From c1f293e6f10a13d42fb295e09f207973d5cd9c6c Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Tue, 12 May 2020 17:04:05 +0200 Subject: [PATCH] Work in progress for Owner --- ... Example-08-ListingPermissionsUnknown.ps1} | 0 .../Example-11-ReplaceGPOOwnerAutomated.ps1 | 12 +- Examples/Example-13-ListingOwners02.ps1 | 8 +- GPOZaurr.psd1 | 4 +- Public/Get-GPOZaurrOwner.ps1 | 19 ++- Public/Set-GPOZaurrOwner.ps1 | 153 ++++++++++++------ 6 files changed, 140 insertions(+), 56 deletions(-) rename Examples/{Example-08-ListingPermissioonsUnknown.ps1 => Example-08-ListingPermissionsUnknown.ps1} (100%) diff --git a/Examples/Example-08-ListingPermissioonsUnknown.ps1 b/Examples/Example-08-ListingPermissionsUnknown.ps1 similarity index 100% rename from Examples/Example-08-ListingPermissioonsUnknown.ps1 rename to Examples/Example-08-ListingPermissionsUnknown.ps1 diff --git a/Examples/Example-11-ReplaceGPOOwnerAutomated.ps1 b/Examples/Example-11-ReplaceGPOOwnerAutomated.ps1 index 6856f6e..e1f51eb 100644 --- a/Examples/Example-11-ReplaceGPOOwnerAutomated.ps1 +++ b/Examples/Example-11-ReplaceGPOOwnerAutomated.ps1 @@ -4,10 +4,12 @@ # And also can fix at the same time NotAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins # regardless if current user is still Domain Admin or not -$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object' -$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType +$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName +$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType -Set-GPOZaurrOwner -Type NonAdministrative -Verbose -LimitProcessing 1 -WhatIf +Set-GPOZaurrOwner -Type NotAdministrative -Verbose -WhatIf #-LimitProcessing 12 -$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object' -$GPOs | Format-Table DisplayName, Owner, OwnerSID \ No newline at end of file +#Set-GPOZaurrOwner -GPOName 'New Group Policy Object' -Verbose -Principal 'przemyslaw.klys' -IncludeSysVol + +#$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName 'New Group Policy Object' +#$GPOs | Format-Table DisplayName, Owner, OwnerSID \ No newline at end of file diff --git a/Examples/Example-13-ListingOwners02.ps1 b/Examples/Example-13-ListingOwners02.ps1 index 9fca0fc..6a941f5 100644 --- a/Examples/Example-13-ListingOwners02.ps1 +++ b/Examples/Example-13-ListingOwners02.ps1 @@ -2,4 +2,10 @@ $T = Get-GPOZaurrOwner -Verbose -IncludeSysvol $T | Format-Table * -#$T | Out-HtmlView -ScrollX \ No newline at end of file +#$T | Out-HtmlView -ScrollX + +$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOName 'Default Domain Policy' +$T | Format-Table * + +$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOGuid '4E1F9C70-1DDB-4AB6-BBA3-14A8E07F0B4B' +$T | Format-Table * \ No newline at end of file diff --git a/GPOZaurr.psd1 b/GPOZaurr.psd1 index 620eb34..3f08c93 100644 --- a/GPOZaurr.psd1 +++ b/GPOZaurr.psd1 @@ -17,11 +17,11 @@ } } RequiredModules = @{ - ModuleVersion = '0.0.139' + ModuleVersion = '0.0.140' ModuleName = 'PSSharedGoods' Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe' }, @{ - ModuleVersion = '0.0.54' + ModuleVersion = '0.0.55' ModuleName = 'ADEssentials' Guid = '9fc9fd61-7f11-4f4b-a527-084086f1905f' }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility' diff --git a/Public/Get-GPOZaurrOwner.ps1 b/Public/Get-GPOZaurrOwner.ps1 index 4ea61f4..4bd42c0 100644 --- a/Public/Get-GPOZaurrOwner.ps1 +++ b/Public/Get-GPOZaurrOwner.ps1 @@ -1,6 +1,9 @@ function Get-GPOZaurrOwner { - [cmdletbinding()] + [cmdletbinding(DefaultParameterSetName = 'Default')] param( + [Parameter(ParameterSetName = 'GPOName')][string] $GPOName, + [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid, + [switch] $IncludeSysvol, [alias('ForestName')][string] $Forest, @@ -16,7 +19,19 @@ } } Process { - Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation | ForEach-Object -Process { + $getGPOZaurrADSplat = @{ + Forest = $Forest + IncludeDomains = $IncludeDomains + ExcludeDomains = $ExcludeDomains + ExtendedForestInformation = $ForestInformation + } + if ($GPOName) { + $getGPOZaurrADSplat['GPOName'] = $GPOName + } elseif ($GPOGuid) { + $getGPOZaurrADSplat['GPOGUID'] = $GPOGuid + } + Get-GPOZaurrAD @getGPOZaurrADSplat | ForEach-Object -Process { + Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)" $ACL = Get-ADACLOwner -ADObject $_.GPODistinguishedName -Resolve -ADAdministrativeGroups $ADAdministrativeGroups $Object = [ordered] @{ DisplayName = $_.DisplayName diff --git a/Public/Set-GPOZaurrOwner.ps1 b/Public/Set-GPOZaurrOwner.ps1 index 03af7dc..3922797 100644 --- a/Public/Set-GPOZaurrOwner.ps1 +++ b/Public/Set-GPOZaurrOwner.ps1 @@ -2,7 +2,7 @@ [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Type')] param( [Parameter(ParameterSetName = 'Type', Mandatory)] - [validateset('EmptyOrUnknown', 'NotAdministrative', 'All')][string[]] $Type, + [validateset('Unknown', 'NotAdministrative', 'All')][string[]] $Type, [Parameter(ParameterSetName = 'Named')][string] $GPOName, [Parameter(ParameterSetName = 'Named')][alias('GUID', 'GPOID')][string] $GPOGuid, @@ -27,28 +27,98 @@ [Parameter(ParameterSetName = 'Named')] [string] $Principal, + [switch] $IncludeSysVol, + [Parameter(ParameterSetName = 'Type')] [Parameter(ParameterSetName = 'Named')] - [int] $LimitProcessing + [int] $LimitProcessing = [int32]::MaxValue ) Begin { Write-Verbose "Set-GPOZaurrOwner - Getting ADAdministrativeGroups" $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation - $Count = 0 