Update

Added some error logging

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# These are supported funding model platforms
+
+github: PrzemyslawKlys
+custom: https://paypal.me/PrzemyslawKlys

Docs/Set-GPOZaurrOwner.md

@@ -182,7 +182,7 @@ Accept wildcard characters: False
 Type: String[]
 Parameter Sets: Type
 Aliases:
-Accepted values: EmptyOrUnknown, NonAdministrative
+Accepted values: EmptyOrUnknown, NotAdministrative
 
 Required: True
 Position: Named

Examples/Example-03-RestoreGPO.ps1

@@ -1,6 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$RestoreFrom = 'C:\Users\przemyslaw.klys\Desktop\GPO\2020-04-20_15_51_00'
+$RestoreFrom = 'C:\Users\przemyslaw.klys\Desktop\GPO\2020-04-26_10_29_34'
 
 $BackupInformation = Get-GPOZaurrBackupInformation -BackupFolder $RestoreFrom
 $BackupInformation | Format-Table -a

Examples/Example-05-ListingWMIFiltersByName.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrWMI -Name 'Test - Dual Filter' | Format-Table -AutoSize *

Examples/Example-08-ListingPermissionsAdministrative.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrPermission -GPOName 'Default Domain Policy' -Type 'All'
+$T | Format-Table *

Examples/Example-08-ListingPermissionsPerGPO.ps1

@@ -1,4 +1,12 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' #-Principal 'marikegerard' -PrincipalType Name # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'marikegerard' -PrincipalType Name # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'EVOTEC\marikegerard' -PrincipalType Name # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'S-1-5-18' -PrincipalType Sid # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'CN=Enterprise Admins,CN=Users,DC=ad,DC=evotec,DC=xyz' -PrincipalType DistinguishedName # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
 $T | Format-Table -AutoSize *

Examples/Example-08-ListingPermissionsUnknown.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrPermission -Type Unknown -Verbose
+$T | Format-Table *

Examples/Example-09-RemovingGPOPermissionUnknown.ps1

@@ -1,3 +1,3 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-
-Remove-GPOZaurrPermission -Verbose -Type Unknown -WhatIf
+#Clear-Host
+Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 1 #-WhatIf

Examples/Example-09-RemovingGPOPermissionUnknown02.ps1

@@ -0,0 +1,19 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Step 1 - Create report
+$Report = Get-GPOZaurrPermission -Type All
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOutput.xlsx -ExcelWorkSheetName 'GPO Permissions Before' -AutoFilter -AutoFit
+
+# Step 2 - Verify couple of GPOS returned with whatif
+#Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 4 -WhatIf
+
+# Step 3 - Confirm the change without whatif
+#Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 4
+
+# Step 4 - Analyze GPO manually to confirm only unknown sids were removed
+
+# Step 5 - if everything went ok, continue process without whatif
+
+# Step-6 - Generate new report
+#$Report = Get-GPOZaurrPermission -Type All
+#$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOutput.xlsx -ExcelWorkSheetName 'GPO Permissions After' -AutoFilter -AutoFit

Examples/Example-09-RemovingGPOpermissionNamed.ps1

@@ -1,13 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$Named = @(
-    'S-1-5-21-853615985-2870445339-3163598659-1105'
-)
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy'
+$T | Format-Table -AutoSize *
 
-# Using exclude permission types (it may not be good idea to delete GPORead/GPOApply)
-#Remove-GPOZaurrPermission -Verbose -Type Named -WhatIf -LimitProcessing 2 -NamedObjects $Named -ExcludePermissionType GpoRead,GpoApply
-
-# But
-#Remove-GPOZaurrPermission -Type Named -NamedObjects $Named -IncludePermissionType GpoEditDeleteModifySecurity -SkipWellKnown -SkipAdministrative -Verbose -WhatIf
-
-Remove-GPOZaurrPermission -Type Named -NamedObjects $Named -SkipWellKnown -SkipAdministrative -Verbose #-WhatIf
+Remove-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'S-1-5-21-853615985-2870445339-3163598659-3755' -Verbose #-WhatIf #-IncludePermissionType GpoApply #-WhatIf

Examples/Example-10-ListingGPO.ps1

@@ -0,0 +1,6 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrAD | Format-Table
+Get-GPOZaurrAD -Forest 'test.evotec.pl' | Format-Table
+
+Get-GPOZaurrAD -GPOName 'Default Domain Policy' -IncludeDomains 'ad.evotec.pl' | Format-Table

Examples/Example-10-ListingGPOLong.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$GPOS = Get-GPOZaurr
+$GPOS | Format-Table -AutoSize

Examples/Example-11-ReplaceGPOOwnerAutomated.ps1

@@ -1,13 +1,17 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 # This Example shows how to deal with GPOs that have owner that doesn't exists anymore (deleted userr or diff domain) - EmptyOrUnknown
-# And also can fix at the same time NonAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins
+# And also can fix at the same time NotAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins
 # regardless if current user is still Domain Admin or not
 
-$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
-$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType
+$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName
+$GPOs | Format-Table  DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
 
-Set-GPOZaurrOwner -Type 'EmptyOrUnknown' -Verbose -LimitProcessing 1 -WhatIf
+#Set-GPOZaurrOwner -Type Unknown -Verbose  #-LimitProcessing 2 -WhatIf
+Set-GPOZaurrOwner -Type NotAdministrative  -Verbose -LimitProcessing 2 -WhatIf
+#Set-GPOZaurrOwner -Type NotMatching -Verbose -LimitProcessing 2 -WhatIf
 
-$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
-$GPOs | Format-Table DisplayName, Owner, OwnerSID
+#Set-GPOZaurrOwner -GPOName 'COMPUTERS | Enable Sets' -Verbose -Principal 'przemyslaw.klys' -WhatIf #-SkipSysvol
+#Set-GPOZaurrOwner -GPOName 'New Group Policy Object' -Verbose #-WhatIf #-SkipSysvol
+#$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName 'New Group Policy Object'
+#$GPOs | Format-Table DisplayName, Owner, OwnerSID

Examples/Example-11-ReplaceGPOwner.ps1

@@ -0,0 +1,12 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Step 1 - Create report
+$Report = Get-GPOZaurrOwner -IncludeSysvol
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOwners.xlsx -ExcelWorkSheetName 'GPO Owners Before' -AutoFilter -AutoFit
+
+# Step 2 - Fix owners / use WhatIf and LimitProcessing / verify changes before/after
+Set-GPOZaurrOwner -Type NotAdministrative  -Verbose -LimitProcessing 2 -WhatIf
+
+# Step 3
+$Report = Get-GPOZaurrOwner -IncludeSysvol
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOwners.xlsx -ExcelWorkSheetName 'GPO Owners After' -AutoFilter -AutoFit

Examples/Example-13-ListingOwners02.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol
+$T | Format-Table *
+#$T | Out-HtmlView -ScrollX
+
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOName 'Default Domain Policy'
+$T | Format-Table *
+
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOGuid '4E1F9C70-1DDB-4AB6-BBA3-14A8E07F0B4B'
+$T | Format-Table *

Examples/Example-14-ListingGPOsPerOU1.ps1

@@ -1,3 +1,3 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-Get-GPOZaurrLink | Format-Table -AutoSize
+Get-GPOZaurrLink | Format-Table -AutoSize *

Examples/Example-14-ListingGPOsPerOU3.ps1

@@ -1,5 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 Get-ADOrganizationalUnit -Filter * -Properties distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
+Get-ADOrganizationalUnit -Filter * -Properties canonicalname, distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
 Get-ADObject -Filter * -Properties distinguishedName, gplink -Server 'ad.evotec.pl' | Get-GPOZaurrLink | Format-Table -AutoSize
 Get-GPOZaurrLink | Format-Table -AutoSize

Examples/Example-14-ListingGPOsPerOU4.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -Linked 'Root' -IncludeDomains 'ad.evotec.pl' | Format-Table

Examples/Example-14-ListingGPOsPerOURemoveDuplicates.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -Verbose | Format-Table -a *
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -SkipDuplicates | Format-Table -a *

Examples/Example-14-ListingGPOsSpecial.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Clear-Host
+
+Get-GPOZaurrLink -Linked Root | Format-Table -AutoSize
+
+Get-GPOZaurrLink -Linked Site | Format-Table -AutoSize
+
+Get-GPOZaurrLink -Linked DomainControllers | Format-Table -AutoSize
+
+Get-GPOZaurrLink -Linked Other | Format-Table -AutoSize

Examples/Example-16-AddRemoveGPOPermission01.ps1

@@ -5,13 +5,13 @@ Clear-Host
 $T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-IncludeGPOObject #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
 $T | Format-Table -AutoSize *
 
-Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoApply -Principal 'przemyslaw.klys' -Verbose
+Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -Verbose
 
 $T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
 $T | Format-Table -AutoSize *
 
 Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -Verbose
-Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
 
 $T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
 $T | Format-Table -AutoSize *

Examples/Example-16-AddRemoveGPOPermission02.ps1

@@ -2,18 +2,37 @@
 
 Clear-Host
 
-$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-IncludeGPOObject #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
-$T | Format-Table -AutoSize *
+$GPOName = 'ALL | Enable RDP'
 
-Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -Verbose
-Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoApply -Principal 'przemyslaw.klys' -Verbose
-Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -Verbose
-Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -Verbose
+$T = Get-GPOZaurrPermission -GPOName $GPOName -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow -Principal 'Domain Admins' -PrincipalType 'Name'
+$T | Format-Table *
 
-$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
-$T | Format-Table -AutoSize *
+<#
+# this will go and check for both Domain Admins / Enterprise Admins - if found won't do anything
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Type Administrative -Verbose
+# this will go thru, because PrincipalType is not set to look by Name. Be precise with what you ask for
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -Verbose
+# this will be detected as already existing
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -PrincipalType Name -Verbose
+# this will be added only if it doesn't exists - assuming that przemyslaw.klys is displayed in Get-GPOZaurrPermissions
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+# this will be added only if it doesn't exists - assuming that przemyslaw.klys is displayed in Get-GPOZaurrPermissions
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+# this will ADD system if it doesn't eists
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Type WellKnownAdministrative -Verbose
 
-#Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -Verbose
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -Verbose
+# this will not work because we already have GPOEditDeleteModifySecurity which is higher than GpoEDIT
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEdit -Principal 'przemyslaw.klys' -Verbose
+#>
+Add-GPOZaurrPermission -GPOName $GPOName -Type AuthenticatedUsers -PermissionType GpoRead -Verbose #-WhatIf
 
-#$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T | Format-Table -AutoSize *
+
+#Remove-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
 #$T | Format-Table -AutoSize *

Examples/Example-16-AddRemoveGPOPermission03.ps1

@@ -0,0 +1,12 @@
+#Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Invoke-GPOZaurrPermission -Linked Root -Verbose {
+    Set-GPOOwner -Type Administrative
+    #Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'
+    #Set-GPOOwner -Principal 'Domain Admins'
+    Remove-GPOPermission -Type Administrative -IncludePermissionType GPOCustom
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
+    #Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
+} #-WhatIf #| Format-Table *

Examples/Example-16-AddRemoveGPOPermission04.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=Computers,OU=Production,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    #Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'
+    #Set-GPOOwner -Principal 'Domain Admins'
+    #Remove-GPOPermission -Type Administrative -IncludePermissionType GPOCustom
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
+    #Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
+    #Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
+} -WhatIf #| Format-Table *

Examples/Example-16-KeepPermissions.ps1

@@ -0,0 +1,42 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Apply permissions for ROOT
+Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+# Apply perrmissions for Domain Controllers
+Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+# Apply permissions for Regions, with exclusions for those 4 groups
+$Exclude = @(
+    'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+$Exclude = @(
+    'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf

Examples/Example-16-KeepPermissions02.ps1

@@ -0,0 +1,44 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Apply permissions for ROOT
+Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.pl' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates
+
+
+# Apply perrmissions for Domain Controllers
+Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates
+
+# Apply permissions for Regions, with exclusions for those 4 groups
+$Exclude = @(
+    'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates
+
+
+$Exclude = @(
+    'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates

Examples/Example-16-KeepPermissions03.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This is a bit special - I would read blog post before running this
+Invoke-GPOZaurrPermission -Verbose -Level 1 -Limit 1 {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf

Examples/Example-17-ListInconsistentACL.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
+Get-GPOZaurrPermissionConsistency -Type All | Format-Table

Examples/Example-17-RepairInconsistentACL.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz'
+
+Repair-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -Verbose #-WhatIf -Verbose

Examples/Example-17-RepairInconsistentACLAll.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrPermissionConsistency -Type All | Format-Table
+
+Repair-GPOZaurrPermissionConsistency -LimitProcessing 2 -WhatIf -Verbose

Examples/Example-18-ListInconsistenciesACLAdvanced.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
+
+$Output = Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -VerifyInheritance
+$Output | Format-Table DisplayName, DomainName, ACLConsistent, ACLConsistentInside
+$Output.ACLConsistentInsideDetails | Format-Table
+
+$Output = Get-GPOZaurrPermissionConsistency -VerifyInheritance -Type 'All'
+$Output | Format-Table

Examples/Example-19-TestSysvol.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrSysvol -Verbose | Format-Table

Examples/Example-19-TestSysvolDomainControllers.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrSysvol -VerifyDomainControllers -Verbose | Format-Table *

Examples/Example-20-RemoveOrphanedFoldersSysvol.ps1

@@ -0,0 +1,7 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# this allows you to process X amount of orphaned folders/files (good for testing)
+Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf -LimitProcessing 2 -IncludeDomains 'ad.evotec.xyz'
+
+# this runs for whole SYSVOL and checks things against GPOS
+Remove-GPOZaurrOrphanedSysvolFolders -Verbose -IncludeDomains 'ad.evotec.xyz' -BackupPath $Env:UserProfile\Desktop\MyBackup1 #-WhatIf

Examples/Example-21-ListLegacyADMFiles.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLegacyFiles | Format-Table -AutoSize

Examples/Example-22-RemoveLegacyADMFiles.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Remove-GPOZaurrLegacyFiles -Verbose -BackupPath $Env:USERPROFILE\Desktop\BackupADM -BackupDated -RemoveEmptyFolders #-WhatIf #-LimitProcessing 2 -WhatIf

Examples/Example-23-Links.ps1

@@ -0,0 +1,14 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Get-GPOZaurrLinkSummary | Format-Table *
+#Get-GPOZaurrLinkSummary -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'MultipleLinks' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'OneLink' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'LinksSummary' -UnlimitedProperties | Format-Table *
+
+$Report = Get-GPOZaurrLinkSummary #-UnlimitedProperties
+$Report | Format-Table *
+$Report.MultipleLinks | Format-Table *
+$Report.OneLink | Format-Table *
+$Report.LinksSummary | Format-Table *

Examples/Example-24-Links02.ps1

@@ -0,0 +1,12 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Report = Get-GPOZaurrLinkSummary -Report OneLink
+$Report | Format-Table
+$AffectedGPOs = foreach ($GPO in $Report) {
+    if ($GPO.Level1 -gt 1) {
+        $GPO
+    }
+}
+
+$AffectedGPOs | Format-Table *

Examples/Example-25-ListSysVolFiles.ps1

@@ -0,0 +1,6 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrFiles -Type All | Out-HtmlView -ScrollX -Filtering -AllProperties
+Get-GPOZaurrFiles -HashAlgorithm MD5 | Select-Object -First 2 | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOListFiles.xlsx -AllProperties -ExcelWorkSheetName 'Files Just 2' -AutoFilter -AutoFit #-OpenWorkBook
+Get-GPOZaurrFiles -Type All -HashAlgorithm SHA256 | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOListFiles.xlsx -AllProperties -ExcelWorkSheetName 'Files All' -AutoFilter -AutoFit #-OpenWorkBook

Examples/Example-26-Files.ps1

@@ -0,0 +1,10 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Output = Get-GPOZaurrSysvol | ForEach-Object {
+    $Path = $_.Path
+    Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File | ForEach-Object {
+        Get-FileMetaData -File $_ -Signature -HashAlgorithm 'SHA256'
+    }
+}
+$Output | Format-Table

Examples/Example-28-SaveGPO.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport -DeleteExisting
+Save-GPOZaurrFiles -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' #-DeleteExisting

Examples/Example-29-FindGPO-FromDisk-Notranslation.ps1

@@ -0,0 +1,34 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
+#$OutputNoTranslation = Invoke-GPOZaurr -GPOPath $Env:UserProfile\Desktop\GPOExport -NoTranslation
+#$OutputNoTranslation = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
+$OutputNoTranslation | Format-Table *
+
+<#
+New-HTML {
+    foreach ($GPOCategory in $OutputNoTranslation.Keys) {
+        New-HTMLTab -Name $GPOCategory {
+            if ($OutputNoTranslation["$GPOCategory"] -is [System.Collections.IDictionary]) {
+                foreach ($GpoSettings in $OutputNoTranslation["$GPOCategory"].Keys) {
+                    New-HTMLTab -Name $GpoSettings {
+                        New-HTMLTable -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+                    }
+                }
+            } else {
+                New-HTMLTable -DataTable $OutputNoTranslation[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+            }
+        }
+    }
+} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-NoTranslationFromDisk.html
+
+#>
+foreach ($GPOCategory in $OutputNoTranslation.Keys) {
+    if ($OutputNoTranslation["$GPOCategory"] -is [System.Collections.IDictionary]) {
+        foreach ($GpoSettings in $OutputNoTranslation["$GPOCategory"].Keys) {
+            ConvertTo-Excel -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -AllProperties -ExcelWorkSheetName $GpoSettings -FilePath $Env:UserProfile\Desktop\Export\$GpoSettings.xlsx -AutoFilter -AutoFit
+        }
+    } else {
+        ConvertTo-Excel -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -AllProperties -ExcelWorkSheetName $GpoSettings -FilePath $Env:UserProfile\Desktop\Export\$GpoSettings.xlsx -AutoFilter -AutoFit
+    }
+}

Examples/Example-29-FindGPO0.ps1

@@ -0,0 +1,47 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Invoke-GPOZaurr -OutputType Excel, Object, HTML -Open | Format-Table
+#$Output = Invoke-GPOZaurr -GPOPath $Env:USERPROFILE\Desktop\GPOExport -NoTranslation #| Format-Table
+#$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTestRegistryCheck' -NoTranslation
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation -Verbose
+#$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' -NoTranslation #-OutputType HTML, Object -Open #| Format-Table
+#$Output.Categories | Out-HtmlView
+#$Output.Categories | Format-Table
+$Output | Format-Table
+#$Output.CategoriesFull | Format-Table
+#$Output.Count
+
+$Output.Reports | Format-Table
+#$Output.Reports.Scripts | Format-Table *
+#$Output.Reports.AccountPolicies | Format-Table *
+#$Output.Reports.Audit | Format-Table *
+#$Output.Reports.Autologon | Format-Table *
+#$Output.Reports.EventLog | Format-Table *
+#$Output.Reports.SoftwareInstallation | Format-Table *
+#$Output.Reports.Policies | Format-Table *
+#Output.Reports.RegistrySettings | Format-Table *
+#$Output.Reports.SecurityOptions | Format-Table *
+#$Output.Reports.SystemServices | Format-Table *
+#$Output.Reports.SystemServicesNT | Format-Table *
+#$Output.Reports.LocalUsers | Format-Table *
+#$Output.Reports.LocalGroups | Format-Table *
+#$Output.Reports.DriveMapping | Format-Table *
+#$Output.Reports.Printers | Format-Table *
+$Output.Reports.TaskScheduler | Format-Table *
+return
+# This is section that treats 1 GPO as single object - if there are 5 scripts in 1 GPO there's only one value
+
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation -SingleObject
+#$Output
+#$Output.Reports | Format-Table
+#$Output.Reports.Scripts | Format-Table *
+#$Output.Reports.SoftwareInstallation | Format-Table *
+#$Output.Reports.Policies | Format-Table *
+#$Output.Reports.RegistrySettings | Format-Table *
+#$Output.Reports.SecurityOptions | Format-Table *
+#$Output.Reports.SystemServices | Format-Table *
+#$Output.Reports.SystemServicesNT | Format-Table *
+#$Output.Reports.LocalUsers | Format-Table *
+#$Output.Reports.LocalGroups | Format-Table *
+#$Output.Reports.DriveMapping | Format-Table *
+$Output.Reports.Printers | Format-Table *

Examples/Example-29-FindGPO1.ps1

@@ -0,0 +1,20 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Output = Invoke-GPOZaurr #-NoTranslation
+$Output | Format-Table
+
+New-HTML {
+    foreach ($GPOCategory in $Output.Keys) {
+        New-HTMLTab -Name $GPOCategory {
+            if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
+                foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
+                    New-HTMLTab -Name $GpoSettings {
+                        New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+                    }
+                }
+            } else {
+                New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+            }
+        }
+    }
+} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO.html

Examples/Example-29-FindGPO2-NoTranslation.ps1

@@ -0,0 +1,20 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Output = Invoke-GPOZaurr -NoTranslation
+$Output | Format-Table
+
+New-HTML {
+    foreach ($GPOCategory in $Output.Keys) {
+        New-HTMLTab -Name $GPOCategory {
+            if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
+                foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
+                    New-HTMLTab -Name $GpoSettings {
+                        New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+                    }
+                }
+            } else {
+                New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+            }
+        }
+    }
+} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-NoTranslation.html

Examples/Example-29-FindGPO3-FromDisk.ps1

@@ -0,0 +1,22 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
+
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' # -NoTranslation
+$Output | Format-Table *
+
+New-HTML {
+    foreach ($GPOCategory in $Output.Keys) {
+        New-HTMLTab -Name $GPOCategory {
+            if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
+                foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
+                    New-HTMLTab -Name $GpoSettings {
+                        New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+                    }
+                }
+            } else {
+                New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
+            }
+        }
+    }
+} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-FromDisk.html

Examples/Example-29-FindGPOFromDiskWork.ps1

@@ -0,0 +1,25 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
+
+$OutputTranslation = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport'
+$OutputTranslation | Format-Table
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' -NoTranslation
+$Output | Format-Table *
+
+#$Output.LugsSettings.LocalUsersAndGroups | Format-List *
+
+$GPOEntry = $Output.LugsSettings.LocalUsersAndGroups[0]
+
+$CreateGPO = @{}
+foreach ($User in $GPOEntry.User) {
+    # $User | Format-Table
+    # $User.Properties | Format-Table
+}
+
+
+foreach ($Group in $GPOEntry.Group) {
+    #$Group | Format-Table
+    $Group.Properties | Format-Table
+    $Group.Properties.Members | Format-Table
+}

Examples/Example-29-FindGPOHtmlOutput.ps1

@@ -0,0 +1,6 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
+
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
+$Output | Format-Table *

Examples/Example-29-FindGPOTranslationHelp.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This is purely for building GPO Dictionary, mostly for development needs to help asses what is there
+
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
+#$Output | Format-Table *
+
+$LookingFor = $Output | Select-GPOTranslation -Category 'SecuritySettings' -Settings 'UserRightsAssignment'
+$LookingFor | Format-Table
+$LookingFor.Types | Format-Table
+#$LookingFor.Data | Format-Table

Examples/Example-30-AssesSyvolFiles.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Files = Get-GPOZaurrFiles -Limited -Signature
+$Files | ConvertTo-Excel -OpenWorkBook -FilePath $Env:USERPROFILE\Desktop\GPOTesting.xlsx -ExcelWorkSheetName 'GPO Output' -AutoFilter -AutoFit -FreezeTopRowFirstColumn

Examples/Example-30-FindPolicyDefinitions.ps1

@@ -0,0 +1,6 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Policies = Get-GPOZaurrFilesPolicyDefinitions -Signature
+$Policies | Format-Table
+#$Policies.FilesToDelete | Format-Table *
+$Policies['ad.evotec.xyz'] | Format-Table *

Examples/Example-31-FindAndRemoveEmptyFolders.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrEmptyFolders | Where-Object { $_.Name -eq 'Adm' } | Format-Table *
+
+Remove-GPOZaurrEmptyFolders -Folders Adm -Verbose -LimitProcessing 1

