From c8ee43ee49d3315e418d0c173ef96a151f586302 Mon Sep 17 00:00:00 2001
From: Przemyslaw Klys <przemyslaw.klys@evotec.pl>
Date: Mon, 11 May 2020 11:08:03 +0200
Subject: [PATCH] Update to Remove-PrivPermission

---
 Private/Get-PrivPermission.ps1 | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/Private/Get-PrivPermission.ps1 b/Private/Get-PrivPermission.ps1
index 500dd9d..94402a0 100644
--- a/Private/Get-PrivPermission.ps1
+++ b/Private/Get-PrivPermission.ps1
@@ -2,6 +2,10 @@
     [cmdletBinding()]
     param(
         [Microsoft.GroupPolicy.Gpo] $GPO,
+
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
         [switch] $SkipWellKnown,
         [switch] $SkipAdministrative,
         [switch] $IncludeOwner,
@@ -9,7 +13,7 @@
         [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
         [switch] $IncludeGPOObject,
         [System.Collections.IDictionary] $ADAdministrativeGroups,
-        [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type,
+        [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All', 'Default')][string[]] $Type,
         [System.Collections.IDictionary] $Accounts
     )
     Begin {
@@ -58,6 +62,22 @@
                     return
                 }
             }
+            if ($Principal) {
+                if ($PrincipalType -eq 'Sid') {
+                    if ($Principal -notcontains $GPOPermission.Trustee.Sid.Value) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'DistinguishedName') {
+                    if ($Principal -notcontains $GPOPermission.Trustee.DSPath) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'Name') {
+                    $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                    if ($Principal -notcontains $UserMerge -and $Principal -notcontains $GPOPermission.Trustee.Name) {
+                        return
+                    }
+                }
+            }
             $ReturnObject = [ordered] @{
                 DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
                 GUID              = $GPO.ID
@@ -105,7 +125,7 @@
             if ($IncludeGPOObject) {
                 $ReturnObject['GPOObject'] = $GPO
                 $ReturnObject['GPOSecurity'] = $SecurityRights
-                $ReturnObject['GPOSecurityPermissionIndex'] = $GPOPermission
+                $ReturnObject['GPOSecurityPermissionItem'] = $GPOPermission
             }
             [PSCustomObject] $ReturnObject
         }
@@ -175,7 +195,7 @@
             if ($IncludeGPOObject) {
                 $ReturnObject['GPOObject'] = $GPO
                 $ReturnObject['GPOSecurity'] = $SecurityRights
-                $ReturnObject['GPOSecurityPermissionIndex'] = $null
+                $ReturnObject['GPOSecurityPermissionItem'] = $null
             }
             [PSCustomObject] $ReturnObject
         }