Compare commits

...

17 Commits

Author SHA1 Message Date
Przemyslaw Klys 863c9fabc9 Update changelog 2023-09-17 07:32:08 +02:00
Przemyslaw Klys 972b51b472 Update changelog 2023-09-17 07:31:12 +02:00
Przemyslaw Klys 060fb95064 Update example 2023-09-17 07:30:17 +02:00
Przemyslaw Klys fdfc700c6f Update example 2023-09-17 07:30:03 +02:00
Przemyslaw Klys 81eaac3fd1 Small improvements to the report #48 2023-09-16 09:42:09 +02:00
Przemyslaw Klys cf9164766e Add example for new report #48 2023-09-16 09:41:56 +02:00
Przemyslaw Klys 4de2e2a57e Submit gitignore 2023-09-16 09:38:54 +02:00
Przemyslaw Klys 663e6058e6 Rewrite configuration 2023-09-16 09:38:30 +02:00
Przemyslaw Klys f681a5586e Update changelog 2023-09-16 09:38:22 +02:00
Przemyslaw Klys 4c022bfc16 Add redirected report #48 2023-09-16 09:38:15 +02:00
Przemyslaw Klys c03f158b77 Changed pipeline into standard foreach 2023-09-16 09:37:44 +02:00
Przemyslaw Klys 4824633787 Changed pipeline foreach into foreach for better/safer results 2023-09-16 09:34:20 +02:00
Przemyslaw Klys 8dc7e5b26d Bump versions 2023-09-16 09:34:00 +02:00
Przemyslaw Klys 68ed20f3e8 Update changelog 2023-09-16 08:48:32 +02:00
Przemyslaw Klys df2bacdba7 Remove bad char 2023-09-16 08:48:26 +02:00
Przemyslaw Klys f67ade6341 Use hashtable to create PSCustomObject for GPO details
- Simplify code by using a hashtable to create PSCustomObject for GPO details in "Get-GPOZaurrAD.ps1" script.
2023-09-16 08:42:31 +02:00
Przemyslaw Klys 5855ca2a7c Detect paths #48 2023-09-15 12:05:34 +02:00
12 changed files with 508 additions and 309 deletions
+8
View File
@@ -0,0 +1,8 @@
Ignore/*
.vs/*
.vscode/*
Releases/*
ReleasesUnpacked/*
*.log
*.html
Artefacts/*
+207 -276
View File
@@ -1,290 +1,221 @@
Clear-Host
$Configuration = @{
Information = @{
ModuleName = 'GPOZaurr'
DirectoryProjects = 'C:\Support\GitHub'
Import-Module "PSPublishModule" -Force
FunctionsToExport = 'Public'
AliasesToExport = 'Public'
Invoke-ModuleBuild -ModuleName 'GPOZaurr' {
# Usual defaults as per standard module
$Manifest = @{
# Version number of this module.
ModuleVersion = '1.X.0'
# Supported PSEditions
CompatiblePSEditions = @('Desktop')
# ID used to uniquely identify this module
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
# Author of this module
Author = 'Przemyslaw Klys'
# Company or vendor of this module
CompanyName = 'Evotec'
# Copyright statement for this module
Copyright = "(c) 2011 - $((Get-Date).Year) Przemyslaw Klys @ Evotec. All rights reserved."
# Description of the functionality provided by this module
Description = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
# Minimum version of the Windows PowerShell engine required by this module
PowerShellVersion = '5.1'
# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
Tags = @('Windows', 'ActiveDirectory', 'GPO', 'GroupPolicy')
#IconUri = 'https://evotec.xyz/wp-content/uploads/2019/02/PSPublishModule.png'
Manifest = @{
# Version number of this module.
ModuleVersion = '0.0.X'
# Supported PSEditions
CompatiblePSEditions = @('Desktop')
# ID used to uniquely identify this module
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
# Author of this module
Author = 'Przemyslaw Klys'
# Company or vendor of this module
CompanyName = 'Evotec'
# Copyright statement for this module
Copyright = "(c) 2011 - $((Get-Date).Year) Przemyslaw Klys @ Evotec. All rights reserved."
