Update

.github/FUNDING.yml

@@ -1,7 +1,4 @@
 # These are supported funding model platforms
 
 github: PrzemyslawKlys
-patreon: przemyslawklys
-ko_fi: przemyslawklys
-open_collective: evotec
 custom: https://paypal.me/PrzemyslawKlys

Examples/Example-14-ListingGPOsPerOU3.ps1

@@ -1,5 +1,5 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-Get-ADOrganizationalUnit -Filter * -Properties distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
-Get-ADObject -Filter * -Properties distinguishedName, gplink -Server 'ad.evotec.pl' | Get-GPOZaurrLink | Format-Table -AutoSize
+#Get-ADOrganizationalUnit -Filter * -Properties distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
+#Get-ADObject -Filter * -Properties distinguishedName, gplink -Server 'ad.evotec.pl' | Get-GPOZaurrLink | Format-Table -AutoSize
 Get-GPOZaurrLink | Format-Table -AutoSize

Examples/Example-14-ListingGPOsPerOU4.ps1

@@ -1,3 +1,3 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-Get-GPOZaurrLink -Linked 'Root' -IncludeDomains 'ad.evotec.pl' | ft
+Get-GPOZaurrLink -Linked 'Root' -IncludeDomains 'ad.evotec.pl' | Format-Table

Examples/Example-14-ListingGPOsPerOURemoveDuplicates.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -Verbose | Format-Table -a *
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -SkipDuplicates | Format-Table -a *

Examples/Example-16-KeepPermissions.ps1

@@ -8,7 +8,6 @@ Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.xyz'
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
 } -WhatIf
 
-
 # Apply perrmissions for Domain Controllers
 Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
     Set-GPOOwner -Type Administrative

Examples/Example-16-KeepPermissions02.ps1

@@ -6,7 +6,7 @@ Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.pl' {
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} -WhatIf
+} -WhatIf -SkipDuplicates
 
 
 # Apply perrmissions for Domain Controllers
@@ -15,7 +15,7 @@ Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} -WhatIf
+} -WhatIf -SkipDuplicates
 
 # Apply permissions for Regions, with exclusions for those 4 groups
 $Exclude = @(
@@ -27,7 +27,8 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz'
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} #-WhatIf
+} -WhatIf -SkipDuplicates
+
 
 $Exclude = @(
     'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
@@ -40,4 +41,4 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz'
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} #-WhatIf
+} -WhatIf -SkipDuplicates

Examples/Example-16-KeepPermissions03.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This is a bit special - I would read blog post before running this
+Invoke-GPOZaurrPermission -Verbose -Level 1 -Limit 1 {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf

Examples/Example-24-Links02.ps1

@@ -0,0 +1,12 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Report = Get-GPOZaurrLinkSummary -Report OneLink
+$Report | Format-Table
+$AffectedGPOs = foreach ($GPO in $Report) {
+    if ($GPO.Level1 -gt 1) {
+        $GPO
+    }
+}
+
+$AffectedGPOs | Format-Table *

GPOZaurr.psd1

@@ -7,7 +7,7 @@
     Description          = 'Group Policy Eater'
     FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.36'
+    ModuleVersion        = '0.0.41'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{

Private/Get-PrivGPOZaurrLInk.ps1

@@ -18,17 +18,25 @@
                 }
                 $Search = -join ($DomainCN, $Output['Guid'])
                 if ($GPOCache -and -not $Limited) {
-                    $Output['DisplayName'] = $GPOCache[$Search].DisplayName
-                    $Output['DomainName'] = $GPOCache[$Search].DomainName
-                    $Output['Owner'] = $GPOCache[$Search].Owner
-                    $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
-                    $Output['Description'] = $GPOCache[$Search].Description
-                    $Output['CreationTime'] = $GPOCache[$Search].CreationTime
-                    $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                    if ($GPOCache[$Search]) {
+                        $Output['DisplayName'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
                 }
-                $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
-                $Output['GPODistinguishedName'] = $_
-                [PSCustomObject] $Output
             }
         }
     } elseif ($Object.LinkedGroupPolicyObjects -and $Object.LinkedGroupPolicyObjects.Trim() -ne '') {
@@ -42,17 +50,25 @@
                 }
                 $Search = -join ($DomainCN, $Output['Guid'])
                 if ($GPOCache -and -not $Limited) {
-                    $Output['Name'] = $GPOCache[$Search].DisplayName
-                    $Output['DomainName'] = $GPOCache[$Search].DomainName
-                    $Output['Owner'] = $GPOCache[$Search].Owner
-                    $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
-                    $Output['Description'] = $GPOCache[$Search].Description
-                    $Output['CreationTime'] = $GPOCache[$Search].CreationTime
-                    $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                    if ($GPOCache[$Search]) {
+                        $Output['Name'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
                 }
-                $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
-                $Output['GPODistinguishedName'] = $_
-                [PSCustomObject] $Output
             }
         }
     }

