Update PSD1

Added some error logging

.github/FUNDING.yml

@@ -1,7 +1,4 @@
 # These are supported funding model platforms
 
 github: PrzemyslawKlys
-patreon: przemyslawklys
-ko_fi: przemyslawklys
-open_collective: evotec
 custom: https://paypal.me/PrzemyslawKlys

Examples/Example-14-ListingGPOsPerOU3.ps1

@@ -1,5 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 Get-ADOrganizationalUnit -Filter * -Properties distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
+Get-ADOrganizationalUnit -Filter * -Properties canonicalname, distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
 Get-ADObject -Filter * -Properties distinguishedName, gplink -Server 'ad.evotec.pl' | Get-GPOZaurrLink | Format-Table -AutoSize
 Get-GPOZaurrLink | Format-Table -AutoSize

Examples/Example-14-ListingGPOsPerOU4.ps1

@@ -1,3 +1,3 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-Get-GPOZaurrLink -Linked 'Root' -IncludeDomains 'ad.evotec.pl' | ft
+Get-GPOZaurrLink -Linked 'Root' -IncludeDomains 'ad.evotec.pl' | Format-Table

Examples/Example-14-ListingGPOsPerOURemoveDuplicates.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -Verbose | Format-Table -a *
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -SkipDuplicates | Format-Table -a *

Examples/Example-16-AddRemoveGPOPermission03.ps1

@@ -1,14 +1,6 @@
 #Clear-Host
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$ApprovedGroups = @(
-    'GDS-TestGroup10'
-)
-$RootGroups = @(
-    #'przemyslaw.klys'
-)
-
-
 Invoke-GPOZaurrPermission -Linked Root -Verbose {
     Set-GPOOwner -Type Administrative
     #Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'

Examples/Example-16-AddRemoveGPOPermission04.ps1

@@ -8,4 +8,4 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=Computers,OU=Production,DC=ad
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
     #Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
     #Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
-} #-WhatIf #| Format-Table *
+} -WhatIf #| Format-Table *

Examples/Example-16-KeepPermissions.ps1

@@ -26,7 +26,7 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz'
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} #-WhatIf
+} -WhatIf
 
 $Exclude = @(
     'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
@@ -39,4 +39,4 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz'
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} #-WhatIf
+} -WhatIf

Examples/Example-16-KeepPermissions02.ps1

@@ -6,7 +6,7 @@ Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.pl' {
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} -WhatIf
+} -WhatIf -SkipDuplicates
 
 
 # Apply perrmissions for Domain Controllers
@@ -15,7 +15,7 @@ Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} -WhatIf
+} -WhatIf -SkipDuplicates
 
 # Apply permissions for Regions, with exclusions for those 4 groups
 $Exclude = @(
@@ -27,7 +27,8 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz'
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} #-WhatIf
+} -WhatIf -SkipDuplicates
+
 
 $Exclude = @(
     'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
@@ -40,4 +41,4 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz'
     Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
     Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
     Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
-} #-WhatIf
+} -WhatIf -SkipDuplicates

GPOZaurr.psd1

@@ -7,7 +7,7 @@
     Description          = 'Group Policy Eater'
     FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.39'
+    ModuleVersion        = '0.0.42'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -17,7 +17,7 @@
         }
     }
     RequiredModules      = @{
-        ModuleVersion = '0.0.147'
+        ModuleVersion = '0.0.148'
         ModuleName    = 'PSSharedGoods'
         Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
     }, @{

Private/Get-PrivGPOZaurrLInk.ps1

@@ -13,7 +13,7 @@
                 $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
                 $Output = [ordered] @{
                     DistinguishedName = $Object.DistinguishedName
-                    CanonicalName     = $Object.CanonicalName.TrimEnd('/');
+                    CanonicalName     = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
                     Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
                 }
                 $Search = -join ($DomainCN, $Output['Guid'])
@@ -45,7 +45,7 @@
                 $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
                 $Output = [ordered] @{
                     DistinguishedName = $Object.DistinguishedName
-                    CanonicalName     = $Object.CanonicalName.TrimEnd('/');
+                    CanonicalName     = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
                     Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
                 }
                 $Search = -join ($DomainCN, $Output['Guid'])

Public/Get-GPOZaurrLink.ps1

@@ -14,6 +14,11 @@
         [parameter(ParameterSetName = 'Linked')]
         [switch] $Limited,
 
