Update

Added some error logging

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# These are supported funding model platforms
+
+github: PrzemyslawKlys
+custom: https://paypal.me/PrzemyslawKlys

Docs/Backup-GPOZaurr.md

@@ -0,0 +1,214 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Backup-GPOZaurr
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Backup-GPOZaurr [[-LimitProcessing] <Int32>] [[-Type] <String[]>] [[-Forest] <String>]
+ [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>]
+ [[-GPOPath] <String[]>] [[-BackupPath] <String>] [-BackupDated] [-WhatIf] [-Confirm] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -BackupDated
+{{ Fill BackupDated Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -BackupPath
+{{ Fill BackupPath Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 7
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 6
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -LimitProcessing
+{{ Fill LimitProcessing Description }}
+
+```yaml
+Type: Int32
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Type
+{{ Fill Type Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: All, Empty, Unlinked
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurr.md

@@ -0,0 +1,197 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurr
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurr [[-GPOName] <String>] [[-GPOGuid] <String>] [[-Forest] <String>] [[-ExcludeDomains] <String[]>]
+ [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>] [[-GPOPath] <String[]>]
+ [-PermissionsOnly] [-OwnerOnly] [-Limited] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOGuid
+{{ Fill GPOGuid Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: GUID, GPOID
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOName
+{{ Fill GPOName Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 6
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Limited
+{{ Fill Limited Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -OwnerOnly
+{{ Fill OwnerOnly Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -PermissionsOnly
+{{ Fill PermissionsOnly Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrBackupInformation.md

@@ -0,0 +1,60 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrBackupInformation
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurrBackupInformation [[-BackupFolder] <String[]>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -BackupFolder
+{{ Fill BackupFolder Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrLink.md

@@ -0,0 +1,152 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrLink
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurrLink [[-ADObject] <ADObject[]>] [-Limited] [[-GPOCache] <IDictionary>] [[-Forest] <String>]
+ [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>]
+ [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ADObject
+{{ Fill ADObject Description }}
+
+```yaml
+Type: ADObject[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: True (ByPropertyName, ByValue)
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOCache
+{{ Fill GPOCache Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Limited
+{{ Fill Limited Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### Microsoft.ActiveDirectory.Management.ADObject[]
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrPassword.md

@@ -0,0 +1,121 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrPassword
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurrPassword [[-Forest] <String>] [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>]
+ [[-ExtendedForestInformation] <IDictionary>] [[-GPOPath] <String[]>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrPermission.md

@@ -0,0 +1,280 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrPermission
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+### GPO (Default)
+```
+Get-GPOZaurrPermission [-Type <String[]>] [-SkipWellKnown] [-SkipAdministrative] [-ResolveAccounts]
+ [-IncludeOwner] [-IncludePermissionType <GPPermissionType[]>] [-ExcludePermissionType <GPPermissionType[]>]
+ [-IncludeGPOObject] [-Forest <String>] [-ExcludeDomains <String[]>] [-IncludeDomains <String[]>]
+ [-ExtendedForestInformation <IDictionary>] [<CommonParameters>]
+```
+
+### GPOName
+```
+Get-GPOZaurrPermission [-GPOName <String>] [-Type <String[]>] [-SkipWellKnown] [-SkipAdministrative]
+ [-ResolveAccounts] [-IncludeOwner] [-IncludePermissionType <GPPermissionType[]>]
+ [-ExcludePermissionType <GPPermissionType[]>] [-IncludeGPOObject] [-Forest <String>]
+ [-ExcludeDomains <String[]>] [-IncludeDomains <String[]>] [-ExtendedForestInformation <IDictionary>]
+ [<CommonParameters>]
+```
+
+### GPOGUID
+```
+Get-GPOZaurrPermission [-GPOGuid <String>] [-Type <String[]>] [-SkipWellKnown] [-SkipAdministrative]
+ [-ResolveAccounts] [-IncludeOwner] [-IncludePermissionType <GPPermissionType[]>]
+ [-ExcludePermissionType <GPPermissionType[]>] [-IncludeGPOObject] [-Forest <String>]
+ [-ExcludeDomains <String[]>] [-IncludeDomains <String[]>] [-ExtendedForestInformation <IDictionary>]
+ [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludePermissionType
+{{ Fill ExcludePermissionType Description }}
+
+```yaml
+Type: GPPermissionType[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: None, GpoApply, GpoRead, GpoEdit, GpoEditDeleteModifySecurity, GpoCustom, WmiFilterEdit, WmiFilterFullControl, WmiFilterCustom, StarterGpoRead, StarterGpoEdit, StarterGpoFullControl, StarterGpoCustom, SomCreateWmiFilter, SomWmiFilterFullControl, SomCreateGpo, SomCreateStarterGpo, SomLogging, SomPlanning, SomLink
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOGuid
+{{ Fill GPOGuid Description }}
+
+```yaml
+Type: String
+Parameter Sets: GPOGUID
+Aliases: GUID, GPOID
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOName
+{{ Fill GPOName Description }}
+
+```yaml
+Type: String
+Parameter Sets: GPOName
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeGPOObject
+{{ Fill IncludeGPOObject Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeOwner
+{{ Fill IncludeOwner Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludePermissionType
+{{ Fill IncludePermissionType Description }}
+
+```yaml
+Type: GPPermissionType[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: None, GpoApply, GpoRead, GpoEdit, GpoEditDeleteModifySecurity, GpoCustom, WmiFilterEdit, WmiFilterFullControl, WmiFilterCustom, StarterGpoRead, StarterGpoEdit, StarterGpoFullControl, StarterGpoCustom, SomCreateWmiFilter, SomWmiFilterFullControl, SomCreateGpo, SomCreateStarterGpo, SomLogging, SomPlanning, SomLink
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ResolveAccounts
+{{ Fill ResolveAccounts Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -SkipAdministrative
+{{ Fill SkipAdministrative Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -SkipWellKnown
+{{ Fill SkipWellKnown Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Type
+{{ Fill Type Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: Unknown, All
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrWMI.md

@@ -0,0 +1,136 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrWMI
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurrWMI [[-Guid] <Guid[]>] [[-Name] <String[]>] [[-Forest] <String>] [[-ExcludeDomains] <String[]>]
+ [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Guid
+{{ Fill Guid Description }}
+
+```yaml
+Type: Guid[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Name
+{{ Fill Name Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/New-GPOZaurrWMI.md

@@ -0,0 +1,213 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# New-GPOZaurrWMI
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+New-GPOZaurrWMI [-Name] <String> [[-Description] <String>] [-Query] <String> [-SkipQueryCheck] [-Force]
+ [[-Forest] <String>] [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>]
+ [[-ExtendedForestInformation] <IDictionary>] [-WhatIf] [-Confirm] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Description
+{{ Fill Description Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 6
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Force
+{{ Fill Force Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Name
+{{ Fill Name Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: True
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Query
+{{ Fill Query Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: True
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -SkipQueryCheck
+{{ Fill SkipQueryCheck Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Readme.md

@@ -0,0 +1,52 @@
+---
+Module Name: GPOZaurr
+Module Guid: f7d4c9e4-0298-4f51-ad77-e8e3febebbde
+Download Help Link: {{ Update Download Link }}
+Help Version: {{ Please enter version of help manually (X.X.X.X) format }}
+Locale: en-US
+---
+
+# GPOZaurr Module
+## Description
+{{ Fill in the Description }}
+
+## GPOZaurr Cmdlets
+### [Backup-GPOZaurr](Backup-GPOZaurr.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurr](Get-GPOZaurr.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrBackupInformation](Get-GPOZaurrBackupInformation.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrLink](Get-GPOZaurrLink.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrPassword](Get-GPOZaurrPassword.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrPermission](Get-GPOZaurrPermission.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrWMI](Get-GPOZaurrWMI.md)
+{{ Fill in the Description }}
+
+### [New-GPOZaurrWMI](New-GPOZaurrWMI.md)
+{{ Fill in the Description }}
+
+### [Remove-GPOZaurr](Remove-GPOZaurr.md)
+{{ Fill in the Description }}
+
+### [Remove-GPOZaurrWMI](Remove-GPOZaurrWMI.md)
+{{ Fill in the Description }}
+
+### [Restore-GPOZaurr](Restore-GPOZaurr.md)
+{{ Fill in the Description }}
+
+### [Save-GPOZaurrFiles](Save-GPOZaurrFiles.md)
+{{ Fill in the Description }}
+
+### [Set-GPOZaurrOwner](Set-GPOZaurrOwner.md)
+{{ Fill in the Description }}
+

Docs/Remove-GPOZaurr.md

@@ -0,0 +1,214 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Remove-GPOZaurr
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Remove-GPOZaurr [-Type] <String[]> [[-LimitProcessing] <Int32>] [[-Forest] <String>]
+ [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>]
+ [[-GPOPath] <String[]>] [[-BackupPath] <String>] [-BackupDated] [-WhatIf] [-Confirm] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -BackupDated
+{{ Fill BackupDated Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -BackupPath
+{{ Fill BackupPath Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 7
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 6
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -LimitProcessing
+{{ Fill LimitProcessing Description }}
+
+```yaml
+Type: Int32
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Type
+{{ Fill Type Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: Empty, Unlinked
+
+Required: True
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Remove-GPOZaurrWMI.md

@@ -0,0 +1,168 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Remove-GPOZaurrWMI
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Remove-GPOZaurrWMI [[-Guid] <Guid[]>] [[-Name] <String[]>] [[-Forest] <String>] [[-ExcludeDomains] <String[]>]
+ [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>] [-WhatIf] [-Confirm]
+ [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Guid
+{{ Fill Guid Description }}
+
+```yaml
+Type: Guid[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Name
+{{ Fill Name Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Restore-GPOZaurr.md

@@ -0,0 +1,121 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Restore-GPOZaurr
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Restore-GPOZaurr [-BackupFolder] <String> [[-DisplayName] <String>] [[-NewDisplayName] <String>]
+ [[-Domain] <String>] [-SkipBackupSummary] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -BackupFolder
+{{ Fill BackupFolder Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: True
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -DisplayName
+{{ Fill DisplayName Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: Name
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Domain
+{{ Fill Domain Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -NewDisplayName
+{{ Fill NewDisplayName Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -SkipBackupSummary
+{{ Fill SkipBackupSummary Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Save-GPOZaurrFiles.md

@@ -0,0 +1,136 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Save-GPOZaurrFiles
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Save-GPOZaurrFiles [[-Forest] <String>] [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>]
+ [[-ExtendedForestInformation] <IDictionary>] [[-GPOPath] <String[]>] [-DeleteExisting] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -DeleteExisting
+{{ Fill DeleteExisting Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Set-GPOZaurrOwner.md

@@ -0,0 +1,222 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Set-GPOZaurrOwner
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+### Type (Default)
+```
+Set-GPOZaurrOwner -Type <String[]> [-Forest <String>] [-ExcludeDomains <String[]>] [-IncludeDomains <String[]>]
+ [-ExtendedForestInformation <IDictionary>] [-LimitProcessing <Int32>] [-WhatIf] [-Confirm]
+ [<CommonParameters>]
+```
+
+### Named
+```
+Set-GPOZaurrOwner [-GPOName <String>] [-GPOGuid <String>] [-Forest <String>] [-ExcludeDomains <String[]>]
+ [-IncludeDomains <String[]>] [-ExtendedForestInformation <IDictionary>] -Principal <String>
+ [-LimitProcessing <Int32>] [-WhatIf] [-Confirm] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOGuid
+{{ Fill GPOGuid Description }}
+
+```yaml
+Type: String
+Parameter Sets: Named
+Aliases: GUID, GPOID
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOName
+{{ Fill GPOName Description }}
+
+```yaml
+Type: String
+Parameter Sets: Named
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -LimitProcessing
+{{ Fill LimitProcessing Description }}
+
+```yaml
+Type: Int32
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Principal
+{{ Fill Principal Description }}
+
+```yaml
+Type: String
+Parameter Sets: Named
+Aliases:
+
+Required: True
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Type
+{{ Fill Type Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: Type
+Aliases:
+Accepted values: EmptyOrUnknown, NotAdministrative
+
+Required: True
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Examples/Example-02-RemoveEmptyAndUnlinkedGPOs.ps1

@@ -2,4 +2,4 @@
 
 # Remove GPOS
 $BackupPath = "$Env:UserProfile\Desktop\GPO"
-Remove-GPOZaurr -Type Empty -BackupPath $BackupPath -BackupDated -LimitProcessing 2 -Verbose
+Remove-GPOZaurr -Type Empty, Unlinked -BackupPath $BackupPath -BackupDated -LimitProcessing 2 -Verbose

Examples/Example-03-RestoreGPO.ps1

@@ -1,6 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$RestoreFrom = 'C:\Users\przemyslaw.klys\Desktop\GPO\2020-04-12_10_11_24'
+$RestoreFrom = 'C:\Users\przemyslaw.klys\Desktop\GPO\2020-04-26_10_29_34'
 
 $BackupInformation = Get-GPOZaurrBackupInformation -BackupFolder $RestoreFrom
 $BackupInformation | Format-Table -a

Examples/Example-04-GPOinformation.ps1

@@ -9,4 +9,4 @@ $GPOs[0].ACL | Format-Table -AutoSize
 
 $GPOs.Links | Format-Table -AutoSize
 
-$GPOS | Format-Table -AutoSize Name, WmiFilter, WMIDescription
+$GPOS | Format-Table -AutoSize DisplayName, WmiFilter, WMIDescription

