Update PSD1

Examples/Example-14-ListingGPOsPerOU1.ps1

@@ -1,3 +1,3 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-Get-GPOZaurrLink | Format-Table -AutoSize *
+Get-GPOZaurrLink -Verbose | Format-Table -AutoSize *

Examples/Example-29-FindGPO4.ps1

@@ -1,4 +1,4 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$Output = Invoke-GPOZaurrContent -Verbose -OutputType HTML, Object -Open
+$Output = Invoke-GPOZaurrContent -Verbose -OutputType HTML, Object -Open -Type LocalGroups
 $Output | Format-Table

Examples/Example-40-ShowGPO01.ps1

@@ -1,4 +1,4 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 #$Output = Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -PassThru -Type GPOConsistency, GPOList, GPODuplicates, GPOOrphans, GPOOwners, NetLogonOwners, GPOPermissionsRead, GPOPermissionsAdministrative,GPOPermissionsUnknown
-Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Type GPOPermissions,GPOPermissionsRead
+Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Type GPOBrokenLink

Examples/Example-47-DetectBrokenLinks.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Get-GPOZaurrBrokenLink -Verbose | Format-Table -AutoSize *
+
+Get-GPOZaurrBrokenLink -Verbose -IncludeDomains ad.evotec.pl | Format-Table -AutoSize *

Examples/Example-48-RepairBrokenLinks.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Repair-GPOZaurrBrokenLink -Verbose -LimitProcessing 1 -WhatIf
+
+#Repair-GPOZaurrBrokenLink -Verbose -IncludeDomains ad.evotec.pl -LimitProcessing 30 #-WhatIf

GPOZaurr.psd1

@@ -6,9 +6,9 @@
     CompatiblePSEditions = @('Desktop')
     Copyright            = '(c) 2011 - 2021 Przemyslaw Klys @ Evotec. All rights reserved.'
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
-    FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionAnalysis', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermission', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Set-GPOZaurrStatus', 'Skip-GroupPolicy')
+    FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrBrokenLink', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionAnalysis', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrBrokenLink', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermission', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Set-GPOZaurrStatus', 'Skip-GroupPolicy')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.102'
+    ModuleVersion        = '0.0.106'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -18,11 +18,11 @@
         }
     }
     RequiredModules      = @(@{
-            ModuleVersion = '0.0.192'
+            ModuleVersion = '0.0.193'
             ModuleName    = 'PSSharedGoods'
             Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
         }, @{
-            ModuleVersion = '0.0.103'
+            ModuleVersion = '0.0.104'
             ModuleName    = 'ADEssentials'
             Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
         }, @{

Private/Get-PrivGPOZaurrLInk.ps1

@@ -42,6 +42,7 @@
             $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $DN -ToDomainCN
             $Output = [ordered] @{
                 DistinguishedName = $Object.DistinguishedName
+                #Domain            = ConvertFrom-DistinguishedName -DistinguishedName $Object.DistinguishedName -ToDomainCN
                 CanonicalName     = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
                 Guid              = [Regex]::Match($DN, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
                 Enforced          = $Enforced