GPOZaurr.psd1

@@ -1,27 +1,27 @@
 @{
-    AliasesToExport      = ''
+    AliasesToExport      = 'Find-GPO'
     Author               = 'Przemyslaw Klys'
     CompanyName          = 'Evotec'
     CompatiblePSEditions = 'Desktop'
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
-    Description          = 'Group Policy Eater'
-    FunctionsToExport    = 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLink', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOZaurrOwner'
+    Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
+    FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrEmptyFolders', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinitions', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrEmptyFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Select-GPOTranslation', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.19'
+    ModuleVersion        = '0.0.48'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
-            Tags                       = 'Windows', 'ActiveDirectory', 'GPO'
+            Tags                       = 'Windows', 'ActiveDirectory', 'GPO', 'GroupPolicy'
             ProjectUri                 = 'https://github.com/EvotecIT/GPOZaurr'
             ExternalModuleDependencies = 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
         }
     }
     RequiredModules      = @{
-        ModuleVersion = '0.0.135'
+        ModuleVersion = '0.0.160'
         ModuleName    = 'PSSharedGoods'
         Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
     }, @{
-        ModuleVersion = '0.0.48'
+        ModuleVersion = '0.0.63'
         ModuleName    = 'ADEssentials'
         Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
     }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'

Private/ConvertTo-XMLAccountPolicy.ps1

@@ -0,0 +1,39 @@
+function ConvertTo-XMLAccountPolicy {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO
+    )
+    $CreateGPO = [ordered]@{
+        DisplayName           = $GPO.DisplayName
+        DomainName            = $GPO.DomainName
+        GUID                  = $GPO.GUID
+        GpoType               = $GPO.GpoType
+        #GpoCategory = $GPOEntry.GpoCategory
+        #GpoSettings = $GPOEntry.GpoSettings
+        ClearTextPassword     = 'Not Set'
+        LockoutBadCount       = 'Not Set'
+        LockoutDuration       = 'Not Set'
+        MaximumPasswordAge    = 'Not Set'
+        MinimumPasswordAge    = 'Not Set'
+        MinimumPasswordLength = 'Not Set'
+        PasswordComplexity    = 'Not Set'
+        PasswordHistorySize   = 'Not Set'
+        ResetLockoutCount     = 'Not Set'
+        MaxClockSkew          = 'Not Set'
+        MaxRenewAge           = 'Not Set'
+        MaxServiceAge         = 'Not Set'
+        MaxTicketAge          = 'Not Set'
+        TicketValidateClient  = 'Not Set'
+    }
+    foreach ($GPOEntry in $GPO.DataSet) {
+        if ($GPOEntry.SettingBoolean) {
+            $CreateGPO[$($GPOEntry.Name)] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { 'Not set' };
+        } elseif ($GPOEntry.SettingNumber) {
+            $CreateGPO[$($GPOEntry.Name)] = $GPOEntry.SettingNumber
+        }
+    }
+    $CreateGPO['Linked'] = $GPO.Linked
+    $CreateGPO['LinksCount'] = $GPO.LinksCount
+    $CreateGPO['Links'] = $GPO.Links
+    [PSCustomObject] $CreateGPO
+}

Private/ConvertTo-XMLAudit.ps1

@@ -0,0 +1,42 @@
+function ConvertTo-XMLAudit {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $FullObject
+    )
+    $CreateGPO = [ordered]@{
+        DisplayName          = $GPO.DisplayName
+        DomainName           = $GPO.DomainName
+        GUID                 = $GPO.GUID
+        GpoType              = $GPO.GpoType
+        #GpoCategory = $GPOEntry.GpoCategory
+        #GpoSettings = $GPOEntry.GpoSettings
+        AuditAccountLogon    = 'No auditing'
+        AuditAccountManage   = 'No auditing'
+        AuditDSAccess        = 'No auditing'
+        AuditLogonEvents     = 'No auditing'
+        AuditObjectAccess    = 'No auditing'
+        AuditPolicyChange    = 'No auditing'
+        AuditPrivilegeUse    = 'No auditing'
+        AuditProcessTracking = 'No auditing'
+        AuditSystemEvents    = 'No auditing'
+    }
+    foreach ($GPOEntry in $GPO.DataSet) {
+        $SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null };
+        $FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null };
+        if ($SuccessAttempts -and $FailureAttempts) {
+            $Setting = 'Success, Failure'
+        } elseif ($SuccessAttempts) {
+            $Setting = 'Success'
+        } elseif ($FailureAttempts) {
+            $Setting = 'Failure'
+        } else {
+            $Setting = 'No auditing'
+        }
+        $CreateGPO["$($GPOEntry.Name)"] = $Setting
+    }
+    $CreateGPO['Linked'] = $GPO.Linked
+    $CreateGPO['LinksCount'] = $GPO.LinksCount
+    $CreateGPO['Links'] = $GPO.Links
+    [PSCustomObject] $CreateGPO
+}

Private/ConvertTo-XMLDriveMapSettings.ps1

@@ -0,0 +1,75 @@
+function ConvertTo-XMLDriveMapSettings {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Entry in $GPO.DataSet.Drive) {
+            [PSCustomObject] @{
+                Changed         = [DateTime] $Entry.changed
+                #uid             = $Entry.uid
+                GPOSettingOrder = $Entry.GPOSettingOrder
+                Filter          = $Entry.Filter
+
+                Name            = $Entry.Name
+                Status          = $Entry.status
+                Action          = $Script:Actions["$($Entry.Properties.action)"]
+                ThisDrive       = $Entry.Properties.thisDrive
+                AllDrives       = $Entry.Properties.allDrives
+                UserName        = $Entry.Properties.userName
+                Path            = $Entry.Properties.path
+                Label           = $Entry.Properties.label
+                Persistent      = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
+                UseLetter       = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
+                Letter          = $Entry.Properties.letter
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Entry in $GPO.DataSet.Drive) {
+            $CreateGPO = [ordered]@{
+                DisplayName     = $GPO.DisplayName
+                DomainName      = $GPO.DomainName
+                GUID            = $GPO.GUID
+                GpoType         = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                Changed         = [DateTime] $Entry.changed
+                #uid             = $Entry.uid
+                GPOSettingOrder = $Entry.GPOSettingOrder
+                Filter          = $Entry.Filter
+
+                Name            = $Entry.Name
+                Status          = $Entry.status
+                Action          = $Script:Actions["$($Entry.Properties.action)"]
+                ThisDrive       = $Entry.Properties.thisDrive
+                AllDrives       = $Entry.Properties.allDrives
+                UserName        = $Entry.Properties.userName
+                Path            = $Entry.Properties.path
+                Label           = $Entry.Properties.label
+                Persistent      = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
+                UseLetter       = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
+                Letter          = $Entry.Properties.letter
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLEventLog.ps1

@@ -0,0 +1,51 @@
+function ConvertTo-XMLEventLog {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO
+    )
+    $RetionPeriod = @{
+        '0' = 'Overwrite events as needed'
+        '1' = 'Overwrite events by days'
+        '2' = 'Do not overwrite events (Clear logs manually)'
+    }
+    $CreateGPO = [ordered]@{
+        DisplayName                        = $GPO.DisplayName
+        DomainName                         = $GPO.DomainName
+        GUID                               = $GPO.GUID
+        GpoType                            = $GPO.GpoType
+        #GpoCategory = $GPOEntry.GpoCategory
+        #GpoSettings = $GPOEntry.GpoSettings
+        ApplicationAuditLogRetentionPeriod = $null
+        ApplicationMaximumLogSize          = $null
+        ApplicationRestrictGuestAccess     = $null
+        ApplicationRetentionDays           = $null
+        SystemAuditLogRetentionPeriod      = $null
+        SystemMaximumLogSize               = $null
+        SystemRestrictGuestAccess          = $null
+        SystemRetentionDays                = $null
+        SecurityAuditLogRetentionPeriod    = $null
+        SecurityMaximumLogSize             = $null
+        SecurityRestrictGuestAccess        = $null
+        SecurityRetentionDays              = $null
+    }
+    foreach ($GPOEntry in $GPO.DataSet) {
+        if ($GPOEntry.SettingBoolean) {
+            $CreateGPO["$($GPOEntry.Log)$($GPOEntry.Name)"] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { 'Not set' };
+        } elseif ($GPOEntry.SettingNumber) {
+            if ($GPOEntry.Name -eq 'AuditLogRetentionPeriod') {
+                if ($GPOEntry.SettingNumber) {
+                    $CreateGPO["$($GPOEntry.Log)$($GPOEntry.Name)"] = $RetionPeriod[$($GPOEntry.SettingNumber)]
+                } else {
+                    # Won't happen?
+                    $CreateGPO["$($GPOEntry.Log)$($GPOEntry.Name)"] = $GPOEntry.SettingNumber
+                }
+            } else {
+                $CreateGPO["$($GPOEntry.Log)$($GPOEntry.Name)"] = $GPOEntry.SettingNumber
+            }
+        }
+    }
+    $CreateGPO['Linked'] = $GPO.Linked
+    $CreateGPO['LinksCount'] = $GPO.LinksCount
+    $CreateGPO['Links'] = $GPO.Links
+    [PSCustomObject] $CreateGPO
+}

Private/ConvertTo-XMLLocalGroups.ps1

@@ -0,0 +1,126 @@
+function ConvertTo-XMLLocalGroups {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        if (-not $GPO.DataSet.Group) {
+            continue
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Group in $GPO.DataSet.Group) {
+            # We're mostly interested in Members
+            [Array] $Members = foreach ($Member in $Group.Properties.Members.Member) {
+                [ordered] @{
+                    MemberName   = $Member.Name
+                    MemberAction = $Member.Action
+                    MemberSID    = $Member.SID
+                }
+            }
+            # if we have no members we create dummy object to make sure we can use foreach below
+            if ($Members.Count -eq 0) {
+                $Members = @(
+                    [ordered] @{
+                        MemberName   = $null
+                        MemberAction = $null
+                        MemberSID    = $null
+                    }
+                )
+            }
+            foreach ($Member in $Members) {
+                $GroupObject = [ordered]@{
+                    Changed         = [DateTime] $Group.Changed
+                    GPOSettingOrder = $Group.GPOSettingOrder
+                    Name            = $Group.name
+                    Action          = $Script:Actions["$($Group.Properties.action)"]
+                    GroupName       = $Group.Properties.groupName       #: Administrators (built -in )
+                    NewName         = $Group.Properties.newName         #:
+                    Description     = $Group.Properties.description     #:
+                    DeleteAllUsers  = if ($Group.Properties.deleteAllUsers -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllUsers -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllUsers };
+                    DeleteAllGroups = if ($Group.Properties.deleteAllGroups -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllGroups -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllGroups };
+                    RemoveAccounts  = if ($Group.Properties.removeAccounts -eq '1') { 'Enabled' } elseif ($Group.Properties.removeAccounts -eq '0') { 'Disabled' } else { $Group.Properties.removeAccounts };
+                    GroupSid        = $Group.Properties.groupSid        #: S - 1 - 5 - 32 - 544
+                }
+                $Last = [ordered] @{
+                    #Uid                                   = $Group.uid             #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
+                    RunInLoggedOnUserSecurityContext      = if ($Group.userContext -eq '1') { 'Enabled' } elseif ($Group.userContext -eq '0') { 'Disabled' } else { $Group.userContext };
+                    RemoveThisItemWhenItIsNoLongerApplied = if ($Group.removePolicy -eq '1') { 'Enabled' } elseif ($Group.removePolicy -eq '0') { 'Disabled' } else { $Group.removePolicy };
+                    Filters                               = $Group.Filters         #::
+                }
+                # Merging GPO with Member
+                $GroupObject = $GroupObject + $Member + $Last
+                [PSCustomObject] $GroupObject
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Group in $GPO.DataSet.Group) {
+            # We're mostly interested in Members
+            [Array] $Members = foreach ($Member in $Group.Properties.Members.Member) {
+                [ordered] @{
+                    MemberName   = $Member.Name
+                    MemberAction = $Member.Action
+                    MemberSID    = $Member.SID
+                }
+            }
+            # if we have no members we create dummy object to make sure we can use foreach below
+            if ($Members.Count -eq 0) {
+                $Members = @(
+                    [ordered] @{
+                        MemberName   = $null
+                        MemberAction = $null
+                        MemberSID    = $null
+                    }
+                )
+            }
+            foreach ($Member in $Members) {
+                $CreateGPO = [ordered]@{
+                    DisplayName     = $GPO.DisplayName
+                    DomainName      = $GPO.DomainName
+                    GUID            = $GPO.GUID
+                    GpoType         = $GPO.GpoType
+                    #GpoCategory          = $GPO.GpoCategory   #: SecuritySettings
+                    #GpoSettings          = $GPO.GpoSettings   #: SecurityOptions
+                    Changed         = [DateTime] $Group.Changed
+                    GPOSettingOrder = $Group.GPOSettingOrder
+                    Name            = $Group.name
+                    Action          = $Script:Actions["$($Group.Properties.action)"]
+                    GroupName       = $Group.Properties.groupName       #: Administrators (built -in )
+                    NewName         = $Group.Properties.newName         #:
+                    Description     = $Group.Properties.description     #:
+                    DeleteAllUsers  = if ($Group.Properties.deleteAllUsers -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllUsers -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllUsers };
+                    DeleteAllGroups = if ($Group.Properties.deleteAllGroups -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllGroups -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllGroups };
+                    RemoveAccounts  = if ($Group.Properties.removeAccounts -eq '1') { 'Enabled' } elseif ($Group.Properties.removeAccounts -eq '0') { 'Disabled' } else { $Group.Properties.removeAccounts };
+                    GroupSid        = $Group.Properties.groupSid        #: S - 1 - 5 - 32 - 544
+                }
+                $Last = [ordered] @{
+                    # Uid                                   = $Group.uid             #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
+                    RunInLoggedOnUserSecurityContext      = if ($Group.userContext -eq '1') { 'Enabled' } elseif ($Group.userContext -eq '0') { 'Disabled' } else { $Group.userContext };
+                    RemoveThisItemWhenItIsNoLongerApplied = if ($Group.removePolicy -eq '1') { 'Enabled' } elseif ($Group.removePolicy -eq '0') { 'Disabled' } else { $Group.removePolicy };
+                    Filters                               = $Group.Filters         #::
+                }
+                # Merging GPO with Member
+                $CreateGPO = $CreateGPO + $Member + $Last
+                $CreateGPO['Linked'] = $GPO.Linked
+                $CreateGPO['LinksCount'] = $GPO.LinksCount
+                $CreateGPO['Links'] = $GPO.Links
+                [PSCustomObject] $CreateGPO
+            }
+        }
+    }
+}

Private/ConvertTo-XMLLocalUser.ps1

@@ -0,0 +1,74 @@
+function ConvertTo-XMLLocalUser {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        if (-not $GPO.DataSet.User) {
+            continue
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($User in $GPO.DataSet.User) {
+            [PSCustomObject] @{
+                Changed                       = [DateTime] $User.Changed
+                GPOSettingOrder               = $User.GPOSettingOrder
+                Action                        = $Script:Actions["$($User.Properties.action)"]
+                UserName                      = $User.Properties.userName
+                NewName                       = $User.Properties.newName
+                FullName                      = $User.Properties.fullName
+                Description                   = $User.Properties.description
+                Password                      = $User.Properties.cpassword
+                MustChangePasswordAtNextLogon = if ($User.Properties.changeLogon -eq '1') { $true } elseif ($User.Properties.changeLogon -eq '0') { $false } else { $User.Properties.changeLogon };
+                CannotChangePassword          = if ($User.Properties.noChange -eq '1') { $true } elseif ($User.Properties.noChange -eq '0') { $false } else { $User.Properties.noChange };
+                PasswordNeverExpires          = if ($User.Properties.neverExpires -eq '1') { $true } elseif ($User.Properties.neverExpires -eq '0') { $false } else { $User.Properties.neverExpires };
+                AccountIsDisabled             = if ($User.Properties.acctDisabled -eq '1') { $true } elseif ($User.Properties.acctDisabled -eq '0') { $false } else { $User.Properties.acctDisabled };
+                AccountExpires                = try { [DateTime] $User.Properties.expires } catch { $User.Properties.expires };
+                SubAuthority                  = $User.Properties.subAuthority
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($User in $GPO.DataSet.User) {
+            $CreateGPO = [ordered]@{
+                DisplayName                   = $GPO.DisplayName
+                DomainName                    = $GPO.DomainName
+                GUID                          = $GPO.GUID
+                GpoType                       = $GPO.GpoType
+                #GpoCategory      = $GPO.GpoCategory   #: SecuritySettings
+                #GpoSettings      = $GPO.GpoSettings   #: SecurityOptions
+                Changed                       = [DateTime] $User.Changed
+                GPOSettingOrder               = $User.GPOSettingOrder
+                Action                        = $Script:Actions["$($User.Properties.action)"]
+                UserName                      = $User.Properties.userName
+                NewName                       = $User.Properties.newName
+                FullName                      = $User.Properties.fullName
+                Description                   = $User.Properties.description
+                Password                      = $User.Properties.cpassword
+                MustChangePasswordAtNextLogon = if ($User.Properties.changeLogon -eq '1') { $true } elseif ($User.Properties.changeLogon -eq '0') { $false } else { $User.Properties.changeLogon };
+                CannotChangePassword          = if ($User.Properties.noChange -eq '1') { $true } elseif ($User.Properties.noChange -eq '0') { $false } else { $User.Properties.noChange };
+                PasswordNeverExpires          = if ($User.Properties.neverExpires -eq '1') { $true } elseif ($User.Properties.neverExpires -eq '0') { $false } else { $User.Properties.neverExpires };
+                AccountIsDisabled             = if ($User.Properties.acctDisabled -eq '1') { $true } elseif ($User.Properties.acctDisabled -eq '0') { $false } else { $User.Properties.acctDisabled };
+                AccountExpires                = try { [DateTime] $User.Properties.expires } catch { $User.Properties.expires };
+                SubAuthority                  = $User.Properties.subAuthority
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLPolicies.ps1

@@ -0,0 +1,61 @@
+function ConvertTo-XMLPolicies {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings        = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Policy in $GPO.DataSet) {
+            [PSCustomObject] @{
+                PolicyName         = $Policy.Name
+                PolicyState        = $Policy.State
+                PolicyCategory     = $Policy.Category
+                PolicySupported    = $Policy.Supported
+                PolicyExplain      = $Policy.Explain
+                PolicyText         = $Policy.Text
+                PolicyCheckBox     = $Policy.CheckBox
+                PolicyDropDownList = $Policy.DropDownList
+                PolicyEditText     = $Policy.EditText
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Policy in $GPO.DataSet) {
+            $CreateGPO = [ordered]@{
+                DisplayName        = $GPO.DisplayName
+                DomainName         = $GPO.DomainName
+                GUID               = $GPO.GUID
+                GpoType            = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                PolicyName         = $Policy.Name
+                PolicyState        = $Policy.State
+                PolicyCategory     = $Policy.Category
+                PolicySupported    = $Policy.Supported
+                PolicyExplain      = $Policy.Explain
+                PolicyText         = $Policy.Text
+                PolicyCheckBox     = $Policy.CheckBox
+                PolicyDropDownList = $Policy.DropDownList
+                PolicyEditText     = $Policy.EditText
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLPrinter.ps1

@@ -0,0 +1,51 @@
+function ConvertTo-XMLPrinter {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = @(
+            foreach ($Type in @('SharedPrinter', 'PortPrinter', 'LocalPrinter')) {
+                foreach ($Entry in $GPO.DataSet.$Type) {
+                    if ($Entry) {
+                        ConvertTo-XMLPrinterInternal -GPO $GPO -Entry $Entry -Type $Type -Limited
+                    }
+                }
+            }
+            if ($GPO.GpoCategory -eq 'PrinterConnectionSettings') {
+                foreach ($Entry in $GPO.DataSet) {
+                    ConvertTo-XMLPrinterInternal -GPO $GPO -Entry $Entry -Type 'PrinterConnections' -Limited
+                }
+            }
+        )
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Type in @('SharedPrinter', 'PortPrinter', 'LocalPrinter')) {
+            foreach ($Entry in $GPO.DataSet.$Type) {
+                if ($Entry) {
+                    ConvertTo-XMLPrinterInternal -GPO $GPO -Entry $Entry -Type $Type
+                }
+            }
+        }
+        if ($GPO.GpoCategory -eq 'PrinterConnectionSettings') {
+            foreach ($Entry in $GPO.DataSet) {
+                ConvertTo-XMLPrinterInternal -GPO $GPO -Entry $Entry -Type 'PrinterConnections'
+            }
+        }
+    }
+}

Private/ConvertTo-XMLPrinterInternal.ps1

@@ -0,0 +1,95 @@
+function ConvertTo-XMLPrinterInternal {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        $Entry,
+        $Type,
+        [switch] $Limited
+    )
+    if ($Limited) {
+        $CreateGPO = [ordered]@{
+            Changed              = try { [DateTime] $Entry.changed } catch { $Entry.Changed };
+            #uid             = $Entry.uid
+            BypassErrors         = if ($Entry.bypassErrors -eq '1') { $true } elseif ($Entry.bypassErrors -eq '0') { $false } else { $Entry.bypassErrors };
+            GPOSettingOrder      = $Entry.GPOSettingOrder
+            Filter               = $Entry.Filter
+            type                 = $Type
+            Action               = $null #$Script:Actions["$($Entry.Properties.action)"]
+            Comment              = $Entry.Properties.comment
+            Path                 = if ($Entry.Properties.path) { $Entry.Properties.Path } elseif ($Entry.Path) { $Entry.Path } else { '' }
+            Location             = $Entry.Properties.location
+
+            HostName             = $Entry.Properties.ipAddress     #: 10.42.20.204
+            LocalName            = $Entry.Properties.localName     #: CZ02PRT00017
+            UseDNS               = if ($Entry.Properties.useDNS -eq '1') { $true } elseif ($Entry.Properties.useDNS -eq '0') { $false } else { $Entry.Properties.useDNS };
+            UseIPv6              = if ($Entry.Properties.useIPv6 -eq '1') { $true } elseif ($Entry.Properties.useIPv6 -eq '0') { $false } else { $Entry.Properties.useIPv6 };
+            Default              = if ($Entry.Properties.default -eq '1') { $true } elseif ($Entry.Properties.default -eq '0') { $false } else { $Entry.Properties.default };
+            SkipLocal            = if ($Entry.Properties.skipLocal -eq '1') { $true } elseif ($Entry.Properties.skipLocal -eq '0') { $false } else { $Entry.Properties.skipLocal };
+            DeleteAllShared      = if ($Entry.Properties.deleteAll -eq '1') { $true } elseif ($Entry.Properties.deleteAll -eq '0') { $false } else { $Entry.Properties.deleteAll };
+            Persistent           = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
+            DeleteMaps           = if ($Entry.Properties.deleteMaps -eq '1') { $true } elseif ($Entry.Properties.deleteMaps -eq '0') { $false } else { $Entry.Properties.deleteMaps };
+            LPRSettingsQueueName = $Entry.Properties.lprQueue      #:
+
+            Protocol             = $Entry.Properties.protocol      #: PROTOCOL_RAWTCP_TYPE
+            PortNumber           = if ($Entry.Properties.portNumber) { $Entry.Properties.portNumber } else { $Entry.Properties.port }
+            DoubleSpool          = if ($Entry.Properties.doubleSpool -eq '1') { $true } elseif ($Entry.Properties.doubleSpool -eq '0') { $false } else { $Entry.Properties.doubleSpool };
+
+            SNMPEnabled          = if ($Entry.Properties.snmpEnabled -eq '1') { $true } elseif ($Entry.Properties.snmpEnabled -eq '0') { $false } else { $Entry.Properties.snmpEnabled };
+            SNMPCommunityName    = $Entry.Properties.snmpCommunity #: public
+            SNMPDeviceIndex      = $Entry.Properties.snmpDevIndex  #: 1
+        }
+        if ($Entry.Properties.Action) {
+            $CreateGPO['Action'] = $Script:Actions["$($Entry.Properties.action)"]
+        } else {
+            $CreateGPO['Action'] = 'Deploy'
+        }
+        [PSCustomObject] $CreateGPO
+    } else {
+        $CreateGPO = [ordered]@{
+            DisplayName          = $GPO.DisplayName
+            DomainName           = $GPO.DomainName
+            GUID                 = $GPO.GUID
+            GpoType              = $GPO.GpoType
+            GpoCategory          = $GPO.GpoCategory
+            GpoSettings          = $GPO.GpoSettings
+            Changed              = try { [DateTime] $Entry.changed } catch { $Entry.Changed };
+            #uid             = $Entry.uid
+            BypassErrors         = if ($Entry.bypassErrors -eq '1') { $true } elseif ($Entry.bypassErrors -eq '0') { $false } else { $Entry.bypassErrors };
+            GPOSettingOrder      = $Entry.GPOSettingOrder
+            Filter               = $Entry.Filter
+            type                 = $Type
+            Action               = $null #$Script:Actions["$($Entry.Properties.action)"]
+            Comment              = $Entry.Properties.comment
+            Path                 = if ($Entry.Properties.path) { $Entry.Properties.Path } elseif ($Entry.Path) { $Entry.Path } else { '' }
+            Location             = $Entry.Properties.location
+
+            HostName             = $Entry.Properties.ipAddress     #: 10.42.20.204
+            LocalName            = $Entry.Properties.localName     #: CZ02PRT00017
+            UseDNS               = if ($Entry.Properties.useDNS -eq '1') { $true } elseif ($Entry.Properties.useDNS -eq '0') { $false } else { $Entry.Properties.useDNS };
+            UseIPv6              = if ($Entry.Properties.useIPv6 -eq '1') { $true } elseif ($Entry.Properties.useIPv6 -eq '0') { $false } else { $Entry.Properties.useIPv6 };
+            Default              = if ($Entry.Properties.default -eq '1') { $true } elseif ($Entry.Properties.default -eq '0') { $false } else { $Entry.Properties.default };
+            SkipLocal            = if ($Entry.Properties.skipLocal -eq '1') { $true } elseif ($Entry.Properties.skipLocal -eq '0') { $false } else { $Entry.Properties.skipLocal };
+            DeleteAllShared      = if ($Entry.Properties.deleteAll -eq '1') { $true } elseif ($Entry.Properties.deleteAll -eq '0') { $false } else { $Entry.Properties.deleteAll };
+            Persistent           = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
+            DeleteMaps           = if ($Entry.Properties.deleteMaps -eq '1') { $true } elseif ($Entry.Properties.deleteMaps -eq '0') { $false } else { $Entry.Properties.deleteMaps };
+            LPRSettingsQueueName = $Entry.Properties.lprQueue      #:
+
+            Protocol             = $Entry.Properties.protocol      #: PROTOCOL_RAWTCP_TYPE
+            PortNumber           = if ($Entry.Properties.portNumber) { $Entry.Properties.portNumber } else { $Entry.Properties.port }
+            DoubleSpool          = if ($Entry.Properties.doubleSpool -eq '1') { $true } elseif ($Entry.Properties.doubleSpool -eq '0') { $false } else { $Entry.Properties.doubleSpool };
+
+            SNMPEnabled          = if ($Entry.Properties.snmpEnabled -eq '1') { $true } elseif ($Entry.Properties.snmpEnabled -eq '0') { $false } else { $Entry.Properties.snmpEnabled };
+            SNMPCommunityName    = $Entry.Properties.snmpCommunity #: public
+            SNMPDeviceIndex      = $Entry.Properties.snmpDevIndex  #: 1
+        }
+        if ($Entry.Properties.Action) {
+            $CreateGPO['Action'] = $Script:Actions["$($Entry.Properties.action)"]
+        } else {
+            $CreateGPO['Action'] = 'Deploy'
+        }
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-XMLRegistryAutologon.ps1

