Readme update

Added some error logging

.github/FUNDING.yml

@@ -1,7 +1,4 @@
 # These are supported funding model platforms
 
 github: PrzemyslawKlys
-patreon: przemyslawklys
-ko_fi: przemyslawklys
-open_collective: evotec
 custom: https://paypal.me/PrzemyslawKlys

Examples/Example-05-ListingWMIFiltersByName.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrWMI -Name 'Test - Dual Filter' | Format-Table -AutoSize *

Examples/Example-09-RemovingGPOPermissionUnknown02.ps1

@@ -0,0 +1,19 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Step 1 - Create report
+$Report = Get-GPOZaurrPermission -Type All
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOutput.xlsx -ExcelWorkSheetName 'GPO Permissions Before' -AutoFilter -AutoFit
+
+# Step 2 - Verify couple of GPOS returned with whatif
+#Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 4 -WhatIf
+
+# Step 3 - Confirm the change without whatif
+#Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 4
+
+# Step 4 - Analyze GPO manually to confirm only unknown sids were removed
+
+# Step 5 - if everything went ok, continue process without whatif
+
+# Step-6 - Generate new report
+#$Report = Get-GPOZaurrPermission -Type All
+#$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOutput.xlsx -ExcelWorkSheetName 'GPO Permissions After' -AutoFilter -AutoFit

Examples/Example-11-ReplaceGPOwner.ps1

@@ -0,0 +1,12 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Step 1 - Create report
+$Report = Get-GPOZaurrOwner -IncludeSysvol
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOwners.xlsx -ExcelWorkSheetName 'GPO Owners Before' -AutoFilter -AutoFit
+
+# Step 2 - Fix owners / use WhatIf and LimitProcessing / verify changes before/after
+Set-GPOZaurrOwner -Type NotAdministrative  -Verbose -LimitProcessing 2 -WhatIf
+
+# Step 3
+$Report = Get-GPOZaurrOwner -IncludeSysvol
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOwners.xlsx -ExcelWorkSheetName 'GPO Owners After' -AutoFilter -AutoFit

Examples/Example-14-ListingGPOsPerOU3.ps1

@@ -1,5 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 Get-ADOrganizationalUnit -Filter * -Properties distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
+Get-ADOrganizationalUnit -Filter * -Properties canonicalname, distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
 Get-ADObject -Filter * -Properties distinguishedName, gplink -Server 'ad.evotec.pl' | Get-GPOZaurrLink | Format-Table -AutoSize
 Get-GPOZaurrLink | Format-Table -AutoSize

Examples/Example-14-ListingGPOsPerOU4.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -Linked 'Root' -IncludeDomains 'ad.evotec.pl' | Format-Table

Examples/Example-14-ListingGPOsPerOURemoveDuplicates.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -Verbose | Format-Table -a *
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -SkipDuplicates | Format-Table -a *

Examples/Example-16-AddRemoveGPOPermission02.ps1

@@ -2,18 +2,37 @@
 
 Clear-Host
 
-$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-IncludeGPOObject #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
-$T | Format-Table -AutoSize *
+$GPOName = 'ALL | Enable RDP'
 
-Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -Verbose
-Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoApply -Principal 'przemyslaw.klys' -Verbose
-Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -Verbose
-Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -Verbose
+$T = Get-GPOZaurrPermission -GPOName $GPOName -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow -Principal 'Domain Admins' -PrincipalType 'Name'
+$T | Format-Table *
 
-$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
-$T | Format-Table -AutoSize *
+<#
+# this will go and check for both Domain Admins / Enterprise Admins - if found won't do anything
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Type Administrative -Verbose
+# this will go thru, because PrincipalType is not set to look by Name. Be precise with what you ask for
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -Verbose
+# this will be detected as already existing
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -PrincipalType Name -Verbose
+# this will be added only if it doesn't exists - assuming that przemyslaw.klys is displayed in Get-GPOZaurrPermissions
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+# this will be added only if it doesn't exists - assuming that przemyslaw.klys is displayed in Get-GPOZaurrPermissions
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+# this will ADD system if it doesn't eists
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Type WellKnownAdministrative -Verbose
 
-#Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -Verbose
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -Verbose
+# this will not work because we already have GPOEditDeleteModifySecurity which is higher than GpoEDIT
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEdit -Principal 'przemyslaw.klys' -Verbose
+#>
+Add-GPOZaurrPermission -GPOName $GPOName -Type AuthenticatedUsers -PermissionType GpoRead -Verbose #-WhatIf
 
-#$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T | Format-Table -AutoSize *
+
+#Remove-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
 #$T | Format-Table -AutoSize *

Examples/Example-16-AddRemoveGPOPermission03.ps1

@@ -1,14 +1,6 @@
 #Clear-Host
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$ApprovedGroups = @(
-    'GDS-TestGroup10'
-)
-$RootGroups = @(
-    #'przemyslaw.klys'
-)
-
-
 Invoke-GPOZaurrPermission -Linked Root -Verbose {
     Set-GPOOwner -Type Administrative
     #Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'

Examples/Example-16-AddRemoveGPOPermission04.ps1

@@ -8,4 +8,4 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=Computers,OU=Production,DC=ad
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
     #Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
     #Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
-} #-WhatIf #| Format-Table *
+} -WhatIf #| Format-Table *

Examples/Example-16-KeepPermissions.ps1

@@ -0,0 +1,42 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Apply permissions for ROOT
+Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+# Apply perrmissions for Domain Controllers
+Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+# Apply permissions for Regions, with exclusions for those 4 groups
+$Exclude = @(
+    'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+$Exclude = @(
+    'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf

Examples/Example-16-KeepPermissions02.ps1

@@ -0,0 +1,44 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Apply permissions for ROOT
+Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.pl' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates
+
+
+# Apply perrmissions for Domain Controllers
+Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates
+
+# Apply permissions for Regions, with exclusions for those 4 groups
+$Exclude = @(
+    'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates
+
+
+$Exclude = @(
+    'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates

Examples/Example-16-KeepPermissions03.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This is a bit special - I would read blog post before running this
+Invoke-GPOZaurrPermission -Verbose -Level 1 -Limit 1 {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf

Examples/Example-17-FixInconsistentACL.ps1

@@ -1,10 +0,0 @@
-Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-
-#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
-Get-GPOZaurrPermissionConsistency -Type Inconsistent | ForEach-Object {
-    $G = Get-GPOZaurrAD -GPOGuid $_.ID.GUID -IncludeDomains $_.DomainName
-    $P = Get-GPOZaurrPermission -GPOGuid $_.ID.GUID
-    $F = Get-WinADShare -Path $G.Path
-    $P | Format-Table
-    $F | Format-Table
-}

Examples/Example-17-RepairInconsistentACL.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz'
+
+Repair-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -Verbose #-WhatIf -Verbose

Examples/Example-17-RepairInconsistentACLAll.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrPermissionConsistency -Type All | Format-Table
+
+Repair-GPOZaurrPermissionConsistency -LimitProcessing 2 -WhatIf -Verbose

Examples/Example-18-ListInconsistenciesACLAdvanced.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
+
+$Output = Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -VerifyInheritance
+$Output | Format-Table DisplayName, DomainName, ACLConsistent, ACLConsistentInside
+$Output.ACLConsistentInsideDetails | Format-Table
+
+$Output = Get-GPOZaurrPermissionConsistency -VerifyInheritance -Type 'All'
+$Output | Format-Table

Examples/Example-19-TestSysvol.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrSysvol -Verbose | Format-Table

Examples/Example-19-TestSysvolDomainControllers.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrSysvol -VerifyDomainControllers -Verbose | Format-Table *

Examples/Example-20-RemoveOrphanedFoldersSysvol.ps1

@@ -0,0 +1,7 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# this allows you to process X amount of orphaned folders/files (good for testing)
+Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf -LimitProcessing 2
+
+# this runs for whole SYSVOL and checks things against GPOS
+Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf

Examples/Example-21-ListLegacyADMFiles.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLegacyFiles | Format-Table -AutoSize

Examples/Example-22-RemoveLegacyADMFiles.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Remove-GPOZaurrLegacyFiles -Verbose -WhatIf

Examples/Example-23-Links.ps1

@@ -0,0 +1,14 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Get-GPOZaurrLinkSummary | Format-Table *
+#Get-GPOZaurrLinkSummary -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'MultipleLinks' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'OneLink' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'LinksSummary' -UnlimitedProperties | Format-Table *
+
+$Report = Get-GPOZaurrLinkSummary #-UnlimitedProperties
+$Report | Format-Table *
+$Report.MultipleLinks | Format-Table *
+$Report.OneLink | Format-Table *
+$Report.LinksSummary | Format-Table *

Examples/Example-24-Links02.ps1

@@ -0,0 +1,12 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Report = Get-GPOZaurrLinkSummary -Report OneLink
+$Report | Format-Table
+$AffectedGPOs = foreach ($GPO in $Report) {
+    if ($GPO.Level1 -gt 1) {
+        $GPO
+    }
+}
+
+$AffectedGPOs | Format-Table *

Examples/Example-25-ListSysVolFiles.ps1

@@ -0,0 +1,6 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrFiles -Type All | Out-HtmlView -ScrollX -Filtering -AllProperties
+Get-GPOZaurrFiles -HashAlgorithm MD5 | Select-Object -First 2 | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOListFiles.xlsx -AllProperties -ExcelWorkSheetName 'Files Just 2' -AutoFilter -AutoFit #-OpenWorkBook
+Get-GPOZaurrFiles -Type All -HashAlgorithm SHA256 | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOListFiles.xlsx -AllProperties -ExcelWorkSheetName 'Files All' -AutoFilter -AutoFit #-OpenWorkBook

Examples/Example-26-Files.ps1

@@ -0,0 +1,10 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Output = Get-GPOZaurrSysvol | ForEach-Object {
+    $Path = $_.Path
+    Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File | ForEach-Object {
+        Get-FileMetaData -File $_ -Signature -HashAlgorithm 'SHA256'
+    }
+}
+$Output | Format-Table

Examples/Example-28-SaveGPO.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport -DeleteExisting
+Save-GPOZaurrFiles -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' #-DeleteExisting

Examples/Example-29-FindGPO-FromDisk-Notranslation.ps1

@@ -0,0 +1,22 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
+
+$OutputNoTranslation = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
+$OutputNoTranslation | Format-Table *
+
+New-HTML {
+    foreach ($GPOCategory in $OutputNoTranslation.Keys) {
+        New-HTMLTab -Name $GPOCategory {
+            if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
+                foreach ($GpoSettings in $OutputNoTranslation["$GPOCategory"].Keys) {
+                    New-HTMLTab -Name $GpoSettings {
+                        New-HTMLTable -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $Key
+                    }
+                }
+            } else {
+                New-HTMLTable -DataTable $OutputNoTranslation[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $Key
+            }
+        }
+    }
+} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-NoTranslationFromDisk.html

Examples/Example-29-FindGPO-FromDisk.ps1

@@ -0,0 +1,22 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
+
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' # -NoTranslation
+$Output | Format-Table *
+
+New-HTML {
+    foreach ($GPOCategory in $Output.Keys) {
+        New-HTMLTab -Name $GPOCategory {
+            if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
+                foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
+                    New-HTMLTab -Name $GpoSettings {
+                        New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $Key
+                    }
+                }
+            } else {
+                New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $Key
+            }
+        }
+    }
+} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-FromDisk.html

Examples/Example-29-FindGPO-NoTranslation.ps1

@@ -0,0 +1,19 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Output = Invoke-GPOZaurr -NoTranslation
+
+New-HTML {
+    foreach ($GPOCategory in $Output.Keys) {
+        New-HTMLTab -Name $GPOCategory {
+            if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
+                foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
+                    New-HTMLTab -Name $GpoSettings {
+                        New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $Key
+                    }
+                }
+            } else {
+                New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $Key
+            }
+        }
+    }
+} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-NoTranslation.html

Examples/Example-29-FindGPO.ps1

@@ -0,0 +1,19 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Output = Invoke-GPOZaurr #-NoTranslation
+
+New-HTML {
+    foreach ($GPOCategory in $Output.Keys) {
+        New-HTMLTab -Name $GPOCategory {
+            if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
+                foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
+                    New-HTMLTab -Name $GpoSettings {
+                        New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $Key
+                    }
+                }
+            } else {
+                New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $Key
+            }
+        }
+    }
+} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO.html

Examples/Example-29-FindGPOFromDiskWork.ps1

@@ -0,0 +1,25 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
+
+$OutputTranslation = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport'
+$OutputTranslation | Format-Table
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' -NoTranslation
+$Output | Format-Table *
+
+#$Output.LugsSettings.LocalUsersAndGroups | Format-List *
+
+$GPOEntry = $Output.LugsSettings.LocalUsersAndGroups[0]
+
+$CreateGPO = @{}
+foreach ($User in $GPOEntry.User) {
+    # $User | Format-Table
+    # $User.Properties | Format-Table
+}
+
+
+foreach ($Group in $GPOEntry.Group) {
+    #$Group | Format-Table
+    $Group.Properties | Format-Table
+    $Group.Properties.Members | Format-Table
+}

Examples/Example-29-FindGPOHtmlOutput.ps1

@@ -0,0 +1,6 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
+
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
+$Output | Format-Table *

Examples/Example-29-FindGPOTranslationHelp.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This is purely for building GPO Dictionary, mostly for development needs to help asses what is there
+
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
+#$Output | Format-Table *
+
+$LookingFor = $Output | Select-GPOTranslation -Category 'SecuritySettings' -Settings 'UserRightsAssignment'
+$LookingFor | Format-Table
+$LookingFor.Types | Format-Table
+#$LookingFor.Data | Format-Table

GPOZaurr.psd1

@@ -1,27 +1,27 @@
 @{
-    AliasesToExport      = ''
+    AliasesToExport      = 'Find-GPO'
     Author               = 'Przemyslaw Klys'
     CompanyName          = 'Evotec'
     CompatiblePSEditions = 'Desktop'
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
-    Description          = 'Group Policy Eater'
-    FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrLink', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
+    Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows easy fixing for issues that you may expect finding in them.'
+    FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrFiles', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Select-GPOTranslation', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.22'
+    ModuleVersion        = '0.0.46'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
-            Tags                       = 'Windows', 'ActiveDirectory', 'GPO'
+            Tags                       = 'Windows', 'ActiveDirectory', 'GPO', 'GroupPolicy'
             ProjectUri                 = 'https://github.com/EvotecIT/GPOZaurr'
             ExternalModuleDependencies = 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
         }
     }
     RequiredModules      = @{
-        ModuleVersion = '0.0.141'
+        ModuleVersion = '0.0.155'
         ModuleName    = 'PSSharedGoods'
         Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
     }, @{
-        ModuleVersion = '0.0.55'
+        ModuleVersion = '0.0.58'
         ModuleName    = 'ADEssentials'
         Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
     }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'

Private/ConvertTo-AccountPolicies.ps1

@@ -0,0 +1,31 @@
+# TODO: #2 Identical to ConvertTo-EventLog - decide what to do later on
+
+function ConvertTo-AccountPolicies {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName  = $GPOEntry.DomainName    #: area1.local
+            GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType     = $GPOEntry.GpoType       #: Computer
+            GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
+            Type        = $GPOEntry.Type
+            Policy      = $GPOEntry.Name
+
+        }
+        if ($GPOEntry.SettingBoolean) {
+            $CreateGPO['Setting'] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { $null };
+            #try { [bool]::Parse($GPOEntry.SettingBoolean) } catch { $null };
+        } elseif ($GPOEntry.SettingNumber) {
+            $CreateGPO['Setting'] = $GPOEntry.SettingNumber
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-EventLog.ps1

@@ -0,0 +1,29 @@
+function ConvertTo-EventLog {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName  = $GPOEntry.DomainName    #: area1.local
+            GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType     = $GPOEntry.GpoType       #: Computer
+            GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
+            Type        = $GPOEntry.Type
+            Policy      = $GPOEntry.Name
+
+        }
+        if ($GPOEntry.SettingBoolean) {
+            $CreateGPO['Setting'] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { $null };
+            #try { [bool]::Parse($GPOEntry.SettingBoolean) } catch { $null };
+        } elseif ($GPOEntry.SettingNumber) {
+            $CreateGPO['Setting'] = $GPOEntry.SettingNumber
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-LocalUserAndGroups.ps1