Public/Get-GPOZaurrLink.ps1

@@ -14,6 +14,11 @@
         [parameter(ParameterSetName = 'Linked')]
         [switch] $Limited,
 
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [switch] $SkipDuplicates,
+
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
@@ -40,6 +45,7 @@
         [System.Collections.IDictionary] $ExtendedForestInformation
     )
     Begin {
+        $CacheReturnedGPOs = [ordered] @{}
         $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         if (-not $GPOCache -and -not $Limited) {
             $GPOCache = @{ }
@@ -71,8 +77,20 @@
                         #}
                         $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
                         $Splat['SearchBase'] = $SearchBase
-                        Get-ADObject @Splat | ForEach-Object -Process {
-                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        $ADObjectGPO = Get-ADObject @Splat
+                        foreach ($_ in $ADObjectGPO) {
+                            $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            foreach ($OutputGPO in $OutputGPOs) {
+                                if (-not $SkipDuplicates) {
+                                    $OutputGPO
+                                } else {
+                                    $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                    if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                        $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                        $OutputGPO
+                                    }
+                                }
+                            }
                         }
                     }
                     if ($Linked -contains 'Root') {
@@ -83,8 +101,20 @@
                         # }
                         $Splat['Filter'] = "objectClass -eq 'domainDNS'"
                         $Splat['SearchBase'] = $SearchBase
-                        Get-ADObject @Splat | ForEach-Object -Process {
-                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        $ADObjectGPO = Get-ADObject @Splat
+                        foreach ($_ in $ADObjectGPO) {
+                            $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            foreach ($OutputGPO in $OutputGPOs) {
+                                if (-not $SkipDuplicates) {
+                                    $OutputGPO
+                                } else {
+                                    $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                    if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                        $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                        $OutputGPO
+                                    }
+                                }
+                            }
                         }
                     }
                     if ($Linked -contains 'Site') {
@@ -97,7 +127,8 @@
                             #}
                             $Splat['Filter'] = "(objectClass -eq 'site')"
                             $Splat['SearchBase'] = $SearchBase
-                            Get-ADObject @Splat | ForEach-Object -Process {
+                            $ADObjectGPO = Get-ADObject @Splat
+                            foreach ($_ in $ADObjectGPO) {
                                 Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
                             }
                         }
@@ -110,13 +141,25 @@
                         #}
                         $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
                         $Splat['SearchBase'] = $SearchBase
-                        Get-ADObject @Splat | ForEach-Object -Process {
+                        $ADObjectGPO = Get-ADObject @Splat
+                        foreach ($_ in $ADObjectGPO) {
                             if ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) {
                                 # other skips Domain Root
                             } elseif ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']) {
                                 # other skips Domain Controllers
                             } else {
-                                Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                                $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                                foreach ($OutputGPO in $OutputGPOs) {
+                                    if (-not $SkipDuplicates) {
+                                        $OutputGPO
+                                    } else {
+                                        $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                        if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                            $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                            $OutputGPO
+                                        }
+                                    }
+                                }
                             }
                         }
                     }
@@ -143,8 +186,20 @@
                     }
 
                     try {
-                        Get-ADObject @Splat | ForEach-Object {
-                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        $ADObjectGPO = Get-ADObject @Splat
+                        foreach ($_ in $ADObjectGPO) {
+                            $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            foreach ($OutputGPO in $OutputGPOs) {
+                                if (-not $SkipDuplicates) {
+                                    $OutputGPO
+                                } else {
+                                    $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                    if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                        $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                        $OutputGPO
+                                    }
+                                }
+                            }
                         }
                     } catch {
                         Write-Warning "Get-GPOZaurrLink - Processing error $($_.Exception.Message)"