@@ -0,0 +1,49 @@
+function ConvertTo-XMLRegistryAutologon {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO
+    )
+    $CreateGPO = [ordered]@{
+        DisplayName                  = $GPO.DisplayName
+        DomainName                   = $GPO.DomainName
+        GUID                         = $GPO.GUID
+        GpoType                      = $GPO.GpoType
+        #GpoCategory = $GPOEntry.GpoCategory
+        #GpoSettings = $GPOEntry.GpoSettings
+        AutoAdminLogon               = $null
+        DefaultDomainName            = $null
+        DefaultUserName              = $null
+        DefaultPassword              = $null
+        DateChangedAutoAdminLogon    = $null
+        DateChangedDefaultDomainName = $null
+        DateChangedDefaultUserName   = $null
+        DateChangedDefaultPassword   = $null
+    }
+    foreach ($Registry in $GPO.DataSet.Registry) {
+        if ($Registry.Properties.Key -eq 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon') {
+            if ($Registry.Properties.Name -eq 'AutoAdminLogon') {
+                $CreateGPO['AutoAdminLogon'] = [bool] $Registry.Properties.value
+                $CreateGPO['DateChangedAutoAdminLogon'] = [DateTime] $Registry.changed
+            } elseif ($Registry.Properties.Name -eq 'DefaultDomainName') {
+                $CreateGPO['DefaultDomainName'] = $Registry.Properties.value
+                $CreateGPO['DateChangedDefaultDomainName'] = [DateTime] $Registry.changed
+            } elseif ($Registry.Properties.Name -eq 'DefaultUserName') {
+                $CreateGPO['DefaultUserName'] = $Registry.Properties.value
+                $CreateGPO['DateChangedDefaultUserName'] = [DateTime] $Registry.changed
+            } elseif ($Registry.Properties.Name -eq 'DefaultPassword') {
+                $CreateGPO['DefaultPassword'] = $Registry.Properties.value
+                $CreateGPO['DateChangedDefaultPassword'] = [DateTime] $Registry.changed
+            }
+        }
+    }
+    if ($null -ne $CreateGPO['AutoAdminLogon'] -or
+        $null -ne $CreateGPO['DefaultDomainName'] -or
+        $null -ne $CreateGPO['DefaultUserName'] -or
+        $null -ne $CreateGPO['DefaultPassword']
+    ) {
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-XMLRegistrySettings.ps1

@@ -0,0 +1,75 @@
+function ConvertTo-XMLRegistrySettings {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+
+        [Array] $CreateGPO['Settings'] = Get-XMLNestedRegistry -GPO $GPO -DataSet $GPO.DataSet
+        <#
+        [Array] $CreateGPO['Settings'] = foreach ($Registry in $GPO.DataSet.Registry) {
+            [PSCustomObject] @{
+                Changed         = [DateTime] $Registry.changed
+                GPOSettingOrder = $Registry.GPOSettingOrder
+                Hive            = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
+                Key             = $Registry.Properties.key  #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+                Name            = $Registry.Properties.name #: AutoAdminLogon
+                Type            = $Registry.Properties.type #: REG_SZ
+                Value           = $Registry.Properties.value #
+                Filters         = $Registry.Filters
+            }
+        }
+        #>
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        <#
+        if ($GPO.DataSet.Registry) {
+            Get-XMLNestedRegistry -GPO $GPO -RegistryCollection $GPO.DataSet.Registry
+        }
+        if ($GPO.DataSet.Collection) {
+            Get-XMLNestedRegistry -GPO $GPO -RegistryCollection $GPO.DataSet.Collection
+        }
+        #>
+        Get-XMLNestedRegistry -GPO $GPO -DataSet $GPO.DataSet
+
+        <#
+        foreach ($Registry in $GPO.DataSet.Registry) {
+            $CreateGPO = [ordered]@{
+                DisplayName     = $GPO.DisplayName
+                DomainName      = $GPO.DomainName
+                GUID            = $GPO.GUID
+                GpoType         = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                Changed         = [DateTime] $Registry.changed
+                GPOSettingOrder = $Registry.GPOSettingOrder
+                Hive            = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
+                Key             = $Registry.Properties.key  #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+                Name            = $Registry.Properties.name #: AutoAdminLogon
+                Type            = $Registry.Properties.type #: REG_SZ
+                Value           = $Registry.Properties.value #
+                Filters         = $Registry.Filters
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+        #>
+    }
+}

Private/ConvertTo-XMLScripts.ps1

@@ -0,0 +1,53 @@
+function ConvertTo-XMLScripts {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings        = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Script in $GPO.DataSet) {
+            [PSCustomObject] @{
+                Type       = $GPO.DataSet.Type
+                Command    = $GPO.DataSet.Command
+                Parameters = $GPO.DataSet.Parameters
+                Order      = $GPO.DataSet.Order
+                RunOrder   = $GPO.DataSet.RunOrder
+            }
+        }
+        $CreateGPO['DataCount'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Script in $GPO.DataSet) {
+            $CreateGPO = [ordered]@{
+                DisplayName = $GPO.DisplayName
+                DomainName  = $GPO.DomainName
+                GUID        = $GPO.GUID
+                GpoType     = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                Type        = $Script.Type
+                Command     = $Script.Command
+                Parameters  = $Script.Parameters
+                Order       = $Script.Order
+                RunOrder    = $Script.RunOrder
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLSecurityOptions.ps1

@@ -0,0 +1,65 @@
+function ConvertTo-XMLSecurityOptions {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Entry in $GPO.DataSet) {
+            $Object = [ordered] @{}
+            $Object['KeyName'] = $Entry.KeyName
+            $Object['KeyDisplayName'] = $Entry.Display.Name
+            $Object['KeyDisplayUnits'] = $Entry.Display.Units
+            $Object['KeyDisplayBoolean'] = try { [bool]::Parse($Entry.Display.DisplayBoolean) } catch { $null };
+            $Object['KeyDisplayString'] = $Entry.Display.DisplayString
+            $Object['SystemAccessPolicyName'] = $Entry.SystemAccessPolicyName
+            if ($Entry.SettingString) {
+                $Object['KeyValue'] = $Entry.SettingString
+            } else {
+                $Object['KeyValue'] = $Entry.SettingNumber
+            }
+            [PSCustomObject] $Object
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Entry in $GPO.DataSet) {
+            $CreateGPO = [ordered]@{
+                DisplayName = $GPO.DisplayName
+                DomainName  = $GPO.DomainName
+                GUID        = $GPO.GUID
+                GpoType     = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+            }
+            $CreateGPO['KeyName'] = $Entry.KeyName
+            $CreateGPO['KeyDisplayName'] = $Entry.Display.Name
+            $CreateGPO['KeyDisplayUnits'] = $Entry.Display.Units
+            $CreateGPO['KeyDisplayBoolean'] = try { [bool]::Parse($Entry.Display.DisplayBoolean) } catch { $null };
+            $CreateGPO['KeyDisplayString'] = $Entry.Display.DisplayString
+            $CreateGPO['SystemAccessPolicyName'] = $Entry.SystemAccessPolicyName
+            if ($Entry.SettingString) {
+                $CreateGPO['KeyValue'] = $Entry.SettingString
+            } else {
+                $CreateGPO['KeyValue'] = $Entry.SettingNumber
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLSoftwareInstallation.ps1

@@ -0,0 +1,87 @@
+function ConvertTo-XMLSoftwareInstallation {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($MsiInstallerr in $GPO.DataSet) {
+            [PSCustomObject] @{
+                Identifier          = $MsiInstallerr.Identifier          #: { 10495e9e-79c1-4a32-b278-a24cd495437f }
+                Name                = $MsiInstallerr.Name                #: Local Administrator Password Solution (2)
+                Path                = $MsiInstallerr.Path                #: \\area1.local\SYSVOL\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\LAPS.x64.msi
+                MajorVersion        = $MsiInstallerr.MajorVersion        #: 6
+                MinorVersion        = $MsiInstallerr.MinorVersion        #: 2
+                LanguageId          = $MsiInstallerr.LanguageId          #: 1033
+                Architecture        = $MsiInstallerr.Architecture        #: 9
+                IgnoreLanguage      = if ($MsiInstallerr.IgnoreLanguage -eq 'true') { $true } else { $false }      #: false
+                Allowx86Onia64      = if ($MsiInstallerr.Allowx86Onia64 -eq 'true') { $true } else { $false }       #: true
+                SupportURL          = $MsiInstallerr.SupportURL          #:
+                AutoInstall         = if ($MsiInstallerr.AutoInstall -eq 'true') { $true } else { $false }          #: true
+                DisplayInARP        = if ($MsiInstallerr.DisplayInARP -eq 'true') { $true } else { $false }        #: true
+                IncludeCOM          = if ($MsiInstallerr.IncludeCOM -eq 'true') { $true } else { $false }          #: true
+                SecurityDescriptor  = $MsiInstallerr.SecurityDescriptor  #: SecurityDescriptor
+                DeploymentType      = $MsiInstallerr.DeploymentType      #: Assign
+                ProductId           = $MsiInstallerr.ProductId           #: { ea8cb806-c109 - 4700 - 96b4-f1f268e5036c }
+                ScriptPath          = $MsiInstallerr.ScriptPath          #: \\area1.local\SysVol\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\Machine\Applications\ { EAC9B821-FB4D - 457A-806F-E5B528D1E41A }.aas
+                DeploymentCount     = $MsiInstallerr.DeploymentCount     #: 0
+                InstallationUILevel = $MsiInstallerr.InstallationUILevel #: Maximum
+                Upgrades            = if ($MsiInstallerr.Upgrades.Mandatory -eq 'true') { $true } else { $false }            #: Upgrades
+                UninstallUnmanaged  = if ($MsiInstallerr.UninstallUnmanaged -eq 'true') { $true } else { $false }   #: false
+                LossOfScopeAction   = $MsiInstallerr.LossOfScopeAction   #: Unmanage
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($MsiInstallerr in $GPO.DataSet) {
+            $CreateGPO = [ordered]@{
+                DisplayName         = $GPO.DisplayName
+                DomainName          = $GPO.DomainName
+                GUID                = $GPO.GUID
+                GpoType             = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                Identifier          = $MsiInstallerr.Identifier          #: { 10495e9e-79c1-4a32-b278-a24cd495437f }
+                Name                = $MsiInstallerr.Name                #: Local Administrator Password Solution (2)
+                Path                = $MsiInstallerr.Path                #: \\area1.local\SYSVOL\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\LAPS.x64.msi
+                MajorVersion        = $MsiInstallerr.MajorVersion        #: 6
+                MinorVersion        = $MsiInstallerr.MinorVersion        #: 2
+                LanguageId          = $MsiInstallerr.LanguageId          #: 1033
+                Architecture        = $MsiInstallerr.Architecture        #: 9
+                IgnoreLanguage      = if ($MsiInstallerr.IgnoreLanguage -eq 'true') { $true } else { $false }      #: false
+                Allowx86Onia64      = if ($MsiInstallerr.Allowx86Onia64 -eq 'true') { $true } else { $false }       #: true
+                SupportURL          = $MsiInstallerr.SupportURL          #:
+                AutoInstall         = if ($MsiInstallerr.AutoInstall -eq 'true') { $true } else { $false }          #: true
+                DisplayInARP        = if ($MsiInstallerr.DisplayInARP -eq 'true') { $true } else { $false }        #: true
+                IncludeCOM          = if ($MsiInstallerr.IncludeCOM -eq 'true') { $true } else { $false }          #: true
+                SecurityDescriptor  = $MsiInstallerr.SecurityDescriptor  #: SecurityDescriptor
+                DeploymentType      = $MsiInstallerr.DeploymentType      #: Assign
+                ProductId           = $MsiInstallerr.ProductId           #: { ea8cb806-c109 - 4700 - 96b4-f1f268e5036c }
+                ScriptPath          = $MsiInstallerr.ScriptPath          #: \\area1.local\SysVol\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\Machine\Applications\ { EAC9B821-FB4D - 457A-806F-E5B528D1E41A }.aas
+                DeploymentCount     = $MsiInstallerr.DeploymentCount     #: 0
+                InstallationUILevel = $MsiInstallerr.InstallationUILevel #: Maximum
+                Upgrades            = if ($MsiInstallerr.Upgrades.Mandatory -eq 'true') { $true } else { $false }            #: Upgrades
+                UninstallUnmanaged  = if ($MsiInstallerr.UninstallUnmanaged -eq 'true') { $true } else { $false }   #: false
+                LossOfScopeAction   = $MsiInstallerr.LossOfScopeAction   #: Unmanage
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLSystemServices.ps1

@@ -0,0 +1,53 @@
+function ConvertTo-XMLSystemServices {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($GPOEntry in $GPO.DataSet) {
+            [PSCustomObject] @{
+                ServiceName                = $GPOEntry.Name
+                ServiceStartUpMode         = $GPOEntry.StartUpMode
+                SecurityAuditingPresent    = try { [bool]::Parse($GPOEntry.SecurityDescriptor.AuditingPresent.'#text') } catch { $null };
+                SecurityPermissionsPresent = try { [bool]::Parse($GPOEntry.SecurityDescriptor.PermissionsPresent.'#text') } catch { $null };
+                SecurityDescriptor         = $GPOEntry.SecurityDescriptor
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($GPOEntry in $GPO.DataSet) {
+            $CreateGPO = [ordered]@{
+                DisplayName                = $GPO.DisplayName
+                DomainName                 = $GPO.DomainName
+                GUID                       = $GPO.GUID
+                GpoType                    = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                ServiceName                = $GPOEntry.Name
+                ServiceStartUpMode         = $GPOEntry.StartUpMode
+                SecurityAuditingPresent    = try { [bool]::Parse($GPOEntry.SecurityDescriptor.AuditingPresent.'#text') } catch { $null };
+                SecurityPermissionsPresent = try { [bool]::Parse($GPOEntry.SecurityDescriptor.PermissionsPresent.'#text') } catch { $null };
+                SecurityDescriptor         = $GPOEntry.SecurityDescriptor
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLSystemServicesNT.ps1

@@ -0,0 +1,106 @@
+function ConvertTo-XMLSystemServicesNT {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Service in $GPO.DataSet.NTService) {
+            [PSCustomObject] @{
+                GPOSettingOrder                      = $Service.GPOSettingOrder
+                #ServiceName          = $Service.Name
+                ServiceName                          = $Service.Properties.serviceName          #: AppIDSvc: AppIDSvc
+                ServiceStartupType                   = $Service.Properties.startupType          #: NOCHANGE: NOCHANGE
+                ServiceAction                        = $Service.Properties.serviceAction        #: START: START
+                Timeout                              = $Service.Properties.timeout              #: 50: 50
+                FirstFailure                         = $Service.Properties.firstFailure         #: REBOOT: REBOOT
+                SecondFailure                        = $Service.Properties.secondFailure        #: REBOOT: REBOOT
+                ThirdFailure                         = $Service.Properties.thirdFailure         #: REBOOT: REBOOT
+                ResetFailCountDelay                  = $Service.Properties.resetFailCountDelay  #: 0: 0
+                RestartComputerDelay                 = $Service.Properties.restartComputerDelay #: 60000: 60000
+                Filter                               = $Service.Filter
+                AccountName                          = $Service.Properties.accountName
+                AllowServiceToInteractWithTheDesktop = if ($Service.Properties.interact -eq 1) { 'Yes' } elseif ($Service.Properties.interact -eq 0) { 'No' } else { $null }
+                RunThisProgram                       = $Service.Properties.program
+                CommandLineParameters                = $Service.Properties.args
+                AppendFailCountToEndOfCommandLine    = if ($Service.Properties.append -eq 1) { 'Yes' } elseif ($Service.Properties.append -eq 0) { 'No' } else { $null }
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Service in $GPO.DataSet.NTService) {
+            $CreateGPO = [ordered]@{
+                DisplayName                          = $GPO.DisplayName
+                DomainName                           = $GPO.DomainName
+                GUID                                 = $GPO.GUID
+                GpoType                              = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                GPOSettingOrder                      = $Service.GPOSettingOrder
+                #ServiceName          = $Service.Name
+                ServiceName                          = $Service.Properties.serviceName          #: AppIDSvc: AppIDSvc
+                ServiceStartupType                   = $Service.Properties.startupType          #: NOCHANGE: NOCHANGE
+                ServiceAction                        = $Service.Properties.serviceAction        #: START: START
+                Timeout                              = $Service.Properties.timeout              #: 50: 50
+                FirstFailure                         = $Service.Properties.firstFailure         #: REBOOT: REBOOT
+                SecondFailure                        = $Service.Properties.secondFailure        #: REBOOT: REBOOT
+                ThirdFailure                         = $Service.Properties.thirdFailure         #: REBOOT: REBOOT
+                ResetFailCountDelay                  = $Service.Properties.resetFailCountDelay  #: 0: 0
+                RestartComputerDelay                 = $Service.Properties.restartComputerDelay #: 60000: 60000
+                Filter                               = $Service.Filter
+                AccountName                          = $Service.Properties.accountName
+                AllowServiceToInteractWithTheDesktop = if ($Service.Properties.interact -eq 1) { 'Yes' } elseif ($Service.Properties.interact -eq 0) { 'No' } else { $null }
+                RunThisProgram                       = $Service.Properties.program
+                CommandLineParameters                = $Service.Properties.args
+                AppendFailCountToEndOfCommandLine    = if ($Service.Properties.append -eq 1) { 'Yes' } elseif ($Service.Properties.append -eq 0) { 'No' } else { $null }
+                <#$
+
+                startupType         : NOCHANGE
+                serviceName         : AudioEndpointBuilder
+                timeout             : 30
+                accountName         : LocalSystem
+                interact            : 1
+                thirdFailure        : RUNCMD
+                resetFailCountDelay : 0
+                program             : fgdfg
+                args                : dg
+                append              : 1
+
+                Service name AudioEndpointBuilder
+                Action No change
+                Startup type: No change
+                Wait timeout if service is locked: 30 seconds
+                Service AccountLog on service as: LocalSystem
+                Allow service to interact with the desktop: Yes
+
+                First failure: No change
+                Second failure: No change
+                Subsequent failures: Run a program
+                Reset fail count after: 0 days
+                Run this program: fgdfg
+                Command line parameters: dg
+                Append fail count to end of command line: Yes
+
+                #>
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLTaskScheduler.ps1

