diff --git a/Examples/Example-16-KeepPermissions.ps1 b/Examples/Example-16-KeepPermissions.ps1 new file mode 100644 index 0000000..398ee70 --- /dev/null +++ b/Examples/Example-16-KeepPermissions.ps1 @@ -0,0 +1,33 @@ +Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force +Import-Module 'C:\Support\GitHub\PSSharedGoods\PSSharedGoods.psd1' -Force + +# Apply permissions for ROOT +Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.xyz' { + Set-GPOOwner -Type Administrative + Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow +} #-WhatIf + +# Apply perrmissions for Domain Controllers +Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' { + Set-GPOOwner -Type Administrative + Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow + Add-GPOPermission -Type +} #-WhatIf + +# Apply permissions for Regions, with exclusions for those 4 groups +$Exclude = @( + 'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz' + 'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz' + 'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz' + 'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz' +) + +Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' { + Set-GPOOwner -Type Administrative + Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName +} #-WhatIf + +Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' { + Set-GPOOwner -Type Administrative + Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName +} #-WhatIf \ No newline at end of file diff --git a/Private/Get-PrivPermission.ps1 b/Private/Get-PrivPermission.ps1 index 711d304..9466aa0 100644 --- a/Private/Get-PrivPermission.ps1 +++ b/Private/Get-PrivPermission.ps1 @@ -12,6 +12,10 @@ [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType, [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType, [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All', + + [string[]] $ExcludePrincipal, + [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid', + [switch] $IncludeGPOObject, [System.Collections.IDictionary] $ADAdministrativeGroups, [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All', 'Default')][string[]] $Type, @@ -91,6 +95,22 @@ } } } + if ($ExcludePrincipal) { + if ($ExcludePrincipalType -eq 'Sid') { + if ($ExcludePrincipal -contains $GPOPermission.Trustee.Sid.Value) { + return + } + } elseif ($ExcludePrincipalType -eq 'DistinguishedName') { + if ($ExcludePrincipal -contains $GPOPermission.Trustee.DSPath) { + return + } + } elseif ($ExcludePrincipalType -eq 'Name') { + $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name) + if ($ExcludePrincipal -contains $UserMerge -or $ExcludePrincipal -contains $GPOPermission.Trustee.Name) { + return + } + } + } $ReturnObject = [ordered] @{ DisplayName = $GPO.DisplayName # : ALL | Enable RDP GUID = $GPO.ID diff --git a/Private/Remove-PrivPermission.ps1 b/Private/Remove-PrivPermission.ps1 index 770d9e0..e40443c 100644 --- a/Private/Remove-PrivPermission.ps1 +++ b/Private/Remove-PrivPermission.ps1 @@ -7,7 +7,7 @@ [alias('PermissionType')][Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType ) if ($GPOPermission.Name) { - $Text = "Removing SID: $($GPOPermission.Sid), Name: $($GPOPermission.Name), SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)" + $Text = "Removing SID: $($GPOPermission.Sid), Name: $($GPOPermission.Domain)\$($GPOPermission.Name), SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)" } else { $Text = "Removing SID: $($GPOPermission.Sid), Name: EMPTY, SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)" } diff --git a/Public/Get-GPOZaurrPermission.ps1 b/Public/Get-GPOZaurrPermission.ps1 index e16ea88..3290a01 100644 --- a/Public/Get-GPOZaurrPermission.ps1 +++ b/Public/Get-GPOZaurrPermission.ps1 @@ -21,16 +21,22 @@ [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType, [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All', + [string[]] $ExcludePrincipal, + [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid', + [switch] $IncludeGPOObject, [alias('ForestName')][string] $Forest, [string[]] $ExcludeDomains, [alias('Domain', 'Domains')][string[]] $IncludeDomains, - [System.Collections.IDictionary] $ExtendedForestInformation + [System.Collections.IDictionary] $ExtendedForestInformation, + [System.Collections.IDictionary] $ADAdministrativeGroups ) Begin { $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation - $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation + if (-not $ADAdministrativeGroups) { + $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation + } if ($Type -eq 'Unknown') { if ($SkipAdministrative -or $SkipWellKnown) { Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed." @@ -93,6 +99,8 @@ IncludeGPOObject = $IncludeGPOObject.IsPresent IncludePermissionType = $IncludePermissionType ExcludePermissionType = $ExcludePermissionType + ExcludePrincipal = $ExcludePrincipal + ExcludePrincipalType = $ExcludePrincipalType ADAdministrativeGroups = $ADAdministrativeGroups } Get-PrivPermission @getPrivPermissionSplat diff --git a/Public/Invoke-GPOZaurrPermission.ps1 b/Public/Invoke-GPOZaurrPermission.ps1 index 1fca29f..9ca5d0a 100644 --- a/Public/Invoke-GPOZaurrPermission.ps1 +++ b/Public/Invoke-GPOZaurrPermission.ps1 @@ -93,7 +93,8 @@ [System.Collections.IDictionary] $ExtendedForestInformation ) Begin { - $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation + $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation + $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation <# $Script:Actions = @{ GpoApply = @{ @@ -172,7 +173,12 @@ } else { - $Splat = @{ } + $Splat = @{ + Forest = $Forest + IncludeDomains = $IncludeDomains + ExcludeDomains = $ExcludeDomains + ExtendedForestInformation = $ForestInformation + } if ($ADObject) { $Splat['ADObject'] = $ADObject } elseif ($Linked) { @@ -209,16 +215,16 @@ continue } if ($Rule.Action -eq 'Remove') { - $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType + $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType foreach ($Permission in $GPOPermissions) { - Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission #-IncludeDomains $GPO.DomainName + Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission } continue } if ($Rule.Action -eq 'Add') { #$GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type 'All' -IncludeGPOObject # foreach ($Permission in $GPOPermissions) { - Add-GPOZaurrPermission -GPOGuid $_.GUID -IncludeDomains $GPO.DomainName -Type $Rule.Type -PermissionType $Rule.IncludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups + Add-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -Type $Rule.Type -PermissionType $Rule.IncludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups # } } } diff --git a/Public/Remove-GPOPermission.ps1 b/Public/Remove-GPOPermission.ps1 index e9fcc85..5185247 100644 --- a/Public/Remove-GPOPermission.ps1 +++ b/Public/Remove-GPOPermission.ps1 @@ -4,7 +4,13 @@ [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'Administrative', 'NotAdministrative', 'All')][string[]] $Type, [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType, [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType, - [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'Allow' + [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'Allow', + + [string[]] $Principal, + [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid', + + [string[]] $ExcludePrincipal, + [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid' ) if ($Type) { @@ -14,34 +20,10 @@ IncludePermissionType = $IncludePermissionType ExcludePermissionType = $ExcludePermissionType PermitType = $PermitType + Principal = $Principal + PrincipalType = $PrincipalType + ExcludePrincipal = $ExcludePrincipal + ExcludePrincipalType = $ExcludePrincipalType } } - <# - foreach ($T in $Type) { - foreach ($Permission in $IncludePermissionType) { - if ($T -eq 'NotWellKnownAdministrative') { - $Script:Actions[$Permission][$T] = $true - } elseif ($T -eq 'NotAdministrative') { - $Script:Actions[$Permission][$T] = $true - } - } - } - #> -} -<# -function Find-GPOPermission { - param( - $GPOPermissions, - [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType, - [bool] $NotAdministrative, - [bool] $NotWellKnownAdministrative - ) - foreach ($Permission in $GPOPermissions) { - if ($Permission.Permission -in $IncludePermissionType) { - if ($NotAdministrative -and $NotWellKnownAdministrative) { - $Permission - } - } - } -} -#> \ No newline at end of file +} \ No newline at end of file