Update

Examples/Example-11-ReplaceGPOOwnerAutomated.ps1

@@ -5,11 +5,13 @@
 # regardless if current user is still Domain Admin or not
 
 $GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName
-$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
+$GPOs | Format-Table  DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
 
-Set-GPOZaurrOwner -Type NotAdministrative -Verbose -WhatIf #-LimitProcessing 12
-
-#Set-GPOZaurrOwner -GPOName 'New Group Policy Object' -Verbose -Principal 'przemyslaw.klys' -IncludeSysVol
+#Set-GPOZaurrOwner -Type Unknown -Verbose  #-LimitProcessing 2 -WhatIf
+Set-GPOZaurrOwner -Type NotAdministrative  -Verbose -LimitProcessing 2 -WhatIf
+#Set-GPOZaurrOwner -Type NotMatching -Verbose -LimitProcessing 2 -WhatIf
 
+#Set-GPOZaurrOwner -GPOName 'COMPUTERS | Enable Sets' -Verbose -Principal 'przemyslaw.klys' -WhatIf #-SkipSysvol
+#Set-GPOZaurrOwner -GPOName 'New Group Policy Object' -Verbose #-WhatIf #-SkipSysvol
 #$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName 'New Group Policy Object'
 #$GPOs | Format-Table DisplayName, Owner, OwnerSID

Examples/Example-13-ListingOwners02.ps1

@@ -1,9 +1,10 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -Forest 'test.evotec.pl'
 $T | Format-Table *
 #$T | Out-HtmlView -ScrollX
 
+return
 $T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOName 'Default Domain Policy'
 $T | Format-Table *
 

Examples/Example-17-FixInconsistentACL.ps1

@@ -1,10 +0,0 @@
-Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-
-#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
-Get-GPOZaurrPermissionConsistency -Type Inconsistent | ForEach-Object {
-    $G = Get-GPOZaurrAD -GPOGuid $_.ID.GUID -IncludeDomains $_.DomainName
-    $P = Get-GPOZaurrPermission -GPOGuid $_.ID.GUID
-    $F = Get-WinADShare -Path $G.Path
-    $P | Format-Table
-    $F | Format-Table
-}

Examples/Example-17-RepairInconsistentACL.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz'
+
+Repair-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' #-WhatIf -Verbose

Examples/Example-18-ListInconsistenciesACLAdvanced.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
+
+$Output = Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -VerifyInside
+$Output | Format-Table DisplayName, DomainName, ACLConsistent, ACLConsistentInside
+$Output.ACLConsistentInsideDetails | Format-Table
+
+$Output = Get-GPOZaurrPermissionConsistency -VerifyInside -Type 'All'
+$Output | Format-Table

GPOZaurr.psd1

@@ -5,9 +5,9 @@
     CompatiblePSEditions = 'Desktop'
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
     Description          = 'Group Policy Eater'
-    FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrLink', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
+    FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLink', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.21'
+    ModuleVersion        = '0.0.24'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -17,7 +17,7 @@
         }
     }
     RequiredModules      = @{
-        ModuleVersion = '0.0.140'
+        ModuleVersion = '0.0.141'
         ModuleName    = 'PSSharedGoods'
         Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
     }, @{

Public/Add-GPOPermission.ps1

@@ -1,12 +1,12 @@
 function Add-GPOPermission {
     [cmdletBinding()]
     param(
-        [validateset('WellKnownAdministrative','Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
+        [validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
         [Microsoft.GroupPolicy.GPPermissionType] $IncludePermissionType,
         [alias('Principal')][Array] $Trustee,
         [alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName'
     )
-    if ($Type -eq 'Default'){
+    if ($Type -eq 'Default') {
         @{
             Action                = 'Add'
             Type                  = 'Standard'
@@ -16,14 +16,14 @@
         }
     } elseif ($Type -eq 'AuthenticatedUsers') {
         @{
-            Action = 'Add'
-            Type   = 'AuthenticatedUsers'
+            Action                = 'Add'
+            Type                  = 'AuthenticatedUsers'
             IncludePermissionType = $IncludePermissionType
         }
     } elseif ($Type -eq 'Administrative') {
         @{
-            Action = 'Add'
-            Type   = 'Administrative'
+            Action                = 'Add'
+            Type                  = 'Administrative'
             IncludePermissionType = $IncludePermissionType
         }
     }

