gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-09 10:19:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-10-01 21:34:42 +02:00
parent afd8e052de
commit b126f397f7
4 changed files with 136 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
GPOZaurr.psd1
+2 -2
View File
@@ -22,11 +22,11 @@
ModuleName = 'PSSharedGoods'
Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
}, @{
ModuleVersion = '0.0.94'
ModuleVersion = '0.0.97'
ModuleName = 'ADEssentials'
Guid = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
}, @{
ModuleVersion = '0.0.109'
ModuleVersion = '0.0.110'
ModuleName = 'PSWriteHTML'
Guid = 'a7bdf640-f5cb-4acf-9de0-365b322d245c'
}, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility')
Private/Get-PrivPermission.ps1
+3 -3
View File
@@ -219,7 +219,7 @@
$UserNameDomain = $OwnerAccount.DomainName
$UserName = $OwnerAccount.Name
$SidType = $OwnerAccount.Type
$ObjectClass = $OwnerAccount.ObjectClass
$OwnerObjectClass = $OwnerAccount.ObjectClass
$SID = $OwnerAccount.ObjectSID
} else {
$ConvertFromSID = ConvertFrom-SID -SID $GPO.Owner
@@ -227,9 +227,9 @@
$Username = $ConvertFromSID.Name
$SidType = $ConvertFromSID.Type
if ($SidType -eq 'Unknown') {
$ObjectClass = 'unknown'
$OwnerObjectClass = 'unknown'
} else {
$ObjectClass = 'foreignSecurityPrincipal'
$OwnerObjectClass = 'foreignSecurityPrincipal'
}
$SID = $ConvertFromSID.SID
}
Public/Get-GPOZaurrPermissionRoot.ps1
+63 -21
View File
@@ -1,6 +1,8 @@
function Get-GPOZaurrPermissionRoot {
[cmdletBinding()]
param(
[ValidateSet('GpoCustomCreate', 'GpoCustomOwner')][string[]] $IncludePermissionType,
[ValidateSet('GpoCustomCreate', 'GpoCustomOwner')][string[]] $ExcludePermissionType,
[alias('ForestName')][string] $Forest,
[string[]] $ExcludeDomains,
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
@@ -12,6 +14,7 @@
Process {
foreach ($Domain in $ForestInformation.Domains) {
$DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain].DistinguishedName
$QueryServer = $ForestInformation['QueryServers'][$Domain].HostName[0]
$getADACLSplat = @{
ADObject = "CN=Policies,CN=System,$DomainDistinguishedName"
IncludeActiveDirectoryRights = 'GenericAll', 'CreateChild', 'WriteOwner', 'WriteDACL'
@@ -21,37 +24,76 @@
ResolveTypes = $true
}
$GPOPermissionsGlobal = Get-ADACL @getADACLSplat #-Verbose
$GPOs = Get-ADObject -SearchBase "CN=Policies,CN=System,$DomainDistinguishedName" -SearchScope OneLevel -Filter * -Properties DisplayName -Server $QueryServer
foreach ($Permission in $GPOPermissionsGlobal) {
if ($Permission.ActiveDirectoryRights | ForEach-Object {
$_ -in 'WriteDACL', 'WriteOwner', 'GenericAll'
}) {
$CustomPermission = foreach ($_ in $Permission.ActiveDirectoryRights) {
if ($_ -in 'WriteDACL', 'WriteOwner', 'GenericAll' ) {
'GpoCustomOwner'
}
if ($_ -in 'CreateChild', 'GenericAll') {
'GpoCustomCreate'
}
}
$CustomPermission = $CustomPermission | Sort-Object -Unique
foreach ($SinglePermission in $CustomPermission) {
if ($SinglePermission -in $ExcludePermissionType) {
continue
}
if ($IncludePermissionType.Count -gt 0 -and $SinglePermission -notin $IncludePermissionType) {
continue
}
[PSCustomObject] @{
PrincipalName = $Permission.Principal
Permission = 'GpoCustomOwner'
PermissionType = $Permission.AccessControlType
PrincipalSid = $Permission.PrincipalObjectSid
PrincipalSidType = $Permission.PrincipalObjectType
PrincipalDomainName = $Permission.PrincipalObjectDomain
GPOCount = 'N/A'
