mirror of
https://github.com/EvotecIT/GPOZaurr.git
synced 2026-08-28 03:06:47 +00:00
This is disaster
This commit is contained in:
Przemysław Kłys
@@ -0,0 +1,30 @@
|
||||
function Add-GPOPermission {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[validateset('WellKnownAdministrative','Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
|
||||
[Microsoft.GroupPolicy.GPPermissionType] $IncludePermissionType,
|
||||
[alias('Principal')][Array] $Trustee,
|
||||
[alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName'
|
||||
)
|
||||
if ($Type -eq 'Default'){
|
||||
@{
|
||||
Action = 'Add'
|
||||
Type = 'Standard'
|
||||
Trustee = $Trustee
|
||||
IncludePermissionType = $IncludePermissionType
|
||||
TrusteeType = $TrusteeType
|
||||
}
|
||||
} elseif ($Type -eq 'AuthenticatedUsers') {
|
||||
@{
|
||||
Action = 'Add'
|
||||
Type = 'AuthenticatedUsers'
|
||||
IncludePermissionType = $IncludePermissionType
|
||||
}
|
||||
} elseif ($Type -eq 'Administrative') {
|
||||
@{
|
||||
Action = 'Add'
|
||||
Type = 'Administrative'
|
||||
IncludePermissionType = $IncludePermissionType
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -10,22 +10,28 @@
|
||||
[Parameter(ParameterSetName = 'ADObject', Mandatory)]
|
||||
[alias('OrganizationalUnit', 'DistinguishedName')][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
|
||||
|
||||
[validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
|
||||
|
||||
[string] $Principal,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $PermissionType,
|
||||
[alias('IncludePermissionType')][Microsoft.GroupPolicy.GPPermissionType[]] $PermissionType,
|
||||
[switch] $Inheritable,
|
||||
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
[System.Collections.IDictionary] $ExtendedForestInformation,
|
||||
|
||||
[System.Collections.IDictionary] $ADAdministrativeGroups,
|
||||
[int] $LimitProcessing
|
||||
)
|
||||
Begin {
|
||||
$Count = 0
|
||||
#$Count = 0
|
||||
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
if (-not $ADAdministrativeGroups) {
|
||||
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
}
|
||||
$ForestInformation = Get-ADForest
|
||||
}
|
||||
Process {
|
||||
|
||||
if ($GPOName) {
|
||||
$Splat = @{
|
||||
GPOName = $GPOName
|
||||
@@ -42,9 +48,9 @@
|
||||
|
||||
$Splat['IncludeGPOObject'] = $true
|
||||
$Splat['Forest'] = $Forest
|
||||
$Splat['IncludeDomains'] = $IncludeDomains
|
||||
$Splat['ExcludeDomains'] = $ExcludeDomains
|
||||
$Splat['ExtendedForestInformation'] = $ExtendedForestInformation
|
||||
$Splat['IncludeDomains'] = $Domain
|
||||
#$Splat['ExcludeDomains'] = $ExcludeDomains
|
||||
#$Splat['ExtendedForestInformation'] = $ExtendedForestInformation
|
||||
#$Splat['ExcludePermissionType'] = $ExcludePermissionType
|
||||
#$Splat['IncludePermissionType'] = $PermissionType-
|
||||
$Splat['SkipWellKnown'] = $SkipWellKnown.IsPresent
|
||||
@@ -54,15 +60,47 @@
|
||||
|
||||
#Set-GPPermission -PermissionLevel $PermissionType -TargetName $Principal -TargetType Group -Verbose -DomainName 'ad.evotec.xyz' -Name $GPOName -Replace #-WhatIf
|
||||
|
||||
$AdministrativeExists = @{
|
||||
DomainAdmins = $false
|
||||
EnterpriseAdmins = $false
|
||||
}
|
||||
|
||||
#continue
|
||||
[Array] $GPOPermissions = Get-GPOZaurrPermission @Splat
|
||||
[Array] $LimitedPermissions = foreach ($GPOPermission in $GPOPermissions) {
|
||||
#$GPOPermission = $_
|
||||
# continue
|
||||
if ($GPOPermission.Name -eq $Principal -and $GPOPermission.Permission -eq $PermissionType) {
|
||||
Write-Verbose "Add-GPOZaurrPermission - Permission $PermissionType already set for $($GPOPermission.Name) / $($GPOPermission.DomainName)"
|
||||
$GPOPermission
|
||||
#break
|
||||
if ($Type -eq 'Default') {
|
||||