Examples/Example-05-ListingWMIFiltersByName.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrWMI -Name 'Test - Dual Filter' | Format-Table -AutoSize *

Examples/Example-08-ListingPermissions.ps1

@@ -2,6 +2,6 @@
 
 $T = Get-GPOZaurrPermission -GPOName 'DC | PowerShell Logging' -Type Unknown
 
-#$T = Get-GPOZaurrPermission #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView
+#$T = Get-GPOZaurrPermission -ResolveAccounts -IncludeOwner #-ExcludePermissionType GpoRead,GpoApply #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView
 $T | Format-Table -AutoSize *
 #$T | Out-HtmlView -ScrollX -Filtering -Online -DisablePaging

Examples/Example-08-ListingPermissionsAdministrative.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrPermission -GPOName 'Default Domain Policy' -Type 'All'
+$T | Format-Table *

Examples/Example-08-ListingPermissionsPerGPO.ps1

@@ -0,0 +1,12 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' #-Principal 'marikegerard' -PrincipalType Name # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'marikegerard' -PrincipalType Name # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'EVOTEC\marikegerard' -PrincipalType Name # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'S-1-5-18' -PrincipalType Sid # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'CN=Enterprise Admins,CN=Users,DC=ad,DC=evotec,DC=xyz' -PrincipalType DistinguishedName # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *

Examples/Example-08-ListingPermissionsUnknown.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrPermission -Type Unknown -Verbose
+$T | Format-Table *

Examples/Example-09-RemovingGPOPermissionUnknown.ps1

@@ -1,3 +1,3 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-
-Remove-GPOZaurrPermission -Verbose -Type Unknown -WhatIf
+#Clear-Host
+Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 1 #-WhatIf

Examples/Example-09-RemovingGPOPermissionUnknown02.ps1

@@ -0,0 +1,19 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Step 1 - Create report
+$Report = Get-GPOZaurrPermission -Type All
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOutput.xlsx -ExcelWorkSheetName 'GPO Permissions Before' -AutoFilter -AutoFit
+
+# Step 2 - Verify couple of GPOS returned with whatif
+#Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 4 -WhatIf
+
+# Step 3 - Confirm the change without whatif
+#Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 4
+
+# Step 4 - Analyze GPO manually to confirm only unknown sids were removed
+
+# Step 5 - if everything went ok, continue process without whatif
+
+# Step-6 - Generate new report
+#$Report = Get-GPOZaurrPermission -Type All
+#$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOutput.xlsx -ExcelWorkSheetName 'GPO Permissions After' -AutoFilter -AutoFit

Examples/Example-09-RemovingGPOpermissionNamed.ps1

@@ -1,13 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$Named = @(
-    'S-1-5-21-853615985-2870445339-3163598659-1105'
-)
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy'
+$T | Format-Table -AutoSize *
 
-# Using exclude permission types (it may not be good idea to delete GPORead/GPOApply)
-#Remove-GPOZaurrPermission -Verbose -Type Named -WhatIf -LimitProcessing 2 -NamedObjects $Named -ExcludePermissionType GpoRead,GpoApply
-
-# But
-#Remove-GPOZaurrPermission -Type Named -NamedObjects $Named -IncludePermissionType GpoEditDeleteModifySecurity -SkipWellKnown -SkipAdministrative -Verbose -WhatIf
-
-Remove-GPOZaurrPermission -Type Named -NamedObjects $Named -SkipWellKnown -SkipAdministrative -Verbose #-WhatIf
+Remove-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'S-1-5-21-853615985-2870445339-3163598659-3755' -Verbose #-WhatIf #-IncludePermissionType GpoApply #-WhatIf

Examples/Example-10-ListingGPO.ps1

@@ -0,0 +1,6 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrAD | Format-Table
+Get-GPOZaurrAD -Forest 'test.evotec.pl' | Format-Table
+
+Get-GPOZaurrAD -GPOName 'Default Domain Policy' -IncludeDomains 'ad.evotec.pl' | Format-Table

Examples/Example-10-ListingGPOLong.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$GPOS = Get-GPOZaurr
+$GPOS | Format-Table -AutoSize

Examples/Example-11-ReplaceGPOOwnerAutomated.ps1

@@ -1,13 +1,17 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 # This Example shows how to deal with GPOs that have owner that doesn't exists anymore (deleted userr or diff domain) - EmptyOrUnknown
-# And also can fix at the same time NonAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins
+# And also can fix at the same time NotAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins
 # regardless if current user is still Domain Admin or not
 
-$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
-$GPOs | Format-Table DisplayName, Owner, OwnerSID
+$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName
+$GPOs | Format-Table  DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
 
-Set-GPOZaurrOwner -Type 'NonAdministrative','EmptyOrUnknown' -Verbose -LimitProcessing 3 #-WhatIf
+#Set-GPOZaurrOwner -Type Unknown -Verbose  #-LimitProcessing 2 -WhatIf
+Set-GPOZaurrOwner -Type NotAdministrative  -Verbose -LimitProcessing 2 -WhatIf
+#Set-GPOZaurrOwner -Type NotMatching -Verbose -LimitProcessing 2 -WhatIf
 
-$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
-$GPOs | Format-Table DisplayName, Owner, OwnerSID
+#Set-GPOZaurrOwner -GPOName 'COMPUTERS | Enable Sets' -Verbose -Principal 'przemyslaw.klys' -WhatIf #-SkipSysvol
+#Set-GPOZaurrOwner -GPOName 'New Group Policy Object' -Verbose #-WhatIf #-SkipSysvol
+#$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName 'New Group Policy Object'
+#$GPOs | Format-Table DisplayName, Owner, OwnerSID

Examples/Example-11-ReplaceGPOOwnerManual.ps1

@@ -1,5 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
+# You can set owner per guid if you want to have more control.
 $LImitProcessing = 2
 
 # check what is there now

Examples/Example-11-ReplaceGPOOwnerPerGPO.ps1

@@ -0,0 +1,15 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# this example shows how to replace owner of a single GPO
+
+$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
+$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType
+
+# If Principal is not provided Domain Admins are set as default principal
+Set-GPOZaurrOwner -GPOName 'ALL | Enable RDP' -WhatIf
+
+# If principal is given it is set (of course if it exits). Otherwise warning is returned.
+Set-GPOZaurrOwner -GPOName 'ALL | Enable RDP' -Principal 'przemyslaw.klys' #-WhatIf
+
+$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
+$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType

Examples/Example-11-ReplaceGPOwner.ps1

@@ -0,0 +1,12 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Step 1 - Create report
+$Report = Get-GPOZaurrOwner -IncludeSysvol
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOwners.xlsx -ExcelWorkSheetName 'GPO Owners Before' -AutoFilter -AutoFit
+
+# Step 2 - Fix owners / use WhatIf and LimitProcessing / verify changes before/after
+Set-GPOZaurrOwner -Type NotAdministrative  -Verbose -LimitProcessing 2 -WhatIf
+
+# Step 3
+$Report = Get-GPOZaurrOwner -IncludeSysvol
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOwners.xlsx -ExcelWorkSheetName 'GPO Owners After' -AutoFilter -AutoFit

Examples/Example-13-ListingOwners01.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Owners = Get-GPOZaurr -OwnerOnly
+$Owners | Format-Table

Examples/Example-13-ListingOwners02.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol
+$T | Format-Table *
+#$T | Out-HtmlView -ScrollX
+
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOName 'Default Domain Policy'
+$T | Format-Table *
+
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOGuid '4E1F9C70-1DDB-4AB6-BBA3-14A8E07F0B4B'
+$T | Format-Table *

Examples/Example-14-ListingGPOsPerOU1.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink | Format-Table -AutoSize *

Examples/Example-14-ListingGPOsPerOU2.ps1

@@ -0,0 +1,7 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -SearchBase 'OU=Domain Controllers,DC=ad,DC=evotec,DC=xyz' | Format-Table -AutoSize
+
+Get-GPOZaurrLink -SearchBase 'OU=Computers,OU=Production,DC=ad,DC=evotec,DC=xyz' | Format-Table -AutoSize
+
+Get-GPOZaurrLink -SearchBase 'DC=ad,DC=evotec,DC=xyz' -SearchScope Base | Format-Table -AutoSize

Examples/Example-14-ListingGPOsPerOU3.ps1

@@ -0,0 +1,6 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-ADOrganizationalUnit -Filter * -Properties distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
+Get-ADOrganizationalUnit -Filter * -Properties canonicalname, distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
+Get-ADObject -Filter * -Properties distinguishedName, gplink -Server 'ad.evotec.pl' | Get-GPOZaurrLink | Format-Table -AutoSize
+Get-GPOZaurrLink | Format-Table -AutoSize

Examples/Example-14-ListingGPOsPerOU4.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -Linked 'Root' -IncludeDomains 'ad.evotec.pl' | Format-Table

Examples/Example-14-ListingGPOsPerOURemoveDuplicates.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -Verbose | Format-Table -a *
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -SkipDuplicates | Format-Table -a *

Examples/Example-14-ListingGPOsSpecial.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Clear-Host
+
+Get-GPOZaurrLink -Linked Root | Format-Table -AutoSize
+
+Get-GPOZaurrLink -Linked Site | Format-Table -AutoSize
+
+Get-GPOZaurrLink -Linked DomainControllers | Format-Table -AutoSize
+
+Get-GPOZaurrLink -Linked Other | Format-Table -AutoSize

Examples/Example-15-FixingGPOPermissions.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink | Format-Table -AutoSize

Examples/Example-16-AddRemoveGPOPermission01.ps1

@@ -0,0 +1,17 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Clear-Host
+
+$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-IncludeGPOObject #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+
+Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -Verbose
+
+$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+
+Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -Verbose
+Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+
+$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *

Examples/Example-16-AddRemoveGPOPermission02.ps1

@@ -0,0 +1,38 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Clear-Host
+
+$GPOName = 'ALL | Enable RDP'
+
+$T = Get-GPOZaurrPermission -GPOName $GPOName -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow -Principal 'Domain Admins' -PrincipalType 'Name'
+$T | Format-Table *
+
+<#
+# this will go and check for both Domain Admins / Enterprise Admins - if found won't do anything
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Type Administrative -Verbose
+# this will go thru, because PrincipalType is not set to look by Name. Be precise with what you ask for
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -Verbose
+# this will be detected as already existing
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -PrincipalType Name -Verbose
+# this will be added only if it doesn't exists - assuming that przemyslaw.klys is displayed in Get-GPOZaurrPermissions
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+# this will be added only if it doesn't exists - assuming that przemyslaw.klys is displayed in Get-GPOZaurrPermissions
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+# this will ADD system if it doesn't eists
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Type WellKnownAdministrative -Verbose
+
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -Verbose
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -Verbose
+# this will not work because we already have GPOEditDeleteModifySecurity which is higher than GpoEDIT
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEdit -Principal 'przemyslaw.klys' -Verbose
+#>
+Add-GPOZaurrPermission -GPOName $GPOName -Type AuthenticatedUsers -PermissionType GpoRead -Verbose #-WhatIf
+
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T | Format-Table -AutoSize *
+
+#Remove-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T | Format-Table -AutoSize *

Examples/Example-16-AddRemoveGPOPermission03.ps1

@@ -0,0 +1,12 @@
+#Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Invoke-GPOZaurrPermission -Linked Root -Verbose {
+    Set-GPOOwner -Type Administrative
+    #Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'
+    #Set-GPOOwner -Principal 'Domain Admins'
+    Remove-GPOPermission -Type Administrative -IncludePermissionType GPOCustom
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
+    #Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
+} #-WhatIf #| Format-Table *

Examples/Example-16-AddRemoveGPOPermission04.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=Computers,OU=Production,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    #Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'
+    #Set-GPOOwner -Principal 'Domain Admins'
+    #Remove-GPOPermission -Type Administrative -IncludePermissionType GPOCustom
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
+    #Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
+    #Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
+} -WhatIf #| Format-Table *

Examples/Example-16-KeepPermissions.ps1

@@ -0,0 +1,42 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Apply permissions for ROOT
+Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+# Apply perrmissions for Domain Controllers
+Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+# Apply permissions for Regions, with exclusions for those 4 groups
+$Exclude = @(
+    'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+$Exclude = @(
+    'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf

Examples/Example-16-KeepPermissions02.ps1

@@ -0,0 +1,44 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Apply permissions for ROOT
+Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.pl' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates
+
+
+# Apply perrmissions for Domain Controllers
+Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates
+
+# Apply permissions for Regions, with exclusions for those 4 groups
+$Exclude = @(
+    'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates
+
+
+$Exclude = @(
+    'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates

Examples/Example-16-KeepPermissions03.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This is a bit special - I would read blog post before running this
+Invoke-GPOZaurrPermission -Verbose -Level 1 -Limit 1 {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf

Examples/Example-17-ListInconsistentACL.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
+Get-GPOZaurrPermissionConsistency -Type All | Format-Table

Examples/Example-17-RepairInconsistentACL.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz'
+
+Repair-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -Verbose #-WhatIf -Verbose