@@ -0,0 +1,243 @@
+function ConvertTo-XMLTaskScheduler {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Entry in $GPO.DataSet.Drive) {
+            [PSCustomObject] @{
+                Changed         = [DateTime] $Entry.changed
+                #uid             = $Entry.uid
+                GPOSettingOrder = $Entry.GPOSettingOrder
+                Filter          = $Entry.Filter
+
+                Name            = $Entry.Name
+                Action          = $Script:Actions["$($Entry.Properties.action)"]
+                ThisDrive       = $Entry.Properties.thisDrive
+                AllDrives       = $Entry.Properties.allDrives
+                UserName        = $Entry.Properties.userName
+                Path            = $Entry.Properties.path
+                Label           = $Entry.Properties.label
+                Persistent      = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
+                UseLetter       = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
+                Letter          = $Entry.Properties.letter
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Type in @('TaskV2', 'Task', 'ImmediateTaskV2', 'ImmediateTask')) {
+            foreach ($Entry in $GPO.DataSet.$Type) {
+                $ListActions = foreach ($LoopAction in $Entry.Properties.Task.Actions) {
+
+                    foreach ($InternalAction in $LoopAction.Exec) {
+                        $Action = [ordered] @{
+                            ActionType       = 'Execute'
+                            Command          = $InternalAction.Command         # : cmd
+                            Arguments        = $InternalAction.Arguments       # : / c wevtutil qe security / rd:true / f:text / c:1 / q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4727 or EventID=4759 or EventID=4754 or EventID=4731)]]" >group-creation.txt
+                            WorkingDirectory = $InternalAction.WorkingDirectory# : % windir % \temp
+                            Server           = $Null
+                            Subject          = $Null
+                            To               = $Null
+                            From             = $Null
+                            Body             = $Null
+                            Attachments      = $Null
+                        }
+                        $Action
+                    }
+                    foreach ($InternalAction in $LoopAction.SendEmail) {
+                        $Action = [ordered] @{
+                            ActionType       = 'SendEmail'
+                            Command          = $null
+                            Arguments        = $null      # : / c wevtutil qe security / rd:true / f:text / c:1 / q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4727 or EventID=4759 or EventID=4754 or EventID=4731)]]" >group-creation.txt
+                            WorkingDirectory = $null # : % windir % \temp
+                            Server           = $InternalAction.Server     # : smtp-de
+                            Subject          = $InternalAction.Subject    # : AD Group creation
+                            To               = $InternalAction.To         # : gm6b@eurofins.de,RalphThomasAussem@eurofins.de,karlthomaseggert@eurofins.de
+                            From             = $InternalAction.From       # : %computername%@eurofins.local
+                            Body             = $InternalAction.Body       # : A new security group has been created. Check attachment for further details.
+                            Attachments      = $InternalAction.Attachments.File -join '; ' # : Attachments
+                        }
+                        $Action
+                    }
+                }
+
+
+                <#
+                [DBG]: PS C:\Support\GitHub\GpoZaurr> $Entry.Properties.Task.Triggers.EventTrigger
+
+                Enabled Subscription
+                ------- ------------
+                true    <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4727]]</Select></Query></QueryList>
+                true    <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4731]]</Select></Query></QueryList>
+                true    <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4754]]</Select></Query></QueryList>
+                false   <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4759]]</Select></Query></QueryList>
+                #>
+                if ($ListActions.Count -eq 0) {
+                    $ListActions = @(
+
+                        if ($Entry.Properties.appName) {
+                            # This supports Scheduled Task (legacy)
+                            $Action = [ordered] @{
+                                ActionType       = $Script:Actions["$($Entry.Properties.action)"]
+                                Command          = $Entry.Properties.appName
+                                Arguments        = $Entry.Properties.args  #
+                                WorkingDirectory = $Entry.Properties.startIn  # : % windir % \temp
+                                Server           = $null     # : smtp-de
+                                Subject          = $null    # : AD Group creation
+                                To               = $null
+                                From             = $null
+                                Body             = $null
+                                Attachments      = $null
+                            }
+                            $Action
+                        } else {
+
+                            $Action = [ordered] @{
+                                ActionType       = $Script:Actions["$($Entry.Properties.action)"]
+                                Command          = $null
+                                Arguments        = $null      #
+                                WorkingDirectory = $null # : % windir % \temp
+                                Server           = $null     # : smtp-de
+                                Subject          = $null    # : AD Group creation
+                                To               = $null
+                                From             = $null
+                                Body             = $null
+                                Attachments      = $null
+                            }
+                            $Action
+                        }
+                    )
+                }
+                foreach ($Action in $ListActions) {
+                    $CreateGPO = [ordered]@{
+                        DisplayName     = $GPO.DisplayName
+                        DomainName      = $GPO.DomainName
+                        GUID            = $GPO.GUID
+                        GpoType         = $GPO.GpoType
+                        #GpoCategory = $GPOEntry.GpoCategory
+                        #GpoSettings = $GPOEntry.GpoSettings
+                        Type            = $Type
+                        Changed         = [DateTime] $Entry.changed
+                        GPOSettingOrder = $Entry.GPOSettingOrder
+                        userContext     = ''
+
+                        Name            = $Entry.Name
+                        Status          = $Entry.status
+                        Action          = $Script:Actions["$($Entry.Properties.action)"]
+
+
+                        runAs           = $Entry.Properties.runAs     #: NT AUTHORITY\System
+                        #logonType                   = $Entry.Properties.logonType #: InteractiveToken
+                        #Task = $Entry.Properties.Task      #: Task
+
+                        Comment         = $Entry.Properties.comment
+                    }
+                    if ($Entry.Properties.startOnlyIfIdle) {
+                        # Old legacy task
+                        $Middle = [ordered] @{
+                            AllowStartOnDemand          = $null        #: true
+                            DisallowStartIfOnBatteries  = $Entry.Properties.noStartIfOnBatteries #: false
+                            StopIfGoingOnBatteries      = $Entry.Properties.stopIfGoingOnBatteries     #: false
+                            AllowHardTerminate          = $null       #: true
+                            Enabled                     = $Entry.Properties.enabled               #: true
+                            Hidden                      = $null                   #: false
+                            MultipleInstancesPolicy     = $null    #: IgnoreNew
+                            Priority                    = $null                   #: 7
+                            ExecutionTimeLimit          = $null         #: PT1H
+                            #IdleSettings                = $Entry.Properties.Task.Settings.IdleSettings               #: IdleSettings
+
+                            IdleDuration                = $Entry.Properties.deadlineMinutes      # : PT5M
+                            IdleWaitTimeout             = $null   # : PT1H
+                            IdleStopOnIdleEnd           = $Entry.Properties.stopOnIdleEnd # : false
+                            IdleRestartOnIdle           = $Entry.Properties.startOnlyIfIdle # : false
+
+                            RegistrationInfoAuthor      = $null
+                            RegistrationInfoDescription = $null
+                            deleteWhenDone              = $Entry.Properties.deleteWhenDone
+
+                            <#
+                            action                 : U
+                            name                   : Task Name
+                            appName                : Run command
+                            args                   : args for command
+                            startIn                : start me in
+                            comment                : Oops i did it again
+                            enabled                : 1
+                            deleteWhenDone         : 1
+                            maxRunTime             : 259200000
+                            startOnlyIfIdle        : 1
+                            idleMinutes            : 10
+                            deadlineMinutes        : 60
+                            stopOnIdleEnd          : 1
+                            noStartIfOnBatteries   : 1
+                            stopIfGoingOnBatteries : 1
+                            systemRequired         : 0
+                            Triggers               : Triggers
+                            #>
+                        }
+                    } else {
+                        $Middle = [ordered] @{
+                            AllowStartOnDemand          = $Entry.Properties.Task.Settings.AllowStartOnDemand         #: true
+                            DisallowStartIfOnBatteries  = $Entry.Properties.Task.Settings.DisallowStartIfOnBatteries #: false
+                            StopIfGoingOnBatteries      = $Entry.Properties.Task.Settings.StopIfGoingOnBatteries     #: false
+                            AllowHardTerminate          = $Entry.Properties.Task.Settings.AllowHardTerminate         #: true
+                            Enabled                     = $Entry.Properties.Task.Settings.Enabled                    #: true
+                            Hidden                      = $Entry.Properties.Task.Settings.Hidden                     #: false
+                            MultipleInstancesPolicy     = $Entry.Properties.Task.Settings.MultipleInstancesPolicy    #: IgnoreNew
+                            Priority                    = $Entry.Properties.Task.Settings.Priority                   #: 7
+                            ExecutionTimeLimit          = $Entry.Properties.Task.Settings.ExecutionTimeLimit         #: PT1H
+                            #IdleSettings                = $Entry.Properties.Task.Settings.IdleSettings               #: IdleSettings
+
+                            IdleDuration                = $Entry.Properties.Task.Settings.IdleSettings.Duration      # : PT5M
+                            IdleWaitTimeout             = $Entry.Properties.Task.Settings.IdleSettings.WaitTimeout   # : PT1H
+                            IdleStopOnIdleEnd           = $Entry.Properties.Task.Settings.IdleSettings.StopOnIdleEnd # : false
+                            IdleRestartOnIdle           = $Entry.Properties.Task.Settings.IdleSettings.RestartOnIdle # : false
+
+                            RegistrationInfoAuthor      = $Entry.Properties.Task.RegistrationInfo.Author
+                            RegistrationInfoDescription = $Entry.Properties.Task.RegistrationInfo.Description
+
+                            deleteWhenDone              = $Entry.Properties.deleteWhenDone
+                        }
+                    }
+                    $End = [ordered] @{
+                        id        = $Entry.Properties.Principals.Principal.id        # : Author
+                        UserId    = $Entry.Properties.Principals.Principal.UserId    # : NT AUTHORITY\System
+                        LogonType = $Entry.Properties.Principals.Principal.LogonType # : InteractiveToken
+                        RunLevel  = $Entry.Properties.Principals.Principal.RunLevel  # : HighestAvailable
+
+                        #Persistent = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
+                        #UseLetter = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
+                        #Letter = $Entry.Properties.letter
+                    }
+                    $CreateGPO = $CreateGPO + $Middle + $End + $Action
+                    $Last = [ordered] @{
+                        #Uid                                   = $Group.uid             #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
+                        RunInLoggedOnUserSecurityContext      = if ($Entry.userContext -eq '1') { 'Enabled' } elseif ($Entry.userContext -eq '0') { 'Disabled' } else { $Entry.userContext };
+                        RemoveThisItemWhenItIsNoLongerApplied = if ($Entry.removePolicy -eq '1') { 'Enabled' } elseif ($Entry.removePolicy -eq '0') { 'Disabled' } else { $Entry.removePolicy };
+                        Filters                               = $Group.Filters         #::
+                    }
+                    $CreateGPO = $CreateGPO + $Last
+                    $CreateGPO['Linked'] = $GPO.Linked
+                    $CreateGPO['LinksCount'] = $GPO.LinksCount
+                    $CreateGPO['Links'] = $GPO.Links
+                    [PSCustomObject] $CreateGPO
+                }
+            }
+        }
+    }
+}

Private/Find-MissingProperties.ps1

@@ -0,0 +1,15 @@
+function Find-MissingProperties {
+    [cmdletBinding()]
+    param(
+        [Array] $Objects,
+        [string[]] $PossibleProperties
+    )
+    $AllProperties = Select-Properties -AllProperties -Objects $Objects
+    $MissingProperties = $AllProperties | Where-Object { $_ -notin 'DisplayName', 'DomainName', 'GUID', 'Linked', 'LinksCount', 'Links', 'GPOType', 'GPOCategory', 'GPOSettings' }
+    [Array] $ConsiderAdding = foreach ($Property in $MissingProperties) {
+        if ($Property -notin $PossibleProperties) {
+            $Property
+        }
+    }
+    $ConsiderAdding
+}

Private/Get-ADAdministrativeGroups.ps1

@@ -1,74 +0,0 @@
-
-function Get-ADADministrativeGroups {
-    <#
-    .SYNOPSIS
-    Short description
-
-    .DESCRIPTION
-    Long description
-
-    .PARAMETER Type
-    Parameter description
-
-    .PARAMETER Forest
-    Parameter description
-
-    .PARAMETER ExcludeDomains
-    Parameter description
-
-    .PARAMETER IncludeDomains
-    Parameter description
-
-    .PARAMETER ExtendedForestInformation
-    Parameter description
-
-    .EXAMPLE
-    Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins
-
-    Output (Where VALUE is Get-ADGroup output):
-    Name                           Value
-    ----                           -----
-    ByNetBIOS                      {EVOTEC\Domain Admins, EVOTEC\Enterprise Admins, EVOTECPL\Domain Admins}
-    ad.evotec.xyz                  {DomainAdmins, EnterpriseAdmins}
-    ad.evotec.pl                   {DomainAdmins}
-
-    .NOTES
-    General notes
-    #>
-    [cmdletBinding()]
-    param(
-        [parameter(Mandatory)][validateSet('DomainAdmins', 'EnterpriseAdmins')][string[]] $Type,
-        [alias('ForestName')][string] $Forest,
-        [string[]] $ExcludeDomains,
-        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
-        [System.Collections.IDictionary] $ExtendedForestInformation
-    )
-    $ADDictionary = [ordered] @{ }
-    $ADDictionary['ByNetBIOS'] = [ordered] @{ }
-    $ADDictionary['BySID'] = [ordered] @{ }
-
-    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-    foreach ($Domain in $ForestInformation.Domains) {
-        $ADDictionary[$Domain] = [ordered] @{ }
-        $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
-        $DomainInformation = Get-ADDomain -Server $QueryServer
-
-        if ($Type -contains 'DomainAdmins') {
-            Get-ADGroup -Filter "SID -eq '$($DomainInformation.DomainSID)-512'" -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
-                $ADDictionary['ByNetBIOS']["$($DomainInformation.NetBIOSName)\$($_.Name)"] = $_
-                $ADDictionary[$Domain]['DomainAdmins'] = "$($DomainInformation.NetBIOSName)\$($_.Name)"
-                $ADDictionary['BySID'][$_.SID.Value] = $_
-            }
-        }
-        if ($Type -contains 'EnterpriseAdmins') {
-            Get-ADGroup -Filter "SID -eq '$($DomainInformation.DomainSID)-519'" -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
-                $ADDictionary['ByNetBIOS']["$($DomainInformation.NetBIOSName)\$($_.Name)"] = $_
-                $ADDictionary[$Domain]['EnterpriseAdmins'] = "$($DomainInformation.NetBIOSName)\$($_.Name)"
-                $ADDictionary['BySID'][$_.SID.Value] = $_ #"$($DomainInformation.NetBIOSName)\$($_.Name)"
-            }
-        }
-    }
-    return $ADDictionary
-}
-
-#Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins

Private/Get-GPOCategories.ps1

@@ -0,0 +1,62 @@
+function Get-GPOCategories {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [System.Xml.XmlElement[]] $GPOOutput,
+        [string] $Splitter,
+        [switch] $FullObjects,
+        [System.Collections.IDictionary] $CachedCategories
+    )
+    if (-not $CachedCategories) {
+        $CachedCategories = [ordered] @{}
+    }
+    $LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects
+    foreach ($GpoType in @('User', 'Computer')) {
+        if ($GPOOutput.$GpoType.ExtensionData.Extension) {
+            foreach ($ExtensionType in $GPOOutput.$GpoType.ExtensionData.Extension) {
+                # It's possible that one of the ExtensionType records has value null. Weird but happend.
+                if ($ExtensionType) {
+                    $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
+                    try {
+                        $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
+                    } catch {
+                        Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
+                        continue
+                    }
+
+                    foreach ($GpoSettings in $KeysToLoop.Name) {
+                        $Template = [ordered] @{
+                            DisplayName = $GPO.DisplayName
+                            DomainName  = $GPO.DomainName
+                            GUID        = $GPO.Guid
+                            GpoType     = $GpoType
+                            GpoCategory = $GPOSettingTypeSplit[1]
+                            GpoSettings = $GpoSettings
+                        }
+                        $Template['Linked'] = $LinksInformation.Linked
+                        $Template['LinksCount'] = $LinksInformation.LinksCount
+                        $Template['Links'] = $LinksInformation.Links
+                        $Template['IncludeComments'] = [bool]::Parse($GPOOutput.IncludeComments)
+                        $Template['CreatedTime'] = [DateTime] $GPOOutput.CreatedTime
+                        $Template['ModifiedTime'] = [DateTime] $GPOOutput.ModifiedTime
+                        $Template['ReadTime'] = [DateTime] $GPOOutput.ReadTime
+                        $Template['SecurityDescriptor'] = $GPOOutput.SecurityDescriptor
+                        $Template['FilterDataAvailable'] = [bool]::Parse($GPOOutput.FilterDataAvailable)
+                        $Template['DataSet'] = $ExtensionType.$GpoSettings
+                        $ConvertedObject = [PSCustomObject] $Template
+
+                        if (-not $CachedCategories["$($Template.GpoCategory)"]) {
+                            $CachedCategories["$($Template.GpoCategory)"] = [ordered] @{}
+                        }
+                        if (-not $CachedCategories["$($Template.GpoCategory)"]["$($Template.GpoSettings)"]) {
+                            $CachedCategories["$($Template.GpoCategory)"]["$($Template.GpoSettings)"] = [System.Collections.Generic.List[PSCustomObject]]::new()
+                        }
+                        $CachedCategories["$($Template.GpoCategory)"]["$($Template.GpoSettings)"].Add($ConvertedObject)
+                        # return GPOCategory
+                        $ConvertedObject
+                    }
+                }
+            }
+        }
+    }
+}

Private/Get-LinksFromXML.ps1

@@ -0,0 +1,38 @@
+function Get-LinksFromXML {
+    [cmdletBinding()]
+    param(
+        [System.Xml.XmlElement[]] $GPOOutput,
+        [string] $Splitter,
+        [switch] $FullObjects
+    )
+    $Links = [ordered] @{
+        Linked     = $null
+        LinksCount = $null
+        Links      = $null
+    }
+    if ($GPOOutput.LinksTo) {
+        $Links.Linked = $true
+        $Links.LinksCount = ([Array] $GPOOutput.LinksTo).Count
+        $Links.Links = foreach ($Link in $GPOOutput.LinksTo) {
+            if ($FullObjects) {
+                [PSCustomObject] @{
+                    Path       = $Link.SOMPath
+                    Enabled    = if ($Link.Enabled -eq 'true') { $true } else { $false }
+                    NoOverride = if ($Link.NoOverride -eq 'true') { $true } else { $false }
+                }
+            } else {
+                if ($Link.Enabled) {
+                    $Link.SOMPath
+                }
+            }
+        }
+        if ($Splitter) {
+            $Links.Links = $Links.Links -join $Splitter
+        }
+    } else {
+        $Links.Linked = $false
+        $Links.LinksCount = 0
+        $Links.Links = $null
+    }
+    [PSCustomObject] $Links
+}

Private/Get-PrivGPOZaurrLInk.ps1

@@ -6,47 +6,69 @@
         [System.Collections.IDictionary] $GPOCache
     )
     if ($Object.GpLink -and $Object.GpLink.Trim() -ne '') {
-        $Object.GpLink -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://' | ForEach-Object {
-            if ($_) {
+        #$Object.GpLink -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://'
+        $Object.GpLink -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            #Write-Verbose $_
+            if ($_.Length -gt 10) {
+                $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
                 $Output = [ordered] @{
                     DistinguishedName = $Object.DistinguishedName
-                    CanonicalName     = $Object.CanonicalName
+                    CanonicalName     = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
                     Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
                 }
+                $Search = -join ($DomainCN, $Output['Guid'])
                 if ($GPOCache -and -not $Limited) {
-                    $Output['Name'] = $GPOCache[$Output['Guid']].DisplayName
-                    $Output['DomainName'] = $GPOCache[$Output['Guid']].DomainName
-                    $Output['Owner'] = $GPOCache[$Output['Guid']].Owner
-                    $Output['GpoStatus'] = $GPOCache[$Output['Guid']].GpoStatus
-                    $Output['Description'] = $GPOCache[$Output['Guid']].Description
-                    $Output['CreationTime'] = $GPOCache[$Output['Guid']].CreationTime
-                    $Output['ModificationTime'] = $GPOCache[$Output['Guid']].ModificationTime
+                    if ($GPOCache[$Search]) {
+                        $Output['DisplayName'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
                 }
-                $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
-                $Output['GPOLink'] = $_
-                [PSCustomObject] $Output
             }
         }
     } elseif ($Object.LinkedGroupPolicyObjects -and $Object.LinkedGroupPolicyObjects.Trim() -ne '') {
-        $Object.LinkedGroupPolicyObjects -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://' | ForEach-Object {
-            if ($_) {
+        $Object.LinkedGroupPolicyObjects -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            if ($_.Length -gt 10) {
+                $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
                 $Output = [ordered] @{
                     DistinguishedName = $Object.DistinguishedName
-                    CanonicalName     = $Object.CanonicalName
+                    CanonicalName     = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
                     Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
                 }
+                $Search = -join ($DomainCN, $Output['Guid'])
                 if ($GPOCache -and -not $Limited) {
-                    $Output['Name'] = $GPOCache[$Output['Guid']].DisplayName
-                    $Output['DomainName'] = $GPOCache[$Output['Guid']].DomainName
-                    $Output['Owner'] = $GPOCache[$Output['Guid']].Owner
-                    $Output['GpoStatus'] = $GPOCache[$Output['Guid']].GpoStatus
-                    $Output['Description'] = $GPOCache[$Output['Guid']].Description
-                    $Output['CreationTime'] = $GPOCache[$Output['Guid']].CreationTime
-                    $Output['ModificationTime'] = $GPOCache[$Output['Guid']].ModificationTime
+                    if ($GPOCache[$Search]) {
+                        $Output['Name'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
                 }
-                $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
-                $Output['GPOLink'] = $_
-                [PSCustomObject] $Output
             }
         }
     }