if ($GPOPermission.Name -eq $Principal -and $GPOPermission.Permission -eq $PermissionType) {
|
||||
#Write-Verbose "Add-GPOZaurrPermission - Permission $PermissionType already set for $($GPOPermission.Name) / $($GPOPermission.DomainName)"
|
||||
$GPOPermission
|
||||
break
|
||||
}
|
||||
} elseif ($Type -eq 'Administrative') {
|
||||
if ($GPOPermission.Permission -eq $PermissionType) {
|
||||
$AdministrativeGroup = $ADAdministrativeGroups['BySID'][$GPOPermission.SID]
|
||||
if ($AdministrativeGroup) {
|
||||
if ($GPOPermission.SID -like '*-512') {
|
||||
#Write-Verbose "Add-GPOZaurrPermission - Permission $PermissionType already set for $($GPOPermission.Name) / $($GPOPermission.DomainName)"
|
||||
$AdministrativeExists['DomainAdmins'] = $true
|
||||
} elseif ($GPOPermission.SID -like '*-519') {
|
||||
#Write-Verbose "Add-GPOZaurrPermission - Permission $PermissionType already set for $($GPOPermission.Name) / $($GPOPermission.DomainName)"
|
||||
$AdministrativeExists['EnterpriseAdmins'] = $true
|
||||
}
|
||||
}
|
||||
}
|
||||
} elseif ($Type -eq 'WellKnownAdministrative') {
|
||||
if ($GPOPermission.Name -eq $Principal -and $GPOPermission.Permission -eq $PermissionType) {
|
||||
#Write-Verbose "Add-GPOZaurrPermission - Permission $PermissionType already set for $($GPOPermission.Name) / $($GPOPermission.DomainName)"
|
||||
$GPOPermission
|
||||
break
|
||||
}
|
||||
} elseif ($Type -eq 'AuthenticatedUsers') {
|
||||
if ($GPOPermission.Name -eq $Principal -and $GPOPermission.Permission -eq $PermissionType) {
|
||||
#Write-Verbose "Add-GPOZaurrPermission - Permission $PermissionType already set for $($GPOPermission.Name) / $($GPOPermission.DomainName)"
|
||||
$GPOPermission
|
||||
break
|
||||
}
|
||||
}
|
||||
# Write-Verbose "Test"
|
||||
# $GPOPermission
|
||||
@@ -78,20 +116,37 @@
|
||||
|
||||
# $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
|
||||
}
|
||||
if ($GPOPermissions.Count -gt 0) {
|
||||
if ($LimitedPermissions.Count -gt 0) {
|
||||
#$LimitedPermissions
|
||||
} else {
|
||||
if ($Type -eq 'Administrative') {
|
||||
if ($AdministrativeExists['DomainAdmins'] -eq $false) {
|
||||
$Principal = $ADAdministrativeGroups[$GPOPermission.DomainName]['DomainAdmins']
|
||||
Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal)"
|
||||
$AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
|
||||
$GPOPermissions[0].GPOSecurity.Add($AddPermission)
|
||||
$GPOPermissions[0].GPOObject.SetSecurityInfo( $GPOPermissions[0].GPOSecurity)
|
||||
}
|
||||
if ($AdministrativeExists['EnterpriseAdmins'] -eq $false) {
|
||||
$Principal = $ADAdministrativeGroups[$ForestInformation.RootDomain]['EnterpriseAdmins']
|
||||
Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal)"
|
||||
$AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
|
||||
$GPOPermissions[0].GPOSecurity.Add($AddPermission)
|
||||
$GPOPermissions[0].GPOObject.SetSecurityInfo( $GPOPermissions[0].GPOSecurity)
|
||||
}
|
||||
} elseif ($Type -eq 'Default') {
|
||||
try {
|
||||
Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal)"
|
||||
$AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
|
||||
$GPOPermissions[0].GPOSecurity.Add($AddPermission)
|
||||
$GPOPermissions[0].GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
|
||||
} catch {
|
||||
Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
|
||||
if ($LimitedPermissions.Count -gt 0) {
|
||||
#$LimitedPermissions
|
||||
} else {
|
||||
try {
|
||||
Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal)"
|
||||
$AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
|
||||
$GPOPermissions[0].GPOSecurity.Add($AddPermission)
|
||||
$GPOPermissions[0].GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
|
||||
} catch {
|
