mirror of
https://github.com/EvotecIT/GPOZaurr.git
synced 2026-08-30 03:59:13 +00:00
Update
This commit is contained in:
Przemyslaw Klys
@@ -0,0 +1,106 @@
|
||||
function Get-GPOZaurrLinkLoop {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
|
||||
[System.Collections.IDictionary] $CacheReturnedGPOs,
|
||||
[System.Collections.IDictionary] $ForestInformation,
|
||||
[validateset('All', 'Root', 'DomainControllers', 'Site', 'Other')][string[]] $Linked,
|
||||
[string] $SearchBase,
|
||||
[Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
|
||||
[string] $Filter
|
||||
)
|
||||
if (-not $ADObject) {
|
||||
if (-not $Filter) {
|
||||
# if not linked, we force it to All
|
||||
if (-not $Linked) {
|
||||
$Linked = 'All'
|
||||
}
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
$Splat = @{
|
||||
#Filter = $Filter
|
||||
Properties = 'distinguishedName', 'gplink', 'CanonicalName'
|
||||
# Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')"
|
||||
Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
|
||||
}
|
||||
if ($Linked -contains 'Root' -or $Linked -contains 'All') {
|
||||
$SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
|
||||
$Splat['Filter'] = "objectClass -eq 'domainDNS'"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable
|
||||
}
|
||||
if ($Linked -contains 'Site' -or $Linked -contains 'All') {
|
||||
# Sites are defined only in primary domain
|
||||
if ($ForestInformation['DomainsExtended'][$Domain]['DNSRoot'] -eq $ForestInformation['DomainsExtended'][$Domain]['Forest']) {
|
||||
$SearchBase = -join ("CN=Configuration,", $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'])
|
||||
$Splat['Filter'] = "(objectClass -eq 'site')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable
|
||||
}
|
||||
}
|
||||
if ($Linked -contains 'DomainControllers' -or $Linked -contains 'All') {
|
||||
$SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']
|
||||
$Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable
|
||||
}
|
||||
if ($Linked -contains 'Other' -or $Linked -contains 'All') {
|
||||
$SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
|
||||
$Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -SkipDomainRoot -SkipDomainControllers -AsHashTable:$AsHashTable
|
||||
}
|
||||
}
|
||||
} elseif ($Filter) {
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
$Splat = @{
|
||||
Filter = $Filter
|
||||
Properties = 'distinguishedName', 'gplink', 'CanonicalName'
|
||||
Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
|
||||
|
||||
}
|
||||
if ($PSBoundParameters.ContainsKey('SearchBase')) {
|
||||
$DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
|
||||
$SearchBaseDC = ConvertFrom-DistinguishedName -DistinguishedName $SearchBase -ToDC
|
||||
if ($SearchBaseDC -ne $DomainDistinguishedName) {
|
||||
# we check if SearchBase is part of domain distinugishname. If it isn't we skip
|
||||
continue
|
||||
}
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
|
||||
}
|
||||
if ($PSBoundParameters.ContainsKey('SearchScope')) {
|
||||
$Splat['SearchScope'] = $SearchScope
|
||||
}
|
||||
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObjectGPO -Domain $Domain -ForestInformation $ForestInformation -AsHashTable:$AsHashTable
|
||||
}
|
||||
}
|
||||
} else {
|
||||
Get-GPOPrivLink -CacheReturnedGPOs $CacheReturnedGPOs -ADObject $ADObject -Domain '' -ForestInformation $ForestInformation -AsHashTable:$AsHashTable
|
||||
}
|
||||
}
|
||||
@@ -6,91 +6,68 @@
|
||||
[System.Collections.IDictionary] $GPOCache
|
||||
)
|
||||
if ($Object.GpLink -and $Object.GpLink.Trim() -ne '') {
|
||||
$Object.GpLink -split '\]\[' | ForEach-Object -Process {
|
||||
$Link = $_ -replace '\[LDAP://' -replace '\]' -replace '\['
|
||||
if ($Link.Length -gt 10) {
|
||||
$SplitGPLink = $Link -split ';'
|
||||
$DN = $SplitGPLink[0]
|
||||
$Option = $SplitGPLink[1]
|
||||
if ($Option -eq '0') {
|
||||
$Enforced = $false
|
||||
$Enabled = $true
|
||||
} elseif ($Option -eq '1') {
|
||||
$Enabled = $false
|
||||
$Enforced = $false
|
||||
} elseif ($Option -eq '2') {
|
||||
$Enabled = $true
|
||||
$Enforced = $true
|
||||
} elseif ($Option -eq '3') {
|
||||
$Enabled = $false
|
||||
$Enforced = $true
|
||||
} else {
|
||||
$ObjectsToProcess = $Object.GpLink -split '\]\['
|
||||
} elseif ($Object.LinkedGroupPolicyObjects -and $Object.LinkedGroupPolicyObjects.Trim() -ne '') {
|
||||
$ObjectsToProcess = $Object.LinkedGroupPolicyObjects -split '\]\['
|
||||
} else {
|
||||
$ObjectsToProcess = $null
|
||||
}
|
||||
$ObjectsToProcess | ForEach-Object -Process {
|
||||
$Link = $_ -replace 'LDAP://' -replace '\]' -replace '\['
|
||||
if ($Link.Length -gt 10) {
|
||||
$SplitGPLink = $Link -split ';'
|
||||
$DN = $SplitGPLink[0]
|
||||
$Option = $SplitGPLink[1]
|
||||
if ($Option -eq '0') {
|
||||
$Enforced = $false
|
||||
$Enabled = $true
