Update to example

Examples/Example-11-ReplaceGPOOwnerAutomated.ps1

@@ -5,11 +5,13 @@
 # regardless if current user is still Domain Admin or not
 
 $GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName
-$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
+$GPOs | Format-Table  DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
 
-Set-GPOZaurrOwner -Type NotAdministrative -Verbose -WhatIf #-LimitProcessing 12
-
-#Set-GPOZaurrOwner -GPOName 'New Group Policy Object' -Verbose -Principal 'przemyslaw.klys' -IncludeSysVol
+#Set-GPOZaurrOwner -Type Unknown -Verbose  #-LimitProcessing 2 -WhatIf
+Set-GPOZaurrOwner -Type NotAdministrative  -Verbose -LimitProcessing 2 -WhatIf
+#Set-GPOZaurrOwner -Type NotMatching -Verbose -LimitProcessing 2 -WhatIf
 
+#Set-GPOZaurrOwner -GPOName 'COMPUTERS | Enable Sets' -Verbose -Principal 'przemyslaw.klys' -WhatIf #-SkipSysvol
+#Set-GPOZaurrOwner -GPOName 'New Group Policy Object' -Verbose #-WhatIf #-SkipSysvol
 #$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName 'New Group Policy Object'
 #$GPOs | Format-Table DisplayName, Owner, OwnerSID

GPOZaurr.psd1

@@ -7,7 +7,7 @@
     Description          = 'Group Policy Eater'
     FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrLink', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.21'
+    ModuleVersion        = '0.0.22'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -17,7 +17,7 @@
         }
     }
     RequiredModules      = @{
-        ModuleVersion = '0.0.140'
+        ModuleVersion = '0.0.141'
         ModuleName    = 'PSSharedGoods'
         Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
     }, @{

Public/Add-GPOPermission.ps1

@@ -1,12 +1,12 @@
 function Add-GPOPermission {
     [cmdletBinding()]
     param(
-        [validateset('WellKnownAdministrative','Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
+        [validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
         [Microsoft.GroupPolicy.GPPermissionType] $IncludePermissionType,
         [alias('Principal')][Array] $Trustee,
         [alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName'
     )
-    if ($Type -eq 'Default'){
+    if ($Type -eq 'Default') {
         @{
             Action                = 'Add'
             Type                  = 'Standard'
@@ -16,14 +16,14 @@
         }
     } elseif ($Type -eq 'AuthenticatedUsers') {
         @{
-            Action = 'Add'
-            Type   = 'AuthenticatedUsers'
+            Action                = 'Add'
+            Type                  = 'AuthenticatedUsers'
             IncludePermissionType = $IncludePermissionType
         }
     } elseif ($Type -eq 'Administrative') {
         @{
-            Action = 'Add'
-            Type   = 'Administrative'
+            Action                = 'Add'
+            Type                  = 'Administrative'
             IncludePermissionType = $IncludePermissionType
         }
     }

Public/Get-GPOZaurrOwner.ps1

@@ -26,9 +26,9 @@
             ExtendedForestInformation = $ForestInformation
         }
         if ($GPOName) {
-            $getGPOZaurrADSplat['GPOName']                   = $GPOName
+            $getGPOZaurrADSplat['GPOName'] = $GPOName
         } elseif ($GPOGuid) {
-            $getGPOZaurrADSplat['GPOGUID']                    = $GPOGuid
+            $getGPOZaurrADSplat['GPOGUID'] = $GPOGuid
         }
         Get-GPOZaurrAD @getGPOZaurrADSplat | ForEach-Object -Process {
             Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)"
@@ -47,6 +47,7 @@
                 $Object['SysvolOwner'] = $FileOwner.OwnerName
                 $Object['SysvolSid'] = $FileOwner.OwnerSid
                 $Object['SysvolType'] = $FileOwner.OwnerType
+                $Object['SysvolPath'] = $_.Path
             }
             [PSCUstomObject] $Object
         }