Public/Get-GPOZaurrConsistency.ps1

@@ -1,130 +0,0 @@
-function Get-GPOZaurrPermissionConsistency {
-    [cmdletBinding()]
-    param(
-        [Parameter(ParameterSetName = 'GPOName')]
-        [string] $GPOName,
-
-        [Parameter(ParameterSetName = 'GPOGUID')]
-        [alias('GUID', 'GPOID')][string] $GPOGuid,
-
-        [Parameter(ParameterSetName = 'Type')][validateSet('Consistent', 'Inconsistent', 'All')][string[]] $Type = 'All',
-
-        [alias('ForestName')][string] $Forest,
-        [string[]] $ExcludeDomains,
-        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
-        [System.Collections.IDictionary] $ExtendedForestInformation,
-
-        [switch] $IncludeGPOObject
-    )
-    Begin {
-        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-    }
-    Process {
-        foreach ($Domain in $ForestInformation.Domains) {
-            $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
-            if ($GPOName) {
-                Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
-                    try {
-                        $IsConsistent = $_.IsAclConsistent()
-                        $ErrorMessage = ''
-                    } catch {
-                        $ErrorMessage = $_.Exception.Message
-                        Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
-                        $IsConsistent = 'Not available.'
-                    }
-                    $Object = @{
-                        DisplayName      = $_.DisplayName     # : New Group Policy Object
-                        DomainName       = $_.DomainName      # : ad.evotec.xyz
-                        ACLConsistent    = $IsConsistent
-                        Owner            = $_.Owner           # : EVOTEC\Enterprise Admins
-                        Id               = $_.Id              # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
-                        GpoStatus        = $_.GpoStatus       # : AllSettingsEnabled
-                        Description      = $_.Description     # :
-                        CreationTime     = $_.CreationTime    # : 04.03.2020 17:19:42
-                        ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36
-                        UserVersion      = $_.UserVersion     # : AD Version: 0, SysVol Version: 0
-                        ComputerVersion  = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
-                        WmiFilter        = $_.WmiFilter       # :
-                        Error            = $ErrorMessage
-                    }
-                    if ($IncludeGPOObject) {
-                        $Object['IncludeGPOObject'] = $_
-                    }
-                    [PSCustomObject] $Object
-                }
-            } elseif ($GPOGuid) {
-                Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
-                    try {
-                        $IsConsistent = $_.IsAclConsistent()
-                        $ErrorMessage = ''
-                    } catch {
-                        $ErrorMessage = $_.Exception.Message
-                        Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
-                        $IsConsistent = 'Not available.'
-                    }
-                    $Object = @{
-                        DisplayName      = $_.DisplayName     # : New Group Policy Object
-                        DomainName       = $_.DomainName      # : ad.evotec.xyz
-                        ACLConsistent    = $IsConsistent
-                        Owner            = $_.Owner           # : EVOTEC\Enterprise Admins
-                        Id               = $_.Id              # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
-                        GpoStatus        = $_.GpoStatus       # : AllSettingsEnabled
-                        Description      = $_.Description     # :
-                        CreationTime     = $_.CreationTime    # : 04.03.2020 17:19:42
-                        ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36
-                        UserVersion      = $_.UserVersion     # : AD Version: 0, SysVol Version: 0
-                        ComputerVersion  = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
-                        WmiFilter        = $_.WmiFilter       # :
-                        Error            = $ErrorMessage
-                    }
-                    if ($IncludeGPOObject) {
-                        $Object['IncludeGPOObject'] = $_
-                    }
-                    [PSCustomObject] $Object
-                }
-            } else {
-                Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
-                    try {
-                        $IsConsistent = $_.IsAclConsistent()
-                        $ErrorMessage = ''
-                    } catch {
-                        $ErrorMessage = $_.Exception.Message
-                        Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
-                        $IsConsistent = 'Not available.'
-                    }
-                    if ($Type -eq 'Consistent') {
-                        if (-not $IsConsistent) {
-                            return
-                        }
-                    } elseif ($Type -eq 'Inconsistent') {
-                        if ($IsConsistent -eq $true) {
-                            return
-                        }
-                    }
-                    $Object = @{
-                        DisplayName      = $_.DisplayName     # : New Group Policy Object
-                        DomainName       = $_.DomainName      # : ad.evotec.xyz
-                        ACLConsistent    = $IsConsistent
-                        Owner            = $_.Owner           # : EVOTEC\Enterprise Admins
-                        Id               = $_.Id              # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
-                        GpoStatus        = $_.GpoStatus       # : AllSettingsEnabled
-                        Description      = $_.Description     # :
-                        CreationTime     = $_.CreationTime    # : 04.03.2020 17:19:42
-                        ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36
-                        UserVersion      = $_.UserVersion     # : AD Version: 0, SysVol Version: 0
-                        ComputerVersion  = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
-                        WmiFilter        = $_.WmiFilter       # :
-                        Error            = $ErrorMessage
-                    }
-                    if ($IncludeGPOObject) {
-                        $Object['IncludeGPOObject'] = $_
-                    }
-                    [PSCustomObject] $Object
-                }
-            }
-        }
-    }
-    End {
-
-    }
-}

