diff --git a/Examples/Example-16-KeepPermissions03.ps1 b/Examples/Example-16-KeepPermissions03.ps1 new file mode 100644 index 0000000..05ccc91 --- /dev/null +++ b/Examples/Example-16-KeepPermissions03.ps1 @@ -0,0 +1,9 @@ +Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force + +# This is a bit special - I would read blog post before running this +Invoke-GPOZaurrPermission -Verbose -Level 1 -Limit 1 { + Set-GPOOwner -Type Administrative + Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow + Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow + Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow +} -WhatIf \ No newline at end of file diff --git a/Examples/Example-24-Links02.ps1 b/Examples/Example-24-Links02.ps1 new file mode 100644 index 0000000..3efbe4b --- /dev/null +++ b/Examples/Example-24-Links02.ps1 @@ -0,0 +1,12 @@ +Clear-Host +Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force + +$Report = Get-GPOZaurrLinkSummary -Report OneLink +$Report | Format-Table +$AffectedGPOs = foreach ($GPO in $Report) { + if ($GPO.Level1 -gt 1) { + $GPO + } +} + +$AffectedGPOs | Format-Table * \ No newline at end of file diff --git a/GPOZaurr.psd1 b/GPOZaurr.psd1 index e3e0e66..646a58e 100644 --- a/GPOZaurr.psd1 +++ b/GPOZaurr.psd1 @@ -7,7 +7,7 @@ Description = 'Group Policy Eater' FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner' GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde' - ModuleVersion = '0.0.36' + ModuleVersion = '0.0.37' PowerShellVersion = '5.1' PrivateData = @{ PSData = @{ diff --git a/Public/Get-GPOZaurrLinkSummary.ps1 b/Public/Get-GPOZaurrLinkSummary.ps1 index 8dea99f..346479f 100644 --- a/Public/Get-GPOZaurrLinkSummary.ps1 +++ b/Public/Get-GPOZaurrLinkSummary.ps1 @@ -35,9 +35,10 @@ } if ($Clean) { $Test = [ordered] @{ - GPOName = $GPO.DisplayName - #Test = $GPO.DistinguishedName - Level0 = ConvertFrom-DistinguishedName -DistinguishedName $GPO.DistinguishedName -ToDomainCN + DisplayName = $GPO.DisplayName + Guid = $GPO.Guid + DomainName = $GPO.DomainName + Level0 = ConvertFrom-DistinguishedName -DistinguishedName $GPO.DistinguishedName -ToDomainCN } for ($i = 1; $i -le 10; $i++) { $Test["Level$i"] = $Clean[ - $i] @@ -45,9 +46,10 @@ [PSCustomobject] $Test } else { $Test = [ordered] @{ - GPOName = $GPO.DisplayName - #Test = $GPO.DistinguishedName - Level0 = $GPO.CanonicalName + DisplayName = $GPO.DisplayName + Guid = $GPO.Guid + DomainName = $GPO.DomainName + Level0 = $GPO.CanonicalName } for ($i = 1; $i -le 10; $i++) { $Test["Level$i"] = $null @@ -63,39 +65,36 @@ } if ($Report -eq 'OneLink' -or $Report -contains 'All') { $List = [ordered] @{ - GPOName = $GPO.DisplayName - DomainName = $GPO.DomainName - LinksCount = $GPOs.Count + DisplayName = $GPOs[0].DisplayName + Guid = $GPOs[0].Guid + DomainName = $GPOs[0].DomainName + LinksCount = $GPOs.Count } for ($i = 0; $i -le 10; $i++) { $List["Level$i"] = ($LinkingSummary."Level$i" | Select-Object -Unique).Count $List["Level$($i)List"] = ($LinkingSummary."Level$i" | Select-Object -Unique) } - - - <# - Level0 = ($LinkingSummary.Level0 | Select-Object -Unique).Count - Level0List = ($LinkingSummary.Level0 | Select-Object -Unique) - Level1 = ($LinkingSummary.Level1 | Select-Object -Unique).Count - Level1List = ($LinkingSummary.Level1 | Select-Object -Unique) - Level2 = ($LinkingSummary.Level2 | Select-Object -Unique).Count - Level2List = ($LinkingSummary.Level2 | Select-Object -Unique) - #> - $List.LinksDistinguishedName = $GPOs.DistinguishedName # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz $List.LinksCanonicalName = $GPOs.CanonicalName + + $List.Owner = $GPOs[0].Owner #: EVOTEC\Domain Admins + $List.GpoStatus = $GPOs[0].GpoStatus #: AllSettingsEnabled + $List.Description = $GPOs[0].Description #: + $List.CreationTime = $GPOs[0].CreationTime #: 16.12.2019 21:25:32 + $List.ModificationTime = $GPOs[0].ModificationTime #: 30.05.2020 19:12:58 + $List.GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz + $List.GPODistinguishedName = $GPOs[0].GPODistinguishedName #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy + $ReturnObject.OneLink.Add( [PSCustomObject] $List) } if ($Report -eq 'LinksSummary' -or $Report -contains 'All') { $Output = [PSCustomObject] @{ - Guid = $GPOs[0].Guid #: AA782787 - 002B-4B8C-886F-05873F2DC0CA - DisplayName = $GPOs[0].DisplayName #: COMPUTERS | LAPS - DomainName = $GPOs[0].DomainName #: ad.evotec.xyz - LinksCount = $GPOs.Count - LinksDistinguishedName = $GPOs.DistinguishedName # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz - LinksCanonicalName = $GPOs.CanonicalName #: ad.evotec.xyz / ITR02 / Computers - #LinkSummary = $LinkingSummary - <# + DisplayName = $GPOs[0].DisplayName #: COMPUTERS | LAPS + Guid = $GPOs[0].Guid #: AA782787 - 002B-4B8C-886F-05873F2DC0CA + DomainName = $GPOs[0].DomainName #: ad.evotec.xyz + LinksCount = $GPOs.Count + LinksDistinguishedName = $GPOs.DistinguishedName # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz + LinksCanonicalName = $GPOs.CanonicalName #: ad.evotec.xyz / ITR02 / Computers Owner = $GPOs[0].Owner #: EVOTEC\Domain Admins GpoStatus = $GPOs[0].GpoStatus #: AllSettingsEnabled Description = $GPOs[0].Description #: @@ -103,7 +102,6 @@ ModificationTime = $GPOs[0].ModificationTime #: 30.05.2020 19:12:58 GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz GPODistinguishedName = $GPOs[0].GPODistinguishedName #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy - #> } $ReturnObject.LinksSummary.Add($Output) } @@ -112,40 +110,46 @@ if (-not $UnlimitedProperties) { if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') { $Properties = @( - 'GPOName' + 'DisplayName' + 'DomainName' + 'GUID' for ($i = 0; $i -le $HighestCount; $i++) { "Level$i" } + 'Owner' + 'GpoStatus' + 'Description' + 'CreationTime' + 'ModificationTime' + 'GPODomainDistinguishedName' + 'GPODistinguishedName' ) $ReturnObject.MultipleLinks = $ReturnObject.MultipleLinks | Select-Object -Property $Properties } if ($Report -contains 'OneLink' -or $Report -contains 'All') { $Properties = @( - 'GPOName' + 'DisplayName' 'DomainName' + 'GUID' for ($i = 0; $i -le $HighestCount; $i++) { "Level$i" "Level$($i)List" } 'LinksDistinguishedName' 'LinksCanonicalName' + 'Owner' + 'GpoStatus' + 'Description' + 'CreationTime' + 'ModificationTime' + 'GPODomainDistinguishedName' + 'GPODistinguishedName' ) $ReturnObject.OneLink = $ReturnObject.OneLink | Select-Object -Property $Properties } - if ($Report -contains 'LinksSummary' -or $Report -contains 'All') { - # Not needed because there's no dynamic properties, but if there would be we need to uncomment and fix it - <# - $Properties = @( - 'Guid' - 'DisplayName' - 'DomainName' - 'LinksCount' - 'LinksDistinguishedName' - 'LinksCanonicalName' - ) - $ReturnObject.LinksSummary = $ReturnObject.LinksSummary | Select-Object -Property $Properties - #> - } + #if ($Report -contains 'LinksSummary' -or $Report -contains 'All') { + # Not needed because there's no dynamic properties, but if there would be we need to uncomment and fix it + #} } if ($Report.Count -eq 1 -and $Report -notcontains 'All') { $ReturnObject["$Report"] diff --git a/Public/Invoke-GPOZaurrPermission.ps1 b/Public/Invoke-GPOZaurrPermission.ps1 index 6f990e2..ff1411a 100644 --- a/Public/Invoke-GPOZaurrPermission.ps1 +++ b/Public/Invoke-GPOZaurrPermission.ps1 @@ -6,27 +6,38 @@ [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] + [parameter(ParameterSetName = 'Level')] [parameter(Position = 0)] [scriptblock] $PermissionRules, + # ParameterSet1 [Parameter(ParameterSetName = 'GPOName')][string] $GPOName, + # ParameterSet2 [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid, + # ParameterSet3 + [parameter(ParameterSetName = 'Level', Mandatory)][int] $Level, + [parameter(ParameterSetName = 'Level', Mandatory)][int] $Limit, + # ParameterSet4 [parameter(ParameterSetName = 'Linked', Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked, + # ParameterSet5 [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject, + # ParameterSet6 [parameter(ParameterSetName = 'Filter')][string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')", [parameter(ParameterSetName = 'Filter')][string] $SearchBase, [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope, + # All other paramerrs are for for all parametersets [Parameter(ParameterSetName = 'GPOGUID')] [Parameter(ParameterSetName = 'GPOName')] [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] + [parameter(ParameterSetName = 'Level')] [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'All')][string[]] $Type, [Parameter(ParameterSetName = 'GPOGUID')] @@ -34,6 +45,7 @@ [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] + [parameter(ParameterSetName = 'Level')] [Array] $ApprovedGroups, [Parameter(ParameterSetName = 'GPOGUID')] @@ -41,6 +53,7 @@ [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] + [parameter(ParameterSetName = 'Level')] [alias('Principal')][Array] $Trustee, [Parameter(ParameterSetName = 'GPOGUID')] @@ -48,6 +61,7 @@ [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] + [parameter(ParameterSetName = 'Level')] [Microsoft.GroupPolicy.GPPermissionType] $TrusteePermissionType, [Parameter(ParameterSetName = 'GPOGUID')] @@ -55,6 +69,7 @@ [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] + [parameter(ParameterSetName = 'Level')] [alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName', [Parameter(ParameterSetName = 'GPOGUID')] @@ -62,6 +77,7 @@ [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] + [parameter(ParameterSetName = 'Level')] [System.Collections.IDictionary] $GPOCache, [Parameter(ParameterSetName = 'GPOGUID')] @@ -69,6 +85,7 @@ [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] + [parameter(ParameterSetName = 'Level')] [alias('ForestName')][string] $Forest, [Parameter(ParameterSetName = 'GPOGUID')] @@ -76,6 +93,7 @@ [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] + [parameter(ParameterSetName = 'Level')] [string[]] $ExcludeDomains, [Parameter(ParameterSetName = 'GPOGUID')] @@ -83,6 +101,7 @@ [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] + [parameter(ParameterSetName = 'Level')] [alias('Domain', 'Domains')][string[]] $IncludeDomains, [Parameter(ParameterSetName = 'GPOGUID')] @@ -90,6 +109,7 @@ [parameter(ParameterSetName = 'Filter')] [parameter(ParameterSetName = 'ADObject')] [parameter(ParameterSetName = 'Linked')] + [parameter(ParameterSetName = 'Level')] [System.Collections.IDictionary] $ExtendedForestInformation ) if ($PermissionRules) { @@ -101,80 +121,138 @@ $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation - $Splat = @{ - Forest = $Forest - IncludeDomains = $IncludeDomains - ExcludeDomains = $ExcludeDomains - ExtendedForestInformation = $ForestInformation - } - if ($ADObject) { - $Splat['ADObject'] = $ADObject - } elseif ($Linked) { - $Splat['Linked'] = $Linked - } elseif ($GPOName) { - - } elseif ($GPOGuid) { - - } else { - if ($Filter) { - $Splat['Filter'] = $Filter + if ($PSCmdlet.ParameterSetName -ne 'Level') { + $Splat = @{ + Forest = $Forest + IncludeDomains = $IncludeDomains + ExcludeDomains = $ExcludeDomains + ExtendedForestInformation = $ForestInformation } - if ($SearchBase) { - $Splat['SearchBase'] = $SearchBase - } - if ($SearchScope) { - $Splat['SearchScope'] = $SearchScope - } - } + if ($ADObject) { + $Splat['ADObject'] = $ADObject + } elseif ($Linked) { + $Splat['Linked'] = $Linked + } elseif ($GPOName) { - Get-GPOZaurrLink @Splat | ForEach-Object -Process { - $GPO = $_ - foreach ($Rule in $Rules) { - if ($Rule.Action -eq 'Owner') { - if ($Rule.Type -eq 'Administrative') { - # We check for Owner (sometimes it can be empty) - if ($GPO.Owner) { - $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"] - } else { - $AdministrativeGroup = $null - } - if (-not $AdministrativeGroup) { - $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] - Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal" - #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference - Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference - } - } elseif ($Rule.Type -eq 'Default') { - Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)" - #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference - Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference - } - } elseif ($Rule.Action -eq 'Remove') { - $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType - foreach ($Permission in $GPOPermissions) { - Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission - } - } elseif ($Rule.Action -eq 'Add') { - # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain - $SplatPermissions = @{ - #Forest = $Forest - IncludeDomains = $GPO.DomainName - #ExcludeDomains = $ExcludeDomains - #ExtendedForestInformation = $ForestInformation + } elseif ($GPOGuid) { - GPOGuid = $GPO.GUID - IncludePermissionType = $Rule.IncludePermissionType - Type = $Rule.Type - PermitType = $Rule.PermitType - Principal = $Rule.Principal - ADAdministrativeGroups = $ADAdministrativeGroups - } - if ($Rule.PrincipalType) { - $SplatPermissions.PrincipalType = $Rule.PrincipalType - } - Add-GPOZaurrPermission @SplatPermissions + } else { + if ($Filter) { + $Splat['Filter'] = $Filter + } + if ($SearchBase) { + $Splat['SearchBase'] = $SearchBase + } + if ($SearchScope) { + $Splat['SearchScope'] = $SearchScope } } - } + + + Get-GPOZaurrLink @Splat | ForEach-Object -Process { + $GPO = $_ + foreach ($Rule in $Rules) { + if ($Rule.Action -eq 'Owner') { + if ($Rule.Type -eq 'Administrative') { + # We check for Owner (sometimes it can be empty) + if ($GPO.Owner) { + $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"] + } else { + $AdministrativeGroup = $null + } + if (-not $AdministrativeGroup) { + $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] + Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal" + #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference + Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference + } + } elseif ($Rule.Type -eq 'Default') { + Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)" + #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference + Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference + } + } elseif ($Rule.Action -eq 'Remove') { + $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType + foreach ($Permission in $GPOPermissions) { + Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission + } + } elseif ($Rule.Action -eq 'Add') { + # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain + $SplatPermissions = @{ + #Forest = $Forest + IncludeDomains = $GPO.DomainName + #ExcludeDomains = $ExcludeDomains + #ExtendedForestInformation = $ForestInformation + + GPOGuid = $GPO.GUID + IncludePermissionType = $Rule.IncludePermissionType + Type = $Rule.Type + PermitType = $Rule.PermitType + Principal = $Rule.Principal + ADAdministrativeGroups = $ADAdministrativeGroups + } + if ($Rule.PrincipalType) { + $SplatPermissions.PrincipalType = $Rule.PrincipalType + } + Add-GPOZaurrPermission @SplatPermissions + } + } + } + } else { + # This is special case based on different command + $Report = Get-GPOZaurrLinkSummary -Report OneLink + $AffectedGPOs = foreach ($GPO in $Report) { + $Property = "Level$($Level)" + if ($GPO."$Property" -gt $Limit) { + foreach ($Rule in $Rules) { + if ($Rule.Action -eq 'Owner') { + if ($Rule.Type -eq 'Administrative') { + # We check for Owner (sometimes it can be empty) + if ($GPO.Owner) { + $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"] + } else { + $AdministrativeGroup = $null + } + if (-not $AdministrativeGroup) { + $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] + Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal" + #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference + Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference + } + } elseif ($Rule.Type -eq 'Default') { + Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)" + #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference + Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference + } + } elseif ($Rule.Action -eq 'Remove') { + $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType + foreach ($Permission in $GPOPermissions) { + Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission + } + } elseif ($Rule.Action -eq 'Add') { + # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain + $SplatPermissions = @{ + #Forest = $Forest + IncludeDomains = $GPO.DomainName + #ExcludeDomains = $ExcludeDomains + #ExtendedForestInformation = $ForestInformation + + GPOGuid = $GPO.GUID + IncludePermissionType = $Rule.IncludePermissionType + Type = $Rule.Type + PermitType = $Rule.PermitType + Principal = $Rule.Principal + ADAdministrativeGroups = $ADAdministrativeGroups + } + if ($Rule.PrincipalType) { + $SplatPermissions.PrincipalType = $Rule.PrincipalType + } + Add-GPOZaurrPermission @SplatPermissions + } + } + } + } + $AffectedGPOs + } } \ No newline at end of file diff --git a/README.md b/README.md index 9cf8f5c..15ed2ca 100644 --- a/README.md +++ b/README.md @@ -39,5 +39,8 @@ That's it. Whenever there's a new version, you run the command, and you can enjo ## Changelog +- 0.0.37 - 16.06.2020 + - Updates to `Invoke-GPOZaurrPermission` with new parameterset `Level` + - Updates to `Get-GPOZaurrLinkSummary` - 0.0.36 - 15.06.2020 - Initial release