mirror of
https://github.com/EvotecIT/GPOZaurr.git
synced 2026-07-26 20:00:09 +00:00
Compare commits
54 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Przemyslaw Klys
|
889ce5f9ab | ||
|
Przemyslaw Klys
|
ac224b41b7 | ||
|
Przemyslaw Klys
|
caaf541e91 | ||
|
Przemyslaw Klys
|
c856484932 | ||
|
Przemyslaw Klys
|
9c3ea2bbe7 | ||
|
Przemyslaw Klys
|
5071c0da07 | ||
|
Przemyslaw Klys
|
fd7c7e1b30 | ||
|
Przemyslaw Klys
|
1e3a7a78c8 | ||
|
Przemyslaw Klys
|
d3f0e04f35 | ||
|
Przemyslaw Klys
|
fe080aece9 | ||
|
Przemyslaw Klys
|
95b814f2f9 | ||
|
Przemyslaw Klys
|
59dfa34ba9 | ||
|
Przemyslaw Klys
|
9ecf092bd5 | ||
|
Przemyslaw Klys
|
e917092ac9 | ||
|
Przemyslaw Klys
|
047576ff70 | ||
|
Przemyslaw Klys
|
5d3370d546 | ||
|
Przemyslaw Klys
|
e514deca08 | ||
|
Przemyslaw Klys
|
c99c33d0fa | ||
|
Przemyslaw Klys
|
f841f41de0 | ||
|
Przemyslaw Klys
|
fb6931c5e1 | ||
|
Przemyslaw Klys
|
9a43c466b7 | ||
|
Przemyslaw Klys
|
afd99d8e67 | ||
|
Przemyslaw Klys
|
edd6dbdfa5 | ||
|
Przemyslaw Klys
|
9e837d2218 | ||
|
Przemyslaw Klys
|
9030233e18 | ||
|
Przemyslaw Klys
|
d02396f591 | ||
|
Przemyslaw Klys
|
efb1ddf056 | ||
|
Przemyslaw Klys
|
f6c5cbe901 | ||
|
Przemyslaw Klys
|
a7583508f5 | ||
|
Przemyslaw Klys
|
f73c445385 | ||
|
Przemyslaw Klys
|
de4ff8ff07 | ||
|
Przemyslaw Klys
|
7501693276 | ||
|
Przemyslaw Klys
|
e76c4d9094 | ||
|
Przemyslaw Klys
|
2f25064090 | ||
|
Przemyslaw Klys
|
97ffc8bfd5 | ||
|
Przemyslaw Klys
|
27bd83eaba | ||
|
Przemyslaw Klys
|
7cff95cc81 | ||
|
Przemyslaw Klys
|
99d489290d | ||
|
Przemyslaw Klys
|
d94bf27669 | ||
|
Przemyslaw Klys
|
570b1cbc83 | ||
|
Przemyslaw Klys
|
2286f0cb0b | ||
|
Przemyslaw Klys
|
e253bb39e0 | ||
|
Przemyslaw Klys
|
1054d8a38b | ||
|
Przemyslaw Klys
|
3874098738 | ||
|
Przemyslaw Klys
|
5d81539ba6 | ||
|
Przemyslaw Klys
|
15b467b1ff | ||
|
Przemyslaw Klys
|
75be102588 | ||
|
Przemyslaw Klys
|
dff222dbb4 | ||
|
Przemyslaw Klys
|
428776afd7 | ||
|
Przemyslaw Klys
|
2c078d3b2d | ||
|
Przemyslaw Klys
|
b8ed284648 | ||
|
Przemyslaw Klys
|
8de9c32fd1 | ||
|
Przemyslaw Klys
|
3cd490937b | ||
|
Przemyslaw Klys
|
3557ecefc2 |
@@ -1,5 +1,6 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
#Get-ADOrganizationalUnit -Filter * -Properties distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
|
||||
#Get-ADObject -Filter * -Properties distinguishedName, gplink -Server 'ad.evotec.pl' | Get-GPOZaurrLink | Format-Table -AutoSize
|
||||
Get-ADOrganizationalUnit -Filter * -Properties distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
|
||||
Get-ADOrganizationalUnit -Filter * -Properties canonicalname, distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
|
||||
Get-ADObject -Filter * -Properties distinguishedName, gplink -Server 'ad.evotec.pl' | Get-GPOZaurrLink | Format-Table -AutoSize
|
||||
Get-GPOZaurrLink | Format-Table -AutoSize
|
||||
@@ -1,14 +1,6 @@
|
||||
#Clear-Host
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
$ApprovedGroups = @(
|
||||
'GDS-TestGroup10'
|
||||
)
|
||||
$RootGroups = @(
|
||||
#'przemyslaw.klys'
|
||||
)
|
||||
|
||||
|
||||
Invoke-GPOZaurrPermission -Linked Root -Verbose {
|
||||
Set-GPOOwner -Type Administrative
|
||||
#Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'
|
||||
|
||||
@@ -8,4 +8,4 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=Computers,OU=Production,DC=ad
|
||||
Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
|
||||
#Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
|
||||
#Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
|
||||
} #-WhatIf #| Format-Table *
|
||||
} -WhatIf #| Format-Table *
|
||||
@@ -26,7 +26,7 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz'
|
||||
Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
|
||||
Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
|
||||
Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
|
||||
} #-WhatIf
|
||||
} -WhatIf
|
||||
|
||||
$Exclude = @(
|
||||
'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
|
||||
@@ -39,4 +39,4 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz'
|
||||
Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
|
||||
Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
|
||||
Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
|
||||
} #-WhatIf
|
||||
} -WhatIf
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
# this allows you to process X amount of orphaned folders/files (good for testing)
|
||||
Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf -LimitProcessing 2
|
||||
Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf -LimitProcessing 2 -IncludeDomains 'ad.evotec.xyz'
|
||||
|
||||
# this runs for whole SYSVOL and checks things against GPOS
|
||||
Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf
|
||||
Remove-GPOZaurrOrphanedSysvolFolders -Verbose -IncludeDomains 'ad.evotec.xyz' -BackupPath $Env:UserProfile\Desktop\MyBackup1 #-WhatIf
|
||||
@@ -1,3 +1,3 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
Remove-GPOZaurrLegacyFiles -Verbose -WhatIf
|
||||
Remove-GPOZaurrLegacyFiles -Verbose -BackupPath $Env:USERPROFILE\Desktop\BackupADM -BackupDated -RemoveEmptyFolders #-WhatIf #-LimitProcessing 2 -WhatIf
|
||||
@@ -0,0 +1,6 @@
|
||||
Clear-Host
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
Get-GPOZaurrFiles -Type All | Out-HtmlView -ScrollX -Filtering -AllProperties
|
||||
Get-GPOZaurrFiles -HashAlgorithm MD5 | Select-Object -First 2 | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOListFiles.xlsx -AllProperties -ExcelWorkSheetName 'Files Just 2' -AutoFilter -AutoFit #-OpenWorkBook
|
||||
Get-GPOZaurrFiles -Type All -HashAlgorithm SHA256 | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOListFiles.xlsx -AllProperties -ExcelWorkSheetName 'Files All' -AutoFilter -AutoFit #-OpenWorkBook
|
||||
@@ -0,0 +1,10 @@
|
||||
Clear-Host
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
$Output = Get-GPOZaurrSysvol | ForEach-Object {
|
||||
$Path = $_.Path
|
||||
Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File | ForEach-Object {
|
||||
Get-FileMetaData -File $_ -Signature -HashAlgorithm 'SHA256'
|
||||
}
|
||||
}
|
||||
$Output | Format-Table
|
||||
@@ -0,0 +1,4 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
#Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport -DeleteExisting
|
||||
Save-GPOZaurrFiles -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' #-DeleteExisting
|
||||
@@ -0,0 +1,34 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
|
||||
#$OutputNoTranslation = Invoke-GPOZaurr -GPOPath $Env:UserProfile\Desktop\GPOExport -NoTranslation
|
||||
#$OutputNoTranslation = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
|
||||
$OutputNoTranslation | Format-Table *
|
||||
|
||||
<#
|
||||
New-HTML {
|
||||
foreach ($GPOCategory in $OutputNoTranslation.Keys) {
|
||||
New-HTMLTab -Name $GPOCategory {
|
||||
if ($OutputNoTranslation["$GPOCategory"] -is [System.Collections.IDictionary]) {
|
||||
foreach ($GpoSettings in $OutputNoTranslation["$GPOCategory"].Keys) {
|
||||
New-HTMLTab -Name $GpoSettings {
|
||||
New-HTMLTable -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
|
||||
}
|
||||
}
|
||||
} else {
|
||||
New-HTMLTable -DataTable $OutputNoTranslation[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
|
||||
}
|
||||
}
|
||||
}
|
||||
} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-NoTranslationFromDisk.html
