gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-07-26 11:49:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

self-contain AD administrative groups helper (#87)

Browse Source
This commit is contained in:
Przemysław Kłys
2026-04-02 14:02:33 +02:00
committed by GitHub
parent 6624efa9bc
commit 6bfa63ae68
10 changed files with 83 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/Get-ADAdministrativeGroups.ps1
+73
View File
@@ -0,0 +1,73 @@
function Get-ADAdministrativeGroups {
<#
.SYNOPSIS
Retrieves administrative groups information from Active Directory.
.DESCRIPTION
Retrieves the Domain Admins and Enterprise Admins groups for the requested
forest and returns lookup dictionaries keyed by domain, NetBIOS name, and SID.
.PARAMETER Type
Specifies the type of administrative groups to retrieve. Valid values are
'DomainAdmins' and 'EnterpriseAdmins'.
.PARAMETER Forest
Specifies the name of the forest to query for administrative groups.
.PARAMETER ExcludeDomains
Specifies an array of domains to exclude from the query.
.PARAMETER IncludeDomains
Specifies an array of domains to include in the query.
.PARAMETER ExtendedForestInformation
Specifies additional information about the forest to include in the query.
#>
[cmdletBinding()]
param(
[parameter(Mandatory)][validateSet('DomainAdmins', 'EnterpriseAdmins')][string[]] $Type,
[alias('ForestName')][string] $Forest,
[string[]] $ExcludeDomains,
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
[System.Collections.IDictionary] $ExtendedForestInformation
)
$ADDictionary = [ordered] @{
ByNetBIOS = [ordered] @{}
BySID = [ordered] @{}
}
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
foreach ($Domain in $ForestInformation.Domains) {
$ADDictionary[$Domain] = [ordered] @{}
$QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
$DomainInformation = Get-ADDomain -Server $QueryServer
if ($Type -contains 'DomainAdmins') {
Get-ADGroup -Filter "SID -eq '$($DomainInformation.DomainSID)-512'" -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
$ADDictionary['ByNetBIOS']["$($DomainInformation.NetBIOSName)\$($_.Name)"] = $_
$ADDictionary[$Domain]['DomainAdmins'] = "$($DomainInformation.NetBIOSName)\$($_.Name)"
$ADDictionary['BySID'][$_.SID.Value] = $_
}
}
}
foreach ($Domain in $ForestInformation.Forest.Domains) {
if (-not $ADDictionary[$Domain]) {
$ADDictionary[$Domain] = [ordered] @{}
}
if ($Type -contains 'EnterpriseAdmins') {
$QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
$DomainInformation = Get-ADDomain -Server $QueryServer
Get-ADGroup -Filter "SID -eq '$($DomainInformation.DomainSID)-519'" -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
$ADDictionary['ByNetBIOS']["$($DomainInformation.NetBIOSName)\$($_.Name)"] = $_
$ADDictionary[$Domain]['EnterpriseAdmins'] = "$($DomainInformation.NetBIOSName)\$($_.Name)"
$ADDictionary['BySID'][$_.SID.Value] = $_
}
}
}
$ADDictionary
}
Private/Get-PermissionsAnalysis.ps1
+1 -1
View File
@@ -56,7 +56,7 @@
[System.Collections.IDictionary] $ADAdministrativeGroups
)
if (-not $ADAdministrativeGroups) {
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
$ADAdministrativeGroups = Get-ADAdministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
}
$AdministrativeExists = [ordered] @{
DisplayName = $GPOPermissions[0].DisplayName
Public/Add-GPOZaurrPermission.ps1
+1 -1
View File
@@ -91,7 +91,7 @@
)
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Extended
if (-not $ADAdministrativeGroups) {
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
$ADAdministrativeGroups = Get-ADAdministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
}
if ($GPOName) {
$Splat = @{
Public/Get-GPOZaurr.ps1
+1 -1
View File
@@ -88,7 +88,7 @@
Begin {
if (-not $ADAdministrativeGroups) {
Write-Verbose "Get-GPOZaurr - Getting ADAdministrativeGroups"
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
$ADAdministrativeGroups = Get-ADAdministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
}
if (-not $GPOPath) {
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
Public/Get-GPOZaurrOwner.ps1
+1 -1
View File
@@ -64,7 +64,7 @@
Begin {
$ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
if (-not $ADAdministrativeGroups) {
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
$ADAdministrativeGroups = Get-ADAdministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
}
$Count = 0
}
Public/Get-GPOZaurrPermission.ps1
+1 -1
View File
@@ -115,7 +115,7 @@
Begin {
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Extended
if (-not $ADAdministrativeGroups) {
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
$ADAdministrativeGroups = Get-ADAdministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
}
if ($Type -eq 'Unknown') {
if ($SkipAdministrative -or $SkipWellKnown) {
Public/Get-GPOZaurrPermissionAnalysis.ps1
+1 -1
View File
@@ -32,7 +32,7 @@
[Array] $Permissions
)
if (-not $ADAdministrativeGroups) {
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
$ADAdministrativeGroups = Get-ADAdministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
}
if (-not $Permissions) {
Public/Invoke-GPOZaurrPermission.ps1
+2 -2
View File
@@ -192,9 +192,9 @@
$ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
if ($LimitAdministrativeGroupsToDomain) {
# This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
$ADAdministrativeGroups = Get-ADAdministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
} else {
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
$ADAdministrativeGroups = Get-ADAdministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
}
if ($PSCmdlet.ParameterSetName -ne 'Level') {
$Splat = @{
Public/Remove-GPOZaurrPermission.ps1
+1 -1
View File
@@ -85,7 +85,7 @@
Begin {
$Count = 0
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
$ADAdministrativeGroups = Get-ADAdministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
if ($Type -eq 'Unknown') {
if ($SkipAdministrative -or $SkipWellKnown) {
Write-Warning "Remove-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
Public/Set-GPOZaurrOwner.ps1
+1 -1
View File
@@ -97,7 +97,7 @@
[switch] $Force
)
Begin {
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
$ADAdministrativeGroups = Get-ADAdministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
}
Process {
$getGPOZaurrOwnerSplat = @{