Private/Invoke.GPOZaurrBrokenLink.ps1

@@ -0,0 +1,151 @@
+$GPOZaurrBrokenLink = [ordered] @{
+    Name           = 'Group Policy Broken Links'
+    Enabled        = $true
+    ActionRequired = $null
+    Data           = $null
+    Execute        = {
+        Get-GPOZaurrBrokenLink -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
+    }
+    Processing     = {
+        $Script:Reporting['GPOBrokenLink']['Variables']['RequireDeletion'] = $Script:Reporting['GPOBrokenLink']['Data'].Count
+        $Script:Reporting['GPOBrokenLink']['Variables']['WillFixPerDomain'] = @{}
+        $Script:Reporting['GPOBrokenLink']['Variables']['Unique'] = @{}
+        foreach ($Link In $Script:Reporting['GPOBrokenLink']['Data']) {
+            $DomainName = ConvertFrom-DistinguishedName -ToDomainCN -DistinguishedName $Link.DistinguishedName
+            # Create Per Domain Variables
+            if (-not $Script:Reporting['GPOBrokenLink']['Variables']['WillFixPerDomain'][$DomainName]) {
+                $Script:Reporting['GPOBrokenLink']['Variables']['WillFixPerDomain'][$DomainName] = 0
+            }
+            $Script:Reporting['GPOBrokenLink']['Variables']['WillFixPerDomain'][$DomainName]++
+            # Lets do unique OU counting
+            $Script:Reporting['GPOBrokenLink']['Variables']['Unique'][$Link.CanonicalName] = $Link
+        }
+        $Script:Reporting['GPOBrokenLink']['Variables']['UniqueObjects'] = $Script:Reporting['GPOBrokenLink']['Variables']['Unique'].Keys
+
+        if ($Script:Reporting['GPOBrokenLink']['Data'].Count -gt 0) {
+            $Script:Reporting['GPOBrokenLink']['ActionRequired'] = $true
+        } else {
+            $Script:Reporting['GPOBrokenLink']['ActionRequired'] = $false
+        }
+    }
+    Variables      = @{
+        RequireDeletion  = 0
+        WillFixPerDomain = $null
+        UniqueObjects    = $null
+        Unique           = $null
+    }
+    Overview       = {
+
+    }
+    Summary        = {
+        New-HTMLText -FontSize 10pt -TextBlock {
+            "When GPO is deleted in a proper way it usually is removed from AD, SYSVOL and any link to it is also discarded. "
+            "Unfortunetly this is true only if the GPO is created and linked within same domain. "
+            "If GPO is linked in another domain, this leaves a broken link hanging on wherever it was linked before. "
+            "Additionally Remove-GPO cmdlet doesn't handle site link deletions, which causes dead links to be stuck on sites until those are manually deleted. "
+            "This means that any GPOs deleted using PowerShell may leave trail. "
+        }
+        New-HTMLText -Text @(
+            'As it stands currently there are ',
+            $Script:Reporting['GPOBrokenLink']['Data'].Count,
+            ' broken links that need to be deleted over '
+            $Script:Reporting['GPOBrokenLink']['Variables']['UniqueObjects'].Count,
+            ' unique objects. '
+        ) -FontSize 10pt -FontWeight normal, bold, normal, bold, normal -LineBreak
+        if ($Script:Reporting['GPOBrokenLink']['Data'].Count -ne 0) {
+            New-HTMLText -Text 'Following domains require actions (permissions required):' -FontSize 10pt -FontWeight bold
+            New-HTMLList -Type Unordered {
+                foreach ($Domain in $Script:Reporting['GPOBrokenLink']['Variables']['WillFixPerDomain'].Keys) {
+                    New-HTMLListItem -Text "$Domain requires ", $Script:Reporting['GPOBrokenLink']['Variables']['WillFixPerDomain'][$Domain], " changes." -FontWeight normal, bold, normal
+                }
+            } -FontSize 10pt
+        }
+    }
+    Solution       = {
+        New-HTMLSection -Invisible {
+            New-HTMLPanel {
+                & $Script:GPOConfiguration['GPOBrokenLink']['Summary']
+            }
+            New-HTMLPanel {
+                New-HTMLChart {
+                    New-ChartLegend -Names 'Bad' -Color Salmon
+                    New-ChartBar -Name 'Broken Links' -Value $Script:Reporting['GPOBrokenLink']['Data'].Count
+                } -Title 'Broken Links' -TitleAlignment center
+            }
+        }
+        New-HTMLSection -Name 'Group Policy Broken Links' {
+            New-HTMLTable -DataTable $Script:Reporting['GPOBrokenLink']['Data'] -Filtering {
+
+            } -PagingOptions 10, 20, 30, 40, 50
+        }
+        if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
+            New-HTMLSection -Name 'Steps to remove Broken Links' {
+                New-HTMLContainer {
+                    New-HTMLSpanStyle -FontSize 10pt {
+                        New-HTMLWizard {
+                            New-HTMLWizardStep -Name 'Prepare environment' {
+                                New-HTMLText -Text "To be able to execute actions in automated way please install required modules. Those modules will be installed straight from Microsoft PowerShell Gallery."
