gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-09 18:29:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-11-16 13:47:41 +01:00
parent f990cdfa03
commit bef4744b09
4 changed files with 82 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/Invoke.GPOZaurrNetLogonPermissions.ps1
+40 -10
View File
@@ -109,14 +109,6 @@
New-HTMLTableCondition -Name 'PrincipalType' -Value "WellKnownAdministrative" -BackgroundColor LightGreen -ComparisonType string -Operator eq
}
}
if ($Script:Reporting['NetLogonPermissions']['WarningsAndErrors']) {
New-HTMLSection -Name 'Warnings & Errors to Review' {
New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['WarningsAndErrors'] -Filtering {
New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
}
}
}
New-HTMLSection -Name 'Steps to fix NetLogon Owners ' {
New-HTMLContainer {
New-HTMLSpanStyle -FontSize 10pt {
@@ -141,7 +133,7 @@
}
New-HTMLText -Text "Alternatively if you prefer working with console you can run: "
New-HTMLCodeBlock -Code {
$NetLogonOutput = Get-GPOZaurrNetLogon -Verbose
$NetLogonOutput = Get-GPOZaurrNetLogon -OwnerOnly -Verbose
$NetLogonOutput | Format-Table
}
New-HTMLText -Text "It provides same data as you see in table above just doesn't prettify it for you."
@@ -177,10 +169,48 @@
}
}
}
if ($Script:Reporting['NetLogonPermissions']['WarningsAndErrors']) {
New-HTMLSection -Name 'Warnings & Errors to Review' {
New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['WarningsAndErrors'] -Filtering {
New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
}
}
}
}
New-HTMLTab -Name 'NetLogon Permissions' {
New-HTMLSection -Invisible {
New-HTMLPanel {
#& $Script:GPOConfiguration['NetLogonPermissions']['Summary']
}
New-HTMLPanel {
#New-HTMLChart {
# New-ChartPie -Name 'Correct Owners' -Value $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrators'] -Color LightGreen
# New-ChartPie -Name 'Incorrect Owners' -Value $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'] -Color Crimson
#} -Title 'NetLogon Owners' -TitleAlignment center
}
}
# New-HTMLSection -Name 'NetLogon Files List' {
# New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['Variables']['Owner'] -Filtering {
# New-HTMLTableCondition -Name 'PrincipalSid' -Value "S-1-5-32-544" -BackgroundColor LightGreen -ComparisonType string
# New-HTMLTableCondition -Name 'PrincipalSid' -Value "S-1-5-32-544" -BackgroundColor Salmon -ComparisonType string -Operator ne
# New-HTMLTableCondition -Name 'PrincipalType' -Value "WellKnownAdministrative" -BackgroundColor LightGreen -ComparisonType string -Operator eq
# }
# }
New-HTMLSection -Name 'NetLogon Files List' {
New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['Variables']['NonOwner'] -Filtering
New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['Variables']['NonOwner'] -Filtering {
New-HTMLTableCondition -Name 'PrincipalType' -Value "Unknown" -BackgroundColor Salmon -ComparisonType string -Operator eq -Row
New-HTMLTableCondition -Name 'PrincipalType' -Value "WellKnownAdministrative" -BackgroundColor LightGreen -ComparisonType string -Operator eq -Row
New-HTMLTableCondition -Name 'Status' -Value "Review Required" -BackgroundColor PaleGoldenrod -ComparisonType string -Operator eq -Row
}
}
if ($Script:Reporting['NetLogonPermissions']['WarningsAndErrors']) {
New-HTMLSection -Name 'Warnings & Errors to Review' {
New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['WarningsAndErrors'] -Filtering {
New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
}
}
}
}
}
Private/Invoke.GPOZaurrPermissionsRead.ps1
+18
View File
@@ -17,6 +17,7 @@
$Script:Reporting['GPOPermissionsRead']['Variables']['WillNotTouchPerDomain'] = @{}
$Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'] = @{}
$Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'] = @{}
$Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'] = @{}
