Update

Added some error logging

.github/FUNDING.yml

@@ -1,7 +1,4 @@
 # These are supported funding model platforms
 
 github: PrzemyslawKlys
-patreon: przemyslawklys
-ko_fi: przemyslawklys
-open_collective: evotec
 custom: https://paypal.me/PrzemyslawKlys

Examples/Example-14-ListingGPOsPerOU3.ps1

@@ -1,5 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 Get-ADOrganizationalUnit -Filter * -Properties distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
+Get-ADOrganizationalUnit -Filter * -Properties canonicalname, distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
 Get-ADObject -Filter * -Properties distinguishedName, gplink -Server 'ad.evotec.pl' | Get-GPOZaurrLink | Format-Table -AutoSize
 Get-GPOZaurrLink | Format-Table -AutoSize

Examples/Example-14-ListingGPOsPerOU4.ps1

@@ -1,3 +1,3 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-Get-GPOZaurrLink -Linked 'Root' -IncludeDomains 'ad.evotec.pl' | ft
+Get-GPOZaurrLink -Linked 'Root' -IncludeDomains 'ad.evotec.pl' | Format-Table

Examples/Example-14-ListingGPOsPerOURemoveDuplicates.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -Verbose | Format-Table -a *
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -SkipDuplicates | Format-Table -a *

Examples/Example-16-AddRemoveGPOPermission03.ps1

@@ -1,14 +1,6 @@
 #Clear-Host
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$ApprovedGroups = @(
-    'GDS-TestGroup10'
-)
-$RootGroups = @(
-    #'przemyslaw.klys'
-)
-
-
 Invoke-GPOZaurrPermission -Linked Root -Verbose {
     Set-GPOOwner -Type Administrative
     #Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'

Examples/Example-16-AddRemoveGPOPermission04.ps1

@@ -8,4 +8,4 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=Computers,OU=Production,DC=ad
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
     #Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
     #Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
-} #-WhatIf #| Format-Table *
+} -WhatIf #| Format-Table *

Examples/Example-16-KeepPermissions.ps1

@@ -8,7 +8,6 @@ Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.xyz'
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
 } -WhatIf
 
-
 # Apply perrmissions for Domain Controllers
 Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
     Set-GPOOwner -Type Administrative
@@ -27,7 +26,7 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz'
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} #-WhatIf
+} -WhatIf
 
 $Exclude = @(
     'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
@@ -40,4 +39,4 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz'
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} #-WhatIf
+} -WhatIf

Examples/Example-16-KeepPermissions02.ps1

@@ -6,7 +6,7 @@ Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.pl' {
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} -WhatIf
+} -WhatIf -SkipDuplicates
 
 
 # Apply perrmissions for Domain Controllers
@@ -15,7 +15,7 @@ Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} -WhatIf
+} -WhatIf -SkipDuplicates
 
 # Apply permissions for Regions, with exclusions for those 4 groups
 $Exclude = @(
@@ -27,7 +27,8 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz'
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} #-WhatIf
+} -WhatIf -SkipDuplicates
+
 
 $Exclude = @(
     'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
@@ -40,4 +41,4 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz'
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} #-WhatIf
+} -WhatIf -SkipDuplicates

Examples/Example-16-KeepPermissions03.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This is a bit special - I would read blog post before running this
+Invoke-GPOZaurrPermission -Verbose -Level 1 -Limit 1 {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf

Examples/Example-23-Links.ps1

@@ -0,0 +1,14 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Get-GPOZaurrLinkSummary | Format-Table *
+#Get-GPOZaurrLinkSummary -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'MultipleLinks' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'OneLink' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'LinksSummary' -UnlimitedProperties | Format-Table *
+
+$Report = Get-GPOZaurrLinkSummary #-UnlimitedProperties
+$Report | Format-Table *
+$Report.MultipleLinks | Format-Table *
+$Report.OneLink | Format-Table *
+$Report.LinksSummary | Format-Table *

Examples/Example-24-Links02.ps1

@@ -0,0 +1,12 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Report = Get-GPOZaurrLinkSummary -Report OneLink
+$Report | Format-Table
+$AffectedGPOs = foreach ($GPO in $Report) {
+    if ($GPO.Level1 -gt 1) {
+        $GPO
+    }
+}
+
+$AffectedGPOs | Format-Table *

