mirror of
https://github.com/EvotecIT/GPOZaurr.git
synced 2026-07-26 20:00:09 +00:00
Compare commits
9 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Przemyslaw Klys
|
6e81f6f80f | ||
|
Przemyslaw Klys
|
6c607b28f3 | ||
|
Przemyslaw Klys
|
288306228c | ||
|
Przemyslaw Klys
|
fb2285437a | ||
|
Przemyslaw Klys
|
3ff20afe30 | ||
|
Przemyslaw Klys
|
ff6ad6735d | ||
|
Przemyslaw Klys
|
fe97c15741 | ||
|
Przemyslaw Klys
|
66b60fdbfa | ||
|
Przemyslaw Klys
|
ba9f741a8d |
@@ -1,7 +1,7 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol
|
||||
$T | Format-Table *
|
||||
#$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -Forest 'test.evotec.pl'
|
||||
#$T | Format-Table *
|
||||
#$T | Out-HtmlView -ScrollX
|
||||
|
||||
$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOName 'Default Domain Policy'
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
|
||||
Get-GPOZaurrPermissionConsistency -Type Inconsistent | ForEach-Object {
|
||||
$G = Get-GPOZaurrAD -GPOGuid $_.ID.GUID -IncludeDomains $_.DomainName
|
||||
$P = Get-GPOZaurrPermission -GPOGuid $_.ID.GUID
|
||||
$F = Get-WinADShare -Path $G.Path
|
||||
$P | Format-Table
|
||||
$F | Format-Table
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz'
|
||||
|
||||
Repair-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -Verbose #-WhatIf -Verbose
|
||||
@@ -0,0 +1,9 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
|
||||
|
||||
$Output = Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -VerifyInside
|
||||
$Output | Format-Table DisplayName, DomainName, ACLConsistent, ACLConsistentInside
|
||||
$Output.ACLConsistentInsideDetails | Format-Table
|
||||
|
||||
$Output = Get-GPOZaurrPermissionConsistency -VerifyInside -Type 'All'
|
||||
$Output | Format-Table
|
||||
+3
-3
@@ -5,9 +5,9 @@
|
||||
CompatiblePSEditions = 'Desktop'
|
||||
Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
|
||||
Description = 'Group Policy Eater'
|
||||
FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrLink', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
|
||||
FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLink', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
|
||||
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
|
||||
ModuleVersion = '0.0.22'
|
||||
ModuleVersion = '0.0.26'
|
||||
PowerShellVersion = '5.1'
|
||||
PrivateData = @{
|
||||
PSData = @{
|
||||
@@ -17,7 +17,7 @@
|
||||
}
|
||||
}
|
||||
RequiredModules = @{
|
||||
ModuleVersion = '0.0.141'
|
||||
ModuleVersion = '0.0.143'
|
||||
ModuleName = 'PSSharedGoods'
|
||||
Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
|
||||
}, @{
|
||||
|
||||
@@ -1,130 +0,0 @@
|
||||
function Get-GPOZaurrPermissionConsistency {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[Parameter(ParameterSetName = 'GPOName')]
|
||||
[string] $GPOName,
|
||||
|
||||
[Parameter(ParameterSetName = 'GPOGUID')]
|
||||
[alias('GUID', 'GPOID')][string] $GPOGuid,
|
||||
|
||||
[Parameter(ParameterSetName = 'Type')][validateSet('Consistent', 'Inconsistent', 'All')][string[]] $Type = 'All',
|
||||
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
[System.Collections.IDictionary] $ExtendedForestInformation,
|
||||
|
||||
[switch] $IncludeGPOObject
|
||||
)
|
||||
Begin {
|
||||
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
}
|
||||
Process {
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
$QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
|
||||
if ($GPOName) {
|
||||
Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
|
||||
try {
|
||||
$IsConsistent = $_.IsAclConsistent()
|
||||
$ErrorMessage = ''
|
||||
} catch {
|
||||
$ErrorMessage = $_.Exception.Message
|
||||
Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
|
||||
$IsConsistent = 'Not available.'
