Update PSD1

Handles ObjectClass problem properly now

GPOZaurr.psd1

@@ -8,7 +8,7 @@
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
     FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrBrokenLink', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionAnalysis', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrBrokenLink', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermission', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Set-GPOZaurrStatus', 'Skip-GroupPolicy')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.114'
+    ModuleVersion        = '0.0.121'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -22,11 +22,11 @@
             ModuleName    = 'PSSharedGoods'
             Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
         }, @{
-            ModuleVersion = '0.0.107'
+            ModuleVersion = '0.0.112'
             ModuleName    = 'ADEssentials'
             Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
         }, @{
-            ModuleVersion = '0.0.130'
+            ModuleVersion = '0.0.132'
             ModuleName    = 'PSWriteHTML'
             Guid          = 'a7bdf640-f5cb-4acf-9de0-365b322d245c'
         }, 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility', 'Microsoft.PowerShell.Security')

Private/ConvertTo-XMLFolderRedirection.ps1

@@ -0,0 +1,70 @@
+function ConvertTo-XMLFolderRedirection {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Folder in $GPO.DataSet) {
+            foreach ($Location in $Folder.Location) {
+                [PSCustomObject] @{
+                    DestinationPath           = $Location.DestinationPath
+                    SecuritySID               = $Location.SecurityGroup.SID.'#text'
+                    SecurityName              = $Location.SecurityGroup.Name.'#text'
+                    GrantExclusiveRights      = if ($Folder.GrantExclusiveRights -eq 'true') { $true } else { $false }
+                    MoveContents              = if ($Folder.MoveContents -eq 'true') { $true } else { $false }
+                    FollowParent              = if ($Folder.FollowParent -eq 'true') { $true } else { $false }
+                    ApplyToDownLevel          = if ($Folder.ApplyToDownLevel -eq 'true') { $true } else { $false }
+                    DoNotCare                 = if ($Folder.DoNotCare -eq 'true') { $true } else { $false }
+                    RedirectToLocal           = if ($Folder.RedirectToLocal -eq 'true') { $true } else { $false }
+                    PolicyRemovalBehavior     = $Folder.PolicyRemovalBehavior     # : LeaveContents
+                    ConfigurationControl      = if ($Folder.ConfigurationControl -eq 'GP') { 'Group Policy' } else { $Folder.ConfigurationControl }      # : GP
+                    PrimaryComputerEvaluation = $Folder.PrimaryComputerEvaluation # : PrimaryComputerPolicyDisabled
+                }
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Folder in $GPO.DataSet) {
+            foreach ($Location in $Folder.Location) {
+                $CreateGPO = [ordered]@{
+                    DisplayName               = $GPO.DisplayName
+                    DomainName                = $GPO.DomainName
+                    GUID                      = $GPO.GUID
+                    GpoType                   = $GPO.GpoType
+                    Id                        = $Folder.Id
+                    DestinationPath           = $Location.DestinationPath
+                    SecuritySID               = $Location.SecurityGroup.SID.'#text'
+                    SecurityName              = $Location.SecurityGroup.Name.'#text'
+                    GrantExclusiveRights      = if ($Folder.GrantExclusiveRights -eq 'true') { $true } else { $false }
+                    MoveContents              = if ($Folder.MoveContents -eq 'true') { $true } else { $false }
+                    FollowParent              = if ($Folder.FollowParent -eq 'true') { $true } else { $false }
+                    ApplyToDownLevel          = if ($Folder.ApplyToDownLevel -eq 'true') { $true } else { $false }
+                    DoNotCare                 = if ($Folder.DoNotCare -eq 'true') { $true } else { $false }
+                    RedirectToLocal           = if ($Folder.RedirectToLocal -eq 'true') { $true } else { $false }
+                    PolicyRemovalBehavior     = $Folder.PolicyRemovalBehavior     # : LeaveContents
+                    ConfigurationControl      = if ($Folder.ConfigurationControl -eq 'GP') { 'Group Policy' } else { $Folder.ConfigurationControl }      # : GP
+                    PrimaryComputerEvaluation = $Folder.PrimaryComputerEvaluation # : PrimaryComputerPolicyDisabled
+                    Linked                    = $GPO.Linked
+                    LinksCount                = $GPO.LinksCount
+                    Links                     = $GPO.Links
+                }
+                [PSCustomObject] $CreateGPO
+            }
+        }
+    }
+}