# Description of the functionality provided by this module
Description = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
# Minimum version of the Windows PowerShell engine required by this module
PowerShellVersion = '5.1'
# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
Tags = @('Windows', 'ActiveDirectory', 'GPO', 'GroupPolicy')
#IconUri = 'https://evotec.xyz/wp-content/uploads/2019/02/PSPublishModule.png'
ProjectUri = 'https://github.com/EvotecIT/GPOZaurr'
RequiredModules = @(
@{ ModuleName = 'PSSharedGoods'; ModuleVersion = 'Latest'; Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe' }
@{ ModuleName = 'ADEssentials'; ModuleVersion = '0.0.148'; Guid = '9fc9fd61-7f11-4f4b-a527-084086f1905f' }
@{ ModuleName = 'PSWriteHTML'; ModuleVersion = "Latest"; Guid = 'a7bdf640-f5cb-4acf-9de0-365b322d245c' }
)
ExternalModuleDependencies = @(
#"ActiveDirectory"
#"GroupPolicy"
"CimCmdlets"
'Microsoft.PowerShell.Management'
'Microsoft.PowerShell.Utility'
'Microsoft.PowerShell.Security'
)
CommandModuleDependencies = @{
ActiveDirectory = @(
'Add-GPOPermission'
'Add-GPOZaurrPermission'
'Backup-GPOZaurr'
'Clear-GPOZaurrSysvolDFSR'
'ConvertFrom-CSExtension'
'Find-CSExtension'
'Get-GPOZaurr'
'Get-GPOZaurrAD'
'Get-GPOZaurrBackupInformation'
'Get-GPOZaurrBroken'
'Get-GPOZaurrDictionary'
'Get-GPOZaurrDuplicateObject'
'Get-GPOZaurrFiles'
'Get-GPOZaurrFilesPolicyDefinition'
'Get-GPOZaurrFolders'
'Get-GPOZaurrInheritance'
'Get-GPOZaurrLegacyFiles'
'Get-GPOZaurrLink'
'Get-GPOZaurrLinkSummary'
'Get-GPOZaurrNetLogon'
'Get-GPOZaurrOwner'
'Get-GPOZaurrPassword'
'Get-GPOZaurrPermission'
'Get-GPOZaurrPermissionConsistency'
'Get-GPOZaurrPermissionRoot'
'Get-GPOZaurrPermissionSummary'
'Get-GPOZaurrSysvolDFSR'
'Get-GPOZaurrWMI'
'Invoke-GPOZaurr'
#'Invoke-GPOZaurrContent'
'Invoke-GPOZaurrPermission'
'Invoke-GPOZaurrSupport'
'New-GPOZaurrWMI'
'Optimize-GPOZaurr'
'Remove-GPOPermission'
'Remove-GPOZaurr'
'Remove-GPOZaurrBroken'
'Remove-GPOZaurrDuplicateObject'
'Remove-GPOZaurrFolders'
'Remove-GPOZaurrLegacyFiles'
'Remove-GPOZaurrPermission'
'Remove-GPOZaurrWMI'
'Repair-GPOZaurrNetLogonOwner'
'Repair-GPOZaurrPermissionConsistency'
'Restore-GPOZaurr'
'Save-GPOZaurrFiles'
'Set-GPOOwner'
'Set-GPOZaurrOwner'
'Find-GPO'
'Get-GPOZaurrFilesPolicyDefinitions'
'Get-GPOZaurrSysvol'
'Remove-GPOZaurrOrphaned'
'Show-GPO'
'Show-GPOZaurr'
)
GroupPolicy = @(
'Add-GPOPermission'
'Add-GPOZaurrPermission'
'Backup-GPOZaurr'
'Clear-GPOZaurrSysvolDFSR'
'ConvertFrom-CSExtension'
'Find-CSExtension'
'Get-GPOZaurr'
'Get-GPOZaurrAD'
'Get-GPOZaurrBackupInformation'
'Get-GPOZaurrBroken'
'Get-GPOZaurrDictionary'
'Get-GPOZaurrDuplicateObject'
'Get-GPOZaurrFiles'
'Get-GPOZaurrFilesPolicyDefinition'
'Get-GPOZaurrFolders'
'Get-GPOZaurrInheritance'
'Get-GPOZaurrLegacyFiles'
'Get-GPOZaurrLink'
'Get-GPOZaurrLinkSummary'
'Get-GPOZaurrNetLogon'
'Get-GPOZaurrOwner'
'Get-GPOZaurrPassword'
'Get-GPOZaurrPermission'
'Get-GPOZaurrPermissionConsistency'
'Get-GPOZaurrPermissionRoot'
'Get-GPOZaurrPermissionSummary'
'Get-GPOZaurrSysvolDFSR'
'Get-GPOZaurrWMI'
'Invoke-GPOZaurr'
#'Invoke-GPOZaurrContent'
'Invoke-GPOZaurrPermission'
'Invoke-GPOZaurrSupport'
'New-GPOZaurrWMI'
'Optimize-GPOZaurr'
'Remove-GPOPermission'
'Remove-GPOZaurr'
'Remove-GPOZaurrBroken'
'Remove-GPOZaurrDuplicateObject'
'Remove-GPOZaurrFolders'
'Remove-GPOZaurrLegacyFiles'
'Remove-GPOZaurrPermission'
'Remove-GPOZaurrWMI'
'Repair-GPOZaurrNetLogonOwner'
'Repair-GPOZaurrPermissionConsistency'
'Restore-GPOZaurr'
'Save-GPOZaurrFiles'
'Set-GPOOwner'
'Set-GPOZaurrOwner'
'Find-GPO'