|
||||
|
||||
#>
|
||||
foreach ($GPOCategory in $OutputNoTranslation.Keys) {
|
||||
if ($OutputNoTranslation["$GPOCategory"] -is [System.Collections.IDictionary]) {
|
||||
foreach ($GpoSettings in $OutputNoTranslation["$GPOCategory"].Keys) {
|
||||
ConvertTo-Excel -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -AllProperties -ExcelWorkSheetName $GpoSettings -FilePath $Env:UserProfile\Desktop\Export\$GpoSettings.xlsx -AutoFilter -AutoFit
|
||||
}
|
||||
} else {
|
||||
ConvertTo-Excel -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -AllProperties -ExcelWorkSheetName $GpoSettings -FilePath $Env:UserProfile\Desktop\Export\$GpoSettings.xlsx -AutoFilter -AutoFit
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
#Invoke-GPOZaurr -OutputType Excel, Object, HTML -Open | Format-Table
|
||||
#$Output = Invoke-GPOZaurr -GPOPath $Env:USERPROFILE\Desktop\GPOExport -NoTranslation #| Format-Table
|
||||
#$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTestRegistryCheck' -NoTranslation
|
||||
$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation -Verbose
|
||||
#$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' -NoTranslation #-OutputType HTML, Object -Open #| Format-Table
|
||||
#$Output.Categories | Out-HtmlView
|
||||
#$Output.Categories | Format-Table
|
||||
$Output | Format-Table
|
||||
#$Output.CategoriesFull | Format-Table
|
||||
#$Output.Count
|
||||
|
||||
$Output.Reports | Format-Table
|
||||
#$Output.Reports.Scripts | Format-Table *
|
||||
#$Output.Reports.AccountPolicies | Format-Table *
|
||||
#$Output.Reports.Audit | Format-Table *
|
||||
#$Output.Reports.Autologon | Format-Table *
|
||||
#$Output.Reports.EventLog | Format-Table *
|
||||
#$Output.Reports.SoftwareInstallation | Format-Table *
|
||||
#$Output.Reports.Policies | Format-Table *
|
||||
#Output.Reports.RegistrySettings | Format-Table *
|
||||
#$Output.Reports.SecurityOptions | Format-Table *
|
||||
#$Output.Reports.SystemServices | Format-Table *
|
||||
#$Output.Reports.SystemServicesNT | Format-Table *
|
||||
#$Output.Reports.LocalUsers | Format-Table *
|
||||
#$Output.Reports.LocalGroups | Format-Table *
|
||||
#$Output.Reports.DriveMapping | Format-Table *
|
||||
#$Output.Reports.Printers | Format-Table *
|
||||
$Output.Reports.TaskScheduler | Format-Table *
|
||||
return
|
||||
# This is section that treats 1 GPO as single object - if there are 5 scripts in 1 GPO there's only one value
|
||||
|
||||
$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation -SingleObject
|
||||
#$Output
|
||||
#$Output.Reports | Format-Table
|
||||
#$Output.Reports.Scripts | Format-Table *
|
||||
#$Output.Reports.SoftwareInstallation | Format-Table *
|
||||
#$Output.Reports.Policies | Format-Table *
|
||||
#$Output.Reports.RegistrySettings | Format-Table *
|
||||
#$Output.Reports.SecurityOptions | Format-Table *
|
||||
#$Output.Reports.SystemServices | Format-Table *
|
||||
#$Output.Reports.SystemServicesNT | Format-Table *
|
||||
#$Output.Reports.LocalUsers | Format-Table *
|
||||
#$Output.Reports.LocalGroups | Format-Table *
|
||||
#$Output.Reports.DriveMapping | Format-Table *
|
||||
$Output.Reports.Printers | Format-Table *
|
||||
@@ -0,0 +1,20 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
$Output = Invoke-GPOZaurr #-NoTranslation
|
||||
$Output | Format-Table
|
||||
|
||||
New-HTML {
|
||||
foreach ($GPOCategory in $Output.Keys) {
|
||||
New-HTMLTab -Name $GPOCategory {
|
||||
if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
|
||||
foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
|
||||
New-HTMLTab -Name $GpoSettings {
|
||||
New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
|
||||
}
|
||||
}
|
||||
} else {
|
||||
New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
|
||||
}
|
||||
}
|
||||
}
|
||||
} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO.html
|
||||
@@ -0,0 +1,20 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
$Output = Invoke-GPOZaurr -NoTranslation
|
||||
$Output | Format-Table
|
||||
|
||||
New-HTML {
|
||||
foreach ($GPOCategory in $Output.Keys) {
|
||||
New-HTMLTab -Name $GPOCategory {
|
||||
if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
|
||||
foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
|
||||
New-HTMLTab -Name $GpoSettings {
|
||||
New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
|
||||
}
|
||||
}
|
||||
} else {
|
||||
New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
|
||||
}
|
||||
}
|
||||
}
|
||||
} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-NoTranslation.html
|
||||
@@ -0,0 +1,22 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
|
||||
|
||||
$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' # -NoTranslation
|
||||
$Output | Format-Table *
|
||||
|
||||
New-HTML {
|
||||
foreach ($GPOCategory in $Output.Keys) {
|
||||
New-HTMLTab -Name $GPOCategory {
|
||||
if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
|
||||
foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
|
||||
New-HTMLTab -Name $GpoSettings {
|
||||
New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
|
||||
}
|
||||
}
|
||||
} else {
|
||||
New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
|
||||
}
|
||||
}
|
||||
}
|
||||
} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-FromDisk.html
|
||||
@@ -0,0 +1,25 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
|
||||
|
||||
$OutputTranslation = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport'
|
||||
$OutputTranslation | Format-Table
|
||||
$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' -NoTranslation
|
||||
$Output | Format-Table *
|
||||
|
||||
#$Output.LugsSettings.LocalUsersAndGroups | Format-List *
|
||||
|
||||
$GPOEntry = $Output.LugsSettings.LocalUsersAndGroups[0]
|
||||
|
||||
$CreateGPO = @{}
|
||||
foreach ($User in $GPOEntry.User) {
|
||||
# $User | Format-Table
|
||||
# $User.Properties | Format-Table
|
||||
}
|
||||
|
||||
|
||||
foreach ($Group in $GPOEntry.Group) {
|
||||
#$Group | Format-Table
|
||||
$Group.Properties | Format-Table
|
||||
$Group.Properties.Members | Format-Table
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
|
||||
|
||||
$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
|
||||
$Output | Format-Table *
|
||||
@@ -0,0 +1,11 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
# This is purely for building GPO Dictionary, mostly for development needs to help asses what is there
|
||||
|
||||
$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
|
||||
#$Output | Format-Table *
|
||||
|
||||
$LookingFor = $Output | Select-GPOTranslation -Category 'SecuritySettings' -Settings 'UserRightsAssignment'
|
||||
$LookingFor | Format-Table
|
||||
$LookingFor.Types | Format-Table
|
||||
#$LookingFor.Data | Format-Table
|
||||
@@ -0,0 +1,4 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
$Files = Get-GPOZaurrFiles -Limited -Signature
|
||||
$Files | ConvertTo-Excel -OpenWorkBook -FilePath $Env:USERPROFILE\Desktop\GPOTesting.xlsx -ExcelWorkSheetName 'GPO Output' -AutoFilter -AutoFit -FreezeTopRowFirstColumn
|
||||
@@ -0,0 +1,6 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
$Policies = Get-GPOZaurrFilesPolicyDefinitions -Signature
|
||||
$Policies | Format-Table
|
||||
#$Policies.FilesToDelete | Format-Table *
|
||||
$Policies['ad.evotec.xyz'] | Format-Table *