|
||||
}
|
||||
$Object = @{
|
||||
DisplayName = $_.DisplayName # : New Group Policy Object
|
||||
DomainName = $_.DomainName # : ad.evotec.xyz
|
||||
ACLConsistent = $IsConsistent
|
||||
Owner = $_.Owner # : EVOTEC\Enterprise Admins
|
||||
Id = $_.Id # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
|
||||
GpoStatus = $_.GpoStatus # : AllSettingsEnabled
|
||||
Description = $_.Description # :
|
||||
CreationTime = $_.CreationTime # : 04.03.2020 17:19:42
|
||||
ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36
|
||||
UserVersion = $_.UserVersion # : AD Version: 0, SysVol Version: 0
|
||||
ComputerVersion = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
|
||||
WmiFilter = $_.WmiFilter # :
|
||||
Error = $ErrorMessage
|
||||
}
|
||||
if ($IncludeGPOObject) {
|
||||
$Object['IncludeGPOObject'] = $_
|
||||
}
|
||||
[PSCustomObject] $Object
|
||||
}
|
||||
} elseif ($GPOGuid) {
|
||||
Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
|
||||
try {
|
||||
$IsConsistent = $_.IsAclConsistent()
|
||||
$ErrorMessage = ''
|
||||
} catch {
|
||||
$ErrorMessage = $_.Exception.Message
|
||||
Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
|
||||
$IsConsistent = 'Not available.'
|
||||
}
|
||||
$Object = @{
|
||||
DisplayName = $_.DisplayName # : New Group Policy Object
|
||||
DomainName = $_.DomainName # : ad.evotec.xyz
|
||||
ACLConsistent = $IsConsistent
|
||||
Owner = $_.Owner # : EVOTEC\Enterprise Admins
|
||||
Id = $_.Id # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
|
||||
GpoStatus = $_.GpoStatus # : AllSettingsEnabled
|
||||
Description = $_.Description # :
|
||||
CreationTime = $_.CreationTime # : 04.03.2020 17:19:42
|
||||
ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36
|
||||
UserVersion = $_.UserVersion # : AD Version: 0, SysVol Version: 0
|
||||
ComputerVersion = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
|
||||
WmiFilter = $_.WmiFilter # :
|
||||
Error = $ErrorMessage
|
||||
}
|
||||
if ($IncludeGPOObject) {
|
||||
$Object['IncludeGPOObject'] = $_
|
||||
}
|
||||
[PSCustomObject] $Object
|
||||
}
|
||||
} else {
|
||||
Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
|
||||
try {
|
||||
$IsConsistent = $_.IsAclConsistent()
|
||||
$ErrorMessage = ''
|
||||
} catch {
|
||||
$ErrorMessage = $_.Exception.Message
|
||||
Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
|
||||
$IsConsistent = 'Not available.'
|
||||
}
|
||||
if ($Type -eq 'Consistent') {
|
||||
if (-not $IsConsistent) {
|
||||
return
|
||||
}
|
||||
} elseif ($Type -eq 'Inconsistent') {
|
||||
if ($IsConsistent -eq $true) {
|
||||
return
|
||||
}
|
||||
}
|
||||
$Object = @{
|
||||
DisplayName = $_.DisplayName # : New Group Policy Object
|
||||
DomainName = $_.DomainName # : ad.evotec.xyz
|
||||
ACLConsistent = $IsConsistent
|
||||
Owner = $_.Owner # : EVOTEC\Enterprise Admins
|
||||
Id = $_.Id # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
|
||||
GpoStatus = $_.GpoStatus # : AllSettingsEnabled
|
||||
Description = $_.Description # :
|
||||
CreationTime = $_.CreationTime # : 04.03.2020 17:19:42
|
||||
ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36
|
||||
UserVersion = $_.UserVersion # : AD Version: 0, SysVol Version: 0
|
||||
ComputerVersion = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
|
||||
WmiFilter = $_.WmiFilter # :
|
||||
Error = $ErrorMessage
|
||||
}
|
||||
if ($IncludeGPOObject) {
|
||||
$Object['IncludeGPOObject'] = $_
|
||||
}
|
||||
[PSCustomObject] $Object
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
End {
|
||||
|
||||
}
|
||||
}
|
||||
@@ -7,7 +7,7 @@
|
||||
[parameter(ParameterSetName = 'Filter')][string] $SearchBase,
|
||||
[parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
|
||||
|
||||
[parameter(ParameterSetName = 'Linked',Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
|
||||
[parameter(ParameterSetName = 'Linked', Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
|
||||
|
||||
[parameter(ParameterSetName = 'Filter')]
|
||||
[parameter(ParameterSetName = 'ADObject')]
|
||||
@@ -58,7 +58,7 @@
|
||||
$Splat = @{
|
||||
#Filter = $Filter
|
||||
Properties = 'distinguishedName', 'gplink', 'CanonicalName'
|
||||
# Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')"
|
||||
# Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')"
|
||||
Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
|
||||
}
|
||||
if ($Linked -contains 'DomainControllers') {
|
||||
@@ -103,7 +103,7 @@
|
||||
if ($Linked -contains 'Other') {
|
||||
$SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
|
||||