||||
Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
|
||||
}
|
||||
|
||||
<#
|
||||
<#
|
||||
[Microsoft.GroupPolicy.GPPermission]::new
|
||||
|
||||
OverloadDefinitions
|
||||
@@ -100,8 +155,12 @@
|
||||
Microsoft.GroupPolicy.GPPermission new(System.Security.Principal.IdentityReference identity, Microsoft.GroupPolicy.GPPermissionType rights, bool inheritable)
|
||||
|
||||
#>
|
||||
}
|
||||
} else {
|
||||
Write-Warning "Add-GPOZaurrPermission - GPO $($GPOPermissions[0].GPOName) has no permissions. Weird."
|
||||
}
|
||||
}
|
||||
|
||||
End {
|
||||
|
||||
}
|
||||
|
||||
@@ -11,15 +11,15 @@
|
||||
if ($Folder) {
|
||||
if ((Test-Path -LiteralPath "$Folder\manifest.xml")) {
|
||||
[xml] $Xml = Get-Content -LiteralPath "$Folder\manifest.xml"
|
||||
$Xml.Backups.BackupInst | ForEach-Object {
|
||||
$Xml.Backups.BackupInst | ForEach-Object -Process {
|
||||
[PSCustomObject] @{
|
||||
DisplayName = $_.GPODisplayName.'#cdata-section'
|
||||
DomainName = $_.GPODomain.'#cdata-section'
|
||||
Guid = $_.GPOGUid.'#cdata-section'
|
||||
DomainGuid = $_.GPODomainGuid.'#cdata-section'
|
||||
Guid = $_.GPOGUid.'#cdata-section' -replace '{' -replace '}'
|
||||
DomainGuid = $_.GPODomainGuid.'#cdata-section' -replace '{' -replace '}'
|
||||
DomainController = $_.GPODomainController.'#cdata-section'
|
||||
BackupTime = $_.BackupTime.'#cdata-section'
|
||||
ID = $_.ID.'#cdata-section'
|
||||
BackupTime = [DateTime]::Parse($_.BackupTime.'#cdata-section')
|
||||
ID = $_.ID.'#cdata-section' -replace '{' -replace '}'
|
||||
Comment = $_.Comment.'#cdata-section'
|
||||
}
|
||||
}
|
||||
|
||||
+89
-20
@@ -4,11 +4,12 @@
|
||||
[parameter(ValueFromPipeline, ValueFromPipelineByPropertyName)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
|
||||
[switch] $Limited,
|
||||
[System.Collections.IDictionary] $GPOCache,
|
||||
|
||||
[string] $Filter = '*',
|
||||
# weirdly enough site doesn't really work this way unless you give it 'CN=Configuration,DC=ad,DC=evotec,DC=xyz' as SearchBase
|
||||
[string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')",
|
||||
[string] $SearchBase,
|
||||
[Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
|
||||
|
||||
[validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
|
||||
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
@@ -29,27 +30,95 @@
|
||||
}
|
||||
Process {
|
||||
if (-not $ADObject) {
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
$Splat = @{
|
||||
Filter = $Filter
|
||||
Properties = 'distinguishedName', 'gplink', 'CanonicalName'
|
||||
Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
|
||||
}
|
||||
if ($PSBoundParameters.ContainsKey('SearchBase')) {
|
||||
$DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
|
||||
if ($SearchBase -notlike "*$DomainDistinguishedName") {
|
||||
# we check if SearchBase is part of domain distinugishname. If it isn't we skip
|
||||
continue
|
||||
if ($Linked) {
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
$Splat = @{
|
||||
#Filter = $Filter
|
||||
Properties = 'distinguishedName', 'gplink', 'CanonicalName'
|
||||
# Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')"
|
||||
Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
|
||||
}
|
||||
if ($Linked -contains 'DomainControllers') {
|
||||
$SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']
|
||||
#if ($SearchBase -notlike "*$DomainDistinguishedName") {
|
||||
# we check if SearchBase is part of domain distinugishname. If it isn't we skip
|
||||
# continue
|
||||
#}
|
||||
$Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
Get-ADObject @Splat | ForEach-Object -Process {
|
||||
Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
}
|
||||
}
|
||||
if ($Linked -contains 'Root') {