|
||||
@@ -0,0 +1,5 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
Get-GPOZaurrEmptyFolders | Where-Object { $_.Name -eq 'Adm' } | Format-Table *
|
||||
|
||||
Remove-GPOZaurrEmptyFolders -Folders Adm -Verbose -LimitProcessing 1
|
||||
+7
-7
@@ -1,27 +1,27 @@
|
||||
@{
|
||||
AliasesToExport = ''
|
||||
AliasesToExport = 'Find-GPO'
|
||||
Author = 'Przemyslaw Klys'
|
||||
CompanyName = 'Evotec'
|
||||
CompatiblePSEditions = 'Desktop'
|
||||
Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
|
||||
Description = 'Group Policy Eater'
|
||||
FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
|
||||
Description = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
|
||||
FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrEmptyFolders', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinitions', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrEmptyFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Select-GPOTranslation', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
|
||||
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
|
||||
ModuleVersion = '0.0.41'
|
||||
ModuleVersion = '0.0.49'
|
||||
PowerShellVersion = '5.1'
|
||||
PrivateData = @{
|
||||
PSData = @{
|
||||
Tags = 'Windows', 'ActiveDirectory', 'GPO'
|
||||
Tags = 'Windows', 'ActiveDirectory', 'GPO', 'GroupPolicy'
|
||||
ProjectUri = 'https://github.com/EvotecIT/GPOZaurr'
|
||||
ExternalModuleDependencies = 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
|
||||
}
|
||||
}
|
||||
RequiredModules = @{
|
||||
ModuleVersion = '0.0.147'
|
||||
ModuleVersion = '0.0.161'
|
||||
ModuleName = 'PSSharedGoods'
|
||||
Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
|
||||
}, @{
|
||||
ModuleVersion = '0.0.57'
|
||||
ModuleVersion = '0.0.65'
|
||||
ModuleName = 'ADEssentials'
|
||||
Guid = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
|
||||
}, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
function ConvertTo-XMLAccountPolicy {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO
|
||||
)
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
ClearTextPassword = 'Not Set'
|
||||
LockoutBadCount = 'Not Set'
|
||||
LockoutDuration = 'Not Set'
|
||||
MaximumPasswordAge = 'Not Set'
|
||||
MinimumPasswordAge = 'Not Set'
|
||||
MinimumPasswordLength = 'Not Set'
|
||||
PasswordComplexity = 'Not Set'
|
||||
PasswordHistorySize = 'Not Set'
|
||||
ResetLockoutCount = 'Not Set'
|
||||
MaxClockSkew = 'Not Set'
|
||||
MaxRenewAge = 'Not Set'
|
||||
MaxServiceAge = 'Not Set'
|
||||
MaxTicketAge = 'Not Set'
|
||||
TicketValidateClient = 'Not Set'
|
||||
}
|
||||
foreach ($GPOEntry in $GPO.DataSet) {
|
||||
if ($GPOEntry.SettingBoolean) {
|
||||
$CreateGPO[$($GPOEntry.Name)] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { 'Not set' };
|
||||
} elseif ($GPOEntry.SettingNumber) {
|
||||
$CreateGPO[$($GPOEntry.Name)] = $GPOEntry.SettingNumber
|
||||
}
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
function ConvertTo-XMLAudit {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[switch] $FullObject
|
||||
)
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
AuditAccountLogon = 'No auditing'
|
||||
AuditAccountManage = 'No auditing'
|
||||
AuditDSAccess = 'No auditing'
|
||||
AuditLogonEvents = 'No auditing'
|
||||
AuditObjectAccess = 'No auditing'
|
||||
AuditPolicyChange = 'No auditing'
|
||||
AuditPrivilegeUse = 'No auditing'
|
||||
AuditProcessTracking = 'No auditing'
|
||||
AuditSystemEvents = 'No auditing'
|
||||
}
|
||||
foreach ($GPOEntry in $GPO.DataSet) {
|
||||
$SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null };
|
||||
$FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null };
|
||||
if ($SuccessAttempts -and $FailureAttempts) {
|
||||
$Setting = 'Success, Failure'
|
||||
} elseif ($SuccessAttempts) {
|
||||
$Setting = 'Success'
|
||||
} elseif ($FailureAttempts) {
|
||||
$Setting = 'Failure'
|
||||
} else {
|
||||
$Setting = 'No auditing'
|
||||
}
|
||||
$CreateGPO["$($GPOEntry.Name)"] = $Setting
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
function ConvertTo-XMLDriveMapSettings {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[switch] $SingleObject
|
||||
)
|
||||
if ($SingleObject) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Count = 0
|
||||
Settings = $null
|
||||
}
|
||||
[Array] $CreateGPO['Settings'] = foreach ($Entry in $GPO.DataSet.Drive) {
|
||||
[PSCustomObject] @{
|
||||
Changed = [DateTime] $Entry.changed
|
||||
#uid = $Entry.uid
|
||||
GPOSettingOrder = $Entry.GPOSettingOrder
|
||||
Filter = $Entry.Filter
|
||||
|
||||
Name = $Entry.Name
|
||||
Status = $Entry.status
|
||||
Action = $Script:Actions["$($Entry.Properties.action)"]
|
||||
ThisDrive = $Entry.Properties.thisDrive
|
||||
AllDrives = $Entry.Properties.allDrives
|
||||
UserName = $Entry.Properties.userName
|
||||
Path = $Entry.Properties.path
|
||||
Label = $Entry.Properties.label
|
||||
Persistent = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
|
||||
UseLetter = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
|
||||
Letter = $Entry.Properties.letter
|
||||
}
|
||||
}
|
||||
$CreateGPO['Count'] = $CreateGPO['Settings'].Count
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
} else {
|
||||
foreach ($Entry in $GPO.DataSet.Drive) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Changed = [DateTime] $Entry.changed
|
||||
#uid = $Entry.uid
|
||||
GPOSettingOrder = $Entry.GPOSettingOrder
|
||||
Filter = $Entry.Filter
|
||||
|
||||
Name = $Entry.Name
|
||||
Status = $Entry.status
|
||||
Action = $Script:Actions["$($Entry.Properties.action)"]
|
||||
ThisDrive = $Entry.Properties.thisDrive
|
||||
AllDrives = $Entry.Properties.allDrives
|
||||
UserName = $Entry.Properties.userName
|
||||
Path = $Entry.Properties.path
|
||||
Label = $Entry.Properties.label
|
||||
Persistent = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
|
||||
UseLetter = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
|
||||
Letter = $Entry.Properties.letter
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,51 @@
|
||||
function ConvertTo-XMLEventLog {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO
|
||||
)
|
||||
$RetionPeriod = @{
|
||||
'0' = 'Overwrite events as needed'
|
||||
'1' = 'Overwrite events by days'
|
||||
'2' = 'Do not overwrite events (Clear logs manually)'
|
||||
}
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
ApplicationAuditLogRetentionPeriod = $null
|
||||
ApplicationMaximumLogSize = $null
|
||||
ApplicationRestrictGuestAccess = $null
|
||||
ApplicationRetentionDays = $null
|
||||
SystemAuditLogRetentionPeriod = $null
|
||||
SystemMaximumLogSize = $null
|
||||
SystemRestrictGuestAccess = $null
|
||||
SystemRetentionDays = $null
|
||||
SecurityAuditLogRetentionPeriod = $null
|
||||
SecurityMaximumLogSize = $null
|
||||
SecurityRestrictGuestAccess = $null
|
||||
SecurityRetentionDays = $null
|
||||
}
|
||||
foreach ($GPOEntry in $GPO.DataSet) {
|
||||
if ($GPOEntry.SettingBoolean) {
|
||||
$CreateGPO["$($GPOEntry.Log)$($GPOEntry.Name)"] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { 'Not set' };
|
||||
} elseif ($GPOEntry.SettingNumber) {
|
||||
if ($GPOEntry.Name -eq 'AuditLogRetentionPeriod') {
|
||||
if ($GPOEntry.SettingNumber) {
|
||||
$CreateGPO["$($GPOEntry.Log)$($GPOEntry.Name)"] = $RetionPeriod[$($GPOEntry.SettingNumber)]