foreach ($GPO in $Script:Reporting['GPOPermissionsRead']['Data'].Issues) {
# Create Per Domain Variables
@@ -26,6 +27,9 @@
if (-not $Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'][$GPO.DomainName]) {
$Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'][$GPO.DomainName] = 0
}
if (-not $Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'][$GPO.DomainName]) {
$Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'][$GPO.DomainName] = 0
}
if ($GPO.PermissionIssue) {
$Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotRead']++
$Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'][$GPO.DomainName]++
@@ -33,6 +37,7 @@
$Script:Reporting['GPOPermissionsRead']['Variables']['Read']++
$Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'][$GPO.DomainName]++
}
$Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'][$GPO.DomainName]++
}
foreach ($GPO in $Script:Reporting['GPOPermissionsRead']['Data'].Permissions) {
# Create Per Domain Variables
@@ -69,6 +74,7 @@
Read = 0
ReadPerDomain = $null
TotalToFix = 0
TotalPerDomain = $null
}
Overview = {
@@ -108,6 +114,18 @@
New-HTMLListItem -Text "Group Policies couldn't read at all: ", $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotRead'] -FontWeight normal, bold
New-HTMLListItem -Text "Group Policies with permissions allowing read: ", $Script:Reporting['GPOPermissionsRead']['Variables']['Read'] -FontWeight normal, bold
} -FontSize 10pt
New-HTMLText -Text 'With split per domain (permissions required):' -FontSize 10pt -FontWeight bold
New-HTMLList -Type Unordered {
foreach ($Domain in $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'].Keys) {
New-HTMLListItem -Text @(
"$Domain requires ",
$Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'][$Domain],
" changes out of ",
$Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'][$Domain],
"."
) -FontWeight normal, bold, normal
}
} -FontSize 10pt
New-HTMLText -Text @(
"That means we need to fix permissions on: "
$($Script:Reporting['GPOPermissionsRead']['Variables']['TotalToFix'])
Public/Get-GPOZaurrNetlogon.ps1
+20 -2
View File
@@ -30,8 +30,14 @@
}
if (-not $OwnerOnly) {
if (-not $SkipOwner) {
if ($IdentityOwner.SID -eq "S-1-5-32-544") {
$Status = 'OK'
} else {
$Status = 'Replace Owner Required'
}
[PSCustomObject] @{
FullName = $File.FullName
Status = $Status
Extension = $File.Extension
CreationTime = $File.CreationTime
LastAccessTime = $File.LastAccessTime
@@ -44,14 +50,25 @@
FileSystemRights = 'Owner' # : FullControl
IsInherited = $false
FullNameOnSysVol = $File.FullName.Replace($Path, $PathOnSysvol)
#Owner = $ACL.Owner
}
}
$FilePermission = Get-FilePermissions -Path $_.FullName -ACLS $ACL -Verbose:$false
$FilePermission = Get-FilePermissions -Path $File.FullName -ACLS $ACL -Verbose:$false
foreach ($Perm in $FilePermission) {
$Identity = Convert-Identity -Identity $Perm.Principal -Verbose:$false
$Status = $null
if ($Perm.FileSystemRights -eq [System.Security.AccessControl.FileSystemRights]::FullControl) {
if ($Identity.Type -eq 'WellKnownAdministrative') {
$Status = 'OK'
} else {
$Status = 'Review Required'
}
}
if ($Identity.Type -eq 'Unknown') {
$Status = 'Removal Required'
}
[PSCustomObject] @{
FullName = $File.FullName
Status = $Status
Extension = $File.Extension
CreationTime = $File.CreationTime
LastAccessTime = $File.LastAccessTime
@@ -65,6 +82,7 @@
IsInherited = $Perm.IsInherited # : True
FullNameOnSysVol = $File.FullName.Replace($Path, $PathOnSysvol)
}
}
} else {
[PSCustomObject] @{
README.md
+4
View File
@@ -57,6 +57,10 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
## Changelog
- 0.0.84
- [x] Improves `Invoke-GPOZaurr` (WIP)
- [x] Type `NetLogonPermissions`
- [x] Fix for `Get-GPOZaurrNetLogon`
- 0.0.83 - 14.11.2020
- [x] Improves `Invoke-GPOZaurr` (WIP)
- [x] Fix for wrong ActionRequired count