Version bump

Examples/Example-11-ReplaceGPOOwnerAutomated.ps1

@@ -5,7 +5,7 @@
 # regardless if current user is still Domain Admin or not
 
 $GPOs = Get-GPOZaurrOwner -IncludeSysvol
-$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
+$GPOs | Format-Table DisplayName, Status, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
 
 Set-GPOZaurrOwner -Type Unknown -Verbose -WhatIf  #-LimitProcessing 2
 Set-GPOZaurrOwner -Type All -Verbose -LimitProcessing 2 -WhatIf -IncludeDomains 'ad.evotec.pl'

Examples/Example-11-ReplaceGPOOwnerWithExclusions.ps1

@@ -0,0 +1,10 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$GPOs = Get-GPOZaurrOwner -IncludeSysvol -Verbose
+$GPOs | Format-Table DisplayName, Status, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
+
+#Set-GPOZaurrOwner -Type All -Verbose -LimitProcessing 2 -WhatIf -IncludeDomains 'ad.evotec.xyz'
+
+Set-GPOZaurrOwner -Type All -Verbose -LimitProcessing 2 -WhatIf -IncludeDomains 'ad.evotec.xyz' -ApprovedOwner @(
+    'EVOTEC\przemyslaw.klys'
+)

Examples/Example-13-ListingOwners02.ps1

@@ -2,7 +2,9 @@
 
 $T = Get-GPOZaurrOwner -Verbose -IncludeSysvol
 $T | Format-Table *
-#$T | Out-HtmlView -ScrollX
+
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -ApprovedOwner @('EVOTEC\Domain Admins')
+$T | Format-Table *
 
 $T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOName 'Default Domain Policy'
 $T | Format-Table *

Examples/Example-13-ListingOwners03.ps1

@@ -0,0 +1,6 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurrGPOOwners.html -Type GPOOwners -Online -Exclusions @(
+    'EVOTEC\Domain Admins'
+    'EVOTEC\przemyslaw.klys'
+)

Examples/Example-15-AddPermission02.ps1

@@ -7,4 +7,7 @@ Add-GPOZaurrPermission -GPOName 'New Group Policy Object' -Type AuthenticatedUse
 Add-GPOZaurrPermission -Type AuthenticatedUsers -PermissionType GpoRead -All -WhatIf -Verbose
 
 # Add Domain Admins/Enterprise Admins to all that need it
-Add-GPOZaurrPermission -Type Administrative -PermissionType GpoEditDeleteModifySecurity -All -WhatIf -Verbose
+Add-GPOZaurrPermission -Type Administrative -PermissionType GpoEditDeleteModifySecurity -All -WhatIf -Verbose
+
+# Add ranom name to all that need it
+Add-GPOZaurrPermission -All -Principal SVC_AGPM -PrincipalType Name -PermissionType GpoEditDeleteModifySecurity -Verbose -LimitProcessing 2 -WhatIf

Examples/Example-40-ShowGPO05.ps1

@@ -1,7 +1,16 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$GPOS = Get-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\Empty' -ExcludeGroupPolicies {
+$GPOS = Get-GPOZaurr -ExcludeGroupPolicies {
     Skip-GroupPolicy -Name 'de14_usr_std'
     Skip-GroupPolicy -Name 'de14_usr_std' -DomaiName 'ad.evotec.xyz'
+    Skip-GroupPolicy -Name 'All | Trusted Websites' #-DomaiName 'ad.evotec.xyz'
+    '{D39BF08A-87BF-4662-BFA0-E56240EBD5A2}'
+    'COMPUTERS | Enable Sets'
 }
-$GPOS | Format-Table -AutoSize *
+$GPOS | Format-Table -AutoSize *
+
+Invoke-GPOZaurr -Type GPOList -Exclusions {
+    Skip-GroupPolicy -Name 'All | Trusted Websites' -DomaiName 'ad.evotec.xyz'
+    '{D39BF08A-87BF-4662-BFA0-E56240EBD5A2}'
+    'COMPUTERS | Enable Sets'
+}

Examples/Example-50-RemoveLinkFromEmptyOU.ps1

@@ -0,0 +1,10 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Remove-GPOZaurrLinkEmptyOU -Verbose -LimitProcessing 3 -WhatIf
+
+$Exclude = @(
+    "OU=Groups,OU=Production,DC=ad,DC=evotec,DC=pl"
+    "OU=Test \, OU,OU=ITR02,DC=ad,DC=evotec,DC=xyz"
+)
+
+Remove-GPOZaurrLinkEmptyOU -Verbose -LimitProcessing 3 -WhatIf -ExcludeOrganizationalUnit $Exclude

Examples/Example-51-FindEmptyOUsWithGPOLinks.ps1

@@ -0,0 +1,16 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrOrganizationalUnit -Verbose -Option Unlink -Exclusions @(
+   'OU=Groups,OU=Production,DC=ad,DC=evotec,DC=pl'
+) | Format-Table
+
+Get-GPOZaurrOrganizationalUnit -Verbose -ExcludeOrganizationalUnit @(
+   '*,OU=Production,DC=ad,DC=evotec,DC=pl'
+) | Format-Table
+
+
+Invoke-GPOZaurr -Type GPOOrganizationalUnit -Online -FilePath $PSScriptRoot\Reports\GPOZaurrOU.html -Exclusions @(
+    '*OU=Production,DC=ad,DC=evotec,DC=pl'
+    '*OU=Production,DC=ad,DC=evotec,DC=pl'
+    '*OU=Production,DC=ad,DC=evotec,DC=pl'
+)

GPOZaurr.psd1

@@ -6,9 +6,9 @@
     CompatiblePSEditions = @('Desktop')
     Copyright            = '(c) 2011 - 2021 Przemyslaw Klys @ Evotec. All rights reserved.'
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
-    FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrBrokenLink', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionAnalysis', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrBrokenLink', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermission', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Set-GPOZaurrStatus', 'Skip-GroupPolicy')
+    FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrBrokenLink', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOrganizationalUnit', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionAnalysis', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrLinkEmptyOU', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrBrokenLink', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermission', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Set-GPOZaurrStatus', 'Skip-GroupPolicy')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.127'
+    ModuleVersion        = '0.0.130'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -18,15 +18,15 @@
         }
     }
     RequiredModules      = @(@{
-            ModuleVersion = '0.0.199'
+            ModuleVersion = '0.0.210'
             ModuleName    = 'PSSharedGoods'
             Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
         }, @{
-            ModuleVersion = '0.0.124'
+            ModuleVersion = '0.0.130'
             ModuleName    = 'ADEssentials'
             Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
         }, @{
-            ModuleVersion = '0.0.148'
+            ModuleVersion = '0.0.158'
             ModuleName    = 'PSWriteHTML'
             Guid          = 'a7bdf640-f5cb-4acf-9de0-365b322d245c'
         }, 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility', 'Microsoft.PowerShell.Security')

GPOZaurr.psm1

@@ -2,13 +2,53 @@
 $Public = @( Get-ChildItem -Path $PSScriptRoot\Public\*.ps1 -ErrorAction SilentlyContinue -Recurse )
 $Private = @( Get-ChildItem -Path $PSScriptRoot\Private\*.ps1 -ErrorAction SilentlyContinue -Recurse )
 
-#Dot source the files
-Foreach ($import in @($Public + $Private)) {
-    Try {
-        . $import.fullname
-    } Catch {
-        Write-Error -Message "Failed to import function $($import.fullname): $_"
+$AssemblyFolders = Get-ChildItem -Path $PSScriptRoot\Lib -Directory -ErrorAction SilentlyContinue
+if ($AssemblyFolders.BaseName -contains 'Standard') {
+    $Assembly = @( Get-ChildItem -Path $PSScriptRoot\Lib\Standard\*.dll -ErrorAction SilentlyContinue )
+} else {
+    if ($PSEdition -eq 'Core') {
+        $Assembly = @( Get-ChildItem -Path $PSScriptRoot\Lib\Core\*.dll -ErrorAction SilentlyContinue )
+    } else {
+        $Assembly = @( Get-ChildItem -Path $PSScriptRoot\Lib\Default\*.dll -ErrorAction SilentlyContinue )
     }
 }
+$FoundErrors = @(
+    Foreach ($Import in @($Assembly)) {
+        try {
+            Add-Type -Path $Import.Fullname -ErrorAction Stop
+        } catch [System.Reflection.ReflectionTypeLoadException] {
+            Write-Warning "Processing $($Import.Name) Exception: $($_.Exception.Message)"
+            $LoaderExceptions = $($_.Exception.LoaderExceptions) | Sort-Object -Unique
+            foreach ($E in $LoaderExceptions) {
+                Write-Warning "Processing $($Import.Name) LoaderExceptions: $($E.Message)"
+            }
+            $true
+            #Write-Error -Message "StackTrace: $($_.Exception.StackTrace)"
+        } catch {
+            Write-Warning "Processing $($Import.Name) Exception: $($_.Exception.Message)"
+            $LoaderExceptions = $($_.Exception.LoaderExceptions) | Sort-Object -Unique
+            foreach ($E in $LoaderExceptions) {
+                Write-Warning "Processing $($Import.Name) LoaderExceptions: $($E.Message)"
+            }
+            $true
+            #Write-Error -Message "StackTrace: $($_.Exception.StackTrace)"
+        }
+    }
+    #Dot source the files
+    Foreach ($Import in @($Private + $Public)) {
+        Try {
+            . $Import.Fullname
+        } Catch {
+            Write-Error -Message "Failed to import functions from $($import.Fullname): $_"
+            $true
+        }
+    }
+)
+
+if ($FoundErrors.Count -gt 0) {
+    $ModuleName = (Get-ChildItem $PSScriptRoot\*.psd1).BaseName
+    Write-Warning "Importing module $ModuleName failed. Fix errors before continuing."
+    break
+}
 
 Export-ModuleMember -Function '*' -Alias '*'