Private/Get-PrivPermission.ps1

@@ -2,171 +2,259 @@
     [cmdletBinding()]
     param(
         [Microsoft.GroupPolicy.Gpo] $GPO,
+        [Object] $SecurityRights,
+
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
         [switch] $SkipWellKnown,
         [switch] $SkipAdministrative,
         [switch] $IncludeOwner,
         [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
         [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid',
+
         [switch] $IncludeGPOObject,
         [System.Collections.IDictionary] $ADAdministrativeGroups,
-        [string[]] $Type,
-        [System.Collections.IDictionary] $Accounts
+        [validateSet('AuthenticatedUsers', 'DomainComputers', 'Unknown', 'WellKnownAdministrative', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All',
+        [System.Collections.IDictionary] $Accounts,
+        [System.Collections.IDictionary] $ExtendedForestInformation
     )
-    Write-Verbose "Get-GPOZaurrPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
-    $SecurityRights = $GPO.GetSecurityInfo()
-    $Index = 0
-    $SecurityRights | ForEach-Object -Process {
-        #Get-GPPermissions -Guid $GPO.ID -DomainName $GPO.DomainName -All -Server $QueryServer | ForEach-Object -Process {
-        $GPOPermission = $_
-        if ($ExcludePermissionType -contains $GPOPermission.Permission) {
-            $Index++
-            return
-        }
-        if ($IncludePermissionType) {
-            if ($IncludePermissionType -notcontains $GPOPermission.Permission) {
-                $Index++
-                return
-            }
-        }
-        if ($SkipWellKnown.IsPresent) {
-            if ($GPOPermission.Trustee.SidType -eq 'WellKnownGroup') {
-                $Index++
-                return
-            }
-        }
-        if ($SkipAdministrative.IsPresent) {
-            $IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
-            if ($IsAdministrative) {
-                $Index++
-                return
-            }
-        }
-        if ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
-            # May need updates if there's more types
-            if ($GPOPermission.Trustee.SidType -ne 'Unknown') {
-                $Index++
-                return
-            }
-        }
-        $ReturnObject = [ordered] @{
-            DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
-            GUID              = $GPO.ID
-            DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
-            Enabled           = $GPO.GpoStatus
-            Description       = $GPO.Description
-            CreationDate      = $GPO.CreationTime
-            ModificationTime  = $GPO.ModificationTime
-            Permission        = $GPOPermission.Permission  # : GpoEditDeleteModifySecurity
-            Inherited         = $GPOPermission.Inherited   # : False
-            Domain            = $GPOPermission.Trustee.Domain  #: EVOTEC
-            DistinguishedName = $GPOPermission.Trustee.DSPath  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
-            Name              = $GPOPermission.Trustee.Name    #: Domain Admins
-            Sid               = $GPOPermission.Trustee.Sid.Value     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
-            SidType           = $GPOPermission.Trustee.SidType #: Group
-        }
-        if ($Accounts) {
-            $A = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
-            if ($A -and $Accounts[$A]) {
-                $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
-                $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
-                $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
-                $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
-                $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
-                if (-not $ReturnObject['Sid']) {
-                    $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
-                }
-                if ($Accounts[$A].ObjectClass -eq 'group') {
-                    $ReturnObject['SidType'] = 'Group'
-                } elseif ($Accounts[$A].ObjectClass -eq 'user') {
-                    $ReturnObject['SidType'] = 'User'
-                } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
-                    $ReturnObject['SidType'] = 'Computer'
-                } else {
-                    $ReturnObject['SidType'] = 'EmptyOrUnknown'
-                }
-            } else {
-                $ReturnObject['UserPrincipalName'] = ''
-                $ReturnObject['AccountEnabled'] = ''
-                $ReturnObject['PasswordLastSet'] = ''
-                $ReturnObject['LastLogonDate'] = ''
-            }
-        }
-        if ($IncludeGPOObject) {
-            $ReturnObject['GPOObject'] = $GPO
-            $ReturnObject['GPOSecurity'] = $SecurityRights
-            $ReturnObject['GPOSecurityPermissionIndex'] = $Index
-        }
-        [PSCustomObject] $ReturnObject
-        $Index++
+    Begin {
+        Write-Verbose "Get-PrivPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
     }
-    if ($IncludeOwner.IsPresent) {
-        if ($GPO.Owner) {
-            $SplittedOwner = $GPO.Owner.Split('\')
-            $DomainOwner = $SplittedOwner[0]  #: EVOTEC
-            $DomainUserName = $SplittedOwner[1]   #: Domain Admins
-            $SID = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].Sid.Value
-            if ($SID) {
-                $SIDType = 'Group'
-                $DistinguishedName = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].DistinguishedName
+    Process {
+        $SecurityRights | ForEach-Object -Process {
+            $GPOPermission = $_
+            if ($PermitType -ne 'All') {
+                if ($PermitType -eq 'Deny') {
+                    if ($GPOPermission.Denied -eq $false) {
+                        return
+                    }
+                } else {
+                    if ($GPOPermission.Denied -eq $true) {
+                        return
+                    }
+                }
+            }
+            if ($ExcludePermissionType -contains $GPOPermission.Permission) {
+                return
+            }
+            if ($IncludePermissionType) {
+                if ($IncludePermissionType -notcontains $GPOPermission.Permission) {
+                    if ($IncludePermissionType -eq 'GpoRead' -and $GPOPermission.Permission -eq 'GpoApply') {
+                        # We treat GpoApply as GpoRead as well. This is because when GpoApply is set it becomes GpoRead as well but of course not vice versa
+                    } else {
+                        return
+                    }
+                }
+            }
+            if ($SkipWellKnown.IsPresent -or $Type -contains 'NotWellKnown') {
+                if ($GPOPermission.Trustee.SidType -eq 'WellKnownGroup') {
+                    return
+                }
+            }
+            if ($SkipAdministrative.IsPresent -or $Type -contains 'NotAdministrative') {
+                $IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
+                if ($IsAdministrative) {
+                    return
+                }
+            }
+            if ($Type -contains 'Administrative' -and $Type -notcontains 'All') {
+                $IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
+                if (-not $IsAdministrative) {
+                    return
+                }
+            }
+            if ($Type -contains 'NotWellKnownAdministrative' -and $Type -notcontains 'All') {
+                # We check for SYSTEM account
+                # Maybe we should make it a function and provide more
+                if ($GPOPermission.Trustee.Sid -eq 'S-1-5-18') {
+                    return
+                }
+            }
+            if ($Type -contains 'WellKnownAdministrative' -and $Type -notcontains 'All') {
+                # We check for SYSTEM account
+                # Maybe we should make it a function and provide more
+                if ($GPOPermission.Trustee.Sid -ne 'S-1-5-18') {
+                    return
+                }
+            }
+            if ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
+                # May need updates if there's more types
+                if ($GPOPermission.Trustee.SidType -ne 'Unknown') {
+                    return
+                }
+            }
+            if ($Type -contains 'AuthenticatedUsers' -and $Type -notcontains 'All') {
+                if ($GPOPermission.Trustee.Sid -ne 'S-1-5-11') {
+                    return
+                }
+            }
+            if ($Type -contains 'DomainComputers' -and $Type -notcontains 'All') {
+                $DomainComputersSID = -join ($ExtendedForestInformation['DomainsExtended'][$GPO.DomainName].DomainSID, '-515')
+                if ($GPOPermission.Trustee.Sid -ne $DomainComputersSID) {
+                    return
+                }
+            }
+            if ($Principal) {
+                if ($PrincipalType -eq 'Sid') {
+                    if ($Principal -notcontains $GPOPermission.Trustee.Sid.Value) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'DistinguishedName') {
+                    if ($Principal -notcontains $GPOPermission.Trustee.DSPath) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'Name') {
+                    $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                    if ($Principal -notcontains $UserMerge -and $Principal -notcontains $GPOPermission.Trustee.Name) {
+                        return
+                    }
+                }
+            }
+            if ($ExcludePrincipal) {
+                if ($ExcludePrincipalType -eq 'Sid') {
+                    if ($ExcludePrincipal -contains $GPOPermission.Trustee.Sid.Value) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'DistinguishedName') {
+                    if ($ExcludePrincipal -contains $GPOPermission.Trustee.DSPath) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'Name') {
+                    $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                    if ($ExcludePrincipal -contains $UserMerge -or $ExcludePrincipal -contains $GPOPermission.Trustee.Name) {
+                        return
+                    }
+                }
+            }
+            $ReturnObject = [ordered] @{
+                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
+                GUID              = $GPO.ID
+                DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
+                Enabled           = $GPO.GpoStatus
+                Description       = $GPO.Description
+                CreationDate      = $GPO.CreationTime
+                ModificationTime  = $GPO.ModificationTime
+                PermissionType    = if ($GPOPermission.Denied -eq $true) { 'Deny' } else { 'Allow' }
+                Permission        = $GPOPermission.Permission  # : GpoEditDeleteModifySecurity
+                Inherited         = $GPOPermission.Inherited   # : False
+                Domain            = $GPOPermission.Trustee.Domain  #: EVOTEC
+                DistinguishedName = $GPOPermission.Trustee.DSPath  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+                Name              = $GPOPermission.Trustee.Name    #: Domain Admins
+                Sid               = $GPOPermission.Trustee.Sid.Value     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+                SidType           = $GPOPermission.Trustee.SidType #: Group
+            }
+            if ($Accounts) {
+                $A = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                if ($A -and $Accounts[$A]) {
+                    $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
+                    $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
+                    $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
+                    $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
+                    $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
+                    if (-not $ReturnObject['Sid']) {
+                        $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
+                    }
+                    if ($Accounts[$A].ObjectClass -eq 'group') {
+                        $ReturnObject['SidType'] = 'Group'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'user') {
+                        $ReturnObject['SidType'] = 'User'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
+                        $ReturnObject['SidType'] = 'Computer'
+                    } else {
+                        $ReturnObject['SidType'] = 'EmptyOrUnknown'
+                    }
+                } else {
+                    $ReturnObject['UserPrincipalName'] = ''
+                    $ReturnObject['AccountEnabled'] = ''
+                    $ReturnObject['PasswordLastSet'] = ''
+                    $ReturnObject['LastLogonDate'] = ''
+                }
+            }
+            if ($IncludeGPOObject) {
+                $ReturnObject['GPOObject'] = $GPO
+                $ReturnObject['GPOSecurity'] = $SecurityRights
+                $ReturnObject['GPOSecurityPermissionItem'] = $GPOPermission
+            }
+            [PSCustomObject] $ReturnObject
+        }
+        if ($IncludeOwner.IsPresent) {
+            if ($GPO.Owner) {
+                $SplittedOwner = $GPO.Owner.Split('\')
+                $DomainOwner = $SplittedOwner[0]  #: EVOTEC
+                $DomainUserName = $SplittedOwner[1]   #: Domain Admins
+                $SID = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].Sid.Value
+                if ($SID) {
+                    $SIDType = 'Group'
+                    $DistinguishedName = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].DistinguishedName
+                } else {
+                    $SIDType = ''
+                    $DistinguishedName = ''
+                }
             } else {
-                $SIDType = ''
+                $DomainOwner = $GPO.Owner
+                $DomainUserName = ''
+                $SID = ''
+                $SIDType = 'EmptyOrUnknown'
                 $DistinguishedName = ''
             }
-        } else {
-            $DomainOwner = $GPO.Owner
-            $DomainUserName = ''
-            $SID = ''
-            $SIDType = 'EmptyOrUnknown'
-            $DistinguishedName = ''
-        }
-        $ReturnObject = [ordered] @{
-            DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
-            GUID              = $GPO.Id
-            DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
-            Enabled           = $GPO.GpoStatus
-            Description       = $GPO.Description
-            CreationDate      = $GPO.CreationTime
-            ModificationTime  = $GPO.ModificationTime
-            Permission        = 'GpoOwner'  # : GpoEditDeleteModifySecurity
-            Inherited         = $false  # : False
-            Domain            = $DomainOwner
-            DistinguishedName = $DistinguishedName  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
-            Name              = $DomainUserName
-            Sid               = $SID     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
-            SidType           = $SIDType #  #: Group
-        }
-        if ($Accounts) {
-            $A = $GPO.Owner
-            if ($A -and $Accounts[$A]) {
-                $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
-                $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
-                $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
-                $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
-                $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
-                if (-not $ReturnObject['Sid']) {
-                    $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
-                }
-                if ($Accounts[$A].ObjectClass -eq 'group') {
-                    $ReturnObject['SidType'] = 'Group'
-                } elseif ($Accounts[$A].ObjectClass -eq 'user') {
-                    $ReturnObject['SidType'] = 'User'
-                } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
-                    $ReturnObject['SidType'] = 'Computer'
-                } else {
-                    $ReturnObject['SidType'] = 'EmptyOrUnknown'
-                }
-            } else {
-                $ReturnObject['UserPrincipalName'] = ''
-                $ReturnObject['AccountEnabled'] = ''
-                $ReturnObject['PasswordLastSet'] = ''
-                $ReturnObject['LastLogonDate'] = ''
+            $ReturnObject = [ordered] @{
+                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
+                GUID              = $GPO.Id
+                DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
+                Enabled           = $GPO.GpoStatus
+                Description       = $GPO.Description
+                CreationDate      = $GPO.CreationTime
+                ModificationTime  = $GPO.ModificationTime
+                Permission        = 'GpoOwner'  # : GpoEditDeleteModifySecurity
+                Inherited         = $false  # : False
+                Domain            = $DomainOwner
+                DistinguishedName = $DistinguishedName  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+                Name              = $DomainUserName
+                Sid               = $SID     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+                SidType           = $SIDType #  #: Group
             }
+            if ($Accounts) {
+                $A = $GPO.Owner
+                if ($A -and $Accounts[$A]) {
+                    $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
+                    $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
+                    $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
+                    $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
+                    $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
+                    if (-not $ReturnObject['Sid']) {
+                        $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
+                    }
+                    if ($Accounts[$A].ObjectClass -eq 'group') {
+                        $ReturnObject['SidType'] = 'Group'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'user') {
+                        $ReturnObject['SidType'] = 'User'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
+                        $ReturnObject['SidType'] = 'Computer'
+                    } else {
+                        $ReturnObject['SidType'] = 'EmptyOrUnknown'
+                    }
+                } else {
+                    $ReturnObject['UserPrincipalName'] = ''
+                    $ReturnObject['AccountEnabled'] = ''
+                    $ReturnObject['PasswordLastSet'] = ''
+                    $ReturnObject['LastLogonDate'] = ''
+                }
+            }
+            if ($IncludeGPOObject) {
+                $ReturnObject['GPOObject'] = $GPO
+                $ReturnObject['GPOSecurity'] = $SecurityRights
+                $ReturnObject['GPOSecurityPermissionItem'] = $null
+            }
+            [PSCustomObject] $ReturnObject
         }
-        if ($IncludeGPOObject) {
-            $ReturnObject['GPOObject'] = $GPO
-            $ReturnObject['GPOSecurity'] = $SecurityRights
-            $ReturnObject['GPOSecurityPermissionIndex'] = $null
-        }
-        [PSCustomObject] $ReturnObject
+    }
+    End {
+
     }
 }

Private/Get-XMLGPO.ps1

@@ -45,7 +45,7 @@
             } elseif ($WellKnown.Name) {
                 $OwnerType = 'WellKnown'
             } else {
-                $OwnerType = 'NonAdministrative'
+                $OwnerType = 'NotAdministrative'
             }
         } else {
             $OwnerType = 'EmptyOrUnknown'
@@ -53,48 +53,51 @@
     }
     if ($PermissionsOnly) {
         [PsCustomObject] @{
-            'DisplayName'    = $XMLContent.GPO.Name
-            'DomainName'     = $XMLContent.GPO.Identifier.Domain.'#text'
-            'GUID'           = $XMLContent.GPO.Identifier.Identifier.InnerText
-            'Enabled'        = $Enabled
-            'Name'           = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
-            'Sid'            = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'DisplayName'          = $XMLContent.GPO.Name
+            'DomainName'           = $XMLContent.GPO.Identifier.Domain.'#text'
+            'GUID'                 = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+            'Enabled'              = $Enabled
+            'Name'                 = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+            'Sid'                  = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
             #'SidType'        = if (($XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text').Length -le 10) { 'WellKnown' } else { 'Other' }
-            'PermissionType' = 'Allow'
-            'Inherited'      = $false
-            'Permissions'    = 'Owner'
+            'PermissionType'       = 'Allow'
+            'Inherited'            = $false
+            'Permissions'          = 'Owner'
+            'GPODistinguishedName' = $GPO.Path
         }
         $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
             if ($_) {
                 [PsCustomObject] @{
-                    'DisplayName'    = $XMLContent.GPO.Name
-                    'DomainName'     = $XMLContent.GPO.Identifier.Domain.'#text'
-                    'GUID'           = $XMLContent.GPO.Identifier.Identifier.InnerText
-                    'Enabled'        = $Enabled
-                    'Name'           = $_.trustee.name.'#Text'
-                    'Sid'            = $_.trustee.SID.'#Text'
+                    'DisplayName'          = $XMLContent.GPO.Name
+                    'DomainName'           = $XMLContent.GPO.Identifier.Domain.'#text'
+                    'GUID'                 = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+                    'Enabled'              = $Enabled
+                    'Name'                 = $_.trustee.name.'#Text'
+                    'Sid'                  = $_.trustee.SID.'#Text'
                     #'SidType'        = if (($XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text').Length -le 10) { 'WellKnown' } else { 'Other' }
-                    'PermissionType' = $_.type.PermissionType
-                    'Inherited'      = if ($_.Inherited -eq 'false') { $false } else { $true }
-                    'Permissions'    = $_.Standard.GPOGroupedAccessEnum
+                    'PermissionType'       = $_.type.PermissionType
+                    'Inherited'            = if ($_.Inherited -eq 'false') { $false } else { $true }
+                    'Permissions'          = $_.Standard.GPOGroupedAccessEnum
+                    'GPODistinguishedName' = $GPO.Path
                 }
             }
         }
     } elseif ($OwnerOnly) {
         [PsCustomObject] @{
-            'DisplayName' = $XMLContent.GPO.Name
-            'DomainName'  = $XMLContent.GPO.Identifier.Domain.'#text'
-            'GUID'        = $XMLContent.GPO.Identifier.Identifier.InnerText
-            'Enabled'     = $Enabled
-            'Owner'       = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
-            'OwnerSID'    = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
-            'OwnerType'   = $OwnerType
+            'DisplayName'          = $XMLContent.GPO.Name
+            'DomainName'           = $XMLContent.GPO.Identifier.Domain.'#text'
+            'GUID'                 = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+            'Enabled'              = $Enabled
+            'Owner'                = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+            'OwnerSID'             = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'OwnerType'            = $OwnerType
+            'GPODistinguishedName' = $GPO.Path
         }
     } else {
         [PsCustomObject] @{
             'DisplayName'                       = $XMLContent.GPO.Name
             'DomainName'                        = $XMLContent.GPO.Identifier.Domain.'#text'
-            'GUID'                              = $XMLContent.GPO.Identifier.Identifier.InnerText
+            'GUID'                              = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
             'Linked'                            = $Linked
             'LinksCount'                        = $LinksCount
             'Enabled'                           = $Enabled
@@ -109,13 +112,16 @@
             'UserSettingsVersionIdentical'      = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
             'UserSettings'                      = $XMLContent.GPO.User.ExtensionData.Extension
 
+            ComputerPolicies                    = $XMLContent.GPO.Computer.ExtensionData.Name -join ", "
+            UserPolicies                        = $XMLContent.GPO.User.ExtensionData.Name -join ", "
+
             'CreationTime'                      = [DateTime] $XMLContent.GPO.CreatedTime
             'ModificationTime'                  = [DateTime] $XMLContent.GPO.ModifiedTime
             'ReadTime'                          = [DateTime] $XMLContent.GPO.ReadTime
 
             'WMIFilter'                         = $GPO.WmiFilter.name
             'WMIFilterDescription'              = $GPO.WmiFilter.Description
-            'DistinguishedName'                 = $GPO.Path
+            'GPODistinguishedName'              = $GPO.Path
             'SDDL'                              = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
             'Owner'                             = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
             'OwnerSID'                          = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'

Private/Get-XMLNestedRegistry.ps1

@@ -0,0 +1,111 @@
+function Get-XMLNestedRegistry {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [System.Xml.XmlElement[]] $DataSet,
+        [string] $Collection,
+        [switch] $Limited
+    )
+    if ($DataSet.Properties) {
+        $Registry = $DataSet
+        foreach ($Registry in $DataSet) {
+            if ($Limited) {
+                [PSCustomObject] @{
+                    Collection      = $Collection
+                    Changed         = [DateTime] $Registry.changed
+                    GPOSettingOrder = $Registry.GPOSettingOrder
+                    Hive            = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
+                    Key             = $Registry.Properties.key  #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+                    Name            = $Registry.Properties.name #: AutoAdminLogon
+                    Type            = $Registry.Properties.type #: REG_SZ
+                    Value           = $Registry.Properties.value #
+                    Filters         = $Registry.Filters
+                }
+            } else {
+                $CreateGPO = [ordered]@{
+                    DisplayName     = $GPO.DisplayName
+                    DomainName      = $GPO.DomainName
+                    GUID            = $GPO.GUID
+                    GpoType         = $GPO.GpoType
+                    #GpoCategory = $GPOEntry.GpoCategory
+                    #GpoSettings = $GPOEntry.GpoSettings
+                    Collection      = $Collection
+                    Changed         = [DateTime] $Registry.changed
+                    GPOSettingOrder = $Registry.GPOSettingOrder
+                    Hive            = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
+                    Key             = $Registry.Properties.key  #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+                    Name            = $Registry.Properties.name #: AutoAdminLogon
+                    Type            = $Registry.Properties.type #: REG_SZ
+                    Value           = $Registry.Properties.value #
+                    Filters         = $Registry.Filters
+                }
+                $CreateGPO['Linked'] = $GPO.Linked
+                $CreateGPO['LinksCount'] = $GPO.LinksCount
+                $CreateGPO['Links'] = $GPO.Links
+                [PSCustomObject] $CreateGPO
+            }
+        }
+    }
+    foreach ($Name in @('Registry', 'Collection')) {
+        foreach ($Registry in $DataSet.$Name) {
+            if ($Registry.Properties) {
+                if ($Limited) {
+                    [PSCustomObject] @{
+                        Collection      = $Collection
+                        Changed         = [DateTime] $Registry.changed
+                        GPOSettingOrder = $Registry.GPOSettingOrder
+                        Hive            = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
+                        Key             = $Registry.Properties.key  #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+                        Name            = $Registry.Properties.name #: AutoAdminLogon
+                        Type            = $Registry.Properties.type #: REG_SZ
+                        Value           = $Registry.Properties.value #
+                        Filters         = $Registry.Filters
+                    }
+                } else {
+                    $CreateGPO = [ordered]@{
+                        DisplayName     = $GPO.DisplayName
+                        DomainName      = $GPO.DomainName
+                        GUID            = $GPO.GUID
+                        GpoType         = $GPO.GpoType
+                        #GpoCategory = $GPOEntry.GpoCategory
+                        #GpoSettings = $GPOEntry.GpoSettings
+                        Collection      = $Collection
+                        Changed         = [DateTime] $Registry.changed
+                        GPOSettingOrder = $Registry.GPOSettingOrder
+                        Hive            = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
+                        Key             = $Registry.Properties.key  #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+                        Name            = $Registry.Properties.name #: AutoAdminLogon
+                        Type            = $Registry.Properties.type #: REG_SZ
+                        Value           = $Registry.Properties.value #
+                        Filters         = $Registry.Filters
+                    }
+                    $CreateGPO['Linked'] = $GPO.Linked
+                    $CreateGPO['LinksCount'] = $GPO.LinksCount
+                    $CreateGPO['Links'] = $GPO.Links
+                    [PSCustomObject] $CreateGPO
+                }
+            } else {
+                if ($Registry.Registry) {
+                    #$Collection = $Registry.name
+                    $TempCollection = $Collection
+                    if ($Collection) {
+                        $Collection = "$Collection\$($Registry.name)"
+                    } else {
+                        $Collection = $Registry.name
+                    }
+                    Get-XMLNestedRegistry -GPO $GPO -DataSet $Registry.Registry -Collection $Collection
+                    $Collection = $TempCollection
+                }
+                if ($Registry.Collection) {
+                    if ($Collection) {
+                        $Collection = "$Collection\$($Registry.Collection.name)"
+                    } else {
+                        $Collection = "$($Registry.name)\$($Registry.Collection.name)"
+                    }
+                    Get-XMLNestedRegistry -GPO $GPO -DataSet $Registry.Collection -Collection $Collection
+                }
+            }
+        }
+
+    }
+}

Private/Get-XMLOutput.ps1

@@ -0,0 +1,72 @@
+function Get-XMLOutput {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [System.Xml.XmlElement[]] $GPOOutput,
+        [string] $Splitter,
+        [switch] $FullObjects
+    )
+    $LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects
+    foreach ($GpoType in @('User', 'Computer')) {
+        if ($GPOOutput.$GpoType.ExtensionData.Extension) {
+            foreach ($ExtensionType in $GPOOutput.$GpoType.ExtensionData.Extension) {
+                # It's possible that one of the ExtensionType records has value null. Weird but happend.
+                if ($ExtensionType) {
+                    $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
+                    try {
+                        $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
+                    } catch {
+                        Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
+                        continue
+                    }
+                    foreach ($GpoSettings in $KeysToLoop.Name) {
+                        $Template = [ordered] @{
+                            DisplayName = $GPO.DisplayName
+                            DomainName  = $GPO.DomainName
+                            GUID        = $GPO.Guid
+                            GpoType     = $GpoType
+                            GpoCategory = $GPOSettingTypeSplit[1]
+                            GpoSettings = $GpoSettings
+                        }
+                        [PSCustomObject] $Template
+                    }
+                    continue
+
+                    foreach ($GpoSettings in $KeysToLoop.Name) {
+                        foreach ($Key in $ExtensionType.$GpoSettings) {
+                            $Template = [ordered] @{
+                                DisplayName = $GPO.DisplayName
+                                DomainName  = $GPO.DomainName
+                                GUID        = $GPO.Guid
+                                GpoType     = $GpoType
+                                GpoCategory = $GPOSettingTypeSplit[1]
+                                GpoSettings = $GpoSettings
+                            }
+                            try {
+                                $Properties = ($Key | Get-Member -MemberType Properties -ErrorAction Stop).Name
+                            } catch {
+                                Write-Warning "Get-XMLStandard - things went sideways 1 $($_.Exception.Message)"
+                                $Properties = $null
+                            }
+                            foreach ($Property in $Properties) {
+                                $Template["$Property"] = $Key.$Property
+                            }
+                            $Template['Linked'] = $LinksInformation.Linked
+                            $Template['LinksCount'] = $LinksInformation.LinksCount
+                            $Template['Links'] = $LinksInformation.Links
+                            <#
+                            $Template['IncludeComments'] = $GPOOutput.IncludeComments     # : true #: true
+                            $Template['CreatedTime'] = $GPOOutput.CreatedTime         # : 2020-06-17T11:23:22 #: 2020-06-17T11:23:22
+                            $Template['ModifiedTime'] = $GPOOutput.ModifiedTime        # : 2020-06-28T15:49:52 #: 2020-06-28T15:49:52
+                            $Template['ReadTime'] = $GPOOutput.ReadTime            # : 2020-06-28T16:14:09.2209011Z #: 2020-06-28T16:14:09.2209011Z
+                            $Template['SecurityDescriptor'] = $GPOOutput.SecurityDescriptor  # : SecurityDescriptor #: SecurityDescriptor
+                            $Template['FilterDataAvailable'] = $GPOOutput.FilterDataAvailable # : true #: true
+                            #>
+                            [PSCustomObject] $Template
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

Private/Get-XMLStandard.ps1

@@ -0,0 +1,59 @@
+function Get-XMLStandard {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [System.Xml.XmlElement[]] $GPOOutput,
+        [string] $Splitter,
+        [switch] $FullObjects
+    )
+    $LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects
+    foreach ($GpoType in @('User', 'Computer')) {
+        if ($GPOOutput.$GpoType.ExtensionData.Extension) {
+            foreach ($ExtensionType in $GPOOutput.$GpoType.ExtensionData.Extension) {
+                # It's possible that one of the ExtensionType records has value null. Weird but happend.
+                if ($ExtensionType) {
+                    $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
+                    try {
+                        $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
+                    } catch {
+                        Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
+                        continue
+                    }
+                    foreach ($GpoSettings in $KeysToLoop.Name) {
+                        foreach ($Key in $ExtensionType.$GpoSettings) {
+                            $Template = [ordered] @{
+                                DisplayName = $GPO.DisplayName
+                                DomainName  = $GPO.DomainName
+                                GUID        = $GPO.Guid
+                                GpoType     = $GpoType
+                                GpoCategory = $GPOSettingTypeSplit[1]
+                                GpoSettings = $GpoSettings
+                            }
+                            try {
+                                $Properties = ($Key | Get-Member -MemberType Properties -ErrorAction Stop).Name
+                            } catch {
+                                Write-Warning "Get-XMLStandard - things went sideways 1 $($_.Exception.Message)"
+                                $Properties = $null
+                            }
+                            foreach ($Property in $Properties) {
+                                $Template["$Property"] = $Key.$Property
+                            }
+                            $Template['Linked'] = $LinksInformation.Linked
+                            $Template['LinksCount'] = $LinksInformation.LinksCount
+                            $Template['Links'] = $LinksInformation.Links
+                            <#
+                            $Template['IncludeComments'] = $GPOOutput.IncludeComments     # : true #: true
+                            $Template['CreatedTime'] = $GPOOutput.CreatedTime         # : 2020-06-17T11:23:22 #: 2020-06-17T11:23:22
+                            $Template['ModifiedTime'] = $GPOOutput.ModifiedTime        # : 2020-06-28T15:49:52 #: 2020-06-28T15:49:52
+                            $Template['ReadTime'] = $GPOOutput.ReadTime            # : 2020-06-28T16:14:09.2209011Z #: 2020-06-28T16:14:09.2209011Z
+                            $Template['SecurityDescriptor'] = $GPOOutput.SecurityDescriptor  # : SecurityDescriptor #: SecurityDescriptor
+                            $Template['FilterDataAvailable'] = $GPOOutput.FilterDataAvailable # : true #: true
+                            #>
+                            [PSCustomObject] $Template
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