Public/Get-GPOZaurrLinkSummary.ps1

@@ -35,9 +35,10 @@
             }
             if ($Clean) {
                 $Test = [ordered] @{
-                    GPOName = $GPO.DisplayName
-                    #Test    = $GPO.DistinguishedName
-                    Level0  = ConvertFrom-DistinguishedName -DistinguishedName $GPO.DistinguishedName -ToDomainCN
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = ConvertFrom-DistinguishedName -DistinguishedName $GPO.DistinguishedName -ToDomainCN
                 }
                 for ($i = 1; $i -le 10; $i++) {
                     $Test["Level$i"] = $Clean[ - $i]
@@ -45,9 +46,10 @@
                 [PSCustomobject] $Test
             } else {
                 $Test = [ordered] @{
-                    GPOName = $GPO.DisplayName
-                    #Test    = $GPO.DistinguishedName
-                    Level0  = $GPO.CanonicalName
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = $GPO.CanonicalName
                 }
                 for ($i = 1; $i -le 10; $i++) {
                     $Test["Level$i"] = $null
@@ -63,39 +65,36 @@
         }
         if ($Report -eq 'OneLink' -or $Report -contains 'All') {
             $List = [ordered] @{
-                GPOName    = $GPO.DisplayName
-                DomainName = $GPO.DomainName
-                LinksCount = $GPOs.Count
+                DisplayName = $GPOs[0].DisplayName
+                Guid        = $GPOs[0].Guid
+                DomainName  = $GPOs[0].DomainName
+                LinksCount  = $GPOs.Count
             }
             for ($i = 0; $i -le 10; $i++) {
                 $List["Level$i"] = ($LinkingSummary."Level$i" | Select-Object -Unique).Count
                 $List["Level$($i)List"] = ($LinkingSummary."Level$i" | Select-Object -Unique)
             }
-
-
-            <#
-                Level0     = ($LinkingSummary.Level0 | Select-Object -Unique).Count
-                Level0List = ($LinkingSummary.Level0 | Select-Object -Unique)
-                Level1     = ($LinkingSummary.Level1 | Select-Object -Unique).Count
-                Level1List = ($LinkingSummary.Level1 | Select-Object -Unique)
-                Level2     = ($LinkingSummary.Level2 | Select-Object -Unique).Count
-                Level2List = ($LinkingSummary.Level2 | Select-Object -Unique)
-            #>
-
             $List.LinksDistinguishedName = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
             $List.LinksCanonicalName = $GPOs.CanonicalName
+
+            $List.Owner = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
+            $List.GpoStatus = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
+            $List.Description = $GPOs[0].Description                #:
+            $List.CreationTime = $GPOs[0].CreationTime               #: 16.12.2019 21:25:32
+            $List.ModificationTime = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
+            $List.GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
+            $List.GPODistinguishedName = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
+
             $ReturnObject.OneLink.Add( [PSCustomObject] $List)
         }
         if ($Report -eq 'LinksSummary' -or $Report -contains 'All') {
             $Output = [PSCustomObject] @{
-                Guid                   = $GPOs[0].Guid                       #: AA782787 - 002B-4B8C-886F-05873F2DC0CA
-                DisplayName            = $GPOs[0].DisplayName                #: COMPUTERS | LAPS
-                DomainName             = $GPOs[0].DomainName                 #: ad.evotec.xyz
-                LinksCount             = $GPOs.Count
-                LinksDistinguishedName = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
-                LinksCanonicalName     = $GPOs.CanonicalName              #: ad.evotec.xyz / ITR02 / Computers
-                #LinkSummary = $LinkingSummary
-                <#
+                DisplayName                = $GPOs[0].DisplayName                #: COMPUTERS | LAPS
+                Guid                       = $GPOs[0].Guid                       #: AA782787 - 002B-4B8C-886F-05873F2DC0CA
+                DomainName                 = $GPOs[0].DomainName                 #: ad.evotec.xyz
+                LinksCount                 = $GPOs.Count
+                LinksDistinguishedName     = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
+                LinksCanonicalName         = $GPOs.CanonicalName              #: ad.evotec.xyz / ITR02 / Computers
                 Owner                      = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
                 GpoStatus                  = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
                 Description                = $GPOs[0].Description                #:
@@ -103,7 +102,6 @@
                 ModificationTime           = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
                 GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
                 GPODistinguishedName       = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
-                #>
             }
             $ReturnObject.LinksSummary.Add($Output)
         }
@@ -112,40 +110,46 @@
     if (-not $UnlimitedProperties) {
         if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') {
             $Properties = @(
-                'GPOName'
+                'DisplayName'
+                'DomainName'
+                'GUID'
                 for ($i = 0; $i -le $HighestCount; $i++) {
                     "Level$i"
                 }
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
             )
             $ReturnObject.MultipleLinks = $ReturnObject.MultipleLinks | Select-Object -Property $Properties
         }
         if ($Report -contains 'OneLink' -or $Report -contains 'All') {
             $Properties = @(
-                'GPOName'
+                'DisplayName'
                 'DomainName'
+                'GUID'
                 for ($i = 0; $i -le $HighestCount; $i++) {
                     "Level$i"
                     "Level$($i)List"
                 }
                 'LinksDistinguishedName'
                 'LinksCanonicalName'
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
             )
             $ReturnObject.OneLink = $ReturnObject.OneLink | Select-Object -Property $Properties
         }
-        if ($Report -contains 'LinksSummary' -or $Report -contains 'All') {
-            # Not needed because there's no dynamic properties, but if there would be we need to uncomment and fix it
-            <#
-            $Properties = @(
-                'Guid'
-                'DisplayName'
-                'DomainName'
-                'LinksCount'
-                'LinksDistinguishedName'
-                'LinksCanonicalName'
-            )
-            $ReturnObject.LinksSummary = $ReturnObject.LinksSummary | Select-Object -Property $Properties
-            #>
-        }
+        #if ($Report -contains 'LinksSummary' -or $Report -contains 'All') {
+        # Not needed because there's no dynamic properties, but if there would be we need to uncomment and fix it
+        #}
     }
     if ($Report.Count -eq 1 -and $Report -notcontains 'All') {
         $ReturnObject["$Report"]

