Update CSE

This commit is contained in:
Przemyslaw Klys
2020-08-13 09:40:35 +02:00
parent 1974eb2a39
commit ec30c54577
5 changed files with 52 additions and 13 deletions
+21
View File
@@ -0,0 +1,21 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
# Extracts CSE from registry
$AllRegistryExtensions = Find-CSExtension
$AllRegistryExtensions | Format-Table
# Uses Hashtable - similar to above but much faster
$AllRegistryExtensionsFaster = foreach ($CSE in $AllRegistryExtensions) {
ConvertFrom-CSExtension -CSE $CSE.CSE
}
$AllRegistryExtensionsFaster | Format-Table
# With this we can find out if we're missing anything in hashtable so we can update code if nessecary
$MissingEntries = foreach ($CSE in $AllRegistryExtensions) {
$Output = ConvertFrom-CSExtension -CSE $CSE.CSE
if ($Output.CSE -eq $Output.Description) {
# THis means the value in hashtable is missing this entry and we should add it
$CSE
}
}
$MissingEntries | Format-Table
+1 -1
View File
@@ -5,7 +5,7 @@
CompatiblePSEditions = 'Desktop'
Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
Description = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
ModuleVersion = '0.0.52'
PowerShellVersion = '5.1'
+16 -5
View File
@@ -1,7 +1,8 @@
function ConvertFrom-CSExtension {
[cmdletBinding()]
param(
[string] $CSE
[string[]] $CSE,
[switch] $Limited
)
$GUIDs = @{
# https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpreg/f0dba6b8-704f-45d5-999f-1a0a694a6df9
@@ -70,9 +71,19 @@ function ConvertFrom-CSExtension {
'{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}' = 'EFS Recovery'
'{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}' = 'Internet Explorer Settings'
}
if ($GUIDs[$CSE]) {
return $GUIDs[$CSE]
} else {
return $CSE
foreach ($C in $CSE) {
if (-not $Limited) {
if ($GUIDs[$C]) {
[PSCustomObject] @{ Name = $C; Description = $GUIDs[$C] }
} else {
[PSCustomObject] @{ Name = $C; Description = $C }
}
} else {
if ($GUIDs[$C]) {
$GUIDs[$C]
} else {
$CSE
}
}
}
}
+12 -7
View File
@@ -1,16 +1,21 @@
function Find-CSExtension {
[cmdletBinding()]
param(
[string] $CSE
[string[]] $CSE,
[string] $ComputerName
)
#List Group Policy Client Side Extensions, CSEs, from Windows 10
$Keys = Get-PSRegistry -RegistryPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" -ComputerName AD3
$Keys = Get-PSRegistry -RegistryPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" -ComputerName $ComputerName
foreach ($Key in $Keys.PSSubKeys) {
$Value = (Get-PSRegistry -RegistryPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\$Key" -ComputerName AD3).DefaultKey
if (-not $GUIDs[$Key]) {
"$Key $Value"
$RegistryKey = Get-PSRegistry -RegistryPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\$Key" -ComputerName $ComputerName
if ($CSE) {
foreach ($C in CSE) {
if ($RegistryKey.DefaultKey -eq $Key) {
[PSCustomObject] @{ Name = $Key; Description = $RegistryKey.DefaultKey }
}
}
} else {
[PSCustomObject] @{ CSE = $Key; Description = $RegistryKey.DefaultKey }
}
}
}
+2
View File
@@ -41,6 +41,8 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
- 0.0.52 - Unreleased
- Added `Invoke-GPOZaurrSupport` (WIP)
- Added `ConvertFrom-CSExtension`
- Added `Find-CSExtension`
- 0.0.51 - 2.08.2020
- Updates to `Invoke-GPOZaurr` - still work in progress
- Added `Get-GPOZaurrSysvolDFSR`