@@ -0,0 +1,89 @@
+function ConvertTo-LocalUserAndGroups {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        foreach ($User in $GPOEntry.User) {
+            $CreateGPO = [ordered]@{
+                DisplayName      = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+                DomainName       = $GPOEntry.DomainName    #: area1.local
+                GUID             = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+                GpoType          = $GPOEntry.GpoType       #: Computer
+                GpoCategory      = $GPOEntry.GpoCategory   #: SecuritySettings
+                GpoSettings      = $GPOEntry.GpoSettings   #: SecurityOptions
+                Changed          = [DateTime] $User.Changed
+                GPOSettingOrder  = $User.GPOSettingOrder
+                UserAction       = $Script:Actions["$($User.Properties.action)"]       #: U
+                UserNewName      = $User.Properties.newName      #:
+                UserFullName     = $User.Properties.fullName     #:
+                UserDescription  = $User.Properties.description  #:
+                UserCpassword    = $User.Properties.cpassword    #:
+                UserChangeLogon  = $User.Properties.changeLogon  #: 0
+                UserNoChange     = $User.Properties.noChange     #: 0
+                UserNeverExpires = $User.Properties.neverExpires #: 0
+                UserAcctDisabled = $User.Properties.acctDisabled #: 0
+                UserAubAuthority = $User.Properties.subAuthority #: RID_ADMIN
+                UserUserName     = $User.Properties.userName     #: Administrator (built-in)
+                UserMembers      = $User.Properties.Members      #:
+            }
+            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+            [PSCustomObject] $CreateGPO
+        }
+        foreach ($Group in $GPOEntry.Group) {
+            # We're mostly interested in Members
+            [Array] $Members = foreach ($Member in $Group.Properties.Members.Member) {
+                [ordered] @{
+                    MemberName   = $Member.Name
+                    MemberAction = $Member.Action
+                    MemberSID    = $Member.SID
+                }
+            }
+            # if we have no members we create dummy object to make sure we can use foreach below
+            if ($Members.Count -eq 0) {
+                $Members = @(
+                    [ordered] @{
+                        MemberName   = $null
+                        MemberAction = $null
+                        MemberSID    = $null
+                    }
+                )
+            }
+            foreach ($Member in $Members) {
+                $CreateGPO = [ordered]@{
+                    DisplayName          = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+                    DomainName           = $GPOEntry.DomainName    #: area1.local
+                    GUID                 = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+                    GpoType              = $GPOEntry.GpoType       #: Computer
+                    GpoCategory          = $GPOEntry.GpoCategory   #: SecuritySettings
+                    GpoSettings          = $GPOEntry.GpoSettings   #: SecurityOptions
+                    Changed              = [DateTime] $Group.Changed
+                    GPOSettingOrder      = $Group.GPOSettingOrder
+                    GroupUid             = $Group.uid             #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
+                    GroupUserContext     = $Group.userContext     #: 0: 0
+                    GroupRemovePolicy    = $Group.removePolicy    #: 1: 1
+                    #Properties      = $Group.Properties      #: Properties: Properties
+                    Filters              = $Group.Filters         #::
+
+                    GroupAction          = $Script:Actions["$($Group.Properties.action)"]          #: U
+                    GroupNewName         = $Group.Properties.newName         #:
+                    GroupDescription     = $Group.Properties.description     #:
+                    GroupDeleteAllUsers  = $Group.Properties.deleteAllUsers  #: 0
+                    GroupDeleteAllGroups = $Group.Properties.deleteAllGroups #: 0
+                    GroupRemoveAccounts  = $Group.Properties.removeAccounts  #: 1
+                    GroupSid             = $Group.Properties.groupSid        #: S - 1 - 5 - 32 - 544
+                    GroupName            = $Group.Properties.groupName       #: Administrators (built -in )
+                }
+                # Merging GPO with Member
+                $CreateGPO = $CreateGPO + $Member
+
+                $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+                $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+                $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+                [PSCustomObject] $CreateGPO
+            }
+        }
+    }
+}

Private/ConvertTo-Policies.ps1

@@ -0,0 +1,30 @@
+function ConvertTo-Policies {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName        = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName         = $GPOEntry.DomainName    #: area1.local
+            GUID               = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType            = $GPOEntry.GpoType       #: Computer
+            GpoCategory        = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings        = $GPOEntry.GpoSettings   #: SecurityOptions
+            PolicyName         = $GPOEntry.Name
+            PolicyState        = $GPOEntry.State
+            PolicyCategory     = $GPOEntry.Category
+            PolicySupported    = $GPOEntry.Supported
+            PolicyExplain      = $GPOEntry.Explain
+            PolicyText         = $GPOEntry.Text
+            PolicyCheckBox     = $GPOEntry.CheckBox
+            PolicyDropDownList = $GPOEntry.DropDownList
+            PolicyEditText     = $GPOEntry.EditText
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+
+    }
+}

Private/ConvertTo-RegistryAutologon.ps1

@@ -0,0 +1,49 @@
+function ConvertTo-RegistryAutologon {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+
+        $CreateGPO = [ordered]@{
+            DisplayName       = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName        = $GPOEntry.DomainName    #: area1.local
+            GUID              = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType           = $GPOEntry.GpoType       #: Computer
+            GpoCategory       = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings       = $GPOEntry.GpoSettings   #: SecurityOptions
+            AutoAdminLogon    = $null
+            DefaultDomainName = $null
+            DefaultUserName   = $null
+            DefaultPassword   = $null
+        }
+
+        foreach ($Registry in $GPOEntry.Registry) {
+            if ($Registry.Properties.Key -eq 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon') {
+                if ($Registry.Properties.Name -eq 'AutoAdminLogon') {
+                    $CreateGPO['AutoAdminLogon'] = [bool] $Registry.Properties.value
+                    $CreateGPO['DateChangedAutoAdminLogon'] = [DateTime] $Registry.changed
+                } elseif ($Registry.Properties.Name -eq 'DefaultDomainName') {
+                    $CreateGPO['DefaultDomainName'] = $Registry.Properties.value
+                    $CreateGPO['DateChangedDefaultDomainName'] = [DateTime] $Registry.changed
+                } elseif ($Registry.Properties.Name -eq 'DefaultUserName') {
+                    $CreateGPO['DefaultUserName'] = $Registry.Properties.value
+                    $CreateGPO['DateChangedDefaultUserName'] = [DateTime] $Registry.changed
+                } elseif ($Registry.Properties.Name -eq 'DefaultPassword') {
+                    $CreateGPO['DefaultPassword'] = $Registry.Properties.value
+                    $CreateGPO['DateChangedDefaultPassword'] = [DateTime] $Registry.changed
+                }
+            }
+        }
+        if ($null -ne $CreateGPO['AutoAdminLogon'] -or
+            $null -ne $CreateGPO['DefaultDomainName'] -or
+            $null -ne $CreateGPO['DefaultUserName'] -or
+            $null -ne $CreateGPO['DefaultPassword']
+        ) {
+            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-RegistrySettings.ps1

@@ -0,0 +1,30 @@
+function ConvertTo-RegistrySettings {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        foreach ($Registry in $GPOEntry.Registry) {
+            $CreateGPO = [ordered]@{
+                DisplayName     = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+                DomainName      = $GPOEntry.DomainName    #: area1.local
+                GUID            = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+                GpoType         = $GPOEntry.GpoType       #: Computer
+                GpoCategory     = $GPOEntry.GpoCategory   #: SecuritySettings
+                GpoSettings     = $GPOEntry.GpoSettings   #: SecurityOptions
+                Changed         = [DateTime] $Registry.changed
+                GPOSettingOrder = $Registry.GPOSettingOrder
+                Hive            = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
+                Key             = $Registry.Properties.key  #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+                Name            = $Registry.Properties.name #: AutoAdminLogon
+                Type            = $Registry.Properties.type #: REG_SZ
+                Value           = $Registry.Properties.value #
+                Filters         = $Registry.Filters
+            }
+            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-RegistrySettingsCollection.ps1

@@ -0,0 +1,46 @@
+function ConvertTo-RegistrySettingsCollection {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        foreach ($Collection in $GPOEntry.Collection) {
+            $OutputDictionaries = foreach ($Registry in $Collection.Registry) {
+                [ordered] @{
+                    #"$($Registry.Name)FieldName"       = $Registry.Name
+                    #"$($Registry.Name)FieldStatus"     = $Registry.Status
+                    "$($Registry.Name)BypassErrors"    = try { [bool]::Parse($Registry.BypassErrors) } catch { $null };
+                    "$($Registry.Name)Changed"         = [DateTime] $Registry.Changed
+                    "$($Registry.Name)UID"             = $Registry.UID
+                    "$($Registry.Name)GPOSettingOrder" = $Registry.GPOSettingOrder
+                    "$($Registry.Name)Action"          = $Registry.Properties.action
+                    "$($Registry.Name)DisplayDecimal"  = $Registry.Properties.displayDecimal
+                    "$($Registry.Name)Default"         = $Registry.Properties.default
+                    "$($Registry.Name)Hive"            = $Registry.Properties.hive
+                    "$($Registry.Name)Name"            = $Registry.Properties.name
+                    "$($Registry.Name)Type"            = $Registry.Properties.type
+                    "$($Registry.Name)Value"           = $Registry.Properties.value
+                    "$($Registry.Name)Values"          = $Registry.Properties.Values
+                }
+            }
+            $CreateGPO = [ordered]@{
+                DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+                DomainName  = $GPOEntry.DomainName    #: area1.local
+                GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+                GpoType     = $GPOEntry.GpoType       #: Computer
+                GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
+                GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
+            }
+            foreach ($Dictionary in $OutputDictionaries) {
+                $CreateGPO = $CreateGPO + $Dictionary
+            }
+            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}
+
+
+

Private/ConvertTo-Scripts.ps1

@@ -0,0 +1,26 @@
+function ConvertTo-Scripts {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName  = $GPOEntry.DomainName    #: area1.local
+            GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType     = $GPOEntry.GpoType       #: Computer
+            GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
+            Command     = $GPOEntry.Command
+            Parameters  = $GPOEntry.Parameters
+            Type        = $GPOEntry.Type
+            Order       = $GPOEntry.Order
+            RunOrder    = $GPOEntry.RunOrder
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+
+    }
+}

Private/ConvertTo-SecurityOptions.ps1

@@ -0,0 +1,28 @@
+function ConvertTo-SecurityOptions {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName            = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName             = $GPOEntry.DomainName    #: area1.local
+            GUID                   = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType                = $GPOEntry.GpoType       #: Computer
+            GpoCategory            = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings            = $GPOEntry.GpoSettings   #: SecurityOptions
+            KeyName                = $GPOEntry.KeyName
+            KeyDisplayName         = $GPOEntry.Display.Name
+            KeyDisplayUnits        = $GPOEntry.Display.Units
+            KeyDisplayBoolean      = try { [bool]::Parse($GPOEntry.Display.DisplayBoolean) } catch { $null };
+            KeyDisplayString       = $GPOEntry.Display.DisplayString
+            SystemAccessPolicyName = $GPOEntry.SystemAccessPolicyName
+            SettingString          = $GPOEntry.SettingString
+            SettingNumber          = $GPOEntry.SettingNumber
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-SoftwareInstallation.ps1

@@ -0,0 +1,42 @@
+function ConvertTo-SoftwareInstallation {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName         = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName          = $GPOEntry.DomainName    #: area1.local
+            GUID                = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType             = $GPOEntry.GpoType       #: Computer
+            GpoCategory         = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings         = $GPOEntry.GpoSettings   #: SecurityOptions
+            Identifier          = $GPOEntry.Identifier          #: { 10495e9e-79c1-4a32-b278-a24cd495437f }
+            Name                = $GPOEntry.Name                #: Local Administrator Password Solution (2)
+            Path                = $GPOEntry.Path                #: \\area1.local\SYSVOL\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\LAPS.x64.msi
+            MajorVersion        = $GPOEntry.MajorVersion        #: 6
+            MinorVersion        = $GPOEntry.MinorVersion        #: 2
+            LanguageId          = $GPOEntry.LanguageId          #: 1033
+            Architecture        = $GPOEntry.Architecture        #: 9
+            IgnoreLanguage      = if ($GPOEntry.IgnoreLanguage -eq 'true') { $true } else { $false }      #: false
+            Allowx86Onia64      = if ($GPOEntry.Allowx86Onia64 -eq 'true') { $true } else { $false }       #: true
+            SupportURL          = $GPOEntry.SupportURL          #:
+            AutoInstall         = if ($GPOEntry.AutoInstall -eq 'true') { $true } else { $false }          #: true
+            DisplayInARP        = if ($GPOEntry.DisplayInARP -eq 'true') { $true } else { $false }        #: true
+            IncludeCOM          = if ($GPOEntry.IncludeCOM -eq 'true') { $true } else { $false }          #: true
+            SecurityDescriptor  = $GPOEntry.SecurityDescriptor  #: SecurityDescriptor
+            DeploymentType      = $GPOEntry.DeploymentType      #: Assign
+            ProductId           = $GPOEntry.ProductId           #: { ea8cb806-c109 - 4700 - 96b4-f1f268e5036c }
+            ScriptPath          = $GPOEntry.ScriptPath          #: \\area1.local\SysVol\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\Machine\Applications\ { EAC9B821-FB4D - 457A-806F-E5B528D1E41A }.aas
+            DeploymentCount     = $GPOEntry.DeploymentCount     #: 0
+            InstallationUILevel = $GPOEntry.InstallationUILevel #: Maximum
+            Upgrades            = if ($GPOEntry.Upgrades.Mandatory -eq 'true') { $true } else { $false }            #: Upgrades
+            UninstallUnmanaged  = if ($GPOEntry.UninstallUnmanaged -eq 'true') { $true } else { $false }   #: false
+            LossOfScopeAction   = $GPOEntry.LossOfScopeAction   #: Unmanage
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-SystemServices.ps1

@@ -0,0 +1,25 @@
+function ConvertTo-SystemServices {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        $CreateGPO = [ordered]@{
+            DisplayName                = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+            DomainName                 = $GPOEntry.DomainName    #: area1.local
+            GUID                       = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+            GpoType                    = $GPOEntry.GpoType       #: Computer
+            GpoCategory                = $GPOEntry.GpoCategory   #: SecuritySettings
+            GpoSettings                = $GPOEntry.GpoSettings   #: SecurityOptions
+            ServiceName                = $GPOEntry.Name
+            ServiceStartUpMode         = $GPOEntry.StartUpMode
+            SecurityAuditingPresent    = try { [bool]::Parse($GPOEntry.SecurityDescriptor.AuditingPresent.'#text') } catch { $null };
+            SecurityPermissionsPresent = try { [bool]::Parse($GPOEntry.SecurityDescriptor.PermissionsPresent.'#text') } catch { $null };
+            SecurityDescriptor         = $GPOEntry.SecurityDescriptor
+        }
+        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-SystemServicesNT.ps1

@@ -0,0 +1,36 @@
+function ConvertTo-SystemServicesNT {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOList
+    )
+    foreach ($GPOEntry in $GPOList) {
+        foreach ($Service in $GPOEntry.NTService) {
+            $CreateGPO = [ordered]@{
+                DisplayName          = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
+                DomainName           = $GPOEntry.DomainName    #: area1.local
+                GUID                 = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
+                GpoType              = $GPOEntry.GpoType       #: Computer
+                GpoCategory          = $GPOEntry.GpoCategory   #: SecuritySettings
+                GpoSettings          = $GPOEntry.GpoSettings   #: SecurityOptions
+                Changed              = [DateTime] $Service.Changed
+                GPOSettingOrder      = $Service.GPOSettingOrder
+                #ServiceName          = $Service.Name
+                ServiceName          = $Service.Properties.serviceName          #: AppIDSvc: AppIDSvc
+                ServiceStartupType   = $Service.Properties.startupType          #: NOCHANGE: NOCHANGE
+                ServiceAction        = $Service.Properties.serviceAction        #: START: START
+                Timeout              = $Service.Properties.timeout              #: 50: 50
+                FirstFailure         = $Service.Properties.firstFailure         #: REBOOT: REBOOT
+                SecondFailure        = $Service.Properties.secondFailure        #: REBOOT: REBOOT
+                ThirdFailure         = $Service.Properties.thirdFailure         #: REBOOT: REBOOT
+                ResetFailCountDelay  = $Service.Properties.resetFailCountDelay  #: 0: 0
+                RestartComputerDelay = $Service.Properties.restartComputerDelay #: 60000: 60000
+                Filter               = $Service.Filter
+
+            }
+            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
+            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
+            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/Find-MissingProperties.ps1

@@ -0,0 +1,15 @@
+function Find-MissingProperties {
+    [cmdletBinding()]
+    param(
+        [Array] $Objects,
+        [string[]] $PossibleProperties
+    )
+    $AllProperties = Select-Properties -AllProperties -Objects $Objects
+    $MissingProperties = $AllProperties | Where-Object { $_ -notin 'DisplayName', 'DomainName', 'GUID', 'Linked', 'LinksCount', 'Links', 'GPOType', 'GPOCategory', 'GPOSettings' }
+    [Array] $ConsiderAdding = foreach ($Property in $MissingProperties) {
+        if ($Property -notin $PossibleProperties) {
+            $Property
+        }
+    }
+    $ConsiderAdding
+}

Private/Get-LinksFromXML.ps1

@@ -0,0 +1,38 @@
+function Get-LinksFromXML {
+    [cmdletBinding()]
+    param(
+        [System.Xml.XmlElement[]] $GPOOutput,
+        [string] $Splitter,
+        [switch] $FullObjects
+    )
+    $Links = [ordered] @{
+        Linked     = $null
+        LinksCount = $null
+        Links      = $null
+    }
+    if ($GPOOutput.LinksTo) {
+        $Links.Linked = $true
+        $Links.LinksCount = ([Array] $GPOOutput.LinksTo).Count
+        $Links.Links = foreach ($Link in $GPOOutput.LinksTo) {
+            if ($FullObjects) {
+                [PSCustomObject] @{
+                    Path       = $Link.SOMPath
+                    Enabled    = if ($Link.Enabled -eq 'true') { $true } else { $false }
+                    NoOverride = if ($Link.NoOverride -eq 'true') { $true } else { $false }
+                }
+            } else {
+                if ($Link.Enabled) {
+                    $Link.SOMPath
+                }
+            }
+        }
+        if ($Splitter) {
+            $Links.Links = $Links.Links -join $Splitter
+        }
+    } else {
+        $Links.Linked = $false
+        $Links.LinksCount = 0
+        $Links.Links = $null
+    }
+    [PSCustomObject] $Links
+}