Private/Get-XMLGPO.ps1

@@ -12,6 +12,10 @@
         [string[]] $Type,
         [System.Collections.IDictionary] $LinksSummaryCache
     )
+
+    $DisplayName = $XMLContent.GPO.Name
+    $DomainName = $XMLContent.GPO.Identifier.Domain.'#text'
+
     if ($LinksSummaryCache) {
         $SearchGUID = -join ($XMLContent.GPO.Identifier.Domain.'#text', $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}')
         if ($LinksSummaryCache[$SearchGUID]) {
@@ -73,7 +77,7 @@
     } elseif ($XMLContent.GPO.Computer.Enabled -eq 'True') {
         $ComputerEnabled = $true
     } else {
-        Write-Warning "Get-XMLGPO - Computer enabled not set to true or false. Weird."
+        Write-Warning "Get-XMLGPO - Computer enabled not set to true or false [$DisplayName/$DomainName]. Weird."
         $ComputerEnabled = $null
     }
     if ($XMLContent.GPO.User.Enabled -eq 'False') {
@@ -81,7 +85,7 @@
     } elseif ($XMLContent.GPO.User.Enabled -eq 'True') {
         $UserEnabled = $true
     } else {
-        Write-Warning "Get-XMLGPO - User enabled not set to true or false. Weird."
+        Write-Warning "Get-XMLGPO - User enabled not set to true or false [$DisplayName/$DomainName] . Weird."
         $UserEnabled = $null
     }
     # Translate Enabled to same as GPO GUI
@@ -100,8 +104,8 @@
     }
 
     # This is kind of old way of doing things, but it's superseded by other way below
-    $ComputerSettingsAvailable = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true }
-    $UserSettingsAvailable = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true }
+    [bool] $ComputerSettingsAvailable = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true }
+    [bool] $UserSettingsAvailable = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true }
 
     if ($ComputerSettingsAvailable -eq $false -and $UserSettingsAvailable -eq $false) {
         $NoSettings = $true
@@ -112,35 +116,58 @@
     # $OutputUser = $XMLContent.GPO.User.ExtensionData.Extension | Where-Object { $_.PSObject.Properties.TypeNameOfValue -in 'System.Xml.XmlElement', 'System.Object[]' }
     # $OutputComputer = $XMLContent.GPO.Computer.ExtensionData.Extension | Where-Object { $_.PSObject.Properties.TypeNameOfValue -in 'System.Xml.XmlElement', 'System.Object[]' }
 