Examples/Example-25-ListSysVolFiles.ps1

@@ -0,0 +1,6 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrFiles -Type All | Out-HtmlView -ScrollX -Filtering -AllProperties
+Get-GPOZaurrFiles -HashAlgorithm MD5 | Select-Object -First 2 | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOListFiles.xlsx -AllProperties -ExcelWorkSheetName 'Files Just 2' -AutoFilter -AutoFit #-OpenWorkBook
+Get-GPOZaurrFiles -Type All -HashAlgorithm SHA256 | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOListFiles.xlsx -AllProperties -ExcelWorkSheetName 'Files All' -AutoFilter -AutoFit #-OpenWorkBook

GPOZaurr.psd1

@@ -4,24 +4,24 @@
     CompanyName          = 'Evotec'
     CompatiblePSEditions = 'Desktop'
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
-    Description          = 'Group Policy Eater'
-    FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
+    Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows easy fixing for issues that you may expect finding in them.'
+    FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrFiles', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.34'
+    ModuleVersion        = '0.0.45'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
-            Tags                       = 'Windows', 'ActiveDirectory', 'GPO'
+            Tags                       = 'Windows', 'ActiveDirectory', 'GPO', 'GroupPolicy'
             ProjectUri                 = 'https://github.com/EvotecIT/GPOZaurr'
             ExternalModuleDependencies = 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
         }
     }
     RequiredModules      = @{
-        ModuleVersion = '0.0.145'
+        ModuleVersion = '0.0.155'
         ModuleName    = 'PSSharedGoods'
         Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
     }, @{
-        ModuleVersion = '0.0.57'
+        ModuleVersion = '0.0.58'
         ModuleName    = 'ADEssentials'
         Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
     }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'

Private/Get-PrivGPOZaurrLInk.ps1

@@ -6,51 +6,69 @@
         [System.Collections.IDictionary] $GPOCache
     )
     if ($Object.GpLink -and $Object.GpLink.Trim() -ne '') {
-        $Object.GpLink -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://' | ForEach-Object -Process {
-            if ($_) {
+        #$Object.GpLink -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://'
+        $Object.GpLink -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            #Write-Verbose $_
+            if ($_.Length -gt 10) {
                 $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
                 $Output = [ordered] @{
                     DistinguishedName = $Object.DistinguishedName
-                    CanonicalName     = $Object.CanonicalName
+                    CanonicalName     = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
                     Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
                 }
                 $Search = -join ($DomainCN, $Output['Guid'])
                 if ($GPOCache -and -not $Limited) {
-                    $Output['DisplayName'] = $GPOCache[$Search].DisplayName
-                    $Output['DomainName'] = $GPOCache[$Search].DomainName
-                    $Output['Owner'] = $GPOCache[$Search].Owner
-                    $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
-                    $Output['Description'] = $GPOCache[$Search].Description
-                    $Output['CreationTime'] = $GPOCache[$Search].CreationTime
-                    $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                    if ($GPOCache[$Search]) {
+                        $Output['DisplayName'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
                 }
-                $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
-                $Output['GPODistinguishedName'] = $_
-                [PSCustomObject] $Output
             }
         }
     } elseif ($Object.LinkedGroupPolicyObjects -and $Object.LinkedGroupPolicyObjects.Trim() -ne '') {
-        $Object.LinkedGroupPolicyObjects -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://' | ForEach-Object -Process {
-            if ($_) {
+        $Object.LinkedGroupPolicyObjects -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            if ($_.Length -gt 10) {
                 $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
                 $Output = [ordered] @{
                     DistinguishedName = $Object.DistinguishedName
-                    CanonicalName     = $Object.CanonicalName
+                    CanonicalName     = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
                     Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
                 }
                 $Search = -join ($DomainCN, $Output['Guid'])
                 if ($GPOCache -and -not $Limited) {
-                    $Output['Name'] = $GPOCache[$Search].DisplayName
-                    $Output['DomainName'] = $GPOCache[$Search].DomainName
-                    $Output['Owner'] = $GPOCache[$Search].Owner
-                    $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
-                    $Output['Description'] = $GPOCache[$Search].Description
-                    $Output['CreationTime'] = $GPOCache[$Search].CreationTime
-                    $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                    if ($GPOCache[$Search]) {
+                        $Output['Name'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
                 }
-                $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
-                $Output['GPODistinguishedName'] = $_
-                [PSCustomObject] $Output
             }
         }
     }