|
||||
$SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
|
||||
#if ($SearchBase -notlike "*$DomainDistinguishedName") {
|
||||
# we check if SearchBase is part of domain distinugishname. If it isn't we skip
|
||||
# continue
|
||||
# }
|
||||
$Splat['Filter'] = "objectClass -eq 'domainDNS'"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
Get-ADObject @Splat | ForEach-Object -Process {
|
||||
Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
}
|
||||
}
|
||||
if ($Linked -contains 'Site') {
|
||||
# Sites are defined only in primary domain
|
||||
if ($ForestInformation['DomainsExtended'][$Domain]['DNSRoot'] -eq $ForestInformation['DomainsExtended'][$Domain]['Forest']) {
|
||||
$SearchBase = -join ("CN=Configuration,", $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'])
|
||||
# if ($SearchBase -notlike "*$DomainDistinguishedName") {
|
||||
# we check if SearchBase is part of domain distinugishname. If it isn't we skip
|
||||
#continue
|
||||
#}
|
||||
$Splat['Filter'] = "(objectClass -eq 'site')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
Get-ADObject @Splat | ForEach-Object -Process {
|
||||
Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
}
|
||||
}
|
||||
}
|
||||
if ($Linked -contains 'Other') {
|
||||
$SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
|
||||
#if ($SearchBase -notlike "*$DomainDistinguishedName") {
|
||||
# we check if SearchBase is part of domain distinugishname. If it isn't we skip
|
||||
# continue
|
||||
#}
|
||||
$Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
Get-ADObject @Splat | ForEach-Object -Process {
|
||||
if ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) {
|
||||
# other skips Domain Root
|
||||
} elseif ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']) {
|
||||
# other skips Domain Controllers
|
||||
} else {
|
||||
Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
}
|
||||
}
|
||||
}
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
|
||||
}
|
||||
if ($PSBoundParameters.ContainsKey('SearchScope')) {
|
||||
$Splat['SearchScope'] = $SearchScope
|
||||
}
|
||||
} else {
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
$Splat = @{
|
||||
Filter = $Filter
|
||||
Properties = 'distinguishedName', 'gplink', 'CanonicalName'
|
||||
Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
|
||||
}
|
||||
if ($PSBoundParameters.ContainsKey('SearchBase')) {
|
||||
$DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
|
||||
if ($SearchBase -notlike "*$DomainDistinguishedName") {
|
||||
# we check if SearchBase is part of domain distinugishname. If it isn't we skip
|
||||
continue
|
||||
}
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
|
||||
Get-ADObject @Splat | ForEach-Object {
|
||||
Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
}
|
||||
if ($PSBoundParameters.ContainsKey('SearchScope')) {
|
||||
$Splat['SearchScope'] = $SearchScope
|
||||
}
|
||||
|
||||
Get-ADObject @Splat | ForEach-Object {
|
||||
Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
[Parameter(ParameterSetName = 'GPOGUID')]
|
||||
[alias('GUID', 'GPOID')][string] $GPOGuid,
|
||||
|
||||
[validateSet('Unknown', 'All')][string[]] $Type = 'All',
|
||||
[validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative','All')][string[]] $Type = 'All',
|
||||
|
||||
[switch] $SkipWellKnown,
|
||||
[switch] $SkipAdministrative,
|
||||
|
||||
@@ -0,0 +1,163 @@
|
||||
function Invoke-GPOZaurrPermission {
|
||||
[cmdletBinding(SupportsShouldProcess)]
|
||||
param(
|
||||
[scriptblock] $PermissionRules,
|
||||
[validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
|
||||
[validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'All')][string[]] $Type,
|
||||