Public/Invoke-GPOZaurrPermission.ps1

@@ -6,27 +6,38 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [parameter(Position = 0)]
         [scriptblock] $PermissionRules,
 
+        # ParameterSet1
         [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
 
+        # ParameterSet2
         [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
 
+        # ParameterSet3
+        [parameter(ParameterSetName = 'Level', Mandatory)][int] $Level,
+        [parameter(ParameterSetName = 'Level', Mandatory)][int] $Limit,
 
+        # ParameterSet4
         [parameter(ParameterSetName = 'Linked', Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
 
+        # ParameterSet5
         [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
 
+        # ParameterSet6
         [parameter(ParameterSetName = 'Filter')][string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')",
         [parameter(ParameterSetName = 'Filter')][string] $SearchBase,
         [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
 
+        # All other paramerrs are for for all parametersets
         [Parameter(ParameterSetName = 'GPOGUID')]
         [Parameter(ParameterSetName = 'GPOName')]
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'All')][string[]] $Type,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -34,6 +45,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [Array] $ApprovedGroups,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -41,6 +53,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('Principal')][Array] $Trustee,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -48,6 +61,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [Microsoft.GroupPolicy.GPPermissionType] $TrusteePermissionType,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -55,6 +69,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName',
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -62,6 +77,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [System.Collections.IDictionary] $GPOCache,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -69,6 +85,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('ForestName')][string] $Forest,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -76,6 +93,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [string[]] $ExcludeDomains,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -83,6 +101,7 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
 
