gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-07-26 11:49:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-11-12 12:18:35 +01:00
parent f5b73918bb
commit a54f183ed3
3 changed files with 83 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Public/Set-GPOZaurrOwner.ps1
+41 -35
View File
@@ -76,7 +76,8 @@
[Parameter(ParameterSetName = 'Type')]
[Parameter(ParameterSetName = 'Named')]
[int] $LimitProcessing = [int32]::MaxValue
[int] $LimitProcessing = [int32]::MaxValue,
[switch] $Force
)
Begin {
#Write-Verbose "Set-GPOZaurrOwner - Getting ADAdministrativeGroups"
@@ -114,45 +115,50 @@
$AdministrativeGroupSysvol = $null
}
}
if ($Type -eq 'NotAdministrative') {
if (-not $AdministrativeGroup -or (-not $AdministrativeGroupSysvol -and -not $SkipSysvol)) {
$_
} else {
if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
$_
}
}
} elseif ($Type -eq 'Unknown') {
if (-not $_.Owner -or (-not $_.SysvolOwner -and -not $SkipSysvol)) {
$_
}
} elseif ($Type -eq 'NotMatching') {
if ($SkipSysvol) {
Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). SysVol scanning is disabled. Skipping."
} else {
if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
#Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
$_
}
}
if ($Force) {
Write-Verbose "Set-GPOZaurrOwner - Force was used to push new owner to $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner)."
$_
} else {
# we run with no type, that means we need to either set it to principal or to Administrative
if ($_.Owner) {
# we check if Principal is not set
$AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
if (-not $SkipSysvol -and $_.SysvolOwner) {
$AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"]
if (-not $AdministrativeGroup -or -not $AdministrativeGroupSysvol) {
if ($Type -eq 'NotAdministrative') {
if (-not $AdministrativeGroup -or (-not $AdministrativeGroupSysvol -and -not $SkipSysvol)) {
$_
} else {
if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
$_
}
}
} elseif ($Type -eq 'Unknown') {
if (-not $_.Owner -or (-not $_.SysvolOwner -and -not $SkipSysvol)) {
$_
}
} elseif ($Type -eq 'NotMatching') {
if ($SkipSysvol) {
Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). SysVol scanning is disabled. Skipping."
} else {
if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
#Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
$_
}
}
} else {
# we run with no type, that means we need to either set it to principal or to Administrative
if ($_.Owner) {
# we check if Principal is not set
$AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
if (-not $SkipSysvol -and $_.SysvolOwner) {
$AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"]
if (-not $AdministrativeGroup -or -not $AdministrativeGroupSysvol) {
$_
}
} else {
if (-not $AdministrativeGroup) {
$_
}
}
} else {
if (-not $AdministrativeGroup) {
$_
}
$_
}
} else {
$_
}
}
} | Select-Object -First $LimitProcessing | ForEach-Object -Process {
Tests/GPOOwners.Tests.ps1
+42
View File
@@ -0,0 +1,42 @@
Describe 'GPO Owners Management - Simple' {
BeforeAll {
# just in case some tests failed before and added user stays
Import-Module $PSScriptRoot\..\*.psd1 -Force
}
It 'Get-GPOZaurrOwner - Should return proper data' {
$GPOs = Get-GPOZaurrOwner -IncludeSysvol
$GPOs.Count | Should -BeGreaterThan 5
$GPOs[0].PSObject.Properties.Name | Should -Be @(
'DisplayName', 'DomainName',
'GUID', 'Owner', 'OwnerSID',
'OwnerType', 'SysvolOwner', 'SysvolSid',
'SysvolType', 'SysvolPath', 'IsOwnerConsistent',
'IsOwnerAdministrative', 'SysvolExists', 'DistinguishedName'
)
}
It 'Set-GPOZaurrOwner - Should set proper data' {
Set-GPOZaurrOwner -GPOName 'TEST | GPOZaurr Permissions Testing' -Verbose -Principal 'przemyslaw.klys' -WhatIf:$false -Force
}
It 'Get-GPOZaurrOwner - Should return proper data for one GPO' {
$GPOs = Get-GPOZaurrOwner -IncludeSysvol -GPOName 'TEST | GPOZaurr Permissions Testing'
$GPOs.SysvolOwner | Should -Be 'EVOTEC\przemyslaw.klys'
$GPOs.SysvolType | Should -Be 'NotAdministrative'
$GPOs.Owner | Should -Be 'EVOTEC\przemyslaw.klys'
$GPOs.OwnerType | Should -Be 'NotAdministrative'
$GPOS.IsOwnerConsistent | Should -Be $true
$GPOS.IsOwnerAdministrative | Should -Be $false
}
It 'Set-GPOZaurrOwner - Should set proper data' {
Set-GPOZaurrOwner -GPOName 'TEST | GPOZaurr Permissions Testing' -Verbose
}
It 'Get-GPOZaurrOwner - Should return proper data for one GPO (Domain Admins)' {
$GPOs = Get-GPOZaurrOwner -IncludeSysvol -GPOName 'TEST | GPOZaurr Permissions Testing'
$GPOs.SysvolOwner | Should -Be 'EVOTEC\Domain Admins'
$GPOs.SysvolType | Should -Be 'Administrative'
$GPOs.Owner | Should -Be 'EVOTEC\Domain Admins'
$GPOs.OwnerType | Should -Be 'Administrative'
$GPOS.IsOwnerConsistent | Should -Be $true
$GPOS.IsOwnerAdministrative | Should -Be $true
}
}
Tests/GetAddRemoveGPOPermissions.Tests.ps1 → Tests/GPOPermissions.Tests.ps1
View File