Public/Get-GPOZaurrOwner.ps1

@@ -26,9 +26,9 @@
             ExtendedForestInformation = $ForestInformation
         }
         if ($GPOName) {
-            $getGPOZaurrADSplat['GPOName']                   = $GPOName
+            $getGPOZaurrADSplat['GPOName'] = $GPOName
         } elseif ($GPOGuid) {
-            $getGPOZaurrADSplat['GPOGUID']                    = $GPOGuid
+            $getGPOZaurrADSplat['GPOGUID'] = $GPOGuid
         }
         Get-GPOZaurrAD @getGPOZaurrADSplat | ForEach-Object -Process {
             Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)"
@@ -47,6 +47,7 @@
                 $Object['SysvolOwner'] = $FileOwner.OwnerName
                 $Object['SysvolSid'] = $FileOwner.OwnerSid
                 $Object['SysvolType'] = $FileOwner.OwnerType
+                $Object['SysvolPath'] = $_.Path
             }
             [PSCUstomObject] $Object
         }

Public/Get-GPOZaurrPermissionConsistency.ps1

@@ -0,0 +1,214 @@
+function Get-GPOZaurrPermissionConsistency {
+    [cmdletBinding()]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+        [Parameter(ParameterSetName = 'Type')][validateSet('Consistent', 'Inconsistent', 'All')][string[]] $Type = 'All',
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [switch] $IncludeGPOObject,
+        [switch] $VerifyInside
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    }
+    Process {
+        foreach ($Domain in $ForestInformation.Domains) {
+            $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+            if ($GPOName) {
+                $getGPOSplat = @{
+                    Name        = $GPOName
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } elseif ($GPOGuid) {
+                $getGPOSplat = @{
+                    Guid        = $GPOGuid
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } else {
+                $getGPOSplat = @{
+                    All         = $true
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            }
+            Get-GPO @getGPOSplat | ForEach-Object -Process {
+                try {
+                    $IsConsistent = $_.IsAclConsistent()
+                    $ErrorMessage = ''
+                } catch {
+                    $ErrorMessage = $_.Exception.Message
+                    Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
+                    $IsConsistent = 'Not available.'
+                }
+                $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
+                if ($VerifyInside) {
+                    $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath
+                    [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) {
+                        if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) {
+                            $File
+                        }
+                    }
+                    if ($NotInheritedPermissions.Count -eq 0) {
+                        $ACLConsistentInside = $true
+                    } else {
+                        $ACLConsistentInside = $false
+                    }
+                } else {
+                    $ACLConsistentInside = $null
+                }
+                $Object = [ordered] @{
+                    DisplayName         = $_.DisplayName     # : New Group Policy Object
+                    DomainName          = $_.DomainName      # : ad.evotec.xyz
+                    ACLConsistent       = $IsConsistent
+                    ACLConsistentInside = $ACLConsistentInside
+                    Owner               = $_.Owner           # : EVOTEC\Enterprise Admins
+                    Path                = $_.Path
+                    SysVolPath          = $SysvolPath
+                    Id                  = $_.Id              # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
+                    GpoStatus           = $_.GpoStatus       # : AllSettingsEnabled
+                    Description         = $_.Description     # :
+                    CreationTime        = $_.CreationTime    # : 04.03.2020 17:19:42
+                    ModificationTime    = $_.ModificationTime# : 06.05.2020 10:30:36
+                    UserVersion         = $_.UserVersion     # : AD Version: 0, SysVol Version: 0
+                    ComputerVersion     = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
+                    WmiFilter           = $_.WmiFilter       # :
+                    Error               = $ErrorMessage
+                }
+                if ($IncludeGPOObject) {
+                    $Object['IncludeGPOObject'] = $_
+                }
+                if ($VerifyInside) {
+                    $Object['ACLConsistentInsideDetails'] = $NotInheritedPermissions
+                }
+                [PSCustomObject] $Object
+            }
+            <#
+            } elseif ($GPOGuid) {
+                Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
+                    try {
+                        $IsConsistent = $_.IsAclConsistent()
+                        $ErrorMessage = ''
+                    } catch {
+                        $ErrorMessage = $_.Exception.Message
+                        Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
+                        $IsConsistent = 'Not available.'
+                    }
+                    $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
+                    if ($Advanced) {
+                        $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath
+                        [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) {
+                            if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) {