Examples/Example-17-RepairInconsistentACLAll.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrPermissionConsistency -Type All | Format-Table
+
+Repair-GPOZaurrPermissionConsistency -LimitProcessing 2 -WhatIf -Verbose

Examples/Example-18-ListInconsistenciesACLAdvanced.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
+
+$Output = Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -VerifyInheritance
+$Output | Format-Table DisplayName, DomainName, ACLConsistent, ACLConsistentInside
+$Output.ACLConsistentInsideDetails | Format-Table
+
+$Output = Get-GPOZaurrPermissionConsistency -VerifyInheritance -Type 'All'
+$Output | Format-Table

Examples/Example-19-TestSysvol.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrSysvol -Verbose | Format-Table

Examples/Example-19-TestSysvolDomainControllers.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrSysvol -VerifyDomainControllers -Verbose | Format-Table *

Examples/Example-20-RemoveOrphanedFoldersSysvol.ps1

@@ -0,0 +1,7 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# this allows you to process X amount of orphaned folders/files (good for testing)
+Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf -LimitProcessing 2
+
+# this runs for whole SYSVOL and checks things against GPOS
+Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf

Examples/Example-21-ListLegacyADMFiles.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLegacyFiles | Format-Table -AutoSize

Examples/Example-22-RemoveLegacyADMFiles.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Remove-GPOZaurrLegacyFiles -Verbose -WhatIf

Examples/Example-23-Links.ps1

@@ -0,0 +1,14 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Get-GPOZaurrLinkSummary | Format-Table *
+#Get-GPOZaurrLinkSummary -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'MultipleLinks' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'OneLink' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'LinksSummary' -UnlimitedProperties | Format-Table *
+
+$Report = Get-GPOZaurrLinkSummary #-UnlimitedProperties
+$Report | Format-Table *
+$Report.MultipleLinks | Format-Table *
+$Report.OneLink | Format-Table *
+$Report.LinksSummary | Format-Table *

Examples/Example-24-Links02.ps1

@@ -0,0 +1,12 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Report = Get-GPOZaurrLinkSummary -Report OneLink
+$Report | Format-Table
+$AffectedGPOs = foreach ($GPO in $Report) {
+    if ($GPO.Level1 -gt 1) {
+        $GPO
+    }
+}
+
+$AffectedGPOs | Format-Table *

Examples/Example-25-ListSysVolFiles.ps1

@@ -0,0 +1,6 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrFiles -Type All | Out-HtmlView -ScrollX -Filtering -AllProperties
+Get-GPOZaurrFiles -HashAlgorithm MD5 | Select-Object -First 2 | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOListFiles.xlsx -AllProperties -ExcelWorkSheetName 'Files Just 2' -AutoFilter -AutoFit #-OpenWorkBook
+Get-GPOZaurrFiles -Type All -HashAlgorithm SHA256 | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOListFiles.xlsx -AllProperties -ExcelWorkSheetName 'Files All' -AutoFilter -AutoFit #-OpenWorkBook

Examples/Example-26-Files.ps1

@@ -0,0 +1,10 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Output = Get-GPOZaurrSysvol | ForEach-Object {
+    $Path = $_.Path
+    Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File | ForEach-Object {
+        Get-FileMetaData -File $_ -Signature -HashAlgorithm 'SHA256'
+    }
+}
+$Output | Format-Table

Examples/Example-28-SaveGPO.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport -DeleteExisting
+Save-GPOZaurrFiles -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' #-DeleteExisting

Examples/Example-29-FindGPO-FromDisk-Notranslation.ps1

@@ -0,0 +1,34 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
+#$OutputNoTranslation = Invoke-GPOZaurr -GPOPath $Env:UserProfile\Desktop\GPOExport -NoTranslation
+#$OutputNoTranslation = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
+$OutputNoTranslation | Format-Table *
+
+<#
+New-HTML {
+    foreach ($GPOCategory in $OutputNoTranslation.Keys) {
+        New-HTMLTab -Name $GPOCategory {
+            if ($OutputNoTranslation["$GPOCategory"] -is [System.Collections.IDictionary]) {
+                foreach ($GpoSettings in $OutputNoTranslation["$GPOCategory"].Keys) {
+                    New-HTMLTab -Name $GpoSettings {
+                        New-HTMLTable -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+                    }
+                }
+            } else {
+                New-HTMLTable -DataTable $OutputNoTranslation[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+            }
+        }
+    }
+} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-NoTranslationFromDisk.html
+
+#>
+foreach ($GPOCategory in $OutputNoTranslation.Keys) {
+    if ($OutputNoTranslation["$GPOCategory"] -is [System.Collections.IDictionary]) {
+        foreach ($GpoSettings in $OutputNoTranslation["$GPOCategory"].Keys) {
+            ConvertTo-Excel -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -AllProperties -ExcelWorkSheetName $GpoSettings -FilePath $Env:UserProfile\Desktop\Export\$GpoSettings.xlsx -AutoFilter -AutoFit
+        }
+    } else {
+        ConvertTo-Excel -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -AllProperties -ExcelWorkSheetName $GpoSettings -FilePath $Env:UserProfile\Desktop\Export\$GpoSettings.xlsx -AutoFilter -AutoFit
+    }
+}

Examples/Example-29-FindGPO0.ps1

@@ -0,0 +1,36 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Invoke-GPOZaurr -OutputType Excel, Object, HTML -Open | Format-Table
+$Output = Invoke-GPOZaurr -GPOPath $Env:USERPROFILE\Desktop\GPOExport -NoTranslation #| Format-Table
+#$Output.Count
+
+
+
+<# 4073 files - 212MB / no translation
+
+Days              : 0
+Hours             : 0
+Minutes           : 0
+Seconds           : 51
+Milliseconds      : 756
+Ticks             : 517566534
+TotalDays         : 0,000599035340277778
+TotalHours        : 0,0143768481666667
+TotalMinutes      : 0,86261089
+TotalSeconds      : 51,7566534
+TotalMilliseconds : 51756,6534
+#>
+
+<# 4073 files - 212MB / no translation / But with 2 diff types ($OutputByCategory / $OutputByGPO)
+Days              : 0
+Hours             : 0
+Minutes           : 0
+Seconds           : 53
+Milliseconds      : 246
+Ticks             : 532466109
+TotalDays         : 0,00061628021875
+TotalHours        : 0,01479072525
+TotalMinutes      : 0,887443515
+TotalSeconds      : 53,2466109
+TotalMilliseconds : 53246,6109
+#>

Examples/Example-29-FindGPO1.ps1

@@ -0,0 +1,20 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Output = Invoke-GPOZaurr #-NoTranslation
+$Output | Format-Table
+
+New-HTML {
+    foreach ($GPOCategory in $Output.Keys) {
+        New-HTMLTab -Name $GPOCategory {
+            if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
+                foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
+                    New-HTMLTab -Name $GpoSettings {
+                        New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+                    }
+                }
+            } else {
+                New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+            }
+        }
+    }
+} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO.html

Examples/Example-29-FindGPO2-NoTranslation.ps1

@@ -0,0 +1,20 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Output = Invoke-GPOZaurr -NoTranslation
+$Output | Format-Table
+
+New-HTML {
+    foreach ($GPOCategory in $Output.Keys) {
+        New-HTMLTab -Name $GPOCategory {
+            if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
+                foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
+                    New-HTMLTab -Name $GpoSettings {
+                        New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+                    }
+                }
+            } else {
+                New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+            }
+        }
+    }
+} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-NoTranslation.html

Examples/Example-29-FindGPO3-FromDisk.ps1

@@ -0,0 +1,22 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
+
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' # -NoTranslation
+$Output | Format-Table *
+
+New-HTML {
+    foreach ($GPOCategory in $Output.Keys) {
+        New-HTMLTab -Name $GPOCategory {
+            if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
+                foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
+                    New-HTMLTab -Name $GpoSettings {
+                        New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+                    }
+                }
+            } else {
+                New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+            }
+        }
+    }
+} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-FromDisk.html

Examples/Example-29-FindGPOFromDiskWork.ps1

@@ -0,0 +1,25 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
+
+$OutputTranslation = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport'
+$OutputTranslation | Format-Table
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' -NoTranslation
+$Output | Format-Table *
+
+#$Output.LugsSettings.LocalUsersAndGroups | Format-List *
+
+$GPOEntry = $Output.LugsSettings.LocalUsersAndGroups[0]
+
+$CreateGPO = @{}
+foreach ($User in $GPOEntry.User) {
+    # $User | Format-Table
+    # $User.Properties | Format-Table
+}
+
+
+foreach ($Group in $GPOEntry.Group) {
+    #$Group | Format-Table
+    $Group.Properties | Format-Table
+    $Group.Properties.Members | Format-Table
+}

Examples/Example-29-FindGPOHtmlOutput.ps1

@@ -0,0 +1,6 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
+
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
+$Output | Format-Table *

Examples/Example-29-FindGPOTranslationHelp.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This is purely for building GPO Dictionary, mostly for development needs to help asses what is there
+
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
+#$Output | Format-Table *
+
+$LookingFor = $Output | Select-GPOTranslation -Category 'SecuritySettings' -Settings 'UserRightsAssignment'
+$LookingFor | Format-Table
+$LookingFor.Types | Format-Table
+#$LookingFor.Data | Format-Table

GPOZaurr.psd1

@@ -1,27 +1,27 @@
 @{
-    AliasesToExport      = ''
+    AliasesToExport      = 'Find-GPO'
     Author               = 'Przemyslaw Klys'
     CompanyName          = 'Evotec'
     CompatiblePSEditions = 'Desktop'
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
-    Description          = 'Group Policy Eater'
-    FunctionsToExport    = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOZaurrOwner', 'Set-GPOZaurrWMI'
+    Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows easy fixing for issues that you may expect finding in them.'
+    FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrFiles', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Select-GPOTranslation', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.12'
+    ModuleVersion        = '0.0.47'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
-            Tags                       = 'Windows', 'ActiveDirectory', 'GPO'
+            Tags                       = 'Windows', 'ActiveDirectory', 'GPO', 'GroupPolicy'
             ProjectUri                 = 'https://github.com/EvotecIT/GPOZaurr'
             ExternalModuleDependencies = 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
         }
     }
     RequiredModules      = @{
-        ModuleVersion = '0.0.134'
+        ModuleVersion = '0.0.155'
         ModuleName    = 'PSSharedGoods'
         Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
     }, @{
-        ModuleVersion = '0.0.47'
+        ModuleVersion = '0.0.58'
         ModuleName    = 'ADEssentials'
         Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
     }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'

Private/ConvertTo-AccountPolicies.ps1

@@ -0,0 +1,31 @@
+# TODO: #2 Identical to ConvertTo-EventLog - decide what to do later on
+
+function ConvertTo-AccountPolicies {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName  = $GPOEntry.DomainName    #: area1.local
+            GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType     = $GPOEntry.GpoType       #: Computer
+            GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
+            Type        = $GPOEntry.Type
+            Policy      = $GPOEntry.Name
+
+        }
+        if ($GPOEntry.SettingBoolean) {
+            $CreateGPO['Setting'] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { $null };
+            #try { [bool]::Parse($GPOEntry.SettingBoolean) } catch { $null };
+        } elseif ($GPOEntry.SettingNumber) {
+            $CreateGPO['Setting'] = $GPOEntry.SettingNumber
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-Audit.ps1

@@ -0,0 +1,35 @@
+function ConvertTo-Audit {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null };
+        $FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null };
+        if ($SuccessAttempts -and $FailureAttempts) {
+            $Setting = 'Success, Failure'
+        } elseif ($SuccessAttempts) {
+            $Setting = 'Success'
+        } elseif ($FailureAttempts) {
+            $Setting = 'Failure'
+        } else {
+            $Setting = 'No auditing'
+        }
+        $CreateGPO = [ordered]@{
+            DisplayName     = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName      = $GPOEntry.DomainName    #: area1.local
+            GUID            = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType         = $GPOEntry.GpoType       #: Computer
+            GpoCategory     = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings     = $GPOEntry.GpoSettings   #: SecurityOptions
+            Policy          = $GPOEntry.Name
+            Setting         = $Setting
+            SuccessAttempts = $SuccessAttempts
+            FailureAttempts = $FailureAttempts
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-AuditAlternative.ps1

@@ -0,0 +1,37 @@
+function ConvertTo-AuditAlternative {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null };
+        $FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null };
+        if ($SuccessAttempts -and $FailureAttempts) {
+            $Setting = 'Success, Failure'
+        } elseif ($SuccessAttempts) {
+            $Setting = 'Success'
+        } elseif ($FailureAttempts) {
+            $Setting = 'Failure'
+        } else {
+            $Setting = 'No auditing'
+        }
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName  = $GPOEntry.DomainName    #: area1.local
+            GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType     = $GPOEntry.GpoType       #: Computer
+            GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
+            Policy      = $GPOEntry.Name
+            Setting     = $Setting
+            #SuccessAttempts = $SuccessAttempts
+            #FailureAttempts = $FailureAttempts
+        }
+
+
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-EventLog.ps1