|
||||
} else {
|
||||
# Won't happen?
|
||||
$CreateGPO["$($GPOEntry.Log)$($GPOEntry.Name)"] = $GPOEntry.SettingNumber
|
||||
}
|
||||
} else {
|
||||
$CreateGPO["$($GPOEntry.Log)$($GPOEntry.Name)"] = $GPOEntry.SettingNumber
|
||||
}
|
||||
}
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
@@ -0,0 +1,126 @@
|
||||
function ConvertTo-XMLLocalGroups {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[switch] $SingleObject
|
||||
)
|
||||
|
||||
if ($SingleObject) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Count = 0
|
||||
Settings = $null
|
||||
}
|
||||
if (-not $GPO.DataSet.Group) {
|
||||
continue
|
||||
}
|
||||
[Array] $CreateGPO['Settings'] = foreach ($Group in $GPO.DataSet.Group) {
|
||||
# We're mostly interested in Members
|
||||
[Array] $Members = foreach ($Member in $Group.Properties.Members.Member) {
|
||||
[ordered] @{
|
||||
MemberName = $Member.Name
|
||||
MemberAction = $Member.Action
|
||||
MemberSID = $Member.SID
|
||||
}
|
||||
}
|
||||
# if we have no members we create dummy object to make sure we can use foreach below
|
||||
if ($Members.Count -eq 0) {
|
||||
$Members = @(
|
||||
[ordered] @{
|
||||
MemberName = $null
|
||||
MemberAction = $null
|
||||
MemberSID = $null
|
||||
}
|
||||
)
|
||||
}
|
||||
foreach ($Member in $Members) {
|
||||
$GroupObject = [ordered]@{
|
||||
Changed = [DateTime] $Group.Changed
|
||||
GPOSettingOrder = $Group.GPOSettingOrder
|
||||
Name = $Group.name
|
||||
Action = $Script:Actions["$($Group.Properties.action)"]
|
||||
GroupName = $Group.Properties.groupName #: Administrators (built -in )
|
||||
NewName = $Group.Properties.newName #:
|
||||
Description = $Group.Properties.description #:
|
||||
DeleteAllUsers = if ($Group.Properties.deleteAllUsers -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllUsers -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllUsers };
|
||||
DeleteAllGroups = if ($Group.Properties.deleteAllGroups -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllGroups -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllGroups };
|
||||
RemoveAccounts = if ($Group.Properties.removeAccounts -eq '1') { 'Enabled' } elseif ($Group.Properties.removeAccounts -eq '0') { 'Disabled' } else { $Group.Properties.removeAccounts };
|
||||
GroupSid = $Group.Properties.groupSid #: S - 1 - 5 - 32 - 544
|
||||
}
|
||||
$Last = [ordered] @{
|
||||
#Uid = $Group.uid #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
|
||||
RunInLoggedOnUserSecurityContext = if ($Group.userContext -eq '1') { 'Enabled' } elseif ($Group.userContext -eq '0') { 'Disabled' } else { $Group.userContext };
|
||||
RemoveThisItemWhenItIsNoLongerApplied = if ($Group.removePolicy -eq '1') { 'Enabled' } elseif ($Group.removePolicy -eq '0') { 'Disabled' } else { $Group.removePolicy };
|
||||
Filters = $Group.Filters #::
|
||||
}
|
||||
# Merging GPO with Member
|
||||
$GroupObject = $GroupObject + $Member + $Last
|
||||
[PSCustomObject] $GroupObject
|
||||
}
|
||||
}
|
||||
$CreateGPO['Count'] = $CreateGPO['Settings'].Count
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
} else {
|
||||
foreach ($Group in $GPO.DataSet.Group) {
|
||||
# We're mostly interested in Members
|
||||
[Array] $Members = foreach ($Member in $Group.Properties.Members.Member) {
|
||||
[ordered] @{
|
||||
MemberName = $Member.Name
|
||||
MemberAction = $Member.Action
|
||||
MemberSID = $Member.SID
|
||||
}
|
||||
}
|
||||
# if we have no members we create dummy object to make sure we can use foreach below
|
||||
if ($Members.Count -eq 0) {
|
||||
$Members = @(
|
||||
[ordered] @{
|
||||
MemberName = $null
|
||||
MemberAction = $null
|
||||
MemberSID = $null
|
||||
}
|
||||
)
|
||||
}
|
||||
foreach ($Member in $Members) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPO.GpoCategory #: SecuritySettings
|
||||
#GpoSettings = $GPO.GpoSettings #: SecurityOptions
|
||||
Changed = [DateTime] $Group.Changed
|
||||
GPOSettingOrder = $Group.GPOSettingOrder
|
||||
Name = $Group.name
|
||||
Action = $Script:Actions["$($Group.Properties.action)"]
|
||||
GroupName = $Group.Properties.groupName #: Administrators (built -in )
|
||||
NewName = $Group.Properties.newName #:
|
||||
Description = $Group.Properties.description #:
|
||||
DeleteAllUsers = if ($Group.Properties.deleteAllUsers -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllUsers -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllUsers };
|
||||
DeleteAllGroups = if ($Group.Properties.deleteAllGroups -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllGroups -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllGroups };
|
||||
RemoveAccounts = if ($Group.Properties.removeAccounts -eq '1') { 'Enabled' } elseif ($Group.Properties.removeAccounts -eq '0') { 'Disabled' } else { $Group.Properties.removeAccounts };
|
||||
GroupSid = $Group.Properties.groupSid #: S - 1 - 5 - 32 - 544
|
||||
}
|
||||
$Last = [ordered] @{
|
||||
# Uid = $Group.uid #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
|
||||
RunInLoggedOnUserSecurityContext = if ($Group.userContext -eq '1') { 'Enabled' } elseif ($Group.userContext -eq '0') { 'Disabled' } else { $Group.userContext };
|
||||
RemoveThisItemWhenItIsNoLongerApplied = if ($Group.removePolicy -eq '1') { 'Enabled' } elseif ($Group.removePolicy -eq '0') { 'Disabled' } else { $Group.removePolicy };
|
||||
Filters = $Group.Filters #::
|
||||
}
|
||||
# Merging GPO with Member
|
||||
$CreateGPO = $CreateGPO + $Member + $Last
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,74 @@
|
||||
function ConvertTo-XMLLocalUser {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[switch] $SingleObject
|
||||
)
|
||||
if ($SingleObject) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Count = 0
|
||||
Settings = $null
|
||||
}
|
||||
if (-not $GPO.DataSet.User) {
|
||||
continue
|
||||
}
|
||||
[Array] $CreateGPO['Settings'] = foreach ($User in $GPO.DataSet.User) {
|
||||
[PSCustomObject] @{
|
||||
Changed = [DateTime] $User.Changed
|
||||
GPOSettingOrder = $User.GPOSettingOrder
|
||||
Action = $Script:Actions["$($User.Properties.action)"]
|
||||
UserName = $User.Properties.userName
|
||||
NewName = $User.Properties.newName
|
||||
FullName = $User.Properties.fullName
|
||||
Description = $User.Properties.description
|
||||
Password = $User.Properties.cpassword
|
||||
MustChangePasswordAtNextLogon = if ($User.Properties.changeLogon -eq '1') { $true } elseif ($User.Properties.changeLogon -eq '0') { $false } else { $User.Properties.changeLogon };
|
||||
CannotChangePassword = if ($User.Properties.noChange -eq '1') { $true } elseif ($User.Properties.noChange -eq '0') { $false } else { $User.Properties.noChange };
|
||||
PasswordNeverExpires = if ($User.Properties.neverExpires -eq '1') { $true } elseif ($User.Properties.neverExpires -eq '0') { $false } else { $User.Properties.neverExpires };
|
||||
AccountIsDisabled = if ($User.Properties.acctDisabled -eq '1') { $true } elseif ($User.Properties.acctDisabled -eq '0') { $false } else { $User.Properties.acctDisabled };
|
||||
AccountExpires = try { [DateTime] $User.Properties.expires } catch { $User.Properties.expires };
|
||||
SubAuthority = $User.Properties.subAuthority
|
||||
}
|
||||
}
|
||||
$CreateGPO['Count'] = $CreateGPO['Settings'].Count
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
} else {
|
||||
foreach ($User in $GPO.DataSet.User) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPO.GpoCategory #: SecuritySettings
|
||||
#GpoSettings = $GPO.GpoSettings #: SecurityOptions
|
||||
Changed = [DateTime] $User.Changed
|
||||
GPOSettingOrder = $User.GPOSettingOrder
|
||||
Action = $Script:Actions["$($User.Properties.action)"]
|
||||
UserName = $User.Properties.userName
|
||||
NewName = $User.Properties.newName
|
||||
FullName = $User.Properties.fullName
|
||||
Description = $User.Properties.description
|
||||