'Get-GPOZaurrFilesPolicyDefinitions'
'Get-GPOZaurrSysvol'
'Remove-GPOZaurrOrphaned'
'Show-GPO'
'Show-GPOZaurr'
)
}
}
ProjectUri = 'https://github.com/EvotecIT/GPOZaurr'
}
Options = @{
Merge = @{
Sort = 'None'
FormatCodePSM1 = @{
Enabled = $true
RemoveComments = $false
FormatterSettings = @{
IncludeRules = @(
'PSPlaceOpenBrace',
'PSPlaceCloseBrace',
'PSUseConsistentWhitespace',
'PSUseConsistentIndentation',
'PSAlignAssignmentStatement',
'PSUseCorrectCasing'
)
New-ConfigurationManifest @Manifest
Rules = @{
PSPlaceOpenBrace = @{
Enable = $true
OnSameLine = $true
NewLineAfter = $true
IgnoreOneLineBlock = $true
}
New-ConfigurationModule -Type RequiredModule -Name 'PSWriteColor', 'PSSharedGoods', 'ADEssentials' -Guid Auto -Version Latest
#New-ConfigurationModule -Type ExternalModule -Name 'Microsoft.PowerShell.Utility', 'Microsoft.PowerShell.Management','Microsoft.PowerShell.Security'
New-ConfigurationModule -Type ApprovedModule -Name 'PSWriteColor', 'Connectimo', 'PSUnifi', 'PSWebToolbox', 'PSMyPassword'
PSPlaceCloseBrace = @{
Enable = $true
NewLineAfter = $false
IgnoreOneLineBlock = $true
NoEmptyLineBefore = $false
}
New-ConfigurationModule -Type ExternalModule -Name @(
"CimCmdlets"
'Microsoft.PowerShell.Management'
'Microsoft.PowerShell.Utility'
'Microsoft.PowerShell.Security'
)
PSUseConsistentIndentation = @{
Enable = $true
Kind = 'space'
PipelineIndentation = 'IncreaseIndentationAfterEveryPipeline'
IndentationSize = 4
}
New-ConfigurationModuleSkip -IgnoreModuleName @(
# this are builtin into PowerShell, so not critical
'powershellget'
'GroupPolicy'
'ActiveDirectory'
) -IgnoreFunctionName @(
PSUseConsistentWhitespace = @{
Enable = $true
CheckInnerBrace = $true
CheckOpenBrace = $true
CheckOpenParen = $true
CheckOperator = $true
CheckPipe = $true
CheckSeparator = $true
}
)
PSAlignAssignmentStatement = @{
Enable = $true
CheckHashtable = $true
}
New-ConfigurationCommand -ModuleName 'ActiveDirectory' -CommandName @(
'Add-GPOPermission'
'Add-GPOZaurrPermission'
'Backup-GPOZaurr'
'Clear-GPOZaurrSysvolDFSR'
'ConvertFrom-CSExtension'
'Find-CSExtension'
'Get-GPOZaurr'
'Get-GPOZaurrAD'
'Get-GPOZaurrBackupInformation'
'Get-GPOZaurrBroken'
'Get-GPOZaurrDictionary'
'Get-GPOZaurrDuplicateObject'
'Get-GPOZaurrFiles'
'Get-GPOZaurrFilesPolicyDefinition'
'Get-GPOZaurrFolders'
'Get-GPOZaurrInheritance'
'Get-GPOZaurrLegacyFiles'
'Get-GPOZaurrLink'
'Get-GPOZaurrLinkSummary'
'Get-GPOZaurrNetLogon'
'Get-GPOZaurrOwner'
'Get-GPOZaurrPassword'
'Get-GPOZaurrPermission'
'Get-GPOZaurrPermissionConsistency'
'Get-GPOZaurrPermissionRoot'
'Get-GPOZaurrPermissionSummary'
'Get-GPOZaurrSysvolDFSR'
'Get-GPOZaurrWMI'
'Invoke-GPOZaurr'
#'Invoke-GPOZaurrContent'
'Invoke-GPOZaurrPermission'
'Invoke-GPOZaurrSupport'
'New-GPOZaurrWMI'
'Optimize-GPOZaurr'
'Remove-GPOPermission'
'Remove-GPOZaurr'
'Remove-GPOZaurrBroken'
'Remove-GPOZaurrDuplicateObject'
'Remove-GPOZaurrFolders'
'Remove-GPOZaurrLegacyFiles'
'Remove-GPOZaurrPermission'
'Remove-GPOZaurrWMI'
'Repair-GPOZaurrNetLogonOwner'
'Repair-GPOZaurrPermissionConsistency'
'Restore-GPOZaurr'
'Save-GPOZaurrFiles'
'Set-GPOOwner'
'Set-GPOZaurrOwner'
'Find-GPO'
'Get-GPOZaurrFilesPolicyDefinitions'
'Get-GPOZaurrSysvol'
'Remove-GPOZaurrOrphaned'
'Show-GPO'
'Show-GPOZaurr'
)
New-ConfigurationCommand -ModuleName 'GroupPolicy' -CommandName @(
'Add-GPOPermission'
'Add-GPOZaurrPermission'
'Backup-GPOZaurr'
'Clear-GPOZaurrSysvolDFSR'
'ConvertFrom-CSExtension'
'Find-CSExtension'
'Get-GPOZaurr'
'Get-GPOZaurrAD'
'Get-GPOZaurrBackupInformation'
'Get-GPOZaurrBroken'
'Get-GPOZaurrDictionary'