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [switch] $SkipDuplicates,
+
         [parameter(ParameterSetName = 'Filter')]
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
@@ -40,6 +45,7 @@
         [System.Collections.IDictionary] $ExtendedForestInformation
     )
     Begin {
+        $CacheReturnedGPOs = [ordered] @{}
         $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         if (-not $GPOCache -and -not $Limited) {
             $GPOCache = @{ }
@@ -71,8 +77,24 @@
                         #}
                         $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
                         $Splat['SearchBase'] = $SearchBase
-                        Get-ADObject @Splat | ForEach-Object -Process {
-                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
+                            $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            foreach ($OutputGPO in $OutputGPOs) {
+                                if (-not $SkipDuplicates) {
+                                    $OutputGPO
+                                } else {
+                                    $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                    if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                        $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                        $OutputGPO
+                                    }
+                                }
+                            }
                         }
                     }
                     if ($Linked -contains 'Root') {
@@ -83,8 +105,24 @@
                         # }
                         $Splat['Filter'] = "objectClass -eq 'domainDNS'"
                         $Splat['SearchBase'] = $SearchBase
-                        Get-ADObject @Splat | ForEach-Object -Process {
-                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
+                            $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            foreach ($OutputGPO in $OutputGPOs) {
+                                if (-not $SkipDuplicates) {
+                                    $OutputGPO
+                                } else {
+                                    $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                    if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                        $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                        $OutputGPO
+                                    }
+                                }
+                            }
                         }
                     }
                     if ($Linked -contains 'Site') {
@@ -97,7 +135,12 @@
                             #}
                             $Splat['Filter'] = "(objectClass -eq 'site')"
                             $Splat['SearchBase'] = $SearchBase
-                            Get-ADObject @Splat | ForEach-Object -Process {
+                            try {
+                                $ADObjectGPO = Get-ADObject @Splat
+                            } catch {
+                                Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                            }
+                            foreach ($_ in $ADObjectGPO) {
                                 Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
                             }
                         }
@@ -110,13 +153,29 @@
                         #}
                         $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
                         $Splat['SearchBase'] = $SearchBase
-                        Get-ADObject @Splat | ForEach-Object -Process {
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
                             if ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) {
                                 # other skips Domain Root
                             } elseif ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']) {
                                 # other skips Domain Controllers
                             } else {
-                                Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                                $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                                foreach ($OutputGPO in $OutputGPOs) {
+                                    if (-not $SkipDuplicates) {
+                                        $OutputGPO
+                                    } else {
+                                        $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                        if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                            $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                            $OutputGPO
+                                        }
+                                    }
+                                }
                             }
                         }
                     }
@@ -131,7 +190,8 @@
                     }
                     if ($PSBoundParameters.ContainsKey('SearchBase')) {
                         $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
-                        if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                        $SearchBaseDC = ConvertFrom-DistinguishedName -DistinguishedName $SearchBase -ToDC
+                        if ($SearchBaseDC -ne $DomainDistinguishedName) {
                             # we check if SearchBase is part of domain distinugishname. If it isn't we skip
                             continue
                         }
@@ -143,11 +203,23 @@
                     }
 
                     try {
-                        Get-ADObject @Splat | ForEach-Object {
-                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
-                        }
+                        $ADObjectGPO = Get-ADObject @Splat
                     } catch {
-                        Write-Warning "Get-GPOZaurrLink - Processing error $($_.Exception.Message)"
+                        Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                    }
+                    foreach ($_ in $ADObjectGPO) {
+                        $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        foreach ($OutputGPO in $OutputGPOs) {
+                            if (-not $SkipDuplicates) {
+                                $OutputGPO
+                            } else {
+                                $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                    $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                    $OutputGPO
+                                }
+                            }
+                        }
                     }
                 }
             }

Public/Get-GPOZaurrPermission.ps1

@@ -71,6 +71,7 @@
                     Server      = $QueryServer
                     ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / Name: $GPOName) with:"
             } elseif ($GPOGuid) {
                 $getGPOSplat = @{
                     Guid        = $GPOGuid
@@ -78,6 +79,7 @@
                     Server      = $QueryServer
                     ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / GUID: $GPOGuid) with:"
             } else {
                 $getGPOSplat = @{
                     All         = $true
@@ -85,48 +87,58 @@
                     Server      = $QueryServer
                     ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / All: $True) with:"
             }
-            Get-GPO @getGPOSplat | ForEach-Object -Process {
-                $GPOSecurity = $_.GetSecurityInfo()
-                $getPrivPermissionSplat = @{
-                    Principal                 = $Principal
-                    PrincipalType             = $PrincipalType
-                    PermitType                = $PermitType
-                    Accounts                  = $Accounts
-                    Type                      = $Type
-                    GPO                       = $_
-                    SkipWellKnown             = $SkipWellKnown.IsPresent
-                    SkipAdministrative        = $SkipAdministrative.IsPresent
-                    IncludeOwner              = $IncludeOwner.IsPresent
-                    IncludeGPOObject          = $IncludeGPOObject.IsPresent
-                    IncludePermissionType     = $IncludePermissionType
-                    ExcludePermissionType     = $ExcludePermissionType
-                    ExcludePrincipal          = $ExcludePrincipal
-                    ExcludePrincipalType      = $ExcludePrincipalType
-                    ADAdministrativeGroups    = $ADAdministrativeGroups
-                    ExtendedForestInformation = $ForestInformation
-                    SecurityRights            = $GPOSecurity
-                }
-                $Output = Get-PrivPermission @getPrivPermissionSplat
-                if (-not $Output) {
-                    if ($ReturnSecurityWhenNoData) {
-                        # there is no data to return, but we need to have GPO information to process ADD permissions.
-                        $ReturnObject = [PSCustomObject] @{
-                            DisplayName      = $_.DisplayName #      : ALL | Enable RDP
-                            GUID             = $_.ID
-                            DomainName       = $_.DomainName  #      : ad.evotec.xyz
-                            Enabled          = $_.GpoStatus
-                            Description      = $_.Description
-                            CreationDate     = $_.CreationTime
-                            ModificationTime = $_.ModificationTime
-                            GPOObject        = $_
-                            GPOSecurity      = $GPOSecurity
-                        }
-                        $ReturnObject
+            Try {
+                Get-GPO @getGPOSplat | ForEach-Object -Process {
+                    $GPOSecurity = $_.GetSecurityInfo()
+                    $getPrivPermissionSplat = @{
+                        Principal                 = $Principal
+                        PrincipalType             = $PrincipalType
+                        PermitType                = $PermitType
+                        Accounts                  = $Accounts
+                        Type                      = $Type
+                        GPO                       = $_
+                        SkipWellKnown             = $SkipWellKnown.IsPresent
+                        SkipAdministrative        = $SkipAdministrative.IsPresent
+                        IncludeOwner              = $IncludeOwner.IsPresent
+                        IncludeGPOObject          = $IncludeGPOObject.IsPresent
+                        IncludePermissionType     = $IncludePermissionType
+                        ExcludePermissionType     = $ExcludePermissionType
+                        ExcludePrincipal          = $ExcludePrincipal
+                        ExcludePrincipalType      = $ExcludePrincipalType
+                        ADAdministrativeGroups    = $ADAdministrativeGroups
+                        ExtendedForestInformation = $ForestInformation
+                        SecurityRights            = $GPOSecurity
+                    }
+                    try {
+                        $Output = Get-PrivPermission @getPrivPermissionSplat
+                    } catch {
+                        $Output = $null
+                        Write-Warning "Get-GPOZaurrPermission - Error running Get-PrivPermission: $($_.Exception.Message)"
+                    }
+                    if (-not $Output) {
+                        if ($ReturnSecurityWhenNoData) {
+                            # there is no data to return, but we need to have GPO information to process ADD permissions.
+                            $ReturnObject = [PSCustomObject] @{
+                                DisplayName      = $_.DisplayName #      : ALL | Enable RDP
+                                GUID             = $_.ID
+                                DomainName       = $_.DomainName  #      : ad.evotec.xyz
+                                Enabled          = $_.GpoStatus
+                                Description      = $_.Description
+                                CreationDate     = $_.CreationTime
+                                ModificationTime = $_.ModificationTime
+                                GPOObject        = $_
+                                GPOSecurity      = $GPOSecurity
+                            }
+                            $ReturnObject
+                        }
+                    } else {
+                        $Output
                     }
-                } else {
-                    $Output
                 }
+            } catch {
+                Write-Warning "Get-GPOZaurrPermission - $TextForError $($_.Exception.Message)"
             }
         }
     }

Public/Invoke-GPOZaurrPermission.ps1

@@ -118,7 +118,14 @@
         [parameter(ParameterSetName = 'ADObject')]
         [parameter(ParameterSetName = 'Linked')]
         [parameter(ParameterSetName = 'Level')]
-        [switch] $LimitAdministrativeGroupsToDomain
+        [switch] $LimitAdministrativeGroupsToDomain,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [switch] $SkipDuplicates
     )
     if ($PermissionRules) {
         $Rules = & $PermissionRules
@@ -139,6 +146,7 @@
             IncludeDomains            = $IncludeDomains
             ExcludeDomains            = $ExcludeDomains
             ExtendedForestInformation = $ForestInformation
+            SkipDuplicates            = $SkipDuplicates.IsPresent
         }
         if ($ADObject) {
             $Splat['ADObject'] = $ADObject

README.md

@@ -39,6 +39,16 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
+- 0.0.42 - 19.06.2020
+  - Fix for `Get-GPOZaurrLink` and `SearchBase` parameter
+  - Fix for `Get-GPOZaurrLink` - canonical link Trim() throwing errors if empty
+- 0.0.41 - 18.06.2020
+  - Added paramerter `SkipDuplicates` to `Invoke-GPOZaurrPermission` which prevents applying permissions over and over again if 1 GPO is linked to a multiple OU's within another OU
+- 0.0.40 - 18.06.2020
+  - Fix for error `Get-GPOZaurrLink` - same issue as described on my [earlier blog - Get-ADObject : The server has returned the following error: invalid enumeration context.](https://evotec.xyz/get-adobject-the-server-has-returned-the-following-error-invalid-enumeration-context/).
+    - `WARNING: Get-GPOZaurrLink - Processing error The server has returned the following error: invalid enumeration context.`
+    - `WARNING: Get-GPOZaurrLink - Processing error A referral was returned from the server`
+  - Added `SkipDuplicates` for `Get-GPOZaurrLink`
 - 0.0.39 - 17.06.2020
   - Updates to `Invoke-GPOZaurrPermission` with new parameter `LimitAdministrativeGroupsToDomain`
     - This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)