gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-27 10:46:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemysław Kłys
2020-04-14 12:03:27 +02:00
parent 7dc64c484f
commit b19e2108ed
5 changed files with 68 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/Get-PrivPermission.ps1
+41 -8
View File
@@ -9,10 +9,9 @@
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
[switch] $IncludeGPOObject,
[System.Collections.IDictionary] $ADAdministrativeGroups,
[string[]] $Type
[string[]] $Type,
[System.Collections.IDictionary] $Accounts
)
# $GPO = $_
Write-Verbose "Get-GPOZaurrPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
$SecurityRights = $GPO.GetSecurityInfo()
$SecurityRights | ForEach-Object -Process {
@@ -43,7 +42,6 @@
return
}
}
$ReturnObject = [ordered] @{
DisplayName = $GPO.DisplayName # : ALL | Enable RDP
GUID = $GPO.ID
@@ -59,11 +57,25 @@
Name = $GPOPermission.Trustee.Name #: Domain Admins
Sid = $GPOPermission.Trustee.Sid.Value #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
SidType = $GPOPermission.Trustee.SidType #: Group
}
if ($Accounts) {
$A = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
#$TranslatedUser = $Accounts[$A]
$ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
$ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
$ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
$ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
if ($Accounts[$A].ObjectClass -eq 'group') {
$ReturnObject['SidType'] = 'Group'
} elseif ($Accounts[$A].ObjectClass -eq 'user') {
$ReturnObject['SidType'] = 'user'
} #else {
#}
}
if ($IncludeGPOObject) {
$ReturnObject.GPOObject = $GPO
$ReturnObject.GPOSecurity = $SecurityRights
$ReturnObject['GPOObject'] = $GPO
$ReturnObject['GPOSecurity'] = $SecurityRights
}
[PSCustomObject] $ReturnObject
}
@@ -84,12 +96,12 @@
$DomainOwner = $GPO.Owner
$DomainUserName = ''
$SID = ''
$SIDType = ''
$SIDType = 'EmptyOrUnknown'
$DistinguishedName = ''
}
$ReturnObject = [ordered] @{
DisplayName = $GPO.DisplayName # : ALL | Enable RDP
GUID = $GPO.GUID
GUID = $GPO.Id
DomainName = $GPO.DomainName # : ad.evotec.xyz
Enabled = $GPO.GpoStatus
Description = $GPO.Description
@@ -103,6 +115,27 @@
Sid = $SID #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
SidType = $SIDType # #: Group
}
if ($Accounts) {
$A = $GPO.Owner
#$TranslatedUser = $Accounts[$A]
$ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
$ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
$ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
$ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
$ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
if (-not $ReturnObject['Sid']) {
$ReturnObject['Sid'] = $Accounts[$A].Sid.Value
}
if ($Accounts[$A].ObjectClass -eq 'group') {
$ReturnObject['SidType'] = 'Group'
} elseif ($Accounts[$A].ObjectClass -eq 'user') {
$ReturnObject['SidType'] = 'User'
} elseif ($Accounts[$A].ObjectClass -eq 'computer') {
$ReturnObject['SidType'] = 'Computer'
} else {
$ReturnObject['SidType'] = 'EmptyOrUnknown'
}
}
if ($IncludeGPOObject) {
$ReturnObject.GPOObject = $GPO
$ReturnObject.GPOSecurity = $SecurityRights