From d94bf276695d37d559dee4e9c924ca7ea150c207 Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Sat, 27 Jun 2020 17:04:19 +0200 Subject: [PATCH] Improvements to Find-GPO --- Private/Get-XMLAccount.ps1 | 32 ++++++++++ Private/Get-XMLSecurityOptions.ps1 | 29 +++++++++ Private/Get-XMLSoftwareInstallation.ps1 | 83 +++++++++++++++++++++++++ Private/Get-XMLStandard.ps1 | 43 +++++++++++++ Private/Get-XMLSystemServices.ps1 | 30 +++++++++ Public/Find-GPO.ps1 | 28 +++++++++ 6 files changed, 245 insertions(+) create mode 100644 Private/Get-XMLAccount.ps1 create mode 100644 Private/Get-XMLSecurityOptions.ps1 create mode 100644 Private/Get-XMLSoftwareInstallation.ps1 create mode 100644 Private/Get-XMLStandard.ps1 create mode 100644 Private/Get-XMLSystemServices.ps1 diff --git a/Private/Get-XMLAccount.ps1 b/Private/Get-XMLAccount.ps1 new file mode 100644 index 0000000..769dcc0 --- /dev/null +++ b/Private/Get-XMLAccount.ps1 @@ -0,0 +1,32 @@ +function Get-XMLAccount { + [cmdletBinding()] + param( + [PSCustomObject] $GPO, + [System.Xml.XmlElement[]] $GPOOutput, + [string] $Splitter = [System.Environment]::NewLine, + [switch] $FullObjects + ) + $LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects + foreach ($Type in @('User', 'Computer')) { + if ($GPOOutput.$Type.ExtensionData.Extension) { + foreach ($ExtensionType in $GPOOutput.$Type.ExtensionData.Extension) { + foreach ($Key in $ExtensionType.Account) { + [PSCustomObject] @{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.Guid + Linked = $LinksInformation.Linked + LinksCount = $LinksInformation.LinksCount + Links = $LinksInformation.Links + GpoType = $Type + Name = $Key.Name + Type = $Key.Type + SettingNumber = $Key.SettingNumber + SettingBoolean = if ($Key.SettingBoolean -eq 'true') { $true } elseif ($Key.SettingBoolean -eq 'false') { $false } else { $null } + } + } + } + } + } +} + diff --git a/Private/Get-XMLSecurityOptions.ps1 b/Private/Get-XMLSecurityOptions.ps1 new file mode 100644 index 0000000..483c99a --- /dev/null +++ b/Private/Get-XMLSecurityOptions.ps1 @@ -0,0 +1,29 @@ +function Get-XMLSecurityOptions { + [cmdletBinding()] + param( + [PSCustomObject] $GPO, + [System.Xml.XmlElement[]] $GPOOutput, + [string] $Splitter = [System.Environment]::NewLine, + [switch] $FullObjects + ) + $LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects + foreach ($Type in @('User', 'Computer')) { + if ($GPOOutput.$Type.ExtensionData.Extension) { + foreach ($ExtensionType in $GPOOutput.$Type.ExtensionData.Extension) { + foreach ($Key in $ExtensionType.SecurityOptions) { + [PSCustomObject] @{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.Guid + Linked = $LinksInformation.Linked + LinksCount = $LinksInformation.LinksCount + Links = $LinksInformation.Links + GpoType = $Type + SystemAccessPolicyName = $Key.SystemAccessPolicyName + SettingNumber = $Key.SettingNumber + } + } + } + } + } +} \ No newline at end of file diff --git a/Private/Get-XMLSoftwareInstallation.ps1 b/Private/Get-XMLSoftwareInstallation.ps1 new file mode 100644 index 0000000..5a466e5 --- /dev/null +++ b/Private/Get-XMLSoftwareInstallation.ps1 @@ -0,0 +1,83 @@ +function Get-XMLSoftwareInstallation { + [cmdletBinding()] + param( + [PSCustomObject] $GPO, + [System.Xml.XmlElement[]] $GPOOutput, + [string] $Splitter = [System.Environment]::NewLine, + [switch] $FullObjects + ) + $LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects + foreach ($Type in @('User', 'Computer')) { + if ($GPOOutput.$Type.ExtensionData.Extension) { + foreach ($ExtensionType in $GPOOutput.