From 9e34f4297c08f1e17adfdbe42928c74b526c982d Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Mon, 9 Nov 2020 09:45:04 +0100 Subject: [PATCH] Update --- Private/Invoke.GPOZaurrConsistency.ps1 | 3 +- .../Invoke.GPOZaurrNetLogonPermissions.ps1 | 37 +++++++++++-------- Private/Invoke.GPOZaurrOrphans.ps1 | 2 +- Public/Invoke-GPOZaurr.ps1 | 4 ++ README.md | 14 ++++++- 5 files changed, 39 insertions(+), 21 deletions(-) diff --git a/Private/Invoke.GPOZaurrConsistency.ps1 b/Private/Invoke.GPOZaurrConsistency.ps1 index 7bf9c67..df7f3ac 100644 --- a/Private/Invoke.GPOZaurrConsistency.ps1 +++ b/Private/Invoke.GPOZaurrConsistency.ps1 @@ -73,9 +73,8 @@ } New-HTMLPanel { New-HTMLChart { - # New-ChartLegend -Names 'Bad', 'Good' -Color PaleGreen, Salmon New-ChartBarOptions -Type barStacked - New-ChartLegend -Name 'Consistent', 'Inconsistent' + New-ChartLegend -Name 'Consistent', 'Inconsistent' -Color PaleGreen, Salmon New-ChartBar -Name 'TopLevel' -Value $Script:Reporting['GPOConsistency']['Variables']['Consistent'], $Script:Reporting['GPOConsistency']['Variables']['Inconsistent'] New-ChartBar -Name 'Inherited' -Value $Script:Reporting['GPOConsistency']['Variables']['ConsistentInside'], $Script:Reporting['GPOConsistency']['Variables']['InconsistentInside'] } -Title 'Permissions Consistency' -TitleAlignment center diff --git a/Private/Invoke.GPOZaurrNetLogonPermissions.ps1 b/Private/Invoke.GPOZaurrNetLogonPermissions.ps1 index 2e5fb7b..f4a887d 100644 --- a/Private/Invoke.GPOZaurrNetLogonPermissions.ps1 +++ b/Private/Invoke.GPOZaurrNetLogonPermissions.ps1 @@ -69,26 +69,31 @@ } } + Summary = { + New-HTMLText -TextBlock { + "NetLogon is crucial part of Active Directory. Files stored there are available on each and every computer or server in the company. " + "Keeping those files clean and secure is very important task. " + "It's important that NetLogon file owners are set to BUILTIN\Administrators (SID: S-1-5-32-544). " + "Owners have full control over the file object. Current owner of the file may be an Administrator but it doesn't guarentee that he/she will be in the future. " + "That's why as a best-practice it's recommended to change any non-administrative owners to BUILTIN\Administrators, and even Administrative accounts should be replaced with it. " + } -FontSize 10pt + New-HTMLList -Type Unordered { + New-HTMLListItem -Text 'NetLogon Files in Total: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwners'] -FontWeight normal, bold + New-HTMLListItem -Text 'NetLogon BUILTIN\Administrators as Owner: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrators'] -FontWeight normal, bold + New-HTMLListItem -Text "NetLogon Owners requiring change: ", $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'] -FontWeight normal, bold { + New-HTMLList -Type Unordered { + New-HTMLListItem -Text 'Not Administrative: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersNotAdministrative'] -FontWeight normal, bold + New-HTMLListItem -Text 'Administrative, but not BUILTIN\Administrators: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrativeNotAdministrators'] -FontWeight normal, bold + } + } + } -FontSize 10pt + New-HTMLText -Text "Follow the steps below table to get NetLogon Owners into compliant state." -FontSize 10pt + } Solution = { New-HTMLTab -Name 'NetLogon Owners' { New-HTMLSection -Invisible { New-HTMLPanel { - New-HTMLText -TextBlock { - "Following table shows NetLogon file owners. It's important that NetLogon file owners are set to BUILTIN\Administrators (SID: S-1-5-32-544). " - "Owners have full control over the file object. Current owner of the file may be an Administrator but it doesn't guarentee that he will be in the future. " - "That's why as a best-practice it's recommended to change any