diff --git a/Examples/Example-08-ListingPermissions.ps1 b/Examples/Example-08-ListingPermissions.ps1 index 1ad946c..3e05fc2 100644 --- a/Examples/Example-08-ListingPermissions.ps1 +++ b/Examples/Example-08-ListingPermissions.ps1 @@ -2,6 +2,6 @@ #$T = Get-GPOZaurrPermission -GPOName 'DC | PowerShell Logging' -Type Unknown -$T = Get-GPOZaurrPermission -ExcludePermissionType GpoRead,GpoApply #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView +$T = Get-GPOZaurrPermission -ResolveAccounts -IncludeOwner #-ExcludePermissionType GpoRead,GpoApply #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView $T | Format-Table -AutoSize * -#$T | Out-HtmlView -ScrollX -Filtering -Online -DisablePaging \ No newline at end of file +$T | Out-HtmlView -ScrollX -Filtering -Online -DisablePaging \ No newline at end of file diff --git a/Examples/Example-13-ListingOwners.ps1 b/Examples/Example-13-ListingOwners.ps1 index 8816665..4365e4b 100644 --- a/Examples/Example-13-ListingOwners.ps1 +++ b/Examples/Example-13-ListingOwners.ps1 @@ -1,4 +1,4 @@ Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force -$Owners = Get-GPOZaurr -owneronly +$Owners = Get-GPOZaurr -OwnerOnly $Owners | Format-Table \ No newline at end of file diff --git a/GPOZaurr.psd1 b/GPOZaurr.psd1 index ffaa9b5..f44f922 100644 --- a/GPOZaurr.psd1 +++ b/GPOZaurr.psd1 @@ -5,7 +5,7 @@ CompatiblePSEditions = 'Desktop' Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.' Description = 'Group Policy Eater' - FunctionsToExport = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOZaurrOwner' + FunctionsToExport = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOZaurrOwner' GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde' ModuleVersion = '0.0.14' PowerShellVersion = '5.1' diff --git a/Private/Get-PrivPermission.ps1 b/Private/Get-PrivPermission.ps1 index ab0e7a1..b0020bc 100644 --- a/Private/Get-PrivPermission.ps1 +++ b/Private/Get-PrivPermission.ps1 @@ -9,10 +9,9 @@ [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType, [switch] $IncludeGPOObject, [System.Collections.IDictionary] $ADAdministrativeGroups, - [string[]] $Type + [string[]] $Type, + [System.Collections.IDictionary] $Accounts ) - - # $GPO = $_ Write-Verbose "Get-GPOZaurrPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)" $SecurityRights = $GPO.GetSecurityInfo() $SecurityRights | ForEach-Object -Process { @@ -43,7 +42,6 @@ return } } - $ReturnObject = [ordered] @{ DisplayName = $GPO.DisplayName # : ALL | Enable RDP GUID = $GPO.ID @@ -59,11 +57,25 @@ Name = $GPOPermission.Trustee.Name #: Domain Admins Sid = $GPOPermission.Trustee.Sid.Value #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512 SidType = $GPOPermission.Trustee.SidType #: Group + } + if ($Accounts) { + $A = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name) + #$TranslatedUser = $Accounts[$A] + $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName + $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled + $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' } + $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' } + if ($Accounts[$A].ObjectClass -eq 'group') { + $ReturnObject['SidType'] = 'Group' + } elseif ($Accounts[$A].ObjectClass -eq 'user') { + $ReturnObject['SidType'] = 'user' + } #else { + #} } if ($IncludeGPOObject) { - $ReturnObject.GPOObject = $GPO - $ReturnObject.GPOSecurity = $SecurityRights + $ReturnObject['GPOObject'] = $GPO + $ReturnObject['GPOSecurity'] = $SecurityRights } [PSCustomObject] $ReturnObject } @@ -84,12 +96,12 @@ $DomainOwner = $GPO.Owner $DomainUserName = '' $SID = '' - $SIDType = '' + $SIDType = 'EmptyOrUnknown' $DistinguishedName = '' } $ReturnObject = [ordered] @{ DisplayName = $GPO.DisplayName # : ALL | Enable RDP - GUID = $GPO.GUID + GUID = $GPO.Id DomainName = $GPO.DomainName # : ad.evotec.xyz Enabled = $GPO.GpoStatus Description = $GPO.Description @@ -103,6 +115,27 @@ Sid = $SID #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512 SidType = $SIDType # #: Group } + if ($Accounts) { + $A = $GPO.Owner + #$TranslatedUser = $Accounts[$A] + $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName + $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled + $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName + $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' } + $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' } + if (-not $ReturnObject['Sid']) { + $ReturnObject['Sid'] = $Accounts[$A].Sid.Value + } + if ($Accounts[$A].ObjectClass -eq 'group') { + $ReturnObject['SidType'] = 'Group' + } elseif ($Accounts[$A].ObjectClass -eq 'user') { + $ReturnObject['SidType'] = 'User' + } elseif ($Accounts[$A].ObjectClass -eq 'computer') { + $ReturnObject['SidType'] = 'Computer' + } else { + $ReturnObject['SidType'] = 'EmptyOrUnknown' + } + } if ($IncludeGPOObject) { $ReturnObject.GPOObject = $GPO $ReturnObject.GPOSecurity = $SecurityRights diff --git a/Public/Get-GPOZaurrPermission.ps1 b/Public/Get-GPOZaurrPermission.ps1 index f8affd4..3b1c6e6 100644 --- a/Public/Get-GPOZaurrPermission.ps1 +++ b/Public/Get-GPOZaurrPermission.ps1 @@ -11,6 +11,7 @@ [switch] $SkipWellKnown, [switch] $SkipAdministrative, + [switch] $ResolveAccounts, [switch] $IncludeOwner, [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType, @@ -23,28 +24,46 @@ [System.Collections.IDictionary] $ExtendedForestInformation ) Begin { + $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation if ($Type -eq 'Unknown') { if ($SkipAdministrative -or $SkipWellKnown) { Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed." } } + if ($ResolveAccounts) { + $Accounts = @{ } + foreach ($Domain in $ForestInformation.Domains) { + $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0] + $DomainInformation = Get-ADDomain -Server $QueryServer + $Users = Get-ADUser -Filter * -Server $QueryServer -Properties PasswordLastSet, LastLogonDate, UserPrincipalName + foreach ($User in $Users) { + $U = -join ($DomainInformation.NetBIOSName, '\', $User.SamAccountName) + $Accounts[$U] = $User + } + $Groups = Get-ADGroup -Filter * -Server $QueryServer + foreach ($Group in $Groups) { + $G = -join ($DomainInformation.NetBIOSName, '\', $Group.SamAccountName) + $Accounts[$G] = $Group + } + } + } + } Process { - $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation foreach ($Domain in $ForestInformation.Domains) { $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0] if ($GPOName) { Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process { - Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups + Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups } } elseif ($GPOGuid) { Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process { - Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups + Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups } } else { Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process { - Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups + Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups } } }