gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-09 18:29:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Work in progress for Owner

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-05-12 17:04:05 +02:00
parent 0f9ed02a04
commit c1f293e6f1
6 changed files with 140 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Examples/Example-08-ListingPermissioonsUnknown.ps1 → Examples/Example-08-ListingPermissionsUnknown.ps1
View File
Examples/Example-11-ReplaceGPOOwnerAutomated.ps1
+7 -5
View File
@@ -4,10 +4,12 @@
# And also can fix at the same time NotAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins
# regardless if current user is still Domain Admin or not
$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType
$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName
$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
Set-GPOZaurrOwner -Type NonAdministrative -Verbose -LimitProcessing 1 -WhatIf
Set-GPOZaurrOwner -Type NotAdministrative -Verbose -WhatIf #-LimitProcessing 12
$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
$GPOs | Format-Table DisplayName, Owner, OwnerSID
#Set-GPOZaurrOwner -GPOName 'New Group Policy Object' -Verbose -Principal 'przemyslaw.klys' -IncludeSysVol
#$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName 'New Group Policy Object'
#$GPOs | Format-Table DisplayName, Owner, OwnerSID
Examples/Example-13-ListingOwners02.ps1
+7 -1
View File
@@ -2,4 +2,10 @@
$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol
$T | Format-Table *
#$T | Out-HtmlView -ScrollX
#$T | Out-HtmlView -ScrollX
$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOName 'Default Domain Policy'
$T | Format-Table *
$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOGuid '4E1F9C70-1DDB-4AB6-BBA3-14A8E07F0B4B'
$T | Format-Table *
GPOZaurr.psd1
+2 -2
View File
@@ -17,11 +17,11 @@
}
}
RequiredModules = @{
ModuleVersion = '0.0.139'
ModuleVersion = '0.0.140'
ModuleName = 'PSSharedGoods'
Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
}, @{
ModuleVersion = '0.0.54'
ModuleVersion = '0.0.55'
ModuleName = 'ADEssentials'
Guid = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
}, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
Public/Get-GPOZaurrOwner.ps1
+17 -2
View File
@@ -1,6 +1,9 @@
function Get-GPOZaurrOwner {
[cmdletbinding()]
[cmdletbinding(DefaultParameterSetName = 'Default')]
param(
[Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
[Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
[switch] $IncludeSysvol,
[alias('ForestName')][string] $Forest,
@@ -16,7 +19,19 @@
}
}
Process {
Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation | ForEach-Object -Process {
$getGPOZaurrADSplat = @{
Forest = $Forest
IncludeDomains = $IncludeDomains
ExcludeDomains = $ExcludeDomains
ExtendedForestInformation = $ForestInformation
}
if ($GPOName) {
$getGPOZaurrADSplat['GPOName'] = $GPOName
} elseif ($GPOGuid) {
$getGPOZaurrADSplat['GPOGUID'] = $GPOGuid
}
Get-GPOZaurrAD @getGPOZaurrADSplat | ForEach-Object -Process {
Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)"
$ACL = Get-ADACLOwner -ADObject $_.GPODistinguishedName -Resolve -ADAdministrativeGroups $ADAdministrativeGroups
$Object = [ordered] @{
DisplayName = $_.DisplayName
Public/Set-GPOZaurrOwner.ps1
+107 -46
View File
@@ -2,7 +2,7 @@
[cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Type')]
param(
[Parameter(ParameterSetName = 'Type', Mandatory)]
[validateset('EmptyOrUnknown', 'NotAdministrative', 'All')][string[]] $Type,
[validateset('Unknown', 'NotAdministrative', 'All')][string[]] $Type,
[Parameter(ParameterSetName = 'Named')][string] $GPOName,
[Parameter(ParameterSetName = 'Named')][alias('GUID', 'GPOID')][string] $GPOGuid,
@@ -27,28 +27,98 @@
[Parameter(ParameterSetName = 'Named')]
[string] $Principal,
[switch] $IncludeSysVol,
[Parameter(ParameterSetName = 'Type')]
[Parameter(ParameterSetName = 'Named')]
[int] $LimitProcessing
[int] $LimitProcessing = [int32]::MaxValue
)
Begin {
Write-Verbose "Set-GPOZaurrOwner - Getting ADAdministrativeGroups"
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
