From db7838fc18d278d7cd8da09f01b39581e8853534 Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Tue, 26 May 2020 18:31:57 +0200 Subject: [PATCH] Update SYSVOL/WMI --- Public/Get-GPOZaurrSysvol.ps1 | 25 ++++--- Public/Get-GPOZaurrWmi.ps1 | 121 ++++++++++++++++------------------ Public/New-GPOZaurrWMi.ps1 | 5 +- 3 files changed, 71 insertions(+), 80 deletions(-) diff --git a/Public/Get-GPOZaurrSysvol.ps1 b/Public/Get-GPOZaurrSysvol.ps1 index 9f0f409..57a469d 100644 --- a/Public/Get-GPOZaurrSysvol.ps1 +++ b/Public/Get-GPOZaurrSysvol.ps1 @@ -12,23 +12,22 @@ [switch] $VerifyDomainControllers ) $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExcludeDomainControllers $ExcludeDomainControllers -IncludeDomainControllers $IncludeDomainControllers -SkipRODC:$SkipRODC -ExtendedForestInformation $ExtendedForestInformation - if (-not $VerifyDomainControllers) { - foreach ($Domain in $ForestInformation.Domains) { - Write-Verbose "Get-WinADGPOSysvolFolders - Processing $Domain" - $QueryServer = $ForestInformation['QueryServers']["$Domain"].HostName[0] - [Array]$GPOs = @(Get-GPO -All -Domain $Domain -Server $QueryServer) - Test-SysVolFolders -GPOs $GPOs -Server $Domain -Domain $Domain + foreach ($Domain in $ForestInformation.Domains) { + Write-Verbose "Get-WinADGPOSysvolFolders - Processing $Domain" + $QueryServer = $ForestInformation['QueryServers']["$Domain"].HostName[0] + Try { + [Array]$GPOs = Get-GPO -All -Domain $Domain -Server $QueryServer + } catch { + Write-Warning "Get-GPOZaurrSysvol - Couldn't get GPOs from $Domain. Error: $($_.Exception.Message)" + continue } - } else { - foreach ($Domain in $ForestInformation.Domains) { - Write-Verbose "Get-WinADGPOSysvolFolders - Processing $Domain" - $QueryServer = $ForestInformation['QueryServers']["$Domain"].HostName[0] - [Array]$GPOs = @(Get-GPO -All -Domain $Domain -Server $QueryServer) + if (-not $VerifyDomainControllers) { + Test-SysVolFolders -GPOs $GPOs -Server $Domain -Domain $Domain + } else { foreach ($Server in $ForestInformation['DomainDomainControllers']["$Domain"]) { Write-Verbose "Get-WinADGPOSysvolFolders - Processing $Domain \ $($Server.HostName.Trim())" Test-SysVolFolders -GPOs $GPOs -Server $Server.Hostname -Domain $Domain } } } -} - +} \ No newline at end of file diff --git a/Public/Get-GPOZaurrWmi.ps1 b/Public/Get-GPOZaurrWmi.ps1 index 290ebc6..3ec62d0 100644 --- a/Public/Get-GPOZaurrWmi.ps1 +++ b/Public/Get-GPOZaurrWmi.ps1 @@ -1,4 +1,11 @@ -function Get-GPOZaurrWMI { +function Get-WMIFilter { + param( + + ) + +} + +function Get-GPOZaurrWMI { [cmdletBinding()] Param( [Guid[]] $Guid, @@ -13,79 +20,63 @@ $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation foreach ($Domain in $ForestInformation.Domains) { $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0] - if ($Guid -or $Name) { - foreach ($N in $Name) { - try { - $ldapFilter = "(&(objectClass=msWMI-Som)(msWMI-Name=$N))" - Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process { - $WMI = $_.'msWMI-Parm2' -split ';' - [PSCustomObject] @{ - DisplayName = $_.'msWMI-Name' - Description = $_.'msWMI-Parm1' - DomainName = $Domain - NameSpace = $WMI[5] - Query = $WMI[6] - Author = $_.'msWMI-Author' - ID = $_.'msWMI-ID' - Created = $_.Created - Modified = $_.Modified - ObjectGUID = $_.'ObjectGUID' - CanonicalName = $_.CanonicalName - DistinguishedName = $_.'DistinguishedName' - } + $Objects = @( + if ($Name) { + foreach ($N in $Name) { + try { + $ldapFilter = "(&(objectClass=msWMI-Som)(msWMI-Name=$N))" + Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer + } catch { + Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)" } + } + } elseif ($GUID) { + foreach ($G