Private/Get-PrivGPOZaurrLInk.ps1

@@ -6,51 +6,69 @@
         [System.Collections.IDictionary] $GPOCache
     )
     if ($Object.GpLink -and $Object.GpLink.Trim() -ne '') {
-        $Object.GpLink -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://' | ForEach-Object -Process {
-            if ($_) {
+        #$Object.GpLink -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://'
+        $Object.GpLink -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            #Write-Verbose $_
+            if ($_.Length -gt 10) {
                 $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
                 $Output = [ordered] @{
                     DistinguishedName = $Object.DistinguishedName
-                    CanonicalName     = $Object.CanonicalName
+                    CanonicalName     = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
                     Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
                 }
                 $Search = -join ($DomainCN, $Output['Guid'])
                 if ($GPOCache -and -not $Limited) {
-                    $Output['DisplayName'] = $GPOCache[$Search].DisplayName
-                    $Output['DomainName'] = $GPOCache[$Search].DomainName
-                    $Output['Owner'] = $GPOCache[$Search].Owner
-                    $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
-                    $Output['Description'] = $GPOCache[$Search].Description
-                    $Output['CreationTime'] = $GPOCache[$Search].CreationTime
-                    $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                    if ($GPOCache[$Search]) {
+                        $Output['DisplayName'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
                 }
-                $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
-                $Output['GPODistinguishedName'] = $_
-                [PSCustomObject] $Output
             }
         }
     } elseif ($Object.LinkedGroupPolicyObjects -and $Object.LinkedGroupPolicyObjects.Trim() -ne '') {
-        $Object.LinkedGroupPolicyObjects -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://' | ForEach-Object -Process {
-            if ($_) {
+        $Object.LinkedGroupPolicyObjects -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            if ($_.Length -gt 10) {
                 $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
                 $Output = [ordered] @{
                     DistinguishedName = $Object.DistinguishedName
-                    CanonicalName     = $Object.CanonicalName
+                    CanonicalName     = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
                     Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
                 }
                 $Search = -join ($DomainCN, $Output['Guid'])
                 if ($GPOCache -and -not $Limited) {
-                    $Output['Name'] = $GPOCache[$Search].DisplayName
-                    $Output['DomainName'] = $GPOCache[$Search].DomainName
-                    $Output['Owner'] = $GPOCache[$Search].Owner
-                    $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
-                    $Output['Description'] = $GPOCache[$Search].Description
-                    $Output['CreationTime'] = $GPOCache[$Search].CreationTime
-                    $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                    if ($GPOCache[$Search]) {
+                        $Output['Name'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
                 }
-                $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
-                $Output['GPODistinguishedName'] = $_
-                [PSCustomObject] $Output
             }
         }
     }

Private/Get-PrivPermission.ps1

@@ -2,6 +2,7 @@
     [cmdletBinding()]
     param(
         [Microsoft.GroupPolicy.Gpo] $GPO,
+        [Object] $SecurityRights,
 
         [string[]] $Principal,
         [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
@@ -11,25 +12,44 @@
         [switch] $IncludeOwner,
         [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
         [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid',
+
         [switch] $IncludeGPOObject,
         [System.Collections.IDictionary] $ADAdministrativeGroups,
-        [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All', 'Default')][string[]] $Type,
-        [System.Collections.IDictionary] $Accounts
+        [validateSet('AuthenticatedUsers', 'DomainComputers', 'Unknown', 'WellKnownAdministrative', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All',
+        [System.Collections.IDictionary] $Accounts,
+        [System.Collections.IDictionary] $ExtendedForestInformation
     )
     Begin {
         Write-Verbose "Get-PrivPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
     }
     Process {
-        $SecurityRights = $GPO.GetSecurityInfo()
         $SecurityRights | ForEach-Object -Process {
-            #Get-GPPermissions -Guid $GPO.ID -DomainName $GPO.DomainName -All -Server $QueryServer | ForEach-Object -Process {
             $GPOPermission = $_
+            if ($PermitType -ne 'All') {
+                if ($PermitType -eq 'Deny') {
+                    if ($GPOPermission.Denied -eq $false) {
+                        return
+                    }
+                } else {
+                    if ($GPOPermission.Denied -eq $true) {
+                        return
+                    }
+                }
+            }
             if ($ExcludePermissionType -contains $GPOPermission.Permission) {
                 return
             }
             if ($IncludePermissionType) {
                 if ($IncludePermissionType -notcontains $GPOPermission.Permission) {
-                    return
+                    if ($IncludePermissionType -eq 'GpoRead' -and $GPOPermission.Permission -eq 'GpoApply') {
+                        # We treat GpoApply as GpoRead as well. This is because when GpoApply is set it becomes GpoRead as well but of course not vice versa
+                    } else {
+                        return
+                    }
                 }
             }
             if ($SkipWellKnown.IsPresent -or $Type -contains 'NotWellKnown') {
@@ -56,12 +76,30 @@
                     return
                 }
             }
+            if ($Type -contains 'WellKnownAdministrative' -and $Type -notcontains 'All') {
+                # We check for SYSTEM account
+                # Maybe we should make it a function and provide more
+                if ($GPOPermission.Trustee.Sid -ne 'S-1-5-18') {
+                    return
+                }
+            }
             if ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
                 # May need updates if there's more types
                 if ($GPOPermission.Trustee.SidType -ne 'Unknown') {
                     return
                 }
             }
+            if ($Type -contains 'AuthenticatedUsers' -and $Type -notcontains 'All') {
+                if ($GPOPermission.Trustee.Sid -ne 'S-1-5-11') {
+                    return
+                }
+            }
+            if ($Type -contains 'DomainComputers' -and $Type -notcontains 'All') {
+                $DomainComputersSID = -join ($ExtendedForestInformation['DomainsExtended'][$GPO.DomainName].DomainSID, '-515')
+                if ($GPOPermission.Trustee.Sid -ne $DomainComputersSID) {
+                    return
+                }
+            }
             if ($Principal) {
                 if ($PrincipalType -eq 'Sid') {
                     if ($Principal -notcontains $GPOPermission.Trustee.Sid.Value) {
@@ -78,6 +116,22 @@
                     }
                 }
             }
+            if ($ExcludePrincipal) {
+                if ($ExcludePrincipalType -eq 'Sid') {
+                    if ($ExcludePrincipal -contains $GPOPermission.Trustee.Sid.Value) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'DistinguishedName') {
+                    if ($ExcludePrincipal -contains $GPOPermission.Trustee.DSPath) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'Name') {
+                    $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                    if ($ExcludePrincipal -contains $UserMerge -or $ExcludePrincipal -contains $GPOPermission.Trustee.Name) {
+                        return
+                    }
+                }
+            }
             $ReturnObject = [ordered] @{
                 DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
                 GUID              = $GPO.ID

Private/Get-XMLGPO.ps1

@@ -112,6 +112,9 @@
             'UserSettingsVersionIdentical'      = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
             'UserSettings'                      = $XMLContent.GPO.User.ExtensionData.Extension
 
+            ComputerPolicies                    = $XMLContent.GPO.Computer.ExtensionData.Name -join ", "
+            UserPolicies                        = $XMLContent.GPO.User.ExtensionData.Name -join ", "
+
             'CreationTime'                      = [DateTime] $XMLContent.GPO.CreatedTime
             'ModificationTime'                  = [DateTime] $XMLContent.GPO.ModifiedTime
             'ReadTime'                          = [DateTime] $XMLContent.GPO.ReadTime

Private/Get-XMLStandard.ps1

@@ -0,0 +1,38 @@
+function Get-XMLStandard {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [System.Xml.XmlElement[]] $GPOOutput,
+        [string] $Splitter,
+        [switch] $FullObjects
+    )
+    $LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects
+    foreach ($GpoType in @('User', 'Computer')) {
+        if ($GPOOutput.$GpoType.ExtensionData.Extension) {
+            foreach ($ExtensionType in $GPOOutput.$GpoType.ExtensionData.Extension) {
+                $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
+                $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] }
+                foreach ($GpoSettings in $KeysToLoop.Name) {
+                    foreach ($Key in $ExtensionType.$GpoSettings) {
+                        $Template = [ordered] @{
+                            DisplayName = $GPO.DisplayName
+                            DomainName  = $GPO.DomainName
+                            GUID        = $GPO.Guid
+                            GpoType     = $GpoType
+                            GpoCategory = $GPOSettingTypeSplit[1]
+                            GpoSettings = $GpoSettings
+                        }
+                        $Properties = ($Key | Get-Member -MemberType Properties).Name
+                        foreach ($Property in $Properties) {
+                            $Template["$Property"] = $Key.$Property
+                        }
+                        $Template['Linked'] = $LinksInformation.Linked
+                        $Template['LinksCount'] = $LinksInformation.LinksCount
+                        $Template['Links'] = $LinksInformation.Links
+                        [PSCustomObject] $Template
+                    }
+                }
+            }
+        }
+    }
+}

Private/Invoke-GPOTranslation.ps1

@@ -0,0 +1,15 @@
+function Invoke-GPOTranslation {
+    [cmdletBinding()]
+    param(
+        [System.Collections.IDictionary] $InputData,
+        [string] $Report,
+        [string] $Category,
+        [string] $Settings
+    )
+    if ($Category -and $Settings -and $InputData) {
+        if ($Script:GPODitionary[$Report]['Code']) {
+            $Script:GPOList = $InputData.$Category.$Settings
+            return & $Script:GPODitionary[$Report]['Code']
+        }
+    }
+}

Private/Remove-PrivPermission.ps1

@@ -7,7 +7,7 @@
         [alias('PermissionType')][Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType
     )
     if ($GPOPermission.Name) {
-        $Text = "Removing SID: $($GPOPermission.Sid), Name: $($GPOPermission.Name), SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
+        $Text = "Removing SID: $($GPOPermission.Sid), Name: $($GPOPermission.Domain)\$($GPOPermission.Name), SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
     } else {
         $Text = "Removing SID: $($GPOPermission.Sid), Name: EMPTY, SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
     }

Private/Script.Actions.ps1

@@ -0,0 +1,6 @@
+$Script:Actions = @{
+    C = 'Create'
+    D = 'Delete'
+    U = 'Update'
+    R = 'Replace'
+}

Private/Script.GPODictionary.ps1

@@ -0,0 +1,95 @@
+$Script:GPODitionary = [ordered] @{
+    AccountPolicies            = [ordered] @{
+        Category = 'SecuritySettings'
+        Settings = 'Account'
+        GPOPath  = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies'
+        Code     = {
+            ConvertTo-AccountPolicies -GPOList $GPOList
+        }
+    }
+    Autologon                  = [ordered] @{
+        Category = 'RegistrySettings'
+        Settings = 'RegistrySettings'
+        Code     = {
+            ConvertTo-RegistryAutologon -GPOList $GPOList
+        }
+    }
+    EventLog                   = [ordered] @{
+        Category = 'SecuritySettings'
+        Settings = 'EventLog'
+        #GPOPath  = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies'
+        Code     = {
+            ConvertTo-EventLog -GPOList $GPOList
+        }
+    }
+    LocalUsersAndGroups        = [ordered] @{
+        Category = 'LugsSettings'
+        Settings = 'LocalUsersAndGroups'
+        Code     = {
+            ConvertTo-LocalUserAndGroups -GPOList $GPOList
+        }
+    }
+    Policies                   = @{
+        Category = 'RegistrySettings'
+        Settings = 'Policy'
+        Code     = {
+            ConvertTo-Policies -GPOList $GPOList
+        }
+    }
+    RegistrySettings           = [ordered] @{
+        Category = 'RegistrySettings'
+        Settings = 'RegistrySettings'
+        Code     = {
+            ConvertTo-RegistrySettings -GPOList $GPOList
+        }
+    }
+    RegistrySettingsCollection = [ordered] @{
+        Category = 'RegistrySettings'
+        Settings = 'RegistrySettings'
+        Code     = {
+            ConvertTo-RegistrySettingsCollection -GPOList $GPOList
+        }
+    }
+    Scripts                    = [ordered] @{
+        Category = 'Scripts'
+        Settings = 'Script'
+        Code     = {
+            ConvertTo-Scripts -GPOList $GPOList
+        }
+    }
+    SecurityOptions            = [ordered] @{
+        Category = 'SecuritySettings'
+        Settings = 'SecurityOptions'
+        Code     = {
+            ConvertTo-SecurityOptions -GPOList $GPOList
+        }
+    }
+    SoftwareInstallation       = [ordered] @{
+        Category = 'SoftwareInstallationSettings'
+        Settings = 'MsiApplication'
+        Code     = {
+            ConvertTo-SoftwareInstallation -GPOList $GPOList
+        }
+    }
+    SystemServices             = [ordered] @{
+        Description = ''
+        GPOPath     = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> System Services'
+        Category    = 'SecuritySettings'
+        Settings    = 'SystemServices'
+        Code        = {
+            ConvertTo-SystemServices -GPOList $GPOList
+        }
+    }
+    SystemServicesNT           = [ordered] @{
+        Description = ''
+        GPOPath     = 'Computer Configuration -> Preferences -> Control Pannel Settings -> Services'
+        Category    = 'ServiceSettings'
+        Settings    = 'NTServices'
+        Code        = {
+            ConvertTo-SystemServicesNT -GPOList $GPOList
+        }
+    }
+    #LugsSettings    = @{
+    #    LocalUsersAndGroups = $LugsSettingsLocalUsersAndGroups
+
+}

Private/Test-SysvolFolders.ps1

@@ -0,0 +1,119 @@
+function Test-SysVolFolders {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOs,
+        [string] $Server,
+        [string] $Domain
+    )
+    $Differences = @{ }
+    $SysvolHash = @{ }
+
+    $GPOGUIDS = $GPOs.ID.GUID
+    try {
+        $SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -ErrorAction Stop
+    } catch {
+        $Sysvol = $Null
+    }
+    foreach ($_ in $SYSVOL) {
+        $GUID = $_.Name -replace '{' -replace '}'
+        $SysvolHash[$GUID] = $_
+    }
+    $Files = $SYSVOL.Name -replace '{' -replace '}'
+    if ($Files) {
+        $Comparing = Compare-Object -ReferenceObject $GPOGUIDS -DifferenceObject $Files -IncludeEqual
+        foreach ($_ in $Comparing) {
+            if ($_.SideIndicator -eq '==') {
+                $Found = 'Exists'
+            } elseif ($_.SideIndicator -eq '<=') {
+                $Found = 'Not available on SYSVOL'
+            } elseif ($_.SideIndicator -eq '=>') {
+                $Found = 'Orphaned GPO'
+            } else {
+                $Found = 'Orphaned GPO'
+            }
+            $Differences[$_.InputObject] = $Found
+        }
+    }
+    $GPOSummary = @(
+        foreach ($GPO in $GPOS) {
+            if ($null -ne $SysvolHash[$GPO.Id.GUID].FullName) {
+                $FullPath = $SysvolHash[$GPO.Id.GUID].FullName
+                try {
+                    $ACL = Get-Acl -Path $SysvolHash[$GPO.Id.GUID].FullName -ErrorAction Stop
+                    $Owner = $ACL.Owner
+                    $ErrorMessage = ''
+                } catch {
+                    Write-Warning "Get-GPOZaurrSysvol - ACL reading (1) failed for $FullPath with error: $($_.Exception.Message)"
+                    $ACL = $null
+                    $Owner = ''
+                    $ErrorMessage = $_.Exception.Message
+                }
+            } else {
+                $ACL = $null
+            }
+            if ($null -eq $Differences[$GPO.Id.Guid]) {
+                $SysVolStatus = 'Not available on SYSVOL'
+            } else {
+                $SysVolStatus = $Differences[$GPO.Id.Guid]
+            }
+            [PSCustomObject] @{
+                DisplayName      = $GPO.DisplayName
+                Status           = $Differences[$GPO.Id.Guid]
+                DomainName       = $GPO.DomainName
+                SysvolServer     = $Server
+                SysvolStatus     = $SysVolStatus
+                Owner            = $GPO.Owner
+                FileOwner        = $Owner
+                Id               = $GPO.Id.Guid
+                GpoStatus        = $GPO.GpoStatus
+                Path             = $FullPath
+                Description      = $GPO.Description
+                CreationTime     = $GPO.CreationTime
+                ModificationTime = $GPO.ModificationTime
+                UserVersion      = $GPO.UserVersion
+                ComputerVersion  = $GPO.ComputerVersion
+                WmiFilter        = $GPO.WmiFilter
+                Error            = $ErrorMessage
+            }
+        }
+        # Now we need to list thru Sysvol files and fine those that do not exists as GPO and create dummy GPO objects to show orphaned gpos
+        foreach ($_ in $Differences.Keys) {
+            if ($Differences[$_] -eq 'Orphaned GPO') {
+                if ($SysvolHash[$_].BaseName -notcontains 'PolicyDefinitions') {
+                    $FullPath = $SysvolHash[$_].FullName
+                    try {
+                        $ACL = Get-Acl -Path $FullPath -ErrorAction Stop
+                        $Owner = $ACL.Owner
+                        $ErrorMessage = ''
+                    } catch {
+                        Write-Warning "Get-GPOZaurrSysvol - ACL reading (2) failed for $FullPath with error: $($_.Exception.Message)"
+                        $ACL = $null
+                        $Owner = $null
+                        $ErrorMessage = $_.Exception.Message
+                    }
+
+                    [PSCustomObject] @{
+                        DisplayName      = $SysvolHash[$_].BaseName
+                        Status           = 'Orphaned GPO'
+                        DomainName       = $Domain
+                        SysvolServer     = $Server
+                        SysvolStatus     = $Differences[$GPO.Id.Guid]
+                        Owner            = ''
+                        FileOwner        = $Owner
+                        Id               = $_
+                        GpoStatus        = 'Orphaned'
+                        Path             = $FullPath
+                        Description      = $null
+                        CreationTime     = $SysvolHash[$_].CreationTime
+                        ModificationTime = $SysvolHash[$_].LastWriteTime
+                        UserVersion      = $null
+                        ComputerVersion  = $null
+                        WmiFilter        = $null
+                        Error            = $ErrorMessage
+                    }
+                }
+            }
+        }
+    )
+    $GPOSummary | Sort-Object -Property DisplayName
+}

