gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-12 03:36:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-10-22 09:16:07 +02:00
parent 72ecf97497
commit 928d66eb9d
4 changed files with 28 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Public/Get-GPOZaurr.ps1
+18 -6
View File
@@ -29,9 +29,13 @@
if (-not $GPOPath) {
foreach ($Domain in $ForestInformation.Domains) {
$QueryServer = $ForestInformation.QueryServers[$Domain]['HostName'][0]
$Count = 0
if ($GPOName) {
Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
$GroupPolicies = Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue
$GroupPolicies | ForEach-Object {
$Count++
#Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
Write-Verbose "Get-GPOZaurr - Processing [$($_.DomainName)]($Count/$($GroupPolicies.Count)) $($_.DisplayName)"
if (-not $Limited) {
try {
$XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
@@ -45,8 +49,11 @@
}
}
} elseif ($GPOGuid) {
Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
$GroupPolicies = Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue
$GroupPolicies | ForEach-Object {
$Count++
#Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
Write-Verbose "Get-GPOZaurr - Processing [$($_.DomainName)]($Count/$($GroupPolicies.Count)) $($_.DisplayName)"
if (-not $Limited) {
try {
$XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
@@ -60,8 +67,11 @@
}
}
} else {
Get-GPO -All -Server $QueryServer -Domain $Domain -ErrorAction SilentlyContinue | ForEach-Object {
Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
$GroupPolicies = Get-GPO -All -Server $QueryServer -Domain $Domain -ErrorAction SilentlyContinue
$GroupPolicies | ForEach-Object {
$Count++
#Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
Write-Verbose "Get-GPOZaurr - Processing [$($_.DomainName)]($Count/$($GroupPolicies.Count)) $($_.DisplayName)"
if (-not $Limited) {
try {
$XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
@@ -78,11 +88,13 @@
}
} else {
foreach ($Path in $GPOPath) {
Write-Verbose "Get-GPOZaurr - Getting GPO content from XML files"
Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml | ForEach-Object {
$XMLContent = [XML]::new()
$XMLContent.Load($_.FullName)
Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent
}
Write-Verbose "Get-GPOZaurr - Finished GPO content from XML files"
}
}
}
Public/Get-GPOZaurrPermissionConsistency.ps1
+6 -2
View File
@@ -39,7 +39,11 @@
ErrorAction = 'SilentlyContinue'
}
}
Get-GPO @getGPOSplat | ForEach-Object -Process {
$GroupPolicies = Get-GPO @getGPOSplat
$Count = 0
$GroupPolicies | ForEach-Object -Process {
$Count++
Write-Verbose "Get-GPOZaurrPermissionConsistency - Processing [$($_.DomainName)]($Count/$($GroupPolicies.Count)) $($_.DisplayName)"
try {
$IsConsistent = $_.IsAclConsistent()
$ErrorMessage = ''
@@ -50,7 +54,7 @@
}
$SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
if ($VerifyInheritance) {
$FolderPermissions = Get-WinADSharePermission -Path $SysVolpath
$FolderPermissions = Get-WinADSharePermission -Path $SysVolpath -Verbose:$false
if ($FolderPermissions) {
[Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) {
if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) {
Public/Get-GPOZaurrPermissionRoot.ps1
-38
View File
@@ -56,44 +56,6 @@
DomainName = $Domain
}
}
<#
if ($Permission.ActiveDirectoryRights | ForEach-Object {
$_
}) {
[PSCustomObject] @{
PrincipalName = $Permission.Principal
Permission = 'GpoCustomOwner'
PermissionType = $Permission.AccessControlType
PrincipalSidType = $Permission.PrincipalType
PrincipalObjectClass = $Permission.PrincipalObjectType
PrincipalDomainName = $Permission.PrincipalObjectDomain
PrincipalSid = $Permission.PrincipalObjectSid
GPOCount = 'N/A'
GPONames = -join ("All-", $Domain.ToUpper())
DomainName = $Domain
}
}
if ($Permission.ActiveDirectoryRights | ForEach-Object {
$_ -in 'CreateChild', 'GenericAll'
}) {
[PSCustomObject] @{
PrincipalName = $Permission.Principal
Permission = 'GpoCustomCreate'
PermissionType = $Permission.AccessControlType
PrincipalSidType = $Permission.PrincipalType
PrincipalObjectClass = $Permission.PrincipalObjectType
PrincipalDomainName = $Permission.PrincipalObjectDomain
PrincipalSid = $Permission.PrincipalObjectSid
GPOCount = 'N/A'
GPONames = -join ("All-", $Domain.ToUpper())
DomainName = $Domain
}
}
#>
}
}
}
Public/Show-GPOZaurr.ps1
+4 -1
View File
@@ -8,6 +8,7 @@
)][string[]] $Type
)
if ($Type -contains 'GPOList' -or $null -eq $Type) {
#Write-Color -Text "[Info] ", "Processing GPO List" -Color Yellow, White
Write-Verbose -Message "Show-GPOZaurr - Processing GPO List"
$GPOSummary = Get-GPOZaurr
$GPOLinked = $GPOSummary.Where( { $_.Linked -eq $true }, 'split')
@@ -15,6 +16,7 @@
$GPOTotal = $GPOSummary.Count
}
if ($Type -contains 'GPOOrphans' -or $null -eq $Type) {
#Write-Color -Text "[Info] ", "Processing GPOOrphans" -Color Yellow, White
Write-Verbose -Message "Show-GPOZaurr - Processing GPO Sysvol"
$GPOOrphans = Get-GPOZaurrBroken
@@ -32,6 +34,7 @@
}
}
if ($Type -contains 'GPOPermissions' -or $null -eq $Type) {
#Write-Color -Text "[Info] ", "Processing GPOPermissions" -Color Yellow, White
Write-Verbose -Message "Show-GPOZaurr - Processing GPO Permissions"
$GPOPermissions = Get-GPOZaurrPermission -Type All -IncludePermissionType GpoEditDeleteModifySecurity, GpoEdit, GpoCustom -IncludeOwner
}
@@ -41,7 +44,7 @@
[Array] $Inconsistent = $GPOPermissionsConsistency.Where( { $_.ACLConsistent -eq $true } , 'split' )
[Array] $InconsistentInside = $GPOPermissionsConsistency.Where( { $_.ACLConsistentInside -eq $true }, 'split' )
}
if ($Type -contains 'GPOConsistency' -or $null -eq $Type) {
if ($Type -contains 'GPOPermissionsRoot' -or $null -eq $Type) {
Write-Verbose -Message "Show-GPOZaurr - Processing GPO Permissions Root"
$GPOPermissionsRoot = Get-GPOZaurrPermissionRoot
}