Write-Verbose "Set-GPOZaurrOwner - Processing GPOs for Type $Type" } Process { - if ($Type) { - Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -ADAdministrativeGroups $ADAdministrativeGroups -OwnerOnly | ForEach-Object -Process { - $GPO = $_ - if ($Type -contains 'All') { - # Regardless who is the owner it is overwritten + $getGPOZaurrOwnerSplat = @{ + IncludeSysvol = $IncludeSysVol + Forest = $Forest + IncludeDomains = $IncludeDomains + ExcludeDomains = $ExcludeDomains + ExtendedForestInformation = $ExtendedForestInformation + ADAdministrativeGroups = $ADAdministrativeGroups + Verbose = $VerbosePreference + } + if ($GPOName) { + $getGPOZaurrOwnerSplat['GPOName'] = $GPOName + } elseif ($GPOGuid) { + $getGPOZaurrOwnerSplat['GPOGuid'] = $GPOGUiD + } + Get-GPOZaurrOwner @getGPOZaurrOwnerSplat | Where-Object { + if ($Type -contains 'NotAdministrative' -and $Type -notcontains 'All') { + if ($_.Owner) { + $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"] + if (-not $AdministrativeGroup) { + $_ + } + } + } elseif ($Type -contains 'Unknown' -and $Type -notcontains 'All') { + if ($null -eq $_.Owner) { + $_ + } + } else { + $_ + } + } | Select-Object -First $LimitProcessing | ForEach-Object -Process { + $GPO = $_ + if ($Principal) { + Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal" + Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference + } else { + $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] + Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal" + Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference + } + <# + if ($Type -contains 'All') { + # Regardless who is the owner it is overwritten + if ($Principal) { + Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal" + Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference + } else { + $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] + Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal" + Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference + } + $Count++ + if ($Count -eq $LimitProcessing) { + break + } + } elseif ($Type -contains 'NotAdministrative' -and $Type -notcontains 'All') { + if ($GPO.Owner) { + $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"] + if (-not $AdministrativeGroup) { + if ($Principal) { + Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal" + Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference + } else { + $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] + Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal" + Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference + } + $Count++ + if ($Count -eq $LimitProcessing) { + return + } + } + } + } else ($Type -contains 'Unknown' -and $Type -notcontains 'All') { + if ($null -eq $GPO.Owner) { if ($Principal) { - Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal" + Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $Principal" Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference } else { $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] - Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal" + Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $DefaultPrincipal" Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference } $Count++ @@ -56,44 +126,34 @@ break } } - if ($Type -contains 'NotAdministrative' -and $Type -notcontains 'All') { - if ($GPO.Owner) { - $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"] - if (-not $AdministrativeGroup) { - if ($Principal) { - Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal" - Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference - } else { - $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] - Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal" - Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference - } - $Count++ - if ($Count -eq $LimitProcessing) { - break - } - } - } - } - if ($Type -contains 'EmptyOrUnknown' -and $Type -notcontains 'All') { - if ($null -eq $GPO.Owner) { - if ($Principal) { - Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $Principal" - Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference - } else { - $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] - Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $DefaultPrincipal" - Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference - } - $Count++ - if ($Count -eq $LimitProcessing) { - break - } - } + } else { + $GPO = $_ + if ($Principal) { + Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal" + Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference + } else { + $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins'] + Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal" + Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference } } - } else { - Get-GPOZaurr -GPOName $GPOName -GPOGuid $GPOGUiD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Verbose:$false -ADAdministrativeGroups $ADAdministrativeGroups | ForEach-Object -Process { + #> + } + #> + #} + <# + else { + $getGPOZaurrOwnerSplat = @{ + IncludeSysvol = $IncludeSysVol + Forest = $Forest + IncludeDomains = $IncludeDomains + ExcludeDomains = $ExcludeDomains + ExtendedForestInformation = $ExtendedForestInformation + ADAdministrativeGroups = $ADAdministrativeGroups + GPOName = $GPOName + GPOGuid = $GPOGUiD + } + Get-GPOZaurrOwner @getGPOZaurrOwnerSplat $IncludeSysVol | ForEach-Object -Process { $GPO = $_ if ($Principal) { Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal" @@ -109,6 +169,7 @@ } } } + #> } End {