From fb7dfdc4b1a00d3cb11dcee51a70755374e9868e Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Tue, 17 Nov 2020 00:06:35 +0100 Subject: [PATCH] Update --- Private/Script.GPOConfiguration.ps1 | 1 + Public/Get-GPOZaurrFiles.ps1 | 9 +++ Public/Get-GPOZaurrNetlogon.ps1 | 104 ++++++++++++++++++---------- 3 files changed, 77 insertions(+), 37 deletions(-) diff --git a/Private/Script.GPOConfiguration.ps1 b/Private/Script.GPOConfiguration.ps1 index b6d4fab..c162bee 100644 --- a/Private/Script.GPOConfiguration.ps1 +++ b/Private/Script.GPOConfiguration.ps1 @@ -11,6 +11,7 @@ GPOFiles = $GPOZaurrFiles GPOBlockedInheritance = $GPOZaurrBlockedInheritance GPOAnalysis = $GPOZaurrAnalysis + NetLogonOwners = $GPOZaurrNetLogonOwners NetLogonPermissions = $GPOZaurrNetLogonPermissions SysVolLegacyFiles = $GPOZaurrSysVolLegacyFiles } \ No newline at end of file diff --git a/Public/Get-GPOZaurrFiles.ps1 b/Public/Get-GPOZaurrFiles.ps1 index bb769b7..114481c 100644 --- a/Public/Get-GPOZaurrFiles.ps1 +++ b/Public/Get-GPOZaurrFiles.ps1 @@ -129,6 +129,9 @@ } elseif ($_.Extension -eq '.adm') { $SuggestedAction = 'Consider deleting' $SuggestedActionComment = 'Most likely legacy ADM files' + } elseif ($_.Name -eq 'Thumbs.db') { + $SuggestedAction = 'Consider deleting' + $SuggestedActionComment = 'Most likely database files to store image thumbnails on Windows systems.' } if (-not $SuggestedAction) { $FullPathAdmFiles = [System.IO.Path]::Combine($GPO.Path, 'Adm\admfiles.ini') @@ -217,6 +220,12 @@ } } } + if (-not $SuggestedAction) { + if ($_.Name -eq 'Thumbs.db') { + $SuggestedAction = 'Consider deleting' + $SuggestedActionComment = 'Most likely database files to store image thumbnails on Windows systems.' + } + } if (-not $SuggestedAction) { foreach ($FullName in @('*backup*', '*Delete*', '*Obsoleet*', '*Obsolete*', '*Archive*')) { if ($_.FullName -like $FullName) { diff --git a/Public/Get-GPOZaurrNetlogon.ps1 b/Public/Get-GPOZaurrNetlogon.ps1 index 377e60e..4023598 100644 --- a/Public/Get-GPOZaurrNetlogon.ps1 +++ b/Public/Get-GPOZaurrNetlogon.ps1 @@ -23,70 +23,100 @@ } catch { Write-Warning "Get-GPOZaurrNetLogon - ACL reading failed for $($File.FullName) with error $($_.Exception.Message) ($($_.CategoryInfo.Reason))" } - if ($ACL.Owner) { - $IdentityOwner = Convert-Identity -Identity $ACL.Owner -Verbose:$false - } else { - $IdentityOwner = [PSCustomObject] @{ SID = ''; Type = 'Uknown' } - } + #if ($ACL.Owner) { + $IdentityOwner = Convert-Identity -Identity $ACL.Owner -Verbose:$false + $IdentityOwnerAdvanced = Get-WinADObject -Identity $ACL.Owner -Cache -Verbose:$false + #} else { + # $IdentityOwner = [PSCustomObject] @{ SID = ''; Type = 'Unknown' } + # $IdentityOwnerAdvanced = [PSCustomObject] @{ ObjectClass = '' } + #} if (-not $OwnerOnly) { if (-not $SkipOwner) { if ($IdentityOwner.SID -eq "S-1-5-32-544") { $Status = 'OK' } else { - $Status = 'Replace Owner Required' + $Status = 'Replace owner required' } [PSCustomObject] @{ - FullName = $File.FullName - Status = $Status - Extension = $File.Extension - CreationTime = $File.CreationTime - LastAccessTime = $File.LastAccessTime - LastWriteTime = $File.LastWriteTime - Attributes = $File.Attributes - AccessControlType = 'Allow' # : Allow - Principal = $IdentityOwner.Name # : BUILTIN\Administrators - PrincipalSid = $IdentityOwner.SID - PrincipalType = $IdentityOwner.Type - FileSystemRights = 'Owner' # : FullControl - IsInherited = $false - FullNameOnSysVol = $File.FullName.Replace($Path, $PathOnSysvol) + FullName = $File.FullName + Status = $Status + DomainName = $Domain + Extension = $File.Extension + CreationTime = $File.CreationTime + LastAccessTime = $File.LastAccessTime + LastWriteTime = $File.LastWriteTime + Attributes = $File.Attributes + AccessControlType = 'Allow' # : Allow + Principal = $IdentityOwner.Name # : BUILTIN\Administrators + PrincipalSid = $IdentityOwner.SID + PrincipalType = $IdentityOwner.Type + PrincipalObjectClass = $IdentityOwnerAdvanced.ObjectClass + FileSystemRights = 'Owner' # : FullControl + IsInherited = $false + FullNameOnSysVol = $File.FullName.Replace($Path, $PathOnSysvol) } } $FilePermission = Get-FilePermissions -Path $File.FullName -ACLS $ACL -Verbose:$false foreach ($Perm in $FilePermission) { $Identity = Convert-Identity -Identity $Perm.Principal -Verbose:$false - $Status = $null + $AdvancedIdentity = Get-WinADObject -Identity $Perm.Principal -Cache -Verbose:$false + $Status = 'Not assesed' if ($Perm.FileSystemRights -eq [System.Security.AccessControl.FileSystemRights]::FullControl) { if ($Identity.Type -eq 'WellKnownAdministrative') { $Status = 'OK' } else { - $Status = 'Review Required' + if ($AdvancedIdentity.ObjectClass -in 'user', 'computer') { + $Status = 'Removal permission required' + } else { + $Status = 'Review permission required' + } + } + } elseif ($Perm.FileSystemRights -like "*Modify*") { + if ($AdvancedIdentity.ObjectClass -in 'user', 'computer') { + $Status = 'Removal permission required' + } else { + $Status = 'Review permission required' + } + } elseif ($Perm.FileSystemRights -like "*Write*") { + if ($AdvancedIdentity.ObjectClass -in 'user', 'computer') { + $Status = 'Removal permission required' + } else { + $Status = 'Review permission required' } } if ($Identity.Type -eq 'Unknown') { - $Status = 'Removal Required' + $Status = 'Removal permission required' } [PSCustomObject] @{ - FullName = $File.FullName - Status = $Status - Extension = $File.Extension - CreationTime = $File.CreationTime - LastAccessTime = $File.LastAccessTime - LastWriteTime = $File.LastWriteTime - Attributes = $File.Attributes - AccessControlType = $Perm.AccessControlType # : Allow - Principal = $Identity.Name # : BUILTIN\Administrators - PrincipalSid = $Identity.SID - PrincipalType = $Identity.Type - FileSystemRights = $Perm.FileSystemRights # : FullControl - IsInherited = $Perm.IsInherited # : True - FullNameOnSysVol = $File.FullName.Replace($Path, $PathOnSysvol) + FullName = $File.FullName + Status = $Status + DomainName = $Domain + Extension = $File.Extension + CreationTime = $File.CreationTime + LastAccessTime = $File.LastAccessTime + LastWriteTime = $File.LastWriteTime + Attributes = $File.Attributes + AccessControlType = $Perm.AccessControlType # : Allow + Principal = $Identity.Name # : BUILTIN\Administrators + PrincipalSid = $Identity.SID + PrincipalType = $Identity.Type + PrincipalObjectClass = $AdvancedIdentity.ObjectClass + FileSystemRights = $Perm.FileSystemRights # : FullControl + IsInherited = $Perm.IsInherited # : True + FullNameOnSysVol = $File.FullName.Replace($Path, $PathOnSysvol) } } } else { + if ($IdentityOwner.SID -eq "S-1-5-32-544") { + $Status = 'OK' + } else { + $Status = 'Replace owner required' + } [PSCustomObject] @{ FullName = $File.FullName + Status = $Status + DomainName = $Domain Extension = $File.Extension CreationTime = $File.CreationTime LastAccessTime = $File.LastAccessTime