diff --git a/Public/Set-GPOZaurrOwner.ps1 b/Public/Set-GPOZaurrOwner.ps1 index 37d05a5..3df7b41 100644 --- a/Public/Set-GPOZaurrOwner.ps1 +++ b/Public/Set-GPOZaurrOwner.ps1 @@ -76,7 +76,8 @@ [Parameter(ParameterSetName = 'Type')] [Parameter(ParameterSetName = 'Named')] - [int] $LimitProcessing = [int32]::MaxValue + [int] $LimitProcessing = [int32]::MaxValue, + [switch] $Force ) Begin { #Write-Verbose "Set-GPOZaurrOwner - Getting ADAdministrativeGroups" @@ -114,45 +115,50 @@ $AdministrativeGroupSysvol = $null } } - if ($Type -eq 'NotAdministrative') { - if (-not $AdministrativeGroup -or (-not $AdministrativeGroupSysvol -and -not $SkipSysvol)) { - $_ - } else { - if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) { - Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required." - $_ - } - } - } elseif ($Type -eq 'Unknown') { - if (-not $_.Owner -or (-not $_.SysvolOwner -and -not $SkipSysvol)) { - $_ - } - } elseif ($Type -eq 'NotMatching') { - if ($SkipSysvol) { - Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). SysVol scanning is disabled. Skipping." - } else { - if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) { - #Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required." - $_ - } - } + if ($Force) { + Write-Verbose "Set-GPOZaurrOwner - Force was used to push new owner to $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner)." + $_ } else { - # we run with no type, that means we need to either set it to principal or to Administrative - if ($_.Owner) { - # we check if Principal is not set - $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"] - if (-not $SkipSysvol -and $_.SysvolOwner) { - $AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"] - if (-not $AdministrativeGroup -or -not $AdministrativeGroupSysvol) { + if ($Type -eq 'NotAdministrative') { + if (-not $AdministrativeGroup -or (-not $AdministrativeGroupSysvol -and -not $SkipSysvol)) { + $_ + } else { + if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) { + Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required." $_ } + } + } elseif ($Type -eq 'Unknown') { + if (-not $_.Owner -or (-not $_.SysvolOwner -and -not $SkipSysvol)) { + $_ + } + } elseif ($Type -eq 'NotMatching') { + if ($SkipSysvol) { + Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). SysVol scanning is disabled. Skipping." + } else { + if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) { + #Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required." + $_ + } + } + } else { + # we run with no type, that means we need to either set it to principal or to Administrative + if ($_.Owner) { + # we check if Principal is not set + $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"] + if (-not $SkipSysvol -and $_.SysvolOwner) { + $AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"] + if (-not $AdministrativeGroup -or -not $AdministrativeGroupSysvol) { + $_ + } + } else { + if (-not $AdministrativeGroup) { + $_ + } + } } else { - if (-not $AdministrativeGroup) { - $_ - } + $_ } - } else { - $_ } } } | Select-Object -First $LimitProcessing | ForEach-Object -Process { diff --git a/Tests/GPOOwners.Tests.ps1 b/Tests/GPOOwners.Tests.ps1 new file mode 100644 index 0000000..ebfcbbe --- /dev/null +++ b/Tests/GPOOwners.Tests.ps1 @@ -0,0 +1,42 @@ +Describe 'GPO Owners Management - Simple' { + BeforeAll { + # just in case some tests failed before and added user stays + Import-Module $PSScriptRoot\..\*.psd1 -Force + + } + It 'Get-GPOZaurrOwner - Should return proper data' { + $GPOs = Get-GPOZaurrOwner -IncludeSysvol + $GPOs.Count | Should -BeGreaterThan 5 + $GPOs[0].PSObject.Properties.Name | Should -Be @( + 'DisplayName', 'DomainName', + 'GUID', 'Owner', 'OwnerSID', + 'OwnerType', 'SysvolOwner', 'SysvolSid', + 'SysvolType', 'SysvolPath', 'IsOwnerConsistent', + 'IsOwnerAdministrative', 'SysvolExists', 'DistinguishedName' + ) + } + It 'Set-GPOZaurrOwner - Should set proper data' { + Set-GPOZaurrOwner -GPOName 'TEST | GPOZaurr Permissions Testing' -Verbose -Principal 'przemyslaw.klys' -WhatIf:$false -Force + } + It 'Get-GPOZaurrOwner - Should return proper data for one GPO' { + $GPOs = Get-GPOZaurrOwner -IncludeSysvol -GPOName 'TEST | GPOZaurr Permissions Testing' + $GPOs.SysvolOwner | Should -Be 'EVOTEC\przemyslaw.klys' + $GPOs.SysvolType | Should -Be 'NotAdministrative' + $GPOs.Owner | Should -Be 'EVOTEC\przemyslaw.klys' + $GPOs.OwnerType | Should -Be 'NotAdministrative' + $GPOS.IsOwnerConsistent | Should -Be $true + $GPOS.IsOwnerAdministrative | Should -Be $false + } + It 'Set-GPOZaurrOwner - Should set proper data' { + Set-GPOZaurrOwner -GPOName 'TEST | GPOZaurr Permissions Testing' -Verbose + } + It 'Get-GPOZaurrOwner - Should return proper data for one GPO (Domain Admins)' { + $GPOs = Get-GPOZaurrOwner -IncludeSysvol -GPOName 'TEST | GPOZaurr Permissions Testing' + $GPOs.SysvolOwner | Should -Be 'EVOTEC\Domain Admins' + $GPOs.SysvolType | Should -Be 'Administrative' + $GPOs.Owner | Should -Be 'EVOTEC\Domain Admins' + $GPOs.OwnerType | Should -Be 'Administrative' + $GPOS.IsOwnerConsistent | Should -Be $true + $GPOS.IsOwnerAdministrative | Should -Be $true + } +} \ No newline at end of file diff --git a/Tests/GetAddRemoveGPOPermissions.Tests.ps1 b/Tests/GPOPermissions.Tests.ps1 similarity index 100% rename from Tests/GetAddRemoveGPOPermissions.Tests.ps1 rename to Tests/GPOPermissions.Tests.ps1