gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-31 20:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-11-09 09:45:04 +01:00
parent 0da051a53b
commit 9e34f4297c
5 changed files with 39 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/Invoke.GPOZaurrConsistency.ps1
+1 -2
View File
@@ -73,9 +73,8 @@
}
New-HTMLPanel {
New-HTMLChart {
# New-ChartLegend -Names 'Bad', 'Good' -Color PaleGreen, Salmon
New-ChartBarOptions -Type barStacked
New-ChartLegend -Name 'Consistent', 'Inconsistent'
New-ChartLegend -Name 'Consistent', 'Inconsistent' -Color PaleGreen, Salmon
New-ChartBar -Name 'TopLevel' -Value $Script:Reporting['GPOConsistency']['Variables']['Consistent'], $Script:Reporting['GPOConsistency']['Variables']['Inconsistent']
New-ChartBar -Name 'Inherited' -Value $Script:Reporting['GPOConsistency']['Variables']['ConsistentInside'], $Script:Reporting['GPOConsistency']['Variables']['InconsistentInside']
} -Title 'Permissions Consistency' -TitleAlignment center
Private/Invoke.GPOZaurrNetLogonPermissions.ps1
+21 -16
View File
@@ -69,26 +69,31 @@
}
}
Summary = {
New-HTMLText -TextBlock {
"NetLogon is crucial part of Active Directory. Files stored there are available on each and every computer or server in the company. "
"Keeping those files clean and secure is very important task. "
"It's important that NetLogon file owners are set to BUILTIN\Administrators (SID: S-1-5-32-544). "
"Owners have full control over the file object. Current owner of the file may be an Administrator but it doesn't guarentee that he/she will be in the future. "
"That's why as a best-practice it's recommended to change any non-administrative owners to BUILTIN\Administrators, and even Administrative accounts should be replaced with it. "
} -FontSize 10pt
New-HTMLList -Type Unordered {
New-HTMLListItem -Text 'NetLogon Files in Total: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwners'] -FontWeight normal, bold
New-HTMLListItem -Text 'NetLogon BUILTIN\Administrators as Owner: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrators'] -FontWeight normal, bold
New-HTMLListItem -Text "NetLogon Owners requiring change: ", $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'] -FontWeight normal, bold {
New-HTMLList -Type Unordered {
New-HTMLListItem -Text 'Not Administrative: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersNotAdministrative'] -FontWeight normal, bold
New-HTMLListItem -Text 'Administrative, but not BUILTIN\Administrators: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrativeNotAdministrators'] -FontWeight normal, bold
}
}
} -FontSize 10pt
New-HTMLText -Text "Follow the steps below table to get NetLogon Owners into compliant state." -FontSize 10pt
}
Solution = {
New-HTMLTab -Name 'NetLogon Owners' {
New-HTMLSection -Invisible {
New-HTMLPanel {
New-HTMLText -TextBlock {
"Following table shows NetLogon file owners. It's important that NetLogon file owners are set to BUILTIN\Administrators (SID: S-1-5-32-544). "
"Owners have full control over the file object. Current owner of the file may be an Administrator but it doesn't guarentee that he will be in the future. "
"That's why as a best-practice it's recommended to change any non-administrative owners to BUILTIN\Administrators, and even Administrative accounts should be replaced with it. "
} -FontSize 10pt
New-HTMLList -Type Unordered {
New-HTMLListItem -Text 'NetLogon Files in Total: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwners'] -FontWeight normal, bold
New-HTMLListItem -Text 'NetLogon BUILTIN\Administrators as Owner: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrators'] -FontWeight normal, bold
New-HTMLListItem -Text "NetLogon Owners requiring change: ", $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'] -FontWeight normal, bold {
New-HTMLList -Type Unordered {
New-HTMLListItem -Text 'Not Administrative: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersNotAdministrative'] -FontWeight normal, bold
New-HTMLListItem -Text 'Administrative, but not BUILTIN\Administrators: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrativeNotAdministrators'] -FontWeight normal, bold
}
}
} -FontSize 10pt
New-HTMLText -Text "Follow the steps below table to get NetLogon Owners into compliant state." -FontSize 10pt
& $Script:GPOConfiguration['NetLogonPermissions']['Summary']
}
New-HTMLPanel {
New-HTMLChart {
Private/Invoke.GPOZaurrOrphans.ps1
+1 -1
View File
@@ -35,7 +35,7 @@
New-HTMLText -TextBlock {
"Group Policies are stored in two places - Active Directory (metadata) and SYSVOL (content)."
"Since those are managed in different ways, replicated in different ways it's possible because of different issues they get out of sync."
}
} -LineBreak
New-HTMLText -Text "For example:"
New-HTMLList -Type Unordered {
New-HTMLListItem -Text 'USN Rollback in AD could cause group policies to reappar in Active Directory, yet SYSVOL data would be unavailable'