Private/ConvertTo-XMLCertificates.ps1

@@ -0,0 +1,101 @@
+function ConvertTo-XMLCertificates {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [string[]] $Category,
+        [switch] $SingleObject
+    )
+    $SkipNames = ('Name', 'LocalName', 'NamespaceURI', 'Prefix', 'NodeType', 'ParentNode', 'OwnerDocument', 'IsEmpty', 'Attributes', 'HasAttributes', 'SchemaInfo', 'InnerXml', 'InnerText', 'NextSibling', 'PreviousSibling', 'ChildNodes', 'FirstChild', 'LastChild', 'HasChildNodes', 'IsReadOnly', 'OuterXml', 'BaseURI', 'PreviousText')
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Setting in $GPO.DataSet) {
+            $SettingName = $Setting.Name -split ":"
+            $MySettings = [ordered] @{
+                CreatedTime         = $GPO.CreatedTime         # : 06.06.2020 18:03:36
+                ModifiedTime        = $GPO.ModifiedTime        # : 17.06.2020 16:08:10
+                ReadTime            = $GPO.ReadTime            # : 13.08.2020 10:15:37
+                SecurityDescriptor  = $GPO.SecurityDescriptor  # : SecurityDescriptor
+                FilterDataAvailable = $GPO.FilterDataAvailable # : True
+            }
+            $Name = $SettingName[1]
+            #$Name = Format-ToTitleCase -Text $Setting.Name -RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'
+            $MySettings['Name'] = $Name # $Setting.Name
+
+            ConvertTo-XMLNested -CreateGPO $MySettings -Setting $Setting -SkipNames $SkipNames #-Name $Name
+
+            if ($MySettings.Data) {
+                $bytes = $MySettings.Data -replace '\r?\n' -split '(?<=\G.{2})' -ne '' -replace '^', '0x' -as [byte[]]
+                $CertificateData = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($bytes)
+
+                $MySettings['NotBefore'] = $CertificateData.NotBefore
+                $MySettings['NotAfter'] = $CertificateData.NotAfter
+                $MySettings['HasPrivateKey'] = $CertificateData.HasPrivateKey
+                $MySettings['Thumbprint'] = $CertificateData.Thumbprint
+                $MySettings['SerialNumber'] = $CertificateData.SerialNumber
+                $MySettings['Version'] = $CertificateData.Version
+                $MySettings['Handle'] = $CertificateData.Handle
+                $MySettings['SignatureAlgorithm'] = $CertificateData.SignatureAlgorithm.Value
+                $MySettings['SignatureAlgorithmName'] = $CertificateData.SignatureAlgorithm.FriendlyName
+                $MySettings['KeyUsages'] = $CertificateData.Extensions.KeyUsages
+                $MySettings.Remove('Data')
+            }
+
+            [PSCustomObject] $MySettings
+        }
+
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Setting in $GPO.DataSet) {
+            $CreateGPO = [ordered]@{
+                DisplayName = $GPO.DisplayName
+                DomainName  = $GPO.DomainName
+                GUID        = $GPO.GUID
+                GpoType     = $GPO.GpoType
+            }
+            $SettingName = $Setting.Name -split ":"
+            $CreateGPO['CreatedTime'] = $GPO.CreatedTime         # : 06.06.2020 18:03:36
+            $CreateGPO['ModifiedTime'] = $GPO.ModifiedTime        # : 17.06.2020 16:08:10
+            $CreateGPO['ReadTime'] = $GPO.ReadTime            # : 13.08.2020 10:15:37
+            $CreateGPO['SecurityDescriptor'] = $GPO.SecurityDescriptor  # : SecurityDescriptor
+            $CreateGPO['FilterDataAvailable'] = $GPO.FilterDataAvailable # : True
+
+            $Name = $SettingName[1]
+            $CreateGPO['Name'] = $Name # $Setting.Name
+
+            ConvertTo-XMLNested -CreateGPO $CreateGPO -Setting $Setting -SkipNames $SkipNames #-Name $Name
+
+            if ($CreateGPO.Data) {
+                $bytes = $CreateGPO.Data -replace '\r?\n' -split '(?<=\G.{2})' -ne '' -replace '^', '0x' -as [byte[]]
+                $CertificateData = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($bytes)
+
+                $CreateGPO['NotBefore'] = $CertificateData.NotBefore
+                $CreateGPO['NotAfter'] = $CertificateData.NotAfter
+                $CreateGPO['HasPrivateKey'] = $CertificateData.HasPrivateKey
+                $CreateGPO['Thumbprint'] = $CertificateData.Thumbprint
+                $CreateGPO['SerialNumber'] = $CertificateData.SerialNumber
+                $CreateGPO['Version'] = $CertificateData.Version
+                $CreateGPO['Handle'] = $CertificateData.Handle
+                $CreateGPO['SignatureAlgorithm'] = $CertificateData.SignatureAlgorithm.Value
+                $CreateGPO['SignatureAlgorithmName'] = $CertificateData.SignatureAlgorithm.FriendlyName
+                $CreateGPO['KeyUsages'] = $CertificateData.Extensions.KeyUsages
+                $CreateGPO.Remove('Data')
+            }
+            $CreateGPO['Filters'] = $Setting.Filters
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/Get-XMLGPO.ps1

@@ -231,7 +231,8 @@
     $Exclude = $false
     if ($ExcludeGroupPolicies) {
         $PolicyWithDomain = -join ($XMLContent.GPO.Identifier.Domain.'#text', $XMLContent.GPO.Name)
-        if ($ExcludeGroupPolicies[$XMLContent.GPO.Name] -or $ExcludeGroupPolicies[$PolicyWithDomain]) {
+        $PolicyWithDomainID = -join ($XMLContent.GPO.Identifier.Domain.'#text', $XMLContent.GPO.Identifier.Identifier.'#text')
+        if ($ExcludeGroupPolicies[$XMLContent.GPO.Name] -or $ExcludeGroupPolicies[$PolicyWithDomain] -or $ExcludeGroupPolicies[$PolicyWithDomainID] -or $ExcludeGroupPolicies[$XMLContent.GPO.Identifier.Identifier.'#text']) {
             $Exclude = $true
         }
     }

Private/Invoke.GPOZaurrAnalysis.ps1

@@ -26,7 +26,7 @@
                 New-HTMLTable -DataTable $Script:Reporting['GPOAnalysis']['WarningsAndErrors'] -Filtering {
                     New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
                     New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
-                } -SearchBuilder
+                }
             }
         }
     }

Private/Invoke.GPOZaurrBlockedInheritance.ps1

@@ -138,14 +138,14 @@
                     New-TableCondition -Name 'ComputersCount' -Value 0
                 } -BackgroundColor Salmon -FailBackgroundColor Amber -HighlightHeaders 'UsersCount', 'ComputersCount'
                 New-TableColumnOption -Hidden $true -ColumnIndex 8
-            } -PagingOptions 5, 10, 20, 30, 40, 50 -SearchBuilder -ExcludeProperty GroupPolicies
+            } -PagingOptions 5, 10, 20, 30, 40, 50 -ExcludeProperty GroupPolicies
         }
         New-HTMLSection -Name 'Group Policies affecting objects in Organizational Units with Blocked Inheritance' {
             New-HTMLTable -DataTable $Script:Reporting['GPOBlockedInheritance']['Data'].GroupPolicies -Filtering {
                 New-TableCondition -Name 'Enabled' -Value $true -BackgroundColor SpringGreen -FailBackgroundColor Salmon
                 New-TableCondition -Name 'Enforced' -Value $true -BackgroundColor Amber -FailBackgroundColor AirForceBlue
                 New-TableCondition -Name 'LinkedDirectly' -Value $true -BackgroundColor Amber -FailBackgroundColor AirForceBlue
-            } -PagingOptions 5, 10, 20, 30, 40, 50 -SearchBuilder -DataTableID 'TableWithGroupPoliciesBlockedInheritance'
+            } -PagingOptions 5, 10, 20, 30, 40, 50 -DataTableID 'TableWithGroupPoliciesBlockedInheritance'
         }
         if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
             New-HTMLSection -Name 'Steps to fix - Organizational Units with Group Policy Blocked Inheritance' {
@@ -160,6 +160,19 @@
                                 } -Style powershell
                                 New-HTMLText -Text "Using force makes sure newest version is downloaded from PowerShellGallery regardless of what is currently installed. Once installed you're ready for next step."
                             }
+                            if ($Script:Reporting['GPOBlockedInheritance']['Exclusions']) {
+                                New-HTMLWizardStep -Name 'Required exclusions' {
+                                    New-HTMLText -Text @(
+                                        "While preparing this report following exclusions were defined. "
+                                        "Please make sure that when you execute your steps to include those exclusions to prevent any issues. "
+                                    )
+                                    $Code = New-GPOZaurrExclusions -ExclusionsArray $Script:Reporting['GPOBlockedInheritance']['Exclusions']
+
+                                    if ($Code) {
+                                        New-HTMLCodeBlock -Code $Code -Style powershell
+                                    }
+                                }
+                            }
                             New-HTMLWizardStep -Name 'Prepare report' {
                                 New-HTMLText -Text @(
                                     "Depending when this report was run you may want to prepare new report before proceeding removing Group Policy Inheritance Blocks. "
@@ -205,7 +218,7 @@
                 New-HTMLTable -DataTable $Script:Reporting['GPOBlockedInheritance']['WarningsAndErrors'] -Filtering {
                     New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
                     New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
-                } -SearchBuilder
+                }
             }
         }
     }

Private/Invoke.GPOZaurrBrokenLink.ps1

@@ -76,7 +76,7 @@ $GPOZaurrBrokenLink = [ordered] @{
         New-HTMLSection -Name 'Group Policy Broken Links' {
             New-HTMLTable -DataTable $Script:Reporting['GPOBrokenLink']['Data'] -Filtering {
 
-            } -PagingOptions 10, 20, 30, 40, 50 -SearchBuilder
+            } -PagingOptions 10, 20, 30, 40, 50
         }
         if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
             New-HTMLSection -Name 'Steps to remove Broken Links' {

Private/Invoke.GPOZaurrConsistency.ps1

@@ -91,7 +91,7 @@
                 New-HTMLTableCondition -Name 'ACLConsistentInside' -Value $true -BackgroundColor PaleGreen -TextTransform capitalize -ComparisonType string
                 New-HTMLTableCondition -Name 'ACLConsistent' -Value 'Not available' -BackgroundColor Crimson -ComparisonType string
                 New-HTMLTableCondition -Name 'ACLConsistentInside' -Value 'Not available' -BackgroundColor Crimson -ComparisonType string
-            } -PagingOptions 10, 20, 30, 40, 50 -SearchBuilder
+            } -PagingOptions 10, 20, 30, 40, 50
         }
         if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
             New-HTMLSection -Name 'Steps to fix - Permissions Consistency' {

Private/Invoke.GPOZaurrDuplicate.ps1

@@ -48,7 +48,7 @@
         New-HTMLSection -Name 'Group Policy CNF (Duplicate) Objects' {
             New-HTMLTable -DataTable $Script:Reporting['GPODuplicates']['Data'] -Filtering {
 
-            } -PagingOptions 10, 20, 30, 40, 50 -SearchBuilder
+            } -PagingOptions 10, 20, 30, 40, 50
         }
         if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
             New-HTMLSection -Name 'Steps to fix - Remove duplicate (CNF) objects' {

Private/Invoke.GPOZaurrFiles.ps1

@@ -22,7 +22,7 @@
                 New-HTMLTable -DataTable $Script:Reporting['GPOFiles']['WarningsAndErrors'] -Filtering {
                     New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
                     New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
-                } -SearchBuilder
+                }
             }
         }
     }

Private/Invoke.GPOZaurrLinks.ps1

@@ -22,7 +22,7 @@ $GPOZaurrLinks = [ordered] @{
                 New-HTMLTable -DataTable $Script:Reporting['GPOLinks']['WarningsAndErrors'] -Filtering {
                     New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
                     New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
-                } -SearchBuilder
+                }
             }
         }
     }

