From ec30c5457767ffb23728e815408e29126a8797ef Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Thu, 13 Aug 2020 09:40:35 +0200 Subject: [PATCH] Update CSE --- Examples/Example-35-FindCSE.ps1 | 21 +++++++++++++++++++++ GPOZaurr.psd1 | 2 +- Public/ConvertFrom-CSExtension.ps1 | 21 ++++++++++++++++----- Public/Find-CSExtension.ps1 | 19 ++++++++++++------- README.md | 2 ++ 5 files changed, 52 insertions(+), 13 deletions(-) create mode 100644 Examples/Example-35-FindCSE.ps1 diff --git a/Examples/Example-35-FindCSE.ps1 b/Examples/Example-35-FindCSE.ps1 new file mode 100644 index 0000000..6e125e2 --- /dev/null +++ b/Examples/Example-35-FindCSE.ps1 @@ -0,0 +1,21 @@ +Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force + +# Extracts CSE from registry +$AllRegistryExtensions = Find-CSExtension +$AllRegistryExtensions | Format-Table + +# Uses Hashtable - similar to above but much faster +$AllRegistryExtensionsFaster = foreach ($CSE in $AllRegistryExtensions) { + ConvertFrom-CSExtension -CSE $CSE.CSE +} +$AllRegistryExtensionsFaster | Format-Table + +# With this we can find out if we're missing anything in hashtable so we can update code if nessecary +$MissingEntries = foreach ($CSE in $AllRegistryExtensions) { + $Output = ConvertFrom-CSExtension -CSE $CSE.CSE + if ($Output.CSE -eq $Output.Description) { + # THis means the value in hashtable is missing this entry and we should add it + $CSE + } +} +$MissingEntries | Format-Table \ No newline at end of file diff --git a/GPOZaurr.psd1 b/GPOZaurr.psd1 index 36fb34a..c8dd3bb 100644 --- a/GPOZaurr.psd1 +++ b/GPOZaurr.psd1 @@ -5,7 +5,7 @@ CompatiblePSEditions = 'Desktop' Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.' Description = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.' - FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner' + FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner' GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde' ModuleVersion = '0.0.52' PowerShellVersion = '5.1' diff --git a/Public/ConvertFrom-CSExtension.ps1 b/Public/ConvertFrom-CSExtension.ps1 index 60f0aea..e715ed2 100644 --- a/Public/ConvertFrom-CSExtension.ps1 +++ b/Public/ConvertFrom-CSExtension.ps1 @@ -1,7 +1,8 @@ function ConvertFrom-CSExtension { [cmdletBinding()] param( - [string] $CSE + [string[]] $CSE, + [switch] $Limited ) $GUIDs = @{ # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpreg/f0dba6b8-704f-45d5-999f-1a0a694a6df9 @@ -70,9 +71,19 @@ function ConvertFrom-CSExtension { '{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}' = 'EFS Recovery' '{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}' = 'Internet Explorer Settings' } - if ($GUIDs[$CSE]) { - return $GUIDs[$CSE] - } else { - return $CSE + foreach ($C in $CSE) { + if (-not $Limited) { + if ($GUIDs[$C]) { + [PSCustomObject] @{ Name = $C; Description = $GUIDs[$C] } + } else { + [PSCustomObject] @{ Name = $C; Description = $C } + } + } else { + if ($GUIDs[$C]) { + $GUIDs[$C] + } else { + $CSE + } + } } } \ No newline at end of file diff --git a/Public/Find-CSExtension.ps1 b/Public/Find-CSExtension.ps1 index bf966d1..f9e5757 100644 --- a/Public/Find-CSExtension.ps1 +++ b/Public/Find-CSExtension.ps1 @@ -1,16 +1,21 @@ function Find-CSExtension { [cmdletBinding()] param( - [string] $CSE + [string[]] $CSE, + [string] $ComputerName ) - #List Group Policy Client Side Extensions, CSEs, from Windows 10 - $Keys = Get-PSRegistry -RegistryPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" -ComputerName AD3 + $Keys = Get-PSRegistry -RegistryPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" -ComputerName $ComputerName foreach ($Key in $Keys.PSSubKeys) { - $Value = (Get-PSRegistry -RegistryPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\$Key" -ComputerName AD3).DefaultKey - - if (-not $GUIDs[$Key]) { - "$Key $Value" + $RegistryKey = Get-PSRegistry -RegistryPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\$Key" -ComputerName $ComputerName + if ($CSE) { + foreach ($C in CSE) { + if ($RegistryKey.DefaultKey -eq $Key) { + [PSCustomObject] @{ Name = $Key; Description = $RegistryKey.DefaultKey } + } + } + } else { + [PSCustomObject] @{ CSE = $Key; Description = $RegistryKey.DefaultKey } } } } \ No newline at end of file diff --git a/README.md b/README.md index 9df9389..c0bd61b 100644 --- a/README.md +++ b/README.md @@ -41,6 +41,8 @@ That's it. Whenever there's a new version, you run the command, and you can enjo - 0.0.52 - Unreleased - Added `Invoke-GPOZaurrSupport` (WIP) + - Added `ConvertFrom-CSExtension` + - Added `Find-CSExtension` - 0.0.51 - 2.08.2020 - Updates to `Invoke-GPOZaurr` - still work in progress - Added `Get-GPOZaurrSysvolDFSR`