'Get-GPOZaurrDuplicateObject'
'Get-GPOZaurrFiles'
'Get-GPOZaurrFilesPolicyDefinition'
'Get-GPOZaurrFolders'
'Get-GPOZaurrInheritance'
'Get-GPOZaurrLegacyFiles'
'Get-GPOZaurrLink'
'Get-GPOZaurrLinkSummary'
'Get-GPOZaurrNetLogon'
'Get-GPOZaurrOwner'
'Get-GPOZaurrPassword'
'Get-GPOZaurrPermission'
'Get-GPOZaurrPermissionConsistency'
'Get-GPOZaurrPermissionRoot'
'Get-GPOZaurrPermissionSummary'
'Get-GPOZaurrSysvolDFSR'
'Get-GPOZaurrWMI'
'Invoke-GPOZaurr'
#'Invoke-GPOZaurrContent'
'Invoke-GPOZaurrPermission'
'Invoke-GPOZaurrSupport'
'New-GPOZaurrWMI'
'Optimize-GPOZaurr'
'Remove-GPOPermission'
'Remove-GPOZaurr'
'Remove-GPOZaurrBroken'
'Remove-GPOZaurrDuplicateObject'
'Remove-GPOZaurrFolders'
'Remove-GPOZaurrLegacyFiles'
'Remove-GPOZaurrPermission'
'Remove-GPOZaurrWMI'
'Repair-GPOZaurrNetLogonOwner'
'Repair-GPOZaurrPermissionConsistency'
'Restore-GPOZaurr'
'Save-GPOZaurrFiles'
'Set-GPOOwner'
'Set-GPOZaurrOwner'
'Find-GPO'
'Get-GPOZaurrFilesPolicyDefinitions'
'Get-GPOZaurrSysvol'
'Remove-GPOZaurrOrphaned'
'Show-GPO'
'Show-GPOZaurr'
)
PSUseCorrectCasing = @{
Enable = $true
}
}
}
}
FormatCodePSD1 = @{
Enabled = $true
RemoveComments = $false
}
Integrate = @{
ApprovedModules = 'PSSharedGoods', 'PSWriteColor', 'Connectimo', 'PSUnifi', 'PSWebToolbox', 'PSMyPassword', 'ADEssentials', 'PSPublishModule'
}
}
Standard = @{
FormatCodePSM1 = @{
}
FormatCodePSD1 = @{
Enabled = $true
#RemoveComments = $true
}
}
PowerShellGallery = @{
ApiKey = 'C:\Support\Important\PowerShellGalleryAPI.txt'
FromFile = $true
}
GitHub = @{
ApiKey = 'C:\Support\Important\GithubAPI.txt'
FromFile = $true
UserName = 'EvotecIT'
#RepositoryName = 'PSPublishModule' # not required, uses project name
}
Documentation = @{
Path = 'Docs'
PathReadme = 'Docs\Readme.md'
}
Style = @{
PSD1 = 'Minimal' # Native
}
Signing = @{
CertificateThumbprint = '36A8A2D0E227D81A2D3B60DCE0CFCF23BEFC343B'
}
$ConfigurationFormat = [ordered] @{
RemoveComments = $true
RemoveEmptyLines = $true
PlaceOpenBraceEnable = $true
PlaceOpenBraceOnSameLine = $true
PlaceOpenBraceNewLineAfter = $true
PlaceOpenBraceIgnoreOneLineBlock = $false
PlaceCloseBraceEnable = $true
PlaceCloseBraceNewLineAfter = $true
PlaceCloseBraceIgnoreOneLineBlock = $false
PlaceCloseBraceNoEmptyLineBefore = $true
UseConsistentIndentationEnable = $true
UseConsistentIndentationKind = 'space'
UseConsistentIndentationPipelineIndentation = 'IncreaseIndentationAfterEveryPipeline'
UseConsistentIndentationIndentationSize = 4
UseConsistentWhitespaceEnable = $true
UseConsistentWhitespaceCheckInnerBrace = $true
UseConsistentWhitespaceCheckOpenBrace = $true
UseConsistentWhitespaceCheckOpenParen = $true
UseConsistentWhitespaceCheckOperator = $true
UseConsistentWhitespaceCheckPipe = $true
UseConsistentWhitespaceCheckSeparator = $true
AlignAssignmentStatementEnable = $true
AlignAssignmentStatementCheckHashtable = $true
UseCorrectCasingEnable = $true
}
Steps = @{
BuildModule = @{ # requires Enable to be on to process all of that
Enable = $true
DeleteBefore = $false
Merge = $true
MergeMissing = $true
SignMerged = $true
Releases = $true
ReleasesUnpacked = $false
RefreshPSD1Only = $false
}
BuildDocumentation = @{
Enable = $true # enables documentation processing
StartClean = $true # always starts clean
UpdateWhenNew = $true # always updates right after new
}
ImportModules = @{
Self = $true
RequiredModules = $false
Verbose = $false
}
PublishModule = @{ # requires Enable to be on to process all of that
Enabled = $false
Prerelease = ''
RequireForce = $false
GitHub = $false
}
}
}