Public/Get-GPOZaurrFiles.ps1

@@ -0,0 +1,31 @@
+function Get-GPOZaurrFiles {
+    [cmdletbinding()]
+    param(
+        [ValidateSet('All', 'Netlogon', 'Sysvol')][string[]] $Type = 'All',
+        [ValidateSet('None', 'MACTripleDES', 'MD5', 'RIPEMD160', 'SHA1', 'SHA256', 'SHA384', 'SHA512')][string] $HashAlgorithm = 'None',
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        $Path = @(
+            if ($Type -contains 'All') {
+                "\\$Domain\SYSVOL\$Domain"
+            }
+            if ($Type -contains 'Sysvol') {
+                "\\$Domain\SYSVOL\$Domain\policies"
+            }
+            if ($Type -contains 'NetLogon') {
+                "\\$Domain\NETLOGON"
+            }
+        )
+        Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File | ForEach-Object {
+            Get-FileMetaData -File $_ -Signature -HashAlgorithm $HashAlgorithm
+        }
+        foreach ($e in $err) {
+            Write-Warning "Get-GPOZaurrFiles - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
+        }
+    }
+}

Public/Get-GPOZaurrLink.ps1

@@ -14,6 +14,11 @@
         [parameter(ParameterSetName = 'Linked')]
         [switch] $Limited,
 
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [switch] $SkipDuplicates,
+
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
@@ -40,6 +45,7 @@
         [System.Collections.IDictionary] $ExtendedForestInformation
     )
     Begin {
+        $CacheReturnedGPOs = [ordered] @{}
         $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         if (-not $GPOCache -and -not $Limited) {
             $GPOCache = @{ }
@@ -71,8 +77,24 @@
                         #}
                         $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
                         $Splat['SearchBase'] = $SearchBase
-                        Get-ADObject @Splat | ForEach-Object -Process {
-                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
+                            $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            foreach ($OutputGPO in $OutputGPOs) {
+                                if (-not $SkipDuplicates) {
+                                    $OutputGPO
+                                } else {
+                                    $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                    if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                        $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                        $OutputGPO
+                                    }
+                                }
+                            }
                         }
                     }
                     if ($Linked -contains 'Root') {
@@ -83,8 +105,24 @@
                         # }
                         $Splat['Filter'] = "objectClass -eq 'domainDNS'"
                         $Splat['SearchBase'] = $SearchBase
-                        Get-ADObject @Splat | ForEach-Object -Process {
-                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
+                            $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            foreach ($OutputGPO in $OutputGPOs) {
+                                if (-not $SkipDuplicates) {
+                                    $OutputGPO
+                                } else {
+                                    $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                    if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                        $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                        $OutputGPO
+                                    }
+                                }
+                            }
                         }
                     }
                     if ($Linked -contains 'Site') {
@@ -97,7 +135,12 @@
                             #}
                             $Splat['Filter'] = "(objectClass -eq 'site')"
                             $Splat['SearchBase'] = $SearchBase
-                            Get-ADObject @Splat | ForEach-Object -Process {
+                            try {
+                                $ADObjectGPO = Get-ADObject @Splat
+                            } catch {
+                                Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                            }
+                            foreach ($_ in $ADObjectGPO) {
                                 Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
                             }
                         }
@@ -110,13 +153,29 @@
                         #}
                         $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
                         $Splat['SearchBase'] = $SearchBase
-                        Get-ADObject @Splat | ForEach-Object -Process {
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
                             if ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) {
                                 # other skips Domain Root
                             } elseif ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']) {
                                 # other skips Domain Controllers
                             } else {
-                                Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                                $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                                foreach ($OutputGPO in $OutputGPOs) {
+                                    if (-not $SkipDuplicates) {
+                                        $OutputGPO
+                                    } else {
+                                        $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                        if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                            $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                            $OutputGPO
+                                        }
+                                    }
+                                }
                             }
                         }
                     }
@@ -131,7 +190,8 @@
                     }
                     if ($PSBoundParameters.ContainsKey('SearchBase')) {
                         $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
-                        if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                        $SearchBaseDC = ConvertFrom-DistinguishedName -DistinguishedName $SearchBase -ToDC
+                        if ($SearchBaseDC -ne $DomainDistinguishedName) {
                             # we check if SearchBase is part of domain distinugishname. If it isn't we skip
                             continue
                         }
@@ -143,11 +203,23 @@
                     }
 
                     try {
-                        Get-ADObject @Splat | ForEach-Object {
-                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
-                        }
+                        $ADObjectGPO = Get-ADObject @Splat
                     } catch {
-                        Write-Warning "Get-GPOZaurrLink - Processing error $($_.Exception.Message)"
+                        Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                    }
+                    foreach ($_ in $ADObjectGPO) {
+                        $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        foreach ($OutputGPO in $OutputGPOs) {
+                            if (-not $SkipDuplicates) {
+                                $OutputGPO
+                            } else {
+                                $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                    $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                    $OutputGPO
+                                }
+                            }
+                        }
                     }
                 }
             }