Password = $User.Properties.cpassword
|
||||
MustChangePasswordAtNextLogon = if ($User.Properties.changeLogon -eq '1') { $true } elseif ($User.Properties.changeLogon -eq '0') { $false } else { $User.Properties.changeLogon };
|
||||
CannotChangePassword = if ($User.Properties.noChange -eq '1') { $true } elseif ($User.Properties.noChange -eq '0') { $false } else { $User.Properties.noChange };
|
||||
PasswordNeverExpires = if ($User.Properties.neverExpires -eq '1') { $true } elseif ($User.Properties.neverExpires -eq '0') { $false } else { $User.Properties.neverExpires };
|
||||
AccountIsDisabled = if ($User.Properties.acctDisabled -eq '1') { $true } elseif ($User.Properties.acctDisabled -eq '0') { $false } else { $User.Properties.acctDisabled };
|
||||
AccountExpires = try { [DateTime] $User.Properties.expires } catch { $User.Properties.expires };
|
||||
SubAuthority = $User.Properties.subAuthority
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
function ConvertTo-XMLPolicies {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[switch] $SingleObject
|
||||
)
|
||||
if ($SingleObject) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Count = 0
|
||||
Settings = $null
|
||||
}
|
||||
[Array] $CreateGPO['Settings'] = foreach ($Policy in $GPO.DataSet) {
|
||||
[PSCustomObject] @{
|
||||
PolicyName = $Policy.Name
|
||||
PolicyState = $Policy.State
|
||||
PolicyCategory = $Policy.Category
|
||||
PolicySupported = $Policy.Supported
|
||||
PolicyExplain = $Policy.Explain
|
||||
PolicyText = $Policy.Text
|
||||
PolicyCheckBox = $Policy.CheckBox
|
||||
PolicyDropDownList = $Policy.DropDownList
|
||||
PolicyEditText = $Policy.EditText
|
||||
}
|
||||
}
|
||||
$CreateGPO['Count'] = $CreateGPO['Settings'].Count
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
} else {
|
||||
foreach ($Policy in $GPO.DataSet) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
PolicyName = $Policy.Name
|
||||
PolicyState = $Policy.State
|
||||
PolicyCategory = $Policy.Category
|
||||
PolicySupported = $Policy.Supported
|
||||
PolicyExplain = $Policy.Explain
|
||||
PolicyText = $Policy.Text
|
||||
PolicyCheckBox = $Policy.CheckBox
|
||||
PolicyDropDownList = $Policy.DropDownList
|
||||
PolicyEditText = $Policy.EditText
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,51 @@
|
||||
function ConvertTo-XMLPrinter {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[switch] $SingleObject
|
||||
)
|
||||
if ($SingleObject) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Count = 0
|
||||
Settings = $null
|
||||
}
|
||||
[Array] $CreateGPO['Settings'] = @(
|
||||
foreach ($Type in @('SharedPrinter', 'PortPrinter', 'LocalPrinter')) {
|
||||
foreach ($Entry in $GPO.DataSet.$Type) {
|
||||
if ($Entry) {
|
||||
ConvertTo-XMLPrinterInternal -GPO $GPO -Entry $Entry -Type $Type -Limited
|
||||
}
|
||||
}
|
||||
}
|
||||
if ($GPO.GpoCategory -eq 'PrinterConnectionSettings') {
|
||||
foreach ($Entry in $GPO.DataSet) {
|
||||
ConvertTo-XMLPrinterInternal -GPO $GPO -Entry $Entry -Type 'PrinterConnections' -Limited
|
||||
}
|
||||
}
|
||||
)
|
||||
$CreateGPO['Count'] = $CreateGPO['Settings'].Count
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
} else {
|
||||
foreach ($Type in @('SharedPrinter', 'PortPrinter', 'LocalPrinter')) {
|
||||
foreach ($Entry in $GPO.DataSet.$Type) {
|
||||
if ($Entry) {
|
||||
ConvertTo-XMLPrinterInternal -GPO $GPO -Entry $Entry -Type $Type
|
||||
}
|
||||
}
|
||||
}
|
||||
if ($GPO.GpoCategory -eq 'PrinterConnectionSettings') {
|
||||
foreach ($Entry in $GPO.DataSet) {
|
||||
ConvertTo-XMLPrinterInternal -GPO $GPO -Entry $Entry -Type 'PrinterConnections'
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,95 @@
|
||||
function ConvertTo-XMLPrinterInternal {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
$Entry,
|
||||
$Type,
|
||||
[switch] $Limited
|
||||
)
|
||||
if ($Limited) {
|
||||
$CreateGPO = [ordered]@{
|
||||
Changed = try { [DateTime] $Entry.changed } catch { $Entry.Changed };
|
||||
#uid = $Entry.uid
|
||||
BypassErrors = if ($Entry.bypassErrors -eq '1') { $true } elseif ($Entry.bypassErrors -eq '0') { $false } else { $Entry.bypassErrors };
|
||||
GPOSettingOrder = $Entry.GPOSettingOrder
|
||||
Filter = $Entry.Filter
|
||||
type = $Type
|
||||
Action = $null #$Script:Actions["$($Entry.Properties.action)"]
|
||||
Comment = $Entry.Properties.comment
|
||||
Path = if ($Entry.Properties.path) { $Entry.Properties.Path } elseif ($Entry.Path) { $Entry.Path } else { '' }
|
||||
Location = $Entry.Properties.location
|
||||
|
||||
HostName = $Entry.Properties.ipAddress #: 10.42.20.204
|
||||
LocalName = $Entry.Properties.localName #: CZ02PRT00017
|
||||
UseDNS = if ($Entry.Properties.useDNS -eq '1') { $true } elseif ($Entry.Properties.useDNS -eq '0') { $false } else { $Entry.Properties.useDNS };
|
||||
UseIPv6 = if ($Entry.Properties.useIPv6 -eq '1') { $true } elseif ($Entry.Properties.useIPv6 -eq '0') { $false } else { $Entry.Properties.useIPv6 };
|
||||
Default = if ($Entry.Properties.default -eq '1') { $true } elseif ($Entry.Properties.default -eq '0') { $false } else { $Entry.Properties.default };
|
||||
SkipLocal = if ($Entry.Properties.skipLocal -eq '1') { $true } elseif ($Entry.Properties.skipLocal -eq '0') { $false } else { $Entry.Properties.skipLocal };
|
||||
DeleteAllShared = if ($Entry.Properties.deleteAll -eq '1') { $true } elseif ($Entry.Properties.deleteAll -eq '0') { $false } else { $Entry.Properties.deleteAll };
|
||||
Persistent = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
|
||||
DeleteMaps = if ($Entry.Properties.deleteMaps -eq '1') { $true } elseif ($Entry.Properties.deleteMaps -eq '0') { $false } else { $Entry.Properties.deleteMaps };
|
||||
LPRSettingsQueueName = $Entry.Properties.lprQueue #:
|
||||
|
||||
Protocol = $Entry.Properties.protocol #: PROTOCOL_RAWTCP_TYPE
|
||||
PortNumber = if ($Entry.Properties.portNumber) { $Entry.Properties.portNumber } else { $Entry.Properties.port }
|
||||
DoubleSpool = if ($Entry.Properties.doubleSpool -eq '1') { $true } elseif ($Entry.Properties.doubleSpool -eq '0') { $false } else { $Entry.Properties.doubleSpool };
|
||||
|
||||
SNMPEnabled = if ($Entry.Properties.snmpEnabled -eq '1') { $true } elseif ($Entry.Properties.snmpEnabled -eq '0') { $false } else { $Entry.Properties.snmpEnabled };
|
||||
SNMPCommunityName = $Entry.Properties.snmpCommunity #: public
|
||||
SNMPDeviceIndex = $Entry.Properties.snmpDevIndex #: 1
|
||||
}
|
||||
if ($Entry.Properties.Action) {
|
||||
$CreateGPO['Action'] = $Script:Actions["$($Entry.Properties.action)"]
|
||||
} else {
|
||||
$CreateGPO['Action'] = 'Deploy'
|
||||
}
|
||||
[PSCustomObject] $CreateGPO
|
||||
} else {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
GpoCategory = $GPO.GpoCategory
|
||||
GpoSettings = $GPO.GpoSettings
|
||||
Changed = try { [DateTime] $Entry.changed } catch { $Entry.Changed };
|
||||
#uid = $Entry.uid
|
||||
BypassErrors = if ($Entry.bypassErrors -eq '1') { $true } elseif ($Entry.bypassErrors -eq '0') { $false } else { $Entry.bypassErrors };
|
||||
GPOSettingOrder = $Entry.GPOSettingOrder
|
||||
Filter = $Entry.Filter
|
||||
type = $Type
|
||||
Action = $null #$Script:Actions["$($Entry.Properties.action)"]
|
||||
Comment = $Entry.Properties.comment
|
||||
Path = if ($Entry.Properties.path) { $Entry.Properties.Path } elseif ($Entry.Path) { $Entry.Path } else { '' }
|
||||
Location = $Entry.Properties.location
|
||||
|
||||
HostName = $Entry.Properties.ipAddress #: 10.42.20.204
|
||||
LocalName = $Entry.Properties.localName #: CZ02PRT00017
|
||||
UseDNS = if ($Entry.Properties.useDNS -eq '1') { $true } elseif ($Entry.Properties.useDNS -eq '0') { $false } else { $Entry.Properties.useDNS };
|
||||
UseIPv6 = if ($Entry.Properties.useIPv6 -eq '1') { $true } elseif ($Entry.Properties.useIPv6 -eq '0') { $false } else { $Entry.Properties.useIPv6 };
|
||||