Public/Add-GPOPermission.ps1

@@ -3,28 +3,39 @@
     param(
         [validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
         [Microsoft.GroupPolicy.GPPermissionType] $IncludePermissionType,
-        [alias('Principal')][Array] $Trustee,
-        [alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName'
+        [alias('Trustee')][Array] $Principal,
+        [alias('TrusteeType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+        [validateSet('Allow', 'Deny')][string] $PermitType = 'Allow'
     )
     if ($Type -eq 'Default') {
         @{
             Action                = 'Add'
-            Type                  = 'Standard'
-            Trustee               = $Trustee
+            Type                  = 'Default'
+            Principal             = $Principal
             IncludePermissionType = $IncludePermissionType
-            TrusteeType           = $TrusteeType
+            PrincipalType         = $PrincipalType
+            PermitType            = $PermitType
         }
     } elseif ($Type -eq 'AuthenticatedUsers') {
         @{
             Action                = 'Add'
             Type                  = 'AuthenticatedUsers'
             IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
         }
     } elseif ($Type -eq 'Administrative') {
         @{
             Action                = 'Add'
             Type                  = 'Administrative'
             IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
+        }
+    } elseif ($Type -eq 'WellKnownAdministrative') {
+        @{
+            Action                = 'Add'
+            Type                  = 'WellKnownAdministrative'
+            IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
         }
     }
 }

Public/Add-GPOZaurrPermission.ps1

@@ -12,10 +12,14 @@
 
         [validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
 
-        [string] $Principal,
-        [alias('IncludePermissionType')][Microsoft.GroupPolicy.GPPermissionType[]] $PermissionType,
+        [alias('Trustee')][string] $Principal,
+        [alias('TrusteeType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+
+        [Parameter(Mandatory)][alias('IncludePermissionType')][Microsoft.GroupPolicy.GPPermissionType] $PermissionType,
         [switch] $Inheritable,
 
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
@@ -23,145 +27,187 @@
         [System.Collections.IDictionary] $ADAdministrativeGroups,
         [int] $LimitProcessing
     )
-    Begin {
-        #$Count = 0
-        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-        if (-not $ADAdministrativeGroups) {
-            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-        }
-        $ForestInformation = Get-ADForest
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Extended
+    if (-not $ADAdministrativeGroups) {
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
     }
-    Process {
-        if ($GPOName) {
-            $Splat = @{
-                GPOName = $GPOName
-            }
-        } elseif ($GPOGUID) {
-            $Splat = @{
-                GPOGUID = $GPOGUID
-            }
-        } else {
-            $Splat = @{
-
-            }
+    if ($GPOName) {
+        $Splat = @{
+            GPOName = $GPOName
         }
-
-        $Splat['IncludeGPOObject'] = $true
-        $Splat['Forest'] = $Forest
-        $Splat['IncludeDomains'] = $Domain
-        #$Splat['ExcludeDomains'] = $ExcludeDomains
-        #$Splat['ExtendedForestInformation'] = $ExtendedForestInformation
-        #$Splat['ExcludePermissionType'] = $ExcludePermissionType
-        #$Splat['IncludePermissionType'] = $PermissionType-
-        $Splat['SkipWellKnown'] = $SkipWellKnown.IsPresent
-        $Splat['SkipAdministrative'] = $SkipAdministrative.IsPresent
-
-        # Get-GPOZaurrPermission @Splat
-
-        #Set-GPPermission -PermissionLevel $PermissionType -TargetName $Principal -TargetType Group -Verbose -DomainName 'ad.evotec.xyz' -Name $GPOName -Replace #-WhatIf
-
-        $AdministrativeExists = @{
-            DomainAdmins     = $false
-            EnterpriseAdmins = $false
+    } elseif ($GPOGUID) {
+        $Splat = @{
+            GPOGUID = $GPOGUID
         }
+    } else {
+        $Splat = @{}
+    }
+    $Splat['IncludeGPOObject'] = $true
+    $Splat['Forest'] = $Forest
+    $Splat['IncludeDomains'] = $IncludeDomains
+    if ($Type -ne 'Default') {
+        $Splat['Type'] = $Type
+    }
+    $Splat['PermitType'] = $PermitType
+    $Splat['Principal'] = $Principal
+    if ($PrincipalType) {
+        $Splat.PrincipalType = $PrincipalType
+    }
+    $Splat['ExcludeDomains'] = $ExcludeDomains
+    $Splat['ExtendedForestInformation'] = $ExtendedForestInformation
+    #$Splat['ExcludePermissionType'] = $ExcludePermissionType
+    $Splat['IncludePermissionType'] = $PermissionType
+    $Splat['SkipWellKnown'] = $SkipWellKnown.IsPresent
+    $Splat['SkipAdministrative'] = $SkipAdministrative.IsPresent
 
-        #continue
-        [Array] $GPOPermissions = Get-GPOZaurrPermission @Splat
-        [Array] $LimitedPermissions = foreach ($GPOPermission in $GPOPermissions) {
-            #$GPOPermission = $_
-            # continue
+    $AdministrativeExists = @{
+        DomainAdmins     = $false
+        EnterpriseAdmins = $false
+    }
+
+    # This should always return results. When no data is found it should return basic information that will allow us to add credentials.
+    [Array] $GPOPermissions = Get-GPOZaurrPermission @Splat -ReturnSecurityWhenNoData
+    # When it has GPOSecurityPermissionItem property it means it has permissions, if it doesn't it means we have clean object to process
+    if ($GPOPermissions.GPOSecurityPermissionItem) {
+        # Permission exists, but may be incomplete
+        foreach ($GPOPermission in $GPOPermissions) {
             if ($Type -eq 'Default') {
-                if ($GPOPermission.Name -eq $Principal -and $GPOPermission.Permission -eq $PermissionType) {
-                    #Write-Verbose "Add-GPOZaurrPermission - Permission $PermissionType already set for $($GPOPermission.Name) / $($GPOPermission.DomainName)"
-                    $GPOPermission
-                    break
-                }
+                # We were looking for specific principal and we got it. nothing to do
+                # this is for standard users such as przemyslaw.klys / adam.gonzales
+                return
             } elseif ($Type -eq 'Administrative') {
+                # We are looking for administrative but we need to make sure we got correct administrative
                 if ($GPOPermission.Permission -eq $PermissionType) {
                     $AdministrativeGroup = $ADAdministrativeGroups['BySID'][$GPOPermission.SID]
+                    if ($AdministrativeGroup.SID -like '*-519') {
+                        $AdministrativeExists['EnterpriseAdmins'] = $true
+                    } elseif ($AdministrativeGroup.SID -like '*-512') {
+                        $AdministrativeExists['DomainAdmins'] = $true
+                    }
+                    <#
                     if ($AdministrativeGroup) {
-                        if ($GPOPermission.SID -like '*-512') {
-                            #Write-Verbose "Add-GPOZaurrPermission - Permission $PermissionType already set for $($GPOPermission.Name) / $($GPOPermission.DomainName)"
+                        $DomainAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-512')
+                        $EnterpriseAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-519')
+                        if ($GPOPermission.SID -eq $DomainAdminsSID) {
                             $AdministrativeExists['DomainAdmins'] = $true
-                        } elseif ($GPOPermission.SID -like '*-519') {
-                            #Write-Verbose "Add-GPOZaurrPermission - Permission $PermissionType already set for $($GPOPermission.Name) / $($GPOPermission.DomainName)"
+                        } elseif ($GPOPermission.SID -eq $EnterpriseAdminsSID) {
                             $AdministrativeExists['EnterpriseAdmins'] = $true
                         }
                     }
+                    #>
                 }
             } elseif ($Type -eq 'WellKnownAdministrative') {
-                if ($GPOPermission.Name -eq $Principal -and $GPOPermission.Permission -eq $PermissionType) {
-                    #Write-Verbose "Add-GPOZaurrPermission - Permission $PermissionType already set for $($GPOPermission.Name) / $($GPOPermission.DomainName)"
-                    $GPOPermission
-                    break
-                }
+                # this is for SYSTEM account
+                return
             } elseif ($Type -eq 'AuthenticatedUsers') {
-                if ($GPOPermission.Name -eq $Principal -and $GPOPermission.Permission -eq $PermissionType) {
-                    #Write-Verbose "Add-GPOZaurrPermission - Permission $PermissionType already set for $($GPOPermission.Name) / $($GPOPermission.DomainName)"
-                    $GPOPermission
-                    break
-                }
+                # this is for Authenticated Users
+                return
             }
-            # Write-Verbose "Test"
-            # $GPOPermission
-
-
-
-
-            #$GPOPermission.GPOSecurity.Add
-            #void Add(Microsoft.GroupPolicy.GPPermission item)
-            #void ICollection[GPPermission].Add(Microsoft.GroupPolicy.GPPermission item)
-            #int IList.Add(System.Object value)
-
-
-            # $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
         }
-        if ($GPOPermissions.Count -gt 0) {
-            if ($LimitedPermissions.Count -gt 0) {
-                #$LimitedPermissions
-            } else {
-                if ($Type -eq 'Administrative') {
-                    if ($AdministrativeExists['DomainAdmins'] -eq $false) {
-                        $Principal = $ADAdministrativeGroups[$GPOPermission.DomainName]['DomainAdmins']
-                        Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal)"
-                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
-                        $GPOPermissions[0].GPOSecurity.Add($AddPermission)
-                        $GPOPermissions[0].GPOObject.SetSecurityInfo( $GPOPermissions[0].GPOSecurity)
+    }
+    if (-not $GPOPermissions) {
+        # This is bad - things went wrong
+        Write-Warning "Add-GPOZaurrPermission - Couldn't get permissions for GPO. Things aren't what they should be. Skipping!"
+    } else {
+        $GPO = $GPOPermissions[0]
+        if ($GPOPermissions.GPOSecurityPermissionItem) {
+            # We asked, we got response, now we need to check if maybe we're missing one of the two administrative groups
+            if ($Type -eq 'Administrative') {
+                # this is a case where something was returned. Be it Domain Admins or Enterprise Admins or both. But we still need to check because it may have been Domain Admins from other domain or just one of the two required groups
+                if ($AdministrativeExists['DomainAdmins'] -eq $false) {
+                    $Principal = $ADAdministrativeGroups[$GPO.DomainName]['DomainAdmins']
+                    Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                    if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                        try {
+                            $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                            $GPO.GPOSecurity.Add($AddPermission)
+                            $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                        } catch {
+                            Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                        }
                     }
-                    if ($AdministrativeExists['EnterpriseAdmins'] -eq $false) {
-                        $Principal = $ADAdministrativeGroups[$ForestInformation.RootDomain]['EnterpriseAdmins']
-                        Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal)"
-                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
-                        $GPOPermissions[0].GPOSecurity.Add($AddPermission)
-                        $GPOPermissions[0].GPOObject.SetSecurityInfo( $GPOPermissions[0].GPOSecurity)
+                }
+                if ($AdministrativeExists['EnterpriseAdmins'] -eq $false) {
+                    $Principal = $ADAdministrativeGroups[$ForestInformation.Forest.RootDomain]['EnterpriseAdmins']
+                    Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                    if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                        try {
+                            $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                            $GPO.GPOSecurity.Add($AddPermission)
+                            $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                        } catch {
+                            Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                        }
                     }
-                } elseif ($Type -eq 'Default') {
+                }
+            } elseif ($Type -eq 'Default') {
+                # This shouldn't really happen, as if we got response, and it didn't exists it wouldn't be here
+                Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType skipped for $($Principal). This shouldn't even happen!"
+            }
+        } else {
+            # We got no response. That means we either asked incorrectly or we need to fix permission. Trying to do so
+            if ($Type -eq 'Default') {
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
                     try {
                         Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal)"
                         $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
-                        $GPOPermissions[0].GPOSecurity.Add($AddPermission)
-                        $GPOPermissions[0].GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
                     } catch {
                         Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
                     }
                 }
-
-                <#
-            [Microsoft.GroupPolicy.GPPermission]::new
-
-            OverloadDefinitions
-            -------------------
-            Microsoft.GroupPolicy.GPPermission new(string trustee, Microsoft.GroupPolicy.GPPermissionType rights, bool inheritable)
-            Microsoft.GroupPolicy.GPPermission new(System.Security.Principal.IdentityReference identity, Microsoft.GroupPolicy.GPPermissionType rights, bool inheritable)
-
-            #>
+            } elseif ($Type -eq 'Administrative') {
+                # this is a case where both Domain Admins/Enterprise Admins were missing
+                $Principal = $ADAdministrativeGroups[$GPO.DomainName]['DomainAdmins']
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+                $Principal = $ADAdministrativeGroups[$ForestInformation.Forest.RootDomain]['EnterpriseAdmins']
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'WellKnownAdministrative') {
+                $Principal = 'S-1-5-18'
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal (SYSTEM) / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) (SYSTEM) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'AuthenticatedUsers') {
+                $Principal = 'S-1-5-11'
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal (Authenticated Users) / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) (Authenticated Users) with error: $($_.Exception.Message)"
+                    }
+                }
             }
-        } else {
-            Write-Warning "Add-GPOZaurrPermission - GPO $($GPOPermissions[0].GPOName) has no permissions. Weird."
         }
-    }
-
-    End {
 
     }
 }

Public/Get-GPOZaurrAD.ps1

@@ -48,50 +48,26 @@
                     Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
                 }
             }
-            Get-ADObject @Splat -Properties DisplayName, Name, Created, Modified, gPCFileSysPath, gPCFunctionalityVersion, gPCWQLFilter, gPCMachineExtensionNames, Description, CanonicalName, DistinguishedName | ForEach-Object -Process { #, Deleted -IncludeDeletedObjects
-                #if ($_) {
+            Get-ADObject @Splat -Properties DisplayName, Name, Created, Modified, gPCFileSysPath, gPCFunctionalityVersion, gPCWQLFilter, gPCMachineExtensionNames, Description, CanonicalName, DistinguishedName | ForEach-Object -Process {
                 $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDomainCN
-                $Output = [ordered]@{ }
-                <#
-                $Search = -join ($DomainCN, $Output['Guid'])
-                if ($GPOCache -and -not $Limited) {
-                    $Output['DisplayName'] = $GPOCache[$Search].DisplayName
-                    $Output['DomainName'] = $GPOCache[$Search].DomainName
-                    $Output['Owner'] = $GPOCache[$Search].Owner
-                    $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
-                    $Output['Description'] = $GPOCache[$Search].Description
-                    $Output['CreationTime'] = $GPOCache[$Search].CreationTime
-                    $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                $GUID = $_.Name -replace '{' -replace '}'
+                if (($GUID).Length -ne 36) {
+                    Write-Warning "Get-GPOZaurrAD - GPO GUID ($($($GUID -join ' '))) is incorrect. Skipping $($_.DisplayName) / Domain: $($DomainCN)"
+                } else {
+                    $Output = [ordered]@{ }
+                    $Output['DisplayName'] = $_.DisplayName
+                    $Output['DomainName'] = $DomainCN
+                    $Output['Description'] = $_.Description
+                    $Output['GUID'] = $GUID
+                    $Output['Path'] = $_.gPCFileSysPath
+                    $Output['FunctionalityVersion'] = $_.gPCFunctionalityVersion
+                    $Output['Created'] = $_.Created
+                    $Output['Modified'] = $_.Modified
+                    $Output['GPOCanonicalName'] = $_.CanonicalName
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDC
+                    $Output['GPODistinguishedName'] = $_.DistinguishedName
+                    [PSCustomObject] $Output
                 }
-                #>
-                $Output['DisplayName'] = $_.DisplayName
-                $Output['DomainName'] = $DomainCN
-                $Output['Description'] = $_.Description
-                $Output['GUID'] = $_.Name -replace '{' -replace '}'
-                $Output['Path'] = $_.gPCFileSysPath
-                $Output['FunctionalityVersion'] = $_.gPCFunctionalityVersion
-                $Output['Created'] = $_.Created
-                $Output['Modified'] = $_.Modified
-                $Output['GPOCanonicalName'] = $_.CanonicalName
-                $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDC
-                $Output['GPODistinguishedName'] = $_.DistinguishedName
-                [PSCustomObject] $Output
-
-                <#
-                    CanonicalName            : ad.evotec.xyz/System/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}
-                    Created                  : 20.05.2018 09:55:29
-                    Description              :
-                    DisplayName              : Default Domain Policy
-                    DistinguishedName        : CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=ad,DC=evotec,DC=xyz
-                    gPCFileSysPath           : \\ad.evotec.xyz\sysvol\ad.evotec.xyz\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
-                    gPCFunctionalityVersion  : 2
-                    gPCMachineExtensionNames : [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}]
-                    Modified                 : 26.04.2020 18:53:56
-                    Name                     : {31B2F340-016D-11D2-945F-00C04FB984F9}
-                    ObjectClass              : groupPolicyContainer
-                    ObjectGUID               : 679a6dd9-30fb-438c-a35f-e5fe8167703e
-                    #>
-                #}
             }
         }
     }

