diff --git a/Public/Get-GPOZaurrConsistency.ps1 b/Public/Get-GPOZaurrConsistency.ps1 deleted file mode 100644 index 0740c58..0000000 --- a/Public/Get-GPOZaurrConsistency.ps1 +++ /dev/null @@ -1,130 +0,0 @@ -function Get-GPOZaurrPermissionConsistency { - [cmdletBinding()] - param( - [Parameter(ParameterSetName = 'GPOName')] - [string] $GPOName, - - [Parameter(ParameterSetName = 'GPOGUID')] - [alias('GUID', 'GPOID')][string] $GPOGuid, - - [Parameter(ParameterSetName = 'Type')][validateSet('Consistent', 'Inconsistent', 'All')][string[]] $Type = 'All', - - [alias('ForestName')][string] $Forest, - [string[]] $ExcludeDomains, - [alias('Domain', 'Domains')][string[]] $IncludeDomains, - [System.Collections.IDictionary] $ExtendedForestInformation, - - [switch] $IncludeGPOObject - ) - Begin { - $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation - } - Process { - foreach ($Domain in $ForestInformation.Domains) { - $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0] - if ($GPOName) { - Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process { - try { - $IsConsistent = $_.IsAclConsistent() - $ErrorMessage = '' - } catch { - $ErrorMessage = $_.Exception.Message - Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)." - $IsConsistent = 'Not available.' - } - $Object = @{ - DisplayName = $_.DisplayName # : New Group Policy Object - DomainName = $_.DomainName # : ad.evotec.xyz - ACLConsistent = $IsConsistent - Owner = $_.Owner # : EVOTEC\Enterprise Admins - Id = $_.Id # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295 - GpoStatus = $_.GpoStatus # : AllSettingsEnabled - Description = $_.Description # : - CreationTime = $_.CreationTime # : 04.03.2020 17:19:42 - ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36 - UserVersion = $_.UserVersion # : AD Version: 0, SysVol Version: 0 - ComputerVersion = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1 - WmiFilter = $_.WmiFilter # : - Error = $ErrorMessage - } - if ($IncludeGPOObject) { - $Object['IncludeGPOObject'] = $_ - } - [PSCustomObject] $Object - } - } elseif ($GPOGuid) { - Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process { - try { - $IsConsistent = $_.IsAclConsistent() - $ErrorMessage = '' - } catch { - $ErrorMessage = $_.Exception.Message - Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)." - $IsConsistent = 'Not available.' - } - $Object = @{ - DisplayName = $_.DisplayName # : New Group Policy Object - DomainName = $_.DomainName # : ad.evotec.xyz - ACLConsistent = $IsConsistent - Owner = $_.Owner # : EVOTEC\Enterprise Admins - Id = $_.Id # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295 - GpoStatus = $_.GpoStatus # : AllSettingsEnabled - Description = $_.Description # : - CreationTime = $_.CreationTime # : 04.03.2020 17:19:42 - ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36 - UserVersion = $_.UserVersion # : AD Version: 0, SysVol Version: 0 - ComputerVersion = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1 - WmiFilter = $_.WmiFilter # : - Error = $ErrorMessage - } - if ($IncludeGPOObject) { - $Object['IncludeGPOObject'] = $_ - } - [PSCustomObject] $Object - } - } else { - Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process { - try { - $IsConsistent = $_.IsAclConsistent() - $ErrorMessage = '' - } catch { - $ErrorMessage = $_.Exception.Message - Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)." - $IsConsistent = 'Not available.' - } - if ($Type -eq 'Consistent') { - if (-not $IsConsistent) { - return - } - } elseif ($Type -eq 'Inconsistent') { - if ($IsConsistent -eq $true) { - return - } - } - $Object = @{ - DisplayName = $_.DisplayName # : New Group Policy Object - DomainName = $_.DomainName # : ad.evotec.xyz - ACLConsistent = $IsConsistent - Owner = $_.Owner # : EVOTEC\Enterprise Admins - Id = $_.Id # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295 - GpoStatus = $_.GpoStatus # : AllSettingsEnabled - Description = $_.Description # : - CreationTime = $_.CreationTime # : 04.03.2020 17:19:42 - ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36 - UserVersion = $_.UserVersion # : AD Version: 0, SysVol Version: 0 - ComputerVersion = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1 - WmiFilter = $_.WmiFilter # : - Error = $ErrorMessage - } - if ($IncludeGPOObject) { - $Object['IncludeGPOObject'] = $_ - } - [PSCustomObject] $Object - } - } - } - } - End { - - } -} \ No newline at end of file diff --git a/Public/Get-GPOZaurrPermissionConsistency.ps1 b/Public/Get-GPOZaurrPermissionConsistency.ps1 new file mode 100644 index 0000000..5ef2f7e --- /dev/null +++ b/Public/Get-GPOZaurrPermissionConsistency.ps1 @@ -0,0 +1,214 @@ +function Get-GPOZaurrPermissionConsistency { + [cmdletBinding()] + param( + [Parameter(ParameterSetName = 'GPOName')][string] $GPOName, + [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid, + [Parameter(ParameterSetName = 'Type')][validateSet('Consistent', 'Inconsistent', 'All')][string[]] $Type = 'All', + [alias('ForestName')][string] $Forest, + [string[]] $ExcludeDomains, + [alias('Domain', 'Domains')][string[]] $IncludeDomains, + [System.Collections.IDictionary] $ExtendedForestInformation, + [switch] $IncludeGPOObject, + [switch] $VerifyInside + ) + Begin { + $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation + } + Process { + foreach ($Domain in $ForestInformation.Domains) { + $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0] + if ($GPOName) { + $getGPOSplat = @{ + Name = $GPOName + Domain = $Domain + Server = $QueryServer + ErrorAction = 'SilentlyContinue' + } + } elseif ($GPOGuid) { + $getGPOSplat = @{ + Guid = $GPOGuid + Domain = $Domain + Server = $QueryServer + ErrorAction = 'SilentlyContinue' + } + } else { + $getGPOSplat = @{ + All = $true + Domain = $Domain + Server = $QueryServer + ErrorAction = 'SilentlyContinue' + } + } + Get-GPO @getGPOSplat | ForEach-Object -Process { + try { + $IsConsistent = $_.IsAclConsistent() + $ErrorMessage = '' + } catch { + $ErrorMessage = $_.Exception.Message + Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)." + $IsConsistent = 'Not available.' + } + $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}') + if ($VerifyInside) { + $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath + [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) { + if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) { + $File + } + } + if ($NotInheritedPermissions.Count -eq 0) { + $ACLConsistentInside = $true + } else { + $ACLConsistentInside = $false + } + } else { + $ACLConsistentInside = $null + } + $Object = [ordered] @{ + DisplayName = $_.DisplayName # : New Group Policy Object + DomainName = $_.DomainName # : ad.evotec.xyz + ACLConsistent = $IsConsistent + ACLConsistentInside = $ACLConsistentInside + Owner = $_.Owner # : EVOTEC\Enterprise Admins + Path = $_.Path + SysVolPath = $SysvolPath + Id = $_.Id # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295 + GpoStatus = $_.GpoStatus # : AllSettingsEnabled + Description = $_.Description # : + CreationTime = $_.CreationTime # : 04.03.2020 17:19:42 + ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36 + UserVersion = $_.UserVersion # : AD Version: 0, SysVol Version: 0 + ComputerVersion = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1 + WmiFilter = $_.WmiFilter # : + Error = $ErrorMessage + } + if ($IncludeGPOObject) { + $Object['IncludeGPOObject'] = $_ + } + if ($VerifyInside) { + $Object['ACLConsistentInsideDetails'] = $NotInheritedPermissions + } + [PSCustomObject] $Object + } + <# + } elseif ($GPOGuid) { + Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process { + try { + $IsConsistent = $_.IsAclConsistent() + $ErrorMessage = '' + } catch { + $ErrorMessage = $_.Exception.Message + Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)." + $IsConsistent = 'Not available.' + } + $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}') + if ($Advanced) { + $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath + [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) { + if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) { + $File + } + } + if ($NotInheritedPermissions.Count -eq 0) { + $ACLConsistentInside = $true + } else { + $ACLConsistentInside = $false + } + } else { + $ACLConsistentInside = $null + } + $Object = [ordered] @{ + DisplayName = $_.DisplayName # : New Group Policy Object + DomainName = $_.DomainName # : ad.evotec.xyz + ACLConsistent = $IsConsistent + ACLConsistentInside = $ACLConsistentInside + Owner = $_.Owner # : EVOTEC\Enterprise Admins + Path = $_.Path + SysVolPath = $SysvolPath + Id = $_.Id # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295 + GpoStatus = $_.GpoStatus # : AllSettingsEnabled + Description = $_.Description # : + CreationTime = $_.CreationTime # : 04.03.2020 17:19:42 + ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36 + UserVersion = $_.UserVersion # : AD Version: 0, SysVol Version: 0 + ComputerVersion = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1 + WmiFilter = $_.WmiFilter # : + Error = $ErrorMessage + } + if ($Advanced) { + $Object['ACLConsistentInsideDetails'] = $NotInheritedPermissions + } + if ($IncludeGPOObject) { + $Object['IncludeGPOObject'] = $_ + } + [PSCustomObject] $Object + } + } else { + Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process { + try { + $IsConsistent = $_.IsAclConsistent() + $ErrorMessage = '' + } catch { + $ErrorMessage = $_.Exception.Message + Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)." + $IsConsistent = 'Not available.' + } + if ($Type -eq 'Consistent') { + if (-not $IsConsistent) { + return + } + } elseif ($Type -eq 'Inconsistent') { + if ($IsConsistent -eq $true) { + return + } + } + $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}') + if ($Advanced) { + $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath + [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) { + if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) { + $File + } + } + if ($NotInheritedPermissions.Count -eq 0) { + $ACLConsistentInside = $true + } else { + $ACLConsistentInside = $false + } + } else { + $ACLConsistentInside = $null + } + $Object = [ordered] @{ + DisplayName = $_.DisplayName # : New Group Policy Object + DomainName = $_.DomainName # : ad.evotec.xyz + ACLConsistent = $IsConsistent + ACLConsistentInside = $ACLConsistentInside + Owner = $_.Owner # : EVOTEC\Enterprise Admins + Path = $_.Path + SysVolPath = $SysvolPath + Id = $_.Id # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295 + GpoStatus = $_.GpoStatus # : AllSettingsEnabled + Description = $_.Description # : + CreationTime = $_.CreationTime # : 04.03.2020 17:19:42 + ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36 + UserVersion = $_.UserVersion # : AD Version: 0, SysVol Version: 0 + ComputerVersion = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1 + WmiFilter = $_.WmiFilter # : + Error = $ErrorMessage + } + if ($Advanced) { + $Object['ACLConsistentInsideDetails'] = $NotInheritedPermissions + } + if ($IncludeGPOObject) { + $Object['IncludeGPOObject'] = $_ + } + [PSCustomObject] $Object + } + } + #> + } + } + End { + + } +} \ No newline at end of file