Update

Public/Get-GPOZaurrPermission.ps1

@@ -21,16 +21,22 @@
         [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
         [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
 
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid',
+
         [switch] $IncludeGPOObject,
 
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
-        [System.Collections.IDictionary] $ExtendedForestInformation
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [System.Collections.IDictionary] $ADAdministrativeGroups
     )
     Begin {
         $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        if (-not $ADAdministrativeGroups) {
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
         if ($Type -eq 'Unknown') {
             if ($SkipAdministrative -or $SkipWellKnown) {
                 Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
@@ -93,6 +99,8 @@
                     IncludeGPOObject       = $IncludeGPOObject.IsPresent
                     IncludePermissionType  = $IncludePermissionType
                     ExcludePermissionType  = $ExcludePermissionType
+                    ExcludePrincipal       = $ExcludePrincipal
+                    ExcludePrincipalType   = $ExcludePrincipalType
                     ADAdministrativeGroups = $ADAdministrativeGroups
                 }
                 Get-PrivPermission @getPrivPermissionSplat

Public/Invoke-GPOZaurrPermission.ps1

@@ -93,7 +93,8 @@
         [System.Collections.IDictionary] $ExtendedForestInformation
     )
     Begin {
-        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
         <#
         $Script:Actions = @{
             GpoApply                    = @{
@@ -172,7 +173,12 @@
 
         } else {
 
-            $Splat = @{ }
+            $Splat = @{
+                Forest                    = $Forest
+                IncludeDomains            = $IncludeDomains
+                ExcludeDomains            = $ExcludeDomains
+                ExtendedForestInformation = $ForestInformation
+            }
             if ($ADObject) {
                 $Splat['ADObject'] = $ADObject
             } elseif ($Linked) {
@@ -209,16 +215,16 @@
                         continue
                     }
                     if ($Rule.Action -eq 'Remove') {
-                        $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType
+                        $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType
                         foreach ($Permission in $GPOPermissions) {
-                            Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission #-IncludeDomains $GPO.DomainName
+                            Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
                         }
                         continue
                     }
                     if ($Rule.Action -eq 'Add') {
                         #$GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type 'All' -IncludeGPOObject
                         # foreach ($Permission in $GPOPermissions) {
-                        Add-GPOZaurrPermission -GPOGuid $_.GUID -IncludeDomains $GPO.DomainName -Type $Rule.Type -PermissionType $Rule.IncludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                        Add-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -Type $Rule.Type -PermissionType $Rule.IncludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
                         # }
                     }
                 }

Public/Remove-GPOPermission.ps1

@@ -4,7 +4,13 @@
         [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'Administrative', 'NotAdministrative', 'All')][string[]] $Type,
         [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
         [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
-        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'Allow'
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'Allow',
+
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid'
     )
 
     if ($Type) {
@@ -14,34 +20,10 @@
             IncludePermissionType = $IncludePermissionType
             ExcludePermissionType = $ExcludePermissionType
             PermitType            = $PermitType
+            Principal             = $Principal
+            PrincipalType         = $PrincipalType
+            ExcludePrincipal      = $ExcludePrincipal
+            ExcludePrincipalType  = $ExcludePrincipalType
         }
     }
-    <#
-    foreach ($T in $Type) {
-        foreach ($Permission in $IncludePermissionType) {
-            if ($T -eq 'NotWellKnownAdministrative') {
-                $Script:Actions[$Permission][$T] = $true
-            } elseif ($T -eq 'NotAdministrative') {
-                $Script:Actions[$Permission][$T] = $true
-            }
-        }
-    }
-    #>
-}
-<#
-function Find-GPOPermission {
-    param(
-        $GPOPermissions,
-        [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
-        [bool] $NotAdministrative,
-        [bool] $NotWellKnownAdministrative
-    )
-    foreach ($Permission in $GPOPermissions) {
-        if ($Permission.Permission -in $IncludePermissionType) {
-            if ($NotAdministrative -and $NotWellKnownAdministrative) {
-                $Permission
-            }
-        }
-    }
-}
-#>
+}