Update

2026-08-09 02:09:28 +00:00 · 2020-08-09 22:37:28 +02:00
parent 2bca54fd06
commit 7aefc6047b
1 changed files with 95 additions and 0 deletions
@@ -0,0 +1,95 @@
+function ConvertFrom-XMLRSOP {
+    [cmdletBinding()]
+    param(
+        [System.Xml.XmlElement]$Content,
+        $ResultantSetPolicy,
+        [string] $ComputerName
+    )
+    $GPOPrimary = [ordered] @{
+        Summary            = $null
+        SummaryDetails     = $null
+        ResultantSetPolicy = $ResultantSetPolicy
+    }
+
+    $Object = [ordered] @{
+        ComputerName       = $ComputerName
+        ReadTime           = [DateTime] $Content.ReadTime
+        ComputerName1      = $Content.ComputerResults.Name
+        DomainName         = $Content.ComputerResults.Domain
+        OrganizationalUnit = $Content.ComputerResults.SOM
+        Site               = $Content.ComputerResults.Site
+        SlowLink           = if ($Content.ComputerResults.SlowLink -eq 'true') { $true } else { $false };
+    }
+
+    $GPOPrimary['Summary'] = $Object
+    [Array] $GPOPrimary['SecurityGroups'] = foreach ($Group in $Content.ComputerResults.SecurityGroup) {
+        [PSCustomObject] @{
+            Name = $Group.Name.'#Text'
+            SID  = $Group.SID.'#Text'
+        }
+    }
+    [Array] $GPOPrimary['GroupPolicies'] = foreach ($GPO in $Content.ComputerResults.GPO) {
+        [PSCustomObject] @{
+            Name             = $GPO.Name
+            #Path             = $GPO.Path
+            Identifier       = $GPO.Path.Identifier.'#text'
+            DomainName       = $GPO.Path.Domain.'#text'
+            VersionDirectory = $GPO.VersionDirectory
+            VersionSysvol    = $GPO.VersionSysvol
+            IsValid          = if ($GPO.IsValid -eq 'true') { $true } else { $false };
+            FilterAllowed    = if ($GPO.FilterAllowed -eq 'true') { $true } else { $false };
+            AccessDenied     = if ($GPO.AccessDenied -eq 'true') { $true } else { $false };
+            Link             = $GPO.Link
+        }
+    }
+
+    $GPOPrimary['SummaryDetails'] = [Ordered] @{
+        ActivityId                      = $Content.ComputerResults.EventsDetails.SinglePassEventsDetails.ActivityId                      # : {6400d0bf-ac88-4ee6-b2c2-ca2cbbab0695}
+        ProcessingTrigger               = $Content.ComputerResults.EventsDetails.SinglePassEventsDetails.ProcessingTrigger               # : Periodic
+        ProcessingAppMode               = $Content.ComputerResults.EventsDetails.SinglePassEventsDetails.ProcessingAppMode               # : Background
+        LinkSpeedInKbps                 = $Content.ComputerResults.EventsDetails.SinglePassEventsDetails.LinkSpeedInKbps                 # : 0
+        SlowLinkThresholdInKbps         = $Content.ComputerResults.EventsDetails.SinglePassEventsDetails.SlowLinkThresholdInKbps         # : 500
+        DomainControllerName            = $Content.ComputerResults.EventsDetails.SinglePassEventsDetails.DomainControllerName            # : AD1.ad.evotec.xyz
+        DomainControllerIPAddress       = $Content.ComputerResults.EventsDetails.SinglePassEventsDetails.DomainControllerIPAddress       # : 192.168.240.189
+        PolicyProcessingMode            = $Content.ComputerResults.EventsDetails.SinglePassEventsDetails.PolicyProcessingMode            # : None
+        PolicyElapsedTimeInMilliseconds = $Content.ComputerResults.EventsDetails.SinglePassEventsDetails.PolicyElapsedTimeInMilliseconds # : 1202
+        ErrorCount                      = $Content.ComputerResults.EventsDetails.SinglePassEventsDetails.ErrorCount                      # : 0
+        WarningCount                    = $Content.ComputerResults.EventsDetails.SinglePassEventsDetails.WarningCount                    # : 0
+    }
+
+    [Array] $GPOPrimary['ProcessingTime'] = foreach ($Details in $Content.ComputerResults.EventsDetails.SinglePassEventsDetails.ExtensionProcessingTime) {
+        [PSCustomObject] @{
+            ExtensionName             = $Details.ExtensionName
+            ExtensionGuid             = $Details.ExtensionGuid
+            ElapsedTimeInMilliseconds = $Details.ElapsedTimeInMilliseconds
+            ProcessedTimeStamp        = $Details.ProcessedTimeStamp
+        }
+    }
+    [Array] $GPOPrimary['Events'] = foreach ($Event in $Content.ComputerResults.EventsDetails.SinglePassEventsDetails.EventRecord) {
+        [xml] $EventDetails = $Event.EventXML
+        $EventInformation = [ordered] @{
+            Description   = $Event.EventDescription
+            Provider      = $EventDetails.Event.System.Provider.Name      # : Provider
+            ProviderGUID  = $EventDetails.Event.System.Provider.Guid
+            EventID       = $EventDetails.Event.System.EventID       # : 4006
+            Version       = $EventDetails.Event.System.Version       # : 1
+            Level         = $EventDetails.Event.System.Level         # : 4
+            Task          = $EventDetails.Event.System.Task          # : 0
+            Opcode        = $EventDetails.Event.System.Opcode        # : 1
+            Keywords      = $EventDetails.Event.System.Keywords      # : 0x4000000000000000
+            TimeCreated   = [DateTime] $EventDetails.Event.System.TimeCreated.SystemTime   # : TimeCreated, 2020-08-09T20:16:44.5668052Z
+            EventRecordID = $EventDetails.Event.System.EventRecordID # : 10641325
+            Correlation   = $EventDetails.Event.System.Correlation.ActivityID   # : Correlation
+            Execution     = -join ("ProcessID: ", $EventDetails.Event.System.Execution.ProcessID, " ThreadID: ", $EventDetails.Event.System.Execution.ThreadID)       # : Execution
+            Channel       = $EventDetails.Event.System.Channel       # : Microsoft-Windows-GroupPolicy / Operational
+            Computer      = $EventDetails.Event.System.Computer      # : AD1.ad.evotec.xyz
+            Security      = $EventDetails.Event.System.Security.UserID      # : Security
+        }
+        foreach ($Entry in $EventDetails.Event.EventData.Data) {
+            $EventInformation["$($Entry.Name)"] = $Entry.'#text'
+        }
+        [PSCustomObject] $EventInformation
+    }
+
+    $GPOPrimary
+}