-    $OutputUser = foreach ($ExtensionType in $XMLContent.GPO.User.ExtensionData.Extension) {
-        if ($ExtensionType) {
-            $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
-            try {
-                $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
-            } catch {
-                Write-Warning "Get-XMLGPO - things went sideways $($_.Exception.Message)"
-                continue
-            }
+
+    # This is additional check we do for error check to prevent false-positives for EMPTY on non-english language
+    $PreCheckOutputUser = $false
+    $PreCheckOutputComputer = $false
+    foreach ($Extension in $XMLContent.GPO.User.ExtensionData) {
+        if ($Extension.Error) {
+            $PreCheckOutputUser = $true
         }
-        $KeysToLoop
     }
-    $OutputComputer = foreach ($ExtensionType in $XMLContent.GPO.Computer.ExtensionData.Extension) {
-        if ($ExtensionType) {
-            $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
-            try {
-                $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
-            } catch {
-                Write-Warning "Get-XMLGPO - things went sideways $($_.Exception.Message)"
-                continue
-            }
+    foreach ($Extension in $XMLContent.GPO.Computer.ExtensionData) {
+        if ($Extension.Error) {
+            $PreCheckOutputComputer = $true
         }
-        $KeysToLoop
+    }
+    if ($PreCheckOutputComputer -eq $true -or $PreCheckOutputUser -eq $true) {
+        # in some cases GPResult seems to return an error - this was first noticed by user when using Dutch based system
+        # I am not sure if it's possible to fix this error for users, but once that happens checking if GPO is empty fails using the method below
+        # therefore we will use the old method of assuming something is empty or not empty in such case
+        Write-Warning "Get-XMLGPO - Reading GPO content [$DisplayName/$DomainName] returned an error. This may be because of non-english language. Assesing EMPTY using old method which can report false positives. Be careful please."
+        $OutputUser = @()
+        $OutputComputer = @()
+    } else {
+        [Array] $OutputUser = foreach ($ExtensionType in $XMLContent.GPO.User.ExtensionData.Extension) {
+            if ($ExtensionType) {
+                $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
+                try {
+                    $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
+                } catch {
+                    Write-Warning "Get-XMLGPO - things went sideways [$DisplayName/$DomainName]. Error $($_.Exception.Message)"
+                    continue
+                }
+            }
+            $KeysToLoop
+        }
+        [Array] $OutputComputer = foreach ($ExtensionType in $XMLContent.GPO.Computer.ExtensionData.Extension) {
+            if ($ExtensionType) {
+                $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
+                try {
+                    $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
+                } catch {
+                    Write-Warning "Get-XMLGPO - things went sideways [$DisplayName/$DomainName]. Error $($_.Exception.Message)"
+                    continue
+                }
+            }
+            $KeysToLoop
+        }
+
+        [bool] $ComputerSettingsAvailable = if ($OutputComputer.Count -gt 0) { $true } else { $false }
+        [bool] $UserSettingsAvailable = if ($OutputUser.Count -gt 0) { $true } else { $false }
     }
 
-    $ComputerSettingsAvailable = if ($OutputComputer) { $true } else { $false }
-    $UserSettingsAvailable = if ($OutputUser) { $true } else { $false }
-
-    if (-not $ComputerSettingsAvailable -and -not $UserSettingsAvailable) {
+    if ($ComputerSettingsAvailable -eq $false -and $UserSettingsAvailable -eq $false) {
         $Empty = $true
     } else {
         $Empty = $false
@@ -277,8 +304,8 @@
             'UserSettingsAvailable'             = $UserSettingsAvailable
             #'ComputerSettingsAvailableReal'         = $ComputerSettingsAvailableReal
             #'UserSettingsAvailableReal'             = $UserSettingsAvailableReal
-            'ComputerSettingsTypes'             = $OutputComputer.Name
-            'UserSettingsTypes'                 = $OutputUser.Name
+            'ComputerSettingsTypes'             = $OutputComputer.Name -join ", "
+            'UserSettingsTypes'                 = $OutputUser.Name -join ", "
             'ComputerEnabled'                   = $ComputerEnabled
             'UserEnabled'                       = $UserEnabled
             'ComputerSettingsStatus'            = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
@@ -288,6 +315,7 @@
             'UserSettingsVersionIdentical'      = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
             'UserSettings'                      = $XMLContent.GPO.User.ExtensionData.Extension
             'NoSettings'                        = $NoSettings
+            'Description'                       = $GPO.Description
             'CreationTime'                      = [DateTime] $XMLContent.GPO.CreatedTime
             'ModificationTime'                  = [DateTime] $XMLContent.GPO.ModifiedTime
             'ReadTime'                          = [DateTime] $XMLContent.GPO.ReadTime

