Update

Examples/Example-08-ListingPermissions.ps1

@@ -1,7 +1,7 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$T = Get-GPOZaurrPermission -GPOName 'DC | PowerShell Logging' -Type Unknown
+#$T = Get-GPOZaurrPermission -GPOName 'DC | PowerShell Logging' -Type Unknown
 
-#$T = Get-GPOZaurrPermission #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView
+$T = Get-GPOZaurrPermission -ResolveAccounts -IncludeOwner #-ExcludePermissionType GpoRead,GpoApply #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView
 $T | Format-Table -AutoSize *
-#$T | Out-HtmlView -ScrollX -Filtering -Online -DisablePaging
+$T | Out-HtmlView -ScrollX -Filtering -Online -DisablePaging

Examples/Example-13-ListingOwners.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Owners = Get-GPOZaurr -OwnerOnly
+$Owners | Format-Table

GPOZaurr.psd1

@@ -5,9 +5,9 @@
     CompatiblePSEditions = 'Desktop'
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
     Description          = 'Group Policy Eater'
-    FunctionsToExport    = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOZaurrOwner', 'Set-GPOZaurrWMI'
+    FunctionsToExport    = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.12'
+    ModuleVersion        = '0.0.14'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -17,11 +17,11 @@
         }
     }
     RequiredModules      = @{
-        ModuleVersion = '0.0.134'
+        ModuleVersion = '0.0.135'
         ModuleName    = 'PSSharedGoods'
         Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
     }, @{
-        ModuleVersion = '0.0.47'
+        ModuleVersion = '0.0.48'
         ModuleName    = 'ADEssentials'
         Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
     }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'

Private/Get-PrivPermission.ps1

@@ -9,10 +9,9 @@
         [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
         [switch] $IncludeGPOObject,
         [System.Collections.IDictionary] $ADAdministrativeGroups,
-        [string[]] $Type
+        [string[]] $Type,
+        [System.Collections.IDictionary] $Accounts
     )
-
-    # $GPO = $_
     Write-Verbose "Get-GPOZaurrPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
     $SecurityRights = $GPO.GetSecurityInfo()
     $SecurityRights | ForEach-Object -Process {
@@ -43,7 +42,6 @@
                 return
             }
         }
-
         $ReturnObject = [ordered] @{
             DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
             GUID              = $GPO.ID
@@ -59,11 +57,25 @@
             Name              = $GPOPermission.Trustee.Name    #: Domain Admins
             Sid               = $GPOPermission.Trustee.Sid.Value     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
             SidType           = $GPOPermission.Trustee.SidType #: Group
+        }
+        if ($Accounts) {
+            $A = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+            #$TranslatedUser = $Accounts[$A]
+            $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
+            $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
+            $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
+            $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
+            if ($Accounts[$A].ObjectClass -eq 'group') {
+                $ReturnObject['SidType'] = 'Group'
+            } elseif ($Accounts[$A].ObjectClass -eq 'user') {
+                $ReturnObject['SidType'] = 'user'
+            } #else {
 
+            #}
         }
         if ($IncludeGPOObject) {
-            $ReturnObject.GPOObject = $GPO
-            $ReturnObject.GPOSecurity = $SecurityRights
+            $ReturnObject['GPOObject'] = $GPO
+            $ReturnObject['GPOSecurity'] = $SecurityRights
         }
         [PSCustomObject] $ReturnObject
     }
@@ -84,12 +96,12 @@
             $DomainOwner = $GPO.Owner
             $DomainUserName = ''
             $SID = ''
-            $SIDType = ''
+            $SIDType = 'EmptyOrUnknown'
             $DistinguishedName = ''
         }
         $ReturnObject = [ordered] @{
             DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
-            GUID              = $GPO.GUID
+            GUID              = $GPO.Id
             DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
             Enabled           = $GPO.GpoStatus
             Description       = $GPO.Description
@@ -103,6 +115,27 @@
             Sid               = $SID     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
             SidType           = $SIDType #  #: Group
         }
+        if ($Accounts) {
+            $A = $GPO.Owner
+            #$TranslatedUser = $Accounts[$A]
+            $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
+            $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
+            $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
+            $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
+            $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
+            if (-not $ReturnObject['Sid']) {
+                $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
+            }
+            if ($Accounts[$A].ObjectClass -eq 'group') {
+                $ReturnObject['SidType'] = 'Group'
+            } elseif ($Accounts[$A].ObjectClass -eq 'user') {
+                $ReturnObject['SidType'] = 'User'
+            } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
+                $ReturnObject['SidType'] = 'Computer'
+            } else {
+                $ReturnObject['SidType'] = 'EmptyOrUnknown'
+            }
+        }
         if ($IncludeGPOObject) {
             $ReturnObject.GPOObject = $GPO
             $ReturnObject.GPOSecurity = $SecurityRights