@@ -0,0 +1,29 @@
+function ConvertTo-EventLog {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName  = $GPOEntry.DomainName    #: area1.local
+            GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType     = $GPOEntry.GpoType       #: Computer
+            GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
+            Type        = $GPOEntry.Type
+            Policy      = $GPOEntry.Name
+
+        }
+        if ($GPOEntry.SettingBoolean) {
+            $CreateGPO['Setting'] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { $null };
+            #try { [bool]::Parse($GPOEntry.SettingBoolean) } catch { $null };
+        } elseif ($GPOEntry.SettingNumber) {
+            $CreateGPO['Setting'] = $GPOEntry.SettingNumber
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-LocalUserAndGroups.ps1

@@ -0,0 +1,89 @@
+function ConvertTo-LocalUserAndGroups {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        foreach ($User in $GPOEntry.User) {
+            $CreateGPO = [ordered]@{
+                DisplayName      = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+                DomainName       = $GPOEntry.DomainName    #: area1.local
+                GUID             = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+                GpoType          = $GPOEntry.GpoType       #: Computer
+                GpoCategory      = $GPOEntry.GpoCategory   #: SecuritySettings
+                GpoSettings      = $GPOEntry.GpoSettings   #: SecurityOptions
+                Changed          = [DateTime] $User.Changed
+                GPOSettingOrder  = $User.GPOSettingOrder
+                UserAction       = $Script:Actions["$($User.Properties.action)"]       #: U
+                UserNewName      = $User.Properties.newName      #:
+                UserFullName     = $User.Properties.fullName     #:
+                UserDescription  = $User.Properties.description  #:
+                UserCpassword    = $User.Properties.cpassword    #:
+                UserChangeLogon  = $User.Properties.changeLogon  #: 0
+                UserNoChange     = $User.Properties.noChange     #: 0
+                UserNeverExpires = $User.Properties.neverExpires #: 0
+                UserAcctDisabled = $User.Properties.acctDisabled #: 0
+                UserAubAuthority = $User.Properties.subAuthority #: RID_ADMIN
+                UserUserName     = $User.Properties.userName     #: Administrator (built-in)
+                UserMembers      = $User.Properties.Members      #:
+            }
+            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+            [PSCustomObject] $CreateGPO
+        }
+        foreach ($Group in $GPOEntry.Group) {
+            # We're mostly interested in Members
+            [Array] $Members = foreach ($Member in $Group.Properties.Members.Member) {
+                [ordered] @{
+                    MemberName   = $Member.Name
+                    MemberAction = $Member.Action
+                    MemberSID    = $Member.SID
+                }
+            }
+            # if we have no members we create dummy object to make sure we can use foreach below
+            if ($Members.Count -eq 0) {
+                $Members = @(
+                    [ordered] @{
+                        MemberName   = $null
+                        MemberAction = $null
+                        MemberSID    = $null
+                    }
+                )
+            }
+            foreach ($Member in $Members) {
+                $CreateGPO = [ordered]@{
+                    DisplayName          = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+                    DomainName           = $GPOEntry.DomainName    #: area1.local
+                    GUID                 = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+                    GpoType              = $GPOEntry.GpoType       #: Computer
+                    GpoCategory          = $GPOEntry.GpoCategory   #: SecuritySettings
+                    GpoSettings          = $GPOEntry.GpoSettings   #: SecurityOptions
+                    Changed              = [DateTime] $Group.Changed
+                    GPOSettingOrder      = $Group.GPOSettingOrder
+                    GroupUid             = $Group.uid             #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
+                    GroupUserContext     = $Group.userContext     #: 0: 0
+                    GroupRemovePolicy    = $Group.removePolicy    #: 1: 1
+                    #Properties      = $Group.Properties      #: Properties: Properties
+                    Filters              = $Group.Filters         #::
+
+                    GroupAction          = $Script:Actions["$($Group.Properties.action)"]          #: U
+                    GroupNewName         = $Group.Properties.newName         #:
+                    GroupDescription     = $Group.Properties.description     #:
+                    GroupDeleteAllUsers  = $Group.Properties.deleteAllUsers  #: 0
+                    GroupDeleteAllGroups = $Group.Properties.deleteAllGroups #: 0
+                    GroupRemoveAccounts  = $Group.Properties.removeAccounts  #: 1
+                    GroupSid             = $Group.Properties.groupSid        #: S - 1 - 5 - 32 - 544
+                    GroupName            = $Group.Properties.groupName       #: Administrators (built -in )
+                }
+                # Merging GPO with Member
+                $CreateGPO = $CreateGPO + $Member
+
+                $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+                $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+                $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+                [PSCustomObject] $CreateGPO
+            }
+        }
+    }
+}

Private/ConvertTo-Policies.ps1

@@ -0,0 +1,30 @@
+function ConvertTo-Policies {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName        = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName         = $GPOEntry.DomainName    #: area1.local
+            GUID               = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType            = $GPOEntry.GpoType       #: Computer
+            GpoCategory        = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings        = $GPOEntry.GpoSettings   #: SecurityOptions
+            PolicyName         = $GPOEntry.Name
+            PolicyState        = $GPOEntry.State
+            PolicyCategory     = $GPOEntry.Category
+            PolicySupported    = $GPOEntry.Supported
+            PolicyExplain      = $GPOEntry.Explain
+            PolicyText         = $GPOEntry.Text
+            PolicyCheckBox     = $GPOEntry.CheckBox
+            PolicyDropDownList = $GPOEntry.DropDownList
+            PolicyEditText     = $GPOEntry.EditText
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+
+    }
+}

Private/ConvertTo-RegistryAutologon.ps1

@@ -0,0 +1,49 @@
+function ConvertTo-RegistryAutologon {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+
+        $CreateGPO = [ordered]@{
+            DisplayName       = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName        = $GPOEntry.DomainName    #: area1.local
+            GUID              = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType           = $GPOEntry.GpoType       #: Computer
+            GpoCategory       = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings       = $GPOEntry.GpoSettings   #: SecurityOptions
+            AutoAdminLogon    = $null
+            DefaultDomainName = $null
+            DefaultUserName   = $null
+            DefaultPassword   = $null
+        }
+
+        foreach ($Registry in $GPOEntry.Registry) {
+            if ($Registry.Properties.Key -eq 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon') {
+                if ($Registry.Properties.Name -eq 'AutoAdminLogon') {
+                    $CreateGPO['AutoAdminLogon'] = [bool] $Registry.Properties.value
+                    $CreateGPO['DateChangedAutoAdminLogon'] = [DateTime] $Registry.changed
+                } elseif ($Registry.Properties.Name -eq 'DefaultDomainName') {
+                    $CreateGPO['DefaultDomainName'] = $Registry.Properties.value
+                    $CreateGPO['DateChangedDefaultDomainName'] = [DateTime] $Registry.changed
+                } elseif ($Registry.Properties.Name -eq 'DefaultUserName') {
+                    $CreateGPO['DefaultUserName'] = $Registry.Properties.value
+                    $CreateGPO['DateChangedDefaultUserName'] = [DateTime] $Registry.changed
+                } elseif ($Registry.Properties.Name -eq 'DefaultPassword') {
+                    $CreateGPO['DefaultPassword'] = $Registry.Properties.value
+                    $CreateGPO['DateChangedDefaultPassword'] = [DateTime] $Registry.changed
+                }
+            }
+        }
+        if ($null -ne $CreateGPO['AutoAdminLogon'] -or
+            $null -ne $CreateGPO['DefaultDomainName'] -or
+            $null -ne $CreateGPO['DefaultUserName'] -or
+            $null -ne $CreateGPO['DefaultPassword']
+        ) {
+            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-RegistrySettings.ps1

@@ -0,0 +1,30 @@
+function ConvertTo-RegistrySettings {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        foreach ($Registry in $GPOEntry.Registry) {
+            $CreateGPO = [ordered]@{
+                DisplayName     = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+                DomainName      = $GPOEntry.DomainName    #: area1.local
+                GUID            = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+                GpoType         = $GPOEntry.GpoType       #: Computer
+                GpoCategory     = $GPOEntry.GpoCategory   #: SecuritySettings
+                GpoSettings     = $GPOEntry.GpoSettings   #: SecurityOptions
+                Changed         = [DateTime] $Registry.changed
+                GPOSettingOrder = $Registry.GPOSettingOrder
+                Hive            = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
+                Key             = $Registry.Properties.key  #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+                Name            = $Registry.Properties.name #: AutoAdminLogon
+                Type            = $Registry.Properties.type #: REG_SZ
+                Value           = $Registry.Properties.value #
+                Filters         = $Registry.Filters
+            }
+            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-RegistrySettingsCollection.ps1

@@ -0,0 +1,46 @@
+function ConvertTo-RegistrySettingsCollection {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        foreach ($Collection in $GPOEntry.Collection) {
+            $OutputDictionaries = foreach ($Registry in $Collection.Registry) {
+                [ordered] @{
+                    #"$($Registry.Name)FieldName"       = $Registry.Name
+                    #"$($Registry.Name)FieldStatus"     = $Registry.Status
+                    "$($Registry.Name)BypassErrors"    = try { [bool]::Parse($Registry.BypassErrors) } catch { $null };
+                    "$($Registry.Name)Changed"         = [DateTime] $Registry.Changed
+                    "$($Registry.Name)UID"             = $Registry.UID
+                    "$($Registry.Name)GPOSettingOrder" = $Registry.GPOSettingOrder
+                    "$($Registry.Name)Action"          = $Registry.Properties.action
+                    "$($Registry.Name)DisplayDecimal"  = $Registry.Properties.displayDecimal
+                    "$($Registry.Name)Default"         = $Registry.Properties.default
+                    "$($Registry.Name)Hive"            = $Registry.Properties.hive
+                    "$($Registry.Name)Name"            = $Registry.Properties.name
+                    "$($Registry.Name)Type"            = $Registry.Properties.type
+                    "$($Registry.Name)Value"           = $Registry.Properties.value
+                    "$($Registry.Name)Values"          = $Registry.Properties.Values
+                }
+            }
+            $CreateGPO = [ordered]@{
+                DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+                DomainName  = $GPOEntry.DomainName    #: area1.local
+                GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+                GpoType     = $GPOEntry.GpoType       #: Computer
+                GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
+                GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
+            }
+            foreach ($Dictionary in $OutputDictionaries) {
+                $CreateGPO = $CreateGPO + $Dictionary
+            }
+            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}
+
+
+

Private/ConvertTo-Scripts.ps1

@@ -0,0 +1,26 @@
+function ConvertTo-Scripts {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName  = $GPOEntry.DomainName    #: area1.local
+            GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType     = $GPOEntry.GpoType       #: Computer
+            GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
+            Command     = $GPOEntry.Command
+            Parameters  = $GPOEntry.Parameters
+            Type        = $GPOEntry.Type
+            Order       = $GPOEntry.Order
+            RunOrder    = $GPOEntry.RunOrder
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+
+    }
+}

Private/ConvertTo-SecurityOptions.ps1

@@ -0,0 +1,28 @@
+function ConvertTo-SecurityOptions {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName            = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName             = $GPOEntry.DomainName    #: area1.local
+            GUID                   = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType                = $GPOEntry.GpoType       #: Computer
+            GpoCategory            = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings            = $GPOEntry.GpoSettings   #: SecurityOptions
+            KeyName                = $GPOEntry.KeyName
+            KeyDisplayName         = $GPOEntry.Display.Name
+            KeyDisplayUnits        = $GPOEntry.Display.Units
+            KeyDisplayBoolean      = try { [bool]::Parse($GPOEntry.Display.DisplayBoolean) } catch { $null };
+            KeyDisplayString       = $GPOEntry.Display.DisplayString
+            SystemAccessPolicyName = $GPOEntry.SystemAccessPolicyName
+            SettingString          = $GPOEntry.SettingString
+            SettingNumber          = $GPOEntry.SettingNumber
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-SoftwareInstallation.ps1

@@ -0,0 +1,42 @@
+function ConvertTo-SoftwareInstallation {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName         = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName          = $GPOEntry.DomainName    #: area1.local
+            GUID                = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType             = $GPOEntry.GpoType       #: Computer
+            GpoCategory         = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings         = $GPOEntry.GpoSettings   #: SecurityOptions
+            Identifier          = $GPOEntry.Identifier          #: { 10495e9e-79c1-4a32-b278-a24cd495437f }
+            Name                = $GPOEntry.Name                #: Local Administrator Password Solution (2)
+            Path                = $GPOEntry.Path                #: \\area1.local\SYSVOL\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\LAPS.x64.msi
+            MajorVersion        = $GPOEntry.MajorVersion        #: 6
+            MinorVersion        = $GPOEntry.MinorVersion        #: 2
+            LanguageId          = $GPOEntry.LanguageId          #: 1033
+            Architecture        = $GPOEntry.Architecture        #: 9
+            IgnoreLanguage      = if ($GPOEntry.IgnoreLanguage -eq 'true') { $true } else { $false }      #: false
+            Allowx86Onia64      = if ($GPOEntry.Allowx86Onia64 -eq 'true') { $true } else { $false }       #: true
+            SupportURL          = $GPOEntry.SupportURL          #:
+            AutoInstall         = if ($GPOEntry.AutoInstall -eq 'true') { $true } else { $false }          #: true
+            DisplayInARP        = if ($GPOEntry.DisplayInARP -eq 'true') { $true } else { $false }        #: true
+            IncludeCOM          = if ($GPOEntry.IncludeCOM -eq 'true') { $true } else { $false }          #: true
+            SecurityDescriptor  = $GPOEntry.SecurityDescriptor  #: SecurityDescriptor
+            DeploymentType      = $GPOEntry.DeploymentType      #: Assign
+            ProductId           = $GPOEntry.ProductId           #: { ea8cb806-c109 - 4700 - 96b4-f1f268e5036c }
+            ScriptPath          = $GPOEntry.ScriptPath          #: \\area1.local\SysVol\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\Machine\Applications\ { EAC9B821-FB4D - 457A-806F-E5B528D1E41A }.aas
+            DeploymentCount     = $GPOEntry.DeploymentCount     #: 0
+            InstallationUILevel = $GPOEntry.InstallationUILevel #: Maximum
+            Upgrades            = if ($GPOEntry.Upgrades.Mandatory -eq 'true') { $true } else { $false }            #: Upgrades
+            UninstallUnmanaged  = if ($GPOEntry.UninstallUnmanaged -eq 'true') { $true } else { $false }   #: false
+            LossOfScopeAction   = $GPOEntry.LossOfScopeAction   #: Unmanage
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-SystemServices.ps1

