mirror of
https://github.com/EvotecIT/GPOZaurr.git
synced 2026-07-26 20:00:09 +00:00
Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Przemysław Kłys
|
5af51e8022 | ||
|
Przemysław Kłys
|
4a1fa30e7d |
@@ -1,5 +1,7 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
$T = Get-GPOZaurrPermission #-SkipWellKnown #-SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView
|
||||
$T = Get-GPOZaurrPermission -GPOName 'DC | PowerShell Logging' -Type Unknown
|
||||
|
||||
#$T = Get-GPOZaurrPermission #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView
|
||||
$T | Format-Table -AutoSize *
|
||||
#$T | Out-HtmlView -ScrollX -Filtering -Online -DisablePaging
|
||||
+1
-1
@@ -7,7 +7,7 @@
|
||||
Description = 'Group Policy Eater'
|
||||
FunctionsToExport = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOZaurrOwner', 'Set-GPOZaurrWMI'
|
||||
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
|
||||
ModuleVersion = '0.0.10'
|
||||
ModuleVersion = '0.0.12'
|
||||
PowerShellVersion = '5.1'
|
||||
PrivateData = @{
|
||||
PSData = @{
|
||||
|
||||
@@ -0,0 +1,112 @@
|
||||
function Get-PrivPermission {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[Microsoft.GroupPolicy.Gpo] $GPO,
|
||||
[switch] $SkipWellKnown,
|
||||
[switch] $SkipAdministrative,
|
||||
[switch] $IncludeOwner,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
|
||||
[switch] $IncludeGPOObject,
|
||||
[System.Collections.IDictionary] $ADAdministrativeGroups,
|
||||
[string[]] $Type
|
||||
)
|
||||
|
||||
# $GPO = $_
|
||||
Write-Verbose "Get-GPOZaurrPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
|
||||
$SecurityRights = $GPO.GetSecurityInfo()
|
||||
$SecurityRights | ForEach-Object -Process {
|
||||
#Get-GPPermissions -Guid $GPO.ID -DomainName $GPO.DomainName -All -Server $QueryServer | ForEach-Object -Process {
|
||||
$GPOPermission = $_
|
||||
if ($ExcludePermissionType -contains $GPOPermission.Permission) {
|
||||
return
|
||||
}
|
||||
if ($IncludePermissionType) {
|
||||
if ($IncludePermissionType -notcontains $GPOPermission.Permission) {
|
||||
return
|
||||
}
|
||||
}
|
||||
if ($SkipWellKnown.IsPresent) {
|
||||
if ($GPOPermission.Trustee.SidType -eq 'WellKnownGroup') {
|
||||
return
|
||||
}
|
||||
}
|
||||
if ($SkipAdministrative.IsPresent) {
|
||||
$IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
|
||||
if ($IsAdministrative) {
|
||||
return
|
||||
}
|
||||
}
|
||||
if ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
|
||||
# May need updates if there's more types
|
||||
if ($GPOPermission.Trustee.SidType -ne 'Unknown') {
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
$ReturnObject = [ordered] @{
|
||||
DisplayName = $GPO.DisplayName # : ALL | Enable RDP
|
||||
GUID = $GPO.ID
|
||||
DomainName = $GPO.DomainName # : ad.evotec.xyz
|
||||
Enabled = $GPO.GpoStatus
|
||||
Description = $GPO.Description
|
||||
CreationDate = $GPO.CreationTime
|
||||
ModificationTime = $GPO.ModificationTime
|
||||
Permission = $GPOPermission.Permission # : GpoEditDeleteModifySecurity
|
||||
Inherited = $GPOPermission.Inherited # : False
|
||||
Domain = $GPOPermission.Trustee.Domain #: EVOTEC
|
||||
DistinguishedName = $GPOPermission.Trustee.DSPath #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
|
||||
Name = $GPOPermission.Trustee.Name #: Domain Admins
|
||||
Sid = $GPOPermission.Trustee.Sid.Value #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
|
||||
SidType = $GPOPermission.Trustee.SidType #: Group
|
||||
|
||||
}
|
||||
if ($IncludeGPOObject) {
|
||||
$ReturnObject.GPOObject = $GPO
|
||||
$ReturnObject.GPOSecurity = $SecurityRights
|
||||
}
|
||||
[PSCustomObject] $ReturnObject
|
||||
}
|
||||
if ($IncludeOwner.IsPresent) {
|
||||
if ($GPO.Owner) {
|
||||
$SplittedOwner = $GPO.Owner.Split('\')
|
||||
$DomainOwner = $SplittedOwner[0] #: EVOTEC
|
||||
$DomainUserName = $SplittedOwner[1] #: Domain Admins
|
||||
$SID = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].Sid.Value
|
||||
if ($SID) {
|
||||
$SIDType = 'Group'
|
||||
$DistinguishedName = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].DistinguishedName
|
||||
} else {
|
||||
$SIDType = ''
|
||||
$DistinguishedName = ''
|
||||
}
|
||||
} else {
|
||||
$DomainOwner = $GPO.Owner
|
||||
$DomainUserName = ''
|
||||
$SID = ''
|
||||
$SIDType = ''
