gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-31 12:47:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update Get-GPOZaurrPermissionAnalysis

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-12-13 09:39:01 +01:00
parent 4a3a49440f
commit 71a12316e3
1 changed files with 14 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Public/Get-GPOZaurrPermissionAnalysis.ps1
+14 -45
View File
@@ -19,18 +19,20 @@
DisplayName = $GPO[0].DisplayName DisplayName = $GPO[0].DisplayName
DomainName = $GPO[0].DomainName DomainName = $GPO[0].DomainName
GUID = $GPO[0].GUID GUID = $GPO[0].GUID
StatusAdministrative = $false Status = $false
StatusAuthenticatedUsers = $false Administrative = $false
StatusSystem = $false
DomainAdmins = $false
EnterpriseAdmins = $false
AuthenticatedUsers = $false AuthenticatedUsers = $false
System = $false System = $false
Unknown = $false
#StatusAuthenticatedUsers = $false
#StatusSystem = $false
DomainAdmins = $false
EnterpriseAdmins = $false
AuthenticatedUsersPermission = $null AuthenticatedUsersPermission = $null
DomainAdminsPermission = $null DomainAdminsPermission = $null
EnterpriseAdminsPermission = $null EnterpriseAdminsPermission = $null
SystemPermission = $null SystemPermission = $null
UnknownPermission = $null
} }
foreach ($Permission in $GPO) { foreach ($Permission in $GPO) {
if ($Permission.GPOSecurityPermissionItem) { if ($Permission.GPOSecurityPermissionItem) {
@@ -54,16 +56,13 @@
} }
} }
} }
if ($AdministrativeExists['DomainAdmins'] -and $AdministrativeExists['EnterpriseAdmins']) { if ($AdministrativeExists['DomainAdmins'] -and $AdministrativeExists['EnterpriseAdmins']) {
# $AdministrativeExists['Skip'] = $true $AdministrativeExists['Administrative'] = $true
# break
} }
if ($Permission.PrincipalSid -eq 'S-1-5-11') { if ($Permission.PrincipalSid -eq 'S-1-5-11') {
$PermissionType = [Microsoft.GroupPolicy.GPPermissionType]::GpoApply, [Microsoft.GroupPolicy.GPPermissionType]::GpoRead $PermissionType = [Microsoft.GroupPolicy.GPPermissionType]::GpoApply, [Microsoft.GroupPolicy.GPPermissionType]::GpoRead
if ($Permission.Permission -in $PermissionType) { if ($Permission.Permission -in $PermissionType) {
$AdministrativeExists['AuthenticatedUsers'] = $true $AdministrativeExists['AuthenticatedUsers'] = $true
$AdministrativeExists['StatusAuthenticatedUsers'] = $true
} }
$AdministrativeExists['AuthenticatedUsersPermission'] = $Permission.Permission $AdministrativeExists['AuthenticatedUsersPermission'] = $Permission.Permission
} }
@@ -71,46 +70,16 @@
$PermissionType = [Microsoft.GroupPolicy.GPPermissionType]::GpoEditDeleteModifySecurity $PermissionType = [Microsoft.GroupPolicy.GPPermissionType]::GpoEditDeleteModifySecurity
if ($Permission.Permission -in $PermissionType) { if ($Permission.Permission -in $PermissionType) {
$AdministrativeExists['System'] = $true $AdministrativeExists['System'] = $true
$AdministrativeExists['StatusSystem'] = $true
} }
$AdministrativeExists['SystemPermission'] = $Permission.Permission $AdministrativeExists['SystemPermission'] = $Permission.Permission
} }
if ($AdministrativeExists['DomainAdmins'] -and $AdministrativeExists['EnterpriseAdmins']) { if ($Permission.PrincipalSidType -eq 'Unknown') {
$AdministrativeExists['StatusAdministrative'] = $true $AdministrativeExists['Unknown'] = $true
$AdministrativeExists['UnknownPermission'] = $Permission.Permission
} }
# Permission exists, but may be incomplete if ( $AdministrativeExists['System'] -eq $true -and $AdministrativeExists['AuthenticatedUsers'] -eq $true -and $AdministrativeExists['Administrative'] -eq $true) {
#foreach ($GPOPermission in $GPOPermissions) { $AdministrativeExists['Status'] = $true
<#
if ($Type -eq 'Default') {
# We were looking for specific principal and we got it. nothing to do
# this is for standard users such as przemyslaw.klys / adam.gonzales
$AdministrativeExists['Skip'] = $true
break
} elseif ($Type -eq 'Administrative') {
# We are looking for administrative but we need to make sure we got correct administrative
if ($GPOPermission.Permission -eq $PermissionType) {
$AdministrativeGroup = $ADAdministrativeGroups['BySID'][$GPOPermission.PrincipalSid]
if ($AdministrativeGroup.SID -like '*-519') {
$AdministrativeExists['EnterpriseAdmins'] = $true
} elseif ($AdministrativeGroup.SID -like '*-512') {
$AdministrativeExists['DomainAdmins'] = $true
}
}
if ($AdministrativeExists['DomainAdmins'] -and $AdministrativeExists['EnterpriseAdmins']) {
$AdministrativeExists['Skip'] = $true
break
}
} elseif ($Type -eq 'WellKnownAdministrative') {
# this is for SYSTEM account
$AdministrativeExists['Skip'] = $true
break
} elseif ($Type -eq 'AuthenticatedUsers') {
# this is for Authenticated Users
$AdministrativeExists['Skip'] = $true
break
} }
#>
#}
} }
} }
[PSCustomObject] $AdministrativeExists [PSCustomObject] $AdministrativeExists