gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-11 11:16:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Replaced Owner, Added PerminType

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-05-26 22:59:05 +02:00
parent 4acf509e2b
commit b57f131730
4 changed files with 26 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/Get-PrivPermission.ps1
+13
View File
@@ -11,6 +11,7 @@
[switch] $IncludeOwner,
[Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
[validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
[switch] $IncludeGPOObject,
[System.Collections.IDictionary] $ADAdministrativeGroups,
[validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All', 'Default')][string[]] $Type,
@@ -24,6 +25,18 @@
$SecurityRights | ForEach-Object -Process {
#Get-GPPermissions -Guid $GPO.ID -DomainName $GPO.DomainName -All -Server $QueryServer | ForEach-Object -Process {
$GPOPermission = $_
if ($PermitType -ne 'All') {
if ($PermitType -eq 'Deny') {
if ($GPOPermission.Denied -eq $false) {
return
}
} else {
if ($GPOPermission.Denied -eq $true) {
return
}
}
}
if ($ExcludePermissionType -contains $GPOPermission.Permission) {
return
}
Public/Get-GPOZaurrPermission.ps1
+3
View File
@@ -19,6 +19,8 @@
[switch] $IncludeOwner,
[Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
[validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
[switch] $IncludeGPOObject,
[alias('ForestName')][string] $Forest,
@@ -81,6 +83,7 @@
$getPrivPermissionSplat = @{
Principal = $Principal
PrincipalType = $PrincipalType
PermitType = $PermitType
Accounts = $Accounts
Type = $Type
GPO = $_
Public/Invoke-GPOZaurrPermission.ps1
+7 -5
View File
@@ -197,17 +197,19 @@
$AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
if (-not $AdministrativeGroup) {
$DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
#Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
}
} elseif ($Rule.Type -eq 'Default') {
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
#Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
}
continue
}
if ($Rule.Action -eq 'Remove') {
$GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject
$GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType
foreach ($Permission in $GPOPermissions) {
Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission #-IncludeDomains $GPO.DomainName
}
Public/Remove-GPOPermission.ps1
+3 -1
View File
@@ -3,7 +3,8 @@
param(
[validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'Administrative', 'NotAdministrative', 'All')][string[]] $Type,
[Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
[validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'Allow'
)
if ($Type) {
@@ -12,6 +13,7 @@
Type = $Type
IncludePermissionType = $IncludePermissionType
ExcludePermissionType = $ExcludePermissionType
PermitType = $PermitType
}
}
<#