+                                New-HTMLCodeBlock -Code {
+                                    Install-Module GPOZaurr -Force
+                                    Import-Module GPOZaurr -Force
+                                } -Style powershell
+                                New-HTMLText -Text "Using force makes sure newest version is downloaded from PowerShellGallery regardless of what is currently installed. Once installed you're ready for next step."
+                            }
+                            New-HTMLWizardStep -Name 'Prepare report' {
+                                New-HTMLText -Text "Depending when this report was run you may want to prepare new report before proceeding fixing GPO links. To generate new report please use:"
+                                New-HTMLCodeBlock -Code {
+                                    Invoke-GPOZaurr -FilePath $Env:UserProfile\Desktop\GPOZaurrBrokenLinkBefore.html -Verbose -Type GPOBrokenLink
+                                }
+                                New-HTMLText -TextBlock {
+                                    "When executed it will take a while to generate all data and provide you with new report depending on size of environment. "
+                                    "Once confirmed that data is still showing issues and requires fixing please proceed with next step. "
+                                }
+                                New-HTMLText -Text "Alternatively if you prefer working with console you can run: "
+                                New-HTMLCodeBlock -Code {
+                                    $GPOOutput = Get-GPOZaurrBrokenLink -Verbose
+                                    $GPOOutput | Format-Table * # do your actions as desired
+                                }
+                                New-HTMLText -Text "It provides same data as you see in table above just doesn't prettify it for you."
+                            }
+                            New-HTMLWizardStep -Name 'Remove Broken Links' {
+                                New-HTMLText -Text "Following command when executed, runs internally command that lists all broken links. After finding them all it delets them according to given criteria. "
+                                New-HTMLText -Text "Make sure when running it for the first time to run it with ", "WhatIf", " parameter as shown below to prevent accidental removal." -FontWeight normal, bold, normal -Color Black, Red, Black
+
+                                New-HTMLCodeBlock -Code {
+                                    Repair-GPOZaurrBrokenLink -WhatIf -Verbose
+                                }
+                                New-HTMLText -TextBlock {
+                                    "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be changed matches expected data. Once happy with results please follow with command: "
+                                }
+                                New-HTMLCodeBlock -Code {
+                                    Repair-GPOZaurrBrokenLink -Verbose -LimitProcessing 2
+                                }
+                                New-HTMLText -TextBlock {
+                                    "This command when executed removes only first X number of links. Keep in mind that 5 broken links on a single Organizational Unit are treated as one. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur. "
+                                    "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly. "
+                                }
+                            }
+                            New-HTMLWizardStep -Name 'Verification report' {
+                                New-HTMLText -TextBlock {
+                                    "Once cleanup task was executed properly, we need to verify that report now shows no problems."
+                                }
+                                New-HTMLCodeBlock -Code {
+                                    Invoke-GPOZaurr -FilePath $Env:UserProfile\Desktop\GPOZaurrBrokenLinkAfter.html -Verbose -Type GPOBrokenLink
+                                }
+                                New-HTMLText -Text "If everything is healthy in the report you're done! Enjoy rest of the day!" -Color BlueDiamond
+                            }
+                        } -RemoveDoneStepOnNavigateBack -Theme arrows -ToolbarButtonPosition center -EnableAllAnchors
+                    }
+                }
+            }
+        }
+        if ($Script:Reporting['GPOBrokenLink']['WarningsAndErrors']) {
+            New-HTMLSection -Name 'Warnings & Errors to Review' {
+                New-HTMLTable -DataTable $Script:Reporting['GPOBrokenLink']['WarningsAndErrors'] -Filtering {
+                    New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
+                    New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
+                }
+            }
+        }
+    }
+}

