diff --git a/GPOZaurr.psd1 b/GPOZaurr.psd1 index fdae137..5e21274 100644 --- a/GPOZaurr.psd1 +++ b/GPOZaurr.psd1 @@ -6,7 +6,7 @@ CompatiblePSEditions = @('Desktop') Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.' Description = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.' - FunctionsToExport = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvol', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphaned', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Show-GPOZaurr') + FunctionsToExport = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetlogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvol', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphaned', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Show-GPOZaurr') GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde' ModuleVersion = '0.0.63' PowerShellVersion = '5.1' @@ -18,7 +18,7 @@ } } RequiredModules = @(@{ - ModuleVersion = '0.0.182' + ModuleVersion = '0.0.183' ModuleName = 'PSSharedGoods' Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe' }, @{ diff --git a/Public/Get-GPOZaurrNetlogon.ps1 b/Public/Get-GPOZaurrNetlogon.ps1 new file mode 100644 index 0000000..13c5aa4 --- /dev/null +++ b/Public/Get-GPOZaurrNetlogon.ps1 @@ -0,0 +1,70 @@ +function Get-GPOZaurrNetLogon { + [cmdletBinding(DefaultParameterSetName = 'Default')] + param( + [parameter(ParameterSetName = 'OwnerOnly')][switch] $OwnerOnly, + [parameter(ParameterSetName = 'SkipOwner')][switch] $SkipOwner + ) + $ForestInformation = Get-WinADForestDetails -Extended + $FilesAll = foreach ($Domain in $ForestInformation.Domains) { + $Path = -join ("\\", $Domain, '\Netlogon') + $Files = Get-ChildItem -LiteralPath $Path -Recurse + foreach ($_ in $Files) { + $ACL = Get-Acl -Path $_.FullName + if ($ACL.Owner) { + $IdentityOwner = Convert-Identity -Identity $ACL.Owner + } else { + $IdentityOwner = [PSCustomObject] @{ SID = ''; Type = 'Uknown' } + } + if (-not $OwnerOnly) { + if (-not $SkipOwner) { + [PSCustomObject] @{ + FullName = $_.FullName + Extension = $_.Extension + CreationTime = $_.CreationTime + LastAccessTime = $_.LastAccessTime + LastWriteTime = $_.LastWriteTime + Attributes = $_.Attributes + AccessControlType = 'Allow' # : Allow + Principal = $IdentityOwner.Name # : BUILTIN\Administrators + PrincipalSid = $IdentityOwner.SID + PrincipalType = $IdentityOwner.Type + FileSystemRights = 'Owner' # : FullControl + IsInherited = $false + #Owner = $ACL.Owner + } + } + $FilePermission = Get-FilePermissions -Path $_.FullName -ACLS $ACL + foreach ($Perm in $FilePermission) { + $Identity = Convert-Identity -Identity $Perm.Principal + [PSCustomObject] @{ + FullName = $_.FullName + Extension = $_.Extension + CreationTime = $_.CreationTime + LastAccessTime = $_.LastAccessTime + LastWriteTime = $_.LastWriteTime + Attributes = $_.Attributes + AccessControlType = $Perm.AccessControlType # : Allow + Principal = $Identity.Name # : BUILTIN\Administrators + PrincipalSid = $Identity.SID + PrincipalType = $Identity.Type + FileSystemRights = $Perm.FileSystemRights # : FullControl + IsInherited = $Perm.IsInherited # : True + } + } + } else { + [PSCustomObject] @{ + FullName = $_.FullName + Extension = $_.Extension + CreationTime = $_.CreationTime + LastAccessTime = $_.LastAccessTime + LastWriteTime = $_.LastWriteTime + Attributes = $_.Attributes + Owner = $IdentityOwner.Name + OwnerSid = $IdentityOwner.SID + OwnerType = $IdentityOwner.Type + } + } + } + } + $FilesAll +} diff --git a/Public/Invoke-GPOZaurr.ps1 b/Public/Invoke-GPOZaurr.ps1 index 6b3e68b..69e3c0b 100644 --- a/Public/Invoke-GPOZaurr.ps1 +++ b/Public/Invoke-GPOZaurr.ps1 @@ -236,12 +236,14 @@ $OutputPath = Get-FileName -Extension 'html' -Temporary Write-Warning "Invoke-GPOZaurr - OutputPath not given. Using $OutputPath" } + Write-Verbose "Invoke-GPOZaurr - Generating HTML output" New-HTML { New-HTMLSectionStyle -BorderRadius 0px -HeaderBackGroundColor Grey -RemoveShadow New-HTMLTabStyle -BorderRadius 0px -TextTransform capitalize -BackgroundColorActive SlateGrey New-HTMLTableOption -DataStore JavaScript foreach ($Key in $Output.Reports.Keys) { New-HTMLTab -Name $Key { + Write-Verbose "Invoke-GPOZaurr - Generating HTML Table for $Key" New-HTMLTable -DataTable $Output.Reports[$Key] -Filtering -Title $Key } } diff --git a/Public/Show-GPOZaurr.ps1 b/Public/Show-GPOZaurr.ps1 index bcb8b0b..a36e80b 100644 --- a/Public/Show-GPOZaurr.ps1 +++ b/Public/Show-GPOZaurr.ps1 @@ -1,14 +1,22 @@ function Show-GPOZaurr { [cmdletBinding()] param( - [string] $FilePath + [string] $FilePath, + [ValidateSet('GPOList', 'GPOOrphans', 'NetLogon')][string[]] $Type ) - Write-Verbose -Message "Show-GPOZaurr - Processing GPO List" - $GPOSummary = Get-GPOZaurr + if ($Type -contains 'GPOList' -or $null -eq $Type) { + Write-Verbose -Message "Show-GPOZaurr - Processing GPO List" + $GPOSummary = Get-GPOZaurr + $GPOLinked = $GPOSummary.Where( { $_.Linked -eq $true }, 'split') + $GPOEmpty = $GPOSummary.Where( { $_.Empty -eq $true, 'split' }) + $GPOTotal = $GPOSummary.Count + } - Write-Verbose -Message "Show-GPOZaurr - Processing GPO Sysvol" - $GPOOrphans = Get-GPOZaurrSysvol + if ($Type -contains 'GPOOrphans' -or $null -eq $Type) { + Write-Verbose -Message "Show-GPOZaurr - Processing GPO Sysvol" + $GPOOrphans = Get-GPOZaurrSysvol + } Write-Verbose -Message "Show-GPOZaurr - Processing GPO Permissions" $GPOPermissions = Get-GPOZaurrPermission -Type All -IncludePermissionType GpoEditDeleteModifySecurity, GpoEdit, GpoCustom -IncludeOwner @@ -22,12 +30,14 @@ Write-Verbose "Show-GPOZaurr - Processing GPO Owners" $GPOOwners = Get-GPOZaurrOwner -IncludeSysvol + if ($Type -contains 'NetLogon' -or $null -eq $Type) { + Write-Verbose "Get-GPOZaurrNetLogon - Processing NETLOGON Share" + $Netlogon = Get-GPOZaurrNetlogon + } Write-Verbose "Show-GPOZaurr - Processing GPO Analysis" $GPOContent = Invoke-GPOZaurr - $GPOLinked = $GPOSummary.Where( { $_.Linked -eq $true }, 'split') - $GPOEmpty = $GPOSummary.Where( { $_.Empty -eq $true, 'split' }) - $GPOTotal = $GPOSummary.Count + $IsOwnerConsistent = $GPOOwners.Where( { $_.IsOwnerConsistent -eq $true } , 'split' ) $IsOwnerAdministrative = $GPOOwners.Where( { $_.IsOwnerAdministrative -eq $true } , 'split' ) @@ -46,10 +56,6 @@ New-HTMLChart -Title 'Group Policies Summary' { New-ChartLegend -Names 'Unlinked', 'Linked', 'Empty', 'Total' -Color Salmon, PaleGreen, PaleVioletRed, PaleTurquoise New-ChartBar -Name 'Group Policies' -Value $GPOLinked[1].Count, $GPOLinked[0].Count, $GPOEmpty[1].Count, $GPOTotal - - #New-ChartBar -Name 'Linked' -Value $GPOLinked[0].Count - #New-ChartBar -Name 'Empty' -Value $GPOEmpty[1].Count - #New-ChartBar -Name 'Total' -Value $GPOTotal } -TitleAlignment center } New-HTMLPanel { @@ -77,14 +83,23 @@ } } } - New-HTMLTab -Name 'Group Policies Summary' { - New-HTMLTable -DataTable $GPOSummary -Filtering { - New-HTMLTableCondition -Name 'Empty' -Value $false -BackgroundColor Salmon -TextTransform capitalize -ComparisonType bool - New-HTMLTableCondition -Name 'Linked' -Value $false -BackgroundColor Salmon -TextTransform capitalize -ComparisonType bool + if ($Type -contains 'GPOList' -or $null -eq $Type) { + New-HTMLTab -Name 'Group Policies Summary' { + New-HTMLTable -DataTable $GPOSummary -Filtering { + New-HTMLTableCondition -Name 'Empty' -Value $false -BackgroundColor Salmon -TextTransform capitalize -ComparisonType bool + New-HTMLTableCondition -Name 'Linked' -Value $false -BackgroundColor Salmon -TextTransform capitalize -ComparisonType bool + } } } - New-HTMLTab -Name 'Sysvol' { - New-HTMLTable -DataTable $GPOOrphans -Filtering + if ($Type -contains 'GPOOrphans' -or $null -eq $Type) { + New-HTMLTab -Name 'Sysvol' { + New-HTMLTable -DataTable $GPOOrphans -Filtering + } + } + if ($Type -contains 'NetLogon' -or $null -eq $Type) { + New-HTMLTab -Name 'NetLogon' { + New-HTMLTable -DataTable $Netlogon -Filtering + } } New-HTMLTab -Name 'Permissions' { New-HTMLTab -Name 'Root' { diff --git a/README.md b/README.md index 598338b..ee44365 100644 --- a/README.md +++ b/README.md @@ -53,6 +53,7 @@ That's it. Whenever there's a new version, you run the command, and you can enjo - Renamed `Invoke-GPOZaurrContent` back to `Invoke-GPOZaurr` - Added `Show-GPOZaurr` (WIP) - Added `OutputType`,`OutputType`,`Open`,`Online` parameters to `Invoke-GPOZaurr` + - Added `Get-GPOZaurrNetLogon` - Improved `Get-GPOZaurrOwner` - 0.0.62 - 14.10.2020 - Renamed `Invoke-GPOZaurr` to `Invoke-GPOZaurrContent` - I want to use `Invoke-GPOZaurr` for something else