Update

Examples/Example-14-ListingGPOsPerOU4.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -Linked 'Root' -IncludeDomains 'ad.evotec.pl' | ft

Examples/Example-16-KeepPermissions.ps1

@@ -1,6 +1,4 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-Import-Module 'C:\Support\GitHub\PSSharedGoods\PSSharedGoods.psd1' -Force
-
 
 # Apply permissions for ROOT
 Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.xyz' {

Examples/Example-16-KeepPermissions02.ps1

@@ -0,0 +1,43 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Apply permissions for ROOT
+Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.pl' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+
+# Apply perrmissions for Domain Controllers
+Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+# Apply permissions for Regions, with exclusions for those 4 groups
+$Exclude = @(
+    'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} #-WhatIf
+
+$Exclude = @(
+    'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} #-WhatIf

Examples/Example-16-KeepPermissions03.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This is a bit special - I would read blog post before running this
+Invoke-GPOZaurrPermission -Verbose -Level 1 -Limit 1 {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf

Examples/Example-23-Links.ps1

@@ -0,0 +1,14 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Get-GPOZaurrLinkSummary | Format-Table *
+#Get-GPOZaurrLinkSummary -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'MultipleLinks' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'OneLink' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'LinksSummary' -UnlimitedProperties | Format-Table *
+
+$Report = Get-GPOZaurrLinkSummary #-UnlimitedProperties
+$Report | Format-Table *
+$Report.MultipleLinks | Format-Table *
+$Report.OneLink | Format-Table *
+$Report.LinksSummary | Format-Table *

Examples/Example-24-Links02.ps1

@@ -0,0 +1,12 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Report = Get-GPOZaurrLinkSummary -Report OneLink
+$Report | Format-Table
+$AffectedGPOs = foreach ($GPO in $Report) {
+    if ($GPO.Level1 -gt 1) {
+        $GPO
+    }
+}
+
+$AffectedGPOs | Format-Table *

GPOZaurr.psd1

@@ -5,9 +5,9 @@
     CompatiblePSEditions = 'Desktop'
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
     Description          = 'Group Policy Eater'
-    FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
+    FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.33'
+    ModuleVersion        = '0.0.37'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -17,7 +17,7 @@
         }
     }
     RequiredModules      = @{
-        ModuleVersion = '0.0.145'
+        ModuleVersion = '0.0.147'
         ModuleName    = 'PSSharedGoods'
         Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
     }, @{

Private/Get-PrivGPOZaurrLInk.ps1

@@ -6,12 +6,14 @@
         [System.Collections.IDictionary] $GPOCache
     )
     if ($Object.GpLink -and $Object.GpLink.Trim() -ne '') {
-        $Object.GpLink -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://' | ForEach-Object -Process {
-            if ($_) {
+        #$Object.GpLink -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://'
+        $Object.GpLink -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            #Write-Verbose $_
+            if ($_.Length -gt 10) {
                 $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
                 $Output = [ordered] @{
                     DistinguishedName = $Object.DistinguishedName
-                    CanonicalName     = $Object.CanonicalName
+                    CanonicalName     = $Object.CanonicalName.TrimEnd('/');
                     Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
                 }
                 $Search = -join ($DomainCN, $Output['Guid'])
@@ -30,12 +32,12 @@
             }
         }
     } elseif ($Object.LinkedGroupPolicyObjects -and $Object.LinkedGroupPolicyObjects.Trim() -ne '') {
-        $Object.LinkedGroupPolicyObjects -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://' | ForEach-Object -Process {
-            if ($_) {
+        $Object.LinkedGroupPolicyObjects -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            if ($_.Length -gt 10) {
                 $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
                 $Output = [ordered] @{
                     DistinguishedName = $Object.DistinguishedName
-                    CanonicalName     = $Object.CanonicalName
+                    CanonicalName     = $Object.CanonicalName.TrimEnd('/');
                     Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
                 }
                 $Search = -join ($DomainCN, $Output['Guid'])