#if ($SearchBase -notlike "*$DomainDistinguishedName") {
|
||||
# we check if SearchBase is part of domain distinugishname. If it isn't we skip
|
||||
# we check if SearchBase is part of domain distinugishname. If it isn't we skip
|
||||
# continue
|
||||
#}
|
||||
$Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
|
||||
@@ -125,6 +125,7 @@
|
||||
Filter = $Filter
|
||||
Properties = 'distinguishedName', 'gplink', 'CanonicalName'
|
||||
Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
|
||||
|
||||
}
|
||||
if ($PSBoundParameters.ContainsKey('SearchBase')) {
|
||||
$DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
|
||||
@@ -139,8 +140,12 @@
|
||||
$Splat['SearchScope'] = $SearchScope
|
||||
}
|
||||
|
||||
Get-ADObject @Splat | ForEach-Object {
|
||||
Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
try {
|
||||
Get-ADObject @Splat | ForEach-Object {
|
||||
Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
}
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Processing error $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,214 @@
|
||||
function Get-GPOZaurrPermissionConsistency {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
|
||||
[Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
|
||||
[Parameter(ParameterSetName = 'Type')][validateSet('Consistent', 'Inconsistent', 'All')][string[]] $Type = 'All',
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
[System.Collections.IDictionary] $ExtendedForestInformation,
|
||||
[switch] $IncludeGPOObject,
|
||||
[switch] $VerifyInside
|
||||
)
|
||||
Begin {
|
||||
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
}
|
||||
Process {
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
$QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
|
||||
if ($GPOName) {
|
||||
$getGPOSplat = @{
|
||||
Name = $GPOName
|
||||
Domain = $Domain
|
||||
Server = $QueryServer
|
||||
ErrorAction = 'SilentlyContinue'
|
||||
}
|
||||
} elseif ($GPOGuid) {
|
||||
$getGPOSplat = @{
|
||||
Guid = $GPOGuid
|
||||
Domain = $Domain
|
||||
Server = $QueryServer
|
||||
ErrorAction = 'SilentlyContinue'
|
||||
}
|
||||
} else {
|
||||
$getGPOSplat = @{
|
||||
All = $true
|
||||
Domain = $Domain
|
||||
Server = $QueryServer
|
||||
ErrorAction = 'SilentlyContinue'
|
||||
}
|
||||
}
|
||||
Get-GPO @getGPOSplat | ForEach-Object -Process {
|
||||
try {
|
||||
$IsConsistent = $_.IsAclConsistent()
|
||||
$ErrorMessage = ''
|
||||
} catch {
|
||||
$ErrorMessage = $_.Exception.Message
|
||||
Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
|
||||
$IsConsistent = 'Not available.'
|
||||
}
|
||||
$SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
|
||||
if ($VerifyInside) {
|
||||
$FolderPermissions = Get-WinADSharePermission -Path $SysVolpath
|
||||
[Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) {
|
||||
if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) {
|
||||
$File
|
||||
}
|
||||
}
|
||||
if ($NotInheritedPermissions.Count -eq 0) {
|
||||
$ACLConsistentInside = $true
|
||||
} else {
|
||||
$ACLConsistentInside = $false
|
||||
}
|
||||
} else {
|
||||
$ACLConsistentInside = $null
|
||||
}
|
||||
$Object = [ordered] @{
|
||||
DisplayName = $_.DisplayName # : New Group Policy Object
|
||||
DomainName = $_.DomainName # : ad.evotec.xyz
|
||||
ACLConsistent = $IsConsistent
|
||||
ACLConsistentInside = $ACLConsistentInside
|
||||
Owner = $_.Owner # : EVOTEC\Enterprise Admins
|
||||
Path = $_.Path
|
||||
SysVolPath = $SysvolPath
|
||||
Id = $_.Id # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
|
||||
GpoStatus = $_.GpoStatus # : AllSettingsEnabled
|
||||
Description = $_.Description # :
|
||||
CreationTime = $_.CreationTime # : 04.03.2020 17:19:42
|
||||
ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36
|
||||
UserVersion = $_.UserVersion # : AD Version: 0, SysVol Version: 0
|
||||
ComputerVersion = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
|
||||
WmiFilter = $_.WmiFilter # :
|
||||
Error = $ErrorMessage
|
||||
}
|
||||
if ($IncludeGPOObject) {
|
||||
$Object['IncludeGPOObject'] = $_
|
||||
}
|
||||
if ($VerifyInside) {
|
||||
$Object['ACLConsistentInsideDetails'] = $NotInheritedPermissions
|
||||
}
|
||||
[PSCustomObject] $Object
|
||||
}
|
||||
<#
|
||||
} elseif ($GPOGuid) {
|
||||
Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
|
||||
try {
|
||||
$IsConsistent = $_.IsAclConsistent()
|
||||
$ErrorMessage = ''
|
||||
} catch {
|
||||
$ErrorMessage = $_.Exception.Message
|
||||
Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
|
||||
$IsConsistent = 'Not available.'
