From 5d3370d54632ae52fad427a14ef6cc5becc6c9d4 Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Thu, 16 Jul 2020 22:34:32 +0200 Subject: [PATCH] Update --- Examples/Example-29-FindGPO0.ps1 | 27 +++-- Private/ConvertTo-LocalGroups.ps1 | 126 +++++++++++++++++++++++ Private/ConvertTo-LocalUserAndGroups.ps1 | 76 ++++++++++++++ Private/Script.GPODictionary.ps1 | 38 +++---- 4 files changed, 237 insertions(+), 30 deletions(-) create mode 100644 Private/ConvertTo-LocalGroups.ps1 diff --git a/Examples/Example-29-FindGPO0.ps1 b/Examples/Example-29-FindGPO0.ps1 index 6ce71d9..1d4f7a0 100644 --- a/Examples/Example-29-FindGPO0.ps1 +++ b/Examples/Example-29-FindGPO0.ps1 @@ -2,6 +2,7 @@ #Invoke-GPOZaurr -OutputType Excel, Object, HTML -Open | Format-Table #$Output = Invoke-GPOZaurr -GPOPath $Env:USERPROFILE\Desktop\GPOExport -NoTranslation #| Format-Table +#$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTestRegistryCheck' -NoTranslation $Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation #$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' -NoTranslation #-OutputType HTML, Object -Open #| Format-Table #$Output.Categories | Out-HtmlView @@ -16,14 +17,26 @@ $Output.Reports | Format-Table #$Output.Reports.Audit | Format-Table * #$Output.Reports.Autologon | Format-Table * #$Output.Reports.EventLog | Format-Table * -$Output.Reports.SoftwareInstallation | Format-Table * - - +#$Output.Reports.SoftwareInstallation | Format-Table * +#$Output.Reports.Policies | Format-Table * +#Output.Reports.RegistrySettings | Format-Table * +#$Output.Reports.SecurityOptions | Format-Table * +#$Output.Reports.SystemServices | Format-Table * +#$Output.Reports.SystemServicesNT | Format-Table * +$Output.Reports.LocalUsers | Format-Table * +$Output.Reports.LocalGroups | Format-Table * return # This is section that treats 1 GPO as single object - if there are 5 scripts in 1 GPO there's only one value $Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation -SingleObject -$Output -$Output.Reports | Format-Table -$Output.Reports.Scripts | Format-Table * -$Output.Reports.SoftwareInstallation | Format-Table * \ No newline at end of file +#$Output +#$Output.Reports | Format-Table +#$Output.Reports.Scripts | Format-Table * +#$Output.Reports.SoftwareInstallation | Format-Table * +#$Output.Reports.Policies | Format-Table * +#$Output.Reports.RegistrySettings | Format-Table * +#$Output.Reports.SecurityOptions | Format-Table * +#$Output.Reports.SystemServices | Format-Table * +#$Output.Reports.SystemServicesNT | Format-Table * +$Output.Reports.LocalUsers | Format-Table * +$Output.Reports.LocalGroups | Format-Table * \ No newline at end of file diff --git a/Private/ConvertTo-LocalGroups.ps1 b/Private/ConvertTo-LocalGroups.ps1 new file mode 100644 index 0000000..708f569 --- /dev/null +++ b/Private/ConvertTo-LocalGroups.ps1 @@ -0,0 +1,126 @@ +function ConvertTo-XMLLocalGroups { + [cmdletBinding()] + param( + [PSCustomObject] $GPO, + [switch] $SingleObject + ) + + if ($SingleObject) { + $CreateGPO = [ordered]@{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.GUID + GpoType = $GPO.GpoType + #GpoCategory = $GPOEntry.GpoCategory + #GpoSettings = $GPOEntry.GpoSettings + Count = 0 + Settings = $null + } + if (-not $GPO.DataSet.Group) { + continue + } + [Array] $CreateGPO['Settings'] = foreach ($Group in $GPO.DataSet.Group) { + # We're mostly interested in Members + [Array] $Members = foreach ($Member in $Group.Properties.Members.Member) { + [ordered] @{ + MemberName = $Member.Name + MemberAction = $Member.Action + MemberSID = $Member.SID + } + } + # if we have no members we create dummy object to make sure we can use foreach below + if ($Members.Count -eq 0) { + $Members = @( + [ordered] @{ + MemberName = $null + MemberAction = $null + MemberSID = $null + } + ) + } + foreach ($Member in $Members) { + $GroupObject = [ordered]@{ + Changed = [DateTime] $Group.Changed + GPOSettingOrder = $Group.GPOSettingOrder + Name = $Group.name + Action = $Script:Actions["$($Group.Properties.action)"] + GroupName = $Group.Properties.groupName #: Administrators (built -in ) + NewName = $Group.Properties.newName #: + Description = $Group.Properties.description #: + DeleteAllUsers = if ($Group.Properties.deleteAllUsers -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllUsers -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllUsers }; + DeleteAllGroups = if ($Group.Properties.deleteAllGroups -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllGroups -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllGroups }; + RemoveAccounts = if ($Group.Properties.removeAccounts -eq '1') { 'Enabled' } elseif ($Group.Properties.removeAccounts -eq '0') { 'Disabled' } else { $Group.Properties.removeAccounts }; + GroupSid = $Group.Properties.groupSid #: S - 1 - 5 - 32 - 544 + } + $Last = [ordered] @{ + Uid = $Group.uid #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A} + RunInLoggedOnUserSecurityContext = if ($Group.userContext -eq '1') { 'Enabled' } elseif ($Group.userContext -eq '0') { 'Disabled' } else { $Group.userContext }; + RemoveThisItemWhenItIsNoLongerApplied = if ($Group.removePolicy -eq '1') { 'Enabled' } elseif ($Group.removePolicy -eq '0') { 'Disabled' } else { $Group.removePolicy }; + Filters = $Group.Filters #:: + } + # Merging GPO with Member + $GroupObject = $GroupObject + $Member + $Last + [PSCustomObject] $GroupObject + } + } + $CreateGPO['Count'] = $CreateGPO['Settings'].Count + $CreateGPO['Linked'] = $GPO.Linked + $CreateGPO['LinksCount'] = $GPO.LinksCount + $CreateGPO['Links'] = $GPO.Links + [PSCustomObject] $CreateGPO + } else { + foreach ($Group in $GPO.DataSet.Group) { + # We're mostly interested in Members + [Array] $Members = foreach ($Member in $Group.Properties.Members.Member) { + [ordered] @{ + MemberName = $Member.Name + MemberAction = $Member.Action + MemberSID = $Member.SID + } + } + # if we have no members we create dummy object to make sure we can use foreach below + if ($Members.Count -eq 0) { + $Members = @( + [ordered] @{ + MemberName = $null + MemberAction = $null + MemberSID = $null + } + ) + } + foreach ($Member in $Members) { + $CreateGPO = [ordered]@{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.GUID + GpoType = $GPO.GpoType + #GpoCategory = $GPO.GpoCategory #: SecuritySettings + #GpoSettings = $GPO.GpoSettings #: SecurityOptions + Changed = [DateTime] $Group.Changed + GPOSettingOrder = $Group.GPOSettingOrder + Name = $Group.name + Action = $Script:Actions["$($Group.Properties.action)"] + GroupName = $Group.Properties.groupName #: Administrators (built -in ) + NewName = $Group.Properties.newName #: + Description = $Group.Properties.description #: + DeleteAllUsers = if ($Group.Properties.deleteAllUsers -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllUsers -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllUsers }; + DeleteAllGroups = if ($Group.Properties.deleteAllGroups -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllGroups -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllGroups }; + RemoveAccounts = if ($Group.Properties.removeAccounts -eq '1') { 'Enabled' } elseif ($Group.Properties.removeAccounts -eq '0') { 'Disabled' } else { $Group.Properties.removeAccounts }; + GroupSid = $Group.Properties.groupSid #: S - 1 - 5 - 32 - 544 + } + $Last = [ordered] @{ + Uid = $Group.uid #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A} + RunInLoggedOnUserSecurityContext = if ($Group.userContext -eq '1') { 'Enabled' } elseif ($Group.userContext -eq '0') { 'Disabled' } else { $Group.userContext }; + RemoveThisItemWhenItIsNoLongerApplied = if ($Group.removePolicy -eq '1') { 'Enabled' } elseif ($Group.removePolicy -eq '0') { 'Disabled' } else { $Group.removePolicy }; + Filters = $Group.Filters #:: + } + # Merging GPO with Member + $CreateGPO = $CreateGPO + $Member + $Last + $CreateGPO['Linked'] = $GPO.Linked + $CreateGPO['LinksCount'] = $GPO.LinksCount + $CreateGPO['Links'] = $GPO.Links + [PSCustomObject] $CreateGPO + } + } + } +} diff --git a/Private/ConvertTo-LocalUserAndGroups.ps1 b/Private/ConvertTo-LocalUserAndGroups.ps1 index f8798b6..c2a5f32 100644 --- a/Private/ConvertTo-LocalUserAndGroups.ps1 +++ b/Private/ConvertTo-LocalUserAndGroups.ps1 @@ -87,3 +87,79 @@ } } } + + +function ConvertTo-XMLLocalUser { + [cmdletBinding()] + param( + [PSCustomObject] $GPO, + [switch] $SingleObject + ) + if ($SingleObject) { + $CreateGPO = [ordered]@{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.GUID + GpoType = $GPO.GpoType + #GpoCategory = $GPOEntry.GpoCategory + #GpoSettings = $GPOEntry.GpoSettings + Count = 0 + Settings = $null + } + if (-not $GPO.DataSet.User) { + continue + } + [Array] $CreateGPO['Settings'] = foreach ($User in $GPO.DataSet.User) { + [PSCustomObject] @{ + Changed = [DateTime] $User.Changed + GPOSettingOrder = $User.GPOSettingOrder + Action = $Script:Actions["$($User.Properties.action)"] + UserName = $User.Properties.userName + NewName = $User.Properties.newName + FullName = $User.Properties.fullName + Description = $User.Properties.description + Password = $User.Properties.cpassword + MustChangePasswordAtNextLogon = if ($User.Properties.changeLogon -eq '1') { $true } elseif ($User.Properties.changeLogon -eq '0') { $false } else { $User.Properties.changeLogon }; + CannotChangePassword = if ($User.Properties.noChange -eq '1') { $true } elseif ($User.Properties.noChange -eq '0') { $false } else { $User.Properties.noChange }; + PasswordNeverExpires = if ($User.Properties.neverExpires -eq '1') { $true } elseif ($User.Properties.neverExpires -eq '0') { $false } else { $User.Properties.neverExpires }; + AccountIsDisabled = if ($User.Properties.acctDisabled -eq '1') { $true } elseif ($User.Properties.acctDisabled -eq '0') { $false } else { $User.Properties.acctDisabled }; + AccountExpires = try { [DateTime] $User.Properties.expires } catch { $User.Properties.expires }; + SubAuthority = $User.Properties.subAuthority + } + } + $CreateGPO['Count'] = $CreateGPO['Settings'].Count + $CreateGPO['Linked'] = $GPO.Linked + $CreateGPO['LinksCount'] = $GPO.LinksCount + $CreateGPO['Links'] = $GPO.Links + [PSCustomObject] $CreateGPO + } else { + foreach ($User in $GPO.DataSet.User) { + $CreateGPO = [ordered]@{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.GUID + GpoType = $GPO.GpoType + #GpoCategory = $GPO.GpoCategory #: SecuritySettings + #GpoSettings = $GPO.GpoSettings #: SecurityOptions + Changed = [DateTime] $User.Changed + GPOSettingOrder = $User.GPOSettingOrder + Action = $Script:Actions["$($User.Properties.action)"] + UserName = $User.Properties.userName + NewName = $User.Properties.newName + FullName = $User.Properties.fullName + Description = $User.Properties.description + Password = $User.Properties.cpassword + MustChangePasswordAtNextLogon = if ($User.Properties.changeLogon -eq '1') { $true } elseif ($User.Properties.changeLogon -eq '0') { $false } else { $User.Properties.changeLogon }; + CannotChangePassword = if ($User.Properties.noChange -eq '1') { $true } elseif ($User.Properties.noChange -eq '0') { $false } else { $User.Properties.noChange }; + PasswordNeverExpires = if ($User.Properties.neverExpires -eq '1') { $true } elseif ($User.Properties.neverExpires -eq '0') { $false } else { $User.Properties.neverExpires }; + AccountIsDisabled = if ($User.Properties.acctDisabled -eq '1') { $true } elseif ($User.Properties.acctDisabled -eq '0') { $false } else { $User.Properties.acctDisabled }; + AccountExpires = try { [DateTime] $User.Properties.expires } catch { $User.Properties.expires }; + SubAuthority = $User.Properties.subAuthority + } + $CreateGPO['Linked'] = $GPO.Linked + $CreateGPO['LinksCount'] = $GPO.LinksCount + $CreateGPO['Links'] = $GPO.Links + [PSCustomObject] $CreateGPO + } + } +} \ No newline at end of file diff --git a/Private/Script.GPODictionary.ps1 b/Private/Script.GPODictionary.ps1 index 6547028..fb71e3c 100644 --- a/Private/Script.GPODictionary.ps1 +++ b/Private/Script.GPODictionary.ps1 @@ -4,66 +4,64 @@ Settings = 'Account' GPOPath = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies' Code = { - #ConvertTo-AccountPolicies -GPOList $GPOList ConvertTo-XMLAccountPolicies -GPO $GPO } CodeSingle = { - #ConvertTo-AccountPolicies -GPOList $GPOList ConvertTo-XMLAccountPolicies -GPO $GPO } } Audit = [ordered] @{ Category = 'SecuritySettings' Settings = 'Audit' - #GPOPath = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies' + GPOPath = '' Code = { ConvertTo-XMLAudit -GPO $GPO - #ConvertTo-Audit -GPOList $GPOList } CodeSingle = { ConvertTo-XMLAudit -GPO $GPO - #ConvertTo-Audit -GPOList $GPOList } } Autologon = [ordered] @{ Category = 'RegistrySettings' Settings = 'RegistrySettings' Code = { - #ConvertTo-RegistryAutologon -GPOList $GPOList ConvertTo-XMLRegistryAutologon -GPO $GPO } CodeSingle = { - #ConvertTo-AccountPolicies -GPOList $GPOList ConvertTo-XMLRegistryAutologon -GPO $GPO } } EventLog = [ordered] @{ Category = 'SecuritySettings' Settings = 'EventLog' - #GPOPath = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies' + GPOPath = '' Code = { - #ConvertTo-EventLog -GPOList $GPOList ConvertTo-XMLEventLog -GPO $GPO } CodeSingle = { - #ConvertTo-EventLog -GPOList $GPOList ConvertTo-XMLEventLog -GPO $GPO } } - - LocalUsersAndGroups = [ordered] @{ + LocalUsers = [ordered] @{ Category = 'LugsSettings' Settings = 'LocalUsersAndGroups' Code = { - #ConvertTo-LocalUserAndGroups -GPOList $GPOList - ConvertTo-XMLLocalUserAndGroups -GPO $GPO + ConvertTo-XMLLocalUser -GPO $GPO } CodeSingle = { - #ConvertTo-EventLog -GPOList $GPOList - ConvertTo-XMLLocalUserAndGroups -GPO $GPO -SingleObject + ConvertTo-XMLLocalUser -GPO $GPO -SingleObject + } + } + LocalGroups = [ordered] @{ + Category = 'LugsSettings' + Settings = 'LocalUsersAndGroups' + Code = { + ConvertTo-XMLLocalGroups -GPO $GPO + } + CodeSingle = { + ConvertTo-XMLLocalGroups -GPO $GPO -SingleObject } } - Policies = @{ Category = 'RegistrySettings' Settings = 'Policy' @@ -88,7 +86,6 @@ Category = 'Scripts' Settings = 'Script' Code = { - #ConvertTo-Scripts -GPOList $GPOList ConvertTo-XMLScripts -GPO $GPO } CodeSingle = { @@ -99,11 +96,9 @@ Category = 'SecuritySettings' Settings = 'SecurityOptions' Code = { - #ConvertTo-SecurityOptions -GPOList $GPOList ConvertTo-XMLSecurityOptions -GPO $GPO } CodeSingle = { - #ConvertTo-SecurityOptions -GPOList $GPOList ConvertTo-XMLSecurityOptions -GPO $GPO -SingleObject } } @@ -111,7 +106,6 @@ Category = 'SoftwareInstallationSettings' Settings = 'MsiApplication' Code = { - # ConvertTo-SoftwareInstallation -GPOList $GPOList ConvertTo-XMLSoftwareInstallation -GPO $GPO } CodeSingle = { @@ -124,7 +118,6 @@ Category = 'SecuritySettings' Settings = 'SystemServices' Code = { - # ConvertTo-SoftwareInstallation -GPOList $GPOList ConvertTo-XMLSystemServices -GPO $GPO } CodeSingle = { @@ -137,7 +130,6 @@ Category = 'ServiceSettings' Settings = 'NTServices' Code = { - # ConvertTo-SoftwareInstallation -GPOList $GPOList ConvertTo-XMLSystemServicesNT -GPO $GPO } CodeSingle = {