Public/Get-GPOZaurrConsistency.ps1

@@ -1,130 +0,0 @@
-function Get-GPOZaurrPermissionConsistency {
-    [cmdletBinding()]
-    param(
-        [Parameter(ParameterSetName = 'GPOName')]
-        [string] $GPOName,
-
-        [Parameter(ParameterSetName = 'GPOGUID')]
-        [alias('GUID', 'GPOID')][string] $GPOGuid,
-
-        [Parameter(ParameterSetName = 'Type')][validateSet('Consistent', 'Inconsistent', 'All')][string[]] $Type = 'All',
-
-        [alias('ForestName')][string] $Forest,
-        [string[]] $ExcludeDomains,
-        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
-        [System.Collections.IDictionary] $ExtendedForestInformation,
-
-        [switch] $IncludeGPOObject
-    )
-    Begin {
-        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-    }
-    Process {
-        foreach ($Domain in $ForestInformation.Domains) {
-            $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
-            if ($GPOName) {
-                Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
-                    try {
-                        $IsConsistent = $_.IsAclConsistent()
-                        $ErrorMessage = ''
-                    } catch {
-                        $ErrorMessage = $_.Exception.Message
-                        Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
-                        $IsConsistent = 'Not available.'
-                    }
-                    $Object = @{
-                        DisplayName      = $_.DisplayName     # : New Group Policy Object
-                        DomainName       = $_.DomainName      # : ad.evotec.xyz
-                        ACLConsistent    = $IsConsistent
-                        Owner            = $_.Owner           # : EVOTEC\Enterprise Admins
-                        Id               = $_.Id              # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
-                        GpoStatus        = $_.GpoStatus       # : AllSettingsEnabled
-                        Description      = $_.Description     # :
-                        CreationTime     = $_.CreationTime    # : 04.03.2020 17:19:42
-                        ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36
-                        UserVersion      = $_.UserVersion     # : AD Version: 0, SysVol Version: 0
-                        ComputerVersion  = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
-                        WmiFilter        = $_.WmiFilter       # :
-                        Error            = $ErrorMessage
-                    }
-                    if ($IncludeGPOObject) {
-                        $Object['IncludeGPOObject'] = $_
-                    }
-                    [PSCustomObject] $Object
-                }
-            } elseif ($GPOGuid) {
-                Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
-                    try {
-                        $IsConsistent = $_.IsAclConsistent()
-                        $ErrorMessage = ''
-                    } catch {
-                        $ErrorMessage = $_.Exception.Message
-                        Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
-                        $IsConsistent = 'Not available.'
-                    }
-                    $Object = @{
-                        DisplayName      = $_.DisplayName     # : New Group Policy Object
-                        DomainName       = $_.DomainName      # : ad.evotec.xyz
-                        ACLConsistent    = $IsConsistent
-                        Owner            = $_.Owner           # : EVOTEC\Enterprise Admins
-                        Id               = $_.Id              # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
-                        GpoStatus        = $_.GpoStatus       # : AllSettingsEnabled
-                        Description      = $_.Description     # :
-                        CreationTime     = $_.CreationTime    # : 04.03.2020 17:19:42
-                        ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36
-                        UserVersion      = $_.UserVersion     # : AD Version: 0, SysVol Version: 0
-                        ComputerVersion  = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
-                        WmiFilter        = $_.WmiFilter       # :
-                        Error            = $ErrorMessage
-                    }
-                    if ($IncludeGPOObject) {
-                        $Object['IncludeGPOObject'] = $_
-                    }
-                    [PSCustomObject] $Object
-                }
-            } else {
-                Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
-                    try {
-                        $IsConsistent = $_.IsAclConsistent()
-                        $ErrorMessage = ''
-                    } catch {
-                        $ErrorMessage = $_.Exception.Message
-                        Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
-                        $IsConsistent = 'Not available.'
-                    }
-                    if ($Type -eq 'Consistent') {
-                        if (-not $IsConsistent) {
-                            return
-                        }
-                    } elseif ($Type -eq 'Inconsistent') {
-                        if ($IsConsistent -eq $true) {
-                            return
-                        }
-                    }
-                    $Object = @{
-                        DisplayName      = $_.DisplayName     # : New Group Policy Object
-                        DomainName       = $_.DomainName      # : ad.evotec.xyz
-                        ACLConsistent    = $IsConsistent
-                        Owner            = $_.Owner           # : EVOTEC\Enterprise Admins
-                        Id               = $_.Id              # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
-                        GpoStatus        = $_.GpoStatus       # : AllSettingsEnabled
-                        Description      = $_.Description     # :
-                        CreationTime     = $_.CreationTime    # : 04.03.2020 17:19:42
-                        ModificationTime = $_.ModificationTime# : 06.05.2020 10:30:36
-                        UserVersion      = $_.UserVersion     # : AD Version: 0, SysVol Version: 0
-                        ComputerVersion  = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
-                        WmiFilter        = $_.WmiFilter       # :
-                        Error            = $ErrorMessage
-                    }
-                    if ($IncludeGPOObject) {
-                        $Object['IncludeGPOObject'] = $_
-                    }
-                    [PSCustomObject] $Object
-                }
-            }
-        }
-    }
-    End {
-
-    }
-}

Public/Get-GPOZaurrFiles.ps1

@@ -0,0 +1,31 @@
+function Get-GPOZaurrFiles {
+    [cmdletbinding()]
+    param(
+        [ValidateSet('All', 'Netlogon', 'Sysvol')][string[]] $Type = 'All',
+        [ValidateSet('None', 'MACTripleDES', 'MD5', 'RIPEMD160', 'SHA1', 'SHA256', 'SHA384', 'SHA512')][string] $HashAlgorithm = 'None',
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        $Path = @(
+            if ($Type -contains 'All') {
+                "\\$Domain\SYSVOL\$Domain"
+            }
+            if ($Type -contains 'Sysvol') {
+                "\\$Domain\SYSVOL\$Domain\policies"
+            }
+            if ($Type -contains 'NetLogon') {
+                "\\$Domain\NETLOGON"
+            }
+        )
+        Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File | ForEach-Object {
+            Get-FileMetaData -File $_ -Signature -HashAlgorithm $HashAlgorithm
+        }
+        foreach ($e in $err) {
+            Write-Warning "Get-GPOZaurrFiles - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
+        }
+    }
+}

Public/Get-GPOZaurrLegacyFiles.ps1

@@ -0,0 +1,16 @@
+function Get-GPOZaurrLegacyFiles {
+    [cmdletbinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies" -ErrorAction SilentlyContinue -Recurse -Include '*.adm' -ErrorVariable err | Select-Object Name, FullName, CreationTime, LastWriteTime, Attributes
+        foreach ($e in $err) {
+            Write-Warning "Get-GPOZaurrLegacy - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
+        }
+    }
+}

Public/Get-GPOZaurrLink.ps1

@@ -7,13 +7,18 @@
         [parameter(ParameterSetName = 'Filter')][string] $SearchBase,
         [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
 
-        [parameter(ParameterSetName = 'Linked',Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
+        [parameter(ParameterSetName = 'Linked', Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
 
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
         [switch] $Limited,
 
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [switch] $SkipDuplicates,
+
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
@@ -40,10 +45,13 @@
         [System.Collections.IDictionary] $ExtendedForestInformation
     )
     Begin {
+        $CacheReturnedGPOs = [ordered] @{}
         $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         if (-not $GPOCache -and -not $Limited) {
             $GPOCache = @{ }
-            foreach ($Domain in $ForestInformation.Domains) {
+            # While initially we used $ForestInformation.Domains but the thing is GPOs can be linked to other domains so we need to get them all so we can use cache of it later on even if we're processing just one domain
+            # That's why we use $ForestInformation.Forest.Domains instead
+            foreach ($Domain in $ForestInformation.Forest.Domains) {
                 $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
                 Get-GPO -All -DomainName $Domain -Server $QueryServer | ForEach-Object {
                     $GPOCache["$Domain$($_.ID.Guid)"] = $_
@@ -58,7 +66,7 @@
                     $Splat = @{
                         #Filter     = $Filter
                         Properties = 'distinguishedName', 'gplink', 'CanonicalName'
-                       # Filter     = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')"
+                        # Filter     = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')"
                         Server     = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
                     }
                     if ($Linked -contains 'DomainControllers') {
@@ -69,8 +77,24 @@
                         #}
                         $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
                         $Splat['SearchBase'] = $SearchBase
-                        Get-ADObject @Splat | ForEach-Object -Process {
-                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
+                            $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            foreach ($OutputGPO in $OutputGPOs) {
+                                if (-not $SkipDuplicates) {
+                                    $OutputGPO
+                                } else {
+                                    $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                    if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                        $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                        $OutputGPO
+                                    }
+                                }
+                            }
                         }
                     }
                     if ($Linked -contains 'Root') {
@@ -81,8 +105,24 @@
                         # }
                         $Splat['Filter'] = "objectClass -eq 'domainDNS'"
                         $Splat['SearchBase'] = $SearchBase
-                        Get-ADObject @Splat | ForEach-Object -Process {
-                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
+                            $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            foreach ($OutputGPO in $OutputGPOs) {
+                                if (-not $SkipDuplicates) {
+                                    $OutputGPO
+                                } else {
+                                    $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                    if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                        $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                        $OutputGPO
+                                    }
+                                }
+                            }
                         }
                     }
                     if ($Linked -contains 'Site') {
@@ -95,7 +135,12 @@
                             #}
                             $Splat['Filter'] = "(objectClass -eq 'site')"
                             $Splat['SearchBase'] = $SearchBase
-                            Get-ADObject @Splat | ForEach-Object -Process {
+                            try {
+                                $ADObjectGPO = Get-ADObject @Splat
+                            } catch {
+                                Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                            }
+                            foreach ($_ in $ADObjectGPO) {
                                 Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
                             }
                         }
@@ -103,18 +148,34 @@
                     if ($Linked -contains 'Other') {
                         $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
                         #if ($SearchBase -notlike "*$DomainDistinguishedName") {
-                            # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                        # we check if SearchBase is part of domain distinugishname. If it isn't we skip
                         #    continue
                         #}
                         $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
                         $Splat['SearchBase'] = $SearchBase
-                        Get-ADObject @Splat | ForEach-Object -Process {
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
                             if ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) {
                                 # other skips Domain Root
                             } elseif ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']) {
                                 # other skips Domain Controllers
                             } else {
-                                Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                                $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                                foreach ($OutputGPO in $OutputGPOs) {
+                                    if (-not $SkipDuplicates) {
+                                        $OutputGPO
+                                    } else {
+                                        $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                        if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                            $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                            $OutputGPO
+                                        }
+                                    }
+                                }
                             }
                         }
                     }
@@ -125,10 +186,12 @@
                         Filter     = $Filter
                         Properties = 'distinguishedName', 'gplink', 'CanonicalName'
                         Server     = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+
                     }
                     if ($PSBoundParameters.ContainsKey('SearchBase')) {
                         $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
-                        if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                        $SearchBaseDC = ConvertFrom-DistinguishedName -DistinguishedName $SearchBase -ToDC
+                        if ($SearchBaseDC -ne $DomainDistinguishedName) {
                             # we check if SearchBase is part of domain distinugishname. If it isn't we skip
                             continue
                         }
@@ -139,8 +202,24 @@
                         $Splat['SearchScope'] = $SearchScope
                     }
 
-                    Get-ADObject @Splat | ForEach-Object {
-                        Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                    try {
+                        $ADObjectGPO = Get-ADObject @Splat
+                    } catch {
+                        Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                    }
+                    foreach ($_ in $ADObjectGPO) {
+                        $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        foreach ($OutputGPO in $OutputGPOs) {
+                            if (-not $SkipDuplicates) {
+                                $OutputGPO
+                            } else {
+                                $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                    $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                    $OutputGPO
+                                }
+                            }
+                        }
                     }
                 }
             }

Public/Get-GPOZaurrLinkSummary.ps1

@@ -0,0 +1,164 @@
+function Get-GPOZaurrLinkSummary {
+    [cmdletBinding()]
+    param(
+        [ValidateSet('All', 'MultipleLinks', 'OneLink', 'LinksSummary')][string[]] $Report = 'All',
+        [switch] $UnlimitedProperties,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $HighestCount = 0 # to keep number of depth
+    $CacheSummaryLinks = [ordered] @{} # cache
+
+    # Get all links
+    $Links = Get-GPOZaurrLink -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Link in $Links) {
+        if (-not $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"]) {
+            $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"] = [System.Collections.Generic.List[System.Object]]::new()
+        }
+        $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"].Add($Link)
+    }
+
+    $ReturnObject = [ordered] @{
+        MultipleLinks = [System.Collections.Generic.List[System.Object]]::new()
+        OneLink       = [System.Collections.Generic.List[System.Object]]::new()
+        LinksSummary  = [System.Collections.Generic.List[System.Object]]::new()
+    }
+
+    foreach ($Key in $CacheSummaryLinks.Keys) {
+        $GPOs = $CacheSummaryLinks[$Key]
+
+        [Array] $LinkingSummary = foreach ($GPO in $GPOs) {
+            $SplitttedOU = ($GPO.DistinguishedName -split ',')
+            [Array] $Clean = foreach ($_ in $SplitttedOU) {
+                if ($_ -notlike 'DC=*') { $_ -replace 'OU=' }
+            }
+            if ($Clean.Count -gt $HighestCount) {
+                $HighestCount = $Clean.Count
+            }
+            if ($Clean) {
+                $Test = [ordered] @{
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = ConvertFrom-DistinguishedName -DistinguishedName $GPO.DistinguishedName -ToDomainCN
+                }
+                for ($i = 1; $i -le 10; $i++) {
+                    $Test["Level$i"] = $Clean[ - $i]
+                }
+                [PSCustomobject] $Test
+            } else {
+                $Test = [ordered] @{
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = $GPO.CanonicalName
+                }
+                for ($i = 1; $i -le 10; $i++) {
+                    $Test["Level$i"] = $null
+                }
+                [PSCustomobject] $Test
+            }
+        }
+        if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') {
+            foreach ($Link in $LinkingSummary) {
+                $ReturnObject.MultipleLinks.Add($Link)
+            }
+            #continue
+        }
+        if ($Report -eq 'OneLink' -or $Report -contains 'All') {
+            $List = [ordered] @{
+                DisplayName = $GPOs[0].DisplayName
+                Guid        = $GPOs[0].Guid
+                DomainName  = $GPOs[0].DomainName
+                LinksCount  = $GPOs.Count
+            }
+            for ($i = 0; $i -le 10; $i++) {
+                $List["Level$i"] = ($LinkingSummary."Level$i" | Select-Object -Unique).Count
+                $List["Level$($i)List"] = ($LinkingSummary."Level$i" | Select-Object -Unique)
+            }
+            $List.LinksDistinguishedName = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
+            $List.LinksCanonicalName = $GPOs.CanonicalName
+
+            $List.Owner = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
+            $List.GpoStatus = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
+            $List.Description = $GPOs[0].Description                #:
+            $List.CreationTime = $GPOs[0].CreationTime               #: 16.12.2019 21:25:32
+            $List.ModificationTime = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
+            $List.GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
+            $List.GPODistinguishedName = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
+
+            $ReturnObject.OneLink.Add( [PSCustomObject] $List)
+        }
+        if ($Report -eq 'LinksSummary' -or $Report -contains 'All') {
+            $Output = [PSCustomObject] @{
+                DisplayName                = $GPOs[0].DisplayName                #: COMPUTERS | LAPS
+                Guid                       = $GPOs[0].Guid                       #: AA782787 - 002B-4B8C-886F-05873F2DC0CA
+                DomainName                 = $GPOs[0].DomainName                 #: ad.evotec.xyz
+                LinksCount                 = $GPOs.Count
+                LinksDistinguishedName     = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
+                LinksCanonicalName         = $GPOs.CanonicalName              #: ad.evotec.xyz / ITR02 / Computers
+                Owner                      = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
+                GpoStatus                  = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
+                Description                = $GPOs[0].Description                #:
+                CreationTime               = $GPOs[0].CreationTime               #: 16.12.2019 21:25:32
+                ModificationTime           = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
+                GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
+                GPODistinguishedName       = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
+            }
+            $ReturnObject.LinksSummary.Add($Output)
+        }
+    }
+    # Processing output
+    if (-not $UnlimitedProperties) {
+        if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') {
+            $Properties = @(
+                'DisplayName'
+                'DomainName'
+                'GUID'
+                for ($i = 0; $i -le $HighestCount; $i++) {
+                    "Level$i"
+                }
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
+            )
+            $ReturnObject.MultipleLinks = $ReturnObject.MultipleLinks | Select-Object -Property $Properties
+        }
+        if ($Report -contains 'OneLink' -or $Report -contains 'All') {
+            $Properties = @(
+                'DisplayName'
+                'DomainName'
+                'GUID'
+                for ($i = 0; $i -le $HighestCount; $i++) {
+                    "Level$i"
+                    "Level$($i)List"
+                }
+                'LinksDistinguishedName'
+                'LinksCanonicalName'
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
+            )
+            $ReturnObject.OneLink = $ReturnObject.OneLink | Select-Object -Property $Properties
+        }
+        #if ($Report -contains 'LinksSummary' -or $Report -contains 'All') {
+        # Not needed because there's no dynamic properties, but if there would be we need to uncomment and fix it
+        #}
+    }
+    if ($Report.Count -eq 1 -and $Report -notcontains 'All') {
+        $ReturnObject["$Report"]
+    } else {
+        $ReturnObject
+    }
+}