|
||||
}
|
||||
$SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
|
||||
if ($Advanced) {
|
||||
$FolderPermissions = Get-WinADSharePermission -Path $SysVolpath
|
||||
[Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) {
|
||||
if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) {
|
||||
$File
|
||||
}
|
||||
}
|
||||
if ($NotInheritedPermissions.Count -eq 0) {
|
||||
$ACLConsistentInside = $true
|
||||
} else {
|
||||
$ACLConsistentInside = $false
|
||||
}
|
||||
} else {
|
||||
$ACLConsistentInside = $null
|
||||
}
|
||||
$Object = [ordered] @{
|
||||
DisplayName = $_.DisplayName # : New Group Policy Object
|
||||
DomainName = $_.DomainName # : ad.evotec.xyz
|
||||
ACLConsistent = $IsConsistent
|
||||
ACLConsistentInside = $ACLConsistentInside
|
||||
Owner = $_.Owner # : EVOTEC\Enterprise Admins
|
||||
Path = $_.Path
|
||||
SysVolPath = $SysvolPath
|
||||
Id = $_.Id # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
|
||||
GpoStatus = $_.GpoStatus # : AllSettingsEnabled
|
||||
Description = $_.Description # :
|
||||
CreationTime = $_.CreationTime # : 04.03.2020 17:19:42
|
||||
ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36
|
||||
UserVersion = $_.UserVersion # : AD Version: 0, SysVol Version: 0
|
||||
ComputerVersion = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
|
||||
WmiFilter = $_.WmiFilter # :
|
||||
Error = $ErrorMessage
|
||||
}
|
||||
if ($Advanced) {
|
||||
$Object['ACLConsistentInsideDetails'] = $NotInheritedPermissions
|
||||
}
|
||||
if ($IncludeGPOObject) {
|
||||
$Object['IncludeGPOObject'] = $_
|
||||
}
|
||||
[PSCustomObject] $Object
|
||||
}
|
||||
} else {
|
||||
Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
|
||||
try {
|
||||
$IsConsistent = $_.IsAclConsistent()
|
||||
$ErrorMessage = ''
|
||||
} catch {
|
||||
$ErrorMessage = $_.Exception.Message
|
||||
Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
|
||||
$IsConsistent = 'Not available.'