[Array] $ApprovedGroups,
|
||||
[alias('Principal')][Array] $Trustee,
|
||||
[Microsoft.GroupPolicy.GPPermissionType] $TrusteePermissionType,
|
||||
[alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName'
|
||||
)
|
||||
Begin {
|
||||
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
$Script:Actions = @{
|
||||
GpoApply = @{
|
||||
Remove = @{
|
||||
NotAdministrative = $false
|
||||
NotWellKnownAdministrative = $false
|
||||
}
|
||||
Add = @{
|
||||
Administrative = $false
|
||||
WellKnownAdministrative = $false
|
||||
}
|
||||
}
|
||||
GpoRead = @{
|
||||
Remove = @{
|
||||
NotAdministrative = $false
|
||||
NotWellKnownAdministrative = $false
|
||||
}
|
||||
Add = @{
|
||||
Administrative = $false
|
||||
WellKnownAdministrative = $false
|
||||
}
|
||||
}
|
||||
GpoCustom = @{
|
||||
Remove = @{
|
||||
NotAdministrative = $false
|
||||
NotWellKnownAdministrative = $false
|
||||
}
|
||||
Add = @{
|
||||
Administrative = $false
|
||||
WellKnownAdministrative = $false
|
||||
}
|
||||
}
|
||||
GpoEditDeleteModifySecurity = @{
|
||||
Remove = @{
|
||||
NotAdministrative = $false
|
||||
NotWellKnownAdministrative = $false
|
||||
}
|
||||
Add = @{
|
||||
Administrative = $false
|
||||
WellKnownAdministrative = $false
|
||||
}
|
||||
}
|
||||
GpoEdit = @{
|
||||
Remove = @{
|
||||
NotAdministrative = $false
|
||||
NotWellKnownAdministrative = $false
|
||||
}
|
||||
Add = @{
|
||||
Administrative = $false
|
||||
WellKnownAdministrative = $false
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Process {
|
||||
if ($PermissionRules) {
|
||||
$Rules = & $PermissionRules
|
||||
foreach ($Rule in $Rules) {
|
||||
|
||||
#$Actions["$Rule."]
|
||||
|
||||
if ($Rule.Action -eq 'Remove' -and $Rule.Type -contains 'NotWellKnownAdministrative') {
|
||||
#$Actions.NotWellKnownAdministrative = $true
|
||||
}
|
||||
if ($Rule.Action -eq 'Remove' -and $Rule.Type -contains 'NotAdministrative') {
|
||||
#$Actions.Remove.NotAdministrative = $true
|
||||
}
|
||||
}
|
||||
#$RemoveRules = $Rules | Where-Object { $_.Action -eq 'Remove' }
|
||||
#$AddRules = $Rules | Where-Object { $_.Action -eq 'Add' }
|
||||
}
|
||||
Get-GPOZaurrLink -Linked $Linked | ForEach-Object -Process {
|
||||
$GPO = $_
|
||||
#$GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID <#-IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -Type $Type#> -IncludeGPOObject
|
||||
|
||||
#foreach ($Permission in $Script:Actions.Keys) {
|
||||
# $Script:Actions[$Permission]
|
||||
#}
|
||||
|
||||
foreach ($Rule in $Rules) {
|
||||
if ($Rule.Action -eq 'Owner') {
|
||||
if ($Rule.Type -eq 'Administrative') {
|
||||
$AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
|
||||
if (-not $AdministrativeGroup) {
|
||||
$DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
|
||||
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
|
||||
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
}
|
||||
} elseif ($Rule.Type -eq 'Default') {
|
||||
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
|
||||
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
}
|
||||
continue
|
||||
}
|
||||
if ($Rule.Action -eq 'Remove') {
|
||||
$GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject
|
||||
foreach ($Permission in $GPOPermissions) {
|
||||
Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission -IncludeDomains $GPO.DomainName
|
||||
}
|
||||
continue
|
||||
}
|
||||
if ($Rule.Action -eq 'Add') {
|
||||
#$GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type 'All' -IncludeGPOObject
|
||||
# foreach ($Permission in $GPOPermissions) {
|
||||
Add-GPOZaurrPermission -GPOGuid $_.GUID -IncludeDomains $GPO.DomainName -Type $Rule.Type -PermissionType $Rule.IncludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