@@ -0,0 +1,25 @@
+function ConvertTo-SystemServices {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName                = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName                 = $GPOEntry.DomainName    #: area1.local
+            GUID                       = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType                    = $GPOEntry.GpoType       #: Computer
+            GpoCategory                = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings                = $GPOEntry.GpoSettings   #: SecurityOptions
+            ServiceName                = $GPOEntry.Name
+            ServiceStartUpMode         = $GPOEntry.StartUpMode
+            SecurityAuditingPresent    = try { [bool]::Parse($GPOEntry.SecurityDescriptor.AuditingPresent.'#text') } catch { $null };
+            SecurityPermissionsPresent = try { [bool]::Parse($GPOEntry.SecurityDescriptor.PermissionsPresent.'#text') } catch { $null };
+            SecurityDescriptor         = $GPOEntry.SecurityDescriptor
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-SystemServicesNT.ps1

@@ -0,0 +1,36 @@
+function ConvertTo-SystemServicesNT {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        foreach ($Service in $GPOEntry.NTService) {
+            $CreateGPO = [ordered]@{
+                DisplayName          = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+                DomainName           = $GPOEntry.DomainName    #: area1.local
+                GUID                 = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+                GpoType              = $GPOEntry.GpoType       #: Computer
+                GpoCategory          = $GPOEntry.GpoCategory   #: SecuritySettings
+                GpoSettings          = $GPOEntry.GpoSettings   #: SecurityOptions
+                Changed              = [DateTime] $Service.Changed
+                GPOSettingOrder      = $Service.GPOSettingOrder
+                #ServiceName          = $Service.Name
+                ServiceName          = $Service.Properties.serviceName          #: AppIDSvc: AppIDSvc
+                ServiceStartupType   = $Service.Properties.startupType          #: NOCHANGE: NOCHANGE
+                ServiceAction        = $Service.Properties.serviceAction        #: START: START
+                Timeout              = $Service.Properties.timeout              #: 50: 50
+                FirstFailure         = $Service.Properties.firstFailure         #: REBOOT: REBOOT
+                SecondFailure        = $Service.Properties.secondFailure        #: REBOOT: REBOOT
+                ThirdFailure         = $Service.Properties.thirdFailure         #: REBOOT: REBOOT
+                ResetFailCountDelay  = $Service.Properties.resetFailCountDelay  #: 0: 0
+                RestartComputerDelay = $Service.Properties.restartComputerDelay #: 60000: 60000
+                Filter               = $Service.Filter
+
+            }
+            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/Find-MissingProperties.ps1

@@ -0,0 +1,15 @@
+function Find-MissingProperties {
+    [cmdletBinding()]
+    param(
+        [Array] $Objects,
+        [string[]] $PossibleProperties
+    )
+    $AllProperties = Select-Properties -AllProperties -Objects $Objects
+    $MissingProperties = $AllProperties | Where-Object { $_ -notin 'DisplayName', 'DomainName', 'GUID', 'Linked', 'LinksCount', 'Links', 'GPOType', 'GPOCategory', 'GPOSettings' }
+    [Array] $ConsiderAdding = foreach ($Property in $MissingProperties) {
+        if ($Property -notin $PossibleProperties) {
+            $Property
+        }
+    }
+    $ConsiderAdding
+}

Private/Get-ADAdministrativeGroups.ps1

@@ -1,74 +0,0 @@
-
-function Get-ADADministrativeGroups {
-    <#
-    .SYNOPSIS
-    Short description
-
-    .DESCRIPTION
-    Long description
-
-    .PARAMETER Type
-    Parameter description
-
-    .PARAMETER Forest
-    Parameter description
-
-    .PARAMETER ExcludeDomains
-    Parameter description
-
-    .PARAMETER IncludeDomains
-    Parameter description
-
-    .PARAMETER ExtendedForestInformation
-    Parameter description
-
-    .EXAMPLE
-    Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins
-
-    Output (Where VALUE is Get-ADGroup output):
-    Name                           Value
-    ----                           -----
-    ByNetBIOS                      {EVOTEC\Domain Admins, EVOTEC\Enterprise Admins, EVOTECPL\Domain Admins}
-    ad.evotec.xyz                  {DomainAdmins, EnterpriseAdmins}
-    ad.evotec.pl                   {DomainAdmins}
-
-    .NOTES
-    General notes
-    #>
-    [cmdletBinding()]
-    param(
-        [parameter(Mandatory)][validateSet('DomainAdmins', 'EnterpriseAdmins')][string[]] $Type,
-        [alias('ForestName')][string] $Forest,
-        [string[]] $ExcludeDomains,
-        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
-        [System.Collections.IDictionary] $ExtendedForestInformation
-    )
-    $ADDictionary = [ordered] @{ }
-    $ADDictionary['ByNetBIOS'] = [ordered] @{ }
-    $ADDictionary['BySID'] = [ordered] @{ }
-
-    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-    foreach ($Domain in $ForestInformation.Domains) {
-        $ADDictionary[$Domain] = [ordered] @{ }
-        $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
-        $DomainInformation = Get-ADDomain -Server $QueryServer
-
-        if ($Type -contains 'DomainAdmins') {
-            Get-ADGroup -Filter "SID -eq '$($DomainInformation.DomainSID)-512'" -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
-                $ADDictionary['ByNetBIOS']["$($DomainInformation.NetBIOSName)\$($_.Name)"] = $_
-                $ADDictionary[$Domain]['DomainAdmins'] = "$($DomainInformation.NetBIOSName)\$($_.Name)"
-                $ADDictionary['BySID'][$_.SID.Value] = $_
-            }
-        }
-        if ($Type -contains 'EnterpriseAdmins') {
-            Get-ADGroup -Filter "SID -eq '$($DomainInformation.DomainSID)-519'" -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
-                $ADDictionary['ByNetBIOS']["$($DomainInformation.NetBIOSName)\$($_.Name)"] = $_
-                $ADDictionary[$Domain]['EnterpriseAdmins'] = "$($DomainInformation.NetBIOSName)\$($_.Name)"
-                $ADDictionary['BySID'][$_.SID.Value] = $_ #"$($DomainInformation.NetBIOSName)\$($_.Name)"
-            }
-        }
-    }
-    return $ADDictionary
-}
-
-#Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins

Private/Get-LinksFromXML.ps1

@@ -0,0 +1,38 @@
+function Get-LinksFromXML {
+    [cmdletBinding()]
+    param(
+        [System.Xml.XmlElement[]] $GPOOutput,
+        [string] $Splitter,
+        [switch] $FullObjects
+    )
+    $Links = [ordered] @{
+        Linked     = $null
+        LinksCount = $null
+        Links      = $null
+    }
+    if ($GPOOutput.LinksTo) {
+        $Links.Linked = $true
+        $Links.LinksCount = ([Array] $GPOOutput.LinksTo).Count
+        $Links.Links = foreach ($Link in $GPOOutput.LinksTo) {
+            if ($FullObjects) {
+                [PSCustomObject] @{
+                    Path       = $Link.SOMPath
+                    Enabled    = if ($Link.Enabled -eq 'true') { $true } else { $false }
+                    NoOverride = if ($Link.NoOverride -eq 'true') { $true } else { $false }
+                }
+            } else {
+                if ($Link.Enabled) {
+                    $Link.SOMPath
+                }
+            }
+        }
+        if ($Splitter) {
+            $Links.Links = $Links.Links -join $Splitter
+        }
+    } else {
+        $Links.Linked = $false
+        $Links.LinksCount = 0
+        $Links.Links = $null
+    }
+    [PSCustomObject] $Links
+}

Private/Get-PrivGPOZaurrLInk.ps1

@@ -0,0 +1,75 @@
+function Get-PrivGPOZaurrLink {
+    [cmdletBinding()]
+    param(
+        [Microsoft.ActiveDirectory.Management.ADObject] $Object,
+        [switch] $Limited,
+        [System.Collections.IDictionary] $GPOCache
+    )
+    if ($Object.GpLink -and $Object.GpLink.Trim() -ne '') {
+        #$Object.GpLink -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://'
+        $Object.GpLink -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            #Write-Verbose $_
+            if ($_.Length -gt 10) {
+                $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
+                $Output = [ordered] @{
+                    DistinguishedName = $Object.DistinguishedName
+                    CanonicalName     = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
+                    Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
+                }
+                $Search = -join ($DomainCN, $Output['Guid'])
+                if ($GPOCache -and -not $Limited) {
+                    if ($GPOCache[$Search]) {
+                        $Output['DisplayName'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
+                }
+            }
+        }
+    } elseif ($Object.LinkedGroupPolicyObjects -and $Object.LinkedGroupPolicyObjects.Trim() -ne '') {
+        $Object.LinkedGroupPolicyObjects -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            if ($_.Length -gt 10) {
+                $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
+                $Output = [ordered] @{
+                    DistinguishedName = $Object.DistinguishedName
+                    CanonicalName     = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
+                    Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
+                }
+                $Search = -join ($DomainCN, $Output['Guid'])
+                if ($GPOCache -and -not $Limited) {
+                    if ($GPOCache[$Search]) {
+                        $Output['Name'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
+                }
+            }
+        }
+    }
+}

