diff --git a/Private/ConvertTo-XMLLithnetFilter.ps1 b/Private/ConvertTo-XMLLithnetFilter.ps1 new file mode 100644 index 0000000..948a8ca --- /dev/null +++ b/Private/ConvertTo-XMLLithnetFilter.ps1 @@ -0,0 +1,119 @@ +function ConvertTo-XMLLithnetFilter { + [cmdletBinding()] + param( + [PSCustomObject] $GPO, + [switch] $SingleObject + ) + + $CreateGPO = [ordered]@{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.GUID + GpoType = $GPO.GpoType + #GpoCategory = $GPOEntry.GpoCategory + #GpoSettings = $GPOEntry.GpoSettings + + DisablePasswordFilter = 'Not set' # : Disabled + EnableLengthBasedComplexityRules = $null # : Enabled + EnableLengthBasedComplexityRulesApplyTheFollowingRequirementsForPasswordsWithALengthLessThan = $null # : 9 + EnableLengthBasedComplexityRulesTotalNumberOfCharacterSetsRequiredNumberSymbolUppercaseLetterLowercaseLetter = $null # : 4 + EnableLengthBasedComplexityRulesApplyTheFollowingRequirementsForPasswordsLongerThanTheFirstThresholdButWithALengthLessThan = $null # : 15 + EnableLengthBasedComplexityRulesTotalNumberOfCharacterSetsRequiredNumberSymbolUppercaseLetterLowercaseLetter2 = $null # : 4 + EnableLengthBasedComplexityRulesTotalNumberOfCharacterSetsRequiredNumberSymbolUppercaseLetterLowercaseLetter3 = $null # : 4 + EnableLengthBasedComplexityRulesThresholdLevel1 = $null # : + EnableLengthBasedComplexityRulesAlternativelySpecifyTheExactCharacterSetsRequired = $null # : + EnableLengthBasedComplexityRulesThresholdLevel2 = $null # : + EnableLengthBasedComplexityRulesAlternativelySpecifyTheExactCharacterSetsRequired2 = $null # : + EnableLengthBasedComplexityRulesThresholdLevel3 = $null # : + EnableLengthBasedComplexityRulesForPasswordsLongerThanTheSecondThresholdApplyTheFollowingRequirements = $null # : + EnableLengthBasedComplexityRulesAlternativelySpecifyTheExactCharacterSetsRequired3 = $null # : + EnableLengthBasedComplexityRulesLowerCaseLetter = 'Disabled' # : + EnableLengthBasedComplexityRulesUpperCaseLetter = 'Disabled' # : + EnableLengthBasedComplexityRulesSymbol = 'Disabled' # : + EnableLengthBasedComplexityRulesNumber = 'Disabled' # : + EnableLengthBasedComplexityRulesNumberOrSymbol = 'Disabled' # : + EnableLengthBasedComplexityRulesLowerCaseLetter2 = 'Disabled' # : + EnableLengthBasedComplexityRulesUpperCaseLetter2 = 'Disabled' # : + EnableLengthBasedComplexityRulesSymbol2 = 'Disabled' # : + EnableLengthBasedComplexityRulesNumber2 = 'Disabled' # : + EnableLengthBasedComplexityRulesNumberOrSymbol2 = 'Disabled' # : + EnableLengthBasedComplexityRulesLowerCaseLetter3 = 'Disabled' # : + EnableLengthBasedComplexityRulesUpperCaseLetter3 = 'Disabled' # : + EnableLengthBasedComplexityRulesSymbol3 = 'Disabled' # : + EnableLengthBasedComplexityRulesNumber3 = 'Disabled' # : + EnableLengthBasedComplexityRulesNumberOrSymbol3 = 'Disabled' # : + MinimumPasswordLength = $null # : Enabled + MinimumPasswordLengthMinimumPasswordLength = $null # : 8 + PasswordsMustMatchASpecifiedRegularExpression = $null # : Enabled + PasswordsMustMatchASpecifiedRegularExpressionRegularExpression = $null # : sdf + PasswordsMustMeetSpecifiedNumberOfComplexityPoints = $null # : Enabled + PasswordsMustMeetSpecifiedNumberOfComplexityPointsMinimumNumberOfPointsRequiredForPasswordToBeApproved = $null # : 13 + PasswordsMustMeetSpecifiedNumberOfComplexityPointsPointsForEachCharacterUsed = $null # : 1 + PasswordsMustMeetSpecifiedNumberOfComplexityPointsPointsForEachNumberUsed = $null # : 0 + PasswordsMustMeetSpecifiedNumberOfComplexityPointsPointsForEachLowerCaseLetterUsed = $null # : 0 + PasswordsMustMeetSpecifiedNumberOfComplexityPointsPointsForEachUpperCaseLetterUsed = $null # : 0 + PasswordsMustMeetSpecifiedNumberOfComplexityPointsPointsPerSymbolUsed = $null # : 0 + PasswordsMustMeetSpecifiedNumberOfComplexityPointsPointsForTheUseOfAtLeastOneNumber = $null # : 1 + PasswordsMustMeetSpecifiedNumberOfComplexityPointsPointsForTheUseOfAtLeastOneSymbol = $null # : 2 + PasswordsMustMeetSpecifiedNumberOfComplexityPointsPointsForTheUseOfAtLeastOneUppercaseLetter = $null # : 1 + PasswordsMustMeetSpecifiedNumberOfComplexityPointsPointsForTheUseOfAtLeastOneLowercaseLetter = $null # : 0 + PasswordsMustNotMatchASpecifiedRegularExpression = $null # : Enabled + PasswordsMustNotMatchASpecifiedRegularExpressionRegularExpression = $null # : df + RejectNormalizedPasswordsFoundInTheBannedWordStore = $null # : Enabled + RejectNormalizedPasswordsFoundInTheBannedWordStoreEnableForPasswordSetOperations = $null # : + RejectNormalizedPasswordsFoundInTheBannedWordStoreEnableForPasswordChangeOperations = $null # : + RejectNormalizedPasswordsFoundInTheCompromisedPasswordStore = $null # : Enabled + RejectNormalizedPasswordsFoundInTheCompromisedPasswordStoreEnableForPasswordSetOperations = $null # : + RejectNormalizedPasswordsFoundInTheCompromisedPasswordStoreEnableForPasswordChangeOperations = $null # : + RejectPasswordsFoundInTheCompromisedPasswordStore = $null # : Enabled + RejectPasswordsFoundInTheCompromisedPasswordStoreEnableForPasswordSetOperations = $null # : + RejectPasswordsFoundInTheCompromisedPasswordStoreEnableForPasswordChangeOperations = $null # : + RejectPasswordsThatContainTheUsersAccountName = $null # : Enabled + RejectPasswordsThatContainTheUsersDisplayName = $null # : Enabled + } + $UsedNames = [System.Collections.Generic.List[string]]::new() + if ($GPO.DataSet.Category -like 'Lithnet/Password Protection for Active Directory*') { + foreach ($Policy in $GPO.DataSet) { + $Name = (Format-ToTitleCase -Text $Policy.Name -RemoveWhiteSpace) -replace ',' -replace '-' -replace "'" + $CreateGPO[$Name] = $Policy.State + + foreach ($Setting in @('DropDownList', 'Numeric', 'EditText', 'Text', 'CheckBox')) { + if ($Policy.$Setting) { + foreach ($Value in $Policy.$Setting) { + if ($Value.Name) { + $SubName = (Format-ToTitleCase -Text $Value.Name -RemoveWhiteSpace) -replace ',' -replace '-' -replace "'" -replace '\(' -replace '\)' + $SubName = -join ($Name, $SubName) + if ($SubName -notin $UsedNames) { + $UsedNames.Add($SubName) + } else { + $TimesUsed = $UsedNames | Group-Object | Where-Object { $_.Name -eq $SubName } + $NumberToUse = $TimesUsed.Count + 1 + # We add same name 2nd and 3rd time to make sure we count properly + $UsedNames.Add($SubName) + # We now build property name based on amnount of times + $SubName = -join ($SubName, "$NumberToUse") + } + if ($Value.Value -is [string]) { + if ($null -eq $Value.Value -and $CreateGPO["$SubName"]) { + # if value is empty and we already have set value (such as Disabled) - we do nothing + } else { + $CreateGPO["$SubName"] = $Value.Value + } + } else { + if ($null -eq $Value.Value.Name -and $CreateGPO["$SubName"]) { + # if value is empty and we already have set value (such as Disabled) - we do nothing + } else { + $CreateGPO["$SubName"] = $Value.Value.Name + } + } + } + } + } + } + } + $CreateGPO['Linked'] = $GPO.Linked + $CreateGPO['LinksCount'] = $GPO.LinksCount + $CreateGPO['Links'] = $GPO.Links + [PSCustomObject] $CreateGPO + } +} \ No newline at end of file diff --git a/Private/Script.GPODictionary.ps1 b/Private/Script.GPODictionary.ps1 index 009d0e8..be67872 100644 --- a/Private/Script.GPODictionary.ps1 +++ b/Private/Script.GPODictionary.ps1 @@ -134,6 +134,20 @@ ConvertTo-XMLLocalGroups -GPO $GPO -SingleObject } } + LithnetFilter = @{ + Types = @( + @{ + Category = 'RegistrySettings' + Settings = 'Policy' + } + ) + Code = { + ConvertTo-XMLLithnetFilter -GPO $GPO + } + CodeSingle = { + ConvertTo-XMLLithnetFilter -GPO $GPO + } + } Policies = @{ Types = @( @{