GPONames = -join ("All-", $Domain.ToUpper())
DomainName = $Domain
PrincipalName = $Permission.Principal
Permission = $SinglePermission
PermissionType = $Permission.AccessControlType
PrincipalSidType = $Permission.PrincipalType
PrincipalObjectClass = $Permission.PrincipalObjectType
PrincipalDomainName = $Permission.PrincipalObjectDomain
PrincipalSid = $Permission.PrincipalObjectSid
GPOCount = $GPOs.Count
GPONames = $GPOs.DisplayName
DomainName = $Domain
}
}
<#
if ($Permission.ActiveDirectoryRights | ForEach-Object {
$_
}) {
[PSCustomObject] @{
PrincipalName = $Permission.Principal
Permission = 'GpoCustomOwner'
PermissionType = $Permission.AccessControlType
PrincipalSidType = $Permission.PrincipalType
PrincipalObjectClass = $Permission.PrincipalObjectType
PrincipalDomainName = $Permission.PrincipalObjectDomain
PrincipalSid = $Permission.PrincipalObjectSid
GPOCount = 'N/A'
GPONames = -join ("All-", $Domain.ToUpper())
DomainName = $Domain
}
}
if ($Permission.ActiveDirectoryRights | ForEach-Object {
$_ -in 'CreateChild', 'GenericAll'
}) {
[PSCustomObject] @{
PrincipalName = $Permission.Principal
Permission = 'GpoCustomCreate'
PermissionType = $Permission.AccessControlType
PrincipalSid = $Permission.PrincipalObjectSid
PrincipalSidType = $Permission.PrincipalObjectType
PrincipalDomainName = $Permission.PrincipalObjectDomain
GPOCount = 'N/A'
GPONames = -join ("All-", $Domain.ToUpper())
DomainName = $Domain
PrincipalName = $Permission.Principal
Permission = 'GpoCustomCreate'
PermissionType = $Permission.AccessControlType
PrincipalSidType = $Permission.PrincipalType
PrincipalObjectClass = $Permission.PrincipalObjectType
PrincipalDomainName = $Permission.PrincipalObjectDomain
PrincipalSid = $Permission.PrincipalObjectSid
GPOCount = 'N/A'
GPONames = -join ("All-", $Domain.ToUpper())
DomainName = $Domain
}
}
#>
}
}
}
Public/Get-GPOZaurrPermissionSummary.ps1
+68 -20
View File
@@ -3,9 +3,8 @@
param(
[validateSet('AuthenticatedUsers', 'DomainComputers', 'Unknown', 'WellKnownAdministrative', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All',
[validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
[Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
[switch] $IncludeOwner,
[ValidateSet('GpoApply', 'GpoEdit', 'GpoCustom', 'GpoEditDeleteModifySecurity', 'GpoRead', 'GpoOwner', 'GpoCustomCreate', 'GpoCustomOwner')][string[]] $IncludePermissionType,
[ValidateSet('GpoApply', 'GpoEdit', 'GpoCustom', 'GpoEditDeleteModifySecurity', 'GpoRead', 'GpoOwner', 'GpoCustomCreate', 'GpoCustomOwner')][string[]] $ExcludePermissionType,
[alias('ForestName')][string] $Forest,
[string[]] $ExcludeDomains,
@@ -14,34 +13,82 @@
[string] $Separator
)
$IncludePermTypes = [System.Collections.Generic.List[Microsoft.GroupPolicy.GPPermissionType]]::new()
$ExcludePermTypes = [System.Collections.Generic.List[Microsoft.GroupPolicy.GPPermissionType]]::new()
$CustomPermissions = [System.Collections.Generic.List[string]]::new()
foreach ($PermType in $IncludePermissionType) {
if ($PermType -in 'GpoApply', 'GpoEdit', 'GPOCustom', 'GpoEditDeleteModifySecurity', 'GPORead') {
$IncludePermTypes.Add([Microsoft.GroupPolicy.GPPermissionType]::$PermType)
} elseif ($PermType -in 'GpoOwner') {
$IncludeOwner = $true
} elseif ($PermType -in 'GpoCustomCreate', 'GpoCustomOwner') {
$CustomPermissions.Add($PermType)
}
}
foreach ($PermType in $ExcludePermissionType) {
if ($PermType -in 'GpoApply', 'GpoEdit', 'GPOCustom', 'GpoEditDeleteModifySecurity', 'GPORead') {
