Update

Public/Get-GPOZaurrPermissionConsistency.ps1

@@ -56,20 +56,27 @@
                 }
                 $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
                 if ($VerifyInheritance) {
-                    $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath -Verbose:$false
-                    if ($FolderPermissions) {
-                        [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) {
-                            if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) {
-                                $File
+                    if ($IsConsistent -eq $true) {
+                        $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath -Verbose:$false
+                        if ($FolderPermissions) {
+                            [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) {
+                                if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) {
+                                    $File
+                                }
+                            }
+                            if ($NotInheritedPermissions.Count -eq 0) {
+                                $ACLConsistentInside = $true
+                            } else {
+                                $ACLConsistentInside = $false
                             }
-                        }
-                        if ($NotInheritedPermissions.Count -eq 0) {
-                            $ACLConsistentInside = $true
                         } else {
-                            $ACLConsistentInside = $false
+                            $ACLConsistentInside = 'Not available'
+                            $NotInheritedPermissions = $null
                         }
                     } else {
-                        $ACLConsistentInside = 'Not available'
+                        # Since top level permissions are inconsistent we don't even try to asses inside permissions
+                        $ACLConsistentInside = $IsConsistent
+                        $NotInheritedPermissions = $null
                     }
                 }
                 $Object = [ordered] @{

README.md

@@ -49,6 +49,8 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
+- 0.0.68
+  - Improvements to `Get-GPOZaurrPermissionConsistency` - don't check for inherited permissions if top level ones are inconsistent
 - 0.0.67 - 22.10.2020
   - Improved `Show-GPOZaurr` (WIP)
 - 0.0.66 - 22.10.2020