Public/Get-GPOZaurrLinkSummary.ps1

@@ -0,0 +1,164 @@
+function Get-GPOZaurrLinkSummary {
+    [cmdletBinding()]
+    param(
+        [ValidateSet('All', 'MultipleLinks', 'OneLink', 'LinksSummary')][string[]] $Report = 'All',
+        [switch] $UnlimitedProperties,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $HighestCount = 0 # to keep number of depth
+    $CacheSummaryLinks = [ordered] @{} # cache
+
+    # Get all links
+    $Links = Get-GPOZaurrLink -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Link in $Links) {
+        if (-not $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"]) {
+            $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"] = [System.Collections.Generic.List[System.Object]]::new()
+        }
+        $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"].Add($Link)
+    }
+
+    $ReturnObject = [ordered] @{
+        MultipleLinks = [System.Collections.Generic.List[System.Object]]::new()
+        OneLink       = [System.Collections.Generic.List[System.Object]]::new()
+        LinksSummary  = [System.Collections.Generic.List[System.Object]]::new()
+    }
+
+    foreach ($Key in $CacheSummaryLinks.Keys) {
+        $GPOs = $CacheSummaryLinks[$Key]
+
+        [Array] $LinkingSummary = foreach ($GPO in $GPOs) {
+            $SplitttedOU = ($GPO.DistinguishedName -split ',')
+            [Array] $Clean = foreach ($_ in $SplitttedOU) {
+                if ($_ -notlike 'DC=*') { $_ -replace 'OU=' }
+            }
+            if ($Clean.Count -gt $HighestCount) {
+                $HighestCount = $Clean.Count
+            }
+            if ($Clean) {
+                $Test = [ordered] @{
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = ConvertFrom-DistinguishedName -DistinguishedName $GPO.DistinguishedName -ToDomainCN
+                }
+                for ($i = 1; $i -le 10; $i++) {
+                    $Test["Level$i"] = $Clean[ - $i]
+                }
+                [PSCustomobject] $Test
+            } else {
+                $Test = [ordered] @{
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = $GPO.CanonicalName
+                }
+                for ($i = 1; $i -le 10; $i++) {
+                    $Test["Level$i"] = $null
+                }
+                [PSCustomobject] $Test
+            }
+        }
+        if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') {
+            foreach ($Link in $LinkingSummary) {
+                $ReturnObject.MultipleLinks.Add($Link)
+            }
+            #continue
+        }
+        if ($Report -eq 'OneLink' -or $Report -contains 'All') {
+            $List = [ordered] @{
+                DisplayName = $GPOs[0].DisplayName
+                Guid        = $GPOs[0].Guid
+                DomainName  = $GPOs[0].DomainName
+                LinksCount  = $GPOs.Count
+            }
+            for ($i = 0; $i -le 10; $i++) {
+                $List["Level$i"] = ($LinkingSummary."Level$i" | Select-Object -Unique).Count
+                $List["Level$($i)List"] = ($LinkingSummary."Level$i" | Select-Object -Unique)
+            }
+            $List.LinksDistinguishedName = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
+            $List.LinksCanonicalName = $GPOs.CanonicalName
+
+            $List.Owner = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
+            $List.GpoStatus = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
+            $List.Description = $GPOs[0].Description                #:
+            $List.CreationTime = $GPOs[0].CreationTime               #: 16.12.2019 21:25:32
+            $List.ModificationTime = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
+            $List.GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
+            $List.GPODistinguishedName = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
+
+            $ReturnObject.OneLink.Add( [PSCustomObject] $List)
+        }
+        if ($Report -eq 'LinksSummary' -or $Report -contains 'All') {
+            $Output = [PSCustomObject] @{
+                DisplayName                = $GPOs[0].DisplayName                #: COMPUTERS | LAPS
+                Guid                       = $GPOs[0].Guid                       #: AA782787 - 002B-4B8C-886F-05873F2DC0CA
+                DomainName                 = $GPOs[0].DomainName                 #: ad.evotec.xyz
+                LinksCount                 = $GPOs.Count
+                LinksDistinguishedName     = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
+                LinksCanonicalName         = $GPOs.CanonicalName              #: ad.evotec.xyz / ITR02 / Computers
+                Owner                      = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
+                GpoStatus                  = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
+                Description                = $GPOs[0].Description                #:
+                CreationTime               = $GPOs[0].CreationTime               #: 16.12.2019 21:25:32
+                ModificationTime           = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
+                GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
+                GPODistinguishedName       = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
+            }
+            $ReturnObject.LinksSummary.Add($Output)
+        }
+    }
+    # Processing output
+    if (-not $UnlimitedProperties) {
+        if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') {
+            $Properties = @(
+                'DisplayName'
+                'DomainName'
+                'GUID'
+                for ($i = 0; $i -le $HighestCount; $i++) {
+                    "Level$i"
+                }
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
+            )
+            $ReturnObject.MultipleLinks = $ReturnObject.MultipleLinks | Select-Object -Property $Properties
+        }
+        if ($Report -contains 'OneLink' -or $Report -contains 'All') {
+            $Properties = @(
+                'DisplayName'
+                'DomainName'
+                'GUID'
+                for ($i = 0; $i -le $HighestCount; $i++) {
+                    "Level$i"
+                    "Level$($i)List"
+                }
+                'LinksDistinguishedName'
+                'LinksCanonicalName'
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
+            )
+            $ReturnObject.OneLink = $ReturnObject.OneLink | Select-Object -Property $Properties
+        }
+        #if ($Report -contains 'LinksSummary' -or $Report -contains 'All') {
+        # Not needed because there's no dynamic properties, but if there would be we need to uncomment and fix it
+        #}
+    }
+    if ($Report.Count -eq 1 -and $Report -notcontains 'All') {
+        $ReturnObject["$Report"]
+    } else {
+        $ReturnObject
+    }
+}

