From 6f1ac33df8c67e29beaac19590fb483c1c0da8f9 Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Sat, 12 Dec 2020 22:14:27 +0100 Subject: [PATCH] Update examples --- .../Example-08-ListingPermissionsUnknown.ps1 | 2 +- ...mple-09-RemovingGPOPermissionUnknown02.ps1 | 6 +-- Examples/Example-16-AddDomainAdmins.ps1 | 41 +++++++++++++++++++ 3 files changed, 45 insertions(+), 4 deletions(-) create mode 100644 Examples/Example-16-AddDomainAdmins.ps1 diff --git a/Examples/Example-08-ListingPermissionsUnknown.ps1 b/Examples/Example-08-ListingPermissionsUnknown.ps1 index a144f20..3287622 100644 --- a/Examples/Example-08-ListingPermissionsUnknown.ps1 +++ b/Examples/Example-08-ListingPermissionsUnknown.ps1 @@ -1,4 +1,4 @@ Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force $T = Get-GPOZaurrPermission -Type Unknown -Verbose -$T | Out-HtmlView -ScrollX -Filtering -DisablePaging -ScrollY -Online \ No newline at end of file +$T #| Out-HtmlView #-ScrollX -Filtering -DisablePaging -ScrollY -Online \ No newline at end of file diff --git a/Examples/Example-09-RemovingGPOPermissionUnknown02.ps1 b/Examples/Example-09-RemovingGPOPermissionUnknown02.ps1 index fb7f237..6686267 100644 --- a/Examples/Example-09-RemovingGPOPermissionUnknown02.ps1 +++ b/Examples/Example-09-RemovingGPOPermissionUnknown02.ps1 @@ -1,11 +1,11 @@ Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force # Step 1 - Create report -$Report = Get-GPOZaurrPermission -Type All -$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOutput.xlsx -ExcelWorkSheetName 'GPO Permissions Before' -AutoFilter -AutoFit +#$Report = Get-GPOZaurrPermission -Type All +#$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOutput.xlsx -ExcelWorkSheetName 'GPO Permissions Before' -AutoFilter -AutoFit # Step 2 - Verify couple of GPOS returned with whatif -#Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 4 -WhatIf +Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 4 -WhatIf # Step 3 - Confirm the change without whatif #Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 4 diff --git a/Examples/Example-16-AddDomainAdmins.ps1 b/Examples/Example-16-AddDomainAdmins.ps1 new file mode 100644 index 0000000..3b30141 --- /dev/null +++ b/Examples/Example-16-AddDomainAdmins.ps1 @@ -0,0 +1,41 @@ +Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force + +Clear-Host + +$GPOName = 'TEST | Deny Admins' + +$T = Get-GPOZaurrPermission -GPOName $GPOName #-IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow -Principal 'Domain Admins' -PrincipalType 'Name' +$T | Format-Table * + + +return + +<# +# this will go and check for both Domain Admins / Enterprise Admins - if found won't do anything +Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Type Administrative -Verbose +# this will go thru, because PrincipalType is not set to look by Name. Be precise with what you ask for +Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -Verbose +# this will be detected as already existing +Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -PrincipalType Name -Verbose +# this will be added only if it doesn't exists - assuming that przemyslaw.klys is displayed in Get-GPOZaurrPermissions +Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose +# this will be added only if it doesn't exists - assuming that przemyslaw.klys is displayed in Get-GPOZaurrPermissions +Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose +# this will ADD system if it doesn't eists +Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Type WellKnownAdministrative -Verbose + +Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -Verbose +Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -Verbose +# this will not work because we already have GPOEditDeleteModifySecurity which is higher than GpoEDIT +Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEdit -Principal 'przemyslaw.klys' -Verbose +#> +Add-GPOZaurrPermission -GPOName $GPOName -Type AuthenticatedUsers -PermissionType GpoRead -Verbose #-WhatIf + +#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject +#$T | Format-Table -AutoSize * + +#Remove-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose + +#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject +#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject +#$T | Format-Table -AutoSize * \ No newline at end of file