gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-07-26 11:49:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemysław Kłys
2020-04-14 12:03:27 +02:00
parent 7dc64c484f
commit b19e2108ed
5 changed files with 68 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Examples/Example-08-ListingPermissions.ps1
+2 -2
View File
@@ -2,6 +2,6 @@
#$T = Get-GPOZaurrPermission -GPOName 'DC | PowerShell Logging' -Type Unknown #$T = Get-GPOZaurrPermission -GPOName 'DC | PowerShell Logging' -Type Unknown
$T = Get-GPOZaurrPermission -ExcludePermissionType GpoRead,GpoApply #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView $T = Get-GPOZaurrPermission -ResolveAccounts -IncludeOwner #-ExcludePermissionType GpoRead,GpoApply #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView
$T | Format-Table -AutoSize * $T | Format-Table -AutoSize *
#$T | Out-HtmlView -ScrollX -Filtering -Online -DisablePaging $T | Out-HtmlView -ScrollX -Filtering -Online -DisablePaging
Examples/Example-13-ListingOwners.ps1
+1 -1
View File
@@ -1,4 +1,4 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
$Owners = Get-GPOZaurr -owneronly $Owners = Get-GPOZaurr -OwnerOnly
$Owners | Format-Table $Owners | Format-Table
GPOZaurr.psd1
+1 -1
View File
@@ -5,7 +5,7 @@
CompatiblePSEditions = 'Desktop' CompatiblePSEditions = 'Desktop'
Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.' Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
Description = 'Group Policy Eater' Description = 'Group Policy Eater'
FunctionsToExport = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOZaurrOwner' FunctionsToExport = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOZaurrOwner'
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde' GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
ModuleVersion = '0.0.14' ModuleVersion = '0.0.14'
PowerShellVersion = '5.1' PowerShellVersion = '5.1'
Private/Get-PrivPermission.ps1
+41 -8
View File
@@ -9,10 +9,9 @@
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType, [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
[switch] $IncludeGPOObject, [switch] $IncludeGPOObject,
[System.Collections.IDictionary] $ADAdministrativeGroups, [System.Collections.IDictionary] $ADAdministrativeGroups,
[string[]] $Type [string[]] $Type,
[System.Collections.IDictionary] $Accounts
) )
# $GPO = $_
Write-Verbose "Get-GPOZaurrPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)" Write-Verbose "Get-GPOZaurrPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
$SecurityRights = $GPO.GetSecurityInfo() $SecurityRights = $GPO.GetSecurityInfo()
$SecurityRights | ForEach-Object -Process { $SecurityRights | ForEach-Object -Process {
@@ -43,7 +42,6 @@
return return
} }
} }
$ReturnObject = [ordered] @{ $ReturnObject = [ordered] @{
DisplayName = $GPO.DisplayName # : ALL | Enable RDP DisplayName = $GPO.DisplayName # : ALL | Enable RDP
GUID = $GPO.ID GUID = $GPO.ID
@@ -59,11 +57,25 @@
Name = $GPOPermission.Trustee.Name #: Domain Admins Name = $GPOPermission.Trustee.Name #: Domain Admins
Sid = $GPOPermission.Trustee.Sid.Value #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512 Sid = $GPOPermission.Trustee.Sid.Value #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
SidType = $GPOPermission.Trustee.SidType #: Group SidType = $GPOPermission.Trustee.SidType #: Group
}
if ($Accounts) {
$A = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
#$TranslatedUser = $Accounts[$A]
$ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
$ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
$ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
$ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
if ($Accounts[$A].ObjectClass -eq 'group') {
$ReturnObject['SidType'] = 'Group'
} elseif ($Accounts[$A].ObjectClass -eq 'user') {
$ReturnObject['SidType'] = 'user'
} #else {
#}
} }
if ($IncludeGPOObject) { if ($IncludeGPOObject) {
$ReturnObject.GPOObject = $GPO $ReturnObject['GPOObject'] = $GPO
$ReturnObject.GPOSecurity = $SecurityRights $ReturnObject['GPOSecurity'] = $SecurityRights
} }