$Count = 0
Write-Verbose "Set-GPOZaurrOwner - Processing GPOs for Type $Type"
}
Process {
if ($Type) {
Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -ADAdministrativeGroups $ADAdministrativeGroups -OwnerOnly | ForEach-Object -Process {
$GPO = $_
if ($Type -contains 'All') {
# Regardless who is the owner it is overwritten
$getGPOZaurrOwnerSplat = @{
IncludeSysvol = $IncludeSysVol
Forest = $Forest
IncludeDomains = $IncludeDomains
ExcludeDomains = $ExcludeDomains
ExtendedForestInformation = $ExtendedForestInformation
ADAdministrativeGroups = $ADAdministrativeGroups
Verbose = $VerbosePreference
}
if ($GPOName) {
$getGPOZaurrOwnerSplat['GPOName'] = $GPOName
} elseif ($GPOGuid) {
$getGPOZaurrOwnerSplat['GPOGuid'] = $GPOGUiD
}
Get-GPOZaurrOwner @getGPOZaurrOwnerSplat | Where-Object {
if ($Type -contains 'NotAdministrative' -and $Type -notcontains 'All') {
if ($_.Owner) {
$AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
if (-not $AdministrativeGroup) {
$_
}
}
} elseif ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
if ($null -eq $_.Owner) {
$_
}
} else {
$_
}
} | Select-Object -First $LimitProcessing | ForEach-Object -Process {
$GPO = $_
if ($Principal) {
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
} else {
$DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
}
<#
if ($Type -contains 'All') {
# Regardless who is the owner it is overwritten
if ($Principal) {
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
} else {
$DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
}
$Count++
if ($Count -eq $LimitProcessing) {
break
}
} elseif ($Type -contains 'NotAdministrative' -and $Type -notcontains 'All') {
if ($GPO.Owner) {
$AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
if (-not $AdministrativeGroup) {
if ($Principal) {
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
} else {
$DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
}
$Count++
if ($Count -eq $LimitProcessing) {
return
}
}
}
} else ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
if ($null -eq $GPO.Owner) {
if ($Principal) {
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $Principal"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
} else {
$DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $DefaultPrincipal"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
}
$Count++
@@ -56,44 +126,34 @@
break
}
}
if ($Type -contains 'NotAdministrative' -and $Type -notcontains 'All') {
if ($GPO.Owner) {
$AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
if (-not $AdministrativeGroup) {
if ($Principal) {
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
} else {
$DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
}
$Count++
if ($Count -eq $LimitProcessing) {
break
}
}
}
}
if ($Type -contains 'EmptyOrUnknown' -and $Type -notcontains 'All') {
if ($null -eq $GPO.Owner) {
if ($Principal) {
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $Principal"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
} else {
$DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $DefaultPrincipal"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
}
$Count++
if ($Count -eq $LimitProcessing) {
break
}
}
} else {
$GPO = $_
if ($Principal) {
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
} else {
$DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
}
}
} else {
Get-GPOZaurr -GPOName $GPOName -GPOGuid $GPOGUiD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Verbose:$false -ADAdministrativeGroups $ADAdministrativeGroups | ForEach-Object -Process {
#>
}
#>
#}
<#
else {
$getGPOZaurrOwnerSplat = @{
IncludeSysvol = $IncludeSysVol
Forest = $Forest
IncludeDomains = $IncludeDomains
ExcludeDomains = $ExcludeDomains
ExtendedForestInformation = $ExtendedForestInformation
ADAdministrativeGroups = $ADAdministrativeGroups
GPOName = $GPOName
GPOGuid = $GPOGUiD
}
Get-GPOZaurrOwner @getGPOZaurrOwnerSplat $IncludeSysVol | ForEach-Object -Process {
$GPO = $_
if ($Principal) {
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
@@ -109,6 +169,7 @@
}
}
}
#>
}
End {