This is disaster

This commit is contained in:
Przemysław Kłys
2020-04-26 19:43:02 +02:00
parent f0f2b51c7d
commit f518548880
23 changed files with 628 additions and 125 deletions
+1 -1
View File
@@ -1,6 +1,6 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
$RestoreFrom = 'C:\Users\przemyslaw.klys\Desktop\GPO\2020-04-20_15_51_00'
$RestoreFrom = 'C:\Users\przemyslaw.klys\Desktop\GPO\2020-04-26_10_29_34'
$BackupInformation = Get-GPOZaurrBackupInformation -BackupFolder $RestoreFrom
$BackupInformation | Format-Table -a
@@ -0,0 +1,4 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
$T = Get-GPOZaurrPermission -GPOName 'Default Domain Policy' -Type 'All'
$T | Format-Table *
@@ -1,13 +1,13 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
# This Example shows how to deal with GPOs that have owner that doesn't exists anymore (deleted userr or diff domain) - EmptyOrUnknown
# And also can fix at the same time NonAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins
# And also can fix at the same time NotAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins
# regardless if current user is still Domain Admin or not
$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType
Set-GPOZaurrOwner -Type 'EmptyOrUnknown' -Verbose -LimitProcessing 1 -WhatIf
Set-GPOZaurrOwner -Type EmptyOrUnknown -Verbose -LimitProcessing 1 -WhatIf
$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
$GPOs | Format-Table DisplayName, Owner, OwnerSID
+1 -1
View File
@@ -1,3 +1,3 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
Get-GPOZaurrLink | Format-Table -AutoSize
Get-GPOZaurrLink | Format-Table -AutoSize *
@@ -0,0 +1,11 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
Clear-Host
Get-GPOZaurrLink -Linked Root | Format-Table -AutoSize
Get-GPOZaurrLink -Linked Site | Format-Table -AutoSize
Get-GPOZaurrLink -Linked DomainControllers | Format-Table -AutoSize
Get-GPOZaurrLink -Linked Other | Format-Table -AutoSize
@@ -0,0 +1,42 @@
#Clear-Host
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
$ApprovedGroups = @(
'GDS-TestGroup10'
)
$RootGroups = @(
#'przemyslaw.klys'
)
Invoke-GPOZaurrPermission -Linked Root -Verbose { #-IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -Type NotAdministrative, NotWellKnownAdministrative -Verbose {
Set-GPOOwner -Type Administrative
#Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'
#Set-GPOOwner -Principal 'Domain Admins'
Remove-GPOPermission -Type Administrative -IncludePermissionType GPOCustom
Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
#Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
} #-WhatIf #| Format-Table *
#-ApprovedGroups $ApprovedGroups -Trustee $RootGroups -TrusteeType Name -TrusteePermissionType GpoEditDeleteModifySecurity -WhatIf | Format-Table *
return
Get-GPOZaurrLink -Linked Root | ForEach-Object {
Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType 'GpoEdit', 'GpoEditDeleteModifySecurity' -Type 'NotAdministrative', 'NotWellKnownAdministrative' -IncludeGPOObject | ForEach-Object {
$_
}
} | Format-Table -a *
#Get-GPOZaurrLink -Linked Site | Format-Table -AutoSize
#Get-GPOZaurrLink -Linked DomainControllers | Format-Table -AutoSize
#Get-GPOZaurrLink -Linked Other | Format-Table -AutoSize
#Get-GPOZaurrLink -SearchBase 'CN=Configuration,DC=ad,DC=evotec,DC=xyz' | Format-Table -AutoSize
#Get-AdObject -SearchBase 'DC=ad,DC=evotec,DC=xyz' -Server 'ad.evotec.xyz' -Filter "(ObjectClass -eq 'site') -or (ObjectClass -eq 'organizationalUnit' -or ObjectClass -eq 'domainDNS')" -SearchScope Subtree #
#Get-ADObject -SearchBase 'CN=Configuration,DC=ad,DC=evotec,DC=xyz' | fl