Private/Invoke-GPOTranslation.ps1

@@ -0,0 +1,15 @@
+function Invoke-GPOTranslation {
+    [cmdletBinding()]
+    param(
+        [System.Collections.IDictionary] $InputData,
+        [string] $Report,
+        [string] $Category,
+        [string] $Settings
+    )
+    if ($Category -and $Settings -and $InputData) {
+        if ($Script:GPODitionary[$Report]['Code']) {
+            $Script:GPOList = $InputData.$Category.$Settings
+            return & $Script:GPODitionary[$Report]['Code']
+        }
+    }
+}

Private/Remove-PrivPermission.ps1

@@ -0,0 +1,66 @@
+function Remove-PrivPermission {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [string] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+        [PSCustomObject] $GPOPermission,
+        [alias('PermissionType')][Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType
+    )
+    if ($GPOPermission.Name) {
+        $Text = "Removing SID: $($GPOPermission.Sid), Name: $($GPOPermission.Domain)\$($GPOPermission.Name), SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
+    } else {
+        $Text = "Removing SID: $($GPOPermission.Sid), Name: EMPTY, SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
+    }
+    if ($PrincipalType -eq 'DistinguishedName') {
+        if ($GPOPermission.DistinguishedName -eq $Principal -and $GPOPermission.Permission -eq $IncludePermissionType) {
+            if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, $Text)) {
+                try {
+                    Write-Verbose "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType for $($Principal) / $($GPOPermission.Name) / Type: $($GPOPermission.PermissionType)"
+                    $GPOPermission.GPOSecurity.Remove($GPOPermission.GPOSecurityPermissionItem)
+                    $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                } catch {
+                    Write-Warning "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                }
+            }
+        }
+    } elseif ($PrincipalType -eq 'Sid') {
+        if ($GPOPermission.Sid -eq $Principal -and $GPOPermission.Permission -eq $IncludePermissionType) {
+            if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, $Text)) {
+                try {
+                    Write-Verbose "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType for $($Principal) / $($GPOPermission.Name) / Type: $($GPOPermission.PermissionType)"
+                    $GPOPermission.GPOSecurity.Remove($GPOPermission.GPOSecurityPermissionItem)
+                    $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                } catch {
+                    if ($_.Exception.Message -like '*The request is not supported. (Exception from HRESULT: 0x80070032)*') {
+                        Write-Warning "Remove-GPOZaurrPermission - Bummer! The request is not supported, but lets fix it differently."
+                        # This is basically atomic approach. We will totally remove any permissions for that user on ACL level to get rid of this situation.
+                        # This situation should only happen if DENY is on FULL Control
+                        $ACL = Get-ADACL -ADObject $GPOPermission.GPOObject.Path -Bundle #-Verbose:$VerbosePreference
+                        if ($ACL) {
+                            Remove-ADACL -ACL $ACL -Principal $Principal -AccessControlType Deny -Verbose:$VerbosePreference
+                        }
+                        # I've noticed that in situation where Edit settings, delete, modify security is set and then set to Deny we need to fix it once more
+                        $ACL = Get-ADACL -ADObject $GPOPermission.GPOObject.Path -Bundle
+                        if ($ACL) {
+                            Remove-ADACL -ACL $ACL -Principal $Principal -AccessControlType Allow -Verbose:$VerbosePreference
+                        }
+                    } else {
+                        Write-Warning "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+            }
+        }
+    } elseif ($PrincipalType -eq 'Name') {
+        if ($GPOPermission.Name -eq $Principal -and $GPOPermission.Permission -eq $IncludePermissionType) {
+            if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, $Text)) {
+                try {
+                    Write-Verbose "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType for $($Principal) / $($GPOPermission.Name) / Type: $($GPOPermission.PermissionType)"
+                    $GPOPermission.GPOSecurity.Remove($GPOPermission.GPOSecurityPermissionItem)
+                    $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                } catch {
+                    Write-Warning "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                }
+            }
+        }
+    }
+}

Private/Script.Actions.ps1

@@ -0,0 +1,6 @@
+$Script:Actions = @{
+    C = 'Create'
+    D = 'Delete'
+    U = 'Update'
+    R = 'Replace'
+}

Private/Script.GPODictionary.ps1

@@ -0,0 +1,240 @@
+$Script:GPODitionary = [ordered] @{
+    AccountPolicies      = [ordered] @{
+        Types      = @(
+            @{
+                Category = 'SecuritySettings'
+                Settings = 'Account'
+            }
+        )
+        GPOPath    = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies'
+        Code       = {
+            ConvertTo-XMLAccountPolicy -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLAccountPolicy -GPO $GPO
+        }
+    }
+    Audit                = [ordered] @{
+        Types      = @(
+            @{
+                Category = 'SecuritySettings'
+                Settings = 'Audit'
+            }
+        )
+        GPOPath    = ''
+        Code       = {
+            ConvertTo-XMLAudit -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLAudit -GPO $GPO
+        }
+    }
+    Autologon            = [ordered] @{
+        Types      = @(
+            @{
+                Category = 'RegistrySettings'
+                Settings = 'RegistrySettings'
+            }
+        )
+        Code       = {
+            ConvertTo-XMLRegistryAutologon -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLRegistryAutologon -GPO $GPO
+        }
+    }
+    DriveMapping         = [ordered] @{
+        Types      = @(
+            @{
+                Category = 'DriveMapSettings'
+                Settings = 'DriveMapSettings'
+            }
+        )
+        GPOPath    = ''
+        Code       = {
+            ConvertTo-XMLDriveMapSettings -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLDriveMapSettings -GPO $GPO -SingleObject
+        }
+    }
+    EventLog             = [ordered] @{
+        Types      = @(
+            @{
+                Category = 'SecuritySettings'
+                Settings = 'EventLog'
+            }
+        )
+        GPOPath    = ''
+        Code       = {
+            ConvertTo-XMLEventLog -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLEventLog -GPO $GPO
+        }
+    }
+    LocalUsers           = [ordered] @{
+        Types      = @(
+            @{
+                Category = 'LugsSettings'
+                Settings = 'LocalUsersAndGroups'
+            }
+        )
+        Code       = {
+            ConvertTo-XMLLocalUser -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLLocalUser -GPO $GPO -SingleObject
+        }
+    }
+    LocalGroups          = [ordered] @{
+        Types      = @(
+            @{
+                Category = 'LugsSettings'
+                Settings = 'LocalUsersAndGroups'
+            }
+        )
+        Code       = {
+            ConvertTo-XMLLocalGroups -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLLocalGroups -GPO $GPO -SingleObject
+        }
+    }
+    Policies             = @{
+        Types      = @(
+            @{
+                Category = 'RegistrySettings'
+                Settings = 'Policy'
+            }
+        )
+        Code       = {
+            ConvertTo-XMLPolicies -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLPolicies -GPO $GPO -SingleObject
+        }
+    }
+    Printers             = @{
+        Types      = @(
+            @{
+                Category = 'PrintersSettings'
+                Settings = 'Printers'
+            }
+            @{
+                Category = 'PrinterConnectionSettings'
+                Settings = 'PrinterConnection'
+            }
+        )
+        Code       = {
+            ConvertTo-XMLPrinter -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLPrinter -GPO $GPO -SingleObject
+        }
+    }
+    RegistrySettings     = [ordered] @{
+        Types      = @(
+            @{
+                Category = 'RegistrySettings'
+                Settings = 'RegistrySettings'
+            }
+        )
+        Code       = {
+            ConvertTo-XMLRegistrySettings -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLRegistrySettings -GPO $GPO -SingleObject
+        }
+    }
+    Scripts              = [ordered] @{
+        Types      = @(
+            @{
+                Category = 'Scripts'
+                Settings = 'Script'
+            }
+        )
+        Code       = {
+            ConvertTo-XMLScripts -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLScripts -GPO $GPO -SingleObject
+        }
+    }
+    SecurityOptions      = [ordered] @{
+        Types      = @(
+            @{
+                Category = 'SecuritySettings'
+                Settings = 'SecurityOptions'
+            }
+        )
+        Code       = {
+            ConvertTo-XMLSecurityOptions -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLSecurityOptions -GPO $GPO -SingleObject
+        }
+    }
+    SoftwareInstallation = [ordered] @{
+        Types      = @(
+            @{
+                Category = 'SoftwareInstallationSettings'
+                Settings = 'MsiApplication'
+            }
+        )
+        Code       = {
+            ConvertTo-XMLSoftwareInstallation -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLSoftwareInstallation -GPO $GPO -SingleObject
+        }
+    }
+    SystemServices       = [ordered] @{
+        Types       = @(
+            @{
+                Category = 'SecuritySettings'
+                Settings = 'SystemServices'
+            }
+        )
+        Description = ''
+        GPOPath     = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> System Services'
+        Code        = {
+            ConvertTo-XMLSystemServices -GPO $GPO
+        }
+        CodeSingle  = {
+            ConvertTo-XMLSystemServices -GPO $GPO -SingleObject
+        }
+    }
+    SystemServicesNT     = [ordered] @{
+        Types       = @(
+            @{
+                Category = 'ServiceSettings'
+                Settings = 'NTServices'
+            }
+        )
+        Description = ''
+        GPOPath     = 'Computer Configuration -> Preferences -> Control Pannel Settings -> Services'
+        Code        = {
+            ConvertTo-XMLSystemServicesNT -GPO $GPO
+        }
+        CodeSingle  = {
+            ConvertTo-XMLSystemServicesNT -GPO $GPO -SingleObject
+        }
+    }
+    TaskScheduler        = [ordered] @{
+        Types       = @(
+            @{
+                Category = 'ScheduledTasksSettings'
+                Settings = 'ScheduledTasks'
+            }
+        )
+        Description = ''
+        GPOPath     = ''
+        Code        = {
+            ConvertTo-XMLTaskScheduler -GPO $GPO
+        }
+        CodeSingle  = {
+            ConvertTo-XMLTaskScheduler -GPO $GPO -SingleObject
+        }
+    }
+}

Private/Test-SysvolFolders.ps1

@@ -0,0 +1,119 @@
+function Test-SysVolFolders {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOs,
+        [string] $Server,
+        [string] $Domain
+    )
+    $Differences = @{ }
+    $SysvolHash = @{ }
+
+    $GPOGUIDS = $GPOs.ID.GUID
+    try {
+        $SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -ErrorAction Stop
+    } catch {
+        $Sysvol = $Null
+    }
+    foreach ($_ in $SYSVOL) {
+        $GUID = $_.Name -replace '{' -replace '}'
+        $SysvolHash[$GUID] = $_
+    }
+    $Files = $SYSVOL.Name -replace '{' -replace '}'
+    if ($Files) {
+        $Comparing = Compare-Object -ReferenceObject $GPOGUIDS -DifferenceObject $Files -IncludeEqual
+        foreach ($_ in $Comparing) {
+            if ($_.SideIndicator -eq '==') {
+                $Found = 'Exists'
+            } elseif ($_.SideIndicator -eq '<=') {
+                $Found = 'Not available on SYSVOL'
+            } elseif ($_.SideIndicator -eq '=>') {
+                $Found = 'Orphaned GPO'
+            } else {
+                $Found = 'Orphaned GPO'
+            }
+            $Differences[$_.InputObject] = $Found
+        }
+    }
+    $GPOSummary = @(
+        foreach ($GPO in $GPOS) {
+            if ($null -ne $SysvolHash[$GPO.Id.GUID].FullName) {
+                $FullPath = $SysvolHash[$GPO.Id.GUID].FullName
+                try {
+                    $ACL = Get-Acl -Path $SysvolHash[$GPO.Id.GUID].FullName -ErrorAction Stop
+                    $Owner = $ACL.Owner
+                    $ErrorMessage = ''
+                } catch {
+                    Write-Warning "Get-GPOZaurrSysvol - ACL reading (1) failed for $FullPath with error: $($_.Exception.Message)"
+                    $ACL = $null
+                    $Owner = ''
+                    $ErrorMessage = $_.Exception.Message
+                }
+            } else {
+                $ACL = $null
+            }
+            if ($null -eq $Differences[$GPO.Id.Guid]) {
+                $SysVolStatus = 'Not available on SYSVOL'
+            } else {
+                $SysVolStatus = $Differences[$GPO.Id.Guid]
+            }
+            [PSCustomObject] @{
+                DisplayName      = $GPO.DisplayName
+                Status           = $Differences[$GPO.Id.Guid]
+                DomainName       = $GPO.DomainName
+                SysvolServer     = $Server
+                SysvolStatus     = $SysVolStatus
+                Owner            = $GPO.Owner
+                FileOwner        = $Owner
+                Id               = $GPO.Id.Guid
+                GpoStatus        = $GPO.GpoStatus
+                Path             = $FullPath
+                Description      = $GPO.Description
+                CreationTime     = $GPO.CreationTime
+                ModificationTime = $GPO.ModificationTime
+                UserVersion      = $GPO.UserVersion
+                ComputerVersion  = $GPO.ComputerVersion
+                WmiFilter        = $GPO.WmiFilter
+                Error            = $ErrorMessage
+            }
+        }
+        # Now we need to list thru Sysvol files and fine those that do not exists as GPO and create dummy GPO objects to show orphaned gpos
+        foreach ($_ in $Differences.Keys) {
+            if ($Differences[$_] -eq 'Orphaned GPO') {
+                if ($SysvolHash[$_].BaseName -notcontains 'PolicyDefinitions') {
+                    $FullPath = $SysvolHash[$_].FullName
+                    try {
+                        $ACL = Get-Acl -Path $FullPath -ErrorAction Stop
+                        $Owner = $ACL.Owner
+                        $ErrorMessage = ''
+                    } catch {
+                        Write-Warning "Get-GPOZaurrSysvol - ACL reading (2) failed for $FullPath with error: $($_.Exception.Message)"
+                        $ACL = $null
+                        $Owner = $null
+                        $ErrorMessage = $_.Exception.Message
+                    }
+
+                    [PSCustomObject] @{
+                        DisplayName      = $SysvolHash[$_].BaseName
+                        Status           = 'Orphaned GPO'
+                        DomainName       = $Domain
+                        SysvolServer     = $Server
+                        SysvolStatus     = $Differences[$GPO.Id.Guid]
+                        Owner            = ''
+                        FileOwner        = $Owner
+                        Id               = $_
+                        GpoStatus        = 'Orphaned'
+                        Path             = $FullPath
+                        Description      = $null
+                        CreationTime     = $SysvolHash[$_].CreationTime
+                        ModificationTime = $SysvolHash[$_].LastWriteTime
+                        UserVersion      = $null
+                        ComputerVersion  = $null
+                        WmiFilter        = $null
+                        Error            = $ErrorMessage
+                    }
+                }
+            }
+        }
+    )
+    $GPOSummary | Sort-Object -Property DisplayName
+}

Public/Add-GPOPermission.ps1

@@ -0,0 +1,41 @@
+function Add-GPOPermission {
+    [cmdletBinding()]
+    param(
+        [validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
+        [Microsoft.GroupPolicy.GPPermissionType] $IncludePermissionType,
+        [alias('Trustee')][string] $Principal,
+        [alias('TrusteeType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+        [validateSet('Allow', 'Deny')][string] $PermitType = 'Allow'
+    )
+    if ($Type -eq 'Default') {
+        @{
+            Action                = 'Add'
+            Type                  = 'Default'
+            Principal             = $Principal
+            IncludePermissionType = $IncludePermissionType
+            PrincipalType         = $PrincipalType
+            PermitType            = $PermitType
+        }
+    } elseif ($Type -eq 'AuthenticatedUsers') {
+        @{
+            Action                = 'Add'
+            Type                  = 'AuthenticatedUsers'
+            IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
+        }
+    } elseif ($Type -eq 'Administrative') {
+        @{
+            Action                = 'Add'
+            Type                  = 'Administrative'
+            IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
+        }
+    } elseif ($Type -eq 'WellKnownAdministrative') {
+        @{
+            Action                = 'Add'
+            Type                  = 'WellKnownAdministrative'
+            IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
+        }
+    }
+}

Public/Add-GPOZaurrPermission.ps1

@@ -10,99 +10,204 @@
         [Parameter(ParameterSetName = 'ADObject', Mandatory)]
         [alias('OrganizationalUnit', 'DistinguishedName')][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
 
-        [string] $Principal,
-        [Microsoft.GroupPolicy.GPPermissionType[]] $PermissionType,
+        [validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
+
+        [alias('Trustee')][string] $Principal,
+        [alias('TrusteeType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+
+        [Parameter(Mandatory)][alias('IncludePermissionType')][Microsoft.GroupPolicy.GPPermissionType] $PermissionType,
         [switch] $Inheritable,
 
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
         [System.Collections.IDictionary] $ExtendedForestInformation,
-
+        [System.Collections.IDictionary] $ADAdministrativeGroups,
         [int] $LimitProcessing
     )
-    Begin {
-        $Count = 0
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Extended
+    if (-not $ADAdministrativeGroups) {
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
     }
-    Process {
-
-        if ($GPOName) {
-            $Splat = @{
-                GPOName = $GPOName
-            }
-        } elseif ($GPOGUID) {
-            $Splat = @{
-                GPOGUID = $GPOGUID
-            }
-        } else {
-            $Splat = @{
-
-            }
+    if ($GPOName) {
+        $Splat = @{
+            GPOName = $GPOName
         }
-
-        $Splat['IncludeGPOObject'] = $true
-        $Splat['Forest'] = $Forest
-        $Splat['IncludeDomains'] = $IncludeDomains
-        $Splat['ExcludeDomains'] = $ExcludeDomains
-        $Splat['ExtendedForestInformation'] = $ExtendedForestInformation
-        #$Splat['ExcludePermissionType'] = $ExcludePermissionType
-        #$Splat['IncludePermissionType'] = $PermissionType-
-        $Splat['SkipWellKnown'] = $SkipWellKnown.IsPresent
-        $Splat['SkipAdministrative'] = $SkipAdministrative.IsPresent
-
-        # Get-GPOZaurrPermission @Splat
-
-        #Set-GPPermission -PermissionLevel $PermissionType -TargetName $Principal -TargetType Group -Verbose -DomainName 'ad.evotec.xyz' -Name $GPOName -Replace #-WhatIf
-
-        #continue
-        [Array] $GPOPermissions = Get-GPOZaurrPermission @Splat
-        [Array] $LimitedPermissions = foreach ($GPOPermission in $GPOPermissions) {
-            #$GPOPermission = $_
-            # continue
-            if ($GPOPermission.Name -eq $Principal -and $GPOPermission.Permission -eq $PermissionType) {
-                Write-Verbose "Add-GPOZaurrPermission - Permission $PermissionType already set for $($GPOPermission.Name) / $($GPOPermission.DomainName)"
-                $GPOPermission
-                #break
-            }
-            # Write-Verbose "Test"
-            # $GPOPermission
-
-
-
-
-            #$GPOPermission.GPOSecurity.Add
-            #void Add(Microsoft.GroupPolicy.GPPermission item)
-            #void ICollection[GPPermission].Add(Microsoft.GroupPolicy.GPPermission item)
-            #int IList.Add(System.Object value)
-
-
-            # $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+    } elseif ($GPOGUID) {
+        $Splat = @{
+            GPOGUID = $GPOGUID
         }
+    } else {
+        $Splat = @{}
+    }
+    $Splat['IncludeGPOObject'] = $true
+    $Splat['Forest'] = $Forest
+    $Splat['IncludeDomains'] = $IncludeDomains
+    if ($Type -ne 'Default') {
+        $Splat['Type'] = $Type
+    }
+    $Splat['PermitType'] = $PermitType
+    $Splat['Principal'] = $Principal
+    if ($PrincipalType) {
+        $Splat.PrincipalType = $PrincipalType
+    }
+    $Splat['ExcludeDomains'] = $ExcludeDomains
+    $Splat['ExtendedForestInformation'] = $ExtendedForestInformation
+    #$Splat['ExcludePermissionType'] = $ExcludePermissionType
+    $Splat['IncludePermissionType'] = $PermissionType
+    $Splat['SkipWellKnown'] = $SkipWellKnown.IsPresent
+    $Splat['SkipAdministrative'] = $SkipAdministrative.IsPresent
 
-        if ($LimitedPermissions.Count -gt 0) {
-            #$LimitedPermissions
-        } else {
-            try {
-                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal)"
-                $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
-                $GPOPermissions[0].GPOSecurity.Add($AddPermission)
-                $GPOPermissions[0].GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
-            } catch {
-                Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+    $AdministrativeExists = @{
+        DomainAdmins     = $false
+        EnterpriseAdmins = $false
+    }
+
+    # This should always return results. When no data is found it should return basic information that will allow us to add credentials.
+    [Array] $GPOPermissions = Get-GPOZaurrPermission @Splat -ReturnSecurityWhenNoData
+    # When it has GPOSecurityPermissionItem property it means it has permissions, if it doesn't it means we have clean object to process
+    if ($GPOPermissions.GPOSecurityPermissionItem) {
+        # Permission exists, but may be incomplete
+        foreach ($GPOPermission in $GPOPermissions) {
+            if ($Type -eq 'Default') {
+                # We were looking for specific principal and we got it. nothing to do
+                # this is for standard users such as przemyslaw.klys / adam.gonzales
+                return
+            } elseif ($Type -eq 'Administrative') {
+                # We are looking for administrative but we need to make sure we got correct administrative
+                if ($GPOPermission.Permission -eq $PermissionType) {
+                    $AdministrativeGroup = $ADAdministrativeGroups['BySID'][$GPOPermission.SID]
+                    if ($AdministrativeGroup.SID -like '*-519') {
+                        $AdministrativeExists['EnterpriseAdmins'] = $true
+                    } elseif ($AdministrativeGroup.SID -like '*-512') {
+                        $AdministrativeExists['DomainAdmins'] = $true
+                    }
+                    <#
+                    if ($AdministrativeGroup) {
+                        $DomainAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-512')
+                        $EnterpriseAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-519')
+                        if ($GPOPermission.SID -eq $DomainAdminsSID) {
+                            $AdministrativeExists['DomainAdmins'] = $true
+                        } elseif ($GPOPermission.SID -eq $EnterpriseAdminsSID) {
+                            $AdministrativeExists['EnterpriseAdmins'] = $true
+                        }
+                    }
+                    #>
+                }
+            } elseif ($Type -eq 'WellKnownAdministrative') {
+                # this is for SYSTEM account
+                return
+            } elseif ($Type -eq 'AuthenticatedUsers') {
+                # this is for Authenticated Users
+                return
             }
-
-            <#
-            [Microsoft.GroupPolicy.GPPermission]::new
-
-            OverloadDefinitions
-            -------------------
-            Microsoft.GroupPolicy.GPPermission new(string trustee, Microsoft.GroupPolicy.GPPermissionType rights, bool inheritable)
-            Microsoft.GroupPolicy.GPPermission new(System.Security.Principal.IdentityReference identity, Microsoft.GroupPolicy.GPPermissionType rights, bool inheritable)
-
-            #>
         }
     }
-    End {
+    if (-not $GPOPermissions) {
+        # This is bad - things went wrong
+        Write-Warning "Add-GPOZaurrPermission - Couldn't get permissions for GPO. Things aren't what they should be. Skipping!"
+    } else {
+        $GPO = $GPOPermissions[0]
+        if ($GPOPermissions.GPOSecurityPermissionItem) {
+            # We asked, we got response, now we need to check if maybe we're missing one of the two administrative groups
+            if ($Type -eq 'Administrative') {
+                # this is a case where something was returned. Be it Domain Admins or Enterprise Admins or both. But we still need to check because it may have been Domain Admins from other domain or just one of the two required groups
+                if ($AdministrativeExists['DomainAdmins'] -eq $false) {
+                    $Principal = $ADAdministrativeGroups[$GPO.DomainName]['DomainAdmins']
+                    Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                    if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                        try {
+                            $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                            $GPO.GPOSecurity.Add($AddPermission)
+                            $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                        } catch {
+                            Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                        }
+                    }
+                }
+                if ($AdministrativeExists['EnterpriseAdmins'] -eq $false) {
+                    $Principal = $ADAdministrativeGroups[$ForestInformation.Forest.RootDomain]['EnterpriseAdmins']
+                    Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                    if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                        try {
+                            $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                            $GPO.GPOSecurity.Add($AddPermission)
+                            $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                        } catch {
+                            Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                        }
+                    }
+                }
+            } elseif ($Type -eq 'Default') {
+                # This shouldn't really happen, as if we got response, and it didn't exists it wouldn't be here
+                Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType skipped for $($Principal). This shouldn't even happen!"
+            }
+        } else {
+            # We got no response. That means we either asked incorrectly or we need to fix permission. Trying to do so
+            if ($Type -eq 'Default') {
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal)"
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'Administrative') {
+                # this is a case where both Domain Admins/Enterprise Admins were missing
+                $Principal = $ADAdministrativeGroups[$GPO.DomainName]['DomainAdmins']
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+                $Principal = $ADAdministrativeGroups[$ForestInformation.Forest.RootDomain]['EnterpriseAdmins']
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'WellKnownAdministrative') {
+                $Principal = 'S-1-5-18'
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal (SYSTEM) / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) (SYSTEM) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'AuthenticatedUsers') {
+                $Principal = 'S-1-5-11'
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal (Authenticated Users) / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) (Authenticated Users) with error: $($_.Exception.Message)"
+                    }
+                }
+            }
+        }
 