Public/Add-GPOZaurrPermission.ps1

@@ -79,6 +79,12 @@
                 # We are looking for administrative but we need to make sure we got correct administrative
                 if ($GPOPermission.Permission -eq $PermissionType) {
                     $AdministrativeGroup = $ADAdministrativeGroups['BySID'][$GPOPermission.SID]
+                    if ($AdministrativeGroup.SID -like '*-519') {
+                        $AdministrativeExists['EnterpriseAdmins'] = $true
+                    } elseif ($AdministrativeGroup.SID -like '*-512') {
+                        $AdministrativeExists['DomainAdmins'] = $true
+                    }
+                    <#
                     if ($AdministrativeGroup) {
                         $DomainAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-512')
                         $EnterpriseAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-519')
@@ -88,6 +94,7 @@
                             $AdministrativeExists['EnterpriseAdmins'] = $true
                         }
                     }
+                    #>
                 }
             } elseif ($Type -eq 'WellKnownAdministrative') {
                 # this is for SYSTEM account

Public/Get-GPOZaurrLink.ps1

@@ -43,7 +43,9 @@
         $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         if (-not $GPOCache -and -not $Limited) {
             $GPOCache = @{ }
-            foreach ($Domain in $ForestInformation.Domains) {
+            # While initially we used $ForestInformation.Domains but the thing is GPOs can be linked to other domains so we need to get them all so we can use cache of it later on even if we're processing just one domain
+            # That's why we use $ForestInformation.Forest.Domains instead
+            foreach ($Domain in $ForestInformation.Forest.Domains) {
                 $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
                 Get-GPO -All -DomainName $Domain -Server $QueryServer | ForEach-Object {
                     $GPOCache["$Domain$($_.ID.Guid)"] = $_