Private/Invoke.GPOZaurrList.ps1

@@ -4,9 +4,8 @@
     Action     = $null
     Data       = $null
     Execute    = {
-        if ($Script:Reporting['GPOList']['ExclusionsCode']) {
-            Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExcludeGroupPolicies $Script:Reporting['GPOList']['ExclusionsCode']
-
+        if ($Script:Reporting['GPOList']['Exclusions']) {
+            Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExcludeGroupPolicies $Script:Reporting['GPOList']['Exclusions']
         } else {
             Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
         }
@@ -358,7 +357,7 @@
                     New-HTMLTableCondition -Name 'UserProblem' -Value $false -BackgroundColor SpringGreen -ComparisonType string
                     New-HTMLTableCondition -Name 'ComputerOptimized' -Value $true -BackgroundColor SpringGreen -ComparisonType string
                     New-HTMLTableCondition -Name 'UserOptimized' -Value $true -BackgroundColor SpringGreen -TextTransform capitalize -ComparisonType string
-                } -PagingOptions 10, 20, 30, 40, 50 -SearchBuilder
+                } -PagingOptions 10, 20, 30, 40, 50
             }
         }
         if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
@@ -375,6 +374,18 @@
                                 } -Style powershell
                                 New-HTMLText -Text "Using force makes sure newest version is downloaded from PowerShellGallery regardless of what is currently installed. Once installed you're ready for next step."
                             }
+                            if ($Script:Reporting['GPOList']['Exclusions']) {
+                                New-HTMLWizardStep -Name 'Required exclusions' {
+                                    New-HTMLText -Text @(
+                                        "While preparing this report following exclusions were defined. "
+                                        "Please make sure that when you execute your steps to include those exclusions to prevent any issues. "
+                                    )
+                                    $Code = New-GPOZaurrExclusions -ExclusionsArray $Script:Reporting['GPOList']['Exclusions']
+                                    if ($Code) {
+                                        New-HTMLCodeBlock -Code $Code -Style powershell
+                                    }
+                                }
+                            }
                             New-HTMLWizardStep -Name 'Prepare report' {
                                 New-HTMLText -Text "Depending when this report was run you may want to prepare new report before proceeding with removal. To generate new report please use:"
                                 New-HTMLCodeBlock -Code {
@@ -415,11 +426,14 @@
                                     "You would do so using following approach "
                                 ) -FontSize 10pt -FontWeight bold, normal
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -RequireDays 30 -Type Empty, Unlinked, Disabled -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor' {
+                                    $Exclusions = {
                                         Skip-GroupPolicy -Name 'TEST | Drive Mapping'
                                         Skip-GroupPolicy -Name 'Default Domain Policy'
                                         Skip-GroupPolicy -Name 'Default Domain Controllers Policy' -DomaiName 'JustOneDomain'
-                                    } -WhatIf
+                                        '{D39BF08A-87BF-4662-BFA0-E56240EBD5A2}'
+                                        'COMPUTERS | Enable Sets'
+                                    }
+                                    Remove-GPOZaurr -RequireDays 30 -Type Empty, Unlinked, Disabled -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor' -WhatIf -ExcludeGroupPolicies $Exclusions
                                 }
                                 New-HTMLText -Text @(
                                     "Code above when executed will scan YourDomainYouHavePermissionsFor, find all empty, unlinked, disabled group policies, backup any GPO just before it's to be deleted to `$Env:UserProfile\Desktop\GPO. "
@@ -646,6 +660,7 @@
                     }
                 }
             }
+            <#
             if ($Script:Reporting['GPOList']['Exclusions']) {
                 New-HTMLSection -Invisible {
                     New-HTMLSection -Name 'Group Policies Exclusions' {
@@ -656,11 +671,12 @@
                     New-HTMLSection -Name 'Group Policies Exclusions Code' {
                         New-HTMLContainer {
                             New-HTMLText -Text 'Please make sure to use following exclusions when executing removal' -FontSize 10pt
-                            New-HTMLCodeBlock -Code $Script:Reporting['GPOList']['ExclusionsCode']
+                            New-HTMLCodeBlock -Code $Script:Reporting['GPOList']['Exclusions']
                         }
                     }
                 }
             }
+            #>
         }
         if ($Script:Reporting['GPOList']['WarningsAndErrors']) {
             New-HTMLSection -Name 'Errors to Review' {

Private/Invoke.GPOZaurrNetLogonOwners.ps1

@@ -135,7 +135,7 @@
                 New-HTMLTableCondition -Name 'OwnerType' -Value "WellKnownAdministrative" -BackgroundColor LightGreen -ComparisonType string -Operator eq
                 New-HTMLTableCondition -Name 'Status' -Value "OK" -BackgroundColor LightGreen -ComparisonType string -Operator eq
                 New-HTMLTableCondition -Name 'Status' -Value "OK" -BackgroundColor Salmon -ComparisonType string -Operator ne
-            } -SearchBuilder
+            }
         }
         if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
             New-HTMLSection -Name 'Steps to fix NetLogon Owners ' {

Private/Invoke.GPOZaurrNetLogonPermissions.ps1

@@ -237,7 +237,7 @@
                 New-HTMLTableCondition -Name 'Status' -Value "Review permission required" -BackgroundColor PaleGoldenrod -ComparisonType string -Operator eq
                 New-HTMLTableCondition -Name 'Status' -Value "Removal permission required" -BackgroundColor Salmon -ComparisonType string -Operator eq -Row
                 New-HTMLTableCondition -Name 'Status' -Value "OK" -BackgroundColor LightGreen -ComparisonType string -Operator eq
-            } -SearchBuilder
+            }
         }
         if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
             New-HTMLSection -Name 'Steps to fix NetLogon Permissions ' {