|
||||
}
|
||||
if ($Type -eq 'Consistent') {
|
||||
if (-not $IsConsistent) {
|
||||
return
|
||||
}
|
||||
} elseif ($Type -eq 'Inconsistent') {
|
||||
if ($IsConsistent -eq $true) {
|
||||
return
|
||||
}
|
||||
}
|
||||
$SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
|
||||
if ($Advanced) {
|
||||
$FolderPermissions = Get-WinADSharePermission -Path $SysVolpath
|
||||
[Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) {
|
||||
if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) {
|
||||
$File
|
||||
}
|
||||
}
|
||||
if ($NotInheritedPermissions.Count -eq 0) {
|
||||
$ACLConsistentInside = $true
|
||||
} else {
|
||||
$ACLConsistentInside = $false
|
||||
}
|
||||
} else {
|
||||
$ACLConsistentInside = $null
|
||||
}
|
||||
$Object = [ordered] @{
|
||||
DisplayName = $_.DisplayName # : New Group Policy Object
|
||||
DomainName = $_.DomainName # : ad.evotec.xyz
|
||||
ACLConsistent = $IsConsistent
|
||||
ACLConsistentInside = $ACLConsistentInside
|
||||
Owner = $_.Owner # : EVOTEC\Enterprise Admins
|
||||
Path = $_.Path
|
||||
SysVolPath = $SysvolPath
|
||||
Id = $_.Id # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
|
||||
GpoStatus = $_.GpoStatus # : AllSettingsEnabled
|
||||
Description = $_.Description # :
|
||||
CreationTime = $_.CreationTime # : 04.03.2020 17:19:42
|
||||
ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36
|
||||
UserVersion = $_.UserVersion # : AD Version: 0, SysVol Version: 0
|
||||
ComputerVersion = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
|
||||
WmiFilter = $_.WmiFilter # :
|
||||
Error = $ErrorMessage
|
||||
}
|
||||
if ($Advanced) {
|
||||
$Object['ACLConsistentInsideDetails'] = $NotInheritedPermissions
|
||||
}
|
||||
if ($IncludeGPOObject) {
|
||||
$Object['IncludeGPOObject'] = $_
|
||||
}
|
||||
[PSCustomObject] $Object
|
||||
}
|
||||
}
|
||||
#>
|
||||
}
|
||||
}
|
||||
End {
|
||||
|
||||
}
|
||||
}
|
||||
@@ -27,7 +27,7 @@
|
||||
Begin {
|
||||
$Count = 0
|
||||
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
$ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
|
||||
if ($Type -eq 'Unknown') {
|
||||
if ($SkipAdministrative -or $SkipWellKnown) {
|
||||
Write-Warning "Remove-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
|
||||
|
||||
@@ -0,0 +1,44 @@
|
||||
function Repair-GPOZaurrPermissionConsistency {
|
||||
[cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Default')]
|
||||
param(
|
||||
[Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
|
||||
[Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
|
||||
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
[System.Collections.IDictionary] $ExtendedForestInformation,
|
||||
|
||||
[int] $LimitProcessing = [int32]::MaxValue
|
||||
)
|
||||
$ConsistencySplat = @{
|
||||
Forest = $Forest
|
||||
IncludeDomains = $IncludeDomains
|
||||
ExcludeDomains = $ExcludeDomains
|
||||
ExtendedForestInformation = $ExtendedForestInformation
|
||||
Verbose = $VerbosePreference
|
||||
}
|
||||
if ($GPOName) {
|
||||
$ConsistencySplat['GPOName'] = $GPOName
|
||||
} elseif ($GPOGuid) {
|
||||
$ConsistencySplat['GPOGuid'] = $GPOGUiD
|
||||
} else {
|
||||
$ConsistencySplat['Type'] = 'Inconsistent'
|
||||
}
|
||||
|
||||
Get-GPOZaurrPermissionConsistency @ConsistencySplat -IncludeGPOObject | Where-Object {
|
||||
if ($_.ACLConsistent -eq $false) {
|
||||
$_
|
||||
}
|
||||
} | Select-Object -First $LimitProcessing | ForEach-Object {
|
||||
#Write-Verbose "Repair-GPOZaurrPermissionConsistency - Repairing GPO consistency $($_.DisplayName) from domain: $($_.DomainName)"
|
||||
if ($PSCmdlet.ShouldProcess($_.DisplayName, "Reparing GPO permissions consistency in domain $($_.DomainName)")) {
|
||||
try {
|
||||
$_.IncludeGPOObject.MakeAclConsistent()
|
||||
} catch {
|
||||
$ErrorMessage = $_.Exception.Message
|
||||
Write-Warning "Repair-GPOZaurrPermissionConsistency - Failed to set consistency: $($ErrorMessage)."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -146,7 +146,7 @@
|
||||
if ($SkipSysvol) {
|
||||
Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). SysVol scanning is disabled. Skipping."
|
||||
} else {
|
||||
if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
|
||||
if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
|
||||
#Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
|
||||
$_
|
||||
}
|
||||
@@ -197,7 +197,7 @@
|
||||
}
|
||||
}
|
||||
}
|
||||
<#
|
||||
<#
|
||||
if ($Type -contains 'All') {
|
||||
# Regardless who is the owner it is overwritten
|
||||
if ($Principal) {
|
||||
|
||||
Reference in New Issue
Block a user