From b126f397f7d24f5e81293dc4ca2774bb4975cb9d Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Thu, 1 Oct 2020 21:34:42 +0200 Subject: [PATCH] Update --- GPOZaurr.psd1 | 4 +- Private/Get-PrivPermission.ps1 | 6 +- Public/Get-GPOZaurrPermissionRoot.ps1 | 84 ++++++++++++++++------ Public/Get-GPOZaurrPermissionSummary.ps1 | 88 ++++++++++++++++++------ 4 files changed, 136 insertions(+), 46 deletions(-) diff --git a/GPOZaurr.psd1 b/GPOZaurr.psd1 index 2a4bae7..c14ecb8 100644 --- a/GPOZaurr.psd1 +++ b/GPOZaurr.psd1 @@ -22,11 +22,11 @@ ModuleName = 'PSSharedGoods' Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe' }, @{ - ModuleVersion = '0.0.94' + ModuleVersion = '0.0.97' ModuleName = 'ADEssentials' Guid = '9fc9fd61-7f11-4f4b-a527-084086f1905f' }, @{ - ModuleVersion = '0.0.109' + ModuleVersion = '0.0.110' ModuleName = 'PSWriteHTML' Guid = 'a7bdf640-f5cb-4acf-9de0-365b322d245c' }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility') diff --git a/Private/Get-PrivPermission.ps1 b/Private/Get-PrivPermission.ps1 index 3a9b16d..e3fb48b 100644 --- a/Private/Get-PrivPermission.ps1 +++ b/Private/Get-PrivPermission.ps1 @@ -219,7 +219,7 @@ $UserNameDomain = $OwnerAccount.DomainName $UserName = $OwnerAccount.Name $SidType = $OwnerAccount.Type - $ObjectClass = $OwnerAccount.ObjectClass + $OwnerObjectClass = $OwnerAccount.ObjectClass $SID = $OwnerAccount.ObjectSID } else { $ConvertFromSID = ConvertFrom-SID -SID $GPO.Owner @@ -227,9 +227,9 @@ $Username = $ConvertFromSID.Name $SidType = $ConvertFromSID.Type if ($SidType -eq 'Unknown') { - $ObjectClass = 'unknown' + $OwnerObjectClass = 'unknown' } else { - $ObjectClass = 'foreignSecurityPrincipal' + $OwnerObjectClass = 'foreignSecurityPrincipal' } $SID = $ConvertFromSID.SID } diff --git a/Public/Get-GPOZaurrPermissionRoot.ps1 b/Public/Get-GPOZaurrPermissionRoot.ps1 index e7fc733..bb4fd29 100644 --- a/Public/Get-GPOZaurrPermissionRoot.ps1 +++ b/Public/Get-GPOZaurrPermissionRoot.ps1 @@ -1,6 +1,8 @@ function Get-GPOZaurrPermissionRoot { [cmdletBinding()] param( + [ValidateSet('GpoCustomCreate', 'GpoCustomOwner')][string[]] $IncludePermissionType, + [ValidateSet('GpoCustomCreate', 'GpoCustomOwner')][string[]] $ExcludePermissionType, [alias('ForestName')][string] $Forest, [string[]] $ExcludeDomains, [alias('Domain', 'Domains')][string[]] $IncludeDomains, @@ -12,6 +14,7 @@ Process { foreach ($Domain in $ForestInformation.Domains) { $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain].DistinguishedName + $QueryServer = $ForestInformation['QueryServers'][$Domain].HostName[0] $getADACLSplat = @{ ADObject = "CN=Policies,CN=System,$DomainDistinguishedName" IncludeActiveDirectoryRights = 'GenericAll', 'CreateChild', 'WriteOwner', 'WriteDACL' @@ -21,37 +24,76 @@ ResolveTypes = $true } $GPOPermissionsGlobal = Get-ADACL @getADACLSplat #-Verbose + + $GPOs = Get-ADObject -SearchBase "CN=Policies,CN=System,$DomainDistinguishedName" -SearchScope OneLevel -Filter * -Properties DisplayName -Server $QueryServer foreach ($Permission in $GPOPermissionsGlobal) { - if ($Permission.ActiveDirectoryRights | ForEach-Object { - $_ -in 'WriteDACL', 'WriteOwner', 'GenericAll' - }) { + $CustomPermission = foreach ($_ in $Permission.ActiveDirectoryRights) { + if ($_ -in 'WriteDACL', 'WriteOwner', 'GenericAll' ) { + 'GpoCustomOwner' + } + if ($_ -in 'CreateChild', 'GenericAll') { + 'GpoCustomCreate' + } + } + $CustomPermission = $CustomPermission | Sort-Object -Unique + foreach ($SinglePermission in $CustomPermission) { + if ($SinglePermission -in $ExcludePermissionType) { + continue + } + if ($IncludePermissionType.Count -gt 0 -and $SinglePermission -notin $IncludePermissionType) { + continue + } [PSCustomObject] @{ - PrincipalName = $Permission.Principal - Permission = 'GpoCustomOwner' - PermissionType = $Permission.AccessControlType - PrincipalSid = $Permission.PrincipalObjectSid - PrincipalSidType = $Permission.PrincipalObjectType - PrincipalDomainName = $Permission.PrincipalObjectDomain - GPOCount = 'N/A' - GPONames = -join ("All-", $Domain.ToUpper()) - DomainName = $Domain + PrincipalName = $Permission.Principal + Permission = $SinglePermission + PermissionType = $Permission.AccessControlType + PrincipalSidType = $Permission.PrincipalType + PrincipalObjectClass = $Permission.PrincipalObjectType + PrincipalDomainName = $Permission.PrincipalObjectDomain + PrincipalSid = $Permission.PrincipalObjectSid + GPOCount = $GPOs.Count + GPONames = $GPOs.DisplayName + DomainName = $Domain + } + } + + <# + + if ($Permission.ActiveDirectoryRights | ForEach-Object { + $_ + }) { + + [PSCustomObject] @{ + PrincipalName = $Permission.Principal + Permission = 'GpoCustomOwner' + PermissionType = $Permission.AccessControlType + PrincipalSidType = $Permission.PrincipalType + PrincipalObjectClass = $Permission.PrincipalObjectType + PrincipalDomainName = $Permission.PrincipalObjectDomain + PrincipalSid = $Permission.PrincipalObjectSid + GPOCount = 'N/A' + GPONames = -join ("All-", $Domain.ToUpper()) + DomainName = $Domain } } if ($Permission.ActiveDirectoryRights | ForEach-Object { $_ -in 'CreateChild', 'GenericAll' }) { [PSCustomObject] @{ - PrincipalName = $Permission.Principal - Permission = 'GpoCustomCreate' - PermissionType = $Permission.AccessControlType - PrincipalSid = $Permission.PrincipalObjectSid - PrincipalSidType = $Permission.PrincipalObjectType - PrincipalDomainName = $Permission.PrincipalObjectDomain - GPOCount = 'N/A' - GPONames = -join ("All-", $Domain.ToUpper()) - DomainName = $Domain + PrincipalName = $Permission.Principal + Permission = 'GpoCustomCreate' + PermissionType = $Permission.AccessControlType + PrincipalSidType = $Permission.PrincipalType + PrincipalObjectClass = $Permission.PrincipalObjectType + PrincipalDomainName = $Permission.PrincipalObjectDomain + PrincipalSid = $Permission.PrincipalObjectSid + GPOCount = 'N/A' + GPONames = -join ("All-", $Domain.ToUpper()) + DomainName = $Domain } + } + #> } } } diff --git a/Public/Get-GPOZaurrPermissionSummary.ps1 b/Public/Get-GPOZaurrPermissionSummary.ps1 index 914570d..e1769c8 100644 --- a/Public/Get-GPOZaurrPermissionSummary.ps1 +++ b/Public/Get-GPOZaurrPermissionSummary.ps1 @@ -3,9 +3,8 @@ param( [validateSet('AuthenticatedUsers', 'DomainComputers', 'Unknown', 'WellKnownAdministrative', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All', [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All', - [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType, - [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType, - [switch] $IncludeOwner, + [ValidateSet('GpoApply', 'GpoEdit', 'GpoCustom', 'GpoEditDeleteModifySecurity', 'GpoRead', 'GpoOwner', 'GpoCustomCreate', 'GpoCustomOwner')][string[]] $IncludePermissionType, + [ValidateSet('GpoApply', 'GpoEdit', 'GpoCustom', 'GpoEditDeleteModifySecurity', 'GpoRead', 'GpoOwner', 'GpoCustomCreate', 'GpoCustomOwner')][string[]] $ExcludePermissionType, [alias('ForestName')][string] $Forest, [string[]] $ExcludeDomains, @@ -14,34 +13,82 @@ [string] $Separator ) + + $IncludePermTypes = [System.Collections.Generic.List[Microsoft.GroupPolicy.GPPermissionType]]::new() + $ExcludePermTypes = [System.Collections.Generic.List[Microsoft.GroupPolicy.GPPermissionType]]::new() + $CustomPermissions = [System.Collections.Generic.List[string]]::new() + foreach ($PermType in $IncludePermissionType) { + if ($PermType -in 'GpoApply', 'GpoEdit', 'GPOCustom', 'GpoEditDeleteModifySecurity', 'GPORead') { + $IncludePermTypes.Add([Microsoft.GroupPolicy.GPPermissionType]::$PermType) + } elseif ($PermType -in 'GpoOwner') { + $IncludeOwner = $true + } elseif ($PermType -in 