gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-07-26 11:49:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-12-12 19:44:51 +01:00
parent d239c979e9
commit 5b1aaae915
3 changed files with 41 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/Invoke.GPOZaurrPermissionsAdministrative.ps1
+9 -1
View File
@@ -8,6 +8,7 @@
Permissions = Get-GPOZaurrPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -ReturnSecurityWhenNoData -IncludeGPOObject -ReturnSingleObject -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
}
$Object['PermissionsPerRow'] = $Object['Permissions'] | ForEach-Object { $_ }
$Object['PermissionsAnalysis'] = [System.Collections.Generic.List[PSCustomObject]]::new()
$Object
}
Processing = {
@@ -33,6 +34,8 @@
$Script:Reporting['GPOPermissionsAdministrative']['Variables']['WillFix']++
$Script:Reporting['GPOPermissionsAdministrative']['Variables']['WillFixPerDomain'][$GPO[0].DomainName]++
}
# lets create table and add it there
$Script:Reporting['GPOPermissionsAdministrative']['Data'].'PermissionsAnalysis'.Add($Analysis)
}
if ($Script:Reporting['GPOPermissionsAdministrative']['Variables']['WillFix'] -gt 0) {
$Script:Reporting['GPOPermissionsAdministrative']['ActionRequired'] = $true
@@ -88,11 +91,16 @@
} -Title 'Group Policy Permissions' -TitleAlignment center
}
}
New-HTMLSection -Name 'Group Policy Administrative Users Analysis' {
New-HTMLSection -Name 'Group Policy Administrative Users Permissions Summary' {
New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsAdministrative']['Data'].PermissionsPerRow -Filtering {
New-HTMLTableCondition -Name 'Permission' -Value '' -BackgroundColor Salmon -ComparisonType string -Row
} -PagingOptions 7, 15, 30, 45, 60
}
New-HTMLSection -Name 'Group Policy Administrative Users Analysis' {
New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsAdministrative']['Data'].PermissionsAnalysis -Filtering {
# New-HTMLTableCondition -Name 'Permission' -Value '' -BackgroundColor Salmon -ComparisonType string -Row
} -PagingOptions 7, 15, 30, 45, 60
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix Group Policy Administrative Users' {
New-HTMLContainer {
Private/Invoke.GPOZaurrPermissionsAnalysis.ps1
+29
View File
@@ -0,0 +1,29 @@
$GPOZaurrPermissionsAnalysis = [ordered] @{
Name = 'Group Policy Permissions Analysis'
Enabled = $true
Action = $null
Data = $null
Execute = {
Get-GPOZaurrPermissionAnalysis -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
}
Processing = {
}
Variables = @{
}
Overview = {
}
Solution = {
New-HTMLTable -DataTable $Script:Reporting['GPOPermissions']['Data'] -Filtering
if ($Script:Reporting['GPOPermissions']['WarningsAndErrors']) {
New-HTMLSection -Name 'Warnings & Errors to Review' {
New-HTMLTable -DataTable $Script:Reporting['GPOPermissions']['WarningsAndErrors'] -Filtering {
New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
}
}
}
}
}
Public/Add-GPOZaurrPermission.ps1
+3 -3
View File
@@ -108,7 +108,7 @@
}
}
#>
if (-not $PermissionsAnalysis['Skip']) {
if (-not $PermissionsAnalysis.'Skip') {
if (-not $GPOPermissions) {
# This is bad - things went wrong
Write-Warning "Add-GPOZaurrPermission - Couldn't get permissions for GPO. Things aren't what they should be. Skipping!"
@@ -118,7 +118,7 @@
# We asked, we got response, now we need to check if maybe we're missing one of the two administrative groups
if ($Type -eq 'Administrative') {
# this is a case where something was returned. Be it Domain Admins or Enterprise Admins or both. But we still need to check because it may have been Domain Admins from other domain or just one of the two required groups
if ($PermissionsAnalysis['DomainAdmins'] -eq $false) {
if ($PermissionsAnalysis.'DomainAdmins' -eq $false) {
$Principal = $ADAdministrativeGroups[$GPO.DomainName]['DomainAdmins']
Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
$CountFixed++
@@ -132,7 +132,7 @@
}
}
}
if ($PermissionsAnalysis['EnterpriseAdmins'] -eq $false) {
if ($PermissionsAnalysis.'EnterpriseAdmins' -eq $false) {
$Principal = $ADAdministrativeGroups[$ForestInformation.Forest.RootDomain]['EnterpriseAdmins']
Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
$CountFixed++