Default = if ($Entry.Properties.default -eq '1') { $true } elseif ($Entry.Properties.default -eq '0') { $false } else { $Entry.Properties.default };
|
||||
SkipLocal = if ($Entry.Properties.skipLocal -eq '1') { $true } elseif ($Entry.Properties.skipLocal -eq '0') { $false } else { $Entry.Properties.skipLocal };
|
||||
DeleteAllShared = if ($Entry.Properties.deleteAll -eq '1') { $true } elseif ($Entry.Properties.deleteAll -eq '0') { $false } else { $Entry.Properties.deleteAll };
|
||||
Persistent = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
|
||||
DeleteMaps = if ($Entry.Properties.deleteMaps -eq '1') { $true } elseif ($Entry.Properties.deleteMaps -eq '0') { $false } else { $Entry.Properties.deleteMaps };
|
||||
LPRSettingsQueueName = $Entry.Properties.lprQueue #:
|
||||
|
||||
Protocol = $Entry.Properties.protocol #: PROTOCOL_RAWTCP_TYPE
|
||||
PortNumber = if ($Entry.Properties.portNumber) { $Entry.Properties.portNumber } else { $Entry.Properties.port }
|
||||
DoubleSpool = if ($Entry.Properties.doubleSpool -eq '1') { $true } elseif ($Entry.Properties.doubleSpool -eq '0') { $false } else { $Entry.Properties.doubleSpool };
|
||||
|
||||
SNMPEnabled = if ($Entry.Properties.snmpEnabled -eq '1') { $true } elseif ($Entry.Properties.snmpEnabled -eq '0') { $false } else { $Entry.Properties.snmpEnabled };
|
||||
SNMPCommunityName = $Entry.Properties.snmpCommunity #: public
|
||||
SNMPDeviceIndex = $Entry.Properties.snmpDevIndex #: 1
|
||||
}
|
||||
if ($Entry.Properties.Action) {
|
||||
$CreateGPO['Action'] = $Script:Actions["$($Entry.Properties.action)"]
|
||||
} else {
|
||||
$CreateGPO['Action'] = 'Deploy'
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
function ConvertTo-XMLRegistryAutologon {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO
|
||||
)
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
AutoAdminLogon = $null
|
||||
DefaultDomainName = $null
|
||||
DefaultUserName = $null
|
||||
DefaultPassword = $null
|
||||
DateChangedAutoAdminLogon = $null
|
||||
DateChangedDefaultDomainName = $null
|
||||
DateChangedDefaultUserName = $null
|
||||
DateChangedDefaultPassword = $null
|
||||
}
|
||||
foreach ($Registry in $GPO.DataSet.Registry) {
|
||||
if ($Registry.Properties.Key -eq 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon') {
|
||||
if ($Registry.Properties.Name -eq 'AutoAdminLogon') {
|
||||
$CreateGPO['AutoAdminLogon'] = [bool] $Registry.Properties.value
|
||||
$CreateGPO['DateChangedAutoAdminLogon'] = [DateTime] $Registry.changed
|
||||
} elseif ($Registry.Properties.Name -eq 'DefaultDomainName') {
|
||||
$CreateGPO['DefaultDomainName'] = $Registry.Properties.value
|
||||
$CreateGPO['DateChangedDefaultDomainName'] = [DateTime] $Registry.changed
|
||||
} elseif ($Registry.Properties.Name -eq 'DefaultUserName') {
|
||||
$CreateGPO['DefaultUserName'] = $Registry.Properties.value
|
||||
$CreateGPO['DateChangedDefaultUserName'] = [DateTime] $Registry.changed
|
||||
} elseif ($Registry.Properties.Name -eq 'DefaultPassword') {
|
||||
$CreateGPO['DefaultPassword'] = $Registry.Properties.value
|
||||
$CreateGPO['DateChangedDefaultPassword'] = [DateTime] $Registry.changed
|
||||
}
|
||||
}
|
||||
}
|
||||
if ($null -ne $CreateGPO['AutoAdminLogon'] -or
|
||||
$null -ne $CreateGPO['DefaultDomainName'] -or
|
||||
$null -ne $CreateGPO['DefaultUserName'] -or
|
||||
$null -ne $CreateGPO['DefaultPassword']
|
||||
) {
|
||||
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
|
||||
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
|
||||
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
function ConvertTo-XMLRegistrySettings {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[switch] $SingleObject
|
||||
)
|
||||
if ($SingleObject) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Count = 0
|
||||
Settings = $null
|
||||
}
|
||||
|
||||
[Array] $CreateGPO['Settings'] = Get-XMLNestedRegistry -GPO $GPO -DataSet $GPO.DataSet
|
||||
<#
|
||||
[Array] $CreateGPO['Settings'] = foreach ($Registry in $GPO.DataSet.Registry) {
|
||||
[PSCustomObject] @{
|
||||
Changed = [DateTime] $Registry.changed
|
||||
GPOSettingOrder = $Registry.GPOSettingOrder
|
||||
Hive = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
|
||||
Key = $Registry.Properties.key #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
|
||||
Name = $Registry.Properties.name #: AutoAdminLogon
|
||||
Type = $Registry.Properties.type #: REG_SZ
|
||||
Value = $Registry.Properties.value #
|
||||
Filters = $Registry.Filters
|
||||
}
|
||||
}
|
||||
#>
|
||||
$CreateGPO['Count'] = $CreateGPO['Settings'].Count
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
} else {
|
||||
<#
|
||||
if ($GPO.DataSet.Registry) {
|
||||
Get-XMLNestedRegistry -GPO $GPO -RegistryCollection $GPO.DataSet.Registry
|
||||
}
|
||||
if ($GPO.DataSet.Collection) {
|
||||
Get-XMLNestedRegistry -GPO $GPO -RegistryCollection $GPO.DataSet.Collection
|
||||
}
|
||||
#>
|
||||
Get-XMLNestedRegistry -GPO $GPO -DataSet $GPO.DataSet
|
||||
|
||||
<#
|
||||
foreach ($Registry in $GPO.DataSet.Registry) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Changed = [DateTime] $Registry.changed
|
||||
GPOSettingOrder = $Registry.GPOSettingOrder
|
||||
Hive = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
|
||||
Key = $Registry.Properties.key #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
|
||||
Name = $Registry.Properties.name #: AutoAdminLogon
|
||||
Type = $Registry.Properties.type #: REG_SZ
|
||||
Value = $Registry.Properties.value #
|
||||
Filters = $Registry.Filters
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
#>
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
function ConvertTo-XMLScripts {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[switch] $SingleObject
|
||||
)
|
||||
if ($SingleObject) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Count = 0
|
||||
Settings = $null
|
||||
}
|
||||
[Array] $CreateGPO['Settings'] = foreach ($Script in $GPO.DataSet) {
|
||||
[PSCustomObject] @{
|
||||
Type = $GPO.DataSet.Type
|
||||
Command = $GPO.DataSet.Command
|
||||
Parameters = $GPO.DataSet.Parameters
|
||||
Order = $GPO.DataSet.Order
|
||||
RunOrder = $GPO.DataSet.RunOrder
|
||||
}
|
||||
}
|
||||
$CreateGPO['DataCount'] = $CreateGPO['Settings'].Count
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
} else {
|
||||
foreach ($Script in $GPO.DataSet) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Type = $Script.Type
|
||||
Command = $Script.Command
|
||||
Parameters = $Script.Parameters
|
||||
Order = $Script.Order
|
||||
RunOrder = $Script.RunOrder
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
function ConvertTo-XMLSecurityOptions {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[switch] $SingleObject
|
||||
)
|
||||
if ($SingleObject) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Count = 0
|
||||
Settings = $null
|
||||
}
|
||||
[Array] $CreateGPO['Settings'] = foreach ($Entry in $GPO.DataSet) {
|
||||
$Object = [ordered] @{}
|
||||
$Object['KeyName'] = $Entry.KeyName
|
||||
$Object['KeyDisplayName'] = $Entry.Display.Name
|
||||
$Object['KeyDisplayUnits'] = $Entry.Display.Units
|
||||
$Object['KeyDisplayBoolean'] = try { [bool]::Parse($Entry.Display.DisplayBoolean) } catch { $null };
|
||||
$Object['KeyDisplayString'] = $Entry.Display.DisplayString
|
||||
$Object['SystemAccessPolicyName'] = $Entry.SystemAccessPolicyName
|
||||
if ($Entry.SettingString) {
|
||||
$Object['KeyValue'] = $Entry.SettingString
|
||||
} else {
|
||||
$Object['KeyValue'] = $Entry.SettingNumber
|
||||
}
|
||||
[PSCustomObject] $Object
|
||||
}
|
||||
$CreateGPO['Count'] = $CreateGPO['Settings'].Count
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
} else {
|
||||
foreach ($Entry in $GPO.DataSet) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
}
|
||||
$CreateGPO['KeyName'] = $Entry.KeyName
|