Private/Invoke.GPOZaurrDuplicate.ps1

@@ -68,7 +68,7 @@
                                 New-HTMLCodeBlock -Code {
                                     Invoke-GPOZaurr -FilePath $Env:UserProfile\Desktop\GPOZaurrDuplicateObjectsBefore.html -Verbose -Type GPODuplicates
                                 }
-                                New-HTMLText -Text {
+                                New-HTMLText -TextBlock {
                                     "When executed it will take a while to generate all data and provide you with new report depending on size of environment. "
                                     "Once confirmed that data is still showing issues and requires fixing please proceed with next step. "
                                 }

Private/Script.GPOConfiguration.ps1

@@ -1,5 +1,6 @@
 $Script:GPOConfiguration = [ordered] @{
     GPOBroken                    = $GPOZaurrOrphans
+    GPOBrokenLink                = $GPOZaurrBrokenLink
     GPOOwners                    = $GPOZaurrOwners
     GPOConsistency               = $GPOZaurrConsistency
     GPODuplicates                = $GPOZaurrDuplicates

Public/Get-GPOZaurrBrokenLink.ps1

@@ -0,0 +1,85 @@
+function Get-GPOZaurrBrokenLink {
+    <#
+    .SYNOPSIS
+    Finds any GPO link that doesn't have a matching GPO (already removed GPO).
+
+    .DESCRIPTION
+    Finds any GPO link that doesn't have a matching GPO (already removed GPO).
+
+    .PARAMETER Forest
+    Target different Forest, by default current forest is used
+
+    .PARAMETER ExcludeDomains
+    Exclude domain from search, by default whole forest is scanned
+
+    .PARAMETER IncludeDomains
+    Include only specific domains, by default whole forest is scanned
+
+    .PARAMETER ExtendedForestInformation
+    Ability to provide Forest Information from another command to speed up processing
+
+    .EXAMPLE
+    Get-GPOZaurrBrokenLink -Verbose | Format-Table -AutoSize *
+
+    .EXAMPLE
+    Get-GPOZaurrBrokenLink -Verbose -IncludeDomains ad.evotec.pl | Format-Table -AutoSize *
+
+    .NOTES
+    General notes
+    #>
+    [cmdletBinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $ErrorFound = $false
+    $PoliciesAD = @{}
+    # We need to request all GPOS from Forest. Requesting just for any domain won't be enough
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -Extended # -Extended
+    foreach ($Domain in $ForestInformation.Domains) {
+        $QueryServer = $ForestInformation['QueryServers']["$Domain"].HostName[0]
+        $SystemsContainer = $ForestInformation['DomainsExtended'][$Domain].SystemsContainer
+        if ($SystemsContainer) {
+            $PoliciesSearchBase = -join ("CN=Policies,", $SystemsContainer)
+            try {
+                $PoliciesInAD = Get-ADObject -ErrorAction Stop -SearchBase $PoliciesSearchBase -SearchScope OneLevel -Filter * -Server $QueryServer -Properties Name, gPCFileSysPath, DisplayName, DistinguishedName, Description, Created, Modified, ObjectClass, ObjectGUID
+            } catch {
+                Write-Warning "Get-GPOZaurrBrokenLink - An error occured while searching $PoliciesSearchBase. Error $($_.Exception.Message). Please resolve this before continuing."
+                $ErrorFound = $true
+                break
+            }
+            foreach ($Policy in $PoliciesInAD) {
+                $GUIDFromDN = ConvertFrom-DistinguishedName -DistinguishedName $Policy.DistinguishedName
+                # $Key = "$($Domain)$($GuidFromDN)"
+                $Key = $Policy.DistinguishedName
+                if ($Policy.ObjectClass -eq 'Container') {
+                    # This usually means GPO deletion process somehow failed and while object itself stayed it isn't groupPolicyContainer anymore
+                    $PoliciesAD[$Key] = 'ObjectClass issue'
+                } else {
+                    $GUID = $Policy.Name
+                    if ($GUID -and $GUIDFromDN) {
+                        $PoliciesAD[$Key] = 'Exists'
+                    } else {
+                        $PoliciesAD[$Key] = 'Permissions issue'
+                    }
+                }
+            }
+        } else {
+            Write-Warning "Get-GPOZaurrBroken - Couldn't get GPOs from $Domain. Skipping"
+        }
+    }
+    if ($ErrorFound) {
+        return
+    }
+    # In case of links we can request here whatever user requested.
+    # This will search for broken links in domain user requested
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -Extended -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    $Links = Get-GPOZaurrLinkLoop -Linked 'All' -ForestInformation $ForestInformation
+    foreach ($Link in $Links) {
+        if (-not $PoliciesAD[$Link.GPODistinguishedName]) {
+            $Link
+        }
+    }
+}