Private/Invoke.GPOZaurrOrganizationalUnit.ps1

@@ -0,0 +1,246 @@
+$GPOZaurrOrganizationalUnit = [ordered] @{
+    Name           = 'Group Policy Organizational Units'
+    Enabled        = $true
+    ActionRequired = $null
+    Data           = $null
+    Execute        = {
+        if ($Script:Reporting['GPOOrganizationalUnit']['Exclusions']) {
+            Get-GPOZaurrOrganizationalUnit -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExcludeOrganizationalUnit $Script:Reporting['GPOOrganizationalUnit']['Exclusions']
+        } else {
+            Get-GPOZaurrOrganizationalUnit -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
+        }
+    }
+    Processing     = {
+        # Create Per Domain Variables
+        $Script:Reporting['GPOOrganizationalUnit']['Variables']['RequiresDiffFixPerDomain'] = @{}
+        $Script:Reporting['GPOOrganizationalUnit']['Variables']['WillFixPerDomain'] = @{}
+        foreach ($OU in $Script:Reporting['GPOOrganizationalUnit']['Data']) {
+            $Script:Reporting['GPOOrganizationalUnit']['Variables']['TotalOU']++
+            # Create Per Domain Variables
+            if (-not $Script:Reporting['GPOOrganizationalUnit']['Variables']['WillFixPerDomain'][$OU.DomainName]) {
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['WillFixPerDomain'][$OU.DomainName] = 0
+            }
+            if ($OU.Status -contains 'Unlink GPO' -and $OU.Status -contains 'Delete OU') {
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['UnlinkGPODeleteOU']++
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['WillFix']++
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['WillFixPerDomain'][$OU.DomainName]++
+            } elseif ($OU.Status -contains 'Unlink GPO') {
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['UnlinkGPO']++
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['WillFix']++
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['WillFixPerDomain'][$OU.DomainName]++
+            } elseif ($OU.Status -contains 'Delete OU') {
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['DeleteOU']++
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['WillFix']++
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['WillFixPerDomain'][$OU.DomainName]++
+            } elseif ($OU.Status -contains 'Excluded') {
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['Excluded']++
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['ExcludedOU'].Add($OU.Organizationalunit)
+            } else {
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['Legitimate']++
+            }
+        }
+        if ($Script:Reporting['GPOOrganizationalUnit']['Variables']['WillFix'] -gt 0) {
+            $Script:Reporting['GPOOrganizationalUnit']['ActionRequired'] = $true
+        } else {
+            $Script:Reporting['GPOOrganizationalUnit']['ActionRequired'] = $false
+        }
+    }
+    Variables      = @{
+        TotalOU           = 0
+        UnlinkGPO         = 0
+        UnlinkGPODeleteOU = 0
+        DeleteOU          = 0
+        Legitimate        = 0
+        Excluded          = 0
+        ExcludedOU        = [System.Collections.Generic.List[string]]::new()
+        WillFix           = 0
+        WillFixPerDomain  = $null
+    }
+    Overview       = {
+
+    }
+    Summary        = {
+        New-HTMLText -FontSize 10pt -Text @(
+            "In most Active Directories there are a lot of Organizational Units that have different use cases to store different type of objects. "
+            "As Active Directories change over time you can often find Organizational Units with linked GPOs and no objects inside. "
+            "In some cases thats's expected, but in some cases it's totally unnessecary, and for very large AD can be a problem. "
+            "Additionally only User and Computer objects can have GPO applied to them, so having GPO applied to a any other object type won't really work. "
+        )
+        New-HTMLText -FontSize 10pt -Text "Following can happen: " -FontWeight bold
+        New-HTMLList -Type Unordered {
+            New-HTMLListItem -Text 'Organizational Units that can have Group Policies unlinked (objects exists): ', $Script:Reporting['GPOOrganizationalUnit']['Variables']['UnlinkGPO'] -FontWeight normal, bold
+            New-HTMLListItem -Text 'Organizational Units that can have Group Policies unlinked and OU removed (be careful!) (no objects): ', $Script:Reporting['GPOOrganizationalUnit']['Variables']['UnlinkGPODeleteOU'] -FontWeight normal, bold
+            New-HTMLListItem -Text "Organizational Units that can be deleted (no objects/no gpos): ", $Script:Reporting['GPOOrganizationalUnit']['Variables']['DeleteOU'] -FontWeight normal, bold
+        } -FontSize 10pt
+        New-HTMLText -Text 'Following domains require actions (permissions required):' -FontSize 10pt -FontWeight bold
+        New-HTMLList -Type Unordered {
+            foreach ($Domain in $Script:Reporting['GPOOrganizationalUnit']['Variables']['WillFixPerDomain'].Keys) {
+                New-HTMLListItem -Text "$Domain requires ", $Script:Reporting['GPOOrganizationalUnit']['Variables']['WillFixPerDomain'][$Domain], " changes." -FontWeight normal, bold, normal
+            }
+        } -FontSize 10pt
+
+        if ($Script:Reporting['GPOOrganizationalUnit']['Variables']['ExcludedOU'].Count -gt 0) {
+            New-HTMLText -Text @(
+                'There are ',
+                $Script:Reporting['GPOOrganizationalUnit']['Variables']['ExcludedOU'].Count,
+                " Organizational Units that are excluded.",
+                " Please make sure to exclude those when executing unlinking/removal procedures. "
+            ) -FontSize 10pt -FontWeight normal, bold, normal, bold -Color None, Red, None, Red
+            <#
+            New-HTMLList -Type Unordered {
+                foreach ($OU in $Script:Reporting['GPOOrganizationalUnit']['Variables']['ExcludedOU']) {
+                    New-HTMLListItem -Text $OU -FontWeight normal, bold, normal
+                }
+            } -FontSize 10pt
+            #>
+        }
+
+        New-HTMLText -Text @(
+            "Please make sure that you really want to unlink GPO or delete Organizational Unit before executing changes. Sometimes it's completly valid to keep one or the other. "
+            "Unlinking GPO from OU that has no Computer or User objects is fairly safe exercise. Removing OU requires a bit more dive in, and should only be executed if you know what you're doing. "
+        ) -FontWeight normal, bold -Color None, Red -FontSize 10pt
+    }
+    Solution       = {
+        New-HTMLSection -Invisible {
+            New-HTMLPanel {
+                & $Script:GPOConfiguration['GPOOrganizationalUnit']['Summary']
+            }
+            New-HTMLPanel {
+                New-HTMLChart {
+                    New-ChartBarOptions -Type bar -Distributed
+                    New-ChartAxisY -LabelMaxWidth 200 -LabelAlign left -Show
+                    New-ChartBar -Name "Unlink GPO ($($Script:Reporting['GPOOrganizationalUnit']['Variables']['UnlinkGPO']))" -Value $Script:Reporting['GPOOrganizationalUnit']['Variables']['UnlinkGPO']
+                    New-ChartBar -Name "Unlink GPO Delete OU ($($Script:Reporting['GPOOrganizationalUnit']['Variables']['UnlinkGPODeleteOU']))" -Value $Script:Reporting['GPOOrganizationalUnit']['Variables']['UnlinkGPODeleteOU']
+                    New-ChartBar -Name "Delete OU ($($Script:Reporting['GPOOrganizationalUnit']['Variables']['DeleteOU']))" -Value $Script:Reporting['GPOOrganizationalUnit']['Variables']['DeleteOU']
+                } -Title 'Organizational Units' -TitleAlignment center
+            }
+        }
+        New-HTMLSection -Name 'Group Policy Organizational Units' {
+            New-HTMLTable -DataTable $Script:Reporting['GPOOrganizationalUnit']['Data'] -Filtering {
+                New-TableHeader -ResponsiveOperations none -Names 'GPONames', 'Objects'
+                New-HTMLTableCondition -Name 'Status' -ComparisonType string -Value 'Unlink GPO, Delete OU' -BackgroundColor Salmon -Row
+                New-HTMLTableCondition -Name 'Status' -ComparisonType string -Value 'Unlink GPO' -BackgroundColor YellowOrange -Row
+                New-HTMLTableCondition -Name 'Status' -ComparisonType string -Value 'Delete OU' -BackgroundColor Red -Row
+                New-HTMLTableCondition -Name 'Status' -ComparisonType string -Value 'OK' -BackgroundColor LightGreen -Row
+                New-HTMLTableCondition -Name 'Status' -ComparisonType string -Value 'Excluded' -BackgroundColor DeepSkyBlue -Row
+            } -PagingOptions 10, 20, 30, 40, 50 -ExcludeProperty GPO
+        }
+        if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
+            New-HTMLSection -Name 'Steps to fix Group Organizational Units' {
+                New-HTMLContainer {
+                    New-HTMLSpanStyle -FontSize 10pt {
+                        #New-HTMLText -Text 'Following steps will guide you how to fix group policy owners'
+                        New-HTMLWizard {
+                            New-HTMLWizardStep -Name 'Prepare environment' {
+                                New-HTMLText -Text "To be able to execute actions in automated way please install required modules. Those modules will be installed straight from Microsoft PowerShell Gallery."
+                                New-HTMLCodeBlock -Code {
+                                    Install-Module GPOZaurr -Force
+                                    Import-Module GPOZaurr -Force
+                                } -Style powershell
+                                New-HTMLText -Text "Using force makes sure newest version is downloaded from PowerShellGallery regardless of what is currently installed. Once installed you're ready for next step."
+                            }
+                            if ($Script:Reporting['GPOOrganizationalUnit']['Exclusions']) {
+                                New-HTMLWizardStep -Name 'Required exclusions' {
+                                    New-HTMLText -Text @(
+                                        "While preparing this report following exclusions were defined. "
+                                        "Please make sure that when you execute your steps to include those exclusions to prevent any issues. "
+                                    )
+                                    $Code = New-GPOZaurrExclusions -ExclusionsArray $Script:Reporting['GPOOrganizationalUnit']['Exclusions']
+
+                                    if ($Code) {
+                                        New-HTMLCodeBlock -Code $Code -Style powershell
+                                    }
+                                }
+                            }
+                            New-HTMLWizardStep -Name 'Prepare report' {
+                                New-HTMLText -Text "Depending when this report was run you may want to prepare new report before proceeding with unlinking unused Group Policies. To generate new report please use:"
+                                New-HTMLCodeBlock -Code {
+                                    Invoke-GPOZaurr -FilePath $Env:UserProfile\Desktop\GPOZaurrGPOOrganizationalUnitBefore.html -Verbose -Type GPOOrganizationalUnit
+                                }
+                                New-HTMLText -TextBlock {
+                                    "When executed it will take a while to generate all data and provide you with new report depending on size of environment."
+                                    "Once confirmed that data is still showing issues and requires fixing please proceed with next step."
+                                }
+                                New-HTMLText -Text "Alternatively if you prefer working with console you can run: "
+                                New-HTMLCodeBlock -Code {
+                                    $OwnersGPO = Get-GPOZaurrOrganizationalUnit -Verbose
+                                    $OwnersGPO | Format-Table
+                                }
+                                New-HTMLText -Text "It provides same data as you see in table above just doesn't prettify it for you."
+                            }
+                            New-HTMLWizardStep -Name 'Unlink unused Group Policies' {
+                                New-HTMLText -Text @(
+                                    "Following command when executed runs cleanup procedure that unlinks all Group Policies from Organizational Units that have no user or computer objects. "
+                                    "Make sure when running it for the first time to run it with ",
+                                    "WhatIf",
+                                    " parameter as shown below to prevent accidental unlinking."
+                                    'When run it will remove any GPO links from Organizational Units that have no objects applicable for GPOs.'
+                                ) -FontWeight normal, normal, bold, normal -Color Black, Black, Red, Black
+                                New-HTMLCodeBlock -Code {
+                                    Remove-GPOZaurrLinkEmptyOU -WhatIf -Verbose
+                                }
+                                New-HTMLText -TextBlock {
+                                    "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                                }
+                                New-HTMLCodeBlock -Code {
+                                    Remove-GPOZaurrLinkEmptyOU -WhatIf -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                }
+                                New-HTMLText -TextBlock {
+                                    "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be removed matches expected data. "
+                                    "Keep in mind that there is no backup for this, and if link is removed you would need to relink it yourself."
+                                    "Once you remove it, it's gone. "
+                                } -LineBreak
+                                New-HTMLText -Text 'Once happy with results please follow with command (this will start removal process): ' -LineBreak -FontWeight bold
+                                New-HTMLCodeBlock -Code {
+                                    Remove-GPOZaurrLinkEmptyOU -WhatIf -LimitProcessing 2 -Verbose
+                                }
+                                New-HTMLText -TextBlock {
+                                    "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                                }
+                                New-HTMLCodeBlock -Code {
+                                    Remove-GPOZaurrLinkEmptyOU -WhatIf -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                }
+                                New-HTMLText -TextBlock {
+                                    "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur. "
+                                    "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly. "
+                                } -LineBreak
+                                New-HTMLText -TextBlock {
+                                    "It's possible to exclude certain OU's from having GPO's unlinked using follwing method: "
+                                } -FontWeight bold
+                                New-HTMLCodeBlock -Code {
+                                    $Exclude = @(
+                                        "OU=Groups,OU=Production,DC=ad,DC=evotec,DC=pl"
+                                        "OU=Test \, OU,OU=ITR02,DC=ad,DC=evotec,DC=xyz"
+                                    )
+                                    Remove-GPOZaurrLinkEmptyOU -Verbose -LimitProcessing 3 -WhatIf -ExcludeOrganizationalUnit $Exclude
+                                }
+                            }
+                            New-HTMLWizardStep -Name 'Delete unused Organizational Units' {
+                                New-HTMLText -Text @(
+                                    "Following automation is not yet implemented. Requires more testing as potentially it could do more damage than help."
+                                )
+                            }
+                            New-HTMLWizardStep -Name 'Verification report' {
+                                New-HTMLText -TextBlock {
+                                    "Once cleanup task was executed properly, we need to verify that report now shows no problems."
+                                }
+                                New-HTMLCodeBlock -Code {
+                                    Invoke-GPOZaurr -FilePath $Env:UserProfile\Desktop\GPOZaurrGPOOrganizationalUnitAfter.html -Verbose -Type GPOOrganizationalUnit
+                                }
+                                New-HTMLText -Text "If everything is healthy in the report you're done! Enjoy rest of the day!" -Color BlueDiamond
+                            }
+                        } -RemoveDoneStepOnNavigateBack -Theme arrows -ToolbarButtonPosition center -EnableAllAnchors
+                    }
+                }
+            }
+        }
+        if ($Script:Reporting['GPOOrganizationalUnit']['WarningsAndErrors']) {
+            New-HTMLSection -Name 'Warnings & Errors to Review' {
+                New-HTMLTable -DataTable $Script:Reporting['GPOOrganizationalUnit']['WarningsAndErrors'] -Filtering {
+                    New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
+                    New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
+                } -PagingOptions 10, 20, 30, 40, 50
+            }
+        }
+    }
+}

Private/Invoke.GPOZaurrOrphans.ps1

@@ -99,7 +99,7 @@
             New-HTMLListItem -Text 'Group Policies on SYSVOL, but no details in AD: ', $Script:Reporting['GPOBroken']['Variables']['NotAvailableInAD'] -FontWeight normal, bold
             New-HTMLListItem -Text 'Group Policies in AD, but no content on SYSVOL: ', $Script:Reporting['GPOBroken']['Variables']['NotAvailableOnSysvol'] -FontWeight normal, bold
             New-HTMLListItem -Text 'Group Policies which exists, but have wrong ObjectClass: ', $Script:Reporting['GPOBroken']['Variables']['NotAvailableObjectClassIssue'] -FontWeight normal, bold
-            New-HTMLListItem -Text "Group Policies which couldn't be assed due to permissions issue: ", $Script:Reporting['GPOBroken']['Variables']['NotAvailablePermissionIssue'] -FontWeight normal, bold
+            New-HTMLListItem -Text "Group Policies which couldn't be assessed due to permissions issue: ", $Script:Reporting['GPOBroken']['Variables']['NotAvailablePermissionIssue'] -FontWeight normal, bold
         } -FontSize 10pt
         New-HTMLText -Text 'Following domains require actions (permissions required):' -FontSize 10pt -FontWeight bold
         New-HTMLList -Type Unordered {
@@ -128,7 +128,7 @@
                 New-HTMLTableCondition -Name 'Status' -Value "Not available on SYSVOL" -BackgroundColor LightCoral -ComparisonType string
                 New-HTMLTableCondition -Name 'Status' -Value "ObjectClass issue" -BackgroundColor MediumOrchid -ComparisonType string
                 New-HTMLTableCondition -Name 'Status' -Value "Permissions issue" -BackgroundColor MediumVioletRed -ComparisonType string -Color White
-            } -PagingOptions 10, 20, 30, 40, 50 -SearchBuilder
+            } -PagingOptions 10, 20, 30, 40, 50
         }
         if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
             New-HTMLSection -Name 'Steps to fix - Not available on SYSVOL / Active Directory / ObjectClass issue' {

