From 99cf500817e9d9d8356b7d777fea1b5025d967c6 Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Sun, 7 Jun 2020 21:48:41 +0200 Subject: [PATCH] Updates --- Examples/Example-14-ListingGPOsPerOU4.ps1 | 3 ++ Examples/Example-16-KeepPermissions.ps1 | 2 -- Examples/Example-16-KeepPermissions02.ps1 | 43 +++++++++++++++++++++++ Public/Add-GPOZaurrPermission.ps1 | 7 ++++ Public/Get-GPOZaurrLink.ps1 | 4 ++- Public/Invoke-GPOZaurrPermission.ps1 | 31 +++++++++------- 6 files changed, 74 insertions(+), 16 deletions(-) create mode 100644 Examples/Example-14-ListingGPOsPerOU4.ps1 create mode 100644 Examples/Example-16-KeepPermissions02.ps1 diff --git a/Examples/Example-14-ListingGPOsPerOU4.ps1 b/Examples/Example-14-ListingGPOsPerOU4.ps1 new file mode 100644 index 0000000..a0166ed --- /dev/null +++ b/Examples/Example-14-ListingGPOsPerOU4.ps1 @@ -0,0 +1,3 @@ +Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force + +Get-GPOZaurrLink -Linked 'Root' -IncludeDomains 'ad.evotec.pl' | ft \ No newline at end of file diff --git a/Examples/Example-16-KeepPermissions.ps1 b/Examples/Example-16-KeepPermissions.ps1 index 5c5198b..8ca6d49 100644 --- a/Examples/Example-16-KeepPermissions.ps1 +++ b/Examples/Example-16-KeepPermissions.ps1 @@ -1,6 +1,4 @@ Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force -Import-Module 'C:\Support\GitHub\PSSharedGoods\PSSharedGoods.psd1' -Force - # Apply permissions for ROOT Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.xyz' { diff --git a/Examples/Example-16-KeepPermissions02.ps1 b/Examples/Example-16-KeepPermissions02.ps1 new file mode 100644 index 0000000..d01a11f --- /dev/null +++ b/Examples/Example-16-KeepPermissions02.ps1 @@ -0,0 +1,43 @@ +Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force + +# Apply permissions for ROOT +Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.pl' { + Set-GPOOwner -Type Administrative + Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow + Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow + Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow +} -WhatIf + + +# Apply perrmissions for Domain Controllers +Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' { + Set-GPOOwner -Type Administrative + Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow + Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow + Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow +} -WhatIf + +# Apply permissions for Regions, with exclusions for those 4 groups +$Exclude = @( + 'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz' +) + +Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' { + Set-GPOOwner -Type Administrative + Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName + Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow + Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow +} #-WhatIf + +$Exclude = @( + 'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz' + #'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz' + #'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz' +) + +Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' { + Set-GPOOwner -Type Administrative + Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName + Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow + Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow +} #-WhatIf diff --git a/Public/Add-GPOZaurrPermission.ps1 b/Public/Add-GPOZaurrPermission.ps1 index 9727c3a..cbfa4da 100644 --- a/Public/Add-GPOZaurrPermission.ps1 +++ b/Public/Add-GPOZaurrPermission.ps1 @@ -79,6 +79,12 @@ # We are looking for administrative but we need to make sure we got correct administrative if ($GPOPermission.Permission -eq $PermissionType) { $AdministrativeGroup = $ADAdministrativeGroups['BySID'][$GPOPermission.SID] + if ($AdministrativeGroup.SID -like '*-519') { + $AdministrativeExists['EnterpriseAdmins'] = $true + } elseif ($AdministrativeGroup.SID -like '*-512') { + $AdministrativeExists['DomainAdmins'] = $true + } + <# if ($AdministrativeGroup) { $DomainAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-512') $EnterpriseAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-519') @@ -88,6 +94,7 @@ $AdministrativeExists['EnterpriseAdmins'] = $true } } + #> } } elseif ($Type -eq 'WellKnownAdministrative') { # this is for SYSTEM account diff --git a/Public/Get-GPOZaurrLink.ps1 b/Public/Get-GPOZaurrLink.ps1 index c098c9c..d21d5fb 100644 --- a/Public/Get-GPOZaurrLink.ps1 +++ b/Public/Get-GPOZaurrLink.ps1 @@ -43,7 +43,9 @@ $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation if (-not $GPOCache -and -not $Limited) { $GPOCache = @{ } - foreach ($Domain in $ForestInformation.Domains) { + # While initially we used $ForestInformation.Domains but the thing is GPOs can be linked to other domains so we need to get them all so we can use cache of it later on even if we're processing just one domain + # That's why we use $ForestInformation.Forest.Domains instead + foreach ($Domain in $ForestInformation.Forest.Domains) { $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0] Get-GPO -All -DomainName $Domain -Server $QueryServer | ForEach-Object { $GPOCache["$Domain$($_.ID.Guid)"] = $_ diff --git a/Public/Invoke-GPOZaurrPermission.ps1 b/Public/Invoke-GPOZaurrPermission.ps1 index 0a01340..6f990e2 100644 --- a/Public/Invoke-GPOZaurrPermission.ps1 +++ b/Public/Invoke-GPOZaurrPermission.ps1 @@ -99,7 +99,7 @@ return } $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation - $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation + $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation $Splat = @{ Forest = $Forest @@ -132,7 +132,12 @@ foreach ($Rule in $Rules) { if ($Rule.Action -eq 'Owner') { if ($Rule.Type -eq 'Administrative') { - $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"] + # We check for Owner (sometimes it can be empty) + if ($GPO.Owner) { + $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"] + } else { + $AdministrativeGroup = $null + } if (-not $AdministrativeGroup) { $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal" @@ -150,19 +155,19 @@ Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission } } elseif ($Rule.Action -eq 'Add') { - + # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain $SplatPermissions = @{ - Forest = $Forest - IncludeDomains = $IncludeDomains - ExcludeDomains = $ExcludeDomains - ExtendedForestInformation = $ForestInformation + #Forest = $Forest + IncludeDomains = $GPO.DomainName + #ExcludeDomains = $ExcludeDomains + #ExtendedForestInformation = $ForestInformation - GPOGuid = $GPO.GUID - IncludePermissionType = $Rule.IncludePermissionType - Type = $Rule.Type - PermitType = $Rule.PermitType - Principal = $Rule.Principal - ADAdministrativeGroups = $ADAdministrativeGroups + GPOGuid = $GPO.GUID + IncludePermissionType = $Rule.IncludePermissionType + Type = $Rule.Type + PermitType = $Rule.PermitType + Principal = $Rule.Principal + ADAdministrativeGroups = $ADAdministrativeGroups } if ($Rule.PrincipalType) { $SplatPermissions.PrincipalType = $Rule.PrincipalType