||||
$CreateGPO['KeyDisplayName'] = $Entry.Display.Name
|
||||
$CreateGPO['KeyDisplayUnits'] = $Entry.Display.Units
|
||||
$CreateGPO['KeyDisplayBoolean'] = try { [bool]::Parse($Entry.Display.DisplayBoolean) } catch { $null };
|
||||
$CreateGPO['KeyDisplayString'] = $Entry.Display.DisplayString
|
||||
$CreateGPO['SystemAccessPolicyName'] = $Entry.SystemAccessPolicyName
|
||||
if ($Entry.SettingString) {
|
||||
$CreateGPO['KeyValue'] = $Entry.SettingString
|
||||
} else {
|
||||
$CreateGPO['KeyValue'] = $Entry.SettingNumber
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,87 @@
|
||||
function ConvertTo-XMLSoftwareInstallation {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[switch] $SingleObject
|
||||
)
|
||||
if ($SingleObject) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Count = 0
|
||||
Settings = $null
|
||||
}
|
||||
[Array] $CreateGPO['Settings'] = foreach ($MsiInstallerr in $GPO.DataSet) {
|
||||
[PSCustomObject] @{
|
||||
Identifier = $MsiInstallerr.Identifier #: { 10495e9e-79c1-4a32-b278-a24cd495437f }
|
||||
Name = $MsiInstallerr.Name #: Local Administrator Password Solution (2)
|
||||
Path = $MsiInstallerr.Path #: \\area1.local\SYSVOL\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\LAPS.x64.msi
|
||||
MajorVersion = $MsiInstallerr.MajorVersion #: 6
|
||||
MinorVersion = $MsiInstallerr.MinorVersion #: 2
|
||||
LanguageId = $MsiInstallerr.LanguageId #: 1033
|
||||
Architecture = $MsiInstallerr.Architecture #: 9
|
||||
IgnoreLanguage = if ($MsiInstallerr.IgnoreLanguage -eq 'true') { $true } else { $false } #: false
|
||||
Allowx86Onia64 = if ($MsiInstallerr.Allowx86Onia64 -eq 'true') { $true } else { $false } #: true
|
||||
SupportURL = $MsiInstallerr.SupportURL #:
|
||||
AutoInstall = if ($MsiInstallerr.AutoInstall -eq 'true') { $true } else { $false } #: true
|
||||
DisplayInARP = if ($MsiInstallerr.DisplayInARP -eq 'true') { $true } else { $false } #: true
|
||||
IncludeCOM = if ($MsiInstallerr.IncludeCOM -eq 'true') { $true } else { $false } #: true
|
||||
SecurityDescriptor = $MsiInstallerr.SecurityDescriptor #: SecurityDescriptor
|
||||
DeploymentType = $MsiInstallerr.DeploymentType #: Assign
|
||||
ProductId = $MsiInstallerr.ProductId #: { ea8cb806-c109 - 4700 - 96b4-f1f268e5036c }
|
||||
ScriptPath = $MsiInstallerr.ScriptPath #: \\area1.local\SysVol\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\Machine\Applications\ { EAC9B821-FB4D - 457A-806F-E5B528D1E41A }.aas
|
||||
DeploymentCount = $MsiInstallerr.DeploymentCount #: 0
|
||||
InstallationUILevel = $MsiInstallerr.InstallationUILevel #: Maximum
|
||||
Upgrades = if ($MsiInstallerr.Upgrades.Mandatory -eq 'true') { $true } else { $false } #: Upgrades
|
||||
UninstallUnmanaged = if ($MsiInstallerr.UninstallUnmanaged -eq 'true') { $true } else { $false } #: false
|
||||
LossOfScopeAction = $MsiInstallerr.LossOfScopeAction #: Unmanage
|
||||
}
|
||||
}
|
||||
$CreateGPO['Count'] = $CreateGPO['Settings'].Count
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
} else {
|
||||
foreach ($MsiInstallerr in $GPO.DataSet) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Identifier = $MsiInstallerr.Identifier #: { 10495e9e-79c1-4a32-b278-a24cd495437f }
|
||||
Name = $MsiInstallerr.Name #: Local Administrator Password Solution (2)
|
||||
Path = $MsiInstallerr.Path #: \\area1.local\SYSVOL\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\LAPS.x64.msi
|
||||
MajorVersion = $MsiInstallerr.MajorVersion #: 6
|
||||
MinorVersion = $MsiInstallerr.MinorVersion #: 2
|
||||
LanguageId = $MsiInstallerr.LanguageId #: 1033
|
||||
Architecture = $MsiInstallerr.Architecture #: 9
|
||||
IgnoreLanguage = if ($MsiInstallerr.IgnoreLanguage -eq 'true') { $true } else { $false } #: false
|
||||
Allowx86Onia64 = if ($MsiInstallerr.Allowx86Onia64 -eq 'true') { $true } else { $false } #: true
|
||||
SupportURL = $MsiInstallerr.SupportURL #:
|
||||
AutoInstall = if ($MsiInstallerr.AutoInstall -eq 'true') { $true } else { $false } #: true
|
||||
DisplayInARP = if ($MsiInstallerr.DisplayInARP -eq 'true') { $true } else { $false } #: true
|
||||
IncludeCOM = if ($MsiInstallerr.IncludeCOM -eq 'true') { $true } else { $false } #: true
|
||||
SecurityDescriptor = $MsiInstallerr.SecurityDescriptor #: SecurityDescriptor
|
||||
DeploymentType = $MsiInstallerr.DeploymentType #: Assign
|
||||
ProductId = $MsiInstallerr.ProductId #: { ea8cb806-c109 - 4700 - 96b4-f1f268e5036c }
|
||||
ScriptPath = $MsiInstallerr.ScriptPath #: \\area1.local\SysVol\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\Machine\Applications\ { EAC9B821-FB4D - 457A-806F-E5B528D1E41A }.aas
|
||||
DeploymentCount = $MsiInstallerr.DeploymentCount #: 0
|
||||
InstallationUILevel = $MsiInstallerr.InstallationUILevel #: Maximum
|
||||
Upgrades = if ($MsiInstallerr.Upgrades.Mandatory -eq 'true') { $true } else { $false } #: Upgrades
|
||||
UninstallUnmanaged = if ($MsiInstallerr.UninstallUnmanaged -eq 'true') { $true } else { $false } #: false
|
||||
LossOfScopeAction = $MsiInstallerr.LossOfScopeAction #: Unmanage
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
function ConvertTo-XMLSystemServices {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[switch] $SingleObject
|
||||
)
|
||||
if ($SingleObject) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Count = 0
|
||||
Settings = $null
|
||||
}
|
||||
[Array] $CreateGPO['Settings'] = foreach ($GPOEntry in $GPO.DataSet) {
|
||||
[PSCustomObject] @{
|
||||
ServiceName = $GPOEntry.Name
|
||||
ServiceStartUpMode = $GPOEntry.StartUpMode
|
||||
SecurityAuditingPresent = try { [bool]::Parse($GPOEntry.SecurityDescriptor.AuditingPresent.'#text') } catch { $null };
|
||||
SecurityPermissionsPresent = try { [bool]::Parse($GPOEntry.SecurityDescriptor.PermissionsPresent.'#text') } catch { $null };
|
||||
SecurityDescriptor = $GPOEntry.SecurityDescriptor
|
||||
}
|
||||
}
|
||||
$CreateGPO['Count'] = $CreateGPO['Settings'].Count
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
} else {
|
||||
foreach ($GPOEntry in $GPO.DataSet) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
ServiceName = $GPOEntry.Name
|
||||
ServiceStartUpMode = $GPOEntry.StartUpMode
|
||||
SecurityAuditingPresent = try { [bool]::Parse($GPOEntry.SecurityDescriptor.AuditingPresent.'#text') } catch { $null };
|
||||
SecurityPermissionsPresent = try { [bool]::Parse($GPOEntry.SecurityDescriptor.PermissionsPresent.'#text') } catch { $null };
|
||||
SecurityDescriptor = $GPOEntry.SecurityDescriptor
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,106 @@
|
||||
function ConvertTo-XMLSystemServicesNT {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[switch] $SingleObject
|
||||
)
|
||||
if ($SingleObject) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Count = 0
|
||||
Settings = $null
|
||||
}
|
||||
[Array] $CreateGPO['Settings'] = foreach ($Service in $GPO.DataSet.NTService) {
|
||||
[PSCustomObject] @{
|
||||
GPOSettingOrder = $Service.GPOSettingOrder
|
||||
#ServiceName = $Service.Name
|
||||
ServiceName = $Service.Properties.serviceName #: AppIDSvc: AppIDSvc
|
||||
ServiceStartupType = $Service.Properties.startupType #: NOCHANGE: NOCHANGE
|
||||
ServiceAction = $Service.Properties.serviceAction #: START: START
|
||||
Timeout = $Service.Properties.timeout #: 50: 50
|
||||
FirstFailure = $Service.Properties.firstFailure #: REBOOT: REBOOT
|
||||
SecondFailure = $Service.Properties.secondFailure #: REBOOT: REBOOT
|
||||
ThirdFailure = $Service.Properties.thirdFailure #: REBOOT: REBOOT
|
||||
ResetFailCountDelay = $Service.Properties.resetFailCountDelay #: 0: 0
|
||||
RestartComputerDelay = $Service.Properties.restartComputerDelay #: 60000: 60000
|
||||
Filter = $Service.Filter
|
||||
AccountName = $Service.Properties.accountName
|
||||
AllowServiceToInteractWithTheDesktop = if ($Service.Properties.interact -eq 1) { 'Yes' } elseif ($Service.Properties.interact -eq 0) { 'No' } else { $null }