Private/Invoke.GPOZaurrList.ps1

@@ -49,11 +49,11 @@
             }
 
             if ($GPO.Days -le $Script:Reporting['GPOList']['Variables']['GPOOlderThan']) {
-                # Skip GPOS that are younger than 7 days
+                # Skip GPOS that are younger than 30 days
                 $Script:Reporting['GPOList']['Variables']['GPOSkip']++
             }
             if (($GPO.Enabled -eq $false -or $GPO.Empty -eq $true -or $GPO.Linked -eq $false -or $GPO.ApplyPermission -eq $false) -and $GPO.Days -le $Script:Reporting['GPOList']['Variables']['GPOOlderThan']) {
-                # Skip GPOS that are younger than 7 days
+                # Skip GPOS that are younger than 30 days
                 $Script:Reporting['GPOList']['Variables']['GPONotValidButSkip']++
             }
             if (($GPO.Enabled -eq $false -or $GPO.Empty -eq $true -or $GPO.Linked -eq $false -or $GPO.ApplyPermission -eq $false) -and $GPO.Days) {
@@ -149,7 +149,7 @@
         }
     }
     Variables  = @{
-        GPOOlderThan                   = 7
+        GPOOlderThan                   = 30
         GPONotValidPerDomain           = $null
         GPOValidPerDomain              = $null
         GPONotOptimizedPerDomain       = $null
@@ -214,9 +214,9 @@
                 }
             } -Color Black, Red, Black, Red, Black
             New-HTMLListItem -Text @(
-                "Group Policies ", "NOT", " valid, to skip: ", $Script:Reporting['GPOList']['Variables']['GPONotValidButSkip'], " (not older than $($Script:Reporting['GPOList']['Variables']['GPOOlderThan']) days)"
+                "Group Policies ", "NOT", " valid, to skip: ", $Script:Reporting['GPOList']['Variables']['GPONotValidButSkip'], " (modified less than $($Script:Reporting['GPOList']['Variables']['GPOOlderThan']) days ago)"
             ) -FontWeight 'normal', 'bold', 'normal', 'bold', 'normal' -Color 'Black', 'Red', 'Black', 'Red', 'Black'
-            New-HTMLListItem -Text "Group Policies younger than $($Script:Reporting['GPOList']['Variables']['GPOOlderThan']) days: ", $Script:Reporting['GPOList']['Variables']['GPOSkip'], " (not older than $($Script:Reporting['GPOList']['Variables']['GPOOlderThan']) days)" -FontWeight normal, bold
+            New-HTMLListItem -Text "Group Policies recently modified: ", $Script:Reporting['GPOList']['Variables']['GPOSkip'], " (modified less than $($Script:Reporting['GPOList']['Variables']['GPOOlderThan']) days ago)" -FontWeight normal, bold
         } -FontSize 10pt
 