+                                $File
+                            }
+                        }
+                        if ($NotInheritedPermissions.Count -eq 0) {
+                            $ACLConsistentInside = $true
+                        } else {
+                            $ACLConsistentInside = $false
+                        }
+                    } else {
+                        $ACLConsistentInside = $null
+                    }
+                    $Object = [ordered] @{
+                        DisplayName         = $_.DisplayName     # : New Group Policy Object
+                        DomainName          = $_.DomainName      # : ad.evotec.xyz
+                        ACLConsistent       = $IsConsistent
+                        ACLConsistentInside = $ACLConsistentInside
+                        Owner               = $_.Owner           # : EVOTEC\Enterprise Admins
+                        Path                = $_.Path
+                        SysVolPath          = $SysvolPath
+                        Id                  = $_.Id              # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
+                        GpoStatus           = $_.GpoStatus       # : AllSettingsEnabled
+                        Description         = $_.Description     # :
+                        CreationTime        = $_.CreationTime    # : 04.03.2020 17:19:42
+                        ModificationTime    = $_.ModificationTime# : 06.05.2020 10:30:36
+                        UserVersion         = $_.UserVersion     # : AD Version: 0, SysVol Version: 0
+                        ComputerVersion     = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
+                        WmiFilter           = $_.WmiFilter       # :
+                        Error               = $ErrorMessage
+                    }
+                    if ($Advanced) {
+                        $Object['ACLConsistentInsideDetails'] = $NotInheritedPermissions
+                    }
+                    if ($IncludeGPOObject) {
+                        $Object['IncludeGPOObject'] = $_
+                    }
+                    [PSCustomObject] $Object
+                }
+            } else {
+                Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
+                    try {
+                        $IsConsistent = $_.IsAclConsistent()
+                        $ErrorMessage = ''
+                    } catch {
+                        $ErrorMessage = $_.Exception.Message
+                        Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
+                        $IsConsistent = 'Not available.'
+                    }
+                    if ($Type -eq 'Consistent') {
+                        if (-not $IsConsistent) {
+                            return
+                        }
+                    } elseif ($Type -eq 'Inconsistent') {
+                        if ($IsConsistent -eq $true) {
+                            return
+                        }
+                    }
+                    $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
+                    if ($Advanced) {
+                        $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath
+                        [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) {
+                            if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) {
+                                $File
+                            }
+                        }
+                        if ($NotInheritedPermissions.Count -eq 0) {
+                            $ACLConsistentInside = $true
+                        } else {
+                            $ACLConsistentInside = $false
+                        }
+                    } else {
+                        $ACLConsistentInside = $null
+                    }
+                    $Object = [ordered] @{
+                        DisplayName         = $_.DisplayName     # : New Group Policy Object
+                        DomainName          = $_.DomainName      # : ad.evotec.xyz
+                        ACLConsistent       = $IsConsistent
+                        ACLConsistentInside = $ACLConsistentInside
+                        Owner               = $_.Owner           # : EVOTEC\Enterprise Admins
+                        Path                = $_.Path
+                        SysVolPath          = $SysvolPath
+                        Id                  = $_.Id              # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
+                        GpoStatus           = $_.GpoStatus       # : AllSettingsEnabled
+                        Description         = $_.Description     # :
+                        CreationTime        = $_.CreationTime    # : 04.03.2020 17:19:42
+                        ModificationTime    = $_.ModificationTime# : 06.05.2020 10:30:36
+                        UserVersion         = $_.UserVersion     # : AD Version: 0, SysVol Version: 0
+                        ComputerVersion     = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
+                        WmiFilter           = $_.WmiFilter       # :
+                        Error               = $ErrorMessage
+                    }
+                    if ($Advanced) {
+                        $Object['ACLConsistentInsideDetails'] = $NotInheritedPermissions
+                    }
+                    if ($IncludeGPOObject) {
+                        $Object['IncludeGPOObject'] = $_
+                    }
+                    [PSCustomObject] $Object
+                }
+            }
+            #>
+        }
+    }
+    End {
+
+    }
+}