Private/Get-PrivPermission.ps1

@@ -2,111 +2,259 @@
     [cmdletBinding()]
     param(
         [Microsoft.GroupPolicy.Gpo] $GPO,
+        [Object] $SecurityRights,
+
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
         [switch] $SkipWellKnown,
         [switch] $SkipAdministrative,
         [switch] $IncludeOwner,
         [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
         [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid',
+
         [switch] $IncludeGPOObject,
         [System.Collections.IDictionary] $ADAdministrativeGroups,
-        [string[]] $Type
+        [validateSet('AuthenticatedUsers', 'DomainComputers', 'Unknown', 'WellKnownAdministrative', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All',
+        [System.Collections.IDictionary] $Accounts,
+        [System.Collections.IDictionary] $ExtendedForestInformation
     )
-
-    # $GPO = $_
-    Write-Verbose "Get-GPOZaurrPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
-    $SecurityRights = $GPO.GetSecurityInfo()
-    $SecurityRights | ForEach-Object -Process {
-        #Get-GPPermissions -Guid $GPO.ID -DomainName $GPO.DomainName -All -Server $QueryServer | ForEach-Object -Process {
-        $GPOPermission = $_
-        if ($ExcludePermissionType -contains $GPOPermission.Permission) {
-            return
-        }
-        if ($IncludePermissionType) {
-            if ($IncludePermissionType -notcontains $GPOPermission.Permission) {
-                return
-            }
-        }
-        if ($SkipWellKnown.IsPresent) {
-            if ($GPOPermission.Trustee.SidType -eq 'WellKnownGroup') {
-                return
-            }
-        }
-        if ($SkipAdministrative.IsPresent) {
-            $IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
-            if ($IsAdministrative) {
-                return
-            }
-        }
-        if ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
-            # May need updates if there's more types
-            if ($GPOPermission.Trustee.SidType -ne 'Unknown') {
-                return
-            }
-        }
-
-        $ReturnObject = [ordered] @{
-            DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
-            GUID              = $GPO.ID
-            DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
-            Enabled           = $GPO.GpoStatus
-            Description       = $GPO.Description
-            CreationDate      = $GPO.CreationTime
-            ModificationTime  = $GPO.ModificationTime
-            Permission        = $GPOPermission.Permission  # : GpoEditDeleteModifySecurity
-            Inherited         = $GPOPermission.Inherited   # : False
-            Domain            = $GPOPermission.Trustee.Domain  #: EVOTEC
-            DistinguishedName = $GPOPermission.Trustee.DSPath  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
-            Name              = $GPOPermission.Trustee.Name    #: Domain Admins
-            Sid               = $GPOPermission.Trustee.Sid.Value     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
-            SidType           = $GPOPermission.Trustee.SidType #: Group
-
-        }
-        if ($IncludeGPOObject) {
-            $ReturnObject.GPOObject = $GPO
-            $ReturnObject.GPOSecurity = $SecurityRights
-        }
-        [PSCustomObject] $ReturnObject
+    Begin {
+        Write-Verbose "Get-PrivPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
     }
-    if ($IncludeOwner.IsPresent) {
-        if ($GPO.Owner) {
-            $SplittedOwner = $GPO.Owner.Split('\')
-            $DomainOwner = $SplittedOwner[0]  #: EVOTEC
-            $DomainUserName = $SplittedOwner[1]   #: Domain Admins
-            $SID = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].Sid.Value
-            if ($SID) {
-                $SIDType = 'Group'
-                $DistinguishedName = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].DistinguishedName
+    Process {
+        $SecurityRights | ForEach-Object -Process {
+            $GPOPermission = $_
+            if ($PermitType -ne 'All') {
+                if ($PermitType -eq 'Deny') {
+                    if ($GPOPermission.Denied -eq $false) {
+                        return
+                    }
+                } else {
+                    if ($GPOPermission.Denied -eq $true) {
+                        return
+                    }
+                }
+            }
+            if ($ExcludePermissionType -contains $GPOPermission.Permission) {
+                return
+            }
+            if ($IncludePermissionType) {
+                if ($IncludePermissionType -notcontains $GPOPermission.Permission) {
+                    if ($IncludePermissionType -eq 'GpoRead' -and $GPOPermission.Permission -eq 'GpoApply') {
+                        # We treat GpoApply as GpoRead as well. This is because when GpoApply is set it becomes GpoRead as well but of course not vice versa
+                    } else {
+                        return
+                    }
+                }
+            }
+            if ($SkipWellKnown.IsPresent -or $Type -contains 'NotWellKnown') {
+                if ($GPOPermission.Trustee.SidType -eq 'WellKnownGroup') {
+                    return
+                }
+            }
+            if ($SkipAdministrative.IsPresent -or $Type -contains 'NotAdministrative') {
+                $IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
+                if ($IsAdministrative) {
+                    return
+                }
+            }
+            if ($Type -contains 'Administrative' -and $Type -notcontains 'All') {
+                $IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
+                if (-not $IsAdministrative) {
+                    return
+                }
+            }
+            if ($Type -contains 'NotWellKnownAdministrative' -and $Type -notcontains 'All') {
+                # We check for SYSTEM account
+                # Maybe we should make it a function and provide more
+                if ($GPOPermission.Trustee.Sid -eq 'S-1-5-18') {
+                    return
+                }
+            }
+            if ($Type -contains 'WellKnownAdministrative' -and $Type -notcontains 'All') {
+                # We check for SYSTEM account
+                # Maybe we should make it a function and provide more
+                if ($GPOPermission.Trustee.Sid -ne 'S-1-5-18') {
+                    return
+                }
+            }
+            if ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
+                # May need updates if there's more types
+                if ($GPOPermission.Trustee.SidType -ne 'Unknown') {
+                    return
+                }
+            }
+            if ($Type -contains 'AuthenticatedUsers' -and $Type -notcontains 'All') {
+                if ($GPOPermission.Trustee.Sid -ne 'S-1-5-11') {
+                    return
+                }
+            }
+            if ($Type -contains 'DomainComputers' -and $Type -notcontains 'All') {
+                $DomainComputersSID = -join ($ExtendedForestInformation['DomainsExtended'][$GPO.DomainName].DomainSID, '-515')
+                if ($GPOPermission.Trustee.Sid -ne $DomainComputersSID) {
+                    return
+                }
+            }
+            if ($Principal) {
+                if ($PrincipalType -eq 'Sid') {
+                    if ($Principal -notcontains $GPOPermission.Trustee.Sid.Value) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'DistinguishedName') {
+                    if ($Principal -notcontains $GPOPermission.Trustee.DSPath) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'Name') {
+                    $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                    if ($Principal -notcontains $UserMerge -and $Principal -notcontains $GPOPermission.Trustee.Name) {
+                        return
+                    }
+                }
+            }
+            if ($ExcludePrincipal) {
+                if ($ExcludePrincipalType -eq 'Sid') {
+                    if ($ExcludePrincipal -contains $GPOPermission.Trustee.Sid.Value) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'DistinguishedName') {
+                    if ($ExcludePrincipal -contains $GPOPermission.Trustee.DSPath) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'Name') {
+                    $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                    if ($ExcludePrincipal -contains $UserMerge -or $ExcludePrincipal -contains $GPOPermission.Trustee.Name) {
+                        return
+                    }
+                }
+            }
+            $ReturnObject = [ordered] @{
+                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
+                GUID              = $GPO.ID
+                DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
+                Enabled           = $GPO.GpoStatus
+                Description       = $GPO.Description
+                CreationDate      = $GPO.CreationTime
+                ModificationTime  = $GPO.ModificationTime
+                PermissionType    = if ($GPOPermission.Denied -eq $true) { 'Deny' } else { 'Allow' }
+                Permission        = $GPOPermission.Permission  # : GpoEditDeleteModifySecurity
+                Inherited         = $GPOPermission.Inherited   # : False
+                Domain            = $GPOPermission.Trustee.Domain  #: EVOTEC
+                DistinguishedName = $GPOPermission.Trustee.DSPath  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+                Name              = $GPOPermission.Trustee.Name    #: Domain Admins
+                Sid               = $GPOPermission.Trustee.Sid.Value     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+                SidType           = $GPOPermission.Trustee.SidType #: Group
+            }
+            if ($Accounts) {
+                $A = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                if ($A -and $Accounts[$A]) {
+                    $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
+                    $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
+                    $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
+                    $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
+                    $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
+                    if (-not $ReturnObject['Sid']) {
+                        $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
+                    }
+                    if ($Accounts[$A].ObjectClass -eq 'group') {
+                        $ReturnObject['SidType'] = 'Group'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'user') {
+                        $ReturnObject['SidType'] = 'User'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
+                        $ReturnObject['SidType'] = 'Computer'
+                    } else {
+                        $ReturnObject['SidType'] = 'EmptyOrUnknown'
+                    }
+                } else {
+                    $ReturnObject['UserPrincipalName'] = ''
+                    $ReturnObject['AccountEnabled'] = ''
+                    $ReturnObject['PasswordLastSet'] = ''
+                    $ReturnObject['LastLogonDate'] = ''
+                }
+            }
+            if ($IncludeGPOObject) {
+                $ReturnObject['GPOObject'] = $GPO
+                $ReturnObject['GPOSecurity'] = $SecurityRights
+                $ReturnObject['GPOSecurityPermissionItem'] = $GPOPermission
+            }
+            [PSCustomObject] $ReturnObject
+        }
+        if ($IncludeOwner.IsPresent) {
+            if ($GPO.Owner) {
+                $SplittedOwner = $GPO.Owner.Split('\')
+                $DomainOwner = $SplittedOwner[0]  #: EVOTEC
+                $DomainUserName = $SplittedOwner[1]   #: Domain Admins
+                $SID = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].Sid.Value
+                if ($SID) {
+                    $SIDType = 'Group'
+                    $DistinguishedName = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].DistinguishedName
+                } else {
+                    $SIDType = ''
+                    $DistinguishedName = ''
+                }
             } else {
-                $SIDType = ''
+                $DomainOwner = $GPO.Owner
+                $DomainUserName = ''
+                $SID = ''
+                $SIDType = 'EmptyOrUnknown'
                 $DistinguishedName = ''
             }
-        } else {
-            $DomainOwner = $GPO.Owner
-            $DomainUserName = ''
-            $SID = ''
-            $SIDType = ''
-            $DistinguishedName = ''
+            $ReturnObject = [ordered] @{
+                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
+                GUID              = $GPO.Id
+                DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
+                Enabled           = $GPO.GpoStatus
+                Description       = $GPO.Description
+                CreationDate      = $GPO.CreationTime
+                ModificationTime  = $GPO.ModificationTime
+                Permission        = 'GpoOwner'  # : GpoEditDeleteModifySecurity
+                Inherited         = $false  # : False
+                Domain            = $DomainOwner
+                DistinguishedName = $DistinguishedName  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+                Name              = $DomainUserName
+                Sid               = $SID     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+                SidType           = $SIDType #  #: Group
+            }
+            if ($Accounts) {
+                $A = $GPO.Owner
+                if ($A -and $Accounts[$A]) {
+                    $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
+                    $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
+                    $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
+                    $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
+                    $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
+                    if (-not $ReturnObject['Sid']) {
+                        $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
+                    }
+                    if ($Accounts[$A].ObjectClass -eq 'group') {
+                        $ReturnObject['SidType'] = 'Group'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'user') {
+                        $ReturnObject['SidType'] = 'User'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
+                        $ReturnObject['SidType'] = 'Computer'
+                    } else {
+                        $ReturnObject['SidType'] = 'EmptyOrUnknown'
+                    }
+                } else {
+                    $ReturnObject['UserPrincipalName'] = ''
+                    $ReturnObject['AccountEnabled'] = ''
+                    $ReturnObject['PasswordLastSet'] = ''
+                    $ReturnObject['LastLogonDate'] = ''
+                }
+            }
+            if ($IncludeGPOObject) {
+                $ReturnObject['GPOObject'] = $GPO
+                $ReturnObject['GPOSecurity'] = $SecurityRights
+                $ReturnObject['GPOSecurityPermissionItem'] = $null
+            }
+            [PSCustomObject] $ReturnObject
         }
-        $ReturnObject = [ordered] @{
-            DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
-            GUID              = $GPO.GUID
-            DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
-            Enabled           = $GPO.GpoStatus
-            Description       = $GPO.Description
-            CreationDate      = $GPO.CreationTime
-            ModificationTime  = $GPO.ModificationTime
-            Permission        = 'GpoOwner'  # : GpoEditDeleteModifySecurity
-            Inherited         = $false  # : False
-            Domain            = $DomainOwner
-            DistinguishedName = $DistinguishedName  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
-            Name              = $DomainUserName
-            Sid               = $SID     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
-            SidType           = $SIDType #  #: Group
-        }
-        if ($IncludeGPOObject) {
-            $ReturnObject.GPOObject = $GPO
-            $ReturnObject.GPOSecurity = $SecurityRights
-        }
-        [PSCustomObject] $ReturnObject
+    }
+    End {
+
     }
 }

Private/Get-XMLGPO.ps1

@@ -3,7 +3,9 @@
     param(
         [XML] $XMLContent,
         [Microsoft.GroupPolicy.Gpo] $GPO,
-        [switch] $PermissionsOnly
+        [switch] $PermissionsOnly,
+        [switch] $OwnerOnly,
+        [System.Collections.IDictionary] $ADAdministrativeGroups
     )
     if ($XMLContent.GPO.LinksTo) {
         $Linked = $true
@@ -34,41 +36,68 @@
     } elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) {
         $Enabled = 'User configuration settings disabled'
     }
-
+    if (-not $PermissionsOnly) {
+        if ($XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text') {
+            $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text')"]
+            $WellKnown = ConvertFrom-SID -SID $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text' -OnlyWellKnown
+            if ($AdministrativeGroup) {
+                $OwnerType = 'Administrative'
+            } elseif ($WellKnown.Name) {
+                $OwnerType = 'WellKnown'
+            } else {
+                $OwnerType = 'NotAdministrative'
+            }
+        } else {
+            $OwnerType = 'EmptyOrUnknown'
+        }
+    }
     if ($PermissionsOnly) {
         [PsCustomObject] @{
-            'DisplayName'    = $XMLContent.GPO.Name
-            'DomainName'     = $XMLContent.GPO.Identifier.Domain.'#text'
-            'GUID'           = $XMLContent.GPO.Identifier.Identifier.InnerText
-            'Enabled'        = $Enabled
-            'Name'           = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
-            'Sid'            = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'DisplayName'          = $XMLContent.GPO.Name
+            'DomainName'           = $XMLContent.GPO.Identifier.Domain.'#text'
+            'GUID'                 = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+            'Enabled'              = $Enabled
+            'Name'                 = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+            'Sid'                  = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
             #'SidType'        = if (($XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text').Length -le 10) { 'WellKnown' } else { 'Other' }
-            'PermissionType' = 'Allow'
-            'Inherited'      = $false
-            'Permissions'    = 'Owner'
+            'PermissionType'       = 'Allow'
+            'Inherited'            = $false
+            'Permissions'          = 'Owner'
+            'GPODistinguishedName' = $GPO.Path
         }
         $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
             if ($_) {
                 [PsCustomObject] @{
-                    'DisplayName'    = $XMLContent.GPO.Name
-                    'DomainName'     = $XMLContent.GPO.Identifier.Domain.'#text'
-                    'GUID'           = $XMLContent.GPO.Identifier.Identifier.InnerText
-                    'Enabled'        = $Enabled
-                    'Name'           = $_.trustee.name.'#Text'
-                    'Sid'            = $_.trustee.SID.'#Text'
+                    'DisplayName'          = $XMLContent.GPO.Name
+                    'DomainName'           = $XMLContent.GPO.Identifier.Domain.'#text'
+                    'GUID'                 = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+                    'Enabled'              = $Enabled
+                    'Name'                 = $_.trustee.name.'#Text'
+                    'Sid'                  = $_.trustee.SID.'#Text'
                     #'SidType'        = if (($XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text').Length -le 10) { 'WellKnown' } else { 'Other' }
-                    'PermissionType' = $_.type.PermissionType
-                    'Inherited'      = if ($_.Inherited -eq 'false') { $false } else { $true }
-                    'Permissions'    = $_.Standard.GPOGroupedAccessEnum
+                    'PermissionType'       = $_.type.PermissionType
+                    'Inherited'            = if ($_.Inherited -eq 'false') { $false } else { $true }
+                    'Permissions'          = $_.Standard.GPOGroupedAccessEnum
+                    'GPODistinguishedName' = $GPO.Path
                 }
             }
         }
+    } elseif ($OwnerOnly) {
+        [PsCustomObject] @{
+            'DisplayName'          = $XMLContent.GPO.Name
+            'DomainName'           = $XMLContent.GPO.Identifier.Domain.'#text'
+            'GUID'                 = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+            'Enabled'              = $Enabled
+            'Owner'                = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+            'OwnerSID'             = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'OwnerType'            = $OwnerType
+            'GPODistinguishedName' = $GPO.Path
+        }
     } else {
         [PsCustomObject] @{
             'DisplayName'                       = $XMLContent.GPO.Name
             'DomainName'                        = $XMLContent.GPO.Identifier.Domain.'#text'
-            'GUID'                              = $XMLContent.GPO.Identifier.Identifier.InnerText
+            'GUID'                              = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
             'Linked'                            = $Linked
             'LinksCount'                        = $LinksCount
             'Enabled'                           = $Enabled
@@ -83,16 +112,20 @@
             'UserSettingsVersionIdentical'      = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
             'UserSettings'                      = $XMLContent.GPO.User.ExtensionData.Extension
 