Public/Get-GPOZaurrOwner.ps1

@@ -30,17 +30,17 @@
         } elseif ($GPOGuid) {
             $getGPOZaurrADSplat['GPOGUID'] = $GPOGuid
         }
-        Get-GPOZaurrAD @getGPOZaurrADSplat | ForEach-Object -Process {
+        $Objects = Get-GPOZaurrAD @getGPOZaurrADSplat
+        foreach ($_ in $Objects) {
             Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)"
             $ACL = Get-ADACLOwner -ADObject $_.GPODistinguishedName -Resolve -ADAdministrativeGroups $ADAdministrativeGroups
             $Object = [ordered] @{
-                DisplayName       = $_.DisplayName
-                DomainName        = $_.DomainName
-                GUID              = $_.GUID
-                DistinguishedName = $_.GPODistinguishedName
-                Owner             = $ACL.OwnerName
-                OwnerSid          = $ACL.OwnerSid
-                OwnerType         = $ACL.OwnerType
+                DisplayName = $_.DisplayName
+                DomainName  = $_.DomainName
+                GUID        = $_.GUID
+                Owner       = $ACL.OwnerName
+                OwnerSid    = $ACL.OwnerSid
+                OwnerType   = $ACL.OwnerType
             }
             if ($IncludeSysvol) {
                 $FileOwner = Get-FileOwner -JustPath -Path $_.Path -Resolve
@@ -48,7 +48,9 @@
                 $Object['SysvolSid'] = $FileOwner.OwnerSid
                 $Object['SysvolType'] = $FileOwner.OwnerType
                 $Object['SysvolPath'] = $_.Path
+                $Object['IsOwnerConsistent'] = if ($ACL.OwnerName -eq $FileOwner.OwnerName) { $true } else { $false }
             }
+            $Object['DistinguishedName'] = $_.GPODistinguishedName
             [PSCUstomObject] $Object
         }
     }

Public/Get-GPOZaurrPermission.ps1

@@ -10,7 +10,7 @@
         [string[]] $Principal,
         [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
 
-        [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All',
+        [validateSet('AuthenticatedUsers', 'DomainComputers', 'Unknown', 'WellKnownAdministrative', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All',
 
         [switch] $SkipWellKnown,
         [switch] $SkipAdministrative,
@@ -19,16 +19,25 @@
         [switch] $IncludeOwner,
         [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
         [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid',
+
         [switch] $IncludeGPOObject,
 
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
-        [System.Collections.IDictionary] $ExtendedForestInformation
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [System.Collections.IDictionary] $ADAdministrativeGroups,
+        [switch] $ReturnSecurityWhenNoData # if no data return all data
     )
     Begin {
-        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Extended
+        if (-not $ADAdministrativeGroups) {
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
         if ($Type -eq 'Unknown') {
             if ($SkipAdministrative -or $SkipWellKnown) {
                 Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
@@ -62,6 +71,7 @@
                     Server      = $QueryServer
                     ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / Name: $GPOName) with:"
             } elseif ($GPOGuid) {
                 $getGPOSplat = @{
                     Guid        = $GPOGuid
@@ -69,6 +79,7 @@
                     Server      = $QueryServer
                     ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / GUID: $GPOGuid) with:"
             } else {
                 $getGPOSplat = @{
                     All         = $true
@@ -76,23 +87,58 @@
                     Server      = $QueryServer
                     ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / All: $True) with:"
             }
-            Get-GPO @getGPOSplat | ForEach-Object -Process {
-                $getPrivPermissionSplat = @{
-                    Principal              = $Principal
-                    PrincipalType          = $PrincipalType
-                    Accounts               = $Accounts
-                    Type                   = $Type
-                    GPO                    = $_
-                    SkipWellKnown          = $SkipWellKnown.IsPresent
-                    SkipAdministrative     = $SkipAdministrative.IsPresent
-                    IncludeOwner           = $IncludeOwner.IsPresent
-                    IncludeGPOObject       = $IncludeGPOObject.IsPresent
-                    IncludePermissionType  = $IncludePermissionType
-                    ExcludePermissionType  = $ExcludePermissionType
-                    ADAdministrativeGroups = $ADAdministrativeGroups
+            Try {
+                Get-GPO @getGPOSplat | ForEach-Object -Process {
+                    $GPOSecurity = $_.GetSecurityInfo()
+                    $getPrivPermissionSplat = @{
+                        Principal                 = $Principal
+                        PrincipalType             = $PrincipalType
+                        PermitType                = $PermitType
+                        Accounts                  = $Accounts
+                        Type                      = $Type
+                        GPO                       = $_
+                        SkipWellKnown             = $SkipWellKnown.IsPresent
+                        SkipAdministrative        = $SkipAdministrative.IsPresent
+                        IncludeOwner              = $IncludeOwner.IsPresent
+                        IncludeGPOObject          = $IncludeGPOObject.IsPresent
+                        IncludePermissionType     = $IncludePermissionType
+                        ExcludePermissionType     = $ExcludePermissionType
+                        ExcludePrincipal          = $ExcludePrincipal
+                        ExcludePrincipalType      = $ExcludePrincipalType
+                        ADAdministrativeGroups    = $ADAdministrativeGroups
+                        ExtendedForestInformation = $ForestInformation
+                        SecurityRights            = $GPOSecurity
+                    }
+                    try {
+                        $Output = Get-PrivPermission @getPrivPermissionSplat
+                    } catch {
+                        $Output = $null
+                        Write-Warning "Get-GPOZaurrPermission - Error running Get-PrivPermission: $($_.Exception.Message)"
+                    }
+                    if (-not $Output) {
+                        if ($ReturnSecurityWhenNoData) {
+                            # there is no data to return, but we need to have GPO information to process ADD permissions.
+                            $ReturnObject = [PSCustomObject] @{
+                                DisplayName      = $_.DisplayName #      : ALL | Enable RDP
+                                GUID             = $_.ID
+                                DomainName       = $_.DomainName  #      : ad.evotec.xyz
+                                Enabled          = $_.GpoStatus
+                                Description      = $_.Description
+                                CreationDate     = $_.CreationTime
+                                ModificationTime = $_.ModificationTime
+                                GPOObject        = $_
+                                GPOSecurity      = $GPOSecurity
+                            }
+                            $ReturnObject
+                        }
+                    } else {
+                        $Output
+                    }
                 }
-                Get-PrivPermission @getPrivPermissionSplat
+            } catch {
+                Write-Warning "Get-GPOZaurrPermission - $TextForError $($_.Exception.Message)"
             }
         }
     }

Public/Get-GPOZaurrPermissionConsistency.ps1

@@ -0,0 +1,122 @@
+function Get-GPOZaurrPermissionConsistency {
+    [cmdletBinding(DefaultParameterSetName = 'Type')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+        [Parameter(ParameterSetName = 'Type')][validateSet('Consistent', 'Inconsistent', 'All')][string[]] $Type = 'All',
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [switch] $IncludeGPOObject,
+        [switch] $VerifyInheritance
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    }
+    Process {
+        foreach ($Domain in $ForestInformation.Domains) {
+            $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+            if ($GPOName) {
+                $getGPOSplat = @{
+                    Name        = $GPOName
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } elseif ($GPOGuid) {
+                $getGPOSplat = @{
+                    Guid        = $GPOGuid
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } else {
+                $getGPOSplat = @{
+                    All         = $true
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            }
+            Get-GPO @getGPOSplat | ForEach-Object -Process {
+                try {
+                    $IsConsistent = $_.IsAclConsistent()
+                    $ErrorMessage = ''
+                } catch {
+                    $ErrorMessage = $_.Exception.Message
+                    Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
+                    $IsConsistent = 'Not available.'
+                }
+                $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
+                if ($VerifyInheritance) {
+                    $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath
+                    [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) {
+                        if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) {
+                            $File
+                        }
+                    }
+                    if ($NotInheritedPermissions.Count -eq 0) {
+                        $ACLConsistentInside = $true
+                    } else {
+                        $ACLConsistentInside = $false
+                    }
+                } else {
+                    $ACLConsistentInside = $null
+                }
+                $Object = [ordered] @{
+                    DisplayName   = $_.DisplayName     # : New Group Policy Object
+                    DomainName    = $_.DomainName      # : ad.evotec.xyz
+                    ACLConsistent = $IsConsistent
+                }
+                if ($VerifyInheritance) {
+                    $Object['ACLConsistentInside'] = $ACLConsistentInside
+                }
+                $Object['Owner'] = $_.Owner           # : EVOTEC\Enterprise Admins
+                $Object['Path'] = $_.Path
+                $Object['SysVolPath '] = $SysvolPath
+                $Object['Id       '] = $_.Id              # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
+                $Object['GpoStatus'] = $_.GpoStatus       # : AllSettingsEnabled
+                $Object['Description'] = $_.Description     # :
+                $Object['CreationTime'] = $_.CreationTime    # : 04.03.2020 17:19:42
+                $Object['ModificationTime'] = $_.ModificationTime# : 06.05.2020 10:30:36
+                $Object['UserVersion'] = $_.UserVersion     # : AD Version: 0, SysVol Version: 0
+                $Object['ComputerVersion'] = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
+                $Object['WmiFilter'] = $_.WmiFilter       # :
+                $Object['Error'] = $ErrorMessage
+                if ($IncludeGPOObject) {
+                    $Object['IncludeGPOObject'] = $_
+                }
+                if ($VerifyInheritance) {
+                    $Object['ACLConsistentInsideDetails'] = $NotInheritedPermissions
+                }
+                if ($Type -eq 'All') {
+                    [PSCustomObject] $Object
+                } elseif ($Type -eq 'Inconsistent') {
+                    if ($VerifyInheritance) {
+                        if (-not $IsConsistent -or -not $ACLConsistentInside) {
+                            [PSCustomObject] $Object
+                        }
+                    } else {
+                        if (-not $IsConsistent) {
+                            [PSCustomObject] $Object
+                        }
+                    }
+                } elseif ($Type -eq 'Consistent') {
+                    if ($VerifyInheritance) {
+                        if ($IsConsistent -and $ACLConsistentInside) {
+                            [PSCustomObject] $Object
+                        }
+                    } else {
+                        if ($IsConsistent) {
+                            [PSCustomObject] $Object
+                        }
+                    }
+                }
+            }
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrSysvol.ps1

@@ -0,0 +1,37 @@
+function Get-GPOZaurrSysvol {
+    [cmdletBinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [string[]] $ExcludeDomainControllers,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [alias('DomainControllers')][string[]] $IncludeDomainControllers,
+        [switch] $SkipRODC,
+        [Array] $GPOs,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [switch] $VerifyDomainControllers
+    )
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExcludeDomainControllers $ExcludeDomainControllers -IncludeDomainControllers $IncludeDomainControllers -SkipRODC:$SkipRODC -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        Write-Verbose "Get-WinADGPOSysvolFolders - Processing $Domain"
+        $QueryServer = $ForestInformation['QueryServers']["$Domain"].HostName[0]
+        Try {
+            [Array]$GPOs = Get-GPO -All -Domain $Domain -Server $QueryServer
+        } catch {
+            Write-Warning "Get-GPOZaurrSysvol - Couldn't get GPOs from $Domain. Error: $($_.Exception.Message)"
+            continue
+        }
+        if ($GPOs.Count -ge 2) {
+            if (-not $VerifyDomainControllers) {
+                Test-SysVolFolders -GPOs $GPOs -Server $Domain -Domain $Domain
+            } else {
+                foreach ($Server in $ForestInformation['DomainDomainControllers']["$Domain"]) {
+                    Write-Verbose "Get-GPOZaurrSysvol - Processing $Domain \ $($Server.HostName.Trim())"
+                    Test-SysVolFolders -GPOs $GPOs -Server $Server.Hostname -Domain $Domain
+                }
+            }
+        } else {
+            Write-Warning "Get-GPOZaurrSysvol - GPO count for $Domain is less then 2. This is not expected for fully functioning domain. Skipping processing SYSVOL folder."
+        }
+    }
+}

Public/Get-GPOZaurrWmi.ps1

@@ -1,4 +1,11 @@
-function Get-GPOZaurrWMI {
+function Get-WMIFilter {
+    param(
+
+    )
+
+}
+
+function Get-GPOZaurrWMI {
     [cmdletBinding()]
     Param(
         [Guid[]] $Guid,
@@ -13,79 +20,63 @@
     $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
     foreach ($Domain in $ForestInformation.Domains) {
         $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
-        if ($Guid -or $Name) {
-            foreach ($N in $Name) {
-                try {
-                    $ldapFilter = "(&(objectClass=msWMI-Som)(msWMI-Name=$N))"
-                    Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
-                        $WMI = $_.'msWMI-Parm2' -split ';'
-                        [PSCustomObject] @{
-                            DisplayName       = $_.'msWMI-Name'
-                            Description       = $_.'msWMI-Parm1'
-                            DomainName        = $Domain
-                            NameSpace         = $WMI[5]
-                            Query             = $WMI[6]
-                            Author            = $_.'msWMI-Author'
-                            ID                = $_.'msWMI-ID'
-                            Created           = $_.Created
-                            Modified          = $_.Modified
-                            ObjectGUID        = $_.'ObjectGUID'
-                            CanonicalName     = $_.CanonicalName
-                            DistinguishedName = $_.'DistinguishedName'
-                        }
+        $Objects = @(
+            if ($Name) {
+                foreach ($N in $Name) {
+                    try {
+                        $ldapFilter = "(&(objectClass=msWMI-Som)(msWMI-Name=$N))"
+                        Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer
+                    } catch {
+                        Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
                     }
+                }
+            } elseif ($GUID) {
+                foreach ($G in $GUID) {
+                    try {
+                        $ldapFilter = "(&(objectClass=msWMI-Som)(Name={$G}))"
+                        Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer
+                    } catch {
+                        Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
+                    }
+                }
+            } else {
+                try {
+                    $ldapFilter = "(objectClass=msWMI-Som)"
+                    Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer
                 } catch {
                     Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
                 }
             }
-            foreach ($G in $GUID) {
-                $ldapFilter = "(&(objectClass=msWMI-Som)(Name={$G}))"
-                try {
-                    Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
-                        $WMI = $_.'msWMI-Parm2' -split ';'
-                        [PSCustomObject] @{
-                            DisplayName       = $_.'msWMI-Name'
-                            Description       = $_.'msWMI-Parm1'
-                            DomainName        = $Domain
-                            NameSpace         = $WMI[5]
-                            Query             = $WMI[6]
-                            Author            = $_.'msWMI-Author'
-                            ID                = $_.'msWMI-ID'
-                            Created           = $_.Created
-                            Modified          = $_.Modified
-                            ObjectGUID        = $_.'ObjectGUID'
-                            CanonicalName     = $_.CanonicalName
-                            DistinguishedName = $_.'DistinguishedName'
-                        }
-                    }
-                } catch {
-                    Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
+        )
+        foreach ($_ in $Objects) {
+            $WMI = $_.'msWMI-Parm2' -split ';' #$WMI = $_.'msWMI-Parm2'.Split(';',8)
+            [Array] $Data = for ($i = 0; $i -lt $WMI.length; $i += 6) {
+                if ($WMI[$i + 5]) {
+                    #[PSCustomObject] @{
+                    #    NameSpace = $WMI[$i + 5]
+                    #    Query     = $WMI[$i + 6]
+                    #}
+                    -join ($WMI[$i + 5], ';' , $WMI[$i + 6])
                 }
             }
-        } else {
-            $ldapFilter = "(objectClass=msWMI-Som)"
-            try {
-                Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
-                    $WMI = $_.'msWMI-Parm2' -split ';'
-                    [PSCustomObject] @{
-                        DisplayName       = $_.'msWMI-Name'
-                        Description       = $_.'msWMI-Parm1'
-                        DomainName        = $Domain
-                        NameSpace         = $WMI[5]
-                        Query             = $WMI[6]
-                        Author            = $_.'msWMI-Author'
-                        ID                = $_.'msWMI-ID'
-                        Created           = $_.Created
-                        Modified          = $_.Modified
-                        ObjectGUID        = $_.'ObjectGUID'
-                        CanonicalName     = $_.CanonicalName
-                        DistinguishedName = $_.'DistinguishedName'
-                    }
-                }
-            } catch {
-                Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
+            [PSCustomObject] @{
+                DisplayName       = $_.'msWMI-Name'
+                Description       = $_.'msWMI-Parm1'
+                DomainName        = $Domain
+                #NameSpace         = $WMI[$i + 5]
+                #Query             = $WMI[$i + 6]
+                QueryCount        = $Data.Count
+                Query             = $Data -join ","
+                Author            = $_.'msWMI-Author'
+                ID                = $_.'msWMI-ID'
+                Created           = $_.Created
+                Modified          = $_.Modified
+                ObjectGUID        = $_.'ObjectGUID'
+                CanonicalName     = $_.CanonicalName
+                DistinguishedName = $_.'DistinguishedName'
             }
         }
+
     }
 }
 <#