non-administrative owners to BUILTIN\Administrators, and even Administrative accounts should be replaced with it. " - } -FontSize 10pt - New-HTMLList -Type Unordered { - New-HTMLListItem -Text 'NetLogon Files in Total: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwners'] -FontWeight normal, bold - New-HTMLListItem -Text 'NetLogon BUILTIN\Administrators as Owner: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrators'] -FontWeight normal, bold - New-HTMLListItem -Text "NetLogon Owners requiring change: ", $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'] -FontWeight normal, bold { - New-HTMLList -Type Unordered { - New-HTMLListItem -Text 'Not Administrative: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersNotAdministrative'] -FontWeight normal, bold - New-HTMLListItem -Text 'Administrative, but not BUILTIN\Administrators: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrativeNotAdministrators'] -FontWeight normal, bold - } - } - } -FontSize 10pt - New-HTMLText -Text "Follow the steps below table to get NetLogon Owners into compliant state." -FontSize 10pt + & $Script:GPOConfiguration['NetLogonPermissions']['Summary'] } New-HTMLPanel { New-HTMLChart { diff --git a/Private/Invoke.GPOZaurrOrphans.ps1 b/Private/Invoke.GPOZaurrOrphans.ps1 index 13ca9d3..e239aa1 100644 --- a/Private/Invoke.GPOZaurrOrphans.ps1 +++ b/Private/Invoke.GPOZaurrOrphans.ps1 @@ -35,7 +35,7 @@ New-HTMLText -TextBlock { "Group Policies are stored in two places - Active Directory (metadata) and SYSVOL (content)." "Since those are managed in different ways, replicated in different ways it's possible because of different issues they get out of sync." - } + } -LineBreak New-HTMLText -Text "For example:" New-HTMLList -Type Unordered { New-HTMLListItem -Text 'USN Rollback in AD could cause group policies to reappar in Active Directory, yet SYSVOL data would be unavailable' diff --git a/Public/Invoke-GPOZaurr.ps1 b/Public/Invoke-GPOZaurr.ps1 index 6744419..249873b 100644 --- a/Public/Invoke-GPOZaurr.ps1 +++ b/Public/Invoke-GPOZaurr.ps1 @@ -51,6 +51,7 @@ Data = $null WarningsAndErrors = $null Time = $null + Summary = $null Variables = Copy-Dictionary -Dictionary $Script:GPOConfiguration[$T]['Variables'] } $TimeLogGPOList = Start-TimeLog @@ -75,6 +76,9 @@ } } ) + if ($Script:GPOConfiguration[$T]['Summary']) { + $Script:Reporting[$T]['Summary'] = Invoke-Command -ScriptBlock $Script:GPOConfiguration[$T]['Summary'] + } $TimeEndGPOList = Stop-TimeLog -Time $TimeLogGPOList -Option OneLiner $Script:Reporting[$T]['Time'] = $TimeEndGPOList Write-Color -Text '[i]', '[End ] ', $($Script:GPOConfiguration[$T]['Name']), " [Time to execute: $TimeEndGPOList]" -Color Yellow, DarkGray, Yellow, DarkGray diff --git a/README.md b/README.md index af86093..65d553e 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,15 @@ # GPOZaurr -## To install +## Table of Contents + +- [GPOZaurr](#gpozaurr) + - [Table of Contents](#table-of-contents) + - [Installing](#installing) + - [Updating](#updating) + - [Changelog](#changelog) + +## Installing GPOZaurr requires `RSAT` installed to provide results. If you don't have them you can install them as below. Keep in mind it also installs GUI tools so it shouldn't be installed on user workstations. @@ -37,7 +45,7 @@ Install-Module -Name GPOZaurr -AllowClobber -Force Force and AllowClobber aren't necessary, but they do skip errors in case some appear. -## And to update +## Updating ```powershell Update-Module -Name GPOZaurr @@ -49,6 +57,8 @@ That's it. Whenever there's a new version, you run the command, and you can enjo ## Changelog +- 0.0.77 - 9.11.2020 + - Improved `Invoke-GPOZaurr` (WIP) - 0.0.76 - 8.11.2020 - Improved `Get-GPOZaurrNetLogon` to better handle errors - 0.0.75 - 8.11.2020