     }
 }

Public/Get-GPOZaurr.ps1

@@ -12,10 +12,15 @@
 
         [switch] $PermissionsOnly,
         [switch] $OwnerOnly,
-        [switch] $Limited
+        [switch] $Limited,
+
+        [System.Collections.IDictionary] $ADAdministrativeGroups
     )
     Begin {
-        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        if (-not $ADAdministrativeGroups) {
+            Write-Verbose "Get-GPOZaurr - Getting ADAdministrativeGroups"
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
         if (-not $GPOPath) {
             $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         }
@@ -31,7 +36,7 @@
                             try {
                                 $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
                             } catch {
-                                Write-Warning "Get-GPOZaurr - Failed to ger GPOReport: $($_.Exception.Message). Skipping."
+                                Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
                                 continue
                             }
                             Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
@@ -46,7 +51,7 @@
                             try {
                                 $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
                             } catch {
-                                Write-Warning "Get-GPOZaurr - Failed to ger GPOReport: $($_.Exception.Message). Skipping."
+                                Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
                                 continue
                             }
                             Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
@@ -61,7 +66,7 @@
                             try {
                                 $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
                             } catch {
-                                Write-Warning "Get-GPOZaurr - Failed to ger GPOReport: $($_.Exception.Message). Skipping."
+                                Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
                                 continue
                             }
                             Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups

Public/Get-GPOZaurrAD.ps1

@@ -0,0 +1,77 @@
+function Get-GPOZaurrAD {
+    [cmdletbinding(DefaultParameterSetName = 'Default')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')]
+        [string] $GPOName,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    }
+    Process {
+        foreach ($Domain in $ForestInformation.Domains) {
+            if ($PSCmdlet.ParameterSetName -eq 'GPOGUID') {
+                if ($GPOGuid) {
+                    if ($GPOGUID -notlike '*{*') {
+                        $GUID = -join ("{", $GPOGUID, '}')
+                    } else {
+                        $GUID = $GPOGUID
+                    }
+                    $Splat = @{
+                        Filter = "(objectClass -eq 'groupPolicyContainer') -and (Name -eq '$GUID')"
+                        Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                    }
+                } else {
+                    Write-Warning "Get-GPOZaurrAD - GPOGUID parameter is empty. Provide name and try again."
+                    continue
+                }
+            } elseif ($PSCmdlet.ParameterSetName -eq 'GPOName') {
+                if ($GPOName) {
+                    $Splat = @{
+                        Filter = "(objectClass -eq 'groupPolicyContainer') -and (DisplayName -eq '$GPOName')"
+                        Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                    }
+                } else {
+                    Write-Warning "Get-GPOZaurrAD - GPOName parameter is empty. Provide name and try again."
+                    continue
+                }
+            } else {
+                $Splat = @{
+                    Filter = "(objectClass -eq 'groupPolicyContainer')"
+                    Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                }
+            }
+            Get-ADObject @Splat -Properties DisplayName, Name, Created, Modified, gPCFileSysPath, gPCFunctionalityVersion, gPCWQLFilter, gPCMachineExtensionNames, Description, CanonicalName, DistinguishedName | ForEach-Object -Process {
+                $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDomainCN
+                $GUID = $_.Name -replace '{' -replace '}'
+                if (($GUID).Length -ne 36) {
+                    Write-Warning "Get-GPOZaurrAD - GPO GUID ($($($GUID.Replace("`n",' ')))) is incorrect. Skipping $($_.DisplayName) / Domain: $($DomainCN)"
+                } else {
+                    $Output = [ordered]@{ }
+                    $Output['DisplayName'] = $_.DisplayName
+                    $Output['DomainName'] = $DomainCN
+                    $Output['Description'] = $_.Description
+                    $Output['GUID'] = $GUID
+                    $Output['Path'] = $_.gPCFileSysPath
+                    $Output['FunctionalityVersion'] = $_.gPCFunctionalityVersion
+                    $Output['Created'] = $_.Created
+                    $Output['Modified'] = $_.Modified
+                    $Output['GPOCanonicalName'] = $_.CanonicalName
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDC
+                    $Output['GPODistinguishedName'] = $_.DistinguishedName
+                    [PSCustomObject] $Output
+                }
+            }
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrBackupInformation.ps1

@@ -11,15 +11,15 @@
             if ($Folder) {
                 if ((Test-Path -LiteralPath "$Folder\manifest.xml")) {
                     [xml] $Xml = Get-Content -LiteralPath "$Folder\manifest.xml"
-                    $Xml.Backups.BackupInst | ForEach-Object {
+                    $Xml.Backups.BackupInst | ForEach-Object -Process {
                         [PSCustomObject] @{
                             DisplayName      = $_.GPODisplayName.'#cdata-section'
                             DomainName       = $_.GPODomain.'#cdata-section'
-                            Guid             = $_.GPOGUid.'#cdata-section'
-                            DomainGuid       = $_.GPODomainGuid.'#cdata-section'
+                            Guid             = $_.GPOGUid.'#cdata-section' -replace '{' -replace '}'
+                            DomainGuid       = $_.GPODomainGuid.'#cdata-section' -replace '{' -replace '}'
                             DomainController = $_.GPODomainController.'#cdata-section'
-                            BackupTime       = $_.BackupTime.'#cdata-section'
-                            ID               = $_.ID.'#cdata-section'
+                            BackupTime       = [DateTime]::Parse($_.BackupTime.'#cdata-section')
+                            ID               = $_.ID.'#cdata-section' -replace '{' -replace '}'
                             Comment          = $_.Comment.'#cdata-section'
                         }
                     }

Public/Get-GPOZaurrEmptyFolders.ps1

@@ -0,0 +1,29 @@
+function Get-GPOZaurrEmptyFolders {
+    [cmdletBinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [switch] $AllFolders
+    )
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies" -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -Force -Directory | ForEach-Object {
+            $FullFolder = Test-Path -Path "$($_.FullName)\*"
+            if (-not $FullFolder -or $AllFolders) {
+                [PSCustomObject] @{
+                    FullName      = $_.FullName
+                    IsEmptyFolder = -not $FullFolder
+                    Name          = $_.Name
+                    Root          = $_.Root
+                    Parent        = $_.Parent
+                    CreationTime  = $_.CreationTime
+                    LastWriteTime = $_.LastWriteTime
+                    Attributes    = $_.Attributes
+                    DomainName    = $Domain
+                }
+            }
+        }
+    }
+}

Public/Get-GPOZaurrFiles.ps1

@@ -0,0 +1,309 @@
+function Get-GPOZaurrFiles {
+    [cmdletbinding()]
+    param(
+        [ValidateSet('All', 'Netlogon', 'Sysvol')][string[]] $Type = 'All',
+        [ValidateSet('None', 'MACTripleDES', 'MD5', 'RIPEMD160', 'SHA1', 'SHA256', 'SHA384', 'SHA512')][string] $HashAlgorithm = 'None',
+        [switch] $Signature,
+        [switch] $Limited,
+        [switch] $AsHashTable,
+        [switch] $Extended,
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $GPOCache = @{}
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    $GPOList = Get-GPOZaurrAD -ExtendedForestInformation $ForestInformation
+    foreach ($GPO in $GPOList) {
+        if (-not $GPOCache[$GPO.DomainName]) {
+            $GPOCache[$GPO.DomainName] = @{}
+        }
+        $GPOCache[$($GPO.DomainName)][($GPO.GUID)] = $GPO
+    }
+    foreach ($Domain in $ForestInformation.Domains) {
+        $Path = @(
+            if ($Type -contains 'All') {
+                "\\$Domain\SYSVOL\$Domain"
+            }
+            if ($Type -contains 'Sysvol') {
+                "\\$Domain\SYSVOL\$Domain\policies"
+            }
+            if ($Type -contains 'NetLogon') {
+                "\\$Domain\NETLOGON"
+            }
+        )
+        # Order does matter
+        $Folders = [ordered] @{
+            "\\$Domain\SYSVOL\$Domain\policies\PolicyDefinitions" = @{
+                Name = 'SYSVOL PolicyDefinitions'
+            }
+            "\\$Domain\SYSVOL\$Domain\policies"                   = @{
+                Name = 'SYSVOL Policies'
+            }
+            "\\$Domain\SYSVOL\$Domain\scripts"                    = @{
+                Name = 'NETLOGON Scripts'
+            }
+            "\\$Domain\SYSVOL\$Domain\StarterGPOs"                = @{
+                Name = 'SYSVOL GPO Starters'
+            }
+            "\\$Domain\NETLOGON"                                  = @{
+                Name = 'NETLOGON Scripts'
+            }
+            "\\$Domain\SYSVOL\$Domain"                            = @{
+                Name = 'SYSVOL Root'
+            }
+        }
+        Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File -Force | ForEach-Object {
+            # Lets reset values just to be sure those are empty
+            $GPO = $null
+            $BelongsToGPO = $false
+            $GPODisplayName = $null
+            $SuggestedAction = $null
+            $SuggestedActionComment = $null
+            $FileType = foreach ($Key in $Folders.Keys) {
+                if ($_.FullName -like "$Key*") {
+                    $Folders[$Key]
+                    break
+                }
+            }
+            if ($FileType.Name -eq 'SYSVOL Policies') {
+                $FoundGUID = $_.FullName -match '[\da-zA-Z]{8}-([\da-zA-Z]{4}-){3}[\da-zA-Z]{12}'
+                if ($FoundGUID) {
+                    $GPO = $GPOCache[$Domain][$matches[0]]
+                    if ($GPO) {
+                        $BelongsToGPO = $true
+                        $GPODisplayName = $GPO.DisplayName
+                    }
+                }
+                $Correct = @(
+                    [System.IO.Path]::Combine($GPO.Path, 'GPT.INI')
+                    [System.IO.Path]::Combine($GPO.Path, 'GPO.cmt')
+                    [System.IO.Path]::Combine($GPO.Path, 'Group Policy', 'GPE.ini')
+                    foreach ($TypeM in @('Machine', 'User')) {
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Registry.pol')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'comment.cmtx')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Registry\Registry.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Printers\Printers.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\ScheduledTasks\ScheduledTasks.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Services\Services.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Groups\Groups.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\RegionalOptions\RegionalOptions.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\FolderOptions\FolderOptions.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Drives\Drives.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\InternetSettings\InternetSettings.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Folders\Folders.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\PowerOptions\PowerOptions.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Shortcuts\Shortcuts.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Files\Files.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\EnvironmentVariables\EnvironmentVariables.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\NetworkOptions\NetworkOptions.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\DataSources\DataSources.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\NetworkShares\NetworkShares.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\StartMenuTaskbar\StartMenuTaskbar.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Applications\Microsoft\TBLayout.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Applications\Microsoft\DefaultApps.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Applications\ADE.CFG')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Scripts\scripts.ini')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Scripts\psscripts.ini')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Documents & Settings\fdeploy.ini')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Documents & Settings\fdeploy1.ini')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Documents & Settings\fdeploy2.ini')
+                        if ($_.Extension -eq '.aas') {
+                            [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Applications', $_.Name)
+                        }
+                    }
+                    [System.IO.Path]::Combine($GPO.Path, 'Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf')
+                    [System.IO.Path]::Combine($GPO.Path, 'Machine\Microsoft\Windows NT\Audit\audit.csv')
+                )
+                if ($GPO) {
+                    if ($_.FullName -in $Correct) {
+                        $SuggestedAction = 'Skip assesment'
+                        $SuggestedActionComment = 'Correctly placed in SYSVOL'
+                    } elseif ($_.FullName -like '*_NTFRS_*') {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Most likely replication error'
+                    } elseif ($_.Extension -eq '.adm') {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Most likely legacy ADM files'
+                    }
+                    if (-not $SuggestedAction) {
+                        $FullPathAdmFiles = [System.IO.Path]::Combine($GPO.Path, 'Adm\admfiles.ini')
+                        if ($_.FullName -eq $FullPathAdmFiles) {
+                            $SuggestedAction = 'Consider deleting'
+                            $SuggestedActionComment = 'Most likely legacy ADM files settings file'
+                        }
+                    }
+                    if (-not $SuggestedAction) {
+                        foreach ($Ext in @('*old*', '*bak*', '*bck', '.new')) {
+                            if ($_.Extension -like $Ext) {
+                                $SuggestedAction = 'Consider deleting'
+                                $SuggestedActionComment = 'Most likely backup files'
+                                break
+                            }
+                        }
+                    }
+                    if (-not $SuggestedAction) {
+                        <#
+                        $IEAK = @(
+                            'microsoft\IEAK\install.ins'
+                            'MICROSOFT\IEAK\BRANDING\cs\connect.ras'
+                            'microsoft\IEAK\BRANDING\cs\connect.set'
+                            'microsoft\IEAK\BRANDING\cs\cs.dat'
+                            'microsoft\IEAK\BRANDING\ADM\inetcorp.iem'
+                            'microsoft\IEAK\BRANDING\ADM\inetcorp.inf'
+                            'microsoft\IEAK\install.ins'
+                            'microsoft\IEAK\BRANDING\favs\Outlook.ico'
+                            'microsoft\IEAK\BRANDING\favs\Bio.ico'
+                            'MICROSOFT\IEAK\BRANDING\favs\$fi380.ico'
+                            'microsoft\IEAK\BRANDING\PROGRAMS\programs.inf'
+                            'MICROSOFT\IEAK\BRANDING\RATINGS\ratings.inf'
+                            'MICROSOFT\IEAK\BRANDING\RATINGS\ratrsop.inf'
+                            'microsoft\IEAK\BRANDING\ZONES\seczones.inf'
+                            'microsoft\IEAK\BRANDING\ZONES\seczrsop.inf'
+                            'microsoft\IEAK\BRANDING\ZONES\seczrsop.inf'
+                        )
+                        #>
+                        if ($_.FullName -like '*microsoft\IEAK*') {
+                            # https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11#:~:text=The%20Internet%20Explorer%20Maintenance%20(IEM,Internet%20Explorer%2010%20or%20newer.
+                            $SuggestedAction = 'GPO requires cleanup'
+                            $SuggestedActionComment = 'Internet Explorer Maintenance (IEM) is deprecated for IE 11'
+                        }
+                    }
+                } else {
+                    <#
+                    $FullPathAdmFiles = [System.IO.Path]::Combine($GPO.Path, 'Adm\admfiles.ini')
+                    if ($_.FullName -in $Correct) {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Most likely orphaned SYSVOL GPO'
+                    } elseif ($_.Extension -eq '.adm') {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Most likely orphaned SYSVOL GPO (legacy ADM files)'
+                    } elseif ($_.FullName -eq $FullPathAdmFiles) {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Most likely orphaned SYSVOL GPO (legacy ADM files)'
+                    }
+                    #>
+                    $SuggestedAction = 'Consider deleting'
+                    $SuggestedActionComment = 'Most likely orphaned SYSVOL GPO'
+                }
+            } elseif ($FileType.Name -eq 'NETLOGON Scripts') {
+                foreach ($Ext in @('*old*', '*bak*', '*bck', '.new')) {
+                    if ($_.Extension -like $Ext) {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Most likely backup files'
+                        break
+                    }
+                }
+                if (-not $SuggestedAction) {
+                    # We didn't find it in earlier check, lets go deeper
+                    if ($_.Extension.Length -gt 6 -and $_.Extension -notin @('.config', '.sites', '.ipsec')) {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Extension longer then 5 chars'
+                    } elseif ($_.Extension -eq '') {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'No extension'
+                    }
+                }
+                if (-not $SuggestedAction) {
+                    foreach ($Name in @('*old*', '*bak*', '*bck*', '*Copy', '*backup*')) {
+                        if ($_.BaseName -like $Name) {
+                            $SuggestedAction = 'Consider deleting'
+                            $SuggestedActionComment = "FileName contains backup related names ($Name)"
+                            break
+                        }
+                    }
+                }
+                if (-not $SuggestedAction) {
+                    foreach ($FullName in @('*backup*', '*Delete*', '*Obsoleet*', '*Obsolete*', '*Archive*')) {
+                        if ($_.FullName -like $FullName) {
+                            $SuggestedAction = 'Consider deleting'
+                            $SuggestedActionComment = "Fullname contains backup related names ($FullName)"
+                            break
+                        }
+                    }
+                }
+                if (-not $SuggestedAction) {
+                    # We replace all letters leaving only numbers
+                    # We want to find if there is a date possibly
+                    $StrippedNumbers = $_.Name -replace "[^0-9]" , ''
+                    if ($StrippedNumbers.Length -gt 5) {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'FileName contains over 5 numbers (date?)'
+                    }
+                }
+            } elseif ($FileType.Name -eq 'SYSVOL PolicyDefinitions') {
+                if ($_.Extension -in @('.admx', '.adml')) {
+                    $SuggestedAction = 'Skip assesment'
+                    $SuggestedActionComment = 'Most likely ADMX templates'
+                }
+            } elseif ($FileType.Name -eq 'SYSVOL GPO Starters') {
+                $FoundGUID = $_.FullName -match '[\da-zA-Z]{8}-([\da-zA-Z]{4}-){3}[\da-zA-Z]{12}'
+                if ($FoundGUID) {
+                    $GUID = $matches[0]
+                    $TemporaryStarterPath = "\\$Domain\SYSVOL\$Domain\StarterGPOs\{$GUID}"
+                    $Correct = @(
+                        [System.IO.Path]::Combine($TemporaryStarterPath, 'StarterGPO.tmplx')
+                        [System.IO.Path]::Combine($TemporaryStarterPath, 'en-US', 'StarterGPO.tmpll')
+                        foreach ($TypeM in @('Machine', 'User')) {
+                            [System.IO.Path]::Combine($TemporaryStarterPath, $TypeM, 'Registry.pol')
+                            [System.IO.Path]::Combine($TemporaryStarterPath, $TypeM, 'comment.cmtx')
+                        }
+                    )
+                    if ($_.FullName -in $Correct) {
+                        $SuggestedAction = 'Skip assesment'
+                        $SuggestedActionComment = 'Correctly placed in SYSVOL'
+                    }
+                }
+            } else {
+
+            }
+            if (-not $SuggestedAction) {
+                $SuggestedAction = 'Requires verification'
+                $SuggestedActionComment = 'Not able to auto asses'
+            }
+            if ($Limited) {
+                $MetaData = [ordered] @{
+                    LocationType           = $FileType.Name
+                    FullName               = $_.FullName
+                    #Name                   = $_.Name
+                    Extension              = $_.Extension
+                    SuggestedAction        = $SuggestedAction
+                    SuggestedActionComment = $SuggestedActionComment
+                    BelongsToGPO           = $BelongsToGPO
+                    GPODisplayName         = $GPODisplayName
+                    Attributes             = $_.Attributes
+                    CreationTime           = $_.CreationTime
+                    LastAccessTime         = $_.LastAccessTime
+                    LastWriteTime          = $_.LastWriteTime
+                }
+            } else {
+                $MetaData = Get-FileMetaData -File $_ -AsHashTable
+            }
+            if ($Signature) {
+                $DigitalSignature = Get-AuthenticodeSignature -FilePath $_.Fullname
+                $MetaData['SignatureStatus'] = $DigitalSignature.Status
+                $MetaData['IsOSBinary'] = $DigitalSignature.IsOSBinary
+                $MetaData['SignatureCertificateSubject'] = $DigitalSignature.SignerCertificate.Subject
+                if ($Extended) {
+                    $MetaData['SignatureCertificateIssuer'] = $DigitalSignature.SignerCertificate.Issuer
+                    $MetaData['SignatureCertificateSerialNumber'] = $DigitalSignature.SignerCertificate.SerialNumber
+                    $MetaData['SignatureCertificateNotBefore'] = $DigitalSignature.SignerCertificate.NotBefore
+                    $MetaData['SignatureCertificateNotAfter'] = $DigitalSignature.SignerCertificate.NotAfter
+                    $MetaData['SignatureCertificateThumbprint'] = $DigitalSignature.SignerCertificate.Thumbprint
+                }
+            }
+            if ($HashAlgorithm -ne 'None') {
+                $MetaData['ChecksumSHA256'] = (Get-FileHash -LiteralPath $_.FullName -Algorithm $HashAlgorithm).Hash
+            }
+            if ($AsHashTable) {
+                $MetaData
+            } else {
+                [PSCustomObject] $MetaData
+            }
+        }
+        foreach ($e in $err) {
+            Write-Warning "Get-GPOZaurrFiles - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
+        }
+    }
+}

Public/Get-GPOZaurrFilesPolicyDefinition.ps1

@@ -0,0 +1,96 @@
+function Get-GPOZaurrFilesPolicyDefinitions {
+    [cmdletbinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [switch] $Signature
+    )
+    $Output = [ordered] @{
+        FilesToDelete = [System.Collections.Generic.List[Object]]::new()
+    }
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    $FilesCache = @{}
+    foreach ($Domain in $ForestInformation.Domains) {
+        $Output[$Domain] = [ordered] @{}
+        $FilesCache[$Domain] = [ordered] @{}
+        $Directories = Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies\PolicyDefinitions" -Directory -ErrorAction SilentlyContinue -ErrorVariable err
+        [Array] $Languages = foreach ($Directory in $Directories) {
+            if ($Directory.BaseName.Length -eq 5) {
+                $Directory.BaseName
+            }
+        }
+        $Files = Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies\PolicyDefinitions" -ErrorAction SilentlyContinue -ErrorVariable +err -File #| Select-Object Name, FullName, CreationTime, LastWriteTime, Attributes
+        foreach ($File in $Files) {
+            $FilesCache[$Domain][$($File.BaseName)] = [ordered] @{
+                Name           = $File.BaseName
+                FullName       = $File.FullName
+                IsReadOnly     = $File.IsReadOnly
+                CreationTime   = $File.CreationTime
+                LastAccessTime = $File.LastAccessTime
+                LastWriteTime  = $File.LastWriteTime
+                IsConsistent   = $false
+            }
+            foreach ($Language in $Languages) {
+                $FilesCache[$Domain][$($File.BaseName)][$Language] = $false
+            }
+            if ($Signature) {
+                $DigitalSignature = Get-AuthenticodeSignature -FilePath $File.FullName
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureStatus'] = $DigitalSignature.Status
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateSubject'] = $DigitalSignature.SignerCertificate.Subject
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateIssuer'] = $DigitalSignature.SignerCertificate.Issuer
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateSerialNumber'] = $DigitalSignature.SignerCertificate.SerialNumber
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateNotBefore'] = $DigitalSignature.SignerCertificate.NotBefore
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateNotAfter'] = $DigitalSignature.SignerCertificate.NotAfter
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateThumbprint'] = $DigitalSignature.SignerCertificate.Thumbprint
+                $FilesCache[$Domain][$($File.BaseName)]['IsOSBinary'] = $DigitalSignature.IsOSBinary
+            }
+        }
+        foreach ($Directory in $Directories) {
+            $FilesLanguage = Get-ChildItem -Path $Directory.FullName -ErrorAction SilentlyContinue -ErrorVariable +err
+            foreach ($FileLanguage in $FilesLanguage) {
+                if ($FileLanguage.Extension -eq '.adml') {
+                    if ($FilesCache[$Domain][$FileLanguage.BaseName]) {
+                        $FilesCache[$Domain][$FileLanguage.BaseName][$Directory.Name] = $true
+                    } else {
+                        #Write-Warning "Get-GPOZaurrFilesPolicyDefinitions - File $($FileLanguage.FullName) doesn't have a match."
+                        $Output.FilesToDelete.Add(
+                            [PSCustomobject] @{
+                                Name           = $FileLanguage.BaseName
+                                FullName       = $FileLanguage.FullName
+                                IsReadOnly     = $FileLanguage.IsReadOnly
+                                CreationTime   = $FileLanguage.CreationTime
+                                LastAccessTime = $FileLanguage.LastAccessTime
+                                LastWriteTime  = $FileLanguage.LastWriteTime
+                            }
+                        )
+                    }
+                } else {
+
+                }
+            }
+        }
+
+        foreach ($e in $err) {
+            Write-Warning "Get-GPOZaurrLegacy - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
+        }
+        $ExcludeProperty = @(
+            'Name', 'FullName', 'IsReadOnly', 'CreationTime', 'LastAccessTime', 'LastWriteTime', 'IsConsistent'
+            'SignatureCertificateSubject', 'SignatureCertificateIssuer', 'SignatureCertificateSerialNumber', 'SignatureCertificateNotBefore'
+            'SignatureCertificateNotAfter', 'SignatureCertificateThumbprint', 'SignatureStatus', 'IsOSBinary'
+        )
+        $Properties = Select-Properties -Objects $FilesCache[$Domain][0] -ExcludeProperty $ExcludeProperty
+        $Output[$Domain] = foreach ($File in $FilesCache[$Domain].Keys) {
+            $Values = foreach ($Property in $Properties) {
+                $FilesCache[$Domain][$File][$Property]
+            }
+            if ($Values -notcontains $false) {
+                $FilesCache[$Domain][$File]['IsConsistent'] = $true
+            }
+            [PSCustomObject] $FilesCache[$Domain][$File]
+        }
+    }
+    $Output
+}