Public/Invoke-GPOZaurrContent.ps1

@@ -95,7 +95,10 @@
     $Output['CategoriesFull'] = [ordered] @{}
 
     Write-Verbose "Invoke-GPOZaurrContent - Loading GPO Report to Categories"
+    $CountGPO = 0
     [Array] $GPOCategories = foreach ($GPO in $GPOs) {
+        $CountGPO++
+        Write-Verbose "Invoke-GPOZaurrContent - Processing [$CountGPO/$($GPOs.Count)] $($GPO.DisplayName)"
         if ($GPOPath) {
             $GPOOutput = $GPO.GPOOutput
         } else {

Public/Repair-GPOZaurrBrokenLink.ps1

@@ -0,0 +1,94 @@
+function Repair-GPOZaurrBrokenLink {
+    <#
+    .SYNOPSIS
+    Removes any link to GPO that no longer exists.
+
+    .DESCRIPTION
+    Removes any link to GPO that no longer exists. It scans all site, organizational unit or domain root making sure every single link that may be linking to GPO that doesn't exists anymore is gone.
+
+    .PARAMETER Forest
+    Target different Forest, by default current forest is used
+
+    .PARAMETER ExcludeDomains
+    Exclude domain from search, by default whole forest is scanned
+
+    .PARAMETER IncludeDomains
+    Include only specific domains, by default whole forest is scanned
+
+    .PARAMETER ExtendedForestInformation
+    Ability to provide Forest Information from another command to speed up processing
+
+    .PARAMETER LimitProcessing
+    Allows to specify maximum number of items that will be fixed in a single run. It doesn't affect amount of GPOs processed
+
+    .EXAMPLE
+    Repair-GPOZaurrBrokenLink -Verbose -LimitProcessing 1 -WhatIf
+
+    .EXAMPLE
+    Repair-GPOZaurrBrokenLink -Verbose -IncludeDomains ad.evotec.pl -LimitProcessing 1 -WhatIf
+
+    .NOTES
+    General notes
+    #>
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [int] $LimitProcessing
+    )
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -Extended
+    $Links = Get-GPOZaurrBrokenLink -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
+    $Cache = @{}
+    foreach ($Link in $Links) {
+        if (-not $Cache[$Link.DistinguishedName]) {
+            $Cache[$Link.DistinguishedName] = [System.Collections.Generic.List[PSCustomObject]]::new()
+        }
+        $Cache[$Link.DistinguishedName].Add($Link)
+    }
+    $Count = 0
+    foreach ($Key in $Cache.Keys) {
+        $Count++
+        Write-Verbose "Repair-GPOZaurrBrokenLink - processing [$Count/$($Cache.Keys.Count)] $Key "
+        $Domain = ConvertFrom-DistinguishedName -ToDomainCN -DistinguishedName $Key
+        $Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+        $Object = Get-ADObject -Identity $Key -Server $Server -Properties gpLink
+        #$MatchLinks = [Regex]::Matches($Object.gpLink, '(?<=\[)(.*?)(?=\])').Value
+        $MatchLinks = [Regex]::Matches($Object.gpLink, '(?<=LDAP:\/\/)(.*?)(?=])').Value
+        $Found = $false
+        $FixedLinks = foreach ($Match in $MatchLinks) {
+            $SplittedValue = $Match -split ';'
+            $GPODN = $SplittedValue[0]
+            # Check if list of non-existing GPOs contains legitimate GPO
+            if ($Cache[$Key].GPODistinguishedName -notcontains $GPODN) {
+                "[LDAP://$Match]"
+                Write-Verbose "Repair-GPOZaurrBrokenLink - legitimate link to GPO $GPODN ($Key)"
+            } else {
+                $Found = $true
+                Write-Verbose "Repair-GPOZaurrBrokenLink - preparing for removal link to $GPODN ($Key)"
+            }
+        }
+        if ($Found) {
+            $NewGpLink = $($FixedLinks -join '')
+            if ($NewGpLink) {
+                try {
+                    Write-Verbose "Repair-GPOZaurrBrokenLink - setting gpLink to $Key - $NewGPLink"
+                    Set-ADObject -Identity $Key -Server $Server -Replace @{ gPLink = $NewGpLink } -ErrorAction Stop
+                } catch {
+                    Write-Warning "Repair-GPOZaurrBrokenLink - setting gpLink to $Key - $NewGpLink failed! Error $($_.Exception.Message)"
+                }
+            } else {
+                try {
+                    Write-Verbose "Repair-GPOZaurrBrokenLink - clearing gpLink for $Key (no other links)"
+                    Set-ADObject -Identity $Key -Server $Server -Clear gPLink -ErrorAction Stop
+                } catch {
+                    Write-Warning "Repair-GPOZaurrBrokenLink - clearing gpLink for $Key failed! Error $($_.Exception.Message)"
+                }
+            }
+            if ($LimitProcessing -eq $Count) {
+                break
+            }
+        }
+    }
+}