|
||||
# }
|
||||
}
|
||||
}
|
||||
|
||||
<#
|
||||
foreach ($Rule in $Rules) {
|
||||
if ($Rule.Action -eq 'Remove') {
|
||||
foreach ($Permission in $GPOPermissions) {
|
||||
|
||||
#$Permission
|
||||
#Write-Verbose "Remove-GPOZaurrPermission1 - Removing permission $IncludePermissionType for $($Permission.Name) / $($Permission.Permission)"
|
||||
Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
|
||||
# $Permission
|
||||
#Remove-GPOZaurrPermission -Type 'Default' -Principal $Permission.Sid -
|
||||
}
|
||||
}
|
||||
if ($Rule.Action -eq 'Add') {
|
||||
foreach ($Permission in $GPOPermissions) {
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
#>
|
||||
<#
|
||||
Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -Type $Type -IncludeGPOObject | ForEach-Object {
|
||||
$Permission = $_
|
||||
$Permission | Format-Table -a *
|
||||
foreach ($Rule in $Rules) {
|
||||
if ($Rule.Action -eq 'Remove') {
|
||||
#$Permission
|
||||
Write-Verbose "Remove-GPOZaurrPermission1 - Removing permission $IncludePermissionType for $($Permission.Name) / $($Permission.Permission)"
|
||||
Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
|
||||
# $Permission
|
||||
#Remove-GPOZaurrPermission -Type 'Default' -Principal $Permission.Sid -
|
||||
}
|
||||
}
|
||||
}
|
||||
#>
|
||||
}
|
||||
}
|
||||
End {
|
||||
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
function Remove-GPOPermission {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'Administrative', 'NotAdministrative', 'All')][string[]] $Type,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType
|
||||
)
|
||||
|
||||
if ($Type) {
|
||||
@{
|
||||
Action = 'Remove'
|
||||
Type = $Type
|
||||
IncludePermissionType = $IncludePermissionType
|
||||
ExcludePermissionType = $ExcludePermissionType
|
||||
}
|
||||
}
|
||||
<#
|
||||
foreach ($T in $Type) {
|
||||
foreach ($Permission in $IncludePermissionType) {
|
||||
if ($T -eq 'NotWellKnownAdministrative') {
|
||||
$Script:Actions[$Permission][$T] = $true
|
||||
} elseif ($T -eq 'NotAdministrative') {
|
||||
$Script:Actions[$Permission][$T] = $true
|
||||
}
|
||||
}
|
||||
}
|
||||
#>
|
||||
}
|
||||
<#
|
||||
function Find-GPOPermission {
|
||||
param(
|
||||
$GPOPermissions,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
|
||||
[bool] $NotAdministrative,
|
||||
[bool] $NotWellKnownAdministrative
|
||||
)
|
||||
foreach ($Permission in $GPOPermissions) {
|
||||
if ($Permission.Permission -in $IncludePermissionType) {
|
||||
if ($NotAdministrative -and $NotWellKnownAdministrative) {
|
||||
$Permission
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
#>
|
||||
@@ -10,7 +10,7 @@
|
||||
[string] $Principal,
|
||||
[validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
|
||||
|
||||
[validateset('Unknown', 'Named', 'NonAdministrative', 'Default')][string[]] $Type = 'Default',
|
||||
[validateset('Unknown', 'Named', 'NotAdministrative', 'Default')][string[]] $Type = 'Default',
|
||||
|
||||
[alias('PermissionType')][Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
|
||||
@@ -119,10 +119,12 @@
|
||||
}
|
||||
#>
|
||||
}
|
||||
if ($Type -contains 'NonAdministrative') {
|
||||
if ($Type -contains 'NotAdministrative') {
|
||||
|
||||
}
|
||||
if ($Type -contains 'Default') {
|
||||
Remove-PrivPermission -Principal $Principal -PrincipalType $PrincipalType -GPOPermission $GPOPermission -IncludePermissionType $IncludePermissionType
|
||||
<#
|
||||
if ($PrincipalType -eq 'DistinguishedName') {
|
||||
if ($GPOPermission.DistinguishedName -eq $Principal -and $GPOPermission.Permission -eq $IncludePermissionType) {
|
||||
try {
|
||||
@@ -154,6 +156,7 @@
|
||||
}
|
||||
}
|
||||
}
|
||||
#>
|
||||
|
||||
}
|
||||