Public/Repair-GPOZaurrPermissionConsistency.ps1

@@ -0,0 +1,44 @@
+function Repair-GPOZaurrPermissionConsistency {
+    [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Default')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [int] $LimitProcessing = [int32]::MaxValue
+    )
+    $ConsistencySplat = @{
+        Forest                    = $Forest
+        IncludeDomains            = $IncludeDomains
+        ExcludeDomains            = $ExcludeDomains
+        ExtendedForestInformation = $ExtendedForestInformation
+        Verbose                   = $VerbosePreference
+    }
+    if ($GPOName) {
+        $ConsistencySplat['GPOName'] = $GPOName
+    } elseif ($GPOGuid) {
+        $ConsistencySplat['GPOGuid'] = $GPOGUiD
+    } else {
+        $ConsistencySplat['Type'] = 'Inconsistent'
+    }
+
+    Get-GPOZaurrPermissionConsistency @ConsistencySplat -IncludeGPOObject | Where-Object {
+        if ($_.ACLConsistent -eq $false) {
+            $_
+        }
+    } | Select-Object -First $LimitProcessing | ForEach-Object {
+        #Write-Verbose "Repair-GPOZaurrPermissionConsistency - Repairing GPO consistency $($_.DisplayName) from domain: $($_.DomainName)"
+        if ($PSCmdlet.ShouldProcess($_.DisplayName, "Reparing GPO permissions consistency in domain $($_.DomainName)")) {
+            try {
+                $_.IncludeGPOObject.MakeAclConsistent()
+            } catch {
+                $ErrorMessage = $_.Exception.Message
+                Write-Warning "Repair-GPOZaurrPermissionConsistency - Failed to set consistency: $($ErrorMessage)."
+            }
+        }
+    }
+}