Public/Repair-GPOZaurrNetLogonOwner.ps1

@@ -1,4 +1,35 @@
 function Repair-GPOZaurrNetLogonOwner {
+    <#
+    .SYNOPSIS
+    Sets new owner to each file in NetLogon share.
+
+    .DESCRIPTION
+    Sets new owner to each file in NetLogon share.
+
+    .PARAMETER Forest
+    Target different Forest, by default current forest is used
+
+    .PARAMETER ExcludeDomains
+    Exclude domain from search, by default whole forest is scanned
+
+    .PARAMETER IncludeDomains
+    Include only specific domains, by default whole forest is scanned
+
+    .PARAMETER ExtendedForestInformation
+    Ability to provide Forest Information from another command to speed up processing
+
+    .PARAMETER Principal
+    Provide named owner. If not provided default S-1-5-32-544 is used.
+
+    .PARAMETER LimitProcessing
+    Allows to specify maximum number of items that will be fixed in a single run. It doesn't affect amount of GPOs processed
+
+    .EXAMPLE
+    Repair-GPOZaurrNetLogonOwner -WhatIf -Verbose -IncludeDomains ad.evotec.pl
+
+    .NOTES
+    General notes
+    #>
     [cmdletBinding(SupportsShouldProcess)]
     param(
         [alias('ForestName')][string] $Forest,

README.md

@@ -57,6 +57,21 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
+- 0.0.106 - 2021.01.11
+  - [x] Improved `Invoke-GPOZaurrContent`
+- 0.0.105 - 2021.01.05
+  - [x] Improved `Get-GPOZaurr`
+    - [x] Improved report `GPOBrokenLink`
+- 0.0.104 - 2021.01.04
+  - [x] Improved `Get-GPOZaurrBrokenLink`
+  - [x] Improved `Repair-GPOZaurrBrokenLink`
+  - [x] Improved `Get-GPOZaurr`
+    - [x] Improved report `GPOBrokenLink`
+- 0.0.103 - 2021.01.04
+  - [x] Improved `Get-GPOZaurr`
+    - [x] Added new report `GPOBrokenLink`
+  - [x] Added `Get-GPOZaurrBrokenLink`
+  - [x] Added `Repair-GPOZaurrBrokenLink`
 - 0.0.102 - 2021.01.02
   - [x] Improved `Get-GPOZaurrLink`
     - [x] Supports all links across forest