Public/Get-GPOZaurrPermission.ps1

@@ -71,6 +71,7 @@
                     Server      = $QueryServer
                     ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / Name: $GPOName) with:"
             } elseif ($GPOGuid) {
                 $getGPOSplat = @{
                     Guid        = $GPOGuid
@@ -78,6 +79,7 @@
                     Server      = $QueryServer
                     ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / GUID: $GPOGuid) with:"
             } else {
                 $getGPOSplat = @{
                     All         = $true
@@ -85,48 +87,58 @@
                     Server      = $QueryServer
                     ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / All: $True) with:"
             }
-            Get-GPO @getGPOSplat | ForEach-Object -Process {
-                $GPOSecurity = $_.GetSecurityInfo()
-                $getPrivPermissionSplat = @{
-                    Principal                 = $Principal
-                    PrincipalType             = $PrincipalType
-                    PermitType                = $PermitType
-                    Accounts                  = $Accounts
-                    Type                      = $Type
-                    GPO                       = $_
-                    SkipWellKnown             = $SkipWellKnown.IsPresent
-                    SkipAdministrative        = $SkipAdministrative.IsPresent
-                    IncludeOwner              = $IncludeOwner.IsPresent
-                    IncludeGPOObject          = $IncludeGPOObject.IsPresent
-                    IncludePermissionType     = $IncludePermissionType
-                    ExcludePermissionType     = $ExcludePermissionType
-                    ExcludePrincipal          = $ExcludePrincipal
-                    ExcludePrincipalType      = $ExcludePrincipalType
-                    ADAdministrativeGroups    = $ADAdministrativeGroups
-                    ExtendedForestInformation = $ForestInformation
-                    SecurityRights            = $GPOSecurity
-                }
-                $Output = Get-PrivPermission @getPrivPermissionSplat
-                if (-not $Output) {
-                    if ($ReturnSecurityWhenNoData) {
-                        # there is no data to return, but we need to have GPO information to process ADD permissions.
-                        $ReturnObject = [PSCustomObject] @{
-                            DisplayName      = $_.DisplayName #      : ALL | Enable RDP
-                            GUID             = $_.ID
-                            DomainName       = $_.DomainName  #      : ad.evotec.xyz
-                            Enabled          = $_.GpoStatus
-                            Description      = $_.Description
-                            CreationDate     = $_.CreationTime
-                            ModificationTime = $_.ModificationTime
-                            GPOObject        = $_
-                            GPOSecurity      = $GPOSecurity
-                        }
-                        $ReturnObject
+            Try {
+                Get-GPO @getGPOSplat | ForEach-Object -Process {
+                    $GPOSecurity = $_.GetSecurityInfo()
+                    $getPrivPermissionSplat = @{
+                        Principal                 = $Principal
+                        PrincipalType             = $PrincipalType
+                        PermitType                = $PermitType
+                        Accounts                  = $Accounts
+                        Type                      = $Type
+                        GPO                       = $_
+                        SkipWellKnown             = $SkipWellKnown.IsPresent
+                        SkipAdministrative        = $SkipAdministrative.IsPresent
+                        IncludeOwner              = $IncludeOwner.IsPresent
+                        IncludeGPOObject          = $IncludeGPOObject.IsPresent
+                        IncludePermissionType     = $IncludePermissionType
+                        ExcludePermissionType     = $ExcludePermissionType
+                        ExcludePrincipal          = $ExcludePrincipal
+                        ExcludePrincipalType      = $ExcludePrincipalType
+                        ADAdministrativeGroups    = $ADAdministrativeGroups
+                        ExtendedForestInformation = $ForestInformation
+                        SecurityRights            = $GPOSecurity
+                    }
+                    try {
+                        $Output = Get-PrivPermission @getPrivPermissionSplat
+                    } catch {
+                        $Output = $null
+                        Write-Warning "Get-GPOZaurrPermission - Error running Get-PrivPermission: $($_.Exception.Message)"
+                    }
+                    if (-not $Output) {
+                        if ($ReturnSecurityWhenNoData) {
+                            # there is no data to return, but we need to have GPO information to process ADD permissions.
+                            $ReturnObject = [PSCustomObject] @{
+                                DisplayName      = $_.DisplayName #      : ALL | Enable RDP
+                                GUID             = $_.ID
+                                DomainName       = $_.DomainName  #      : ad.evotec.xyz
+                                Enabled          = $_.GpoStatus
+                                Description      = $_.Description
+                                CreationDate     = $_.CreationTime
+                                ModificationTime = $_.ModificationTime
+                                GPOObject        = $_
+                                GPOSecurity      = $GPOSecurity
+                            }
+                            $ReturnObject
+                        }
+                    } else {
+                        $Output
                     }
-                } else {
-                    $Output
                 }
+            } catch {
+                Write-Warning "Get-GPOZaurrPermission - $TextForError $($_.Exception.Message)"
             }
         }
     }