Public/Get-GPOZaurrLinkSummary.ps1

@@ -0,0 +1,159 @@
+function Get-GPOZaurrLinkSummary {
+    [cmdletBinding()]
+    param(
+        [ValidateSet('All', 'MultipleLinks', 'OneLink', 'LinksSummary')][string[]] $Report = 'All',
+        [switch] $UnlimitedProperties
+    )
+    $HighestCount = 0 # to keep number of depth
+    $CacheSummaryLinks = [ordered] @{} # cache
+
+    # Get all links
+    $Links = Get-GPOZaurrLink
+    foreach ($Link in $Links) {
+        if (-not $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"]) {
+            $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"] = [System.Collections.Generic.List[System.Object]]::new()
+        }
+        $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"].Add($Link)
+    }
+
+    $ReturnObject = [ordered] @{
+        MultipleLinks = [System.Collections.Generic.List[System.Object]]::new()
+        OneLink       = [System.Collections.Generic.List[System.Object]]::new()
+        LinksSummary  = [System.Collections.Generic.List[System.Object]]::new()
+    }
+
+    foreach ($Key in $CacheSummaryLinks.Keys) {
+        $GPOs = $CacheSummaryLinks[$Key]
+
+        [Array] $LinkingSummary = foreach ($GPO in $GPOs) {
+            $SplitttedOU = ($GPO.DistinguishedName -split ',')
+            [Array] $Clean = foreach ($_ in $SplitttedOU) {
+                if ($_ -notlike 'DC=*') { $_ -replace 'OU=' }
+            }
+            if ($Clean.Count -gt $HighestCount) {
+                $HighestCount = $Clean.Count
+            }
+            if ($Clean) {
+                $Test = [ordered] @{
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = ConvertFrom-DistinguishedName -DistinguishedName $GPO.DistinguishedName -ToDomainCN
+                }
+                for ($i = 1; $i -le 10; $i++) {
+                    $Test["Level$i"] = $Clean[ - $i]
+                }
+                [PSCustomobject] $Test
+            } else {
+                $Test = [ordered] @{
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = $GPO.CanonicalName
+                }
+                for ($i = 1; $i -le 10; $i++) {
+                    $Test["Level$i"] = $null
+                }
+                [PSCustomobject] $Test
+            }
+        }
+        if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') {
+            foreach ($Link in $LinkingSummary) {
+                $ReturnObject.MultipleLinks.Add($Link)
+            }
+            #continue
+        }
+        if ($Report -eq 'OneLink' -or $Report -contains 'All') {
+            $List = [ordered] @{
+                DisplayName = $GPOs[0].DisplayName
+                Guid        = $GPOs[0].Guid
+                DomainName  = $GPOs[0].DomainName
+                LinksCount  = $GPOs.Count
+            }
+            for ($i = 0; $i -le 10; $i++) {
+                $List["Level$i"] = ($LinkingSummary."Level$i" | Select-Object -Unique).Count
+                $List["Level$($i)List"] = ($LinkingSummary."Level$i" | Select-Object -Unique)
+            }
+            $List.LinksDistinguishedName = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
+            $List.LinksCanonicalName = $GPOs.CanonicalName
+
+            $List.Owner = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
+            $List.GpoStatus = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
+            $List.Description = $GPOs[0].Description                #:
+            $List.CreationTime = $GPOs[0].CreationTime               #: 16.12.2019 21:25:32
+            $List.ModificationTime = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
+            $List.GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
+            $List.GPODistinguishedName = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
+
+            $ReturnObject.OneLink.Add( [PSCustomObject] $List)
+        }
+        if ($Report -eq 'LinksSummary' -or $Report -contains 'All') {
+            $Output = [PSCustomObject] @{
+                DisplayName                = $GPOs[0].DisplayName                #: COMPUTERS | LAPS
+                Guid                       = $GPOs[0].Guid                       #: AA782787 - 002B-4B8C-886F-05873F2DC0CA
+                DomainName                 = $GPOs[0].DomainName                 #: ad.evotec.xyz
+                LinksCount                 = $GPOs.Count
+                LinksDistinguishedName     = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
+                LinksCanonicalName         = $GPOs.CanonicalName              #: ad.evotec.xyz / ITR02 / Computers
+                Owner                      = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
+                GpoStatus                  = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
+                Description                = $GPOs[0].Description                #:
+                CreationTime               = $GPOs[0].CreationTime               #: 16.12.2019 21:25:32
+                ModificationTime           = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
+                GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
+                GPODistinguishedName       = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
+            }
+            $ReturnObject.LinksSummary.Add($Output)
+        }
+    }
+    # Processing output
+    if (-not $UnlimitedProperties) {
+        if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') {
+            $Properties = @(
+                'DisplayName'
+                'DomainName'
+                'GUID'
+                for ($i = 0; $i -le $HighestCount; $i++) {
+                    "Level$i"
+                }
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
+            )
+            $ReturnObject.MultipleLinks = $ReturnObject.MultipleLinks | Select-Object -Property $Properties
+        }
+        if ($Report -contains 'OneLink' -or $Report -contains 'All') {
+            $Properties = @(
+                'DisplayName'
+                'DomainName'
+                'GUID'
+                for ($i = 0; $i -le $HighestCount; $i++) {
+                    "Level$i"
+                    "Level$($i)List"
+                }
+                'LinksDistinguishedName'
+                'LinksCanonicalName'
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
+            )
+            $ReturnObject.OneLink = $ReturnObject.OneLink | Select-Object -Property $Properties
+        }
+        #if ($Report -contains 'LinksSummary' -or $Report -contains 'All') {
+        # Not needed because there's no dynamic properties, but if there would be we need to uncomment and fix it
+        #}
+    }
+    if ($Report.Count -eq 1 -and $Report -notcontains 'All') {
+        $ReturnObject["$Report"]
+    } else {
+        $ReturnObject
+    }
+}

Public/Invoke-GPOZaurrPermission.ps1

@@ -6,27 +6,38 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [parameter(Position = 0)]
         [scriptblock] $PermissionRules,
 
+        # ParameterSet1
         [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
 
+        # ParameterSet2
         [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
 
+        # ParameterSet3
+        [parameter(ParameterSetName = 'Level', Mandatory)][int] $Level,
+        [parameter(ParameterSetName = 'Level', Mandatory)][int] $Limit,
 
+        # ParameterSet4
         [parameter(ParameterSetName = 'Linked', Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
 
+        # ParameterSet5
         [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
 
+        # ParameterSet6
         [parameter(ParameterSetName = 'Filter')][string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')",
         [parameter(ParameterSetName = 'Filter')][string] $SearchBase,
         [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
 
