diff --git a/Public/Get-GPOZaurrOrganizationalUnit.ps1 b/Public/Get-GPOZaurrOrganizationalUnit.ps1 index 48426ee..5f99997 100644 --- a/Public/Get-GPOZaurrOrganizationalUnit.ps1 +++ b/Public/Get-GPOZaurrOrganizationalUnit.ps1 @@ -4,16 +4,33 @@ [alias('ForestName')][string] $Forest, [string[]] $ExcludeDomains, [alias('Domain', 'Domains')][string[]] $IncludeDomains, - [System.Collections.IDictionary] $ExtendedForestInformation + [System.Collections.IDictionary] $ExtendedForestInformation, + + [ValidateSet('OK', 'Unlink', 'Delete')][string[]] $Option ) $CachedOu = [ordered] @{} + $CachedGPO = [ordered] @{} $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation + $GroupPolicies = Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation + foreach ($GPO in $GroupPolicies) { + $CachedGPO[$GPO.GPODistinguishedName] = $GPO + } foreach ($Domain in $ForestInformation.Domains) { + Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain)" + $CountTop = 0 $TopOrganizationalUnits = Get-ADOrganizationalUnit -Filter * -Properties LinkedGroupPolicyObjects, DistinguishedName, ntSecurityDescriptor -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0] -SearchScope OneLevel foreach ($TopOU in $TopOrganizationalUnits) { + $CountTop++ + Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain) / $($TOPOU.DistinguishedName) [$CountTop/$($TopOrganizationalUnits.Count)]" # cache top ou + if ($TopOU.LinkedGroupPolicyObjects) { + $LinkedGPOs = $CachedGPO[$TopOU.LinkedGroupPolicyObjects] + } else { + $LinkedGPOs = $null + } $CachedOu[$TopOU.DistinguishedName] = [ordered]@{ 'LinkedGroupPolicyObjects' = $TopOU.LinkedGroupPolicyObjects + 'LinkedGroupPolicy' = $LinkedGPOs 'Objects' = [ordered] @{} 'ObjectsClasses' = [ordered] @{} 'ObjectsCountDirect' = 0 @@ -25,10 +42,17 @@ # cache children OUs $OUs = Get-ADOrganizationalUnit -SearchScope Subtree -SearchBase $TopOU.DistinguishedName -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0] -Properties LinkedGroupPolicyObjects, DistinguishedName -Filter * + Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain) / $($TOPOU.DistinguishedName) [$CountTop/$($TopOrganizationalUnits.Count)], found $($OUs.Count) OU's to process." foreach ($OU in $OUs) { if (-not $CachedOu[$OU.DistinguishedName]) { + if ($OU.LinkedGroupPolicyObjects) { + $LinkedGPOs = $CachedGPO[$OU.LinkedGroupPolicyObjects] + } else { + $LinkedGPOs = $null + } $CachedOu[$OU.DistinguishedName] = [ordered]@{ 'LinkedGroupPolicyObjects' = $OU.LinkedGroupPolicyObjects + 'LinkedGroupPolicy' = $LinkedGPOs 'Objects' = [ordered] @{} 'ObjectsClasses' = [ordered] @{} 'ObjectsCountDirect' = 0 @@ -41,6 +65,7 @@ } # Find all objects in those OUs $ObjectsInOu = Get-ADObject -LDAPFilter "(|(ObjectClass=user)(ObjectClass=contact)(ObjectClass=computer)(ObjectClass=group)(objectClass=inetOrgPerson))" -SearchBase $TopOU.distinguishedName -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0] + Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain) / $($TOPOU.DistinguishedName) [$CountTop/$($TopOrganizationalUnits.Count)], found $($ObjectsInOu.Count) objects to process." foreach ($Object in $ObjectsInOu) { $Place = ConvertFrom-DistinguishedName -ToOrganizationalUnit -DistinguishedName $Object.DistinguishedName $AllOUs = ConvertFrom-DistinguishedName -ToMultipleOrganizationalUnit -IncludeParent -DistinguishedName $Place @@ -72,6 +97,21 @@ } + if ($Option) { + $Found = $false + if ($Option -contains 'Ok' -and $Status -contains 'OK') { + $Found = $true + } elseif ($Option -contains 'Unlink' -and $Status -contains 'Unlink GPO') { + $Found = $true + } elseif ($Option -contains 'Delete' -and $Status -contains 'Delete OU') { + $Found = $true + } + if (-not $Found) { + continue + } + } + + [PSCustomObject] @{ Organizationalunit = $OU Level = $CachedOu[$OU]['Level'] @@ -82,15 +122,9 @@ ObjectCountIndirect = $CachedOu[$OU]['ObjectsCountIndirect'] ObjectCountTotal = $CachedOu[$OU]['ObjectsCountTotal'] ObjectClasses = $ObjectClasses + GPONames = $CachedOu[$OU]['LinkedGroupPolicy'].DisplayName Objects = $CachedOu[$OU]['Objects'].Values.Name + GPO = $CachedOu[$OU]['LinkedGroupPolicy'] } } -} - -#$Values = Get-WinADOrganizationalUnits -#$Values | Format-Table - -<# -$T = ([adsisearcher]'(objectcategory=organizationalunit)').FindAll() | Where-Object { - -not (-join $_.GetDirectoryEntry().psbase.children) } - #> \ No newline at end of file +} \ No newline at end of file