[PSCustomObject] $ReturnObject [PSCustomObject] $ReturnObject
} }
@@ -84,12 +96,12 @@
$DomainOwner = $GPO.Owner $DomainOwner = $GPO.Owner
$DomainUserName = '' $DomainUserName = ''
$SID = '' $SID = ''
$SIDType = '' $SIDType = 'EmptyOrUnknown'
$DistinguishedName = '' $DistinguishedName = ''
} }
$ReturnObject = [ordered] @{ $ReturnObject = [ordered] @{
DisplayName = $GPO.DisplayName # : ALL | Enable RDP DisplayName = $GPO.DisplayName # : ALL | Enable RDP
GUID = $GPO.GUID GUID = $GPO.Id
DomainName = $GPO.DomainName # : ad.evotec.xyz DomainName = $GPO.DomainName # : ad.evotec.xyz
Enabled = $GPO.GpoStatus Enabled = $GPO.GpoStatus
Description = $GPO.Description Description = $GPO.Description
@@ -103,6 +115,27 @@
Sid = $SID #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512 Sid = $SID #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
SidType = $SIDType # #: Group SidType = $SIDType # #: Group
} }
if ($Accounts) {
$A = $GPO.Owner
#$TranslatedUser = $Accounts[$A]
$ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
$ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
$ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
$ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
$ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
if (-not $ReturnObject['Sid']) {
$ReturnObject['Sid'] = $Accounts[$A].Sid.Value
}
if ($Accounts[$A].ObjectClass -eq 'group') {
$ReturnObject['SidType'] = 'Group'
} elseif ($Accounts[$A].ObjectClass -eq 'user') {
$ReturnObject['SidType'] = 'User'
} elseif ($Accounts[$A].ObjectClass -eq 'computer') {
$ReturnObject['SidType'] = 'Computer'
} else {
$ReturnObject['SidType'] = 'EmptyOrUnknown'
}
}
if ($IncludeGPOObject) { if ($IncludeGPOObject) {
$ReturnObject.GPOObject = $GPO $ReturnObject.GPOObject = $GPO
$ReturnObject.GPOSecurity = $SecurityRights $ReturnObject.GPOSecurity = $SecurityRights
Public/Get-GPOZaurrPermission.ps1
+23 -4
View File
@@ -11,6 +11,7 @@
[switch] $SkipWellKnown, [switch] $SkipWellKnown,
[switch] $SkipAdministrative, [switch] $SkipAdministrative,
[switch] $ResolveAccounts,
[switch] $IncludeOwner, [switch] $IncludeOwner,
[Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType, [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
@@ -23,28 +24,46 @@
[System.Collections.IDictionary] $ExtendedForestInformation [System.Collections.IDictionary] $ExtendedForestInformation
) )
Begin { Begin {
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
if ($Type -eq 'Unknown') { if ($Type -eq 'Unknown') {
if ($SkipAdministrative -or $SkipWellKnown) { if ($SkipAdministrative -or $SkipWellKnown) {
Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed." Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
} }
} }
if ($ResolveAccounts) {
$Accounts = @{ }
foreach ($Domain in $ForestInformation.Domains) {
$QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
$DomainInformation = Get-ADDomain -Server $QueryServer
$Users = Get-ADUser -Filter * -Server $QueryServer -Properties PasswordLastSet, LastLogonDate, UserPrincipalName
foreach ($User in $Users) {
$U = -join ($DomainInformation.NetBIOSName, '\', $User.SamAccountName)
$Accounts[$U] = $User
}
$Groups = Get-ADGroup -Filter * -Server $QueryServer
foreach ($Group in $Groups) {
$G = -join ($DomainInformation.NetBIOSName, '\', $Group.SamAccountName)
$Accounts[$G] = $Group
}
}
}
} }
Process { Process {
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
foreach ($Domain in $ForestInformation.Domains) { foreach ($Domain in $ForestInformation.Domains) {
$QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0] $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
if ($GPOName) { if ($GPOName) {
Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process { Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
} }
} elseif ($GPOGuid) { } elseif ($GPOGuid) {
Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process { Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
} }
} else { } else {
Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process { Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
} }
} }
} }