Public/Invoke-GPOZaurrPermission.ps1

@@ -6,27 +6,38 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [parameter(Position = 0)]
         [scriptblock] $PermissionRules,
 
+        # ParameterSet1
         [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
 
+        # ParameterSet2
         [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
 
+        # ParameterSet3
+        [parameter(ParameterSetName = 'Level', Mandatory)][int] $Level,
+        [parameter(ParameterSetName = 'Level', Mandatory)][int] $Limit,
 
+        # ParameterSet4
         [parameter(ParameterSetName = 'Linked', Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
 
+        # ParameterSet5
         [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
 
+        # ParameterSet6
         [parameter(ParameterSetName = 'Filter')][string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')",
         [parameter(ParameterSetName = 'Filter')][string] $SearchBase,
         [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
 
+        # All other paramerrs are for for all parametersets
         [Parameter(ParameterSetName = 'GPOGUID')]
         [Parameter(ParameterSetName = 'GPOName')]
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'All')][string[]] $Type,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -34,6 +45,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [Array] $ApprovedGroups,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -41,6 +53,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('Principal')][Array] $Trustee,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -48,6 +61,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [Microsoft.GroupPolicy.GPPermissionType] $TrusteePermissionType,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -55,6 +69,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName',
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -62,6 +77,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [System.Collections.IDictionary] $GPOCache,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -69,6 +85,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('ForestName')][string] $Forest,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -76,6 +93,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [string[]] $ExcludeDomains,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -83,6 +101,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -90,7 +109,23 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
-        [System.Collections.IDictionary] $ExtendedForestInformation
+        [parameter(ParameterSetName = 'Level')]
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [switch] $LimitAdministrativeGroupsToDomain,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [switch] $SkipDuplicates
     )
     if ($PermissionRules) {
         $Rules = & $PermissionRules
@@ -99,82 +134,145 @@
         return
     }
     $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-    $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
-
-    $Splat = @{
-        Forest                    = $Forest
-        IncludeDomains            = $IncludeDomains
-        ExcludeDomains            = $ExcludeDomains
-        ExtendedForestInformation = $ForestInformation
-    }
-    if ($ADObject) {
-        $Splat['ADObject'] = $ADObject
-    } elseif ($Linked) {
-        $Splat['Linked'] = $Linked
-    } elseif ($GPOName) {
-
-    } elseif ($GPOGuid) {
-
+    if ($LimitAdministrativeGroupsToDomain) {
+        # This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
     } else {
-        if ($Filter) {
-            $Splat['Filter'] = $Filter
-        }
-        if ($SearchBase) {
-            $Splat['SearchBase'] = $SearchBase
-        }
-        if ($SearchScope) {
-            $Splat['SearchScope'] = $SearchScope
-        }
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
     }
+    if ($PSCmdlet.ParameterSetName -ne 'Level') {
+        $Splat = @{
+            Forest                    = $Forest
+            IncludeDomains            = $IncludeDomains
+            ExcludeDomains            = $ExcludeDomains
+            ExtendedForestInformation = $ForestInformation
+            SkipDuplicates            = $SkipDuplicates.IsPresent
+        }
+        if ($ADObject) {
+            $Splat['ADObject'] = $ADObject
+        } elseif ($Linked) {
+            $Splat['Linked'] = $Linked
+        } elseif ($GPOName) {
 