in $GUID) { + try { + $ldapFilter = "(&(objectClass=msWMI-Som)(Name={$G}))" + Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer + } catch { + Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)" + } + } + } else { + try { + $ldapFilter = "(objectClass=msWMI-Som)" + Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer } catch { Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)" } } - foreach ($G in $GUID) { - $ldapFilter = "(&(objectClass=msWMI-Som)(Name={$G}))" - try { - Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process { - $WMI = $_.'msWMI-Parm2' -split ';' - [PSCustomObject] @{ - DisplayName = $_.'msWMI-Name' - Description = $_.'msWMI-Parm1' - DomainName = $Domain - NameSpace = $WMI[5] - Query = $WMI[6] - Author = $_.'msWMI-Author' - ID = $_.'msWMI-ID' - Created = $_.Created - Modified = $_.Modified - ObjectGUID = $_.'ObjectGUID' - CanonicalName = $_.CanonicalName - DistinguishedName = $_.'DistinguishedName' - } - } - } catch { - Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)" + ) + foreach ($_ in $Objects) { + $WMI = $_.'msWMI-Parm2' -split ';' #$WMI = $_.'msWMI-Parm2'.Split(';',8) + [Array] $Data = for ($i = 0; $i -lt $WMI.length; $i += 6) { + if ($WMI[$i + 5]) { + #[PSCustomObject] @{ + # NameSpace = $WMI[$i + 5] + # Query = $WMI[$i + 6] + #} + -join ($WMI[$i + 5], ';' , $WMI[$i + 6]) } } - } else { - $ldapFilter = "(objectClass=msWMI-Som)" - try { - Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process { - $WMI = $_.'msWMI-Parm2' -split ';' - [PSCustomObject] @{ - DisplayName = $_.'msWMI-Name' - Description = $_.'msWMI-Parm1' - DomainName = $Domain - NameSpace = $WMI[5] - Query = $WMI[6] - Author = $_.'msWMI-Author' - ID = $_.'msWMI-ID' - Created = $_.Created - Modified = $_.Modified - ObjectGUID = $_.'ObjectGUID' - CanonicalName = $_.CanonicalName - DistinguishedName = $_.'DistinguishedName' - } - } - } catch { - Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)" + [PSCustomObject] @{ + DisplayName = $_.'msWMI-Name' + Description = $_.'msWMI-Parm1' + DomainName = $Domain + #NameSpace = $WMI[$i + 5] + #Query = $WMI[$i + 6] + QueryCount = $Data.Count + Query = $Data -join "," + Author = $_.'msWMI-Author' + ID = $_.'msWMI-ID' + Created = $_.Created + Modified = $_.Modified + ObjectGUID = $_.'ObjectGUID' + CanonicalName = $_.CanonicalName + DistinguishedName = $_.'DistinguishedName' } } + } } <# diff --git a/Public/New-GPOZaurrWMi.ps1 b/Public/New-GPOZaurrWMi.ps1 index efedfdc..aee35a4 100644 --- a/Public/New-GPOZaurrWMi.ps1 +++ b/Public/New-GPOZaurrWMi.ps1 @@ -3,6 +3,7 @@ param( [parameter(Mandatory)][string] $Name, [string] $Description = ' ', + [string] $Namespace = 'root\CIMv2', [parameter(Mandatory)][string] $Query, [switch] $SkipQueryCheck, [switch] $Force, @@ -50,7 +51,7 @@ [Array] $ExistingWmiFilter = Get-GPOZaurrWMI -ExtendedForestInformation $ForestInformation -IncludeDomains $Domain -Name $Name if ($ExistingWmiFilter.Count -eq 0) { - [string] $WMIParm2 = -join ("1;3;10;", $Query.Length.ToString(), ";WQL;root\CIMv2;", $Query , ";") + [string] $WMIParm2 = -join ("1;3;10;", $Query.Length.ToString(), ";WQL;$Namespace;", $Query , ";") $OtherAttributes = @{ "msWMI-Name" = $Name "msWMI-Parm1" = $Description @@ -67,7 +68,7 @@ try { Write-Verbose "New-GPOZaurrWMI - Creating WMI filter $Name in $Domain" - New-ADObject -name $GUID -type "msWMI-Som" -Path $WMIPath -OtherAttributes $OtherAttributes -Server $QueryServer + New-ADObject -Name $GUID -Type "msWMI-Som" -Path $WMIPath -OtherAttributes $OtherAttributes -Server $QueryServer } catch { Write-Warning "New-GPOZaurrWMI - Creating GPO filter error $($_.Exception.Message). Terminating." return