Private/Get-XMLGPO.ps1

@@ -3,7 +3,9 @@
     param(
         [XML] $XMLContent,
         [Microsoft.GroupPolicy.Gpo] $GPO,
-        [switch] $PermissionsOnly
+        [switch] $PermissionsOnly,
+        [switch] $OwnerOnly,
+        [System.Collections.IDictionary] $ADAdministrativeGroups
     )
     if ($XMLContent.GPO.LinksTo) {
         $Linked = $true
@@ -34,7 +36,21 @@
     } elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) {
         $Enabled = 'User configuration settings disabled'
     }
-
+    if (-not $PermissionsOnly) {
+        if ($XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text') {
+            $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text')"]
+            $WellKnown = ConvertFrom-SID -SID $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text' -OnlyWellKnown
+            if ($AdministrativeGroup) {
+                $OwnerType = 'Administrative'
+            } elseif ($WellKnown.Name) {
+                $OwnerType = 'WellKnown'
+            } else {
+                $OwnerType = 'NonAdministrative'
+            }
+        } else {
+            $OwnerType = 'EmptyOrUnknown'
+        }
+    }
     if ($PermissionsOnly) {
         [PsCustomObject] @{
             'DisplayName'    = $XMLContent.GPO.Name
@@ -64,6 +80,16 @@
                 }
             }
         }
+    } elseif ($OwnerOnly) {
+        [PsCustomObject] @{
+            'DisplayName' = $XMLContent.GPO.Name
+            'DomainName'  = $XMLContent.GPO.Identifier.Domain.'#text'
+            'GUID'        = $XMLContent.GPO.Identifier.Identifier.InnerText
+            'Enabled'     = $Enabled
+            'Owner'       = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+            'OwnerSID'    = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'OwnerType'   = $OwnerType
+        }
     } else {
         [PsCustomObject] @{
             'DisplayName'                       = $XMLContent.GPO.Name
@@ -93,6 +119,7 @@
             'SDDL'                              = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
             'Owner'                             = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
             'OwnerSID'                          = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'OwnerType'                         = $OwnerType
             'ACL'                               = @(
                 [PsCustomObject] @{
                     'Name'           = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'

Public/Get-GPOZaurr.ps1

@@ -11,9 +11,11 @@
         [string[]] $GPOPath,
 
         [switch] $PermissionsOnly,
+        [switch] $OwnerOnly,
         [switch] $Limited
     )
     Begin {
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         if (-not $GPOPath) {
             $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         }
@@ -27,7 +29,7 @@
                         Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
                         if (-not $Limited) {
                             $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
-                            Get-XMLGPO -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
                         } else {
                             $_
                         }
@@ -37,7 +39,7 @@
                         Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
                         if (-not $Limited) {
                             $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
-                            Get-XMLGPO -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
                         } else {
                             $_
                         }
@@ -47,7 +49,7 @@
                         Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
                         if (-not $Limited) {
                             $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
-                            Get-XMLGPO -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
                         } else {
                             $_
                         }
@@ -59,7 +61,7 @@
                 Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml | ForEach-Object {
                     $XMLContent = [XML]::new()
                     $XMLContent.Load($_.FullName)
-                    Get-XMLGPO -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent
+                    Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent
                 }
             }
         }

Public/Get-GPOZaurrPermission.ps1

@@ -11,6 +11,7 @@
 
         [switch] $SkipWellKnown,
         [switch] $SkipAdministrative,
+        [switch] $ResolveAccounts,
 
         [switch] $IncludeOwner,
         [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
@@ -23,28 +24,46 @@
         [System.Collections.IDictionary] $ExtendedForestInformation
     )
     Begin {
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         if ($Type -eq 'Unknown') {
             if ($SkipAdministrative -or $SkipWellKnown) {
                 Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
             }
         }
+        if ($ResolveAccounts) {
+            $Accounts = @{ }
+            foreach ($Domain in $ForestInformation.Domains) {
+                $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                $DomainInformation = Get-ADDomain -Server $QueryServer
+                $Users = Get-ADUser -Filter * -Server $QueryServer -Properties PasswordLastSet, LastLogonDate, UserPrincipalName
+                foreach ($User in $Users) {
+                    $U = -join ($DomainInformation.NetBIOSName, '\', $User.SamAccountName)
+                    $Accounts[$U] = $User
+                }
+                $Groups = Get-ADGroup -Filter * -Server $QueryServer
+                foreach ($Group in $Groups) {
+                    $G = -join ($DomainInformation.NetBIOSName, '\', $Group.SamAccountName)
+                    $Accounts[$G] = $Group
+                }
+            }
+        }
+
     }
     Process {
-        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         foreach ($Domain in $ForestInformation.Domains) {
             $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
             if ($GPOName) {
                 Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
-                    Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                    Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
                 }
             } elseif ($GPOGuid) {
                 Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
-                    Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                    Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
                 }
             } else {
                 Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
-                    Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                    Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
                 }
             }
         }

Public/Set-GPOZaurrWMI.ps1

@@ -1,6 +0,0 @@
-function Set-GPOZaurrWMI {
-    [cmdletBinding()]
-    param(
-
-    )
-}