Public/Invoke-GPOZaurr.ps1

@@ -0,0 +1,180 @@
+function Invoke-GPOZaurr {
+    [alias('Find-GPO')]
+    [cmdletBinding(DefaultParameterSetName = 'Default')]
+    param(
+        [Parameter(ParameterSetName = 'Default')][alias('ForestName')][string] $Forest,
+        [Parameter(ParameterSetName = 'Default')][string[]] $ExcludeDomains,
+        [Parameter(ParameterSetName = 'Default')][alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [Parameter(ParameterSetName = 'Default')][System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [Parameter(ParameterSetName = 'Local')][string] $GPOPath,
+
+        [Parameter(ParameterSetName = 'Default')]
+        [Parameter(ParameterSetName = 'Local')]
+        [string[]] $Type,
+        [Parameter(ParameterSetName = 'Default')]
+        [Parameter(ParameterSetName = 'Local')]
+        [switch] $NoTranslation,
+
+        [Parameter(ParameterSetName = 'Default')]
+        [Parameter(ParameterSetName = 'Local')]
+        [string] $Splitter = [System.Environment]::NewLine,
+        [switch] $FullObjects,
+
+        [ValidateSet('HTML', 'Object')][string] $OutputType = 'Object'
+    )
+    if ($Type.Count -eq 0) {
+        $Type = $Script:GPODitionary.Keys
+    }
+    if ($GPOPath) {
+        if (Test-Path -LiteralPath $GPOPath) {
+            <#
+            $GPOListPath = [io.path]::Combine($GPOPath, "GPOList.xml")
+            if ($GPOListPath) {
+                $GPOs = Import-Clixml -Path $GPOListPath
+            } else {
+
+            }
+            #>
+            $GPOFiles = Get-ChildItem -LiteralPath $GPOPath -Recurse -File
+            [Array] $GPOs = foreach ($File in $GPOFiles) {
+                if ($File.Name -ne 'GPOList.xml') {
+                    [xml] $GPORead = Get-Content -LiteralPath $File.FullName
+                    [PSCustomObject] @{
+                        DisplayName = $GPORead.GPO.Name
+                        DomainName  = $GPORead.GPO.Identifier.Domain.'#text'
+                        GUID        = $GPORead.GPO.Identifier.Identifier.'#text' -replace '{' -replace '}'
+                        GPOOutput   = $GPORead
+                    }
+                }
+            }
+        } else {
+            Write-Warning "Find-GPO - $GPOPath doesn't exists."
+            return
+        }
+    } else {
+        [Array] $GPOs = Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    }
+    $Output = [ordered] @{}
+    foreach ($T in $Type) {
+        # $Output[$T] = [System.Collections.Generic.List[PSCustomObject]]::new()
+    }
+    foreach ($GPO in $GPOs) {
+        if ($GPOPath) {
+            $GPOOutput = $GPO.GPOOutput
+        } else {
+            [xml] $GPOOutput = Get-GPOReport -Guid $GPO.GUID -Domain $GPO.DomainName -ReportType Xml
+        }
+        <#
+        [PSCustomobject] @{
+            DisplayName      = $GPO.DisplayName
+            DomainName       = $GPO.DomainName
+            ComputerEnabled  = $GPOOutput.GPO.Computer.Enabled
+            ComputerEmpty    = if ($GPOOutput.GPO.Computer.ExtensionData) { $false } else { $true }
+            ComputerPolicies = $GPOOutput.GPO.Computer.ExtensionData.Name -join ", "
+            UserEnabled      = $GPOOutput.GPO.User.Enabled
+            UserEmpty        = if ($GPOOutput.GPO.User.ExtensionData) { $false } else { $true }
+            UserPolicies     = $GPOOutput.GPO.User.ExtensionData.Name -join ", "
+        }
+        #>
+
+
+        #$GPOStoredTypes = Get-XMLGPOTypes -GPOOutput $GPOOutput.GPO
+
+        [Array] $Data = Get-XMLStandard -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects
+        foreach ($D in $Data) {
+            if (-not $Output["$($D.GpoCategory)"]) {
+                $Output["$($D.GpoCategory)"] = [ordered] @{}
+            }
+            if (-not $Output["$($D.GpoCategory)"]["$($D.GpoSettings)"]) {
+                $Output["$($D.GpoCategory)"]["$($D.GpoSettings)"] = [System.Collections.Generic.List[PSCustomObject]]::new()
+            }
+            $Output["$($D.GpoCategory)"]["$($D.GpoSettings)"].Add($D)
+        }
+        <#
+        continue
+
+        if ($Type -contains 'RegistrySettings') {
+            [Array] $Data = Get-XMLRegistrySettings -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects
+            foreach ($D in $Data) {
+                $Output['RegistrySettings'].Add($D)
+            }
+        }
+        if ($Type -contains 'RegistryPolicies') {
+            [Array] $Data = Get-XMLRegistryPolicies -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects
+            foreach ($D in $Data) {
+                $Output['RegistryPolicies'].Add($D)
+            }
+        }
+        if ($Type -contains 'LocalUsersAndGroups') {
+            [Array] $Data = Get-XMLLocalUserGroups -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects
+            foreach ($D in $Data) {
+                $Output['LocalUsersAndGroups'].Add($D)
+            }
+        }
+        if ($Type -contains 'AutoLogon') {
+            [Array] $Data = Get-XMLAutologon -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects
+            foreach ($D in $Data) {
+                $Output['AutoLogon'].Add($D)
+            }
+        }
+        if ($Type -contains 'Scripts') {
+            [Array] $Data = Get-XMLScripts -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects
+            foreach ($D in $Data) {
+                $Output['Scripts'].Add($D)
+            }
+        }
+        if ($Type -contains 'SoftwareInstallation') {
+            [Array] $Data = Get-XMLSoftwareInstallation -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects
+            foreach ($D in $Data) {
+                $Output['SoftwareInstallation'].Add($D)
+            }
+        }
+        if ($Type -contains 'SecurityOptions') {
+            [Array] $Data = Get-XMLSecurityOptions -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects
+            foreach ($D in $Data) {
+                $Output['SecurityOptions'].Add($D)
+            }
+        }
+        if ($Type -contains 'Account') {
+            [Array] $Data = Get-XMLAccount -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects
+            foreach ($D in $Data) {
+                $Output['Account'].Add($D)
+            }
+        }
+        if ($Type -contains 'SystemServices') {
+            [Array] $Data = Get-XMLSystemServices -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects
+            foreach ($D in $Data) {
+                $Output['SystemServices'].Add($D)
+            }
+        }
+        #>
+    }
+    if ($NoTranslation) {
+        $Output
+    } else {
+        $TranslatedOutput = [ordered] @{}
+        foreach ($Report in $Type) {
+            $Category = $Script:GPODitionary[$Report]['Category']
+            $Settings = $Script:GPODitionary[$Report]['Settings']
+
+            #if (-not $TranslatedOutput[$Report]) {
+            #    $TranslatedOutput[$Report] = [ordered] @{}
+            #}
+            #foreach ($Setting in $Settings) {
+            #    if (-not $TranslatedOutput[$Category][$Settings]) {
+            #        $TranslatedOutput[$Category][$Settings] = [ordered] @{}
+            #    }
+            $TranslatedOutput[$Report] = Invoke-GPOTranslation -InputData $Output -Category $Category -Settings $Settings -Report $Report
+            #}
+        }
+        $TranslatedOutput
+    }
+}
+
+[scriptblock] $SourcesAutoCompleter = {
+    param($commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters)
+
+    $Script:GPODitionary.Keys | Sort-Object | Where-Object { $_ -like "*$wordToComplete*" }
+}
+Register-ArgumentCompleter -CommandName Find-GPO -ParameterName Type -ScriptBlock $SourcesAutoCompleter

Public/Invoke-GPOZaurrPermission.ps1

@@ -6,27 +6,38 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [parameter(Position = 0)]
         [scriptblock] $PermissionRules,
 
+        # ParameterSet1
         [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
 
+        # ParameterSet2
         [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
 
+        # ParameterSet3
+        [parameter(ParameterSetName = 'Level', Mandatory)][int] $Level,
+        [parameter(ParameterSetName = 'Level', Mandatory)][int] $Limit,
 
+        # ParameterSet4
         [parameter(ParameterSetName = 'Linked', Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
 
+        # ParameterSet5
         [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
 
+        # ParameterSet6
         [parameter(ParameterSetName = 'Filter')][string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')",
         [parameter(ParameterSetName = 'Filter')][string] $SearchBase,
         [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
 
+        # All other paramerrs are for for all parametersets
         [Parameter(ParameterSetName = 'GPOGUID')]
         [Parameter(ParameterSetName = 'GPOName')]
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'All')][string[]] $Type,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -34,6 +45,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [Array] $ApprovedGroups,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -41,6 +53,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('Principal')][Array] $Trustee,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -48,6 +61,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [Microsoft.GroupPolicy.GPPermissionType] $TrusteePermissionType,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -55,6 +69,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName',
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -62,6 +77,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [System.Collections.IDictionary] $GPOCache,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -69,6 +85,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('ForestName')][string] $Forest,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -76,6 +93,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [string[]] $ExcludeDomains,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -83,6 +101,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -90,140 +109,170 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
-        [System.Collections.IDictionary] $ExtendedForestInformation
+        [parameter(ParameterSetName = 'Level')]
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [switch] $LimitAdministrativeGroupsToDomain,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [switch] $SkipDuplicates
     )
-    Begin {
-        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-        <#
-        $Script:Actions = @{
-            GpoApply                    = @{
-                Remove = @{
-                    NotAdministrative          = $false
-                    NotWellKnownAdministrative = $false
-                }
-                Add    = @{
-                    Administrative          = $false
-                    WellKnownAdministrative = $false
-                }
-            }
-            GpoRead                     = @{
-                Remove = @{
-                    NotAdministrative          = $false
-                    NotWellKnownAdministrative = $false
-                }
-                Add    = @{
-                    Administrative          = $false
-                    WellKnownAdministrative = $false
-                }
-            }
-            GpoCustom                   = @{
-                Remove = @{
-                    NotAdministrative          = $false
-                    NotWellKnownAdministrative = $false
-                }
-                Add    = @{
-                    Administrative          = $false
-                    WellKnownAdministrative = $false
-                }
-            }
-            GpoEditDeleteModifySecurity = @{
-                Remove = @{
-                    NotAdministrative          = $false
-                    NotWellKnownAdministrative = $false
-                }
-                Add    = @{
-                    Administrative          = $false
-                    WellKnownAdministrative = $false
-                }
-            }
-            GpoEdit                     = @{
-                Remove = @{
-                    NotAdministrative          = $false
-                    NotWellKnownAdministrative = $false
-                }
-                Add    = @{
-                    Administrative          = $false
-                    WellKnownAdministrative = $false
-                }
-            }
-        }
-        #>
+    if ($PermissionRules) {
+        $Rules = & $PermissionRules
+    } else {
+        Write-Warning "Invoke-GPOZaurrPermission - No rules defined. Stopping processing."
+        return
     }
-    Process {
-
-        if ($PermissionRules) {
-            $Rules = & $PermissionRules
-            <#
-            foreach ($Rule in $Rules) {
-
-                #$Actions["$Rule."]
-
-                if ($Rule.Action -eq 'Remove' -and $Rule.Type -contains 'NotWellKnownAdministrative') {
-                    #$Actions.NotWellKnownAdministrative = $true
-                }
-                if ($Rule.Action -eq 'Remove' -and $Rule.Type -contains 'NotAdministrative') {
-                    #$Actions.Remove.NotAdministrative = $true
-                }
-            }
-            #>
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    if ($LimitAdministrativeGroupsToDomain) {
+        # This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
+    } else {
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
+    }
+    if ($PSCmdlet.ParameterSetName -ne 'Level') {
+        $Splat = @{
+            Forest                    = $Forest
+            IncludeDomains            = $IncludeDomains
+            ExcludeDomains            = $ExcludeDomains
+            ExtendedForestInformation = $ForestInformation
+            SkipDuplicates            = $SkipDuplicates.IsPresent
         }
+        if ($ADObject) {
+            $Splat['ADObject'] = $ADObject
+        } elseif ($Linked) {
+            $Splat['Linked'] = $Linked
+        } elseif ($GPOName) {
 
-        if ($GPOName -or $GPOGuid) {
+        } elseif ($GPOGuid) {
 
         } else {
+            if ($Filter) {
+                $Splat['Filter'] = $Filter
+            }
+            if ($SearchBase) {
+                $Splat['SearchBase'] = $SearchBase
+            }
+            if ($SearchScope) {
+                $Splat['SearchScope'] = $SearchScope
+            }
+        }
 
-            $Splat = @{ }
-            if ($ADObject) {
-                $Splat['ADObject'] = $ADObject
-            } elseif ($Linked) {
-                $Splat['Linked'] = $Linked
-            } else {
-                if ($Filter) {
-                    $Splat['Filter'] = $Filter
-                }
-                if ($SearchBase) {
-                    $Splat['SearchBase'] = $SearchBase
-                }
-                if ($SearchScope) {
-                    $Splat['SearchScope'] = $SearchScope
+
+
+        Get-GPOZaurrLink @Splat | ForEach-Object -Process {
+            $GPO = $_
+            foreach ($Rule in $Rules) {
+                if ($Rule.Action -eq 'Owner') {
+                    if ($Rule.Type -eq 'Administrative') {
+                        # We check for Owner (sometimes it can be empty)
+                        if ($GPO.Owner) {
+                            $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                        } else {
+                            $AdministrativeGroup = $null
+                        }
+                        if (-not $AdministrativeGroup) {
+                            $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+                            Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
+                            #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                            Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
+                        }
+                    } elseif ($Rule.Type -eq 'Default') {
+                        Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
+                        #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
+                        Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
+                    }
+                } elseif ($Rule.Action -eq 'Remove') {
+                    $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType -ADAdministrativeGroups $ADAdministrativeGroups
+                    foreach ($Permission in $GPOPermissions) {
+                        Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
+                    }
+                } elseif ($Rule.Action -eq 'Add') {
+                    # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
+                    $SplatPermissions = @{
+                        #Forest                    = $Forest
+                        IncludeDomains         = $GPO.DomainName
+                        #ExcludeDomains            = $ExcludeDomains
+                        #ExtendedForestInformation = $ForestInformation
+
+                        GPOGuid                = $GPO.GUID
+                        IncludePermissionType  = $Rule.IncludePermissionType
+                        Type                   = $Rule.Type
+                        PermitType             = $Rule.PermitType
+                        Principal              = $Rule.Principal
+                        ADAdministrativeGroups = $ADAdministrativeGroups
+                    }
+                    if ($Rule.PrincipalType) {
+                        $SplatPermissions.PrincipalType = $Rule.PrincipalType
+                    }
+                    Add-GPOZaurrPermission @SplatPermissions
                 }
             }
-
-            Get-GPOZaurrLink @Splat | ForEach-Object -Process {
-                $GPO = $_
+        }
+    } else {
+        # This is special case based on different command
+        $Report = Get-GPOZaurrLinkSummary -Report OneLink
+        $AffectedGPOs = foreach ($GPO in $Report) {
+            $Property = "Level$($Level)"
+            if ($GPO."$Property" -gt $Limit) {
                 foreach ($Rule in $Rules) {
                     if ($Rule.Action -eq 'Owner') {
                         if ($Rule.Type -eq 'Administrative') {
-                            $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                            # We check for Owner (sometimes it can be empty)
+                            if ($GPO.Owner) {
+                                $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                            } else {
+                                $AdministrativeGroup = $null
+                            }
                             if (-not $AdministrativeGroup) {
                                 $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-                                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
-                                Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                                Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
+                                #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                                Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
                             }
                         } elseif ($Rule.Type -eq 'Default') {
-                            Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
-                            Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
+                            Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
+                            #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
+                            Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
                         }
-                        continue
-                    }
-                    if ($Rule.Action -eq 'Remove') {
-                        $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject
+                    } elseif ($Rule.Action -eq 'Remove') {
+                        $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType -ADAdministrativeGroups $ADAdministrativeGroups
                         foreach ($Permission in $GPOPermissions) {
-                            Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission #-IncludeDomains $GPO.DomainName
+                            Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
                         }
-                        continue
-                    }
-                    if ($Rule.Action -eq 'Add') {
-                        #$GPOPermissions = Get-GPOZaurrPermission -GPOGuid $_.GUID -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type 'All' -IncludeGPOObject
-                        # foreach ($Permission in $GPOPermissions) {
-                        Add-GPOZaurrPermission -GPOGuid $_.GUID -IncludeDomains $GPO.DomainName -Type $Rule.Type -PermissionType $Rule.IncludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
-                        # }
+                    } elseif ($Rule.Action -eq 'Add') {
+                        # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
+                        $SplatPermissions = @{
+                            #Forest                    = $Forest
+                            IncludeDomains         = $GPO.DomainName
+                            #ExcludeDomains            = $ExcludeDomains
+                            #ExtendedForestInformation = $ForestInformation
+
+                            GPOGuid                = $GPO.GUID
+                            IncludePermissionType  = $Rule.IncludePermissionType
+                            Type                   = $Rule.Type
+                            PermitType             = $Rule.PermitType
+                            Principal              = $Rule.Principal
+                            ADAdministrativeGroups = $ADAdministrativeGroups
+                        }
+                        if ($Rule.PrincipalType) {
+                            $SplatPermissions.PrincipalType = $Rule.PrincipalType
+                        }
+                        Add-GPOZaurrPermission @SplatPermissions
                     }
                 }
             }
         }
-    }
-    End {
-
+        $AffectedGPOs
     }
 }