# format PSD1 and PSM1 files when merging into a single file
# enable formatting is not required as Configuration is provided
New-ConfigurationFormat -ApplyTo 'OnMergePSM1', 'OnMergePSD1' -Sort None @ConfigurationFormat
# format PSD1 and PSM1 files within the module
# enable formatting is required to make sure that formatting is applied (with default settings)
New-ConfigurationFormat -ApplyTo 'DefaultPSD1', 'DefaultPSM1' -EnableFormatting -Sort None
# when creating PSD1 use special style without comments and with only required parameters
New-ConfigurationFormat -ApplyTo 'DefaultPSD1', 'OnMergePSD1' -PSD1Style 'Minimal'
# configuration for documentation, at the same time it enables documentation processing
New-ConfigurationDocumentation -Enable:$false -StartClean -UpdateWhenNew -PathReadme 'Docs\Readme.md' -Path 'Docs'
New-PrepareModule -Configuration $Configuration
New-ConfigurationImportModule -ImportSelf
New-ConfigurationBuild -Enable:$true -SignModule -MergeModuleOnBuild -MergeFunctionsFromApprovedModules -CertificateThumbprint '483292C9E317AA13B07BB7A96AE9D1A5ED9E7703'
# New-ConfigurationTest -TestsPath "$PSScriptRoot\..\Tests" -Enable
New-ConfigurationArtefact -Type Unpacked -Enable -Path "$PSScriptRoot\..\Artefacts\Unpacked" -AddRequiredModules
New-ConfigurationArtefact -Type Packed -Enable -Path "$PSScriptRoot\..\Artefacts\Packed" -ArtefactName '<ModuleName>.v<ModuleVersion>.zip'
# options for publishing to github/psgallery
#New-ConfigurationPublish -Type PowerShellGallery -FilePath 'C:\Support\Important\PowerShellGalleryAPI.txt' -Enabled:$true
#New-ConfigurationPublish -Type GitHub -FilePath 'C:\Support\Important\GitHubAPI.txt' -UserName 'EvotecIT' -Enabled:$true
} -ExitCode
+7
View File
@@ -1,5 +1,12 @@
# GPOZaurr Release History
## 1.0.0 - 2023.09.17
- `Get-GPOZaurrUpdates` fix small typo
- `Get-GPOZaurrAD` improve performance a bit
- `Get-GPOZaurrAD` changed pipeline into standard foreach to improve performance and potential problems for large domains
- Added `Get-GPOZaurrRedirect` to detect if GPO path was redirected (security issue)
- Added `GPORedirect` report type to `Invoke-GPOZaurr` to detect if GPO path was redirected (security issue)
## 0.0.160 - 2023.05.26
- Fixes `Remove-GPOZaurr` limit processing feature which would not stop in some cases
@@ -1,7 +1,11 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
# Remove GPOS
Remove-GPOZaurr -Type Empty, Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -BackupDated -LimitProcessing 2 -Verbose -WhatIf
# Remove GPOS, but don't touch 2 defined exclusions
$ExcludeGroupPolicies = {
'TEST | Drive Mapping 1',
'TEST | Drive Mapping 2'
}
Remove-GPOZaurr -Type Empty -BackupPath "$Env:UserProfile\Desktop\GPO" -BackupDated -LimitProcessing 3 -Verbose -WhatIf -ExcludeGroupPolicies $ExcludeGroupPolicies
# Remove GPOS, but don't touch 2 defined exclusions
Remove-GPOZaurr -Type Empty, Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -BackupDated -LimitProcessing 2 -Verbose -WhatIf {
@@ -1,3 +1,3 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
#Clear-Host
Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 1 #-WhatIf
Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 5 -GPOName 'CA TEST'
+4
View File
@@ -0,0 +1,4 @@
Import-Module .\GPoZaurr.psd1 -Force
$Data = Invoke-GPOZaurr -Online -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Type GPORedirect -PassThru
$Data.GPORedirect
+11 -11
View File
@@ -6,29 +6,29 @@
CompatiblePSEditions = @('Desktop')
Copyright = '(c) 2011 - 2023 Przemyslaw Klys @ Evotec. All rights reserved.'