Public/Set-GPOZaurrOwner.ps1

@@ -1,8 +1,53 @@
 function Set-GPOZaurrOwner {
+    <#
+    .SYNOPSIS
+    Short description
+
+    .DESCRIPTION
+    Long description
+
+    .PARAMETER Type
+    Unknown - finds unknown Owners and sets them to Administrative (Domain Admins) or chosen principal
+    NotMatching - find administrative groups only and if sysvol and gpo doesn't match - replace with chosen principal or Domain Admins if not specified
+    NotAdministrative - combination of Unknown/NotMatching and NotAdministrative - replace with chosen principal or Domain Admins if not specified
+    All - if Owner is known it checks if it's Administrative, if it sn't it fixes that. If owner is unknown it fixes it
+    .PARAMETER GPOName
+    Parameter description
+
+    .PARAMETER GPOGuid
+    Parameter description
+
+    .PARAMETER Forest
+    Parameter description
+
+    .PARAMETER ExcludeDomains
+    Parameter description
+
+    .PARAMETER IncludeDomains
+    Parameter description
+
+    .PARAMETER ExtendedForestInformation
+    Parameter description
+
+    .PARAMETER Principal
+    Parameter description
+
+    .PARAMETER SkipSysvol
+    Parameter description
+
+    .PARAMETER LimitProcessing
+    Parameter description
+
+    .EXAMPLE
+    An example
+
+    .NOTES
+    General notes
+    #>
     [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Type')]
     param(
         [Parameter(ParameterSetName = 'Type', Mandatory)]
-        [validateset('Unknown', 'NotAdministrative', 'All')][string[]] $Type,
+        [validateset('Unknown', 'NotAdministrative', 'NotMatching', 'All')][string] $Type,
 
         [Parameter(ParameterSetName = 'Named')][string] $GPOName,
         [Parameter(ParameterSetName = 'Named')][alias('GUID', 'GPOID')][string] $GPOGuid,
@@ -27,20 +72,20 @@
         [Parameter(ParameterSetName = 'Named')]
         [string] $Principal,
 