Private/Invoke.GPOZaurrOwners.ps1

@@ -4,7 +4,11 @@
     ActionRequired = $null
     Data           = $null
     Execute        = {
-        Get-GPOZaurrOwner -IncludeSysvol -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
+        if ($Script:Reporting['GPOOwners']['Exclusions']) {
+            Get-GPOZaurrOwner -IncludeSysvol -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ApprovedOwner $Script:Reporting['GPOOwners']['Exclusions']
+        } else {
+            Get-GPOZaurrOwner -IncludeSysvol -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
+        }
     }
     Processing     = {
         # Create Per Domain Variables
@@ -19,17 +23,35 @@
                 $Script:Reporting['GPOOwners']['Variables']['WillFixPerDomain'][$GPO.DomainName] = 0
             }
             # Checks
-            if ($GPO.IsOwnerConsistent) {
+            if ($GPO.Status -contains 'Consistent') {
                 $Script:Reporting['GPOOwners']['Variables']['IsConsistent']++
-            } else {
+            } elseif ($GPO.Status -contains 'Inconsistent') {
                 $Script:Reporting['GPOOwners']['Variables']['IsNotConsistent']++
             }
-            if ($GPO.IsOwnerAdministrative) {
+            if ($GPO.Status -contains 'Administrative') {
                 $Script:Reporting['GPOOwners']['Variables']['IsAdministrative']++
+            } elseif ($GPO.Status -contains 'Approved') {
+                $Script:Reporting['GPOOwners']['Variables']['IsApproved']++
             } else {
                 $Script:Reporting['GPOOwners']['Variables']['IsNotAdministrative']++
             }
-            if (($GPO.IsOwnerAdministrative -eq $false -or $GPO.IsOwnerConsistent -eq $false) -and $GPO.SysvolExists -eq $true) {
+
+            if ($GPO.SysvolExists -eq $false) {
+                $Script:Reporting['GPOOwners']['Variables']['RequiresDiffFix']++
+                $Script:Reporting['GPOOwners']['Variables']['RequiresDiffFixPerDomain'][$GPO.DomainName]++
+            } else {
+                if ($GPO.Status -contains 'Inconsistent') {
+                    $Script:Reporting['GPOOwners']['Variables']['WillFix']++
+                    $Script:Reporting['GPOOwners']['Variables']['WillFixPerDomain'][$GPO.DomainName]++
+                } elseif ($GPO.Status -contains 'NotAdministrative' -and $GPO.Status -notcontains 'Approved') {
+                    $Script:Reporting['GPOOwners']['Variables']['WillFix']++
+                    $Script:Reporting['GPOOwners']['Variables']['WillFixPerDomain'][$GPO.DomainName]++
+                } else {
+                    $Script:Reporting['GPOOwners']['Variables']['WillNotTouch']++
+                }
+            }
+            <#
+            if (($GPO.IsOwnerAdministrative -eq $false -or $GPO.IsOwnerConsistent -eq $false) -and $GPO.Status -and $GPO.SysvolExists -eq $true) {
                 $Script:Reporting['GPOOwners']['Variables']['WillFix']++
                 $Script:Reporting['GPOOwners']['Variables']['WillFixPerDomain'][$GPO.DomainName]++
             } elseif ($GPO.SysvolExists -eq $false) {
@@ -38,6 +60,7 @@
             } else {
                 $Script:Reporting['GPOOwners']['Variables']['WillNotTouch']++
             }
+            #>
         }
         if ($Script:Reporting['GPOOwners']['Variables']['WillFix'] -gt 0) {
             $Script:Reporting['GPOOwners']['ActionRequired'] = $true
@@ -47,6 +70,7 @@
     }
     Variables      = @{
         IsAdministrative         = 0
+        IsApproved               = 0
         IsNotAdministrative      = 0
         IsConsistent             = 0
         IsNotConsistent          = 0
@@ -93,6 +117,7 @@
         New-HTMLText -Text "Here's a short summary of ", "Group Policy Owners", ": " -FontSize 10pt -FontWeight normal, bold, normal
         New-HTMLList -Type Unordered {
             New-HTMLListItem -Text 'Administrative Owners: ', $Script:Reporting['GPOOwners']['Variables']['IsAdministrative'] -FontWeight normal, bold
+            New-HTMLListItem -Text 'Non-Administrative, but approved Owners (for example AGPM): ', $Script:Reporting['GPOOwners']['Variables']['IsApproved'] -FontWeight normal, bold
             New-HTMLListItem -Text 'Non-Administrative Owners: ', $Script:Reporting['GPOOwners']['Variables']['IsNotAdministrative'] -FontWeight normal, bold
             New-HTMLListItem -Text "Owners consistent in AD and SYSVOL: ", $Script:Reporting['GPOOwners']['Variables']['IsConsistent'] -FontWeight normal, bold
             New-HTMLListItem -Text "Owners not-consistent in AD and SYSVOL: ", $Script:Reporting['GPOOwners']['Variables']['IsNotConsistent'] -FontWeight normal, bold
@@ -124,17 +149,26 @@
             New-HTMLPanel {
                 New-HTMLChart {
                     New-ChartBarOptions -Type barStacked
-                    New-ChartLegend -Name 'Yes', 'No' -Color LightGreen, Salmon
-                    New-ChartBar -Name 'Is administrative' -Value $Script:Reporting['GPOOwners']['Variables']['IsAdministrative'], $Script:Reporting['GPOOwners']['Variables']['IsNotAdministrative']
+                    New-ChartLegend -Name 'Yes', 'No', 'Approved' -Color LightGreen, Salmon, DeepSkyBlue
+                    New-ChartBar -Name 'Is administrative' -Value $Script:Reporting['GPOOwners']['Variables']['IsAdministrative'], $Script:Reporting['GPOOwners']['Variables']['IsNotAdministrative'], $Script:Reporting['GPOOwners']['Variables']['IsApproved']
                     New-ChartBar -Name 'Is consistent' -Value $Script:Reporting['GPOOwners']['Variables']['IsConsistent'], $Script:Reporting['GPOOwners']['Variables']['IsNotConsistent']
                 } -Title 'Group Policy Owners' -TitleAlignment center
             }
         }
         New-HTMLSection -Name 'Group Policy Owners' {
             New-HTMLTable -DataTable $Script:Reporting['GPOOwners']['Data'] -Filtering {
-                New-HTMLTableCondition -Name 'IsOwnerConsistent' -Value $false -BackgroundColor Salmon -ComparisonType string -Row
-                New-HTMLTableCondition -Name 'IsOwnerAdministrative' -Value $false -BackgroundColor Salmon -ComparisonType string -Row
-            } -PagingOptions 10, 20, 30, 40, 50 -SearchBuilder
+                #New-HTMLTableCondition -Name 'IsOwnerConsistent' -Value $false -BackgroundColor Salmon -ComparisonType string -Row
+                #New-HTMLTableCondition -Name 'IsOwnerAdministrative' -Value $false -BackgroundColor Salmon -ComparisonType string -Row
+
+                New-HTMLTableCondition -Name 'Status' -Value 'Administrative, Consistent' -BackgroundColor LightGreen -ComparisonType string -Row
+                New-HTMLTableCondition -Name 'Status' -Value 'NotAdministrative, Consistent, Approved' -BackgroundColor DeepSkyBlue -ComparisonType string -Row
+
+                New-HTMLTableCondition -Name 'Status' -Value 'Administrative, Inconsistent' -BackgroundColor Salmon -ComparisonType string -Row
+                New-HTMLTableCondition -Name 'Status' -Value 'NotAdministrative, Inconsistent' -BackgroundColor Salmon -ComparisonType string -Row
+                #New-HTMLTableCondition -Name 'Status' -Value 'Administrative, Inconsistent, Approved' -BackgroundColor Salmon -ComparisonType string -Row
+                # New-HTMLTableCondition -Name 'Status' -Value 'NotAdministrative, Inconsistent, Approved' -BackgroundColor Salmon -ComparisonType string -Row
+
+            } -PagingOptions 10, 20, 30, 40, 50
         }
         if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
             New-HTMLSection -Name 'Steps to fix Group Policy Owners' {
@@ -150,6 +184,19 @@
                                 } -Style powershell
                                 New-HTMLText -Text "Using force makes sure newest version is downloaded from PowerShellGallery regardless of what is currently installed. Once installed you're ready for next step."
                             }
+                            if ($Script:Reporting['GPOOwners']['Exclusions']) {
+                                New-HTMLWizardStep -Name 'Required exclusions' {
+                                    New-HTMLText -Text @(
+                                        "While preparing this report following exclusions were defined. "
+                                        "Please make sure that when you execute your steps to include those exclusions to prevent any issues. "
+                                    )
+                                    $Code = New-GPOZaurrExclusions -ExclusionsArray $Script:Reporting['GPOOwners']['Exclusions']
+
+                                    if ($Code) {
+                                        New-HTMLCodeBlock -Code $Code -Style powershell
+                                    }
+                                }
+                            }
                             New-HTMLWizardStep -Name 'Prepare report' {
                                 New-HTMLText -Text "Depending when this report was run you may want to prepare new report before proceeding with fixing Group Policy Owners. To generate new report please use:"
                                 New-HTMLCodeBlock -Code {
@@ -207,6 +254,22 @@
                                 New-HTMLText -TextBlock {
                                     "This command when executed sets new owner only on first X non-compliant GPO Owners for AD/SYSVOL. Use LimitProcessing parameter to prevent mass change and increase the counter when no errors occur. "
                                     "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly. "
+                                } -LineBreak
+                                New-HTMLText -TextBlock {
+                                    "It's possible to define certain owners as being approved (for example with domain that have AGPM). "
+                                    "Make sure to verify if excluded/approved owners were provided in Required Exclusions tab, or add your own when nessecary. "
+                                    "You can approve owners with following code: "
+                                } -FontWeight bold
+                                New-HTMLCodeBlock -Code {
+                                    $Approved = @(
+                                        'EVOTEC\przemyslaw.klys'
+                                        'EVOTEC\green.b'
+                                    )
+                                    Set-GPOZaurrOwner -Type All -Verbose -LimitProcessing 2 -ApprovedOwner $Approved
+                                }
+                                New-HTMLText -TextBlock {
+                                    "Please keep in mind that ApprovedOwner is only applicable to Non-Administrative permissions to provide a way to approve special use cases. "
+                                    "It won't do anything for inconsistent, unknown permissions as those are still treated as wrong. "
                                 }
                             }
                             New-HTMLWizardStep -Name 'Verification report' {

Private/Invoke.GPOZaurrPassword.ps1

@@ -23,7 +23,7 @@
                 New-HTMLTable -DataTable $Script:Reporting['GPOPassword']['WarningsAndErrors'] -Filtering {
                     New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
                     New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
-                } -SearchBuilder
+                }
             }
         }
     }

Private/Invoke.GPOZaurrPermissionsAdministrative.ps1

@@ -94,12 +94,12 @@
         New-HTMLSection -Name 'Group Policy Administrative Users Permissions Summary' {
             New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsAdministrative']['Data'].PermissionsPerRow -Filtering {
                 New-HTMLTableCondition -Name 'Permission' -Value '' -BackgroundColor Salmon -ComparisonType string -Row
-            } -PagingOptions 7, 15, 30, 45, 60 -SearchBuilder
+            } -PagingOptions 7, 15, 30, 45, 60
         }
         New-HTMLSection -Name 'Group Policy Administrative Users Analysis' {
             New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsAdministrative']['Data'].PermissionsAnalysis -Filtering {
                 # New-HTMLTableCondition -Name 'Permission' -Value '' -BackgroundColor Salmon -ComparisonType string -Row
-            } -PagingOptions 7, 15, 30, 45, 60 -SearchBuilder
+            } -PagingOptions 7, 15, 30, 45, 60
         }
         if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
             New-HTMLSection -Name 'Steps to fix Group Policy Administrative Users' {