-    Get-GPOZaurrLink @Splat | ForEach-Object -Process {
-        $GPO = $_
-        foreach ($Rule in $Rules) {
-            if ($Rule.Action -eq 'Owner') {
-                if ($Rule.Type -eq 'Administrative') {
-                    # We check for Owner (sometimes it can be empty)
-                    if ($GPO.Owner) {
-                        $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
-                    } else {
-                        $AdministrativeGroup = $null
-                    }
-                    if (-not $AdministrativeGroup) {
-                        $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-                        Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
-                        #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
-                        Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
-                    }
-                } elseif ($Rule.Type -eq 'Default') {
-                    Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
-                    #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
-                    Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
-                }
-            } elseif ($Rule.Action -eq 'Remove') {
-                $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType
-                foreach ($Permission in $GPOPermissions) {
-                    Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
-                }
-            } elseif ($Rule.Action -eq 'Add') {
-                # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
-                $SplatPermissions = @{
-                    #Forest                    = $Forest
-                    IncludeDomains         = $GPO.DomainName
-                    #ExcludeDomains            = $ExcludeDomains
-                    #ExtendedForestInformation = $ForestInformation
+        } elseif ($GPOGuid) {
 
-                    GPOGuid                = $GPO.GUID
-                    IncludePermissionType  = $Rule.IncludePermissionType
-                    Type                   = $Rule.Type
-                    PermitType             = $Rule.PermitType
-                    Principal              = $Rule.Principal
-                    ADAdministrativeGroups = $ADAdministrativeGroups
-                }
-                if ($Rule.PrincipalType) {
-                    $SplatPermissions.PrincipalType = $Rule.PrincipalType
-                }
-                Add-GPOZaurrPermission @SplatPermissions
+        } else {
+            if ($Filter) {
+                $Splat['Filter'] = $Filter
+            }
+            if ($SearchBase) {
+                $Splat['SearchBase'] = $SearchBase
+            }
+            if ($SearchScope) {
+                $Splat['SearchScope'] = $SearchScope
             }
         }
-    }
 
