diff --git a/Public/Get-GPOZaurrPermissionConsistency.ps1 b/Public/Get-GPOZaurrPermissionConsistency.ps1 index 4a90e79..edeb5da 100644 --- a/Public/Get-GPOZaurrPermissionConsistency.ps1 +++ b/Public/Get-GPOZaurrPermissionConsistency.ps1 @@ -56,20 +56,27 @@ } $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}') if ($VerifyInheritance) { - $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath -Verbose:$false - if ($FolderPermissions) { - [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) { - if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) { - $File + if ($IsConsistent -eq $true) { + $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath -Verbose:$false + if ($FolderPermissions) { + [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) { + if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) { + $File + } + } + if ($NotInheritedPermissions.Count -eq 0) { + $ACLConsistentInside = $true + } else { + $ACLConsistentInside = $false } - } - if ($NotInheritedPermissions.Count -eq 0) { - $ACLConsistentInside = $true } else { - $ACLConsistentInside = $false + $ACLConsistentInside = 'Not available' + $NotInheritedPermissions = $null } } else { - $ACLConsistentInside = 'Not available' + # Since top level permissions are inconsistent we don't even try to asses inside permissions + $ACLConsistentInside = $IsConsistent + $NotInheritedPermissions = $null } } $Object = [ordered] @{ diff --git a/README.md b/README.md index a61c461..400436b 100644 --- a/README.md +++ b/README.md @@ -49,6 +49,8 @@ That's it. Whenever there's a new version, you run the command, and you can enjo ## Changelog +- 0.0.68 + - Improvements to `Get-GPOZaurrPermissionConsistency` - don't check for inherited permissions if top level ones are inconsistent - 0.0.67 - 22.10.2020 - Improved `Show-GPOZaurr` (WIP) - 0.0.66 - 22.10.2020