Public/New-GPOZaurrWMi.ps1

@@ -3,6 +3,7 @@
     param(
         [parameter(Mandatory)][string] $Name,
         [string] $Description = ' ',
+        [string] $Namespace = 'root\CIMv2',
         [parameter(Mandatory)][string] $Query,
         [switch] $SkipQueryCheck,
         [switch] $Force,
@@ -50,7 +51,7 @@
 
         [Array] $ExistingWmiFilter = Get-GPOZaurrWMI -ExtendedForestInformation $ForestInformation -IncludeDomains $Domain -Name $Name
         if ($ExistingWmiFilter.Count -eq 0) {
-            [string] $WMIParm2 = -join ("1;3;10;", $Query.Length.ToString(), ";WQL;root\CIMv2;", $Query , ";")
+            [string] $WMIParm2 = -join ("1;3;10;", $Query.Length.ToString(), ";WQL;$Namespace;", $Query , ";")
             $OtherAttributes = @{
                 "msWMI-Name"             = $Name
                 "msWMI-Parm1"            = $Description
@@ -67,7 +68,7 @@
 
             try {
                 Write-Verbose "New-GPOZaurrWMI - Creating WMI filter $Name in $Domain"
-                New-ADObject -name $GUID -type "msWMI-Som" -Path $WMIPath -OtherAttributes $OtherAttributes -Server $QueryServer
+                New-ADObject -Name $GUID -Type "msWMI-Som" -Path $WMIPath -OtherAttributes $OtherAttributes -Server $QueryServer
             } catch {
                 Write-Warning "New-GPOZaurrWMI - Creating GPO filter error $($_.Exception.Message). Terminating."
                 return

Public/Remove-GPOPermission.ps1

@@ -3,7 +3,14 @@
     param(
         [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'Administrative', 'NotAdministrative', 'All')][string[]] $Type,
         [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
-        [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType
+        [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'Allow',
+
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid'
     )
 
     if ($Type) {
@@ -12,34 +19,11 @@
             Type                  = $Type
             IncludePermissionType = $IncludePermissionType
             ExcludePermissionType = $ExcludePermissionType
+            PermitType            = $PermitType
+            Principal             = $Principal
+            PrincipalType         = $PrincipalType
+            ExcludePrincipal      = $ExcludePrincipal
+            ExcludePrincipalType  = $ExcludePrincipalType
         }
     }
-    <#
-    foreach ($T in $Type) {
-        foreach ($Permission in $IncludePermissionType) {
-            if ($T -eq 'NotWellKnownAdministrative') {
-                $Script:Actions[$Permission][$T] = $true
-            } elseif ($T -eq 'NotAdministrative') {
-                $Script:Actions[$Permission][$T] = $true
-            }
-        }
-    }
-    #>
-}
-<#
-function Find-GPOPermission {
-    param(
-        $GPOPermissions,
-        [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
-        [bool] $NotAdministrative,
-        [bool] $NotWellKnownAdministrative
-    )
-    foreach ($Permission in $GPOPermissions) {
-        if ($Permission.Permission -in $IncludePermissionType) {
-            if ($NotAdministrative -and $NotWellKnownAdministrative) {
-                $Permission
-            }
-        }
-    }
-}
-#>
+}

Public/Remove-GPOZaurrLegacyFiles.ps1

@@ -0,0 +1,25 @@
+function Remove-GPOZaurrLegacyFiles {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+
+        [int] $LimitProcessing = [int32]::MaxValue
+    )
+    $Splat = @{
+        Forest                    = $Forest
+        IncludeDomains            = $IncludeDomains
+        ExcludeDomains            = $ExcludeDomains
+        ExtendedForestInformation = $ExtendedForestInformation
+        Verbose                   = $VerbosePreference
+    }
+    Get-GPOZaurrLegacyFiles @Splat | Select-Object -First $LimitProcessing | ForEach-Object {
+        try {
+            Remove-Item -Path $_.FullName -ErrorAction Stop
+        } catch {
+            $ErrorMessage = $_.Exception.Message
+            Write-Warning "Remove-GPOZaurrLegacyFiles - Failed to remove file $($_.FullName): $($ErrorMessage)."
+        }
+    }
+}

Public/Remove-GPOZaurrOrphanedSysvolFolders.ps1

@@ -0,0 +1,13 @@
+function Remove-GPOZaurrOrphanedSysvolFolders {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [int] $LimitProcessing = [int32]::MaxValue
+    )
+    Get-GPOZaurrSysvol | Where-Object {
+        if ($_.Status -eq 'Orphaned GPO') {
+            $_
+        }
+    } | Select-Object | Select-Object -First $LimitProcessing | ForEach-Object {
+        Remove-Item -Recurse -Force -LiteralPath $_.Path
+    }
+}

Public/Remove-GPOZaurrPermission.ps1

@@ -27,7 +27,7 @@
     Begin {
         $Count = 0
         $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
         if ($Type -eq 'Unknown') {
             if ($SkipAdministrative -or $SkipWellKnown) {
                 Write-Warning "Remove-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."

Public/Repair-GPOZaurrPermissionConsistency.ps1

@@ -0,0 +1,44 @@
+function Repair-GPOZaurrPermissionConsistency {
+    [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Default')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [int] $LimitProcessing = [int32]::MaxValue
+    )
+    $ConsistencySplat = @{
+        Forest                    = $Forest
+        IncludeDomains            = $IncludeDomains
+        ExcludeDomains            = $ExcludeDomains
+        ExtendedForestInformation = $ExtendedForestInformation
+        Verbose                   = $VerbosePreference
+    }
+    if ($GPOName) {
+        $ConsistencySplat['GPOName'] = $GPOName
+    } elseif ($GPOGuid) {
+        $ConsistencySplat['GPOGuid'] = $GPOGUiD
+    } else {
+        $ConsistencySplat['Type'] = 'Inconsistent'
+    }
+
+    Get-GPOZaurrPermissionConsistency @ConsistencySplat -IncludeGPOObject | Where-Object {
+        if ($_.ACLConsistent -eq $false) {
+            $_
+        }
+    } | Select-Object -First $LimitProcessing | ForEach-Object {
+        #Write-Verbose "Repair-GPOZaurrPermissionConsistency - Repairing GPO consistency $($_.DisplayName) from domain: $($_.DomainName)"
+        if ($PSCmdlet.ShouldProcess($_.DisplayName, "Reparing GPO permissions consistency in domain $($_.DomainName)")) {
+            try {
+                $_.IncludeGPOObject.MakeAclConsistent()
+            } catch {
+                $ErrorMessage = $_.Exception.Message
+                Write-Warning "Repair-GPOZaurrPermissionConsistency - Failed to set consistency: $($ErrorMessage)."
+            }
+        }
+    }
+}

Public/Save-GPOZaurrFiles.ps1

@@ -9,12 +9,6 @@
         [switch] $DeleteExisting
     )
     if ($GPOPath) {
-        if (-not $ExtendedForestInformation) {
-            $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
-        } else {
-            $ForestInformation = $ExtendedForestInformation
-        }
-
         if ($DeleteExisting) {
             $Test = Test-Path -LiteralPath $GPOPath
             if ($Test) {
@@ -22,16 +16,18 @@
                 Remove-Item -LiteralPath $GPOPath -Recurse
             }
         }
-
         $null = New-Item -ItemType Directory -Path $GPOPath -Force
-        foreach ($Domain in $ForestInformation.Domains) {
-            Write-Verbose "Save-GPOZaurrFiles - Processing GPO for $Domain"
-            Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
-                $XMLContent = Get-GPOReport -ID $_.ID.Guid -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
-                $Path = [io.path]::Combine($GPOPath, "$($_.ID.Guid).xml")
-
-                $XMLContent | Set-Content -LiteralPath $Path -Force -Encoding Unicode
+        $GPOs = Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        foreach ($GPO in $GPOS) {
+            $XMLContent = Get-GPOReport -ID $GPO.Guid -ReportType XML -Domain $GPO.DomainName
+            $GPODOmainFolder = [io.path]::Combine($GPOPath, $GPO.DomainName)
+            if (-not (Test-Path -Path $GPODOmainFolder)) {
+                $null = New-Item -ItemType Directory -Path $GPODOmainFolder -Force
             }
+            $Path = [io.path]::Combine($GPODOmainFolder, "$($GPO.Guid).xml")
+            $XMLContent | Set-Content -LiteralPath $Path -Force -Encoding Unicode
         }
+        $GPOListPath = [io.path]::Combine($GPOPath, "GPOList.xml")
+        $GPOs | Export-Clixml -Depth 5 -Path $GPOListPath
     }
 }

Public/Select-GPOTranslation.ps1

@@ -0,0 +1,22 @@
+function Select-GPOTranslation {
+    [cmdletbInding()]
+    param(
+        [Parameter(ValueFromPipeline)][System.Collections.IDictionary] $InputObject,
+        [string] $Category,
+        [string] $Settings
+    )
+
+    $Important = [ordered] @{}
+    $AllProperties = Select-Properties -AllProperties -Objects $InputObject.$Category.$Settings
+    $MissingProperties = $AllProperties | Where-Object { $_ -notin 'DisplayName', 'DomainName', 'GUID', 'Linked', 'LinksCount', 'Links', 'GPOType', 'GPOCategory', 'GPOSettings' }
+    $Types = foreach ($Property in $MissingProperties) {
+        ($InputObject.$Category.$Settings | Where-Object { $null -ne $_.$Property }).$Property | ForEach-Object {
+            ($_ | Get-Member -MemberType Properties) | Where-Object { $_.Name -notin 'Length' }
+        }
+    }
+    $Important['AllProperties'] = $AllProperties
+    $Important['MissingProperties'] = $MissingProperties
+    $Important['Types'] = $Types | Select-Object -Unique
+    $Important['Data'] = $InputObject.$Category.$Settings
+    $Important
+}

Public/Set-GPOZaurrOwner.ps1

@@ -120,24 +120,6 @@
                         $_
                     }
                 }
-
-                <#
-                if (-not $AdministrativeGroup -and (-not $AdministrativeGroupSysvol -and -not $SkipSysvol)) {
-                    $Action = 'Both'
-                    $_
-                } elseif (-not $AdministrativeGroup) {
-                    $Action = 'OnlyGPO'
-                    $_
-                } elseif (-not $AdministrativeGroupSysvol -and -not $SkipSysvol) {
-                    $Action = 'OnlyFileSystem'
-                    $_
-                } else {
-                    if ($_.Owner -ne $_.SysvolOwner) {
-                        $Action = 'OnlyFileSystem'
-                        $_
-                    }
-                }
-                #>
             } elseif ($Type -eq 'Unknown') {
                 if (-not $_.Owner -or (-not $_.SysvolOwner -and -not $SkipSysvol)) {
                     $_
@@ -146,7 +128,7 @@
                 if ($SkipSysvol) {
                     Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). SysVol scanning is disabled. Skipping."
                 } else {
-                if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
+                    if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
                         #Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
                         $_
                     }
@@ -172,9 +154,6 @@
             }
         } | Select-Object -First $LimitProcessing | ForEach-Object -Process {
             $GPO = $_
-            #if (-not $Principal) {
-            #   $Principal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-            #}
             if (-not $Principal) {
                 $DefaultPrincipal = $ADAdministrativeGroups["$($_.DomainName)"]['DomainAdmins']
             } else {
@@ -197,98 +176,6 @@
                 }
             }
         }
-            <#
-            if ($Type -contains 'All') {
-                # Regardless who is the owner it is overwritten
-                if ($Principal) {
-                    Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
-                    Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
-                } else {
-                    $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-                    Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
-                    Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
-                }
-                $Count++
-                if ($Count -eq $LimitProcessing) {
-                    break
-                }
-            } elseif ($Type -contains 'NotAdministrative' -and $Type -notcontains 'All') {
-                if ($GPO.Owner) {
-                    $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
-                    if (-not $AdministrativeGroup) {
-                        if ($Principal) {
-                            Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
-                            Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
-                        } else {
-                            $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-                            Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
-                            Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
-                        }
-                        $Count++
-                        if ($Count -eq $LimitProcessing) {
-                            return
-                        }
-                    }
-                }
-            } else ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
-                if ($null -eq $GPO.Owner) {
-                    if ($Principal) {
-                        Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $Principal"
-                        Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
-                    } else {
-                        $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-                        Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $DefaultPrincipal"
-                        Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
-                    }
-                    $Count++
-                    if ($Count -eq $LimitProcessing) {
-                        break
-                    }
-                }
-            } else {
-                $GPO = $_
-                if ($Principal) {
-                    Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
-                    Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
-                } else {
-                    $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-                    Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
-                    Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
-                }
-            }
-            #>
-        #}
-        #>
-        #}
-        <#
-        else {
-            $getGPOZaurrOwnerSplat = @{
-                IncludeSysvol             = $IncludeSysVol
-                Forest                    = $Forest
-                IncludeDomains            = $IncludeDomains
-                ExcludeDomains            = $ExcludeDomains
-                ExtendedForestInformation = $ExtendedForestInformation
-                ADAdministrativeGroups    = $ADAdministrativeGroups
-                GPOName                   = $GPOName
-                GPOGuid                   = $GPOGUiD
-            }
-            Get-GPOZaurrOwner @getGPOZaurrOwnerSplat $IncludeSysVol | ForEach-Object -Process {
-                $GPO = $_
-                if ($Principal) {
-                    Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
-                    Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Principal -Verbose:$false -WhatIf:$WhatIfPreference
-                } else {
-                    $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-                    Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $DefaultPrincipal"
-                    Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
-                }
-                $Count++
-                if ($Count -eq $LimitProcessing) {
-                    break
-                }
-            }
-        }
-        #>
     }
     End {
 

README.md

@@ -39,5 +39,33 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
-- 0.0.1 - Unreleased
+- 0.0.46 - 28.06.2020
+  - Additional protection for `Get-GPOZaurrAD` for CNF duplicates
+  - Update to `Save-GPOZaurrFiles`
+  - Added `Invoke-GPOZaurr` (alias: `Find-GPO`) (heavy work in progress)
+- 0.0.45 - 26.06.2020
+  - During publishing ADEssentials required functions are now merged to prevent cyclic dependency bug [Using ModuleSpec syntax in RequiredModules causes incorrect "cyclic dependency" failures](https://github.com/PowerShell/PowerShell/issues/2607)
+- 0.0.44 - 24.06.2020
+  - Improvement to `Get-GPOZaurrLinkSummary`
+- 0.0.43 - 21.06.2020
+  - Added `Get-GPOZaurrFiles` to list files on NETLOGON/SYSVOL shares with a lot of details
+- 0.0.42 - 19.06.2020
+  - Fix for `Get-GPOZaurrLink` and `SearchBase` parameter
+  - Fix for `Get-GPOZaurrLink` - canonical link Trim() throwing errors if empty
+- 0.0.41 - 18.06.2020
+  - Added paramerter `SkipDuplicates` to `Invoke-GPOZaurrPermission` which prevents applying permissions over and over again if 1 GPO is linked to a multiple OU's within another OU
+- 0.0.40 - 18.06.2020
+  - Fix for error `Get-GPOZaurrLink` - same issue as described on my [earlier blog - Get-ADObject : The server has returned the following error: invalid enumeration context.](https://evotec.xyz/get-adobject-the-server-has-returned-the-following-error-invalid-enumeration-context/).
+    - `WARNING: Get-GPOZaurrLink - Processing error The server has returned the following error: invalid enumeration context.`
+    - `WARNING: Get-GPOZaurrLink - Processing error A referral was returned from the server`
+  - Added `SkipDuplicates` for `Get-GPOZaurrLink`
+- 0.0.39 - 17.06.2020
+  - Updates to `Invoke-GPOZaurrPermission` with new parameter `LimitAdministrativeGroupsToDomain`
+    - This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)
+- 0.0.38 - 17.06.2020
+  - Update to Get-PrivGPOZaurrLink which would cause problems to `Invoke-GPOZaurrPermission` if it would be run without Administrative permission and GPO wouldn't be accessible for that user
+- 0.0.37 - 16.06.2020
+  - Updates to `Invoke-GPOZaurrPermission` with new parameterset `Level`
+  - Updates to `Get-GPOZaurrLinkSummary`
+- 0.0.36 - 15.06.2020
   - Initial release