|
||||
} elseif ($Option -eq '1') {
|
||||
$Enabled = $false
|
||||
$Enforced = $false
|
||||
} elseif ($Option -eq '2') {
|
||||
$Enabled = $true
|
||||
$Enforced = $true
|
||||
} elseif ($Option -eq '3') {
|
||||
$Enabled = $false
|
||||
$Enforced = $true
|
||||
} else {
|
||||
if ($Object.GpLink) {
|
||||
Write-Warning "Get-PrivGPOZaurrLink - This should't happen. Please investigate - Option: $Option"
|
||||
$Enabled = $null
|
||||
$Enforced = $null
|
||||
}
|
||||
$DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $DN -ToDomainCN
|
||||
$Output = [ordered] @{
|
||||
DistinguishedName = $Object.DistinguishedName
|
||||
CanonicalName = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
|
||||
Guid = [Regex]::Match( $DN, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
|
||||
Enforced = $Enforced
|
||||
Enabled = $Enabled
|
||||
ObjectClass = $Object.ObjectClass
|
||||
}
|
||||
$Search = -join ($DomainCN, $Output['Guid'])
|
||||
if ($GPOCache -and -not $Limited) {
|
||||
if ($GPOCache[$Search]) {
|
||||
$Output['DisplayName'] = $GPOCache[$Search].DisplayName
|
||||
$Output['DomainName'] = $GPOCache[$Search].DomainName
|
||||
$Output['Owner'] = $GPOCache[$Search].Owner
|
||||
$Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
|
||||
$Output['Description'] = $GPOCache[$Search].Description
|
||||
$Output['CreationTime'] = $GPOCache[$Search].CreationTime
|
||||
$Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
|
||||
$Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $DN -ToDC
|
||||
$Output['GPODistinguishedName'] = $DN
|
||||
[PSCustomObject] $Output
|
||||
} else {
|
||||
Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
|
||||
}
|
||||
} else {
|
||||
Write-Warning "Get-PrivGPOZaurrLink - Property GPLink is required to be able to tell if Enabled/Enforced is added. Skipping those settings."
|
||||
}
|
||||
$Enabled = $null
|
||||
$Enforced = $null
|
||||
}
|
||||
$DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $DN -ToDomainCN
|
||||
$Output = [ordered] @{
|
||||
DistinguishedName = $Object.DistinguishedName
|
||||
CanonicalName = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
|
||||
Guid = [Regex]::Match($DN, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
|
||||
Enforced = $Enforced
|
||||
Enabled = $Enabled
|
||||
ObjectClass = $Object.ObjectClass
|
||||
}
|
||||
$Search = -join ($DomainCN, $Output['Guid'])
|
||||
if ($GPOCache -and -not $Limited) {
|
||||
if ($GPOCache[$Search]) {
|
||||
$Output['DisplayName'] = $GPOCache[$Search].DisplayName
|
||||
$Output['DomainName'] = $GPOCache[$Search].DomainName
|
||||
$Output['Owner'] = $GPOCache[$Search].Owner
|
||||
$Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
|
||||
$Output['Description'] = $GPOCache[$Search].Description
|
||||
$Output['CreationTime'] = $GPOCache[$Search].CreationTime
|
||||
$Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
|
||||
$Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $DN -ToDC
|
||||
$Output['GPODistinguishedName'] = $DN
|
||||
[PSCustomObject] $Output
|
||||
}
|
||||
}
|
||||
}
|
||||
} elseif ($Object.LinkedGroupPolicyObjects -and $Object.LinkedGroupPolicyObjects.Trim() -ne '') {
|
||||
$Object.LinkedGroupPolicyObjects -split '\[LDAP://' -split ';' | ForEach-Object -Process {
|
||||
if ($_.Length -gt 10) {
|
||||
$DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
|
||||
$Output = [ordered] @{
|
||||
DistinguishedName = $Object.DistinguishedName
|
||||
CanonicalName = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
|
||||
Guid = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
|
||||
}
|
||||
$Search = -join ($DomainCN, $Output['Guid'])
|
||||
if ($GPOCache -and -not $Limited) {
|
||||
if ($GPOCache[$Search]) {
|
||||
$Output['Name'] = $GPOCache[$Search].DisplayName
|
||||
$Output['DomainName'] = $GPOCache[$Search].DomainName
|
||||
$Output['Owner'] = $GPOCache[$Search].Owner
|
||||
$Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
|
||||
$Output['Description'] = $GPOCache[$Search].Description
|
||||
$Output['CreationTime'] = $GPOCache[$Search].CreationTime
|
||||
$Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
|
||||
$Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
|
||||
$Output['GPODistinguishedName'] = $_
|
||||
[PSCustomObject] $Output
|
||||
} else {
|
||||
Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
|
||||
}
|
||||
} else {
|
||||
$Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
|
||||
$Output['GPODistinguishedName'] = $_
|
||||
[PSCustomObject] $Output
|
||||
Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
|
||||
}
|
||||
} else {
|
||||
$Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $DN -ToDC
|
||||
$Output['GPODistinguishedName'] = $DN
|
||||
[PSCustomObject] $Output
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user