From b57f1317309fb8ff5ab386de1e21d0a4472ef93c Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Tue, 26 May 2020 22:59:05 +0200 Subject: [PATCH] Replaced Owner, Added PerminType --- Private/Get-PrivPermission.ps1 | 13 +++++++++++++ Public/Get-GPOZaurrPermission.ps1 | 3 +++ Public/Invoke-GPOZaurrPermission.ps1 | 12 +++++++----- Public/Remove-GPOPermission.ps1 | 4 +++- 4 files changed, 26 insertions(+), 6 deletions(-) diff --git a/Private/Get-PrivPermission.ps1 b/Private/Get-PrivPermission.ps1 index 94402a0..711d304 100644 --- a/Private/Get-PrivPermission.ps1 +++ b/Private/Get-PrivPermission.ps1 @@ -11,6 +11,7 @@ [switch] $IncludeOwner, [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType, [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType, + [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All', [switch] $IncludeGPOObject, [System.Collections.IDictionary] $ADAdministrativeGroups, [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All', 'Default')][string[]] $Type, @@ -24,6 +25,18 @@ $SecurityRights | ForEach-Object -Process { #Get-GPPermissions -Guid $GPO.ID -DomainName $GPO.DomainName -All -Server $QueryServer | ForEach-Object -Process { $GPOPermission = $_ + + if ($PermitType -ne 'All') { + if ($PermitType -eq 'Deny') { + if ($GPOPermission.Denied -eq $false) { + return + } + } else { + if ($GPOPermission.Denied -eq $true) { + return + } + } + } if ($ExcludePermissionType -contains $GPOPermission.Permission) { return } diff --git a/Public/Get-GPOZaurrPermission.ps1 b/Public/Get-GPOZaurrPermission.ps1 index ce63acf..e16ea88 100644 --- a/Public/Get-GPOZaurrPermission.ps1 +++ b/Public/Get-GPOZaurrPermission.ps1 @@ -19,6 +19,8 @@ [switch] $IncludeOwner, [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType, [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType, + [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All', + [switch] $IncludeGPOObject, [alias('ForestName')][string] $Forest, @@ -81,6 +83,7 @@ $getPrivPermissionSplat = @{ Principal = $Principal PrincipalType = $PrincipalType + PermitType = $PermitType Accounts = $Accounts Type = $Type GPO = $_ diff --git a/Public/Invoke-GPOZaurrPermission.ps1 b/Public/Invoke-GPOZaurrPermission.ps1 index d959af7..1fca29f 100644 --- a/Public/Invoke-GPOZaurrPermission.ps1 +++ b/Public/Invoke-GPOZaurrPermission.ps1 @@ -197,17 +197,19 @@ $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"] if (-not $AdministrativeGroup) { $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] - Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal" - Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference + Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal" + #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference + Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference } } elseif ($Rule.Type -eq 'Default') { - Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)" - Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference + Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)" + #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference + Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference } continue } if ($Rule.Action -eq 'Remove') { - $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject + $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType foreach ($Permission in $GPOPermissions) { Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission #-IncludeDomains $GPO.DomainName } diff --git a/Public/Remove-GPOPermission.ps1 b/Public/Remove-GPOPermission.ps1 index a661cc7..e9fcc85 100644 --- a/Public/Remove-GPOPermission.ps1 +++ b/Public/Remove-GPOPermission.ps1 @@ -3,7 +3,8 @@ param( [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'Administrative', 'NotAdministrative', 'All')][string[]] $Type, [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType, - [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType + [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType, + [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'Allow' ) if ($Type) { @@ -12,6 +13,7 @@ Type = $Type IncludePermissionType = $IncludePermissionType ExcludePermissionType = $ExcludePermissionType + PermitType = $PermitType } } <#