+        # All other paramerrs are for for all parametersets
         [Parameter(ParameterSetName = 'GPOGUID')]
         [Parameter(ParameterSetName = 'GPOName')]
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'All')][string[]] $Type,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -34,6 +45,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [Array] $ApprovedGroups,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -41,6 +53,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('Principal')][Array] $Trustee,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -48,6 +61,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [Microsoft.GroupPolicy.GPPermissionType] $TrusteePermissionType,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -55,6 +69,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName',
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -62,6 +77,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [System.Collections.IDictionary] $GPOCache,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -69,6 +85,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('ForestName')][string] $Forest,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -76,6 +93,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [string[]] $ExcludeDomains,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -83,6 +101,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -90,6 +109,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [System.Collections.IDictionary] $ExtendedForestInformation
     )
     if ($PermissionRules) {
@@ -99,77 +119,140 @@
         return
     }
     $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-    $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
+    $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
 
-    $Splat = @{
-        Forest                    = $Forest
-        IncludeDomains            = $IncludeDomains
-        ExcludeDomains            = $ExcludeDomains
-        ExtendedForestInformation = $ForestInformation
-    }
-    if ($ADObject) {
-        $Splat['ADObject'] = $ADObject
-    } elseif ($Linked) {
-        $Splat['Linked'] = $Linked
-    } elseif ($GPOName) {
-
-    } elseif ($GPOGuid) {
-
-    } else {
-        if ($Filter) {
-            $Splat['Filter'] = $Filter
+    if ($PSCmdlet.ParameterSetName -ne 'Level') {
+        $Splat = @{
+            Forest                    = $Forest
+            IncludeDomains            = $IncludeDomains
+            ExcludeDomains            = $ExcludeDomains
+            ExtendedForestInformation = $ForestInformation
         }
-        if ($SearchBase) {
-            $Splat['SearchBase'] = $SearchBase
-        }
-        if ($SearchScope) {
-            $Splat['SearchScope'] = $SearchScope
-        }
-    }
+        if ($ADObject) {
+            $Splat['ADObject'] = $ADObject
+        } elseif ($Linked) {
+            $Splat['Linked'] = $Linked
+        } elseif ($GPOName) {
 
-    Get-GPOZaurrLink @Splat | ForEach-Object -Process {
-        $GPO = $_
-        foreach ($Rule in $Rules) {
-            if ($Rule.Action -eq 'Owner') {
-                if ($Rule.Type -eq 'Administrative') {
-                    $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
-                    if (-not $AdministrativeGroup) {
-                        $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-                        Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
-                        #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
-                        Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
-                    }
-                } elseif ($Rule.Type -eq 'Default') {
-                    Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
-                    #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
-                    Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
-                }
-            } elseif ($Rule.Action -eq 'Remove') {
-                $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType
-                foreach ($Permission in $GPOPermissions) {
-                    Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
-                }
-            } elseif ($Rule.Action -eq 'Add') {
+        } elseif ($GPOGuid) {
 
-                $SplatPermissions = @{
-                    Forest                    = $Forest
-                    IncludeDomains            = $IncludeDomains
-                    ExcludeDomains            = $ExcludeDomains
-                    ExtendedForestInformation = $ForestInformation
-
-                    GPOGuid                   = $GPO.GUID
-                    IncludePermissionType     = $Rule.IncludePermissionType
-                    Type                      = $Rule.Type
-                    PermitType                = $Rule.PermitType
-                    Principal                 = $Rule.Principal
-                    ADAdministrativeGroups    = $ADAdministrativeGroups
-                }
-                if ($Rule.PrincipalType) {
-                    $SplatPermissions.PrincipalType = $Rule.PrincipalType
-                }
-                Add-GPOZaurrPermission @SplatPermissions
+        } else {
+            if ($Filter) {
+                $Splat['Filter'] = $Filter
+            }
+            if ($SearchBase) {
+                $Splat['SearchBase'] = $SearchBase
+            }
+            if ($SearchScope) {
+                $Splat['SearchScope'] = $SearchScope
             }
         }
-    }
 
