diff --git a/Examples/Example-08-ListingPermissions.ps1 b/Examples/Example-08-ListingPermissions.ps1 index e5f853e..1ad946c 100644 --- a/Examples/Example-08-ListingPermissions.ps1 +++ b/Examples/Example-08-ListingPermissions.ps1 @@ -1,7 +1,7 @@ Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force -$T = Get-GPOZaurrPermission -GPOName 'DC | PowerShell Logging' -Type Unknown +#$T = Get-GPOZaurrPermission -GPOName 'DC | PowerShell Logging' -Type Unknown -#$T = Get-GPOZaurrPermission #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView +$T = Get-GPOZaurrPermission -ExcludePermissionType GpoRead,GpoApply #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView $T | Format-Table -AutoSize * #$T | Out-HtmlView -ScrollX -Filtering -Online -DisablePaging \ No newline at end of file diff --git a/Examples/Example-13-ListingOwners.ps1 b/Examples/Example-13-ListingOwners.ps1 new file mode 100644 index 0000000..8816665 --- /dev/null +++ b/Examples/Example-13-ListingOwners.ps1 @@ -0,0 +1,4 @@ +Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force + +$Owners = Get-GPOZaurr -owneronly +$Owners | Format-Table \ No newline at end of file diff --git a/GPOZaurr.psd1 b/GPOZaurr.psd1 index e718b00..ffaa9b5 100644 --- a/GPOZaurr.psd1 +++ b/GPOZaurr.psd1 @@ -5,9 +5,9 @@ CompatiblePSEditions = 'Desktop' Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.' Description = 'Group Policy Eater' - FunctionsToExport = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOZaurrOwner', 'Set-GPOZaurrWMI' + FunctionsToExport = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOZaurrOwner' GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde' - ModuleVersion = '0.0.12' + ModuleVersion = '0.0.14' PowerShellVersion = '5.1' PrivateData = @{ PSData = @{ @@ -17,11 +17,11 @@ } } RequiredModules = @{ - ModuleVersion = '0.0.134' + ModuleVersion = '0.0.135' ModuleName = 'PSSharedGoods' Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe' }, @{ - ModuleVersion = '0.0.47' + ModuleVersion = '0.0.48' ModuleName = 'ADEssentials' Guid = '9fc9fd61-7f11-4f4b-a527-084086f1905f' }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility' diff --git a/Private/Get-XMLGPO.ps1 b/Private/Get-XMLGPO.ps1 index 718a260..0c74ca9 100644 --- a/Private/Get-XMLGPO.ps1 +++ b/Private/Get-XMLGPO.ps1 @@ -3,7 +3,9 @@ param( [XML] $XMLContent, [Microsoft.GroupPolicy.Gpo] $GPO, - [switch] $PermissionsOnly + [switch] $PermissionsOnly, + [switch] $OwnerOnly, + [System.Collections.IDictionary] $ADAdministrativeGroups ) if ($XMLContent.GPO.LinksTo) { $Linked = $true @@ -34,7 +36,21 @@ } elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) { $Enabled = 'User configuration settings disabled' } - + if (-not $PermissionsOnly) { + if ($XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text') { + $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text')"] + $WellKnown = ConvertFrom-SID -SID $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text' -OnlyWellKnown + if ($AdministrativeGroup) { + $OwnerType = 'Administrative' + } elseif ($WellKnown.Name) { + $OwnerType = 'WellKnown' + } else { + $OwnerType = 'NonAdministrative' + } + } else { + $OwnerType = 'EmptyOrUnknown' + } + } if ($PermissionsOnly) { [PsCustomObject] @{ 'DisplayName' = $XMLContent.GPO.Name @@ -64,6 +80,16 @@ } } } + } elseif ($OwnerOnly) { + [PsCustomObject] @{ + 'DisplayName' = $XMLContent.GPO.Name + 'DomainName' = $XMLContent.GPO.Identifier.Domain.'#text' + 'GUID' = $XMLContent.GPO.Identifier.Identifier.InnerText + 'Enabled' = $Enabled + 'Owner' = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text' + 'OwnerSID' = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text' + 'OwnerType' = $OwnerType + } } else { [PsCustomObject] @{ 'DisplayName' = $XMLContent.GPO.Name @@ -93,6 +119,7 @@ 'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' } 'Owner' = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text' 'OwnerSID' = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text' + 'OwnerType' = $OwnerType 'ACL' = @( [PsCustomObject] @{ 'Name' = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text' diff --git a/Public/Get-GPOZaurr.ps1 b/Public/Get-GPOZaurr.ps1 index ab277ad..4639fb9 100644 --- a/Public/Get-GPOZaurr.ps1 +++ b/Public/Get-GPOZaurr.ps1 @@ -11,9 +11,11 @@ [string[]] $GPOPath, [switch] $PermissionsOnly, + [switch] $OwnerOnly, [switch] $Limited ) Begin { + $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation if (-not $GPOPath) { $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation } @@ -27,7 +29,7 @@ Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain" if (-not $Limited) { $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain - Get-XMLGPO -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent + Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups } else { $_ } @@ -37,7 +39,7 @@ Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain" if (-not $Limited) { $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain - Get-XMLGPO -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent + Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups } else { $_ } @@ -47,7 +49,7 @@ Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain" if (-not $Limited) { $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain - Get-XMLGPO -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent + Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups } else { $_ } @@ -59,7 +61,7 @@ Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml | ForEach-Object { $XMLContent = [XML]::new() $XMLContent.Load($_.FullName) - Get-XMLGPO -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent + Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent } } } diff --git a/Public/Set-GPOZaurrWMI.ps1 b/Public/Set-GPOZaurrWMI.ps1 deleted file mode 100644 index 740a6be..0000000 --- a/Public/Set-GPOZaurrWMI.ps1 +++ /dev/null @@ -1,6 +0,0 @@ -function Set-GPOZaurrWMI { - [cmdletBinding()] - param( - - ) -} \ No newline at end of file