gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-12 03:36:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-11-06 10:35:11 +01:00
parent 0c8e23f6af
commit 7ce5027abd
4 changed files with 32 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/Export-GPOZaurr.ps1
+1
View File
@@ -9,6 +9,7 @@
$Output[$T] = [ordered]@{
Action = $Script:GPOConfiguration[$T].Action
Data = $Script:GPOConfiguration[$T].Data
Name = $Script:GPOConfiguration[$T].Name
Summary = $Script:GPOConfiguration[$T].Summary
Variables = $Script:GPOConfiguration[$T].Variables
}
Private/Invoke.GPOZaurrConsistency.ps1
+24 -12
View File
@@ -17,6 +17,11 @@
$GPOZaurrConsistency['Variables']['InconsistentInside']++
}
}
if ($GPOZaurrConsistency['Variables']['Inconsistent'].Count -gt 0 -or $GPOZaurrConsistency['Variables']['InconsistentInside'].Count -gt 0 ) {
$GPOZaurrConsistency['Action'] = $true
} else {
$GPOZaurrConsistency['Action'] = $false
}
}
Variables = @{
Consistent = 0
@@ -43,21 +48,28 @@
} -Title 'Permissions Consistency' -TitleAlignment center
}
}
Summary = {
New-HTMLText -FontSize 10pt -TextBlock {
"When GPO is created it creates an entry in Active Directory (metadata) and SYSVOL (content). "
"Two different places meens two different sets of permissions. Group Policy module is making sure the data in both places is correct. "
"However, for different reasons it's not nessecary the case and often permissions go out of sync between AD and SYSVOL. "
"This test verifies consistency of policies between AD and SYSVOL in two ways. "
"It checks top level permissions for a GPO, and then checks if all files within said GPO are inheriting permissions or have different permissions in place. "
}
New-HTMLText -Text 'Following list presents ', 'permissions consistency between Active Directory and SYSVOL for Group Policies' -FontSize 10pt -FontWeight normal, bold
New-HTMLList -Type Unordered {
New-HTMLListItem -Text 'Top level permissions consistency: ', $GPOZaurrConsistency['Variables']['Consistent'] -FontWeight normal, bold
New-HTMLListItem -Text 'Inherited permissions consistency: ', $GPOZaurrConsistency['Variables']['ConsistentInside'] -FontWeight normal, bold
New-HTMLListItem -Text 'Inconsistent top level permissions: ', $GPOZaurrConsistency['Variables']['Inconsistent'] -FontWeight normal, bold
New-HTMLListItem -Text "Inconsistent inherited permissions: ", $GPOZaurrConsistency['Variables']['InconsistentInside'] -FontWeight normal, bold
} -FontSize 10pt
New-HTMLText -FontSize 10pt -Text 'Having incosistent permissions on AD in comparison to those on SYSVOL can lead to uncontrolled ability to modify them. Please notice that if ', `
' Not available ', 'is visible in the table you should first fix related, more pressing issue, before fixing permissions inconsistency.' -FontWeight normal, bold, normal
}
Solution = {
New-HTMLSection -Invisible {
New-HTMLPanel {
New-HTMLText -FontSize 10pt -TextBlock {
"When GPO is created it creates an entry in Active Directory (metadata) "
}
New-HTMLText -Text 'Following table presents ', 'permissions consistency between Active Directory and SYSVOL for Group Policies' -FontSize 10pt -FontWeight normal, bold
New-HTMLList -Type Unordered {
New-HTMLListItem -Text 'Top level permissions consistency: ', $GPOZaurrConsistency['Variables']['Consistent'] -FontWeight normal, bold
New-HTMLListItem -Text 'Inherited permissions consistency: ', $GPOZaurrConsistency['Variables']['ConsistentInside'] -FontWeight normal, bold
New-HTMLListItem -Text 'Inconsistent top level permissions: ', $GPOZaurrConsistency['Variables']['Inconsistent'] -FontWeight normal, bold
New-HTMLListItem -Text "Inconsistent inherited permissions: ", $GPOZaurrConsistency['Variables']['InconsistentInside'] -FontWeight normal, bold
} -FontSize 10pt
New-HTMLText -FontSize 10pt -Text 'Having incosistent permissions on AD in comparison to those on SYSVOL can lead to uncontrolled ability to modify them. Please notice that if ', `
' Not available ', 'is visible in the table you should first fix related, more pressing issue, before fixing permissions inconsistency.' -FontWeight normal, bold, normal
& $GPOZaurrConsistency['Summary']
}
New-HTMLPanel {
New-HTMLChart {
Private/Invoke.GPOZaurrNetLogonPermissions.ps1
+5
View File
@@ -30,6 +30,11 @@
$GPOZaurrNetLogonPermissions['Variables']['NonOwner'].Add($File)
}
}
if ($GPOZaurrNetLogonPermissions['Variables']['NetLogonOwnersToFix'].Count -gt 0) {
$GPOZaurrNetLogonPermissions['Action'] = $true
} else {
$GPOZaurrNetLogonPermissions['Action'] = $false
}
}
Variables = @{
NetLogonOwners = 0
Public/Get-GPOZaurrPermissionConsistency.ps1
+2 -1
View File
@@ -44,6 +44,7 @@
$GroupPolicies = Get-GPO @getGPOSplat
$Count = 0
$GroupPolicies | ForEach-Object -Process {
$GPO = $_
$Count++
Write-Verbose "Get-GPOZaurrPermissionConsistency - Processing [$($_.DomainName)]($Count/$($GroupPolicies.Count)) $($_.DisplayName)"
try {
@@ -51,7 +52,7 @@
$ErrorMessage = ''
} catch {
$ErrorMessage = $_.Exception.Message
Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
Write-Warning "Get-GPOZaurrPermissionConsistency - Processing $($GPO.DisplayName) / $($GPO.DomainName) failed to get consistency with error: $($_.Exception.Message)."
$IsConsistent = 'Not available'
}
$SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')