Private/Invoke.GPOZaurrPermissionsAnalysis.ps1

@@ -309,7 +309,7 @@
         New-HTMLSection -Name 'Group Policy Visibility Analysis' {
             New-HTMLTable -DataTable $Script:Reporting['GPOPermissions']['Data'].PermissionsIssues -Filtering {
                 New-HTMLTableCondition -Name 'PermissionIssue' -Value $true -BackgroundColor Salmon -ComparisonType string -Row
-            } -PagingOptions 7, 15, 30, 45, 60 -DefaultSortColumn PermissionIssue -DefaultSortOrder Descending -SearchBuilder
+            } -PagingOptions 7, 15, 30, 45, 60 -DefaultSortColumn PermissionIssue -DefaultSortOrder Descending
         }
         New-HTMLSection -Name 'Group Policy Permissions Analysis' {
             New-HTMLContainer {
@@ -344,7 +344,7 @@
                     New-HTMLTableCondition -Name 'EnterpriseAdmins' -Value 'True' -BackgroundColor Salmon -ComparisonType string -Operator ne
 
                     New-TableEvent -TableID 'GPOPermissionsAll' -SourceColumnName 'GUID' -TargetColumnID 1 # TargetColumnID 1 eq GUID on the other table
-                } -PagingOptions 7, 15, 30, 45, 60 -SearchBuilder
+                } -PagingOptions 7, 15, 30, 45, 60
             }
         }
         New-HTMLSection -Name 'All Permissions' {
@@ -355,7 +355,7 @@
                 New-HTMLTableCondition -Name 'Permission' -Value 'GpoApply' -BackgroundColor Orange -ComparisonType string
                 New-HTMLTableCondition -Name 'Permission' -Value 'GpoRead' -BackgroundColor MediumSpringGreen -ComparisonType string -Operator eq
                 New-HTMLTableCondition -Name 'PrincipalSidType' -Value 'Unknown' -BackgroundColor Salmon -ComparisonType string -Operator eq
-            } -PagingOptions 7, 15, 30, 45, 60 -DataTableID 'GPOPermissionsAll' -SearchBuilder
+            } -PagingOptions 7, 15, 30, 45, 60 -DataTableID 'GPOPermissionsAll'
         }
         if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
             New-HTMLSection -Name 'Steps to fix Group Policy Administrative Users' {

Private/Invoke.GPOZaurrPermissionsRead.ps1

@@ -151,12 +151,12 @@
         New-HTMLSection -Name 'Group Policy Authenticated Users Analysis' {
             New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsRead']['Data'].Permissions -Filtering {
                 New-HTMLTableCondition -Name 'Permission' -Value '' -BackgroundColor Salmon -ComparisonType string -Row
-            } -PagingOptions 7, 15, 30, 45, 60 -SearchBuilder
+            } -PagingOptions 7, 15, 30, 45, 60
         }
         New-HTMLSection -Name 'Group Policy Issues Assesment' {
             New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsRead']['Data'].Issues -Filtering {
                 New-HTMLTableCondition -Name 'PermissionIssue' -Value $true -BackgroundColor Salmon -ComparisonType string -Row
-            } -PagingOptions 7, 15, 30, 45, 60 -DefaultSortColumn PermissionIssue -DefaultSortOrder Descending -SearchBuilder
+            } -PagingOptions 7, 15, 30, 45, 60 -DefaultSortColumn PermissionIssue -DefaultSortOrder Descending
         }
         if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
             New-HTMLSection -Name 'Steps to fix Group Policy Authenticated Users' {

Private/Invoke.GPOZaurrPermissionsRoot.ps1

@@ -22,7 +22,7 @@
                 New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsRoot']['WarningsAndErrors'] -Filtering {
                     New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
                     New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
-                } -SearchBuilder
+                }
             }
         }
     }

Private/Invoke.GPOZaurrPermissionsUnknown.ps1

@@ -71,7 +71,7 @@
         New-HTMLSection -Name 'Group Policy Unknown Permissions Analysis' {
             New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsUnknown']['Data'] -Filtering {
                 New-HTMLTableCondition -Name 'Permission' -Value '' -BackgroundColor Salmon -ComparisonType string -Row
-            } -PagingOptions 7, 15, 30, 45, 60 -SearchBuilder
+            } -PagingOptions 7, 15, 30, 45, 60
         }
         if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
             New-HTMLSection -Name 'Steps to fix Group Policy Unknown Permissions' {

Private/New-GPOZaurrExclusions.ps1

@@ -0,0 +1,33 @@
+function New-GPOZaurrExclusions {
+    [cmdletBinding()]
+    param(
+        [alias('ExcludeGroupPolicies', 'ExclusionsCode', 'ExclusionsArray')][Parameter(Position = 1)][object] $Exclusions
+    )
+
+    if ($Exclusions) {
+        if ($Exclusions -is [scriptblock]) {
+            #$Script:Reporting[$T]['Exclusions'] = $Exclusions
+            #$Script:Reporting[$T]['ExclusionsCode'] = $Exclusions
+            [string] $Code = @(
+                "`$Exclusions = {"
+                "    " + $Exclusions.ToString()
+                "}"
+            )
+            $Code
+        }
+        if ($Exclusions -is [Array]) {
+            #$Script:Reporting[$T]['Exclusions'] = $Exclusions
+            #$ExclusionsArray = $Exclusions
+            [string] $Code = @(
+                '$Exclusions = @('
+                [System.Environment]::NewLine
+                foreach ($Exclusion in $Exclusions) {
+                    "   `"$Exclusion`"" + [System.Environment]::NewLine
+                }
+                [System.Environment]::NewLine
+                ')'
+            )
+            $Code
+        }
+    }
+}

Private/Script.GPOConfiguration.ps1

@@ -4,6 +4,7 @@
     GPOOwners                    = $GPOZaurrOwners
     GPOConsistency               = $GPOZaurrConsistency
     GPODuplicates                = $GPOZaurrDuplicates
+    GPOOrganizationalUnit        = $GPOZaurrOrganizationalUnit
     GPOList                      = $GPOZaurrList
     GPOLinks                     = $GPOZaurrLinks
     GPOPassword                  = $GPOZaurrPassword

Private/Script.GPODictionary.ps1

@@ -789,10 +789,10 @@
         )
         GPOPath    = 'Policies -> Windows Settings -> Security Settings -> Public Key Policies'
         Code       = {
-            ConvertTo-XMLGenericPublicKey -GPO $GPO
+            ConvertTo-XMLCertificates -GPO $GPO
         }
         CodeSingle = {
-            ConvertTo-XMLGenericPublicKey -GPO $GPO -SingleObject
+            ConvertTo-XMLCertificates -GPO $GPO -SingleObject
         }
     }
     <#

Public/Get-GPOZaurrOrganizationalUnit.ps1

@@ -0,0 +1,147 @@
+function Get-GPOZaurrOrganizationalUnit {
+    [CmdletBinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [ValidateSet('OK', 'Unlink', 'Delete')][string[]] $Option,
+        [alias('ExcludeOU', 'Exclusions')][string[]] $ExcludeOrganizationalUnit
+    )
+    $CachedOu = [ordered] @{}
+    $CachedGPO = [ordered] @{}
+
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    $GroupPolicies = Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($GPO in $GroupPolicies) {
+        $CachedGPO[$GPO.GPODistinguishedName] = $GPO
+    }
+    foreach ($Domain in $ForestInformation.Domains) {
+        Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain)"
+        $CountTop = 0
+        $TopOrganizationalUnits = Get-ADOrganizationalUnit -Filter * -Properties LinkedGroupPolicyObjects, DistinguishedName, ntSecurityDescriptor -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0] -SearchScope OneLevel
+        foreach ($TopOU in $TopOrganizationalUnits) {
+            $CountTop++
+            Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain) / $($TOPOU.DistinguishedName) [$CountTop/$($TopOrganizationalUnits.Count)]"
+            # cache top ou
+            if ($TopOU.LinkedGroupPolicyObjects) {
+                $LinkedGPOs = $CachedGPO[$TopOU.LinkedGroupPolicyObjects]
+            } else {
+                $LinkedGPOs = $null
+            }
+            $CachedOu[$TopOU.DistinguishedName] = [ordered]@{
+                'LinkedGroupPolicyObjects' = $TopOU.LinkedGroupPolicyObjects
+                'LinkedGroupPolicy'        = $LinkedGPOs
+                'Objects'                  = [ordered] @{}
+                'ObjectsClasses'           = [ordered] @{}
+                'ObjectsCountDirect'       = 0
+                'ObjectsCountIndirect'     = 0
+                'ObjectsCountTotal'        = 0
+                'Level'                    = 'Top'
+                'Domain'                   = $Domain
+            }
+
+            # cache children OUs
+            $OUs = Get-ADOrganizationalUnit -SearchScope Subtree -SearchBase $TopOU.DistinguishedName -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0] -Properties LinkedGroupPolicyObjects, DistinguishedName -Filter *
+            Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain) / $($TOPOU.DistinguishedName) [$CountTop/$($TopOrganizationalUnits.Count)], found $($OUs.Count) OU's to process."
+            foreach ($OU in $OUs) {
+                if (-not $CachedOu[$OU.DistinguishedName]) {
+                    if ($OU.LinkedGroupPolicyObjects) {
+                        $LinkedGPOs = $CachedGPO[$OU.LinkedGroupPolicyObjects]
+                    } else {
+                        $LinkedGPOs = $null
+                    }
+                    $CachedOu[$OU.DistinguishedName] = [ordered]@{
+                        'LinkedGroupPolicyObjects' = $OU.LinkedGroupPolicyObjects
+                        'LinkedGroupPolicy'        = $LinkedGPOs
+                        'Objects'                  = [ordered] @{}
+                        'ObjectsClasses'           = [ordered] @{}
+                        'ObjectsCountDirect'       = 0
+                        'ObjectsCountIndirect'     = 0
+                        'ObjectsCountTotal'        = 0
+                        'Level'                    = 'Child'
+                        'Domain'                   = $Domain
+                    }
+                }
+            }
+            # Find all objects in those OUs
+            $ObjectsInOu = Get-ADObject -LDAPFilter "(|(ObjectClass=user)(ObjectClass=contact)(ObjectClass=computer)(ObjectClass=group)(objectClass=inetOrgPerson))" -SearchBase $TopOU.distinguishedName -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0]
+            Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain) / $($TOPOU.DistinguishedName) [$CountTop/$($TopOrganizationalUnits.Count)], found $($ObjectsInOu.Count) objects to process."
+            foreach ($Object in $ObjectsInOu) {
+                $Place = ConvertFrom-DistinguishedName -ToOrganizationalUnit -DistinguishedName $Object.DistinguishedName
+                $AllOUs = ConvertFrom-DistinguishedName -ToMultipleOrganizationalUnit -IncludeParent -DistinguishedName $Place
+                foreach ($OU in $AllOUs) {
+                    if ($OU -eq $Place) {
+                        $CachedOu[$OU]['Objects'][$Object.DistinguishedName] = $Object
+                        $CachedOu[$OU]['ObjectsClasses'][$Object.ObjectClass] = ''
+                        $CachedOu[$OU]['ObjectsCountDirect']++
+                    } else {
+                        $CachedOu[$OU]['ObjectsClasses'][$Object.ObjectClass] = ''
+                        $CachedOu[$OU]['ObjectsCountIndirect']++
+                    }
+                    $CachedOu[$OU]['ObjectsCountTotal']++
+                }
+            }
+        }
+    }
+    foreach ($OU in $CachedOu.Keys) {
+        $ObjectClasses = [string[]] $CachedOu[$OU]['ObjectsClasses'].Keys
+
+        if ($CachedOu[$OU]['ObjectsCountTotal'] -eq 0 -and $CachedOu[$OU]['LinkedGroupPolicyObjects'].Count -gt 0) {
+            $Status = "Unlink GPO", 'Delete OU'
+        } elseif ($CachedOu[$OU]['ObjectsCountTotal'] -eq 0 -and $CachedOu[$OU]['LinkedGroupPolicyObjects'].Count -eq 0) {
+            $Status = 'Delete OU'
+        } elseif ($CachedOU[$Ou]['ObjectsCountTotal'] -gt 0 -and $CachedOu[$OU]['LinkedGroupPolicyObjects'].Count -gt 0 -and $ObjectClasses -notcontains 'User' -and $ObjectClasses -notcontains 'Computer' ) {
+            $Status = "Unlink GPO"
+        } else {
+            $Status = 'OK'
+        }
+
+        if ($Option) {
+            $Found = $false
+            if ($Option -contains 'Ok' -and $Status -contains 'OK') {
+                $Found = $true
+            } elseif ($Option -contains 'Unlink' -and $Status -contains 'Unlink GPO') {
+                $Found = $true
+            } elseif ($Option -contains 'Delete' -and $Status -contains 'Delete OU') {
+                $Found = $true
+            }
+            if ($ExcludeOrganizationalUnit) {
+                foreach ($ExcludedOU in $ExcludeOrganizationalUnit) {
+                    if ($OU -like $ExcludedOU) {
+                        $Found = $false
+                        break
+                    }
+                }
+            }
+            if (-not $Found) {
+                continue
+            }
+        } else {
+            if ($ExcludeOrganizationalUnit) {
+                foreach ($ExcludedOU in $ExcludeOrganizationalUnit) {
+                    if ($OU -like $ExcludedOU) {
+                        $Status = 'Excluded'
+                        break
+                    }
+                }
+            }
+        }
+
+        [PSCustomObject] @{
+            Organizationalunit  = $OU
+            Level               = $CachedOu[$OU]['Level']
+            DomainName          = $CachedOu[$OU]['Domain']
+            Status              = $Status
+            GPOCount            = $CachedOu[$OU]['LinkedGroupPolicyObjects'].Count
+            ObjectCountDirect   = $CachedOu[$OU]['ObjectsCountDirect']
+            ObjectCountIndirect = $CachedOu[$OU]['ObjectsCountIndirect']
+            ObjectCountTotal    = $CachedOu[$OU]['ObjectsCountTotal']
+            ObjectClasses       = $ObjectClasses
+            GPONames            = $CachedOu[$OU]['LinkedGroupPolicy'].DisplayName
+            Objects             = $CachedOu[$OU]['Objects'].Values.Name
+            GPO                 = $CachedOu[$OU]['LinkedGroupPolicy']
+        }
+    }
+}