#Set-GPPermission -PermissionLevel None -TargetName $GPOPermission.Sid -Verbose -DomainName $GPOPermission.DomainName -Guid $GPOPermission.GUID #-WhatIf
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
function Set-GPOOwner {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[validateset('Administrative', 'Default')][string] $Type = 'Default',
|
||||
[string] $Principal
|
||||
)
|
||||
if ($Type -eq 'Default') {
|
||||
if ($Principal) {
|
||||
@{
|
||||
Action = 'Owner'
|
||||
Type = 'Default'
|
||||
Principal = $Principal
|
||||
}
|
||||
}
|
||||
} elseif ($Type -eq 'Administrative') {
|
||||
@{
|
||||
Action = 'Owner'
|
||||
Type = 'Administrative'
|
||||
Principal = ''
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -2,7 +2,7 @@
|
||||
[cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Type')]
|
||||
param(
|
||||
[Parameter(ParameterSetName = 'Type', Mandatory)]
|
||||
[validateset('EmptyOrUnknown', 'NonAdministrative', 'All')][string[]] $Type,
|
||||
[validateset('EmptyOrUnknown', 'NotAdministrative', 'All')][string[]] $Type,
|
||||
|
||||
[Parameter(ParameterSetName = 'Named')][string] $GPOName,
|
||||
[Parameter(ParameterSetName = 'Named')][alias('GUID', 'GPOID')][string] $GPOGuid,
|
||||
@@ -43,32 +43,32 @@
|
||||
# Regardless who is the owner it is overwritten
|
||||
if ($Principal) {
|
||||
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
|
||||
Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
} else {
|
||||
$DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
|
||||
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
|
||||
Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
$Count++
|
||||
if ($Count -eq $LimitProcessing) {
|
||||
break
|
||||
}
|
||||
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
}
|
||||
$Count++
|
||||
if ($Count -eq $LimitProcessing) {
|
||||
break
|
||||
}
|
||||
}
|
||||
if ($Type -contains 'NonAdministrative' -and $Type -notcontains 'All') {
|
||||
if ($Type -contains 'NotAdministrative' -and $Type -notcontains 'All') {
|
||||
if ($GPO.Owner) {
|
||||
$AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
|
||||
if (-not $AdministrativeGroup) {
|
||||
if ($Principal) {
|
||||
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
|
||||
Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
} else {
|
||||
$DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
|
||||
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
|
||||
Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
$Count++
|
||||
if ($Count -eq $LimitProcessing) {
|
||||
break
|
||||
}
|
||||
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
}
|
||||
$Count++
|
||||
if ($Count -eq $LimitProcessing) {
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -77,11 +77,11 @@
|
||||
if ($null -eq $GPO.Owner) {
|
||||
if ($Principal) {
|
||||
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $Principal"
|
||||
Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
} else {
|
||||
$DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
|
||||
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $DefaultPrincipal"
|
||||
Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
}
|
||||
$Count++
|
||||
if ($Count -eq $LimitProcessing) {
|
||||
@@ -95,11 +95,11 @@
|
||||
$GPO = $_
|
||||
if ($Principal) {
|
||||
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
|
||||
Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
} else {
|
||||
$DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
|
||||
Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
|
||||
Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
|
||||
}
|
||||
$Count++
|
||||
if ($Count -eq $LimitProcessing) {
|
||||
|
||||
Reference in New Issue
Block a user