         New-HTMLText -Text 'Following domains require actions (permissions required):' -FontSize 10pt -FontWeight bold
@@ -415,7 +415,7 @@
                                     "You would do so using following approach "
                                 ) -FontSize 10pt -FontWeight bold, normal
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type Empty, Unlinked, Disabled -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor' {
+                                    Remove-GPOZaurr -RequireDays 30 -Type Empty, Unlinked, Disabled -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor' {
                                         Skip-GroupPolicy -Name 'TEST | Drive Mapping'
                                         Skip-GroupPolicy -Name 'Default Domain Policy'
                                         Skip-GroupPolicy -Name 'Default Domain Controllers Policy' -DomaiName 'JustOneDomain'
@@ -428,6 +428,13 @@
                                     "Now go ahead and find what's there"
                                 )
                             }
+                            New-HTMLWizardStep -Name 'Remove GPOs (Manual)' {
+                                New-HTMLText -Text @(
+                                    "Please condider deleting GPOs manually if the amount of GPOs to delete is small enough. "
+                                    "Deleting 1-5-30 GPOs manually on domain of 4000 GPOs will be much faster than doing it in controlled manner with automated steps mentioned on next steps. "
+                                    "What can take 30 minutes manually, can take 8 hours using automated script, because of amount of checks required by the script over and over to delete a single GPO. "
+                                ) -FontWeight normal, bold, normal, bold, normal, bold, normal, normal -Color Black, Red, Black, Red, Black
+                            }
                             New-HTMLWizardStep -Name 'Remove GPOs that are EMPTY' {
                                 New-HTMLText -Text @(
                                     "Following command when executed removes every ",
@@ -439,26 +446,26 @@
                                     "You can skip parameters related to backup if you did backup all GPOs prior to running remove command. "
                                 ) -FontWeight normal, bold, normal, bold, normal, bold, normal, normal -Color Black, Red, Black, Red, Black
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type Empty -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf
+                                    Remove-GPOZaurr -RequireDays 30 -Type Empty -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf
                                 }
                                 New-HTMLText -TextBlock {
                                     "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                                 }
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type Empty -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                    Remove-GPOZaurr -RequireDays 30 -Type Empty -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor'
                                 }
                                 New-HTMLText -TextBlock {
                                     "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. "
                                 } -LineBreak
                                 New-HTMLText -Text "Once happy with results please follow with command (this will start fixing process): " -LineBreak -FontWeight bold
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type Empty -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose
+                                    Remove-GPOZaurr -RequireDays 30 -Type Empty -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose
                                 }
                                 New-HTMLText -TextBlock {
                                     "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                                 }
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type Empty -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                    Remove-GPOZaurr -RequireDays 30 -Type Empty -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
                                 }
                                 New-HTMLText -TextBlock {
                                     "This command when executed deletes only first X empty GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur."
@@ -478,26 +485,26 @@
                                     "You can skip parameters related to backup if you did backup all GPOs prior to running remove command. "
                                 ) -FontWeight normal, bold, normal, bold, normal, bold, normal, normal -Color Black, Red, Black, Red, Black
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf
+                                    Remove-GPOZaurr -RequireDays 30 -Type Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf
                                 }
                                 New-HTMLText -TextBlock {
                                     "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                                 }
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                    Remove-GPOZaurr -RequireDays 30 -Type Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor'
                                 }
                                 New-HTMLText -TextBlock {
                                     "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. "
                                 } -LineBreak
                                 New-HTMLText -Text "Once happy with results please follow with command (this will start fixing process): " -LineBreak -FontWeight bold
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose
+                                    Remove-GPOZaurr -RequireDays 30 -Type Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose
                                 }
                                 New-HTMLText -TextBlock {
                                     "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                                 }
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                    Remove-GPOZaurr -RequireDays 30 -Type Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
                                 }
                                 New-HTMLText -TextBlock {
                                     "This command when executed deletes only first X unlinked GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur."
@@ -520,26 +527,26 @@
                                     ""
                                 }
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type Disabled -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf
+                                    Remove-GPOZaurr -RequireDays 30 -Type Disabled -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf
                                 }
                                 New-HTMLText -TextBlock {
                                     "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                                 }
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type Disabled -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                    Remove-GPOZaurr -RequireDays 30 -Type Disabled -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor'
                                 }
                                 New-HTMLText -TextBlock {
                                     "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. "
                                 } -LineBreak
                                 New-HTMLText -Text "Once happy with results please follow with command (this will start fixing process): " -LineBreak -FontWeight bold
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type Disabled -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose
+                                    Remove-GPOZaurr -RequireDays 30 -Type Disabled -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose
                                 }
                                 New-HTMLText -TextBlock {
                                     "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                                 }
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type Disabled -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                    Remove-GPOZaurr -RequireDays 30 -Type Disabled -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
                                 }
                                 New-HTMLText -TextBlock {
                                     "This command when executed deletes only first X disabled GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur. "
@@ -562,26 +569,26 @@
                                     ""
                                 }
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type NoApplyPermission -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf
+                                    Remove-GPOZaurr -RequireDays 30 -Type NoApplyPermission -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf
                                 }
                                 New-HTMLText -TextBlock {
                                     "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                                 }
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type NoApplyPermission -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                    Remove-GPOZaurr -RequireDays 30 -Type NoApplyPermission -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor'
                                 }
                                 New-HTMLText -TextBlock {
                                     "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. "
                                 } -LineBreak
                                 New-HTMLText -Text "Once happy with results please follow with command (this will start fixing process): " -LineBreak -FontWeight bold
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type NoApplyPermission -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose
+                                    Remove-GPOZaurr -RequireDays 30 -Type NoApplyPermission -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose
                                 }
                                 New-HTMLText -TextBlock {
                                     "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                                 }
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 7 -Type NoApplyPermission -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                    Remove-GPOZaurr -RequireDays 30 -Type NoApplyPermission -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
                                 }
                                 New-HTMLText -TextBlock {
                                     "This command when executed deletes only first X NoApplyPermission GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur. "

Private/Invoke.GPOZaurrNetLogonPermissions.ps1

@@ -272,6 +272,7 @@
                                 New-HTMLText -Text @(
                                     "In case of NETLOGON permissions it's impossible to tell what in a given moment for given domain should be automatically removed except for the very obvious ",
                                     "unknown ", 'permissions. Domain Admins have to make their assesment on and remove permissions from users or groups that '
+                                    "they think do not belong. "
                                 ) -FontWeight normal, bold, normal
                             }
                             New-HTMLWizardStep -Name 'Verification report' {