$ExcludePermTypes.Add([Microsoft.GroupPolicy.GPPermissionType]::$PermType)
} elseif ($PermType -in 'GpoOwner') {
$IncludeOwner = $false
} elseif ($PermType -in 'GpoCustomCreate', 'GpoCustomOwner') {
$CustomPermissions.Add($PermType)
}
}
$RootPermissions = Get-GPOZaurrPermissionRoot -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
$Permissions = Get-GPOZaurrPermission -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -Type $Type -PermitType $PermitType -IncludeOwner:$IncludeOwner
$Permissions = Get-GPOZaurrPermission -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -IncludePermissionType $IncludePermTypes -ExcludePermissionType $ExcludePermissionType -Type $Type -PermitType $PermitType -IncludeOwner:$IncludeOwner
$Entries = @(
foreach ($Permission in $Permissions) {
[PSCustomObject] @{
PrincipalName = $Permission.PrincipalName
PrincipalDomainName = $Permission.PrincipalDomainName
Permission = $Permission.Permission
PermissionType = $Permission.PermissionType
PrincipalSid = $Permission.PrincipalSid
PrincipalSidType = $Permission.PrincipalSidType
DisplayName = $Permission.DisplayName
DomainName = $Permission.DomainName
PrincipalName = $Permission.PrincipalName
PrincipalDomainName = $Permission.PrincipalDomainName
Permission = $Permission.Permission
PermissionType = $Permission.PermissionType
PrincipalSid = $Permission.PrincipalSid
PrincipalSidType = $Permission.PrincipalSidType
PrincipalObjectClass = $Permission.PrincipalObjectClass
DisplayName = $Permission.DisplayName
DomainName = $Permission.DomainName
}
}
foreach ($RootPermission in $RootPermissions) {
[PSCustomObject] @{
PrincipalName = $RootPermission.PrincipalName
PrincipalDomainName = $Permission.PrincipalDomainName
Permission = $RootPermission.Permission
PermissionType = $RootPermission.PermissionType
PrincipalSid = $RootPermission.PrincipalSid
PrincipalSidType = $RootPermission.PrincipalSidType
DisplayName = $RootPermission.GPONames
DomainName = $RootPermission.DomainName
PrincipalName = $RootPermission.PrincipalName
PrincipalDomainName = $RootPermission.PrincipalDomainName
Permission = $RootPermission.Permission
PermissionType = $RootPermission.PermissionType
PrincipalSid = $RootPermission.PrincipalSid
PrincipalSidType = $RootPermission.PrincipalSidType
PrincipalObjectClass = $RootPermission.PrincipalObjectClass
DisplayName = $RootPermission.GPONames
DomainName = $RootPermission.DomainName
}
}
)
$PermissionsData = [ordered] @{}
foreach ($Entry in $Entries) {
$Key = -join ($Entry.Permission, $Entry.PrincipalName, $Entry.PrincipalDomainName)
if (-not $PermissionsData[$Key]) {
$PermissionsData[$Key] = [PSCustomObject] @{
Permission = $Entry.Permission
PrincipalName = $Entry.PrincipalName
PrincipalDomainName = $Entry.PrincipalDomainName
PrincipalSidType = $Entry.PrincipalSidType
DomainName = $Entry.DomainName
PermissionType = $Entry.PermissionType
GPOCOunt = 0
GPONames = [System.Collections.Generic.List[string]]::new()
}
}
#if ($IncludeNames) {
$PermissionsData[$Key].GPONames.Add($Entry.DisplayName)
#}
$PermissionsData[$Key].GPOCOunt = $PermissionsData[$Key].GPOCOunt + ($Entry.DisplayName).Count
}
$PermissionsData.Values
<#
($Entries | Group-Object -Property Permission, PrincipalSidType, PrincipalName, PrincipalDomainName, DomainName, PermissionType) | ForEach-Object {
$Property = $_.Name -split ', '
Write-Verbose "$Property - $($Property.Count)"
@@ -80,4 +127,5 @@
}
}
}
#>
}