Description = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
FunctionsToExport = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Export-GPOZaurrContent', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrBrokenLink', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOrganizationalUnit', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionAnalysis', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrUpdates', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrLinkEmptyOU', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrBrokenLink', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermission', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Set-GPOZaurrStatus', 'Skip-GroupPolicy')
FunctionsToExport = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Export-GPOZaurrContent', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrBrokenLink', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOrganizationalUnit', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionAnalysis', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrRedirect', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrUpdates', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrLinkEmptyOU', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrBrokenLink', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermission', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Set-GPOZaurrStatus', 'Skip-GroupPolicy')
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
ModuleVersion = '0.0.159'
ModuleVersion = '1.0.0'
PowerShellVersion = '5.1'
PrivateData = @{
PSData = @{
ExternalModuleDependencies = @('CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility', 'Microsoft.PowerShell.Security')
ProjectUri = 'https://github.com/EvotecIT/GPOZaurr'
Tags = @('Windows', 'ActiveDirectory', 'GPO', 'GroupPolicy')
ExternalModuleDependencies = @('CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility', 'Microsoft.PowerShell.Security')
}
}
RequiredModules = @(@{
ModuleName = 'PSSharedGoods'
ModuleVersion = '0.0.264'
Guid = '0b0ba5c5-ec85-4c2b-a718-874e55a8bc3f'
ModuleName = 'PSWriteColor'
ModuleVersion = '1.0.1'
}, @{
Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
ModuleName = 'PSSharedGoods'
ModuleVersion = '0.0.266'
}, @{
ModuleName = 'ADEssentials'
ModuleVersion = '0.0.148'
Guid = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
}, @{
ModuleName = 'PSWriteHTML'
ModuleVersion = '0.0.188'
Guid = 'a7bdf640-f5cb-4acf-9de0-365b322d245c'
ModuleName = 'ADEssentials'
ModuleVersion = '0.0.165'
}, 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility', 'Microsoft.PowerShell.Security')
RootModule = 'GPOZaurr.psm1'
}
+79
View File
@@ -0,0 +1,79 @@
$GPOZaurrGPORedirects = [ordered] @{
Name = 'Group Policies With Redirected SYSVOL'
Enabled = $false
ActionRequired = $null
Data = $null
Execute = {
Get-GPOZaurrRedirect -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
}
Processing = {
foreach ($GPO in $Script:Reporting['GPORedirect']['Data']) {
$Script:Reporting['GPORedirect']['Variables']['GPOTotal']++
if ($GPO.IsCorrect -eq $true) {
$Script:Reporting['GPORedirect']['Variables']['GPOIsCorrect']++
} else {
$Script:Reporting['GPORedirect']['Variables']['GPOIsNotCorrect']++
}
}
if ($Script:Reporting['GPORedirect']['Variables']['GPOIsNotCorrect'] -gt 0) {
$Script:Reporting['GPORedirect']['ActionRequired'] = $true
} else {
$Script:Reporting['GPORedirect']['ActionRequired'] = $false
}
}
Variables = @{
GPOTotal = 0
GPOIsCorrect = 0
GPOIsNotCorrect = 0
}
Overview = {
}
Summary = {
New-HTMLText -TextBlock {
"Group Policies are stored in Active Directory and SYSVOL. SYSVOL is a folder shared by the domain controllers to hold its logon scripts, "
"group policy data, and other domain-wide data which needs to be available anywhere there is a domain controller. "
"SYSVOL provides a default location for files that must be shared for common access throughout a domain. "
"However it is possible to redirect SYSVOL to a different location by modifying "
"gPCFileSysPath "
"attribute of a GPO. "
"This is not recommended and should be avoided, but it can also be a sign of compromise."
"This report shows which GPOs are redirected and which are not. "
} -FontSize 10pt -LineBreak -FontWeight normal, normal, normal, normal, bold, normal, normal, normal -Color None, None, None, None, RedBerry, None, None, None
New-HTMLList -Type Unordered {
New-HTMLListItem -Text 'Group Policies in total: ', $Script:Reporting['GPORedirect']['Variables']['GPOTotal'] -FontWeight normal, bold
New-HTMLListItem -Text 'Group Policies without redirects: ', $Script:Reporting['GPORedirect']['Variables']['GPOIsCorrect'] -FontWeight normal, bold -Color None, MintGreen
New-HTMLListItem -Text 'Group Policies with redirects: ', $Script:Reporting['GPORedirect']['Variables']['GPOIsNotCorrect'] -FontWeight normal, bold -Color None, RedBerry
} -FontSize 10pt
New-HTMLText -TextBlock {
"If you notice any GPO with redirect, you should investigate it. "
} -FontSize 10pt -LineBreak
}
Solution = {
New-HTMLSection -Invisible {
New-HTMLPanel {
& $Script:GPOConfiguration['GPORedirect']['Summary']
}
New-HTMLPanel {
New-HTMLChart {
New-ChartBarOptions -Type barStacked
New-ChartLegend -Name 'No redirects', 'With redirects' -Color MintGreen, MediumOrchid
New-ChartBar -Name 'No redirection' -Value $Script:Reporting['GPORedirect']['Variables']['GPOIsCorrect'], $Script:Reporting['GPORedirect']['Variables']['GPOIsNotCorrect']
} -Title 'Group Policies with redirects' -TitleAlignment center
}
}
New-HTMLSection -Name 'Group Policies showing redirects (if any)' {
New-HTMLTable -DataTable $Script:Reporting['GPORedirect']['Data'] -Filtering {