+            ComputerPolicies                    = $XMLContent.GPO.Computer.ExtensionData.Name -join ", "
+            UserPolicies                        = $XMLContent.GPO.User.ExtensionData.Name -join ", "
+
             'CreationTime'                      = [DateTime] $XMLContent.GPO.CreatedTime
             'ModificationTime'                  = [DateTime] $XMLContent.GPO.ModifiedTime
             'ReadTime'                          = [DateTime] $XMLContent.GPO.ReadTime
 
             'WMIFilter'                         = $GPO.WmiFilter.name
             'WMIFilterDescription'              = $GPO.WmiFilter.Description
-            'DistinguishedName'                 = $GPO.Path
+            'GPODistinguishedName'              = $GPO.Path
             'SDDL'                              = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
             'Owner'                             = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
             'OwnerSID'                          = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'OwnerType'                         = $OwnerType
             'ACL'                               = @(
                 [PsCustomObject] @{
                     'Name'           = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'

Private/Get-XMLStandard.ps1

@@ -0,0 +1,51 @@
+function Get-XMLStandard {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [System.Xml.XmlElement[]] $GPOOutput,
+        [string] $Splitter,
+        [switch] $FullObjects
+    )
+    $LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects
+    foreach ($GpoType in @('User', 'Computer')) {
+        if ($GPOOutput.$GpoType.ExtensionData.Extension) {
+            foreach ($ExtensionType in $GPOOutput.$GpoType.ExtensionData.Extension) {
+                # It's possible that one of the ExtensionType records has value null. Weird but happend.
+                if ($ExtensionType) {
+                    $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
+                    try {
+                        $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] }
+                    } catch {
+                        Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
+                        continue
+                    }
+                    foreach ($GpoSettings in $KeysToLoop.Name) {
+                        foreach ($Key in $ExtensionType.$GpoSettings) {
+                            $Template = [ordered] @{
+                                DisplayName = $GPO.DisplayName
+                                DomainName  = $GPO.DomainName
+                                GUID        = $GPO.Guid
+                                GpoType     = $GpoType
+                                GpoCategory = $GPOSettingTypeSplit[1]
+                                GpoSettings = $GpoSettings
+                            }
+                            try {
+                                $Properties = ($Key | Get-Member -MemberType Properties -ErrorAction Stop).Name
+                            } catch {
+                                Write-Warning "Get-XMLStandard - things went sideways 1 $($_.Exception.Message)"
+                                $Properties = $null
+                            }
+                            foreach ($Property in $Properties) {
+                                $Template["$Property"] = $Key.$Property
+                            }
+                            $Template['Linked'] = $LinksInformation.Linked
+                            $Template['LinksCount'] = $LinksInformation.LinksCount
+                            $Template['Links'] = $LinksInformation.Links
+                            [PSCustomObject] $Template
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

Private/Invoke-GPOTranslation.ps1

@@ -0,0 +1,15 @@
+function Invoke-GPOTranslation {
+    [cmdletBinding()]
+    param(
+        [System.Collections.IDictionary] $InputData,
+        [string] $Report,
+        [string] $Category,
+        [string] $Settings
+    )
+    if ($Category -and $Settings -and $InputData) {
+        if ($Script:GPODitionary[$Report]['Code']) {
+            $Script:GPOList = $InputData.$Category.$Settings
+            return & $Script:GPODitionary[$Report]['Code']
+        }
+    }
+}

Private/Remove-PrivPermission.ps1

@@ -0,0 +1,66 @@
+function Remove-PrivPermission {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [string] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+        [PSCustomObject] $GPOPermission,
+        [alias('PermissionType')][Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType
+    )
+    if ($GPOPermission.Name) {
+        $Text = "Removing SID: $($GPOPermission.Sid), Name: $($GPOPermission.Domain)\$($GPOPermission.Name), SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
+    } else {
+        $Text = "Removing SID: $($GPOPermission.Sid), Name: EMPTY, SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
+    }
+    if ($PrincipalType -eq 'DistinguishedName') {
+        if ($GPOPermission.DistinguishedName -eq $Principal -and $GPOPermission.Permission -eq $IncludePermissionType) {
+            if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, $Text)) {
+                try {
+                    Write-Verbose "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType for $($Principal) / $($GPOPermission.Name) / Type: $($GPOPermission.PermissionType)"
+                    $GPOPermission.GPOSecurity.Remove($GPOPermission.GPOSecurityPermissionItem)
+                    $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                } catch {
+                    Write-Warning "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                }
+            }
+        }
+    } elseif ($PrincipalType -eq 'Sid') {
+        if ($GPOPermission.Sid -eq $Principal -and $GPOPermission.Permission -eq $IncludePermissionType) {
+            if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, $Text)) {
+                try {
+                    Write-Verbose "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType for $($Principal) / $($GPOPermission.Name) / Type: $($GPOPermission.PermissionType)"
+                    $GPOPermission.GPOSecurity.Remove($GPOPermission.GPOSecurityPermissionItem)
+                    $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                } catch {
+                    if ($_.Exception.Message -like '*The request is not supported. (Exception from HRESULT: 0x80070032)*') {
+                        Write-Warning "Remove-GPOZaurrPermission - Bummer! The request is not supported, but lets fix it differently."
+                        # This is basically atomic approach. We will totally remove any permissions for that user on ACL level to get rid of this situation.
+                        # This situation should only happen if DENY is on FULL Control
+                        $ACL = Get-ADACL -ADObject $GPOPermission.GPOObject.Path -Bundle #-Verbose:$VerbosePreference
+                        if ($ACL) {
+                            Remove-ADACL -ACL $ACL -Principal $Principal -AccessControlType Deny -Verbose:$VerbosePreference
+                        }
+                        # I've noticed that in situation where Edit settings, delete, modify security is set and then set to Deny we need to fix it once more
+                        $ACL = Get-ADACL -ADObject $GPOPermission.GPOObject.Path -Bundle
+                        if ($ACL) {
+                            Remove-ADACL -ACL $ACL -Principal $Principal -AccessControlType Allow -Verbose:$VerbosePreference
+                        }
+                    } else {
+                        Write-Warning "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+            }
+        }
+    } elseif ($PrincipalType -eq 'Name') {
+        if ($GPOPermission.Name -eq $Principal -and $GPOPermission.Permission -eq $IncludePermissionType) {
+            if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, $Text)) {
+                try {
+                    Write-Verbose "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType for $($Principal) / $($GPOPermission.Name) / Type: $($GPOPermission.PermissionType)"
+                    $GPOPermission.GPOSecurity.Remove($GPOPermission.GPOSecurityPermissionItem)
+                    $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                } catch {
+                    Write-Warning "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                }
+            }
+        }
+    }
+}

Private/Script.Actions.ps1

@@ -0,0 +1,6 @@
+$Script:Actions = @{
+    C = 'Create'
+    D = 'Delete'
+    U = 'Update'
+    R = 'Replace'
+}

Private/Script.GPODictionary.ps1

@@ -0,0 +1,111 @@
+$Script:GPODitionary = [ordered] @{
+    AccountPolicies            = [ordered] @{
+        Category = 'SecuritySettings'
+        Settings = 'Account'
+        GPOPath  = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies'
+        Code     = {
+            ConvertTo-AccountPolicies -GPOList $GPOList
+        }
+    }
+    Audit                      = [ordered] @{
+        Category = 'SecuritySettings'
+        Settings = 'Audit'
+        #GPOPath  = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies'
+        Code     = {
+            ConvertTo-Audit -GPOList $GPOList
+        }
+    }
+    AuditAlternative           = [ordered] @{
+        Category = 'SecuritySettings'
+        Settings = 'Audit'
+        #GPOPath  = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies'
+        Code     = {
+            ConvertTo-AuditAlternative -GPOList $GPOList
+        }
+    }
+    Autologon                  = [ordered] @{
+        Category = 'RegistrySettings'
+        Settings = 'RegistrySettings'
+        Code     = {
+            ConvertTo-RegistryAutologon -GPOList $GPOList
+        }
+    }
+    EventLog                   = [ordered] @{
+        Category = 'SecuritySettings'
+        Settings = 'EventLog'
+        #GPOPath  = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies'
+        Code     = {
+            ConvertTo-EventLog -GPOList $GPOList
+        }
+    }
+    LocalUsersAndGroups        = [ordered] @{
+        Category = 'LugsSettings'
+        Settings = 'LocalUsersAndGroups'
+        Code     = {
+            ConvertTo-LocalUserAndGroups -GPOList $GPOList
+        }
+    }
+    Policies                   = @{
+        Category = 'RegistrySettings'
+        Settings = 'Policy'
+        Code     = {
+            ConvertTo-Policies -GPOList $GPOList
+        }
+    }
+    RegistrySettings           = [ordered] @{
+        Category = 'RegistrySettings'
+        Settings = 'RegistrySettings'
+        Code     = {
+            ConvertTo-RegistrySettings -GPOList $GPOList
+        }
+    }
+    RegistrySettingsCollection = [ordered] @{
+        Category = 'RegistrySettings'
+        Settings = 'RegistrySettings'
+        Code     = {
+            ConvertTo-RegistrySettingsCollection -GPOList $GPOList
+        }
+    }
+    Scripts                    = [ordered] @{
+        Category = 'Scripts'
+        Settings = 'Script'
+        Code     = {
+            ConvertTo-Scripts -GPOList $GPOList
+        }
+    }
+    SecurityOptions            = [ordered] @{
+        Category = 'SecuritySettings'
+        Settings = 'SecurityOptions'
+        Code     = {
+            ConvertTo-SecurityOptions -GPOList $GPOList
+        }
+    }
+    SoftwareInstallation       = [ordered] @{
+        Category = 'SoftwareInstallationSettings'
+        Settings = 'MsiApplication'
+        Code     = {
+            ConvertTo-SoftwareInstallation -GPOList $GPOList
+        }
+    }
+    SystemServices             = [ordered] @{
+        Description = ''
+        GPOPath     = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> System Services'
+        Category    = 'SecuritySettings'
+        Settings    = 'SystemServices'
+        Code        = {
+            ConvertTo-SystemServices -GPOList $GPOList
+        }
+    }
+    SystemServicesNT           = [ordered] @{
+        Description = ''
+        GPOPath     = 'Computer Configuration -> Preferences -> Control Pannel Settings -> Services'
+        Category    = 'ServiceSettings'
+        Settings    = 'NTServices'
+        Code        = {
+            ConvertTo-SystemServicesNT -GPOList $GPOList
+        }
+    }
+    #LugsSettings    = @{
+    #    LocalUsersAndGroups = $LugsSettingsLocalUsersAndGroups
+
+}