'GpoCustomCreate', 'GpoCustomOwner') { + $CustomPermissions.Add($PermType) + } + } + foreach ($PermType in $ExcludePermissionType) { + if ($PermType -in 'GpoApply', 'GpoEdit', 'GPOCustom', 'GpoEditDeleteModifySecurity', 'GPORead') { + $ExcludePermTypes.Add([Microsoft.GroupPolicy.GPPermissionType]::$PermType) + } elseif ($PermType -in 'GpoOwner') { + $IncludeOwner = $false + } elseif ($PermType -in 'GpoCustomCreate', 'GpoCustomOwner') { + $CustomPermissions.Add($PermType) + } + } + $RootPermissions = Get-GPOZaurrPermissionRoot -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation - $Permissions = Get-GPOZaurrPermission -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -Type $Type -PermitType $PermitType -IncludeOwner:$IncludeOwner + $Permissions = Get-GPOZaurrPermission -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -IncludePermissionType $IncludePermTypes -ExcludePermissionType $ExcludePermissionType -Type $Type -PermitType $PermitType -IncludeOwner:$IncludeOwner $Entries = @( foreach ($Permission in $Permissions) { [PSCustomObject] @{ - PrincipalName = $Permission.PrincipalName - PrincipalDomainName = $Permission.PrincipalDomainName - Permission = $Permission.Permission - PermissionType = $Permission.PermissionType - PrincipalSid = $Permission.PrincipalSid - PrincipalSidType = $Permission.PrincipalSidType - DisplayName = $Permission.DisplayName - DomainName = $Permission.DomainName + PrincipalName = $Permission.PrincipalName + PrincipalDomainName = $Permission.PrincipalDomainName + Permission = $Permission.Permission + PermissionType = $Permission.PermissionType + PrincipalSid = $Permission.PrincipalSid + PrincipalSidType = $Permission.PrincipalSidType + PrincipalObjectClass = $Permission.PrincipalObjectClass + DisplayName = $Permission.DisplayName + DomainName = $Permission.DomainName } } foreach ($RootPermission in $RootPermissions) { [PSCustomObject] @{ - PrincipalName = $RootPermission.PrincipalName - PrincipalDomainName = $Permission.PrincipalDomainName - Permission = $RootPermission.Permission - PermissionType = $RootPermission.PermissionType - PrincipalSid = $RootPermission.PrincipalSid - PrincipalSidType = $RootPermission.PrincipalSidType - DisplayName = $RootPermission.GPONames - DomainName = $RootPermission.DomainName + PrincipalName = $RootPermission.PrincipalName + PrincipalDomainName = $RootPermission.PrincipalDomainName + Permission = $RootPermission.Permission + PermissionType = $RootPermission.PermissionType + PrincipalSid = $RootPermission.PrincipalSid + PrincipalSidType = $RootPermission.PrincipalSidType + PrincipalObjectClass = $RootPermission.PrincipalObjectClass + DisplayName = $RootPermission.GPONames + DomainName = $RootPermission.DomainName } } ) + $PermissionsData = [ordered] @{} + foreach ($Entry in $Entries) { + $Key = -join ($Entry.Permission, $Entry.PrincipalName, $Entry.PrincipalDomainName) + if (-not $PermissionsData[$Key]) { + $PermissionsData[$Key] = [PSCustomObject] @{ + Permission = $Entry.Permission + PrincipalName = $Entry.PrincipalName + PrincipalDomainName = $Entry.PrincipalDomainName + PrincipalSidType = $Entry.PrincipalSidType + DomainName = $Entry.DomainName + PermissionType = $Entry.PermissionType + GPOCOunt = 0 + GPONames = [System.Collections.Generic.List[string]]::new() + } + } + #if ($IncludeNames) { + $PermissionsData[$Key].GPONames.Add($Entry.DisplayName) + #} + $PermissionsData[$Key].GPOCOunt = $PermissionsData[$Key].GPOCOunt + ($Entry.DisplayName).Count + } + $PermissionsData.Values + + <# ($Entries | Group-Object -Property Permission, PrincipalSidType, PrincipalName, PrincipalDomainName, DomainName, PermissionType) | ForEach-Object { $Property = $_.Name -split ', ' Write-Verbose "$Property - $($Property.Count)" @@ -80,4 +127,5 @@ } } } + #> } \ No newline at end of file