gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-31 12:47:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-10-28 18:25:21 +01:00
parent 901be9fc66
commit e5d897d354
7 changed files with 117 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Public/Get-GPOZaurrNetlogon.ps1
+16 -12
View File
@@ -7,11 +7,12 @@
$ForestInformation = Get-WinADForestDetails -Extended
$FilesAll = foreach ($Domain in $ForestInformation.Domains) {
$Path = -join ("\\", $Domain, '\Netlogon')
$PathOnSysvol = -join ("\\", $Domain, "\SYSVOL\", $Domain, "\Scripts")
$Files = Get-ChildItem -LiteralPath $Path -Recurse -Force
foreach ($_ in $Files) {
$ACL = Get-Acl -Path $_.FullName
if ($ACL.Owner) {
$IdentityOwner = Convert-Identity -Identity $ACL.Owner
$IdentityOwner = Convert-Identity -Identity $ACL.Owner -Verbose:$false
} else {
$IdentityOwner = [PSCustomObject] @{ SID = ''; Type = 'Uknown' }
}
@@ -30,12 +31,13 @@
PrincipalType = $IdentityOwner.Type
FileSystemRights = 'Owner' # : FullControl
IsInherited = $false
FullNameOnSysVol = $_.FullName.Replace($Path, $PathOnSysvol)
#Owner = $ACL.Owner
}
}
$FilePermission = Get-FilePermissions -Path $_.FullName -ACLS $ACL
$FilePermission = Get-FilePermissions -Path $_.FullName -ACLS $ACL -Verbose:$false
foreach ($Perm in $FilePermission) {
$Identity = Convert-Identity -Identity $Perm.Principal
$Identity = Convert-Identity -Identity $Perm.Principal -Verbose:$false
[PSCustomObject] @{
FullName = $_.FullName
Extension = $_.Extension
@@ -49,19 +51,21 @@
PrincipalType = $Identity.Type
FileSystemRights = $Perm.FileSystemRights # : FullControl
IsInherited = $Perm.IsInherited # : True
FullNameOnSysVol = $_.FullName.Replace($Path, $PathOnSysvol)
}
}
} else {
[PSCustomObject] @{
FullName = $_.FullName
Extension = $_.Extension
CreationTime = $_.CreationTime
LastAccessTime = $_.LastAccessTime
LastWriteTime = $_.LastWriteTime
Attributes = $_.Attributes
Owner = $IdentityOwner.Name
OwnerSid = $IdentityOwner.SID
OwnerType = $IdentityOwner.Type
FullName = $_.FullName
Extension = $_.Extension
CreationTime = $_.CreationTime
LastAccessTime = $_.LastAccessTime
LastWriteTime = $_.LastWriteTime
Attributes = $_.Attributes
Owner = $IdentityOwner.Name
OwnerSid = $IdentityOwner.SID
OwnerType = $IdentityOwner.Type
FullNameOnSysVol = $_.FullName.Replace($Path, $PathOnSysvol)
}
}
}
Public/Invoke-GPOZaurr.ps1
+4 -18
View File
@@ -278,14 +278,7 @@
New-HTMLPanel {
New-HTMLText -Text 'Following chart presents ', 'NetLogon Summary' -FontSize 10pt -FontWeight normal, bold
New-HTMLList -Type Unordered {
New-HTMLListItem -Text 'NetLogon Files in Total: ', $NetLogonOwners.Count -FontWeight normal, bold
New-HTMLListItem -Text 'NetLogon BUILTIN\Administrators as Owner: ', $NetLogonOwnersAdministrators.Count -FontWeight normal, bold
New-HTMLListItem -Text "NetLogon Owners requiring change: ", $NetLogonOwnersToFix.Count -FontWeight normal, bold {
New-HTMLList -Type Unordered {
New-HTMLListItem -Text 'Not Administrative: ', $NetLogonOwnersNotAdministrative.Count -FontWeight normal, bold
New-HTMLListItem -Text 'Administrative, but not BUILTIN\Administrators: ', $NetLogonOwnersAdministrativeNotAdministrators.Count -FontWeight normal, bold
}
}
& $Script:GPOConfiguration['NetLogon']['List']
} -FontSize 10pt
#New-HTMLText -FontSize 10pt -Text 'Those problems must be resolved before doing other clenaup activities.'