         [Parameter(ParameterSetName = 'GPOGUID')]
@@ -90,7 +109,23 @@
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
-        [System.Collections.IDictionary] $ExtendedForestInformation
+        [parameter(ParameterSetName = 'Level')]
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [switch] $LimitAdministrativeGroupsToDomain,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [switch] $SkipDuplicates
     )
     if ($PermissionRules) {
         $Rules = & $PermissionRules
@@ -99,82 +134,145 @@
         return
     }
     $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-    $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
-
-    $Splat = @{
-        Forest                    = $Forest
-        IncludeDomains            = $IncludeDomains
-        ExcludeDomains            = $ExcludeDomains
-        ExtendedForestInformation = $ForestInformation
-    }
-    if ($ADObject) {
-        $Splat['ADObject'] = $ADObject
-    } elseif ($Linked) {
-        $Splat['Linked'] = $Linked
-    } elseif ($GPOName) {
-
-    } elseif ($GPOGuid) {
-
+    if ($LimitAdministrativeGroupsToDomain) {
+        # This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
     } else {
-        if ($Filter) {
-            $Splat['Filter'] = $Filter
-        }
-        if ($SearchBase) {
-            $Splat['SearchBase'] = $SearchBase
-        }
-        if ($SearchScope) {
-            $Splat['SearchScope'] = $SearchScope
-        }
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
     }
+    if ($PSCmdlet.ParameterSetName -ne 'Level') {
+        $Splat = @{
+            Forest                    = $Forest
+            IncludeDomains            = $IncludeDomains
+            ExcludeDomains            = $ExcludeDomains
+            ExtendedForestInformation = $ForestInformation
+            SkipDuplicates            = $SkipDuplicates.IsPresent
+        }
+        if ($ADObject) {
+            $Splat['ADObject'] = $ADObject
+        } elseif ($Linked) {
+            $Splat['Linked'] = $Linked
+        } elseif ($GPOName) {
 
-    Get-GPOZaurrLink @Splat | ForEach-Object -Process {
-        $GPO = $_
-        foreach ($Rule in $Rules) {
-            if ($Rule.Action -eq 'Owner') {
-                if ($Rule.Type -eq 'Administrative') {
-                    # We check for Owner (sometimes it can be empty)
-                    if ($GPO.Owner) {
-                        $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
-                    } else {
-                        $AdministrativeGroup = $null
-                    }
-                    if (-not $AdministrativeGroup) {
-                        $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-                        Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
-                        #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
-                        Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
-                    }
-                } elseif ($Rule.Type -eq 'Default') {
-                    Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
-                    #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
-                    Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
-                }
-            } elseif ($Rule.Action -eq 'Remove') {
-                $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType
-                foreach ($Permission in $GPOPermissions) {
-                    Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
-                }
-            } elseif ($Rule.Action -eq 'Add') {
-                # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
-                $SplatPermissions = @{
-                    #Forest                    = $Forest
-                    IncludeDomains         = $GPO.DomainName
-                    #ExcludeDomains            = $ExcludeDomains
-                    #ExtendedForestInformation = $ForestInformation
+        } elseif ($GPOGuid) {
 
-                    GPOGuid                = $GPO.GUID
-                    IncludePermissionType  = $Rule.IncludePermissionType
-                    Type                   = $Rule.Type
-                    PermitType             = $Rule.PermitType
-                    Principal              = $Rule.Principal
-                    ADAdministrativeGroups = $ADAdministrativeGroups
-                }
-                if ($Rule.PrincipalType) {
-                    $SplatPermissions.PrincipalType = $Rule.PrincipalType
-                }
-                Add-GPOZaurrPermission @SplatPermissions
+        } else {
+            if ($Filter) {
+                $Splat['Filter'] = $Filter
+            }
+            if ($SearchBase) {
+                $Splat['SearchBase'] = $SearchBase
+            }
+            if ($SearchScope) {
+                $Splat['SearchScope'] = $SearchScope
             }
         }
-    }
 
