif ($_.Extension -eq '.adm') {
+                    $SuggestedAction = 'Consider deleting'
+                    $SuggestedActionComment = 'Most likely legacy ADM files'
+                }
+            } elseif ($FileType.Name -eq 'NETLOGON Scripts') {
+                foreach ($Ext in @('*old*', '*bak*', '*bck')) {
+                    if ($_.Extension -like $Ext) {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Most likely backup files'
+                        break
+                    }
+                }
+                if (-not $SuggestedAction) {
+                    # We didn't find it in earlier check, lets go deeper
+                    if ($_.Extension.Length -gt 5 -and $_.Extension -ne '.config') {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Extension longer then 5 chars'
+                    } elseif ($_.Extension -eq '') {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'No extension'
+                    }
+                }
+                if (-not $SuggestedAction) {
+                    foreach ($Name in @('*old*', '*bak*', '*bck*', '*Copy*')) {
+                        if ($_.Name -like $Name) {
+                            $SuggestedAction = 'Consider deleting'
+                            $SuggestedActionComment = 'FileName contains backup related names'
+                            break
+                        }
+                    }
+                }
+                if (-not $SuggestedAction) {
+                    # We replace all letters leaving only numbers
+                    # We want to find if there is a date possibly
+                    $StrippedNumbers = $_.Name -replace "[^0-9]" , ''
+                    if ($StrippedNumbers.Length -gt 5) {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'FileName contains date related names'
+                    }
+                }
+            } elseif ($FileType.Name -eq 'SYSVOL PolicyDefinitions') {
+                if ($_.Extension -in @('.admx', '.adml')) {
+                    $SuggestedAction = 'Skip assesment'
+                    $SuggestedActionComment = 'Most likely ADMX templates'
+                }
+            } elseif ($FileType.Name -eq 'SYSVOL GPO Starters') {
+                $FoundGUID = $_.FullName -match '[\da-zA-Z]{8}-([\da-zA-Z]{4}-){3}[\da-zA-Z]{12}'
+                if ($FoundGUID) {
+                    $GUID = $matches[0]
+                    $TemporaryStarterPath = "\\$Domain\SYSVOL\$Domain\StarterGPOs\{$GUID}"
+                    $Correct = @(
+                        [System.IO.Path]::Combine($TemporaryStarterPath, 'StarterGPO.tmplx')
+                        [System.IO.Path]::Combine($TemporaryStarterPath, 'en-US', 'StarterGPO.tmpll')
+                        foreach ($TypeM in @('Machine', 'User')) {
+                            [System.IO.Path]::Combine($TemporaryStarterPath, $TypeM, 'Registry.pol')
+                            [System.IO.Path]::Combine($TemporaryStarterPath, $TypeM, 'comment.cmtx')
+                        }
+                    )
+                    if ($_.FullName -in $Correct) {
+                        $SuggestedAction = 'Skip assesment'
+                        $SuggestedActionComment = 'Correctly placed in SYSVOL'
+                    }
+                }
+            } else {

-            $MetaData = Get-FileMetaData -File $_ -Signature #-HashAlgorithm $HashAlgorithm
+            }
+            if (-not $SuggestedAction) {
+                $SuggestedAction = 'Requires verification'
+                $SuggestedActionComment = 'Not able to auto asses'
+            }
+            if ($Limited) {
+                $MetaData = $_
+            } else {
+                $MetaData = Get-FileMetaData -File $_ -Signature #-HashAlgorithm $HashAlgorithm
+            }
            Add-Member -InputObject $MetaData -Name 'AssesmentType' -Value $FileType.Name -MemberType NoteProperty
            Add-Member -InputObject $MetaData -Name 'BelongsToGPO' -Value $BelongsToGPO -MemberType NoteProperty
            Add-Member -InputObject $MetaData -Name 'GPODisplayName' -Value $GPODisplayName -MemberType NoteProperty
            Add-Member -InputObject $MetaData -Name 'SuggestedAction' -Value $SuggestedAction -MemberType NoteProperty
+            Add-Member -InputObject $MetaData -Name 'SuggestedActionComment' -Value $SuggestedActionComment -MemberType NoteProperty

-
-
-            $MetaData
+            if ($Limited) {
+                $MetaData | Select-Object FullName, Name, Extension, SuggestedAction, SuggestedActionComment, AssesmentType, BelongsToGPO, GPODisplayName, IsReadOnly, CreationTime, LastAccessTime, LastWriteTime
+            } else {
+                $MetaData
+            }
        }
        foreach ($e in $err) {
            Write-Warning "Get-GPOZaurrFiles - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
@@ -90,4 +189,4 @@
    }
 }

-#Get-GPOZaurrFiles | ConvertTo-Excel -OpenWorkBook -FilePath $Env:USERPROFILE\GPOTesting.xlsx -ExcelWorkSheetName 'GPO Output' -AutoFilter -AutoFit -FreezeTopRowFirstColumn
+#Get-GPOZaurrFiles -Limited | ConvertTo-Excel -OpenWorkBook -FilePath $Env:USERPROFILE\GPOTesting.xlsx -ExcelWorkSheetName 'GPO Output' -AutoFilter -AutoFit -FreezeTopRowFirstColumn
@@ -147,7 +147,7 @@


    return $Output
-
+    <#
    foreach ($GPO in $GPOs) {
        if ($GPOPath) {
            $GPOOutput = $GPO.GPOOutput
@@ -182,16 +182,7 @@
        foreach ($Report in $Type) {
            $Category = $Script:GPODitionary[$Report]['Category']
            $Settings = $Script:GPODitionary[$Report]['Settings']
-
-            #if (-not $TranslatedOutput[$Report]) {
-            #    $TranslatedOutput[$Report] = [ordered] @{}
-            #}
-            #foreach ($Setting in $Settings) {
-            #    if (-not $TranslatedOutput[$Category][$Settings]) {
-            #        $TranslatedOutput[$Category][$Settings] = [ordered] @{}
-            #    }
            $TranslatedOutput[$Report] = Invoke-GPOTranslation -InputData $Output -Category $Category -Settings $Settings -Report $Report
-            #}
        }
        if ($OutputType -contains 'Object') {
            $TranslatedOutput
@@ -252,6 +243,7 @@
            Invoke-Item -Path $FilePathExcel
        }
    }
+    #>

 }