New-HTMLTableCondition -Name 'IsCorrect' -Value $false -BackgroundColor Salmon -ComparisonType bool -FailBackgroundColor MintGreen -HighlightHeaders 'IsCorrect', 'Path', 'ExpectedPath'
}
}
if ($Script:Reporting['GPORedirect']['WarningsAndErrors']) {
New-HTMLSection -Name 'Warnings & Errors to Review' {
New-HTMLTable -DataTable $Script:Reporting['GPORedirect']['WarningsAndErrors'] -Filtering {
New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
}
}
}
}
}
+1
View File
@@ -13,6 +13,7 @@
GPOPermissionsRead = $GPOZaurrPermissionsRead
GPOPermissionsRoot = $GPOZaurrPermissionsRoot
GPOPermissionsUnknown = $GPOZaurrPermissionsUnknown
GPORedirect = $GPOZaurrGPORedirects
GPOFiles = $GPOZaurrFiles
GPOBlockedInheritance = $GPOZaurrBlockedInheritance
GPOAnalysis = $GPOZaurrAnalysis
+19 -18
View File
@@ -85,26 +85,27 @@
}
Write-Verbose -Message "Get-GPOZaurrAD - Searching domain $Domain with filter $($Splat['Filter'])"
Get-ADObject @Splat -Properties DisplayName, Name, Created, Modified, ntSecurityDescriptor, gPCFileSysPath, gPCFunctionalityVersion, gPCWQLFilter, gPCMachineExtensionNames, Description, CanonicalName, DistinguishedName | ForEach-Object -Process {
$DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDomainCN
$GUID = $_.Name -replace '{' -replace '}'
$Objects = Get-ADObject @Splat -Properties DisplayName, Name, Created, Modified, ntSecurityDescriptor, gPCFileSysPath, gPCFunctionalityVersion, gPCWQLFilter, gPCMachineExtensionNames, Description, CanonicalName, DistinguishedName
foreach ($Object in $Objects) {
$DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $Object.DistinguishedName -ToDomainCN
$GUID = $Object.Name -replace '{' -replace '}'
if (($GUID).Length -ne 36) {
Write-Warning "Get-GPOZaurrAD - GPO GUID ($($($GUID.Replace("`n",' ')))) is incorrect. Skipping $($_.DisplayName) / Domain: $($DomainCN)"
Write-Warning "Get-GPOZaurrAD - GPO GUID ($($($GUID.Replace("`n",' ')))) is incorrect. Skipping $($Object.DisplayName) / Domain: $($DomainCN)"
} else {
$Output = [ordered]@{ }
$Output['DisplayName'] = $_.DisplayName
$Output['DomainName'] = $DomainCN
$Output['Description'] = $_.Description
$Output['GUID'] = $GUID
$Output['Path'] = $_.gPCFileSysPath
#$Output['FunctionalityVersion'] = $_.gPCFunctionalityVersion
$Output['Created'] = $_.Created
$Output['Modified'] = $_.Modified
$Output['Owner'] = $_.ntSecurityDescriptor.Owner
$Output['GPOCanonicalName'] = $_.CanonicalName
$Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDC
$Output['GPODistinguishedName'] = $_.DistinguishedName
[PSCustomObject] $Output
[PSCustomObject]@{
'DisplayName' = $Object.DisplayName
'DomainName' = $DomainCN
'Description' = $Object.Description
'GUID' = $GUID
'Path' = $Object.gPCFileSysPath
#$Output['FunctionalityVersion'] = $Object.gPCFunctionalityVersion
'Created' = $Object.Created
'Modified' = $Object.Modified
'Owner' = $Object.ntSecurityDescriptor.Owner
'GPOCanonicalName' = $Object.CanonicalName
'GPODomainDistinguishedName' = ConvertFrom-DistinguishedName -DistinguishedName $Object.DistinguishedName -ToDC
'GPODistinguishedName' = $Object.DistinguishedName
}
}
}
}
+164
View File
@@ -0,0 +1,164 @@
function Get-GPOZaurrRedirect {
<#
.SYNOPSIS
Command to detect if GPOs have correct path in SYSVOL, or someone changed it manually.
.DESCRIPTION
Command to detect if GPOs have correct path in SYSVOL, or someone changed it manually.
.PARAMETER GPOName
Provide GPO name to search for. By default command returns all GPOs
.PARAMETER GPOGuid
Provide GPO GUID to search for. By default command returns all GPOs
.PARAMETER Forest
Target different Forest, by default current forest is used
.PARAMETER ExcludeDomains
Exclude domain from search, by default whole forest is scanned
.PARAMETER IncludeDomains
Include only specific domains, by default whole forest is scanned
.PARAMETER DateFrom
Provide a date from which to start the search, by default the last X days are used
.PARAMETER DateTo
Provide a date to which to end the search, by default the last X days are used
.PARAMETER DateRange
Provide a date range to search for, by default the last X days are used
.PARAMETER DateProperty
Choose a date property. It can be WhenCreated or WhenChanged or both. By default whenCreated is used for comparison purposes
.PARAMETER ExtendedForestInformation
Ability to provide Forest Information from another command to speed up processing
.EXAMPLE
Get-GPOZaurrRedirect | Format-Table
.NOTES
General notes
#>
[cmdletbinding(DefaultParameterSetName = 'Default')]
param(
[Parameter(ParameterSetName = 'GPOName')]
[string] $GPOName,
[Parameter(ParameterSetName = 'GPOGUID')]
[alias('GUID', 'GPOID')][string] $GPOGuid,
[alias('ForestName')][string] $Forest,
[string[]] $ExcludeDomains,
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
[DateTime] $DateFrom,
[DateTime] $DateTo,
[ValidateSet('PastHour', 'CurrentHour', 'PastDay', 'CurrentDay', 'PastMonth', 'CurrentMonth', 'PastQuarter', 'CurrentQuarter', 'Last14Days', 'Last21Days', 'Last30Days', 'Last7Days', 'Last3Days', 'Last1Days')][string] $DateRange,
[ValidateSet('WhenCreated', 'WhenChanged')][string[]] $DateProperty = 'WhenCreated',
[System.Collections.IDictionary] $ExtendedForestInformation
)
Begin {
$ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
}
Process {
foreach ($Domain in $ForestInformation.Domains) {
if ($PSCmdlet.ParameterSetName -eq 'GPOGUID') {
if ($GPOGuid) {
if ($GPOGUID -notlike '*{*') {
$GUID = -join ("{", $GPOGUID, '}')
} else {
$GUID = $GPOGUID
}
$Splat = @{
Filter = "(objectClass -eq 'groupPolicyContainer') -and (Name -eq '$GUID')"
Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
}
} else {
Write-Warning "Get-GPOZaurrRedirect - GPOGUID parameter is empty. Provide name and try again."