+
+
+        Get-GPOZaurrLink @Splat | ForEach-Object -Process {
+            $GPO = $_
+            foreach ($Rule in $Rules) {
+                if ($Rule.Action -eq 'Owner') {
+                    if ($Rule.Type -eq 'Administrative') {
+                        # We check for Owner (sometimes it can be empty)
+                        if ($GPO.Owner) {
+                            $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                        } else {
+                            $AdministrativeGroup = $null
+                        }
+                        if (-not $AdministrativeGroup) {
+                            $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+                            Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
+                            #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                            Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
+                        }
+                    } elseif ($Rule.Type -eq 'Default') {
+                        Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
+                        #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
+                        Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
+                    }
+                } elseif ($Rule.Action -eq 'Remove') {
+                    $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType
+                    foreach ($Permission in $GPOPermissions) {
+                        Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
+                    }
+                } elseif ($Rule.Action -eq 'Add') {
+                    # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
+                    $SplatPermissions = @{
+                        #Forest                    = $Forest
+                        IncludeDomains         = $GPO.DomainName
+                        #ExcludeDomains            = $ExcludeDomains
+                        #ExtendedForestInformation = $ForestInformation
+
+                        GPOGuid                = $GPO.GUID
+                        IncludePermissionType  = $Rule.IncludePermissionType
+                        Type                   = $Rule.Type
+                        PermitType             = $Rule.PermitType
+                        Principal              = $Rule.Principal
+                        ADAdministrativeGroups = $ADAdministrativeGroups
+                    }
+                    if ($Rule.PrincipalType) {
+                        $SplatPermissions.PrincipalType = $Rule.PrincipalType
+                    }
+                    Add-GPOZaurrPermission @SplatPermissions
+                }
+            }
+        }
+    } else {
+        # This is special case based on different command
+        $Report = Get-GPOZaurrLinkSummary -Report OneLink
+        $AffectedGPOs = foreach ($GPO in $Report) {
+            $Property = "Level$($Level)"
+            if ($GPO."$Property" -gt $Limit) {
+                foreach ($Rule in $Rules) {
+                    if ($Rule.Action -eq 'Owner') {
+                        if ($Rule.Type -eq 'Administrative') {
+                            # We check for Owner (sometimes it can be empty)
+                            if ($GPO.Owner) {
+                                $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                            } else {
+                                $AdministrativeGroup = $null
+                            }
+                            if (-not $AdministrativeGroup) {
+                                $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+                                Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
+                                #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                                Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
+                            }
+                        } elseif ($Rule.Type -eq 'Default') {
+                            Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
+                            #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
+                            Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
+                        }
+                    } elseif ($Rule.Action -eq 'Remove') {
+                        $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType
+                        foreach ($Permission in $GPOPermissions) {
+                            Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
+                        }
+                    } elseif ($Rule.Action -eq 'Add') {
+                        # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
+                        $SplatPermissions = @{
+                            #Forest                    = $Forest
+                            IncludeDomains         = $GPO.DomainName
+                            #ExcludeDomains            = $ExcludeDomains
+                            #ExtendedForestInformation = $ForestInformation
+
+                            GPOGuid                = $GPO.GUID
+                            IncludePermissionType  = $Rule.IncludePermissionType
+                            Type                   = $Rule.Type
+                            PermitType             = $Rule.PermitType
+                            Principal              = $Rule.Principal
+                            ADAdministrativeGroups = $ADAdministrativeGroups
+                        }
+                        if ($Rule.PrincipalType) {
+                            $SplatPermissions.PrincipalType = $Rule.PrincipalType
+                        }
+                        Add-GPOZaurrPermission @SplatPermissions
+                    }
+                }
+            }
+        }
+        $AffectedGPOs
+    }
 }

README.md

@@ -39,5 +39,8 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
-- 0.0.1 - Unreleased
+- 0.0.37 - 16.06.2020
+  - Updates to `Invoke-GPOZaurrPermission` with new parameterset `Level`
+  - Updates to `Get-GPOZaurrLinkSummary`
+- 0.0.36 - 15.06.2020
   - Initial release