Public/Get-GPOZaurrOwner.ps1

@@ -33,6 +33,9 @@
     .PARAMETER ADAdministrativeGroups
     Ability to provide AD Administrative Groups from another command to speed up processing
 
+    .PARAMETER ApprovedOwner
+    Ability to provide different owner (non administrative that still is approved for use)
+
     .EXAMPLE
     Get-GPOZaurrOwner -Verbose -IncludeSysvol
 
@@ -54,7 +57,9 @@
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
         [System.Collections.IDictionary] $ExtendedForestInformation,
-        [System.Collections.IDictionary] $ADAdministrativeGroups
+        [System.Collections.IDictionary] $ADAdministrativeGroups,
+
+        [alias('Exclusion', 'Exclusions')][string[]] $ApprovedOwner
     )
     Begin {
         $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
@@ -84,6 +89,7 @@
                 DisplayName = $_.DisplayName
                 DomainName  = $_.DomainName
                 GUID        = $_.GUID
+                Status      = [System.Collections.Generic.List[string]]::new()
                 Owner       = $ACL.OwnerName
                 OwnerSid    = $ACL.OwnerSid
                 OwnerType   = $ACL.OwnerType
@@ -104,6 +110,29 @@
             } else {
                 $Object['IsOwnerAdministrative'] = if ($Object['OwnerType'] -eq 'Administrative') { $true } else { $false }
             }
+            if ($Object['IsOwnerAdministrative'] -eq $true) {
+                $Object['Status'].Add('Administrative')
+            } else {
+                $Object['Status'].Add('NotAdministrative')
+            }
+            if ($Object['IsOwnerConsistent']) {
+                $Object['Status'].Add('Consistent')
+            } else {
+                $Object['Status'].Add('Inconsistent')
+            }
+            if ($Object['IsOwnerConsistent'] -eq $true -and $Object['IsOwnerAdministrative'] -eq $false) {
+                # We want to approve only OWNER if it's consistent and not administrative, otherwise it makes no sense
+                # This is mostly here to allow for use of AGPM or similar approved owner of GPOs
+                foreach ($Owner in $ApprovedOwner) {
+                    if ($Owner -eq $Object['Owner']) {
+                        $Object['Status'].Add('Approved')
+                        break
+                    } elseif ($Owner -eq $Object['OwnerSid']) {
+                        $Object['Status'].Add('Approved')
+                        break
+                    }
+                }
+            }
             if ($SkipBroken -and $Object['SysvolExists'] -eq $false) {
                 continue
             }

Public/Invoke-GPOZaurr.ps1

@@ -1,4 +1,62 @@
 function Invoke-GPOZaurr {
+    <#
+    .SYNOPSIS
+    Single cmdlet that provides 360 degree overview of Group Policies in Active Directory Forest.
+
+    .DESCRIPTION
+    Single cmdlet that provides 360 degree overview of Group Policies in Active Directory Forest with ability to pick reports and export to HTML.
+
+    .PARAMETER Exclusions
+    Allows to mark as excluded some Group Policies or Organizational Units depending on type.
+    Can be a scriptblock or array depending on supported way by underlying report.
+    Not every report support exclusions.
+    Not every report support exclusions the same way.
+    Exclusions should be used only if there is single report being asked for.
+
+    .PARAMETER FilePath
+    Path to the file where the report will be saved.
+
+    .PARAMETER Type
+    Type of report to be generated from a list of available reports.
+
+    .PARAMETER PassThru
+    Returns created objects after the report is done
+
+    .PARAMETER HideHTML
+    Do not auto open HTML report in default browser
+
+    .PARAMETER HideSteps
+    Do not show steps in report
+
+    .PARAMETER ShowError
+    Show errors in HTML report. Useful in case the report is being run as Scheduled Task
+
+    .PARAMETER ShowWarning
+    Show warnings in HTML report. Useful in case the report is being run as Scheduled Task
+
+    .PARAMETER Forest
+    Target different Forest, by default current forest is used
+
+    .PARAMETER ExcludeDomains
+    Exclude domain from search, by default whole forest is scanned
+
+    .PARAMETER IncludeDomains
+    Include only specific domains, by default whole forest is scanned
+
+    .PARAMETER Online
+    Forces report to use online resources in HTML (using CDN most of the time), by default it is run offline, and inlines all CSS/JS code.
+
+    .EXAMPLE
+    Invoke-GPOZaurr
+
+    .EXAMPLE
+    Invoke-GPOZaurr -Type GPOOrganizationalUnit -Online -FilePath $PSScriptRoot\Reports\GPOZaurrOU.html -Exclusions @(
+        '*OU=Production,DC=ad,DC=evotec,DC=pl'
+    )
+
+    .NOTES
+    General notes
+    #>
     [alias('Show-GPOZaurr', 'Show-GPO')]
     [cmdletBinding()]
     param(
@@ -76,7 +134,8 @@
             }
             if ($Exclusions) {
                 if ($Exclusions -is [scriptblock]) {
-                    $Script:Reporting[$T]['ExclusionsCode'] = $Exclusions
+                    $Script:Reporting[$T]['Exclusions'] = $Exclusions
+                    #$Script:Reporting[$T]['ExclusionsCode'] = $Exclusions
                 }
                 if ($Exclusions -is [Array]) {
                     $Script:Reporting[$T]['Exclusions'] = $Exclusions

Public/Invoke-GPOZaurrContent.ps1

@@ -212,7 +212,9 @@
             $DisplayProperties = @(
                 $FirstProperties
                 foreach ($Property in $Properties) {
-                    $Property
+                    if ($Property -notin $FirstProperties -and $Property -notin $EndProperties) {
+                        $Property
+                    }
                 }
                 $EndProperties
             )

Public/Remove-GPOZaurrLinkEmptyOU.ps1

@@ -0,0 +1,38 @@
+function Remove-GPOZaurrLinkEmptyOU {
+    [cmdletbinding(SupportsShouldProcess)]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [string[]] $ExcludeOrganizationalUnit,
+
+        [int] $LimitProcessing = [int32]::MaxValue
+    )
+
+    $Processed = 0
+    $OrganizationalUnits = Get-GPOZaurrOrganizationalUnit -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Option Unlink -ExcludeOrganizationalUnit $ExcludeOrganizationalUnit
+    foreach ($OU in $OrganizationalUnits) {
+        if ($OU.Status -contains 'Unlink GPO') {
+            if ($OU.OrganizationalUnit -in $ExcludeOrganizationalUnit) {
+                Write-Verbose "Remove-GPOZaurrLinkEmptyOU - Processing $($OU.Organizationalunit) was skipped as it's excluded."
+                continue
+            }
+            Write-Verbose "Remove-GPOZaurrLinkEmptyOU - Processing $($OU.Organizationalunit) found OU with GPOs to unlink"
+            $Processed++
+            foreach ($GPO in $OU.GPO) {
+                Write-Verbose "Remove-GPOZaurrLinkEmptyOU - Removing $($GPO.DisplayName) link from $($OU.Organizationalunit)"
+                try {
+                    Remove-GPLink -ErrorAction Stop -Guid $GPO.GUID -Domain $GPO.DomainName -Target $OU.Organizationalunit
+                } catch {
+                    Write-Warning "Remove-GPOZaurrLinkEmptyOU - Error removing link of $($GPO.DisplayName) from $($OU.OrganizationalUnit) error: $($_.Exception.Message)"
+                }
+            }
+            if ($Processed -ge $LimitProcessing) {
+                Write-Verbose "Remove-GPOZaurrLinkEmptyOU - Limit processing hit, stopping."
+                break
+            }
+        }
+    }
+}