continue
}
} elseif ($PSCmdlet.ParameterSetName -eq 'GPOName') {
if ($GPOName) {
$Splat = @{
Filter = "(objectClass -eq 'groupPolicyContainer') -and (DisplayName -eq '$GPOName')"
Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
}
} else {
Write-Warning "Get-GPOZaurrRedirect - GPOName parameter is empty. Provide name and try again."
continue
}
} else {
$Splat = @{
Filter = "(objectClass -eq 'groupPolicyContainer')"
Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
}
}
# allows to only get GPOs from a specific date range
if ($PSBoundParameters.ContainsKey('DateRange')) {
$Dates = Get-ChoosenDates -DateRange $DateRange
$DateFrom = $($Dates.DateFrom)
$DateTo = $($Dates.DateTo)
if ($DateProperty -contains 'WhenChanged' -and $DateProperty -contains 'WhenCreated') {
$Splat['Filter'] = -join ($Splat['Filter'], ' -and ((WhenChanged -ge $DateFrom -and WhenChanged -le $DateTo) -or (WhenCreated -ge $DateFrom -and WhenCreated -le $DateTo))')
} elseif ($DateProperty -eq 'WhenChanged' -or $DateProperty -eq 'WhenCreated') {
$Property = $DateProperty[0]
$Splat['Filter'] = -join ($Splat['Filter'], ' -and ($Property -ge $DateFrom -and $Property -le $DateTo)')
} else {
Write-Warning -Message "Get-GPOZaurrRedirect - DateProperty parameter is empty. Provide name and try again."
continue
}
} elseif ($PSBoundParameters.ContainsKey('DateFrom') -and $PSBoundParameters.ContainsKey('DateTo')) {
# already set $DateFrom,DateTo
#$Splat['Filter'] = -join ($Splat['Filter'], '-and ($DateProperty -ge $DateFrom -and $DateProperty -le $DateTo)')
if ($DateProperty -contains 'WhenChanged' -and $DateProperty -contains 'WhenCreated') {
$Splat['Filter'] = -join ($Splat['Filter'], ' -and ((WhenChanged -ge $DateFrom -and WhenChanged -le $DateTo) -or (WhenCreated -ge $DateFrom -and WhenCreated -le $DateTo))')
} elseif ($DateProperty -eq 'WhenChanged' -or $DateProperty -eq 'WhenCreated') {
$Property = $DateProperty[0]
$Splat['Filter'] = -join ($Splat['Filter'], ' -and ($Property -ge $DateFrom -and $Property -le $DateTo)')
} else {
Write-Warning -Message "Get-GPOZaurrRedirect - DateProperty parameter is empty. Provide name and try again."
continue
}
} else {
# not needed
}
Write-Verbose -Message "Get-GPOZaurrRedirect - Searching domain $Domain with filter $($Splat['Filter'])"
$Objects = Get-ADObject @Splat -Properties DisplayName, Name, Created, Modified, ntSecurityDescriptor, gPCFileSysPath, gPCFunctionalityVersion, gPCWQLFilter, gPCMachineExtensionNames, Description, CanonicalName, DistinguishedName
foreach ($Object in $Objects) {
$DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $Object.DistinguishedName -ToDomainCN
$GUID = $Object.Name -replace '{' -replace '}'
if (($GUID).Length -ne 36) {
Write-Warning "Get-GPOZaurrRedirect - GPO GUID ($($($GUID.Replace("`n",' ')))) is incorrect. Skipping $($Object.DisplayName) / Domain: $($DomainCN)"
} else {
$Path = $Object.gPCFileSysPath
$ExpectedPath = "\\$($DomainCN)\SYSVOL\$($DomainCN)\Policies\{$($GUID)}"
$Compare = if ($Path -eq $ExpectedPath) { $true } else { $false }
[PSCustomObject]@{
'DisplayName' = $Object.DisplayName
'DomainName' = $DomainCN
'Description' = $Object.Description
'IsCorrect' = $Compare
'GUID' = $GUID
'Path' = $Path
'ExpectedPath' = $ExpectedPath
#$Output['FunctionalityVersion'] = $Object.gPCFunctionalityVersion
'Created' = $Object.Created
'Modified' = $Object.Modified
'Owner' = $Object.ntSecurityDescriptor.Owner
'GPOCanonicalName' = $Object.CanonicalName
'GPODomainDistinguishedName' = ConvertFrom-DistinguishedName -DistinguishedName $Object.DistinguishedName -ToDC
'GPODistinguishedName' = $Object.DistinguishedName
}
}
}
}
}
End {
}
}
+1 -1
View File
@@ -14,7 +14,7 @@
.PARAMETER IncludeDomains
Include only specific domains, by default whole forest is scanned
ą
.PARAMETER DateFrom
Provide a date from which to start the search, by default the last X days are used