|
||||
$DistinguishedName = ''
|
||||
}
|
||||
$ReturnObject = [ordered] @{
|
||||
DisplayName = $GPO.DisplayName # : ALL | Enable RDP
|
||||
GUID = $GPO.GUID
|
||||
DomainName = $GPO.DomainName # : ad.evotec.xyz
|
||||
Enabled = $GPO.GpoStatus
|
||||
Description = $GPO.Description
|
||||
CreationDate = $GPO.CreationTime
|
||||
ModificationTime = $GPO.ModificationTime
|
||||
Permission = 'GpoOwner' # : GpoEditDeleteModifySecurity
|
||||
Inherited = $false # : False
|
||||
Domain = $DomainOwner
|
||||
DistinguishedName = $DistinguishedName #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
|
||||
Name = $DomainUserName
|
||||
Sid = $SID #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
|
||||
SidType = $SIDType # #: Group
|
||||
}
|
||||
if ($IncludeGPOObject) {
|
||||
$ReturnObject.GPOObject = $GPO
|
||||
$ReturnObject.GPOSecurity = $SecurityRights
|
||||
}
|
||||
[PSCustomObject] $ReturnObject
|
||||
}
|
||||
}
|
||||
@@ -1,122 +1,50 @@
|
||||
function Get-GPOZaurrPermission {
|
||||
[cmdletBinding()]
|
||||
[cmdletBinding(DefaultParameterSetName = 'GPO' )]
|
||||
param(
|
||||
[string[]]$NamedObjects,
|
||||
[Parameter(ParameterSetName = 'GPOName')]
|
||||
[string] $GPOName,
|
||||
|
||||
[Parameter(ParameterSetName = 'GPOGUID')]
|
||||
[alias('GUID', 'GPOID')][string] $GPOGuid,
|
||||
|
||||
[validateSet('Unknown', 'All')][string[]] $Type = 'All',
|
||||
|
||||
[switch] $SkipWellKnown,
|
||||
[switch] $SkipAdministrative,
|
||||
|
||||
[switch] $IncludeOwner,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
|
||||
[switch] $IncludeGPOObject,
|
||||
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
[System.Collections.IDictionary] $ExtendedForestInformation,
|
||||
|
||||
[alias('Unknown', 'All')][string[]] $Type = 'All',
|
||||
[switch] $IncludeOwner,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
|
||||
[switch] $IncludeGPOObject
|
||||
[System.Collections.IDictionary] $ExtendedForestInformation
|
||||
)
|
||||
Begin {
|
||||
# if ($Type -contains 'NonAdministrative') {
|
||||
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
#}
|
||||
#$Count = 0
|
||||
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
if ($Type -eq 'Unknown') {
|
||||
if ($SkipAdministrative -or $SkipWellKnown) {
|
||||
Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
|
||||
}
|
||||
}
|
||||
}
|
||||
Process {
|
||||
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
$QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
|
||||
Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
|
||||
$GPO = $_
|
||||
Write-Verbose "Get-GPOZaurrPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
|
||||
$SecurityRights = $GPO.GetSecurityInfo()
|
||||
$SecurityRights | ForEach-Object -Process {
|
||||
#Get-GPPermissions -Guid $GPO.ID -DomainName $GPO.DomainName -All -Server $QueryServer | ForEach-Object -Process {
|
||||
$GPOPermission = $_
|
||||
if ($ExcludePermissionType -contains $GPOPermission.Permission) {
|
||||
return
|
||||
}
|
||||
if ($IncludePermissionType) {
|
||||
if ($IncludePermissionType -notcontains $GPOPermission.Permission) {
|
||||
return
|
||||
}
|
||||
}
|
||||
if ($SkipWellKnown.IsPresent) {
|
||||
if ($GPOPermission.Trustee.SidType -eq 'WellKnownGroup') {
|
||||
return
|
||||
}
|
||||
}
|
||||
if ($SkipAdministrative.IsPresent) {
|
||||
$IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
|
||||
if ($IsAdministrative) {
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
$ReturnObject = [ordered] @{
|
||||
DisplayName = $GPO.DisplayName # : ALL | Enable RDP
|
||||
GUID = $GPO.ID
|
||||
DomainName = $GPO.DomainName # : ad.evotec.xyz
|
||||
Enabled = $GPO.GpoStatus
|
||||
Description = $GPO.Description
|
||||
CreationDate = $GPO.CreationTime
|
||||
ModificationTime = $GPO.ModificationTime
|
||||
Permission = $GPOPermission.Permission # : GpoEditDeleteModifySecurity
|
||||
Inherited = $GPOPermission.Inherited # : False
|
||||
Domain = $GPOPermission.Trustee.Domain #: EVOTEC
|
||||
DistinguishedName = $GPOPermission.Trustee.DSPath #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
|
||||
Name = $GPOPermission.Trustee.Name #: Domain Admins
|
||||
Sid = $GPOPermission.Trustee.Sid.Value #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
|
||||
SidType = $GPOPermission.Trustee.SidType #: Group
