gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-07-26 11:49:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update Get-GPOZaurrPermissionAnalysis

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-12-13 09:39:01 +01:00
parent 4a3a49440f
commit 71a12316e3
1 changed files with 14 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Public/Get-GPOZaurrPermissionAnalysis.ps1
+14 -45
View File
@@ -19,18 +19,20 @@
DisplayName = $GPO[0].DisplayName
DomainName = $GPO[0].DomainName
GUID = $GPO[0].GUID
StatusAdministrative = $false
StatusAuthenticatedUsers = $false
StatusSystem = $false
DomainAdmins = $false
EnterpriseAdmins = $false
Status = $false
Administrative = $false
AuthenticatedUsers = $false
System = $false
Unknown = $false
#StatusAuthenticatedUsers = $false
#StatusSystem = $false
DomainAdmins = $false
EnterpriseAdmins = $false
AuthenticatedUsersPermission = $null
DomainAdminsPermission = $null
EnterpriseAdminsPermission = $null
SystemPermission = $null
UnknownPermission = $null
}
foreach ($Permission in $GPO) {
if ($Permission.GPOSecurityPermissionItem) {
@@ -54,16 +56,13 @@
}
}
}
if ($AdministrativeExists['DomainAdmins'] -and $AdministrativeExists['EnterpriseAdmins']) {
# $AdministrativeExists['Skip'] = $true
# break
$AdministrativeExists['Administrative'] = $true
}
if ($Permission.PrincipalSid -eq 'S-1-5-11') {
$PermissionType = [Microsoft.GroupPolicy.GPPermissionType]::GpoApply, [Microsoft.GroupPolicy.GPPermissionType]::GpoRead
if ($Permission.Permission -in $PermissionType) {
$AdministrativeExists['AuthenticatedUsers'] = $true
$AdministrativeExists['StatusAuthenticatedUsers'] = $true
}
$AdministrativeExists['AuthenticatedUsersPermission'] = $Permission.Permission
}
@@ -71,46 +70,16 @@
$PermissionType = [Microsoft.GroupPolicy.GPPermissionType]::GpoEditDeleteModifySecurity
if ($Permission.Permission -in $PermissionType) {
$AdministrativeExists['System'] = $true
$AdministrativeExists['StatusSystem'] = $true
}
$AdministrativeExists['SystemPermission'] = $Permission.Permission
}
if ($AdministrativeExists['DomainAdmins'] -and $AdministrativeExists['EnterpriseAdmins']) {
$AdministrativeExists['StatusAdministrative'] = $true
if ($Permission.PrincipalSidType -eq 'Unknown') {
$AdministrativeExists['Unknown'] = $true
$AdministrativeExists['UnknownPermission'] = $Permission.Permission
}
# Permission exists, but may be incomplete
#foreach ($GPOPermission in $GPOPermissions) {
<#
if ($Type -eq 'Default') {
# We were looking for specific principal and we got it. nothing to do
# this is for standard users such as przemyslaw.klys / adam.gonzales
$AdministrativeExists['Skip'] = $true
break
} elseif ($Type -eq 'Administrative') {
# We are looking for administrative but we need to make sure we got correct administrative
if ($GPOPermission.Permission -eq $PermissionType) {
$AdministrativeGroup = $ADAdministrativeGroups['BySID'][$GPOPermission.PrincipalSid]
if ($AdministrativeGroup.SID -like '*-519') {
$AdministrativeExists['EnterpriseAdmins'] = $true
} elseif ($AdministrativeGroup.SID -like '*-512') {
$AdministrativeExists['DomainAdmins'] = $true
}
}
if ($AdministrativeExists['DomainAdmins'] -and $AdministrativeExists['EnterpriseAdmins']) {
$AdministrativeExists['Skip'] = $true
break
}
} elseif ($Type -eq 'WellKnownAdministrative') {
# this is for SYSTEM account
$AdministrativeExists['Skip'] = $true
break
} elseif ($Type -eq 'AuthenticatedUsers') {
# this is for Authenticated Users
$AdministrativeExists['Skip'] = $true
break
if ( $AdministrativeExists['System'] -eq $true -and $AdministrativeExists['AuthenticatedUsers'] -eq $true -and $AdministrativeExists['Administrative'] -eq $true) {
$AdministrativeExists['Status'] = $true
}
#>
#}
}
}
[PSCustomObject] $AdministrativeExists