+
+
+        Get-GPOZaurrLink @Splat | ForEach-Object -Process {
+            $GPO = $_
+            foreach ($Rule in $Rules) {
+                if ($Rule.Action -eq 'Owner') {
+                    if ($Rule.Type -eq 'Administrative') {
+                        # We check for Owner (sometimes it can be empty)
+                        if ($GPO.Owner) {
+                            $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                        } else {
+                            $AdministrativeGroup = $null
+                        }
+                        if (-not $AdministrativeGroup) {
+                            $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+                            Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
+                            #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                            Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
+                        }
+                    } elseif ($Rule.Type -eq 'Default') {
+                        Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
+                        #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
+                        Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
+                    }
+                } elseif ($Rule.Action -eq 'Remove') {
+                    $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType -ADAdministrativeGroups $ADAdministrativeGroups
+                    foreach ($Permission in $GPOPermissions) {
+                        Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
+                    }
+                } elseif ($Rule.Action -eq 'Add') {
+                    # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
+                    $SplatPermissions = @{
+                        #Forest                    = $Forest
+                        IncludeDomains         = $GPO.DomainName
+                        #ExcludeDomains            = $ExcludeDomains
+                        #ExtendedForestInformation = $ForestInformation
+
+                        GPOGuid                = $GPO.GUID
+                        IncludePermissionType  = $Rule.IncludePermissionType
+                        Type                   = $Rule.Type
+                        PermitType             = $Rule.PermitType
+                        Principal              = $Rule.Principal
+                        ADAdministrativeGroups = $ADAdministrativeGroups
+                    }
+                    if ($Rule.PrincipalType) {
+                        $SplatPermissions.PrincipalType = $Rule.PrincipalType
+                    }
+                    Add-GPOZaurrPermission @SplatPermissions
+                }
+            }
+        }
+    } else {
+        # This is special case based on different command
+        $Report = Get-GPOZaurrLinkSummary -Report OneLink
+        $AffectedGPOs = foreach ($GPO in $Report) {
+            $Property = "Level$($Level)"
+            if ($GPO."$Property" -gt $Limit) {
+                foreach ($Rule in $Rules) {
+                    if ($Rule.Action -eq 'Owner') {
+                        if ($Rule.Type -eq 'Administrative') {
+                            # We check for Owner (sometimes it can be empty)
+                            if ($GPO.Owner) {
+                                $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                            } else {
+                                $AdministrativeGroup = $null
+                            }
+                            if (-not $AdministrativeGroup) {
+                                $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+                                Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
+                                #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                                Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
+                            }
+                        } elseif ($Rule.Type -eq 'Default') {
+                            Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
+                            #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
+                            Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
+                        }
+                    } elseif ($Rule.Action -eq 'Remove') {
+                        $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType -ADAdministrativeGroups $ADAdministrativeGroups
+                        foreach ($Permission in $GPOPermissions) {
+                            Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
+                        }
+                    } elseif ($Rule.Action -eq 'Add') {
+                        # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
+                        $SplatPermissions = @{
+                            #Forest                    = $Forest
+                            IncludeDomains         = $GPO.DomainName
+                            #ExcludeDomains            = $ExcludeDomains
+                            #ExtendedForestInformation = $ForestInformation
+
+                            GPOGuid                = $GPO.GUID
+                            IncludePermissionType  = $Rule.IncludePermissionType
+                            Type                   = $Rule.Type
+                            PermitType             = $Rule.PermitType
+                            Principal              = $Rule.Principal
+                            ADAdministrativeGroups = $ADAdministrativeGroups
+                        }
+                        if ($Rule.PrincipalType) {
+                            $SplatPermissions.PrincipalType = $Rule.PrincipalType
+                        }
+                        Add-GPOZaurrPermission @SplatPermissions
+                    }
+                }
+            }
+        }
+        $AffectedGPOs
+    }
 }

README.md

@@ -39,5 +39,29 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
-- 0.0.1 - Unreleased
+- 0.0.45 - 26.06.2020
+  - During publishing ADEssentials required functions are now merged to prevent cyclic dependency bug [Using ModuleSpec syntax in RequiredModules causes incorrect "cyclic dependency" failures](https://github.com/PowerShell/PowerShell/issues/2607)
+- 0.0.44 - 24.06.2020
+  - Improvement to `Get-GPOZaurrLinkSummary`
+- 0.0.43 - 21.06.2020
+  - Added `Get-GPOZaurrFiles` to list files on NETLOGON/SYSVOL shares with a lot of details
+- 0.0.42 - 19.06.2020
+  - Fix for `Get-GPOZaurrLink` and `SearchBase` parameter
+  - Fix for `Get-GPOZaurrLink` - canonical link Trim() throwing errors if empty
+- 0.0.41 - 18.06.2020
+  - Added paramerter `SkipDuplicates` to `Invoke-GPOZaurrPermission` which prevents applying permissions over and over again if 1 GPO is linked to a multiple OU's within another OU
+- 0.0.40 - 18.06.2020
+  - Fix for error `Get-GPOZaurrLink` - same issue as described on my [earlier blog - Get-ADObject : The server has returned the following error: invalid enumeration context.](https://evotec.xyz/get-adobject-the-server-has-returned-the-following-error-invalid-enumeration-context/).
+    - `WARNING: Get-GPOZaurrLink - Processing error The server has returned the following error: invalid enumeration context.`
+    - `WARNING: Get-GPOZaurrLink - Processing error A referral was returned from the server`
+  - Added `SkipDuplicates` for `Get-GPOZaurrLink`
+- 0.0.39 - 17.06.2020
+  - Updates to `Invoke-GPOZaurrPermission` with new parameter `LimitAdministrativeGroupsToDomain`
+    - This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)
+- 0.0.38 - 17.06.2020
+  - Update to Get-PrivGPOZaurrLink which would cause problems to `Invoke-GPOZaurrPermission` if it would be run without Administrative permission and GPO wouldn't be accessible for that user
+- 0.0.37 - 16.06.2020
+  - Updates to `Invoke-GPOZaurrPermission` with new parameterset `Level`
+  - Updates to `Get-GPOZaurrLinkSummary`
+- 0.0.36 - 15.06.2020
   - Initial release