|
||||
|
||||
}
|
||||
if ($IncludeGPOObject) {
|
||||
$ReturnObject.GPOObject = $GPO
|
||||
$ReturnObject.GPOSecurity = $SecurityRights
|
||||
}
|
||||
[PSCustomObject] $ReturnObject
|
||||
if ($GPOName) {
|
||||
Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
|
||||
Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
|
||||
}
|
||||
if ($IncludeOwner.IsPresent) {
|
||||
if ($GPO.Owner) {
|
||||
$SplittedOwner = $GPO.Owner.Split('\')
|
||||
$DomainOwner = $SplittedOwner[0] #: EVOTEC
|
||||
$DomainUserName = $SplittedOwner[1] #: Domain Admins
|
||||
$SID = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].Sid.Value
|
||||
if ($SID) {
|
||||
$SIDType = 'Group'
|
||||
$DistinguishedName = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].DistinguishedName
|
||||
} else {
|
||||
$SIDType = ''
|
||||
$DistinguishedName = ''
|
||||
}
|
||||
} else {
|
||||
$DomainOwner = $GPO.Owner
|
||||
$DomainUserName = ''
|
||||
$SID = ''
|
||||
$SIDType = ''
|
||||
$DistinguishedName = ''
|
||||
}
|
||||
$ReturnObject = [ordered] @{
|
||||
DisplayName = $GPO.DisplayName # : ALL | Enable RDP
|
||||
GUID = $GPO.GUID
|
||||
DomainName = $GPO.DomainName # : ad.evotec.xyz
|
||||
Enabled = $GPO.GpoStatus
|
||||
Description = $GPO.Description
|
||||
CreationDate = $GPO.CreationTime
|
||||
ModificationTime = $GPO.ModificationTime
|
||||
Permission = 'GpoOwner' # : GpoEditDeleteModifySecurity
|
||||
Inherited = $false # : False
|
||||
Domain = $DomainOwner
|
||||
DistinguishedName = $DistinguishedName #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
|
||||
Name = $DomainUserName
|
||||
Sid = $SID #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
|
||||
SidType = $SIDType # #: Group
|
||||
}
|
||||
if ($IncludeGPOObject) {
|
||||
$ReturnObject.GPOObject = $GPO
|
||||
$ReturnObject.GPOSecurity = $SecurityRights
|
||||
}
|
||||
[PSCustomObject] $ReturnObject
|
||||
} elseif ($GPOGuid) {
|
||||
Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
|
||||
Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
|
||||
}
|
||||
} else {
|
||||
Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
|
||||
Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,7 +1,16 @@
|
||||
function Remove-GPOZaurrPermission {
|
||||
[cmdletBinding(SupportsShouldProcess)]
|
||||
param(
|
||||
[alias('Unknown', 'Named')][string[]] $Type,
|
||||
[Parameter(ParameterSetName = 'GPOName', Mandatory)]
|
||||
[string] $GPOName,
|
||||
|
||||
[Parameter(ParameterSetName = 'GPOGUID', Mandatory)]
|
||||
[alias('GUID', 'GPOID')][string] $GPOGuid,
|
||||
|
||||
[Parameter(ParameterSetName = 'GPOGUID', Mandatory)]
|
||||
[validateset('Unknown', 'Named')][string[]] $Type,
|
||||
|
||||
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
|
||||
[Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
|
||||
[switch] $SkipWellKnown,
|
||||
@@ -33,11 +42,11 @@
|
||||
$GPOPermission.GPOSecurity.RemoveTrustee($GPOPermission.Sid)
|
||||
$GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
|
||||
# Set-GPPPermission doesn't work on Unknown Accounts
|
||||
$Count++
|
||||
if ($Count -eq $LimitProcessing) {
|
||||
# skipping skips per removed permission not per gpo.
|
||||
break
|
||||
}
|
||||
}
|
||||
$Count++
|
||||
if ($Count -eq $LimitProcessing) {
|
||||
# skipping skips per removed permission not per gpo.
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -49,17 +58,13 @@
|
||||
$GPOPermission.GPOSecurity.RemoveTrustee($GPOPermission.Sid)
|
||||
$GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
|
||||
# Set-GPPPermission doesn't work on Unknown Accounts
|
||||
$Count++
|
||||
if ($Count -eq $LimitProcessing) {
|
||||
# skipping skips per removed permission not per gpo.
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
$Count++
|
||||
if ($Count -eq $LimitProcessing) {
|
||||
# skipping skips per removed permission not per gpo.
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
}
|
||||
#Set-GPPermission -PermissionLevel None -TargetName $GPOPermission.Sid -Verbose -DomainName $GPOPermission.DomainName -Guid $GPOPermission.GUID #-WhatIf
|
||||
#Set-GPPermission -PermissionLevel GpoRead -TargetName 'Authenticated Users' -TargetType Group -Verbose -DomainName $Domain -Guid $_.GUID -WhatIf
|
||||
|
||||
Reference in New Issue
Block a user