Public/Set-GPOZaurrOwner.ps1

@@ -1,8 +1,53 @@
 function Set-GPOZaurrOwner {
+    <#
+    .SYNOPSIS
+    Short description
+
+    .DESCRIPTION
+    Long description
+
+    .PARAMETER Type
+    Unknown - finds unknown Owners and sets them to Administrative (Domain Admins) or chosen principal
+    NotMatching - find administrative groups only and if sysvol and gpo doesn't match - replace with chosen principal or Domain Admins if not specified
+    NotAdministrative - combination of Unknown/NotMatching and NotAdministrative - replace with chosen principal or Domain Admins if not specified
+    All - if Owner is known it checks if it's Administrative, if it sn't it fixes that. If owner is unknown it fixes it
+    .PARAMETER GPOName
+    Parameter description
+
+    .PARAMETER GPOGuid
+    Parameter description
+
+    .PARAMETER Forest
+    Parameter description
+
+    .PARAMETER ExcludeDomains
+    Parameter description
+
+    .PARAMETER IncludeDomains
+    Parameter description
+
+    .PARAMETER ExtendedForestInformation
+    Parameter description
+
+    .PARAMETER Principal
+    Parameter description
+
+    .PARAMETER SkipSysvol
+    Parameter description
+
+    .PARAMETER LimitProcessing
+    Parameter description
+
+    .EXAMPLE
+    An example
+
+    .NOTES
+    General notes
+    #>
     [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Type')]
     param(
         [Parameter(ParameterSetName = 'Type', Mandatory)]
-        [validateset('Unknown', 'NotAdministrative', 'All')][string[]] $Type,
+        [validateset('Unknown', 'NotAdministrative', 'NotMatching', 'All')][string] $Type,
 
         [Parameter(ParameterSetName = 'Named')][string] $GPOName,
         [Parameter(ParameterSetName = 'Named')][alias('GUID', 'GPOID')][string] $GPOGuid,
@@ -27,20 +72,20 @@
         [Parameter(ParameterSetName = 'Named')]
         [string] $Principal,
 