$Type.ExtensionData.Extension) { + foreach ($Key in $ExtensionType.MsiApplication) { + if ($FullObjects) { + [PSCustomObject] @{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.Guid + Linked = $LinksInformation.Linked + LinksCount = $LinksInformation.LinksCount + Links = $LinksInformation.Links + GpoType = $Type + Identifier = $Key.Identifier #: { 10495e9e-79c1-4a32-b278-a24cd495437f } + Name = $Key.Name #: Local Administrator Password Solution (2) + Path = $Key.Path #: \\area1.local\SYSVOL\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\LAPS.x64.msi + MajorVersion = $Key.MajorVersion #: 6 + MinorVersion = $Key.MinorVersion #: 2 + LanguageId = $Key.LanguageId #: 1033 + Architecture = $Key.Architecture #: 9 + IgnoreLanguage = if ($Key.IgnoreLanguage -eq 'true') { $true } else { $false } #: false + Allowx86Onia64 = if ($Key.Allowx86Onia64 -eq 'true') { $true } else { $false } #: true + SupportURL = $Key.SupportURL #: + AutoInstall = if ($Key.AutoInstall -eq 'true') { $true } else { $false } #: true + DisplayInARP = if ($Key.DisplayInARP -eq 'true') { $true } else { $false } #: true + IncludeCOM = if ($Key.IncludeCOM -eq 'true') { $true } else { $false } #: true + SecurityDescriptor = $Key.SecurityDescriptor #: SecurityDescriptor + DeploymentType = $Key.DeploymentType #: Assign + ProductId = $Key.ProductId #: { ea8cb806-c109 - 4700 - 96b4-f1f268e5036c } + ScriptPath = $Key.ScriptPath #: \\area1.local\SysVol\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\Machine\Applications\ { EAC9B821-FB4D - 457A-806F-E5B528D1E41A }.aas + DeploymentCount = $Key.DeploymentCount #: 0 + InstallationUILevel = $Key.InstallationUILevel #: Maximum + Upgrades = if ($Key.Upgrades.Mandatory -eq 'true') { $true } else { $false } #: Upgrades + UninstallUnmanaged = if ($Key.UninstallUnmanaged -eq 'true') { $true } else { $false } #: false + LossOfScopeAction = $Key.LossOfScopeAction #: Unmanage + } + } else { + [PSCustomObject] @{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.Guid + Linked = $LinksInformation.Linked + LinksCount = $LinksInformation.LinksCount + Links = $LinksInformation.Links + GpoType = $Type + Identifier = $Key.Identifier #: { 10495e9e-79c1-4a32-b278-a24cd495437f } + Name = $Key.Name #: Local Administrator Password Solution (2) + Path = $Key.Path #: \\area1.local\SYSVOL\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\LAPS.x64.msi + MajorVersion = $Key.MajorVersion #: 6 + MinorVersion = $Key.MinorVersion #: 2 + LanguageId = $Key.LanguageId #: 1033 + Architecture = $Key.Architecture #: 9 + IgnoreLanguage = if ($Key.IgnoreLanguage -eq 'true') { $true } else { $false } #: false + Allowx86Onia64 = if ($Key.Allowx86Onia64 -eq 'true') { $true } else { $false } #: true + SupportURL = $Key.SupportURL #: + AutoInstall = if ($Key.AutoInstall -eq 'true') { $true } else { $false } #: true + DisplayInARP = if ($Key.DisplayInARP -eq 'true') { $true } else { $false } #: true + IncludeCOM = if ($Key.IncludeCOM -eq 'true') { $true } else { $false } #: true + SecurityDescriptor = $Key.SecurityDescriptor #: SecurityDescriptor + DeploymentType = $Key.DeploymentType #: Assign + ProductId = $Key.ProductId #: { ea8cb806-c109 - 4700 - 96b4-f1f268e5036c } + ScriptPath = $Key.ScriptPath #: \\area1.local\SysVol\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\Machine\Applications\ { EAC9B821-FB4D - 457A-806F-E5B528D1E41A }.aas + DeploymentCount = $Key.DeploymentCount #: 0 + InstallationUILevel = $Key.InstallationUILevel #: Maximum + Upgrades = if ($Key.Upgrades.Mandatory -eq 'true') { $true } else { $false } #: Upgrades + UninstallUnmanaged = if ($Key.UninstallUnmanaged -eq 'true') { $true } else { $false } #: false + LossOfScopeAction = $Key.LossOfScopeAction #: Unmanage + } + } + } + } + } + } +} \ No newline at end of file diff --git a/Private/Get-XMLStandard.ps1 b/Private/Get-XMLStandard.ps1 new file mode 100644 index 0000000..7086e03 --- /dev/null +++ b/Private/Get-XMLStandard.ps1 @@ -0,0 +1,43 @@ +function Get-XMLStandard { + [cmdletBinding()] + param( + [PSCustomObject] $GPO, + [System.Xml.XmlElement[]] $GPOOutput, + [string] $Splitter = [System.Environment]::NewLine, + [switch] $FullObjects + ) + $LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects + foreach ($Type in @('User', 'Computer')) { + if ($GPOOutput.