From bef4744b09d7678ee3e34e97903fa4f5a832a21b Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Mon, 16 Nov 2020 13:47:41 +0100 Subject: [PATCH] Update --- .../Invoke.GPOZaurrNetLogonPermissions.ps1 | 50 +++++++++++++++---- Private/Invoke.GPOZaurrPermissionsRead.ps1 | 18 +++++++ Public/Get-GPOZaurrNetlogon.ps1 | 22 +++++++- README.md | 4 ++ 4 files changed, 82 insertions(+), 12 deletions(-) diff --git a/Private/Invoke.GPOZaurrNetLogonPermissions.ps1 b/Private/Invoke.GPOZaurrNetLogonPermissions.ps1 index ca6a107..9027251 100644 --- a/Private/Invoke.GPOZaurrNetLogonPermissions.ps1 +++ b/Private/Invoke.GPOZaurrNetLogonPermissions.ps1 @@ -109,14 +109,6 @@ New-HTMLTableCondition -Name 'PrincipalType' -Value "WellKnownAdministrative" -BackgroundColor LightGreen -ComparisonType string -Operator eq } } - if ($Script:Reporting['NetLogonPermissions']['WarningsAndErrors']) { - New-HTMLSection -Name 'Warnings & Errors to Review' { - New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['WarningsAndErrors'] -Filtering { - New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row - New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row - } - } - } New-HTMLSection -Name 'Steps to fix NetLogon Owners ' { New-HTMLContainer { New-HTMLSpanStyle -FontSize 10pt { @@ -141,7 +133,7 @@ } New-HTMLText -Text "Alternatively if you prefer working with console you can run: " New-HTMLCodeBlock -Code { - $NetLogonOutput = Get-GPOZaurrNetLogon -Verbose + $NetLogonOutput = Get-GPOZaurrNetLogon -OwnerOnly -Verbose $NetLogonOutput | Format-Table } New-HTMLText -Text "It provides same data as you see in table above just doesn't prettify it for you." @@ -177,10 +169,48 @@ } } } + if ($Script:Reporting['NetLogonPermissions']['WarningsAndErrors']) { + New-HTMLSection -Name 'Warnings & Errors to Review' { + New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['WarningsAndErrors'] -Filtering { + New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row + New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row + } + } + } } New-HTMLTab -Name 'NetLogon Permissions' { + New-HTMLSection -Invisible { + New-HTMLPanel { + #& $Script:GPOConfiguration['NetLogonPermissions']['Summary'] + } + New-HTMLPanel { + #New-HTMLChart { + # New-ChartPie -Name 'Correct Owners' -Value $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrators'] -Color LightGreen + # New-ChartPie -Name 'Incorrect Owners' -Value $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'] -Color Crimson + #} -Title 'NetLogon Owners' -TitleAlignment center + } + } + # New-HTMLSection -Name 'NetLogon Files List' { + # New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['Variables']['Owner'] -Filtering { + # New-HTMLTableCondition -Name 'PrincipalSid' -Value "S-1-5-32-544" -BackgroundColor LightGreen -ComparisonType string + # New-HTMLTableCondition -Name 'PrincipalSid' -Value "S-1-5-32-544" -BackgroundColor Salmon -ComparisonType string -Operator ne + # New-HTMLTableCondition -Name 'PrincipalType' -Value "WellKnownAdministrative" -BackgroundColor LightGreen -ComparisonType string -Operator eq + # } + # } New-HTMLSection -Name 'NetLogon Files List' { - New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['Variables']['NonOwner'] -Filtering + New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['Variables']['NonOwner'] -Filtering { + New-HTMLTableCondition -Name 'PrincipalType' -Value "Unknown" -BackgroundColor Salmon -ComparisonType string -Operator eq -Row + New-HTMLTableCondition -Name 'PrincipalType' -Value "WellKnownAdministrative" -BackgroundColor LightGreen -ComparisonType string -Operator eq -Row + New-HTMLTableCondition -Name 'Status' -Value "Review Required" -BackgroundColor PaleGoldenrod -ComparisonType string -Operator eq -Row + } + } + if ($Script:Reporting['NetLogonPermissions']['WarningsAndErrors']) { + New-HTMLSection -Name 'Warnings & Errors to Review' { + New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['WarningsAndErrors'] -Filtering { + New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row + New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row + } + } } } } diff --git a/Private/Invoke.GPOZaurrPermissionsRead.ps1 b/Private/Invoke.GPOZaurrPermissionsRead.ps1 index 996be45..61973b7 100644 --- a/Private/Invoke.GPOZaurrPermissionsRead.ps1 +++ b/Private/Invoke.GPOZaurrPermissionsRead.ps1 @@ -17,6 +17,7 @@ $Script:Reporting['GPOPermissionsRead']['Variables']['WillNotTouchPerDomain'] = @{} $Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'] = @{} $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'] = @{} + $Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'] = @{} foreach ($GPO in $Script:Reporting['GPOPermissionsRead']['Data'].Issues) { # Create Per Domain Variables @@ -26,6 +27,9 @@ if (-not $Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'][$GPO.DomainName]) { $Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'][$GPO.DomainName] = 0 } + if (-not $Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'][$GPO.DomainName]) { + $Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'][$GPO.DomainName] = 0 + } if ($GPO.PermissionIssue) { $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotRead']++ $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'][$GPO.DomainName]++ @@ -33,6 +37,7 @@ $Script:Reporting['GPOPermissionsRead']['Variables']['Read']++ $Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'][$GPO.DomainName]++ } + $Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'][$GPO.DomainName]++ } foreach ($GPO in $Script:Reporting['GPOPermissionsRead']['Data'].Permissions) { # Create Per Domain Variables @@ -69,6 +74,7 @@ Read = 0 ReadPerDomain = $null TotalToFix = 0 + TotalPerDomain = $null } Overview = { @@ -108,6 +114,18 @@ New-HTMLListItem -Text "Group Policies couldn't read at all: ", $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotRead'] -FontWeight normal, bold New-HTMLListItem -Text "Group Policies with permissions allowing read: ", $Script:Reporting['GPOPermissionsRead']['Variables']['Read'] -FontWeight normal, bold } -FontSize 10pt + New-HTMLText -Text 'With split per domain (permissions required):' -FontSize 10pt -FontWeight bold + New-HTMLList -Type Unordered { + foreach ($Domain in $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'].Keys) { + New-HTMLListItem -Text @( + "$Domain requires ", + $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'][$Domain], + " changes out of ", + $Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'][$Domain], + "." + ) -FontWeight normal, bold, normal + } + } -FontSize 10pt New-HTMLText -Text @( "That means we need to fix permissions on: " $($Script:Reporting['GPOPermissionsRead']['Variables']['TotalToFix']) diff --git a/Public/Get-GPOZaurrNetlogon.ps1 b/Public/Get-GPOZaurrNetlogon.ps1 index f6123bc..377e60e 100644 --- a/Public/Get-GPOZaurrNetlogon.ps1 +++ b/Public/Get-GPOZaurrNetlogon.ps1 @@ -30,8 +30,14 @@ } if (-not $OwnerOnly) { if (-not $SkipOwner) { + if ($IdentityOwner.SID -eq "S-1-5-32-544") { + $Status = 'OK' + } else { + $Status = 'Replace Owner Required' + } [PSCustomObject] @{ FullName = $File.FullName + Status = $Status Extension = $File.Extension CreationTime = $File.CreationTime LastAccessTime = $File.LastAccessTime @@ -44,14 +50,25 @@ FileSystemRights = 'Owner' # : FullControl IsInherited = $false FullNameOnSysVol = $File.FullName.Replace($Path, $PathOnSysvol) - #Owner = $ACL.Owner } } - $FilePermission = Get-FilePermissions -Path $_.FullName -ACLS $ACL -Verbose:$false + $FilePermission = Get-FilePermissions -Path $File.FullName -ACLS $ACL -Verbose:$false foreach ($Perm in $FilePermission) { $Identity = Convert-Identity -Identity $Perm.Principal -Verbose:$false + $Status = $null + if ($Perm.FileSystemRights -eq [System.Security.AccessControl.FileSystemRights]::FullControl) { + if ($Identity.Type -eq 'WellKnownAdministrative') { + $Status = 'OK' + } else { + $Status = 'Review Required' + } + } + if ($Identity.Type -eq 'Unknown') { + $Status = 'Removal Required' + } [PSCustomObject] @{ FullName = $File.FullName + Status = $Status Extension = $File.Extension CreationTime = $File.CreationTime LastAccessTime = $File.LastAccessTime @@ -65,6 +82,7 @@ IsInherited = $Perm.IsInherited # : True FullNameOnSysVol = $File.FullName.Replace($Path, $PathOnSysvol) } + } } else { [PSCustomObject] @{ diff --git a/README.md b/README.md index a47b6e1..f235ad0 100644 --- a/README.md +++ b/README.md @@ -57,6 +57,10 @@ That's it. Whenever there's a new version, you run the command, and you can enjo ## Changelog +- 0.0.84 + - [x] Improves `Invoke-GPOZaurr` (WIP) + - [x] Type `NetLogonPermissions` + - [x] Fix for `Get-GPOZaurrNetLogon` - 0.0.83 - 14.11.2020 - [x] Improves `Invoke-GPOZaurr` (WIP) - [x] Fix for wrong ActionRequired count