-        [switch] $IncludeSysVol,
+        [switch] $SkipSysvol,
 
         [Parameter(ParameterSetName = 'Type')]
         [Parameter(ParameterSetName = 'Named')]
         [int] $LimitProcessing = [int32]::MaxValue
     )
     Begin {
-        Write-Verbose "Set-GPOZaurrOwner - Getting ADAdministrativeGroups"
+        #Write-Verbose "Set-GPOZaurrOwner - Getting ADAdministrativeGroups"
         $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-        Write-Verbose "Set-GPOZaurrOwner - Processing GPOs for Type $Type"
+        #Write-Verbose "Set-GPOZaurrOwner - Processing GPO for Type $Type"
     }
     Process {
         $getGPOZaurrOwnerSplat = @{
-            IncludeSysvol             = $IncludeSysVol
+            IncludeSysvol             = -not $SkipSysvol.IsPresent
             Forest                    = $Forest
             IncludeDomains            = $IncludeDomains
             ExcludeDomains            = $ExcludeDomains
@@ -54,31 +99,105 @@
             $getGPOZaurrOwnerSplat['GPOGuid'] = $GPOGUiD
         }
         Get-GPOZaurrOwner @getGPOZaurrOwnerSplat | Where-Object {
-            if ($Type -contains 'NotAdministrative' -and $Type -notcontains 'All') {
-                if ($_.Owner) {
-                    $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
-                    if (-not $AdministrativeGroup) {
+            if ($_.Owner) {
+                $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
+            } else {
+                $AdministrativeGroup = $null
+            }
+            if (-not $SkipSysvol) {
+                if ($_.SysvolOwner) {
+                    $AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"]
+                } else {
+                    $AdministrativeGroupSysvol = $null
+                }
+            }
+            if ($Type -eq 'NotAdministrative') {
+                if (-not $AdministrativeGroup -or (-not $AdministrativeGroupSysvol -and -not $SkipSysvol)) {
+                    $_
+                } else {
+                    if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
+                        Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
                         $_
                     }
                 }
-            } elseif ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
-                if ($null -eq $_.Owner) {
+
+                <#
+                if (-not $AdministrativeGroup -and (-not $AdministrativeGroupSysvol -and -not $SkipSysvol)) {
+                    $Action = 'Both'
+                    $_
+                } elseif (-not $AdministrativeGroup) {
+                    $Action = 'OnlyGPO'
+                    $_
+                } elseif (-not $AdministrativeGroupSysvol -and -not $SkipSysvol) {
+                    $Action = 'OnlyFileSystem'
+                    $_
+                } else {
+                    if ($_.Owner -ne $_.SysvolOwner) {
+                        $Action = 'OnlyFileSystem'
+                        $_
+                    }
+                }
+                #>
+            } elseif ($Type -eq 'Unknown') {
+                if (-not $_.Owner -or (-not $_.SysvolOwner -and -not $SkipSysvol)) {
                     $_
                 }
+            } elseif ($Type -eq 'NotMatching') {
+                if ($SkipSysvol) {
+                    Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). SysVol scanning is disabled. Skipping."
+                } else {
+                    if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
+                        #Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
+                        $_
+                    }
+                }
             } else {
-                $_
+                # we run with no type, that means we need to either set it to principal or to Administrative
+                if ($_.Owner) {
+                    # we check if Principal is not set
+                    $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
+                    if (-not $SkipSysvol -and $_.SysvolOwner) {
+                        $AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"]
+                        if (-not $AdministrativeGroup -or -not $AdministrativeGroupSysvol) {
+                            $_
+                        }
+                    } else {
+                        if (-not $AdministrativeGroup) {
+                            $_
+                        }
+                    }
+                } else {
+                    $_
+                }
             }
         } | Select-Object -First $LimitProcessing | ForEach-Object -Process {
             $GPO = $_
-            if ($Principal) {
-                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
-                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
+            #if (-not $Principal) {
+            #   $Principal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+            #}
+            if (-not $Principal) {
+                $DefaultPrincipal = $ADAdministrativeGroups["$($_.DomainName)"]['DomainAdmins']
             } else {
-                $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
-                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                $DefaultPrincipal = $Principal
             }
-            <#
+            if ($Action -eq 'OnlyGPO') {
+                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) (SID: $($GPO.OwnerSID)) to $DefaultPrincipal"
+                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal  -Verbose:$false -WhatIf:$WhatIfPreference
+            } elseif ($Action -eq 'OnlyFileSystem') {
+                if (-not $SkipSysvol) {
+                    Write-Verbose "Set-GPOZaurrOwner - Changing Sysvol Owner GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.SysvolOwner) (SID: $($GPO.SysvolSid)) to $DefaultPrincipal"
+                    Set-FileOwner -JustPath -Path $GPO.SysvolPath -Owner $DefaultPrincipal  -Verbose:$true -WhatIf:$WhatIfPreference
+                }
+            } else {
+                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) (SID: $($GPO.OwnerSID)) to $DefaultPrincipal"
+                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal  -Verbose:$false -WhatIf:$WhatIfPreference
+                if (-not $SkipSysvol) {
+                    Write-Verbose "Set-GPOZaurrOwner - Changing Sysvol Owner GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.SysvolOwner) (SID: $($GPO.SysvolSid)) to $DefaultPrincipal"
+                    Set-FileOwner -JustPath -Path $GPO.SysvolPath -Owner $DefaultPrincipal -Verbose:$true -WhatIf:$WhatIfPreference
+                }
+            }
+        }
+        <#
             if ($Type -contains 'All') {
                 # Regardless who is the owner it is overwritten
                 if ($Principal) {
@@ -138,7 +257,7 @@
                 }
             }
             #>
-        }
+        #}
         #>
         #}
         <#