New-HTMLChart {
@@ -387,14 +380,7 @@
"That's why as a best-practice it's recommended to change any non-administrative owners to BUILTIN\Administrators, and even Administrative accounts should be replaced with it. "
} -FontSize 10pt
New-HTMLList -Type Unordered {
New-HTMLListItem -Text 'NetLogon Files in Total: ', $NetLogonOwners.Count -FontWeight normal, bold
New-HTMLListItem -Text 'NetLogon BUILTIN\Administrators as Owner: ', $NetLogonOwnersAdministrators.Count -FontWeight normal, bold
New-HTMLListItem -Text "NetLogon Owners requiring change: ", $NetLogonOwnersToFix.Count -FontWeight normal, bold {
New-HTMLList -Type Unordered {
New-HTMLListItem -Text 'Not Administrative: ', $NetLogonOwnersNotAdministrative.Count -FontWeight normal, bold
New-HTMLListItem -Text 'Administrative, but not BUILTIN\Administrators: ', $NetLogonOwnersAdministrativeNotAdministrators.Count -FontWeight normal, bold
}
}
& $Script:GPOConfiguration['NetLogon']['List']
} -FontSize 10pt
New-HTMLText -Text "Follow the steps below table to get NetLogon Owners into compliant state." -FontSize 10pt
}
@@ -405,12 +391,12 @@
New-HTMLTableCondition -Name 'PrincipalType' -Value "WellKnownAdministrative" -BackgroundColor LightGreen -ComparisonType string -Operator eq
}
}
New-HTMLSection -Name 'Steps to fix - Owners ' {
New-HTMLSection -Name 'Steps to fix NetLogon Owners ' {
New-HTMLContainer {
New-HTMLSpanStyle -FontSize 10pt {
New-HTMLText -Text 'Following steps will guide you how to fix NetLogon Owners and make them compliant.'
New-HTMLWizard {
#& $Script:GPOConfiguration['GPOOrphans']['Wizard']
& $Script:GPOConfiguration['NetLogon']['Wizard']
} -RemoveDoneStepOnNavigateBack -Theme arrows -ToolbarButtonPosition center
}
}
Public/Repair-GPOZaurrNetLogonOwner.ps1
+27
View File
@@ -0,0 +1,27 @@
function Repair-GPOZaurrNetLogonOwner {
[cmdletBinding(SupportsShouldProcess)]
param(
[alias('ForestName')][string] $Forest,
[string[]] $ExcludeDomains,
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
[System.Collections.IDictionary] $ExtendedForestInformation,
[string] $Principal = 'S-1-5-32-544',
[int] $LimitProcessing = [int32]::MaxValue
)
$Identity = Convert-Identity -Identity $Principal -Verbose:$false
if ($Identity.Error) {
Write-Warning "Repair-GPOZaurrNetLogonOwner - couldn't convert Identity $Principal to desired name. Error: $($Identity.Error)"
return
}
$Principal = $Identity.Name
Get-GPOZaurrNetLogon -OwnerOnly | Select-Object -First $LimitProcessing | Where-Object {
if ($_.OwnerSid -ne 'S-1-5-32-544') {
$_
}
} | ForEach-Object {
if ($PSCmdlet.ShouldProcess($_.FullName, "Setting NetLogon Owner to $($Principal)")) {
Set-FileOwner -JustPath -Path $_.FullName -Owner $Principal -Verbose:$true -WhatIf:$WhatIfPreference
}
}
}