Public/Set-GPOZaurrOwner.ps1

@@ -9,6 +9,7 @@
     .PARAMETER Type
     Unknown - finds unknown Owners and sets them to Administrative (Domain Admins) or chosen principal
     NotMatching - find administrative groups only and if sysvol and gpo doesn't match - replace with chosen principal or Domain Admins if not specified
+    Inconsistent - same as not NotMatching
     NotAdministrative - combination of Unknown/NotMatching and NotAdministrative - replace with chosen principal or Domain Admins if not specified
     All - if Owner is known it checks if it's Administrative, if it sn't it fixes that. If owner is unknown it fixes it
     .PARAMETER GPOName
@@ -38,6 +39,9 @@
     .PARAMETER LimitProcessing
     Allows to specify maximum number of items that will be fixed in a single run. It doesn't affect amount of GPOs processed
 
+    .PARAMETER Force
+    Pushes new owner regardless if it's already set or not
+
     .EXAMPLE
     Set-GPOZaurrOwner -Type All -Verbose -WhatIf -LimitProcessing 2
 
@@ -47,7 +51,7 @@
     [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Type')]
     param(
         [Parameter(ParameterSetName = 'Type', Mandatory)]
-        [validateset('Unknown', 'NotAdministrative', 'NotMatching', 'All')][string] $Type,
+        [validateset('Unknown', 'NotAdministrative', 'NotMatching', 'Inconsistent', 'All')][string] $Type,
 
         [Parameter(ParameterSetName = 'Named')][string] $GPOName,
         [Parameter(ParameterSetName = 'Named')][alias('GUID', 'GPOID')][string] $GPOGuid,
@@ -72,17 +76,28 @@
         [Parameter(ParameterSetName = 'Named')]
         [string] $Principal,
 
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
         [switch] $SkipSysvol,
 
         [Parameter(ParameterSetName = 'Type')]
         [Parameter(ParameterSetName = 'Named')]
         [int] $LimitProcessing = [int32]::MaxValue,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
+        [alias('Exclusion', 'Exclusions')][string[]] $ApprovedOwner,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
+        [validateset('OnlyAD', 'OnlyFileSystem')][string] $Action,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
         [switch] $Force
     )
     Begin {
-        #Write-Verbose "Set-GPOZaurrOwner - Getting ADAdministrativeGroups"
         $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-        #Write-Verbose "Set-GPOZaurrOwner - Processing GPO for Type $Type"
     }
     Process {
         $getGPOZaurrOwnerSplat = @{
@@ -94,6 +109,7 @@
             ADAdministrativeGroups    = $ADAdministrativeGroups
             Verbose                   = $VerbosePreference
             SkipBroken                = $true
+            ApprovedOwner             = $ApprovedOwner
         }
         if ($GPOName) {
             $getGPOZaurrOwnerSplat['GPOName'] = $GPOName
@@ -103,11 +119,13 @@
         $Count = 0
         Get-GPOZaurrOwner @getGPOZaurrOwnerSplat | Where-Object {
             $Count++
+            <#
             if ($_.Owner) {
                 $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
             } else {
                 $AdministrativeGroup = $null
             }
+
             if (-not $SkipSysvol) {
                 if ($_.SysvolOwner) {
                     $AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"]
@@ -115,11 +133,19 @@
                     $AdministrativeGroupSysvol = $null
                 }
             }
+
+            #>
             if ($Force) {
                 Write-Verbose "Set-GPOZaurrOwner - Force was used to push new owner to $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner)."
                 $_
             } else {
                 if ($Type -eq 'NotAdministrative') {
+                    if ($_.Status -contains 'NotAdministrative' -and $_.Status -notcontains 'Approved') {
+                        $_
+                    } elseif ($_.Status -contains 'Inconsistent') {
+                        $_
+                    }
+                    <#
                     if (-not $AdministrativeGroup -or (-not $AdministrativeGroupSysvol -and -not $SkipSysvol)) {
                         $_
                     } else {
@@ -128,23 +154,35 @@
                             $_
                         }
                     }
+                    #>
                 } elseif ($Type -eq 'Unknown') {
                     if (-not $_.Owner -or (-not $_.SysvolOwner -and -not $SkipSysvol)) {
                         $_
                     }
-                } elseif ($Type -eq 'NotMatching') {
+                } elseif ($Type -in 'NotMatching', 'Inconsistent') {
                     if ($SkipSysvol) {
                         Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). SysVol scanning is disabled. Skipping."
                     } else {
+                        if ($_.Status -contains 'Inconsistent') {
+                            $_
+                        }
+                        <#
                         if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
                             #Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
                             $_
                         }
+                        #>
                     }
                 } else {
                     # we run with no type, that means we need to either set it to principal or to Administrative
                     if ($_.Owner) {
                         # we check if Principal is not set
+                        if ($_.Status -contains 'NotAdministrative' -and $_.Status -notcontains 'Approved') {
+                            $_
+                        } elseif ($_.Status -contains 'Inconsistent') {
+                            $_
+                        }
+                        <#
                         $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
                         if (-not $SkipSysvol -and $_.SysvolOwner) {
                             $AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"]
@@ -156,6 +194,7 @@
                                 $_
                             }
                         }
+                        #>
                     } else {
                         $_
                     }
@@ -168,7 +207,7 @@
             } else {
                 $DefaultPrincipal = $Principal
             }
-            if ($Action -eq 'OnlyGPO') {
+            if ($Action -eq 'OnlyAD') {
                 Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) (SID: $($GPO.OwnerSID)) to $DefaultPrincipal"
                 Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
             } elseif ($Action -eq 'OnlyFileSystem') {

Public/Skip-GroupPolicy.ps1

@@ -27,22 +27,21 @@
     .NOTES
     General notes
     #>
-    [cmdletBinding()]
+    [cmdletBinding(DefaultParameterSetName = 'Name')]
     param(
         #[ValidateSet('GPOList')][string] $Type,
-        [alias('GpoName', 'DisplayName')][string] $Name,
+        [parameter(ParameterSetName = 'Name')][alias('GpoName', 'DisplayName')][string] $Name,
+        [parameter(ParameterSetName = 'Guid')]
+        [alias('ID')][string] $GUID,
+        [parameter(ParameterSetName = 'Name')]
+        [parameter(ParameterSetName = 'Guid')]
         [string] $DomaiName
     )
-    #if ($Type) {
-    #    [PSCustomObject] @{
-    #        Type       = $Type
-    #        Name       = $Name
-    #        DomainName = $DomaiName
-    #    }
-    #} else {
-    [PSCustomObject] @{
+    $Output = @{
         Name       = $Name
+        ID         = $GUID
         DomainName = $DomaiName
     }
-    #}
+    Remove-EmptyValue -Hashtable $Output
+    [PSCustomObject] $Output
 }

README.md

@@ -55,6 +55,92 @@ To understand the usage I've created blog post you may find useful
 
 ## Changelog
 
+- 0.0.130 - 2021.08.13
+  - 💡 Updated HTML to new version of `PSWriteHTML` that fixes complains about `SearchBuilder` option
+  - ☑ Improved `Invoke-GPOZaurr` - type `GPOOrganizationalUnit` with exclusions
+
+    ```powershell
+    Invoke-GPOZaurr -Type GPOOrganizationalUnit -Online -FilePath $PSScriptRoot\Reports\GPOZaurrOU.html -Exclusions @(
+        '*OU=Production,DC=ad,DC=evotec,DC=pl'
+        '*OU=Production,DC=ad,DC=evotec,DC=pl'
+        '*DC=ad,DC=evotec,DC=pl'
+    )
+    ```
+
+  - ☑ Improved `Get-GPOZaurrOrganizationalUnit` with exclusions
+
+      ```powershell
+      Get-GPOZaurrOrganizationalUnit -Verbose -ExcludeOrganizationalUnit @(
+        '*,OU=Production,DC=ad,DC=evotec,DC=pl'
+      ) | Format-Table
+      ```
+
+  - ☑ Improved `Remove-GPOZaurrLinkEmptyOU` with exclusions
+
+    ```powershell
+    $Exclude = @(
+        "OU=Groups,OU=Production,DC=ad,DC=evotec,DC=pl"
+        "OU=Test \, OU,OU=ITR02,DC=ad,DC=evotec,DC=xyz"
+    )
+
+    Remove-GPOZaurrLinkEmptyOU -Verbose -LimitProcessing 3 -WhatIf -ExcludeOrganizationalUnit $Exclude
+    ```
+
+  - ☑ Improved `Invoke-GPOZaurr` - type `GPOOwners` with exclusions
+
+    ```powershell
+    Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurrGPOOwners.html -Type GPOOwners -Online -Exclusions @(
+        'EVOTEC\przemyslaw.klys'
+    )
+    ```
+
+  - ☑ Improved `Set-GPOZaurrOwner` with exclusions/approved owners
+
+    ```powershell
+    Set-GPOZaurrOwner -Type All -Verbose -LimitProcessing 2 -WhatIf -IncludeDomains 'ad.evotec.xyz' -ApprovedOwner @(
+        'EVOTEC\przemyslaw.klys'
+    )
+    ```
+
+  - ☑ Improved `Get-GPOZaurrOwner` with exclusions/approved owners
+
+    ```powershell
+    $T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -ApprovedOwner @('EVOTEC\przemyslaw.klys')
+    $T | Format-Table *
+    ```
+
+  - ☑ Improved `Get-GPOZaurr` with exclusions and support for GUID, strings
+
+    ```powershell
+    $GPOS = Get-GPOZaurr -ExcludeGroupPolicies {
+        Skip-GroupPolicy -Name 'de14_usr_std'
+        Skip-GroupPolicy -Name 'de14_usr_std' -DomaiName 'ad.evotec.xyz'
+        Skip-GroupPolicy -Name 'All | Trusted Websites' #-DomaiName 'ad.evotec.xyz'
+        '{D39BF08A-87BF-4662-BFA0-E56240EBD5A2}'
+        'COMPUTERS | Enable Sets'
+    }
+    $GPOS | Format-Table -AutoSize *
+    ```
+
+  - ☑ Improved `Invoke-GPOZaurr` with exclusions and support for GUID, strings
+
+    ```powershell
+    Invoke-GPOZaurr -Type GPOList -Exclusions {
+        Skip-GroupPolicy -Name 'All | Trusted Websites' -DomaiName 'ad.evotec.xyz'
+        '{D39BF08A-87BF-4662-BFA0-E56240EBD5A2}'
+        'COMPUTERS | Enable Sets'
+    }
+    ```
+
+- 0.0.129 - 2021.08.06
+  - Added `Get-GPOZaurrOrganizationalUnit` and added `GPOOrganizationalUnit` in `Invoke-GPOZaurr` (preview)
+  - Added `Remove-GPOZaurrLinkEmptyOU` which allows removing links from Empty OUs (preview)
+  - Small update to parameter sets for `Set-GPOZaurrOwner`
+- 0.0.128 - 2021.05.26
+  - ☑ Improved `Invoke-GPOZaurrContent` - type `PublicKeyPoliciesCertificates` - added more certificate information
+  - ☑ Improved `Invoke-GPOZaurr` - type `GPOAnalysis` - added more certificate information
+- 0.0.128 Alpha 1 - 2021.05.17
+  - 🐛 Fixes errors when normalizing properties [#17](https://github.com/EvotecIT/GPOZaurr/issues/17)
 - 0.0.127 - 2021.04.15
   - ☑ Improved `Invoke-GPOZaurr`
     - ☑ Report `GPOList` - moved description closer to statuses