From 5b1aaae9154821d8db3ebf9cc5a9b2c5e783780b Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Sat, 12 Dec 2020 19:44:51 +0100 Subject: [PATCH] Update --- ...voke.GPOZaurrPermissionsAdministrative.ps1 | 10 ++++++- .../Invoke.GPOZaurrPermissionsAnalysis.ps1 | 29 +++++++++++++++++++ Public/Add-GPOZaurrPermission.ps1 | 6 ++-- 3 files changed, 41 insertions(+), 4 deletions(-) create mode 100644 Private/Invoke.GPOZaurrPermissionsAnalysis.ps1 diff --git a/Private/Invoke.GPOZaurrPermissionsAdministrative.ps1 b/Private/Invoke.GPOZaurrPermissionsAdministrative.ps1 index 5175377..0901865 100644 --- a/Private/Invoke.GPOZaurrPermissionsAdministrative.ps1 +++ b/Private/Invoke.GPOZaurrPermissionsAdministrative.ps1 @@ -8,6 +8,7 @@ Permissions = Get-GPOZaurrPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -ReturnSecurityWhenNoData -IncludeGPOObject -ReturnSingleObject -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains } $Object['PermissionsPerRow'] = $Object['Permissions'] | ForEach-Object { $_ } + $Object['PermissionsAnalysis'] = [System.Collections.Generic.List[PSCustomObject]]::new() $Object } Processing = { @@ -33,6 +34,8 @@ $Script:Reporting['GPOPermissionsAdministrative']['Variables']['WillFix']++ $Script:Reporting['GPOPermissionsAdministrative']['Variables']['WillFixPerDomain'][$GPO[0].DomainName]++ } + # lets create table and add it there + $Script:Reporting['GPOPermissionsAdministrative']['Data'].'PermissionsAnalysis'.Add($Analysis) } if ($Script:Reporting['GPOPermissionsAdministrative']['Variables']['WillFix'] -gt 0) { $Script:Reporting['GPOPermissionsAdministrative']['ActionRequired'] = $true @@ -88,11 +91,16 @@ } -Title 'Group Policy Permissions' -TitleAlignment center } } - New-HTMLSection -Name 'Group Policy Administrative Users Analysis' { + New-HTMLSection -Name 'Group Policy Administrative Users Permissions Summary' { New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsAdministrative']['Data'].PermissionsPerRow -Filtering { New-HTMLTableCondition -Name 'Permission' -Value '' -BackgroundColor Salmon -ComparisonType string -Row } -PagingOptions 7, 15, 30, 45, 60 } + New-HTMLSection -Name 'Group Policy Administrative Users Analysis' { + New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsAdministrative']['Data'].PermissionsAnalysis -Filtering { + # New-HTMLTableCondition -Name 'Permission' -Value '' -BackgroundColor Salmon -ComparisonType string -Row + } -PagingOptions 7, 15, 30, 45, 60 + } if ($Script:Reporting['Settings']['HideSteps'] -eq $false) { New-HTMLSection -Name 'Steps to fix Group Policy Administrative Users' { New-HTMLContainer { diff --git a/Private/Invoke.GPOZaurrPermissionsAnalysis.ps1 b/Private/Invoke.GPOZaurrPermissionsAnalysis.ps1 new file mode 100644 index 0000000..15a2c8a --- /dev/null +++ b/Private/Invoke.GPOZaurrPermissionsAnalysis.ps1 @@ -0,0 +1,29 @@ +$GPOZaurrPermissionsAnalysis = [ordered] @{ + Name = 'Group Policy Permissions Analysis' + Enabled = $true + Action = $null + Data = $null + Execute = { + Get-GPOZaurrPermissionAnalysis -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains + } + Processing = { + + } + Variables = @{ + + } + Overview = { + + } + Solution = { + New-HTMLTable -DataTable $Script:Reporting['GPOPermissions']['Data'] -Filtering + if ($Script:Reporting['GPOPermissions']['WarningsAndErrors']) { + New-HTMLSection -Name 'Warnings & Errors to Review' { + New-HTMLTable -DataTable $Script:Reporting['GPOPermissions']['WarningsAndErrors'] -Filtering { + New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row + New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row + } + } + } + } +} \ No newline at end of file diff --git a/Public/Add-GPOZaurrPermission.ps1 b/Public/Add-GPOZaurrPermission.ps1 index 3266fc7..e28ea20 100644 --- a/Public/Add-GPOZaurrPermission.ps1 +++ b/Public/Add-GPOZaurrPermission.ps1 @@ -108,7 +108,7 @@ } } #> - if (-not $PermissionsAnalysis['Skip']) { + if (-not $PermissionsAnalysis.'Skip') { if (-not $GPOPermissions) { # This is bad - things went wrong Write-Warning "Add-GPOZaurrPermission - Couldn't get permissions for GPO. Things aren't what they should be. Skipping!" @@ -118,7 +118,7 @@ # We asked, we got response, now we need to check if maybe we're missing one of the two administrative groups if ($Type -eq 'Administrative') { # this is a case where something was returned. Be it Domain Admins or Enterprise Admins or both. But we still need to check because it may have been Domain Admins from other domain or just one of the two required groups - if ($PermissionsAnalysis['DomainAdmins'] -eq $false) { + if ($PermissionsAnalysis.'DomainAdmins' -eq $false) { $Principal = $ADAdministrativeGroups[$GPO.DomainName]['DomainAdmins'] Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)" $CountFixed++ @@ -132,7 +132,7 @@ } } } - if ($PermissionsAnalysis['EnterpriseAdmins'] -eq $false) { + if ($PermissionsAnalysis.'EnterpriseAdmins' -eq $false) { $Principal = $ADAdministrativeGroups[$ForestInformation.Forest.RootDomain]['EnterpriseAdmins'] Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)" $CountFixed++