$Type.ExtensionData.Extension) { + foreach ($ExtensionType in $GPOOutput.$Type.ExtensionData.Extension) { + $GPOSettingType = ($ExtensionType.type -split ':')[1] + Write-Warning $GPOSettingType + foreach ($Key in $ExtensionType.Account) { + [PSCustomObject] @{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.Guid + Linked = $LinksInformation.Linked + LinksCount = $LinksInformation.LinksCount + Links = $LinksInformation.Links + GpoType = $Type + Name = $Key.Name + Type = $Key.Type + SettingNumber = $Key.SettingNumber + SettingBoolean = if ($Key.SettingBoolean -eq 'true') { $true } elseif ($Key.SettingBoolean -eq 'false') { $false } else { $null } + } + } + } + } + } +} + +<# +q1 : http://www.microsoft.com/GroupPolicy/Settings/Security +type : q1:SecuritySettings +Account : {ClearTextPassword, LockoutBadCount, LockoutDuration, MaximumPasswordAge...} +SecurityOptions : SecurityOptions +SystemServices : SystemServices +#> + +#$GPOSettingType = ($ExtensionType.type -split ':')[1] diff --git a/Private/Get-XMLSystemServices.ps1 b/Private/Get-XMLSystemServices.ps1 new file mode 100644 index 0000000..071a7bd --- /dev/null +++ b/Private/Get-XMLSystemServices.ps1 @@ -0,0 +1,30 @@ +function Get-XMLSystemServices { + [cmdletBinding()] + param( + [PSCustomObject] $GPO, + [System.Xml.XmlElement[]] $GPOOutput, + [string] $Splitter = [System.Environment]::NewLine, + [switch] $FullObjects + ) + $LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects + foreach ($Type in @('User', 'Computer')) { + if ($GPOOutput.$Type.ExtensionData.Extension) { + foreach ($ExtensionType in $GPOOutput.$Type.ExtensionData.Extension) { + foreach ($Key in $ExtensionType.SystemServices) { + [PSCustomObject] @{ + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.Guid + Linked = $LinksInformation.Linked + LinksCount = $LinksInformation.LinksCount + Links = $LinksInformation.Links + GpoType = $Type + Name = $Key.Name + StartupMode = $Key.StartupMode + + } + } + } + } + } +} \ No newline at end of file diff --git a/Public/Find-GPO.ps1 b/Public/Find-GPO.ps1 index 14ceecd..916f678 100644 --- a/Public/Find-GPO.ps1 +++ b/Public/Find-GPO.ps1 @@ -16,6 +16,10 @@ 'RegistrySettings' 'RegistryPolicies' 'Scripts' + 'SoftwareInstallation' + 'SecurityOptions' + 'Account' + 'SystemServices' ), [Parameter(ParameterSetName = 'Default')] [Parameter(ParameterSetName = 'Local')] @@ -103,6 +107,30 @@ $Output['Scripts'].Add($D) } } + if ($Type -contains 'SoftwareInstallation') { + [Array] $Data = Get-XMLSoftwareInstallation -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects + foreach ($D in $Data) { + $Output['SoftwareInstallation'].Add($D) + } + } + if ($Type -contains 'SecurityOptions') { + [Array] $Data = Get-XMLSecurityOptions -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects + foreach ($D in $Data) { + $Output['SecurityOptions'].Add($D) + } + } + if ($Type -contains 'Account') { + [Array] $Data = Get-XMLAccount -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects + foreach ($D in $Data) { + $Output['Account'].Add($D) + } + } + if ($Type -contains 'SystemServices') { + [Array] $Data = Get-XMLSystemServices -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects + foreach ($D in $Data) { + $Output['SystemServices'].Add($D) + } + } } $Output } \ No newline at end of file