-        [switch] $IncludeSysVol,
+        [switch] $SkipSysvol,
 
         [Parameter(ParameterSetName = 'Type')]
         [Parameter(ParameterSetName = 'Named')]
         [int] $LimitProcessing = [int32]::MaxValue
     )
     Begin {
-        Write-Verbose "Set-GPOZaurrOwner - Getting ADAdministrativeGroups"
+        #Write-Verbose "Set-GPOZaurrOwner - Getting ADAdministrativeGroups"
         $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-        Write-Verbose "Set-GPOZaurrOwner - Processing GPOs for Type $Type"
+        #Write-Verbose "Set-GPOZaurrOwner - Processing GPO for Type $Type"
     }
     Process {
         $getGPOZaurrOwnerSplat = @{
-            IncludeSysvol             = $IncludeSysVol
+            IncludeSysvol             = -not $SkipSysvol.IsPresent
             Forest                    = $Forest
             IncludeDomains            = $IncludeDomains
             ExcludeDomains            = $ExcludeDomains
@@ -54,30 +99,104 @@
             $getGPOZaurrOwnerSplat['GPOGuid'] = $GPOGUiD
         }
         Get-GPOZaurrOwner @getGPOZaurrOwnerSplat | Where-Object {
-            if ($Type -contains 'NotAdministrative' -and $Type -notcontains 'All') {
-                if ($_.Owner) {
-                    $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
-                    if (-not $AdministrativeGroup) {
+            if ($_.Owner) {
+                $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
+            } else {
+                $AdministrativeGroup = $null
+            }
+            if (-not $SkipSysvol) {
+                if ($_.SysvolOwner) {
+                    $AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"]
+                } else {
+                    $AdministrativeGroupSysvol = $null
+                }
+            }
+            if ($Type -eq 'NotAdministrative') {
+                if (-not $AdministrativeGroup -or (-not $AdministrativeGroupSysvol -and -not $SkipSysvol)) {
+                    $_
+                } else {
+                    if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
+                        Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
                         $_
                     }
                 }
-            } elseif ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
-                if ($null -eq $_.Owner) {
+
+                <#
+                if (-not $AdministrativeGroup -and (-not $AdministrativeGroupSysvol -and -not $SkipSysvol)) {
+                    $Action = 'Both'
+                    $_
+                } elseif (-not $AdministrativeGroup) {
+                    $Action = 'OnlyGPO'
+                    $_
+                } elseif (-not $AdministrativeGroupSysvol -and -not $SkipSysvol) {
+                    $Action = 'OnlyFileSystem'
+                    $_
+                } else {
+                    if ($_.Owner -ne $_.SysvolOwner) {
+                        $Action = 'OnlyFileSystem'
+                        $_
+                    }
+                }
+                #>
+            } elseif ($Type -eq 'Unknown') {
+                if (-not $_.Owner -or (-not $_.SysvolOwner -and -not $SkipSysvol)) {
                     $_
                 }
+            } elseif ($Type -eq 'NotMatching') {
+                if ($SkipSysvol) {
+                    Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). SysVol scanning is disabled. Skipping."
+                } else {
+                if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
+                        #Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
+                        $_
+                    }
+                }
             } else {
-                $_
+                # we run with no type, that means we need to either set it to principal or to Administrative
+                if ($_.Owner) {
+                    # we check if Principal is not set
+                    $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
+                    if (-not $SkipSysvol -and $_.SysvolOwner) {
+                        $AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"]
+                        if (-not $AdministrativeGroup -or -not $AdministrativeGroupSysvol) {
+                            $_
+                        }
+                    } else {
+                        if (-not $AdministrativeGroup) {
+                            $_
+                        }
+                    }
+                } else {
+                    $_
+                }
             }
         } | Select-Object -First $LimitProcessing | ForEach-Object -Process {
             $GPO = $_
-            if ($Principal) {
-                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
-                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
+            #if (-not $Principal) {
+            #   $Principal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+            #}
+            if (-not $Principal) {
+                $DefaultPrincipal = $ADAdministrativeGroups["$($_.DomainName)"]['DomainAdmins']
             } else {
-                $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
-                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                $DefaultPrincipal = $Principal
             }
+            if ($Action -eq 'OnlyGPO') {
+                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) (SID: $($GPO.OwnerSID)) to $DefaultPrincipal"
+                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal  -Verbose:$false -WhatIf:$WhatIfPreference
+            } elseif ($Action -eq 'OnlyFileSystem') {
+                if (-not $SkipSysvol) {
+                    Write-Verbose "Set-GPOZaurrOwner - Changing Sysvol Owner GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.SysvolOwner) (SID: $($GPO.SysvolSid)) to $DefaultPrincipal"
+                    Set-FileOwner -JustPath -Path $GPO.SysvolPath -Owner $DefaultPrincipal  -Verbose:$true -WhatIf:$WhatIfPreference
+                }
+            } else {
+                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) (SID: $($GPO.OwnerSID)) to $DefaultPrincipal"
+                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal  -Verbose:$false -WhatIf:$WhatIfPreference
+                if (-not $SkipSysvol) {
+                    Write-Verbose "Set-GPOZaurrOwner - Changing Sysvol Owner GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.SysvolOwner) (SID: $($GPO.SysvolSid)) to $DefaultPrincipal"
+                    Set-FileOwner -JustPath -Path $GPO.SysvolPath -Owner $DefaultPrincipal -Verbose:$true -WhatIf:$WhatIfPreference
+                }
+            }
+        }
             <#
             if ($Type -contains 'All') {
                 # Regardless who is the owner it is overwritten
@@ -138,7 +257,7 @@
                 }
             }
             #>
-        }
+        #}
         #>
         #}
         <#