+
+
+        Get-GPOZaurrLink @Splat | ForEach-Object -Process {
+            $GPO = $_
+            foreach ($Rule in $Rules) {
+                if ($Rule.Action -eq 'Owner') {
+                    if ($Rule.Type -eq 'Administrative') {
+                        # We check for Owner (sometimes it can be empty)
+                        if ($GPO.Owner) {
+                            $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                        } else {
+                            $AdministrativeGroup = $null
+                        }
+                        if (-not $AdministrativeGroup) {
+                            $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+                            Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
+                            #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                            Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
+                        }
+                    } elseif ($Rule.Type -eq 'Default') {
+                        Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
+                        #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
+                        Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
+                    }
+                } elseif ($Rule.Action -eq 'Remove') {
+                    $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType -ADAdministrativeGroups $ADAdministrativeGroups
+                    foreach ($Permission in $GPOPermissions) {
+                        Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
+                    }
+                } elseif ($Rule.Action -eq 'Add') {
+                    # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
+                    $SplatPermissions = @{
+                        #Forest                    = $Forest
+                        IncludeDomains         = $GPO.DomainName
+                        #ExcludeDomains            = $ExcludeDomains
+                        #ExtendedForestInformation = $ForestInformation
+
+                        GPOGuid                = $GPO.GUID
+                        IncludePermissionType  = $Rule.IncludePermissionType
+                        Type                   = $Rule.Type
+                        PermitType             = $Rule.PermitType
+                        Principal              = $Rule.Principal
+                        ADAdministrativeGroups = $ADAdministrativeGroups
+                    }
+                    if ($Rule.PrincipalType) {
+                        $SplatPermissions.PrincipalType = $Rule.PrincipalType
+                    }
+                    Add-GPOZaurrPermission @SplatPermissions
+                }
+            }
+        }
+    } else {
+        # This is special case based on different command
+        $Report = Get-GPOZaurrLinkSummary -Report OneLink
+        $AffectedGPOs = foreach ($GPO in $Report) {
+            $Property = "Level$($Level)"
+            if ($GPO."$Property" -gt $Limit) {
+                foreach ($Rule in $Rules) {
+                    if ($Rule.Action -eq 'Owner') {
+                        if ($Rule.Type -eq 'Administrative') {
+                            # We check for Owner (sometimes it can be empty)
+                            if ($GPO.Owner) {
+                                $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                            } else {
+                                $AdministrativeGroup = $null
+                            }
+                            if (-not $AdministrativeGroup) {
+                                $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+                                Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
+                                #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                                Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
+                            }
+                        } elseif ($Rule.Type -eq 'Default') {
+                            Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
+                            #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
+                            Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
+                        }
+                    } elseif ($Rule.Action -eq 'Remove') {
+                        $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType -ADAdministrativeGroups $ADAdministrativeGroups
+                        foreach ($Permission in $GPOPermissions) {
+                            Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
+                        }
+                    } elseif ($Rule.Action -eq 'Add') {
+                        # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
+                        $SplatPermissions = @{
+                            #Forest                    = $Forest
+                            IncludeDomains         = $GPO.DomainName
+                            #ExcludeDomains            = $ExcludeDomains
+                            #ExtendedForestInformation = $ForestInformation
+
+                            GPOGuid                = $GPO.GUID
+                            IncludePermissionType  = $Rule.IncludePermissionType
+                            Type                   = $Rule.Type
+                            PermitType             = $Rule.PermitType
+                            Principal              = $Rule.Principal
+                            ADAdministrativeGroups = $ADAdministrativeGroups
+                        }
+                        if ($Rule.PrincipalType) {
+                            $SplatPermissions.PrincipalType = $Rule.PrincipalType
+                        }
+                        Add-GPOZaurrPermission @SplatPermissions
+                    }
+                }
+            }
+        }
+        $AffectedGPOs
+    }
 }

README.md

@@ -39,5 +39,20 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
+- 0.0.41 - 18.06.2020
+  - Added paramerter `SkipDuplicates` to `Invoke-GPOZaurrPermission` which prevents applying permissions over and over again if 1 GPO is linked to a multiple OU's within another OU
+- 0.0.40 - 18.06.2020
+  - Fix for error `Get-GPOZaurrLink` - same issue as described on my [earlier blog - Get-ADObject : The server has returned the following error: invalid enumeration context.](https://evotec.xyz/get-adobject-the-server-has-returned-the-following-error-invalid-enumeration-context/).
+    - `WARNING: Get-GPOZaurrLink - Processing error The server has returned the following error: invalid enumeration context.`
+    - `WARNING: Get-GPOZaurrLink - Processing error A referral was returned from the server`
+  - Added `SkipDuplicates` for `Get-GPOZaurrLink`
+- 0.0.39 - 17.06.2020
+  - Updates to `Invoke-GPOZaurrPermission` with new parameter `LimitAdministrativeGroupsToDomain`
+    - This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)
+- 0.0.38 - 17.06.2020
+  - Update to Get-PrivGPOZaurrLink which would cause problems to `Invoke-GPOZaurrPermission` if it would be run without Administrative permission and GPO wouldn't be accessible for that user
+- 0.0.37 - 16.06.2020
+  - Updates to `Invoke-GPOZaurrPermission` with new parameterset `Level`
+  - Updates to `Get-GPOZaurrLinkSummary`
 - 0.0.36 - 15.06.2020
   - Initial release