gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-29 03:36:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-09-29 12:17:59 +02:00
parent 52edd47532
commit afd8e052de
5 changed files with 258 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Public/Get-GPOZaurrPermission.ps1
+5 -3
View File
@@ -8,13 +8,13 @@
[alias('GUID', 'GPOID')][string] $GPOGuid,
[string[]] $Principal,
[validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
[validateset('DistinguishedName', 'Name', 'NetbiosName', 'Sid')][string] $PrincipalType = 'Sid',
[validateSet('AuthenticatedUsers', 'DomainComputers', 'Unknown', 'WellKnownAdministrative', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All',
[switch] $SkipWellKnown,
[switch] $SkipAdministrative,
[switch] $ResolveAccounts,
#[switch] $ResolveAccounts,
[switch] $IncludeOwner,
[Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
@@ -43,6 +43,7 @@
Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
}
}
<#
if ($ResolveAccounts) {
$Accounts = @{ }
foreach ($Domain in $ForestInformation.Domains) {
@@ -60,6 +61,7 @@
}
}
}
#>
}
Process {
foreach ($Domain in $ForestInformation.Domains) {
@@ -96,7 +98,7 @@
Principal = $Principal
PrincipalType = $PrincipalType
PermitType = $PermitType
Accounts = $Accounts
#Accounts = $Accounts
Type = $Type
GPO = $_
SkipWellKnown = $SkipWellKnown.IsPresent
Public/Get-GPOZaurrPermissionSummary.ps1
+52 -35
View File
@@ -14,52 +14,69 @@
[string] $Separator
)
$RootPermissions = Get-GPOZaurrPermissionRoot -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
$Permissions = Get-GPOZaurrPermission -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -Type $Type -PermitType $PermitType -IncludeOwner:$IncludeOwner
$Entries = foreach ($Permission in $Permissions) {
[PSCustomObject] @{
Name = $Permission.Name
Permission = $Permission.Permission
PermissionType = $Permission.PermissionType
Sid = $Permission.Sid
SidType = $Permission.SidType
DisplayName = $Permission.DisplayName
DomainName = $Permission.DomainName
Domain = $Domain
$Entries = @(
foreach ($Permission in $Permissions) {
[PSCustomObject] @{
PrincipalName = $Permission.PrincipalName
PrincipalDomainName = $Permission.PrincipalDomainName
Permission = $Permission.Permission
PermissionType = $Permission.PermissionType
PrincipalSid = $Permission.PrincipalSid
PrincipalSidType = $Permission.PrincipalSidType
DisplayName = $Permission.DisplayName
DomainName = $Permission.DomainName
}
}
}
$Entries | Group-Object -Property Permission, SidType, Name, DomainName, PermissionType | ForEach-Object {
foreach ($RootPermission in $RootPermissions) {
[PSCustomObject] @{
PrincipalName = $RootPermission.PrincipalName
PrincipalDomainName = $Permission.PrincipalDomainName
Permission = $RootPermission.Permission
PermissionType = $RootPermission.PermissionType
PrincipalSid = $RootPermission.PrincipalSid
PrincipalSidType = $RootPermission.PrincipalSidType
DisplayName = $RootPermission.GPONames
DomainName = $RootPermission.DomainName
}
}
)
($Entries | Group-Object -Property Permission, PrincipalSidType, PrincipalName, PrincipalDomainName, DomainName, PermissionType) | ForEach-Object {
$Property = $_.Name -split ', '
Write-Verbose "$Property - $($Property.Count)"
if ($Property[0] -eq 'GpoOwner') {
[PSCustomObject] @{
Permission = $Property[0]
Type = $Property[1]
Name = $Property[2]
DomainName = $Property[3]
PermissionType = 'Allow'
GPOCount = $_.Count
GPONames = if ($Separator) { $_.Group.DisplayName -join $Separator } else { $_.Group.DisplayName }
Permission = $Property[0]
PrincipalSidType = $Property[1]
PrincipalName = $Property[2]
PrincipalDomainName = $Property[3]
DomainName = $Property[4]
PermissionType = 'Allow'
GPOCount = $_.Count
GPONames = if ($Separator) { $_.Group.DisplayName -join $Separator } else { $_.Group.DisplayName }
}
} elseif ($Property.Count -eq 5) {
[PSCustomObject] @{
Permission = $Property[0]
Type = $Property[1]
Name = $Property[2]
DomainName = $Property[3]
PermissionType = if ($Property[4]) { $Property[4] } else { 'Owner' }
GPOCount = $_.Count
GPONames = if ($Separator) { $_.Group.DisplayName -join $Separator } else { $_.Group.DisplayName }
Permission = $Property[0]
PrincipalSidType = $Property[1]
PrincipalName = $Property[2]
PrincipalDomainName = $Property[3]
DomainName = $Property[4]
PermissionType = if ($Property[5]) { $Property[5] } else { 'Owner' }
GPOCount = $_.Count
GPONames = if ($Separator) { $_.Group.DisplayName -join $Separator } else { $_.Group.DisplayName }
}
} else {
[PSCustomObject] @{
Permission = $Property[0]
Type = $Property[1]
Name = ''
DomainName = $Property[2]
PermissionType = if ($Property[3]) { $Property[3] } else { 'Owner' }
GPOCount = $_.Count
GPONames = if ($Separator) { $_.Group.DisplayName -join $Separator } else { $_.Group.DisplayName }
Permission = $Property[0]
PrincipalSidType = $Property[1]
PrincipalName = ''
PrincipalDomainName = ''
DomainName = $Property[2]
PermissionType = if ($Property[3]) { $Property[3] } else { 'Owner' }
GPOCount = $_.Count
GPONames = if ($Separator) { $_.Group.DisplayName -join $Separator } else { $_.Group.DisplayName }
}
}
}
Public/Remove-GPOZaurrPermission.ps1
+1 -1
View File
@@ -8,7 +8,7 @@
[alias('GUID', 'GPOID')][string] $GPOGuid,
[string[]] $Principal,
[validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
[validateset('DistinguishedName', 'Name', 'NetbiosName', 'Sid')][string] $PrincipalType = 'Sid',
[validateset('Unknown', 'NotAdministrative', 'Default')][string[]] $Type = 'Default',