Update

2026-08-09 10:19:26 +00:00 · 2020-05-28 15:36:57 +02:00
parent b57f131730
commit f7375bd537
6 changed files with 87 additions and 38 deletions
@@ -0,0 +1,33 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+Import-Module 'C:\Support\GitHub\PSSharedGoods\PSSharedGoods.psd1' -Force
+
+# Apply permissions for ROOT
+Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+} #-WhatIf
+
+# Apply perrmissions for Domain Controllers
+Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type
+} #-WhatIf
+
+# Apply permissions for Regions, with exclusions for those 4 groups
+$Exclude = @(
+    'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+} #-WhatIf
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+} #-WhatIf
@@ -12,6 +12,10 @@
        [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
        [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid',
+
        [switch] $IncludeGPOObject,
        [System.Collections.IDictionary] $ADAdministrativeGroups,
        [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All', 'Default')][string[]] $Type,
@@ -91,6 +95,22 @@
                    }
                }
            }
+            if ($ExcludePrincipal) {
+                if ($ExcludePrincipalType -eq 'Sid') {
+                    if ($ExcludePrincipal -contains $GPOPermission.Trustee.Sid.Value) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'DistinguishedName') {
+                    if ($ExcludePrincipal -contains $GPOPermission.Trustee.DSPath) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'Name') {
+                    $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                    if ($ExcludePrincipal -contains $UserMerge -or $ExcludePrincipal -contains $GPOPermission.Trustee.Name) {
+                        return
+                    }
+                }
+            }
            $ReturnObject = [ordered] @{
                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
                GUID              = $GPO.ID
@@ -7,7 +7,7 @@
        [alias('PermissionType')][Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType
    )
    if ($GPOPermission.Name) {
-        $Text = "Removing SID: $($GPOPermission.Sid), Name: $($GPOPermission.Name), SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
+        $Text = "Removing SID: $($GPOPermission.Sid), Name: $($GPOPermission.Domain)\$($GPOPermission.Name), SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
    } else {
        $Text = "Removing SID: $($GPOPermission.Sid), Name: EMPTY, SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
    }
@@ -21,16 +21,22 @@
        [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',

+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid',
+
        [switch] $IncludeGPOObject,

        [alias('ForestName')][string] $Forest,
        [string[]] $ExcludeDomains,
        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
-        [System.Collections.IDictionary] $ExtendedForestInformation
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [System.Collections.IDictionary] $ADAdministrativeGroups
    )
    Begin {
        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        if (-not $ADAdministrativeGroups) {
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
        if ($Type -eq 'Unknown') {
            if ($SkipAdministrative -or $SkipWellKnown) {
                Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
@@ -93,6 +99,8 @@
                    IncludeGPOObject       = $IncludeGPOObject.IsPresent
                    IncludePermissionType  = $IncludePermissionType
                    ExcludePermissionType  = $ExcludePermissionType
+                    ExcludePrincipal       = $ExcludePrincipal
+                    ExcludePrincipalType   = $ExcludePrincipalType
                    ADAdministrativeGroups = $ADAdministrativeGroups
                }
                Get-PrivPermission @getPrivPermissionSplat
@@ -93,7 +93,8 @@
        [System.Collections.IDictionary] $ExtendedForestInformation
    )
    Begin {
-        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
        <#
        $Script:Actions = @{
            GpoApply                    = @{
@@ -172,7 +173,12 @@

        } else {

-            $Splat = @{ }
+            $Splat = @{
+                Forest                    = $Forest
+                IncludeDomains            = $IncludeDomains
+                ExcludeDomains            = $ExcludeDomains
+                ExtendedForestInformation = $ForestInformation
+            }
            if ($ADObject) {
                $Splat['ADObject'] = $ADObject
            } elseif ($Linked) {
@@ -209,16 +215,16 @@
                        continue
                    }
                    if ($Rule.Action -eq 'Remove') {
-                        $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType
+                        $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType
                        foreach ($Permission in $GPOPermissions) {
-                            Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission #-IncludeDomains $GPO.DomainName
+                            Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
                        }
                        continue
                    }
                    if ($Rule.Action -eq 'Add') {
                        #$GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type 'All' -IncludeGPOObject
                        # foreach ($Permission in $GPOPermissions) {
-                        Add-GPOZaurrPermission -GPOGuid $_.GUID -IncludeDomains $GPO.DomainName -Type $Rule.Type -PermissionType $Rule.IncludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                        Add-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -Type $Rule.Type -PermissionType $Rule.IncludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
                        # }
                    }
                }
@@ -4,7 +4,13 @@
        [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'Administrative', 'NotAdministrative', 'All')][string[]] $Type,
        [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
        [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
-        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'Allow'
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'Allow',
+
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid'
    )

    if ($Type) {
@@ -14,34 +20,10 @@
            IncludePermissionType = $IncludePermissionType
            ExcludePermissionType = $ExcludePermissionType
            PermitType            = $PermitType
+            Principal             = $Principal
+            PrincipalType         = $PrincipalType
+            ExcludePrincipal      = $ExcludePrincipal
+            ExcludePrincipalType  = $ExcludePrincipalType
        }
    }
-    <#
-    foreach ($T in $Type) {
-        foreach ($Permission in $IncludePermissionType) {
-            if ($T -eq 'NotWellKnownAdministrative') {
-                $Script:Actions[$Permission][$T] = $true
-            } elseif ($T -eq 'NotAdministrative') {
-                $Script:Actions[$Permission][$T] = $true
-            }
-        }
-    }
-    #>
-}
-<#
-function Find-GPOPermission {
-    param(
-        $GPOPermissions,
-        [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
-        [bool] $NotAdministrative,
-        [bool] $NotWellKnownAdministrative
-    )
-    foreach ($Permission in $GPOPermissions) {
-        if ($Permission.Permission -in $IncludePermissionType) {
-            if ($NotAdministrative -and $NotWellKnownAdministrative) {
-                $Permission
-            }
-        }
-    }
-}
-#>
+}