Private/Test-SysvolFolders.ps1

@@ -0,0 +1,119 @@
+function Test-SysVolFolders {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOs,
+        [string] $Server,
+        [string] $Domain
+    )
+    $Differences = @{ }
+    $SysvolHash = @{ }
+
+    $GPOGUIDS = $GPOs.ID.GUID
+    try {
+        $SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -ErrorAction Stop
+    } catch {
+        $Sysvol = $Null
+    }
+    foreach ($_ in $SYSVOL) {
+        $GUID = $_.Name -replace '{' -replace '}'
+        $SysvolHash[$GUID] = $_
+    }
+    $Files = $SYSVOL.Name -replace '{' -replace '}'
+    if ($Files) {
+        $Comparing = Compare-Object -ReferenceObject $GPOGUIDS -DifferenceObject $Files -IncludeEqual
+        foreach ($_ in $Comparing) {
+            if ($_.SideIndicator -eq '==') {
+                $Found = 'Exists'
+            } elseif ($_.SideIndicator -eq '<=') {
+                $Found = 'Not available on SYSVOL'
+            } elseif ($_.SideIndicator -eq '=>') {
+                $Found = 'Orphaned GPO'
+            } else {
+                $Found = 'Orphaned GPO'
+            }
+            $Differences[$_.InputObject] = $Found
+        }
+    }
+    $GPOSummary = @(
+        foreach ($GPO in $GPOS) {
+            if ($null -ne $SysvolHash[$GPO.Id.GUID].FullName) {
+                $FullPath = $SysvolHash[$GPO.Id.GUID].FullName
+                try {
+                    $ACL = Get-Acl -Path $SysvolHash[$GPO.Id.GUID].FullName -ErrorAction Stop
+                    $Owner = $ACL.Owner
+                    $ErrorMessage = ''
+                } catch {
+                    Write-Warning "Get-GPOZaurrSysvol - ACL reading (1) failed for $FullPath with error: $($_.Exception.Message)"
+                    $ACL = $null
+                    $Owner = ''
+                    $ErrorMessage = $_.Exception.Message
+                }
+            } else {
+                $ACL = $null
+            }
+            if ($null -eq $Differences[$GPO.Id.Guid]) {
+                $SysVolStatus = 'Not available on SYSVOL'
+            } else {
+                $SysVolStatus = $Differences[$GPO.Id.Guid]
+            }
+            [PSCustomObject] @{
+                DisplayName      = $GPO.DisplayName
+                Status           = $Differences[$GPO.Id.Guid]
+                DomainName       = $GPO.DomainName
+                SysvolServer     = $Server
+                SysvolStatus     = $SysVolStatus
+                Owner            = $GPO.Owner
+                FileOwner        = $Owner
+                Id               = $GPO.Id.Guid
+                GpoStatus        = $GPO.GpoStatus
+                Path             = $FullPath
+                Description      = $GPO.Description
+                CreationTime     = $GPO.CreationTime
+                ModificationTime = $GPO.ModificationTime
+                UserVersion      = $GPO.UserVersion
+                ComputerVersion  = $GPO.ComputerVersion
+                WmiFilter        = $GPO.WmiFilter
+                Error            = $ErrorMessage
+            }
+        }
+        # Now we need to list thru Sysvol files and fine those that do not exists as GPO and create dummy GPO objects to show orphaned gpos
+        foreach ($_ in $Differences.Keys) {
+            if ($Differences[$_] -eq 'Orphaned GPO') {
+                if ($SysvolHash[$_].BaseName -notcontains 'PolicyDefinitions') {
+                    $FullPath = $SysvolHash[$_].FullName
+                    try {
+                        $ACL = Get-Acl -Path $FullPath -ErrorAction Stop
+                        $Owner = $ACL.Owner
+                        $ErrorMessage = ''
+                    } catch {
+                        Write-Warning "Get-GPOZaurrSysvol - ACL reading (2) failed for $FullPath with error: $($_.Exception.Message)"
+                        $ACL = $null
+                        $Owner = $null
+                        $ErrorMessage = $_.Exception.Message
+                    }
+
+                    [PSCustomObject] @{
+                        DisplayName      = $SysvolHash[$_].BaseName
+                        Status           = 'Orphaned GPO'
+                        DomainName       = $Domain
+                        SysvolServer     = $Server
+                        SysvolStatus     = $Differences[$GPO.Id.Guid]
+                        Owner            = ''
+                        FileOwner        = $Owner
+                        Id               = $_
+                        GpoStatus        = 'Orphaned'
+                        Path             = $FullPath
+                        Description      = $null
+                        CreationTime     = $SysvolHash[$_].CreationTime
+                        ModificationTime = $SysvolHash[$_].LastWriteTime
+                        UserVersion      = $null
+                        ComputerVersion  = $null
+                        WmiFilter        = $null
+                        Error            = $ErrorMessage
+                    }
+                }
+            }
+        }
+    )
+    $GPOSummary | Sort-Object -Property DisplayName
+}

Public/Add-GPOPermission.ps1

@@ -0,0 +1,41 @@
+function Add-GPOPermission {
+    [cmdletBinding()]
+    param(
+        [validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
+        [Microsoft.GroupPolicy.GPPermissionType] $IncludePermissionType,
+        [alias('Trustee')][Array] $Principal,
+        [alias('TrusteeType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+        [validateSet('Allow', 'Deny')][string] $PermitType = 'Allow'
+    )
+    if ($Type -eq 'Default') {
+        @{
+            Action                = 'Add'
+            Type                  = 'Default'
+            Principal             = $Principal
+            IncludePermissionType = $IncludePermissionType
+            PrincipalType         = $PrincipalType
+            PermitType            = $PermitType
+        }
+    } elseif ($Type -eq 'AuthenticatedUsers') {
+        @{
+            Action                = 'Add'
+            Type                  = 'AuthenticatedUsers'
+            IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
+        }
+    } elseif ($Type -eq 'Administrative') {
+        @{
+            Action                = 'Add'
+            Type                  = 'Administrative'
+            IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
+        }
+    } elseif ($Type -eq 'WellKnownAdministrative') {
+        @{
+            Action                = 'Add'
+            Type                  = 'WellKnownAdministrative'
+            IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
+        }
+    }
+}

Public/Add-GPOZaurrPermission.ps1

@@ -0,0 +1,213 @@
+function Add-GPOZaurrPermission {
+    [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'GPOGUID')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName', Mandatory)]
+        [string] $GPOName,
+
+        [Parameter(ParameterSetName = 'GPOGUID', Mandatory)]
+        [alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [Parameter(ParameterSetName = 'ADObject', Mandatory)]
+        [alias('OrganizationalUnit', 'DistinguishedName')][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
+
+        [validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
+
+        [alias('Trustee')][string] $Principal,
+        [alias('TrusteeType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+
+        [Parameter(Mandatory)][alias('IncludePermissionType')][Microsoft.GroupPolicy.GPPermissionType] $PermissionType,
+        [switch] $Inheritable,
+
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [System.Collections.IDictionary] $ADAdministrativeGroups,
+        [int] $LimitProcessing
+    )
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Extended
+    if (-not $ADAdministrativeGroups) {
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    }
+    if ($GPOName) {
+        $Splat = @{
+            GPOName = $GPOName
+        }
+    } elseif ($GPOGUID) {
+        $Splat = @{
+            GPOGUID = $GPOGUID
+        }
+    } else {
+        $Splat = @{}
+    }
+    $Splat['IncludeGPOObject'] = $true
+    $Splat['Forest'] = $Forest
+    $Splat['IncludeDomains'] = $IncludeDomains
+    if ($Type -ne 'Default') {
+        $Splat['Type'] = $Type
+    }
+    $Splat['PermitType'] = $PermitType
+    $Splat['Principal'] = $Principal
+    if ($PrincipalType) {
+        $Splat.PrincipalType = $PrincipalType
+    }
+    $Splat['ExcludeDomains'] = $ExcludeDomains
+    $Splat['ExtendedForestInformation'] = $ExtendedForestInformation
+    #$Splat['ExcludePermissionType'] = $ExcludePermissionType
+    $Splat['IncludePermissionType'] = $PermissionType
+    $Splat['SkipWellKnown'] = $SkipWellKnown.IsPresent
+    $Splat['SkipAdministrative'] = $SkipAdministrative.IsPresent
+
+    $AdministrativeExists = @{
+        DomainAdmins     = $false
+        EnterpriseAdmins = $false
+    }
+
+    # This should always return results. When no data is found it should return basic information that will allow us to add credentials.
+    [Array] $GPOPermissions = Get-GPOZaurrPermission @Splat -ReturnSecurityWhenNoData
+    # When it has GPOSecurityPermissionItem property it means it has permissions, if it doesn't it means we have clean object to process
+    if ($GPOPermissions.GPOSecurityPermissionItem) {
+        # Permission exists, but may be incomplete
+        foreach ($GPOPermission in $GPOPermissions) {
+            if ($Type -eq 'Default') {
+                # We were looking for specific principal and we got it. nothing to do
+                # this is for standard users such as przemyslaw.klys / adam.gonzales
+                return
+            } elseif ($Type -eq 'Administrative') {
+                # We are looking for administrative but we need to make sure we got correct administrative
+                if ($GPOPermission.Permission -eq $PermissionType) {
+                    $AdministrativeGroup = $ADAdministrativeGroups['BySID'][$GPOPermission.SID]
+                    if ($AdministrativeGroup.SID -like '*-519') {
+                        $AdministrativeExists['EnterpriseAdmins'] = $true
+                    } elseif ($AdministrativeGroup.SID -like '*-512') {
+                        $AdministrativeExists['DomainAdmins'] = $true
+                    }
+                    <#
+                    if ($AdministrativeGroup) {
+                        $DomainAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-512')
+                        $EnterpriseAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-519')
+                        if ($GPOPermission.SID -eq $DomainAdminsSID) {
+                            $AdministrativeExists['DomainAdmins'] = $true
+                        } elseif ($GPOPermission.SID -eq $EnterpriseAdminsSID) {
+                            $AdministrativeExists['EnterpriseAdmins'] = $true
+                        }
+                    }
+                    #>
+                }
+            } elseif ($Type -eq 'WellKnownAdministrative') {
+                # this is for SYSTEM account
+                return
+            } elseif ($Type -eq 'AuthenticatedUsers') {
+                # this is for Authenticated Users
+                return
+            }
+        }
+    }
+    if (-not $GPOPermissions) {
+        # This is bad - things went wrong
+        Write-Warning "Add-GPOZaurrPermission - Couldn't get permissions for GPO. Things aren't what they should be. Skipping!"
+    } else {
+        $GPO = $GPOPermissions[0]
+        if ($GPOPermissions.GPOSecurityPermissionItem) {
+            # We asked, we got response, now we need to check if maybe we're missing one of the two administrative groups
+            if ($Type -eq 'Administrative') {
+                # this is a case where something was returned. Be it Domain Admins or Enterprise Admins or both. But we still need to check because it may have been Domain Admins from other domain or just one of the two required groups
+                if ($AdministrativeExists['DomainAdmins'] -eq $false) {
+                    $Principal = $ADAdministrativeGroups[$GPO.DomainName]['DomainAdmins']
+                    Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                    if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                        try {
+                            $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                            $GPO.GPOSecurity.Add($AddPermission)
+                            $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                        } catch {
+                            Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                        }
+                    }
+                }
+                if ($AdministrativeExists['EnterpriseAdmins'] -eq $false) {
+                    $Principal = $ADAdministrativeGroups[$ForestInformation.Forest.RootDomain]['EnterpriseAdmins']
+                    Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                    if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                        try {
+                            $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                            $GPO.GPOSecurity.Add($AddPermission)
+                            $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                        } catch {
+                            Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                        }
+                    }
+                }
+            } elseif ($Type -eq 'Default') {
+                # This shouldn't really happen, as if we got response, and it didn't exists it wouldn't be here
+                Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType skipped for $($Principal). This shouldn't even happen!"
+            }
+        } else {
+            # We got no response. That means we either asked incorrectly or we need to fix permission. Trying to do so
+            if ($Type -eq 'Default') {
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal)"
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'Administrative') {
+                # this is a case where both Domain Admins/Enterprise Admins were missing
+                $Principal = $ADAdministrativeGroups[$GPO.DomainName]['DomainAdmins']
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+                $Principal = $ADAdministrativeGroups[$ForestInformation.Forest.RootDomain]['EnterpriseAdmins']
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'WellKnownAdministrative') {
+                $Principal = 'S-1-5-18'
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal (SYSTEM) / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) (SYSTEM) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'AuthenticatedUsers') {
+                $Principal = 'S-1-5-11'
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal (Authenticated Users) / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) (Authenticated Users) with error: $($_.Exception.Message)"
+                    }
+                }
+            }
+        }
+
+    }
+}

Public/Get-GPOZaurr.ps1

@@ -11,9 +11,16 @@
         [string[]] $GPOPath,
 
         [switch] $PermissionsOnly,
-        [switch] $Limited
+        [switch] $OwnerOnly,
+        [switch] $Limited,
+
+        [System.Collections.IDictionary] $ADAdministrativeGroups
     )
     Begin {
+        if (-not $ADAdministrativeGroups) {
+            Write-Verbose "Get-GPOZaurr - Getting ADAdministrativeGroups"
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
         if (-not $GPOPath) {
             $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         }
@@ -26,8 +33,13 @@
                     Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
                         Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
                         if (-not $Limited) {
-                            $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
-                            Get-XMLGPO -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent
+                            try {
+                                $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
+                            } catch {
+                                Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
+                                continue
+                            }
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
                         } else {
                             $_
                         }
@@ -36,8 +48,13 @@
                     Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
                         Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
                         if (-not $Limited) {
-                            $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
-                            Get-XMLGPO -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent
+                            try {
+                                $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
+                            } catch {
+                                Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
+                                continue
+                            }
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
                         } else {
                             $_
                         }
@@ -46,8 +63,13 @@
                     Get-GPO -All -Server $QueryServer -Domain $Domain -ErrorAction SilentlyContinue | ForEach-Object {
                         Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
                         if (-not $Limited) {
-                            $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
-                            Get-XMLGPO -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent
+                            try {
+                                $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
+                            } catch {
+                                Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
+                                continue
+                            }
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
                         } else {
                             $_
                         }
@@ -59,7 +81,7 @@
                 Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml | ForEach-Object {
                     $XMLContent = [XML]::new()
                     $XMLContent.Load($_.FullName)
-                    Get-XMLGPO -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent
+                    Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent
                 }
             }
         }