Private/Script.GPODictionary.ps1

@@ -336,6 +336,21 @@
         }
     }
     FolderRedirection                 = @{
+        Types      = @(
+            @{
+                Category = 'FolderRedirectionSettings'
+                Settings = 'Folder'
+            }
+        )
+        GPOPath    = 'Windows Settings -> Folder Redirection'
+        Code       = {
+            ConvertTo-XMLFolderRedirection -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLFolderRedirection -GPO $GPO -SingleObject
+        }
+    }
+    FolderRedirectionPolicy           = @{
         Types      = @(
             @{
                 Category = 'RegistrySettings'

Public/Get-GPOZaurr.ps1

@@ -100,9 +100,11 @@
             foreach ($Path in $GPOPath) {
                 Write-Verbose "Get-GPOZaurr - Getting GPO content from XML files"
                 Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml | ForEach-Object {
-                    $XMLContent = [XML]::new()
-                    $XMLContent.Load($_.FullName)
-                    Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent -ExcludeGroupPolicies $ExcludeGPO -Type $Type
+                    if ($_.Name -ne 'GPOList.xml') {
+                        $XMLContent = [XML]::new()
+                        $XMLContent.Load($_.FullName)
+                        Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent -ExcludeGroupPolicies $ExcludeGPO -Type $Type
+                    }
                 }
                 Write-Verbose "Get-GPOZaurr - Finished GPO content from XML files"
             }

Public/Get-GPOZaurrNetlogon.ps1

@@ -26,13 +26,13 @@
             } catch {
                 Write-Warning "Get-GPOZaurrNetLogon - ACL reading failed for $($File.FullName) with error $($_.Exception.Message) ($($_.CategoryInfo.Reason))"
             }
-            #if ($ACL.Owner) {
-            $IdentityOwner = Convert-Identity -Identity $ACL.Owner -Verbose:$false
-            $IdentityOwnerAdvanced = Get-WinADObject -Identity $ACL.Owner -Cache -Verbose:$false
-            #} else {
-            #    $IdentityOwner = [PSCustomObject] @{ SID = ''; Type = 'Unknown' }
-            #    $IdentityOwnerAdvanced = [PSCustomObject] @{ ObjectClass = '' }
-            #}
+            if ($ACL.Owner) {
+                $IdentityOwner = Convert-Identity -Identity $ACL.Owner -Verbose:$false
+                $IdentityOwnerAdvanced = Get-WinADObject -Identity $ACL.Owner -Cache -Verbose:$false
+            } else {
+                $IdentityOwner = [PSCustomObject] @{ Name = ''; SID = ''; Type = 'Unknown' }
+                $IdentityOwnerAdvanced = [PSCustomObject] @{ ObjectClass = '' }
+            }
             if (-not $OwnerOnly) {
                 if (-not $SkipOwner) {
                     if ($IdentityOwner.SID -eq "S-1-5-32-544") {

Public/Invoke-GPOZaurr.ps1

@@ -144,7 +144,10 @@
 
     # Generate pretty HTML
     $TimeLogHTML = Start-TimeLog
-    Write-Color -Text '[i]', '[HTML ] ', 'Generating HTML report' -Color Yellow, DarkGray, Yellow
+    if (-not $FilePath) {
+        $FilePath = Get-FileName -Extension 'html' -Temporary
+    }
+    Write-Color -Text '[i]', '[HTML ] ', "Generating HTML report ($FilePath)" -Color Yellow, DarkGray, Yellow
     New-HTML -Author 'Przemysław Kłys' -TitleText 'GPOZaurr Report' {
         New-HTMLTabStyle -BorderRadius 0px -TextTransform capitalize -BackgroundColorActive SlateGrey
         New-HTMLSectionStyle -BorderRadius 0px -HeaderBackGroundColor Grey -RemoveShadow

