Update

Examples/Example-16-KeepPermissions.ps1

@@ -8,7 +8,6 @@ Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.xyz'
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
 } -WhatIf
 
-
 # Apply perrmissions for Domain Controllers
 Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
     Set-GPOOwner -Type Administrative

GPOZaurr.psd1

@@ -7,7 +7,7 @@
     Description          = 'Group Policy Eater'
     FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.37'
+    ModuleVersion        = '0.0.39'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{

Private/Get-PrivGPOZaurrLInk.ps1

@@ -18,17 +18,25 @@
                 }
                 $Search = -join ($DomainCN, $Output['Guid'])
                 if ($GPOCache -and -not $Limited) {
-                    $Output['DisplayName'] = $GPOCache[$Search].DisplayName
-                    $Output['DomainName'] = $GPOCache[$Search].DomainName
-                    $Output['Owner'] = $GPOCache[$Search].Owner
-                    $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
-                    $Output['Description'] = $GPOCache[$Search].Description
-                    $Output['CreationTime'] = $GPOCache[$Search].CreationTime
-                    $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                    if ($GPOCache[$Search]) {
+                        $Output['DisplayName'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
                 }
-                $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
-                $Output['GPODistinguishedName'] = $_
-                [PSCustomObject] $Output
             }
         }
     } elseif ($Object.LinkedGroupPolicyObjects -and $Object.LinkedGroupPolicyObjects.Trim() -ne '') {
@@ -42,17 +50,25 @@
                 }
                 $Search = -join ($DomainCN, $Output['Guid'])
                 if ($GPOCache -and -not $Limited) {
-                    $Output['Name'] = $GPOCache[$Search].DisplayName
-                    $Output['DomainName'] = $GPOCache[$Search].DomainName
-                    $Output['Owner'] = $GPOCache[$Search].Owner
-                    $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
-                    $Output['Description'] = $GPOCache[$Search].Description
-                    $Output['CreationTime'] = $GPOCache[$Search].CreationTime
-                    $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                    if ($GPOCache[$Search]) {
+                        $Output['Name'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
                 }
-                $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
-                $Output['GPODistinguishedName'] = $_
-                [PSCustomObject] $Output
             }
         }
     }

Public/Invoke-GPOZaurrPermission.ps1

@@ -110,7 +110,15 @@
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
         [parameter(ParameterSetName = 'Level')]
-        [System.Collections.IDictionary] $ExtendedForestInformation
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [switch] $LimitAdministrativeGroupsToDomain
     )
     if ($PermissionRules) {
         $Rules = & $PermissionRules
@@ -119,8 +127,12 @@
         return
     }
     $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-    $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
-
+    if ($LimitAdministrativeGroupsToDomain) {
+        # This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
+    } else {
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
+    }
     if ($PSCmdlet.ParameterSetName -ne 'Level') {
         $Splat = @{
             Forest                    = $Forest
@@ -173,7 +185,7 @@
                         Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
                     }
                 } elseif ($Rule.Action -eq 'Remove') {
-                    $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType
+                    $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType -ADAdministrativeGroups $ADAdministrativeGroups
                     foreach ($Permission in $GPOPermissions) {
                         Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
                     }
@@ -226,7 +238,7 @@
                             Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
                         }
                     } elseif ($Rule.Action -eq 'Remove') {
-                        $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType
+                        $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType -ADAdministrativeGroups $ADAdministrativeGroups
                         foreach ($Permission in $GPOPermissions) {
                             Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
                         }

README.md

@@ -39,6 +39,11 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
+- 0.0.39 - 17.06.2020
+  - Updates to `Invoke-GPOZaurrPermission` with new parameter `LimitAdministrativeGroupsToDomain`
+    - This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)
+- 0.0.38 - 17.06.2020
+  - Update to Get-PrivGPOZaurrLink which would cause problems to `Invoke-GPOZaurrPermission` if it would be run without Administrative permission and GPO wouldn't be accessible for that user
 - 0.0.37 - 16.06.2020
   - Updates to `Invoke-GPOZaurrPermission` with new parameterset `Level`
   - Updates to `Get-GPOZaurrLinkSummary`