Public/Get-GPOZaurrLegacyFiles.ps1

@@ -0,0 +1,26 @@
+function Get-GPOZaurrLegacyFiles {
+    [cmdletbinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies" -ErrorAction SilentlyContinue -Recurse -Include '*.adm', 'admfiles.ini' -ErrorVariable err -Force | ForEach-Object {
+            [PSCustomObject] @{
+                Name          = $_.Name
+                FullName      = $_.FullName
+                CreationTime  = $_.CreationTime
+                LastWriteTime = $_.LastWriteTime
+                Attributes    = $_.Attributes
+                DomainName    = $Domain
+                DirectoryName = $_.DirectoryName
+            }
+        }
+        foreach ($e in $err) {
+            Write-Warning "Get-GPOZaurrLegacy - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
+        }
+    }
+}

Public/Get-GPOZaurrLink.ps1

@@ -1,55 +1,226 @@
 function Get-GPOZaurrLink {
     [cmdletbinding()]
     param(
-        [parameter(ValueFromPipeline, ValueFromPipelineByPropertyName)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
+        [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
+        # weirdly enough site doesn't really work this way unless you give it 'CN=Configuration,DC=ad,DC=evotec,DC=xyz' as SearchBase
+        [parameter(ParameterSetName = 'Filter')][string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')",
+        [parameter(ParameterSetName = 'Filter')][string] $SearchBase,
+        [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
+
+        [parameter(ParameterSetName = 'Linked', Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
         [switch] $Limited,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [switch] $SkipDuplicates,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
         [System.Collections.IDictionary] $GPOCache,
 
-        [string] $Filter = '*',
-        [string] $SearchBase,
-        [Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
-
-
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
         [alias('ForestName')][string] $Forest,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
         [string[]] $ExcludeDomains,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
         [System.Collections.IDictionary] $ExtendedForestInformation
     )
     Begin {
+        $CacheReturnedGPOs = [ordered] @{}
         $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         if (-not $GPOCache -and -not $Limited) {
             $GPOCache = @{ }
-            foreach ($Domain in $ForestInformation.Domains) {
+            # While initially we used $ForestInformation.Domains but the thing is GPOs can be linked to other domains so we need to get them all so we can use cache of it later on even if we're processing just one domain
+            # That's why we use $ForestInformation.Forest.Domains instead
+            foreach ($Domain in $ForestInformation.Forest.Domains) {
                 $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
                 Get-GPO -All -DomainName $Domain -Server $QueryServer | ForEach-Object {
-                    $GPOCache[$_.ID.Guid] = $_
+                    $GPOCache["$Domain$($_.ID.Guid)"] = $_
                 }
             }
         }
     }
     Process {
         if (-not $ADObject) {
-            foreach ($Domain in $ForestInformation.Domains) {
-                $Splat = @{
-                    Filter     = $Filter
-                    Properties = 'distinguishedName', 'gplink', 'CanonicalName'
-                    Server     = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
-                }
-                if ($PSBoundParameters.ContainsKey('SearchBase')) {
-                    $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
-                    if ($SearchBase -notlike "*$DomainDistinguishedName") {
-                        # we check if SearchBase is part of domain distinugishname. If it isn't we skip
-                        continue
+            if ($Linked) {
+                foreach ($Domain in $ForestInformation.Domains) {
+                    $Splat = @{
+                        #Filter     = $Filter
+                        Properties = 'distinguishedName', 'gplink', 'CanonicalName'
+                        # Filter     = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')"
+                        Server     = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                    }
+                    if ($Linked -contains 'DomainControllers') {
+                        $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']
+                        #if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                        # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                        #    continue
+                        #}
+                        $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
+                        $Splat['SearchBase'] = $SearchBase
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
+                            $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            foreach ($OutputGPO in $OutputGPOs) {
+                                if (-not $SkipDuplicates) {
+                                    $OutputGPO
+                                } else {
+                                    $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                    if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                        $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                        $OutputGPO
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    if ($Linked -contains 'Root') {
+                        $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
+                        #if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                        # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                        #    continue
+                        # }
+                        $Splat['Filter'] = "objectClass -eq 'domainDNS'"
+                        $Splat['SearchBase'] = $SearchBase
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
+                            $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            foreach ($OutputGPO in $OutputGPOs) {
+                                if (-not $SkipDuplicates) {
+                                    $OutputGPO
+                                } else {
+                                    $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                    if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                        $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                        $OutputGPO
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    if ($Linked -contains 'Site') {
+                        # Sites are defined only in primary domain
+                        if ($ForestInformation['DomainsExtended'][$Domain]['DNSRoot'] -eq $ForestInformation['DomainsExtended'][$Domain]['Forest']) {
+                            $SearchBase = -join ("CN=Configuration,", $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'])
+                            # if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                            # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                            #continue
+                            #}
+                            $Splat['Filter'] = "(objectClass -eq 'site')"
+                            $Splat['SearchBase'] = $SearchBase
+                            try {
+                                $ADObjectGPO = Get-ADObject @Splat
+                            } catch {
+                                Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                            }
+                            foreach ($_ in $ADObjectGPO) {
+                                Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            }
+                        }
+                    }
+                    if ($Linked -contains 'Other') {
+                        $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
+                        #if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                        # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                        #    continue
+                        #}
+                        $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
+                        $Splat['SearchBase'] = $SearchBase
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
+                            if ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) {
+                                # other skips Domain Root
+                            } elseif ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']) {
+                                # other skips Domain Controllers
+                            } else {
+                                $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                                foreach ($OutputGPO in $OutputGPOs) {
+                                    if (-not $SkipDuplicates) {
+                                        $OutputGPO
+                                    } else {
+                                        $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                        if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                            $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                            $OutputGPO
+                                        }
+                                    }
+                                }
+                            }
+                        }
                     }
-                    $Splat['SearchBase'] = $SearchBase
-
-                }
-                if ($PSBoundParameters.ContainsKey('SearchScope')) {
-                    $Splat['SearchScope'] = $SearchScope
                 }
+            } else {
+                foreach ($Domain in $ForestInformation.Domains) {
+                    $Splat = @{
+                        Filter     = $Filter
+                        Properties = 'distinguishedName', 'gplink', 'CanonicalName'
+                        Server     = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
 
-                Get-ADObject @Splat | ForEach-Object {
-                    Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                    }
+                    if ($PSBoundParameters.ContainsKey('SearchBase')) {
+                        $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
+                        $SearchBaseDC = ConvertFrom-DistinguishedName -DistinguishedName $SearchBase -ToDC
+                        if ($SearchBaseDC -ne $DomainDistinguishedName) {
+                            # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                            continue
+                        }
+                        $Splat['SearchBase'] = $SearchBase
+
+                    }
+                    if ($PSBoundParameters.ContainsKey('SearchScope')) {
+                        $Splat['SearchScope'] = $SearchScope
+                    }
+
+                    try {
+                        $ADObjectGPO = Get-ADObject @Splat
+                    } catch {
+                        Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                    }
+                    foreach ($_ in $ADObjectGPO) {
+                        $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        foreach ($OutputGPO in $OutputGPOs) {
+                            if (-not $SkipDuplicates) {
+                                $OutputGPO
+                            } else {
+                                $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                    $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                    $OutputGPO
+                                }
+                            }
+                        }
+                    }
                 }
             }
         } else {

Public/Get-GPOZaurrLinkSummary.ps1

@@ -0,0 +1,164 @@
+function Get-GPOZaurrLinkSummary {
+    [cmdletBinding()]
+    param(
+        [ValidateSet('All', 'MultipleLinks', 'OneLink', 'LinksSummary')][string[]] $Report = 'All',
+        [switch] $UnlimitedProperties,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $HighestCount = 0 # to keep number of depth
+    $CacheSummaryLinks = [ordered] @{} # cache
+
+    # Get all links
+    $Links = Get-GPOZaurrLink -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Link in $Links) {
+        if (-not $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"]) {
+            $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"] = [System.Collections.Generic.List[System.Object]]::new()
+        }
+        $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"].Add($Link)
+    }
+
+    $ReturnObject = [ordered] @{
+        MultipleLinks = [System.Collections.Generic.List[System.Object]]::new()
+        OneLink       = [System.Collections.Generic.List[System.Object]]::new()
+        LinksSummary  = [System.Collections.Generic.List[System.Object]]::new()
+    }
+
+    foreach ($Key in $CacheSummaryLinks.Keys) {
+        $GPOs = $CacheSummaryLinks[$Key]
+
+        [Array] $LinkingSummary = foreach ($GPO in $GPOs) {
+            $SplitttedOU = ($GPO.DistinguishedName -split ',')
+            [Array] $Clean = foreach ($_ in $SplitttedOU) {
+                if ($_ -notlike 'DC=*') { $_ -replace 'OU=' }
+            }
+            if ($Clean.Count -gt $HighestCount) {
+                $HighestCount = $Clean.Count
+            }
+            if ($Clean) {
+                $Test = [ordered] @{
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = ConvertFrom-DistinguishedName -DistinguishedName $GPO.DistinguishedName -ToDomainCN
+                }
+                for ($i = 1; $i -le 10; $i++) {
+                    $Test["Level$i"] = $Clean[ - $i]
+                }
+                [PSCustomobject] $Test
+            } else {
+                $Test = [ordered] @{
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = $GPO.CanonicalName
+                }
+                for ($i = 1; $i -le 10; $i++) {
+                    $Test["Level$i"] = $null
+                }
+                [PSCustomobject] $Test
+            }
+        }
+        if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') {
+            foreach ($Link in $LinkingSummary) {
+                $ReturnObject.MultipleLinks.Add($Link)
+            }
+            #continue
+        }
+        if ($Report -eq 'OneLink' -or $Report -contains 'All') {
+            $List = [ordered] @{
+                DisplayName = $GPOs[0].DisplayName
+                Guid        = $GPOs[0].Guid
+                DomainName  = $GPOs[0].DomainName
+                LinksCount  = $GPOs.Count
+            }
+            for ($i = 0; $i -le 10; $i++) {
+                $List["Level$i"] = ($LinkingSummary."Level$i" | Select-Object -Unique).Count
+                $List["Level$($i)List"] = ($LinkingSummary."Level$i" | Select-Object -Unique)
+            }
+            $List.LinksDistinguishedName = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
+            $List.LinksCanonicalName = $GPOs.CanonicalName
+
+            $List.Owner = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
+            $List.GpoStatus = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
+            $List.Description = $GPOs[0].Description                #:
+            $List.CreationTime = $GPOs[0].CreationTime               #: 16.12.2019 21:25:32
+            $List.ModificationTime = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
+            $List.GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
+            $List.GPODistinguishedName = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
+
+            $ReturnObject.OneLink.Add( [PSCustomObject] $List)
+        }
+        if ($Report -eq 'LinksSummary' -or $Report -contains 'All') {
+            $Output = [PSCustomObject] @{
+                DisplayName                = $GPOs[0].DisplayName                #: COMPUTERS | LAPS
+                Guid                       = $GPOs[0].Guid                       #: AA782787 - 002B-4B8C-886F-05873F2DC0CA
+                DomainName                 = $GPOs[0].DomainName                 #: ad.evotec.xyz
+                LinksCount                 = $GPOs.Count
+                LinksDistinguishedName     = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
+                LinksCanonicalName         = $GPOs.CanonicalName              #: ad.evotec.xyz / ITR02 / Computers
+                Owner                      = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
+                GpoStatus                  = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
+                Description                = $GPOs[0].Description                #:
+                CreationTime               = $GPOs[0].CreationTime               #: 16.12.2019 21:25:32
+                ModificationTime           = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
+                GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
+                GPODistinguishedName       = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
+            }
+            $ReturnObject.LinksSummary.Add($Output)
+        }
+    }
+    # Processing output
+    if (-not $UnlimitedProperties) {
+        if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') {
+            $Properties = @(
+                'DisplayName'
+                'DomainName'
+                'GUID'
+                for ($i = 0; $i -le $HighestCount; $i++) {
+                    "Level$i"
+                }
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
+            )
+            $ReturnObject.MultipleLinks = $ReturnObject.MultipleLinks | Select-Object -Property $Properties
+        }
+        if ($Report -contains 'OneLink' -or $Report -contains 'All') {
+            $Properties = @(
+                'DisplayName'
+                'DomainName'
+                'GUID'
+                for ($i = 0; $i -le $HighestCount; $i++) {
+                    "Level$i"
+                    "Level$($i)List"
+                }
+                'LinksDistinguishedName'
+                'LinksCanonicalName'
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
+            )
+            $ReturnObject.OneLink = $ReturnObject.OneLink | Select-Object -Property $Properties
+        }
+        #if ($Report -contains 'LinksSummary' -or $Report -contains 'All') {
+        # Not needed because there's no dynamic properties, but if there would be we need to uncomment and fix it
+        #}
+    }
+    if ($Report.Count -eq 1 -and $Report -notcontains 'All') {
+        $ReturnObject["$Report"]
+    } else {
+        $ReturnObject
+    }
+}

Public/Get-GPOZaurrOwner.ps1

@@ -0,0 +1,60 @@
+function Get-GPOZaurrOwner {
+    [cmdletbinding(DefaultParameterSetName = 'Default')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [switch] $IncludeSysvol,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [System.Collections.IDictionary] $ADAdministrativeGroups
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        if (-not $ADAdministrativeGroups) {
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
+    }
+    Process {
+        $getGPOZaurrADSplat = @{
+            Forest                    = $Forest
+            IncludeDomains            = $IncludeDomains
+            ExcludeDomains            = $ExcludeDomains
+            ExtendedForestInformation = $ForestInformation
+        }
+        if ($GPOName) {
+            $getGPOZaurrADSplat['GPOName'] = $GPOName
+        } elseif ($GPOGuid) {
+            $getGPOZaurrADSplat['GPOGUID'] = $GPOGuid
+        }
+        $Objects = Get-GPOZaurrAD @getGPOZaurrADSplat
+        foreach ($_ in $Objects) {
+            Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)"
+            $ACL = Get-ADACLOwner -ADObject $_.GPODistinguishedName -Resolve -ADAdministrativeGroups $ADAdministrativeGroups
+            $Object = [ordered] @{
+                DisplayName = $_.DisplayName
+                DomainName  = $_.DomainName
+                GUID        = $_.GUID
+                Owner       = $ACL.OwnerName
+                OwnerSid    = $ACL.OwnerSid
+                OwnerType   = $ACL.OwnerType
+            }
+            if ($IncludeSysvol) {
+                $FileOwner = Get-FileOwner -JustPath -Path $_.Path -Resolve
+                $Object['SysvolOwner'] = $FileOwner.OwnerName
+                $Object['SysvolSid'] = $FileOwner.OwnerSid
+                $Object['SysvolType'] = $FileOwner.OwnerType
+                $Object['SysvolPath'] = $_.Path
+                $Object['IsOwnerConsistent'] = if ($ACL.OwnerName -eq $FileOwner.OwnerName) { $true } else { $false }
+            }
+            $Object['DistinguishedName'] = $_.GPODistinguishedName
+            [PSCUstomObject] $Object
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrPermission.ps1

@@ -7,7 +7,10 @@
         [Parameter(ParameterSetName = 'GPOGUID')]
         [alias('GUID', 'GPOID')][string] $GPOGuid,
 
-        [validateSet('Unknown', 'All')][string[]] $Type = 'All',
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
+        [validateSet('AuthenticatedUsers', 'DomainComputers', 'Unknown', 'WellKnownAdministrative', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All',
 
         [switch] $SkipWellKnown,
         [switch] $SkipAdministrative,
@@ -16,16 +19,25 @@
         [switch] $IncludeOwner,
         [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
         [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid',
+
         [switch] $IncludeGPOObject,
 
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
-        [System.Collections.IDictionary] $ExtendedForestInformation
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [System.Collections.IDictionary] $ADAdministrativeGroups,
+        [switch] $ReturnSecurityWhenNoData # if no data return all data
     )
     Begin {
-        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Extended
+        if (-not $ADAdministrativeGroups) {
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
         if ($Type -eq 'Unknown') {
             if ($SkipAdministrative -or $SkipWellKnown) {
                 Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
@@ -48,23 +60,85 @@
                 }
             }
         }
-
     }
     Process {
         foreach ($Domain in $ForestInformation.Domains) {
             $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
             if ($GPOName) {
-                Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
-                    Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                $getGPOSplat = @{
+                    Name        = $GPOName
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / Name: $GPOName) with:"
             } elseif ($GPOGuid) {
-                Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
-                    Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                $getGPOSplat = @{
+                    Guid        = $GPOGuid
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / GUID: $GPOGuid) with:"
             } else {
-                Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
-                    Get-PrivPermission -Accounts $Accounts -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                $getGPOSplat = @{
+                    All         = $true
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / All: $True) with:"
+            }
+            Try {
+                Get-GPO @getGPOSplat | ForEach-Object -Process {
+                    $GPOSecurity = $_.GetSecurityInfo()
+                    $getPrivPermissionSplat = @{
+                        Principal                 = $Principal
+                        PrincipalType             = $PrincipalType
+                        PermitType                = $PermitType
+                        Accounts                  = $Accounts
+                        Type                      = $Type
+                        GPO                       = $_
+                        SkipWellKnown             = $SkipWellKnown.IsPresent
+                        SkipAdministrative        = $SkipAdministrative.IsPresent
+                        IncludeOwner              = $IncludeOwner.IsPresent
+                        IncludeGPOObject          = $IncludeGPOObject.IsPresent
+                        IncludePermissionType     = $IncludePermissionType
+                        ExcludePermissionType     = $ExcludePermissionType
+                        ExcludePrincipal          = $ExcludePrincipal
+                        ExcludePrincipalType      = $ExcludePrincipalType
+                        ADAdministrativeGroups    = $ADAdministrativeGroups
+                        ExtendedForestInformation = $ForestInformation
+                        SecurityRights            = $GPOSecurity
+                    }
+                    try {
+                        $Output = Get-PrivPermission @getPrivPermissionSplat
+                    } catch {
+                        $Output = $null
+                        Write-Warning "Get-GPOZaurrPermission - Error running Get-PrivPermission: $($_.Exception.Message)"
+                    }
+                    if (-not $Output) {
+                        if ($ReturnSecurityWhenNoData) {
+                            # there is no data to return, but we need to have GPO information to process ADD permissions.
+                            $ReturnObject = [PSCustomObject] @{
+                                DisplayName      = $_.DisplayName #      : ALL | Enable RDP
+                                GUID             = $_.ID
+                                DomainName       = $_.DomainName  #      : ad.evotec.xyz
+                                Enabled          = $_.GpoStatus
+                                Description      = $_.Description
+                                CreationDate     = $_.CreationTime
+                                ModificationTime = $_.ModificationTime
+                                GPOObject        = $_
+                                GPOSecurity      = $GPOSecurity
+                            }
+                            $ReturnObject
+                        }
+                    } else {
+                        $Output
+                    }
+                }
+            } catch {
+                Write-Warning "Get-GPOZaurrPermission - $TextForError $($_.Exception.Message)"
             }
         }
     }

Public/Get-GPOZaurrPermissionConsistency.ps1

@@ -0,0 +1,122 @@
+function Get-GPOZaurrPermissionConsistency {
+    [cmdletBinding(DefaultParameterSetName = 'Type')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+        [Parameter(ParameterSetName = 'Type')][validateSet('Consistent', 'Inconsistent', 'All')][string[]] $Type = 'All',
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [switch] $IncludeGPOObject,
+        [switch] $VerifyInheritance
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    }
+    Process {
+        foreach ($Domain in $ForestInformation.Domains) {
+            $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+            if ($GPOName) {
+                $getGPOSplat = @{
+                    Name        = $GPOName
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } elseif ($GPOGuid) {
+                $getGPOSplat = @{
+                    Guid        = $GPOGuid
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } else {
+                $getGPOSplat = @{
+                    All         = $true
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            }
+            Get-GPO @getGPOSplat | ForEach-Object -Process {
+                try {
+                    $IsConsistent = $_.IsAclConsistent()
+                    $ErrorMessage = ''
+                } catch {
+                    $ErrorMessage = $_.Exception.Message
+                    Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
+                    $IsConsistent = 'Not available.'
+                }
+                $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
+                if ($VerifyInheritance) {
+                    $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath
+                    [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) {
+                        if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) {
+                            $File
+                        }
+                    }
+                    if ($NotInheritedPermissions.Count -eq 0) {
+                        $ACLConsistentInside = $true
+                    } else {
+                        $ACLConsistentInside = $false
+                    }
+                } else {
+                    $ACLConsistentInside = $null
+                }
+                $Object = [ordered] @{
+                    DisplayName   = $_.DisplayName     # : New Group Policy Object
+                    DomainName    = $_.DomainName      # : ad.evotec.xyz
+                    ACLConsistent = $IsConsistent
+                }
+                if ($VerifyInheritance) {
+                    $Object['ACLConsistentInside'] = $ACLConsistentInside
+                }
+                $Object['Owner'] = $_.Owner           # : EVOTEC\Enterprise Admins
+                $Object['Path'] = $_.Path
+                $Object['SysVolPath '] = $SysvolPath
+                $Object['Id       '] = $_.Id              # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
+                $Object['GpoStatus'] = $_.GpoStatus       # : AllSettingsEnabled
+                $Object['Description'] = $_.Description     # :
+                $Object['CreationTime'] = $_.CreationTime    # : 04.03.2020 17:19:42
+                $Object['ModificationTime'] = $_.ModificationTime# : 06.05.2020 10:30:36
+                $Object['UserVersion'] = $_.UserVersion     # : AD Version: 0, SysVol Version: 0
+                $Object['ComputerVersion'] = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
+                $Object['WmiFilter'] = $_.WmiFilter       # :
+                $Object['Error'] = $ErrorMessage
+                if ($IncludeGPOObject) {
+                    $Object['IncludeGPOObject'] = $_
+                }
+                if ($VerifyInheritance) {
+                    $Object['ACLConsistentInsideDetails'] = $NotInheritedPermissions
+                }
+                if ($Type -eq 'All') {
+                    [PSCustomObject] $Object
+                } elseif ($Type -eq 'Inconsistent') {
+                    if ($VerifyInheritance) {
+                        if (-not $IsConsistent -or -not $ACLConsistentInside) {
+                            [PSCustomObject] $Object
+                        }
+                    } else {
+                        if (-not $IsConsistent) {
+                            [PSCustomObject] $Object
+                        }
+                    }
+                } elseif ($Type -eq 'Consistent') {
+                    if ($VerifyInheritance) {
+                        if ($IsConsistent -and $ACLConsistentInside) {
+                            [PSCustomObject] $Object
+                        }
+                    } else {
+                        if ($IsConsistent) {
+                            [PSCustomObject] $Object
+                        }
+                    }
+                }
+            }
+        }
+    }
+    End {
+
+    }
+}