Public/Remove-GPOZaurrBroken.ps1

@@ -108,21 +108,23 @@
         }
         if ($GPO.Status -in 'Not available on SYSVOL', 'ObjectClass issue') {
             Write-Verbose "Remove-GPOZaurrBroken - Removing from AD [$($GPO.Status)] $($GPO.DistinguishedName)"
+            <#
             try {
                 $ExistingObject = Get-ADObject -Identity $GPO.DistinguishedName -Server $GPO.DomainName -ErrorAction Stop
             } catch {
                 Write-Warning "Remove-GPOZaurrBroken - Error getting $($GPO.DistinguishedName) from AD error: $($_.Exception.Message)"
                 $ExistingObject = $null
             }
-            if ($ExistingObject -and $ExistingObject.ObjectClass -eq 'groupPolicyContainer') {
-                Write-Verbose "Remove-GPOZaurrBroken - Removing DN: $($GPO.DistinguishedName) / ObjectClass: $($ExistingObject.ObjectClass)"
+            #>
+            if ($GPO -and $GPO.ObjectClass -in 'groupPolicyContainer', 'Container') {
+                Write-Verbose "Remove-GPOZaurrBroken - Removing DN: $($GPO.DistinguishedName) / ObjectClass: $($GPO.ObjectClass)"
                 try {
                     Remove-ADObject -Server $GPO.DomainName -Identity $GPO.DistinguishedName -Recursive -Confirm:$false -ErrorAction Stop
                 } catch {
                     Write-Warning "Remove-GPOZaurrBroken - Failed to remove $($GPO.DistinguishedName) from AD error: $($_.Exception.Message)"
                 }
             } else {
-                Write-Warning "Remove-GPOZaurrBroken - DistinguishedName $($GPO.DistinguishedName) not found or ObjectClass is not groupPolicyContainer ($($ExistingObject.ObjectClass))"
+                Write-Warning "Remove-GPOZaurrBroken - DistinguishedName $($GPO.DistinguishedName) not found or ObjectClass is not groupPolicyContainer/Container ($($GPO.ObjectClass))"
             }
         }
     }

README.md

@@ -64,6 +64,30 @@ To understand the usage I've created blog post you may find useful
 
 ## Changelog
 
+- 0.0.121 - 2021.02.10
+  - [x] Improvement to `Get-GPOZaurr` - added description [#13](https://github.com/EvotecIT/GPOZaurr/issues/13)
+  - [x] Improvement to `Invoke-GPOZaurr -Type GPOList` - added description [#13](https://github.com/EvotecIT/GPOZaurr/issues/13)
+  - [x] Improved `Invoke-GPOZaurr`
+    - [x] Report GPOAnalysis - added `FolderRedirection`
+    - [x] Report GPOAnalysis - renamed `FolderRedirection` to `FolderRedirectionPolicy`
+  - [x] Improved `Invoke-GPOZaurrContent` as mentioned above for `GPOAnalysis`
+- 0.0.120 - 2021.02.10
+  - [x] Improvement to `Get-GPOZaurr` to warn if there is potential issue with EMPTY (which can happen on non-english system)
+    - [x] In such case GPOZaurr will asses EMPTY or not using old method which doesn't detect all EMPTY cases but shouldn't provide false positives
+- 0.0.119
+  - Broken release - weird
+- 0.0.118 - 2021.02.09
+  - [x] Added information where the report is saved
+  - [x] Small improvement to `Get-GPOZaurr` to exlicitly define variable types
+- 0.0.117 - 2021.02.09
+  - [x] Small fix to `Get-GPOZaurr` to exclude GPOList.xml which is used in offline mode by `Save-GPOZaurrFiles`
+- 0.0.116 - 2021.02.08
+  - [x] Improved `Remove-GPOZaurrBroken` to handle ObjectClass problem, and removed reduntant check
+- 0.0.115 - 2021.02.07
+  - [x] Improved `Invoke-GPOZaurr`
+    - [x] `GPOList` - clarified some texts, changed 7 days to 30 days as default
+    - [x] `NetLogonPermissions` - fixed missing text
+  - [x] Fixes `Get-GPOZaurrNetLogon` error on empty Owner - [#9](https://github.com/EvotecIT/GPOZaurr/issues/9)
 - 0.0.114 - 2021.01.27
   - [x] Improved `Invoke-GPOZaurr`
     - [x] HTML now uses offline mode by default (no CDN) - increase in size of HTML up to 3MB