|
||||
RunThisProgram = $Service.Properties.program
|
||||
CommandLineParameters = $Service.Properties.args
|
||||
AppendFailCountToEndOfCommandLine = if ($Service.Properties.append -eq 1) { 'Yes' } elseif ($Service.Properties.append -eq 0) { 'No' } else { $null }
|
||||
}
|
||||
}
|
||||
$CreateGPO['Count'] = $CreateGPO['Settings'].Count
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
} else {
|
||||
foreach ($Service in $GPO.DataSet.NTService) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
GPOSettingOrder = $Service.GPOSettingOrder
|
||||
#ServiceName = $Service.Name
|
||||
ServiceName = $Service.Properties.serviceName #: AppIDSvc: AppIDSvc
|
||||
ServiceStartupType = $Service.Properties.startupType #: NOCHANGE: NOCHANGE
|
||||
ServiceAction = $Service.Properties.serviceAction #: START: START
|
||||
Timeout = $Service.Properties.timeout #: 50: 50
|
||||
FirstFailure = $Service.Properties.firstFailure #: REBOOT: REBOOT
|
||||
SecondFailure = $Service.Properties.secondFailure #: REBOOT: REBOOT
|
||||
ThirdFailure = $Service.Properties.thirdFailure #: REBOOT: REBOOT
|
||||
ResetFailCountDelay = $Service.Properties.resetFailCountDelay #: 0: 0
|
||||
RestartComputerDelay = $Service.Properties.restartComputerDelay #: 60000: 60000
|
||||
Filter = $Service.Filter
|
||||
AccountName = $Service.Properties.accountName
|
||||
AllowServiceToInteractWithTheDesktop = if ($Service.Properties.interact -eq 1) { 'Yes' } elseif ($Service.Properties.interact -eq 0) { 'No' } else { $null }
|
||||
RunThisProgram = $Service.Properties.program
|
||||
CommandLineParameters = $Service.Properties.args
|
||||
AppendFailCountToEndOfCommandLine = if ($Service.Properties.append -eq 1) { 'Yes' } elseif ($Service.Properties.append -eq 0) { 'No' } else { $null }
|
||||
<#$
|
||||
|
||||
startupType : NOCHANGE
|
||||
serviceName : AudioEndpointBuilder
|
||||
timeout : 30
|
||||
accountName : LocalSystem
|
||||
interact : 1
|
||||
thirdFailure : RUNCMD
|
||||
resetFailCountDelay : 0
|
||||
program : fgdfg
|
||||
args : dg
|
||||
append : 1
|
||||
|
||||
Service name AudioEndpointBuilder
|
||||
Action No change
|
||||
Startup type: No change
|
||||
Wait timeout if service is locked: 30 seconds
|
||||
Service AccountLog on service as: LocalSystem
|
||||
Allow service to interact with the desktop: Yes
|
||||
|
||||
First failure: No change
|
||||
Second failure: No change
|
||||
Subsequent failures: Run a program
|
||||
Reset fail count after: 0 days
|
||||
Run this program: fgdfg
|
||||
Command line parameters: dg
|
||||
Append fail count to end of command line: Yes
|
||||
|
||||
#>
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,243 @@
|
||||
function ConvertTo-XMLTaskScheduler {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[switch] $SingleObject
|
||||
)
|
||||
if ($SingleObject) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Count = 0
|
||||
Settings = $null
|
||||
}
|
||||
[Array] $CreateGPO['Settings'] = foreach ($Entry in $GPO.DataSet.Drive) {
|
||||
[PSCustomObject] @{
|
||||
Changed = [DateTime] $Entry.changed
|
||||
#uid = $Entry.uid
|
||||
GPOSettingOrder = $Entry.GPOSettingOrder
|
||||
Filter = $Entry.Filter
|
||||
|
||||
Name = $Entry.Name
|
||||
Action = $Script:Actions["$($Entry.Properties.action)"]
|
||||
ThisDrive = $Entry.Properties.thisDrive
|
||||
AllDrives = $Entry.Properties.allDrives
|
||||
UserName = $Entry.Properties.userName
|
||||
Path = $Entry.Properties.path
|
||||
Label = $Entry.Properties.label
|
||||
Persistent = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
|
||||
UseLetter = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
|
||||
Letter = $Entry.Properties.letter
|
||||
}
|
||||
}
|
||||
$CreateGPO['Count'] = $CreateGPO['Settings'].Count
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
} else {
|
||||
foreach ($Type in @('TaskV2', 'Task', 'ImmediateTaskV2', 'ImmediateTask')) {
|
||||
foreach ($Entry in $GPO.DataSet.$Type) {
|
||||
$ListActions = foreach ($LoopAction in $Entry.Properties.Task.Actions) {
|
||||
|
||||
foreach ($InternalAction in $LoopAction.Exec) {
|
||||
$Action = [ordered] @{
|
||||
ActionType = 'Execute'
|
||||
Command = $InternalAction.Command # : cmd
|
||||
Arguments = $InternalAction.Arguments # : / c wevtutil qe security / rd:true / f:text / c:1 / q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4727 or EventID=4759 or EventID=4754 or EventID=4731)]]" >group-creation.txt
|
||||
WorkingDirectory = $InternalAction.WorkingDirectory# : % windir % \temp
|
||||
Server = $Null
|
||||
Subject = $Null
|
||||
To = $Null
|
||||
From = $Null
|
||||
Body = $Null
|
||||
Attachments = $Null
|
||||
}
|
||||
$Action
|
||||
}
|
||||
foreach ($InternalAction in $LoopAction.SendEmail) {
|
||||
$Action = [ordered] @{
|
||||
ActionType = 'SendEmail'
|
||||
Command = $null
|
||||
Arguments = $null # : / c wevtutil qe security / rd:true / f:text / c:1 / q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4727 or EventID=4759 or EventID=4754 or EventID=4731)]]" >group-creation.txt
|
||||
WorkingDirectory = $null # : % windir % \temp
|
||||
Server = $InternalAction.Server # : smtp-de
|
||||
Subject = $InternalAction.Subject # : AD Group creation
|
||||
To = $InternalAction.To # : gm6b@eurofins.de,RalphThomasAussem@eurofins.de,karlthomaseggert@eurofins.de
|
||||
From = $InternalAction.From # : %computername%@eurofins.local
|
||||
Body = $InternalAction.Body # : A new security group has been created. Check attachment for further details.
|
||||
Attachments = $InternalAction.Attachments.File -join '; ' # : Attachments
|
||||
}
|
||||
$Action
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
<#
|
||||
[DBG]: PS C:\Support\GitHub\GpoZaurr> $Entry.Properties.Task.Triggers.EventTrigger
|
||||
|
||||
Enabled Subscription
|
||||
------- ------------
|
||||
true <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4727]]</Select></Query></QueryList>
|
||||
true <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4731]]</Select></Query></QueryList>
|
||||
true <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4754]]</Select></Query></QueryList>
|
||||
false <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4759]]</Select></Query></QueryList>
|
||||
#>
|
||||
if ($ListActions.Count -eq 0) {
|
||||
$ListActions = @(
|
||||
|
||||
if ($Entry.Properties.appName) {
|
||||
# This supports Scheduled Task (legacy)
|
||||
$Action = [ordered] @{
|
||||
ActionType = $Script:Actions["$($Entry.Properties.action)"]
|
||||
Command = $Entry.Properties.appName
|
||||
Arguments = $Entry.Properties.args #
|
||||
WorkingDirectory = $Entry.Properties.startIn # : % windir % \temp
|
||||
Server = $null # : smtp-de
|
||||
Subject = $null # : AD Group creation
|
||||
To = $null
|
||||
From = $null
|
||||
Body = $null
|
||||
Attachments = $null
|
||||
}
|
||||
$Action
|
||||
} else {
|
||||
|
||||
$Action = [ordered] @{
|
||||
ActionType = $Script:Actions["$($Entry.Properties.action)"]
|
||||
Command = $null
|
||||
Arguments = $null #
|
||||
WorkingDirectory = $null # : % windir % \temp
|
||||
Server = $null # : smtp-de
|
||||
Subject = $null # : AD Group creation
|
||||
To = $null
|
||||
From = $null
|
||||
Body = $null
|
||||
Attachments = $null
|
||||
}
|
||||
$Action
|
||||
}
|
||||
)
|
||||
}
|
||||
foreach ($Action in $ListActions) {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Type = $Type
|
||||
Changed = [DateTime] $Entry.changed
|
||||
GPOSettingOrder = $Entry.GPOSettingOrder
|
||||
userContext = ''
|
||||
|
||||
Name = $Entry.Name
|
||||
Status = $Entry.status
|
||||
Action = $Script:Actions["$($Entry.Properties.action)"]
|
||||
|
||||
|
||||
runAs = $Entry.Properties.runAs #: NT AUTHORITY\System
|
||||
#logonType = $Entry.Properties.logonType #: InteractiveToken
|
||||
#Task = $Entry.Properties.Task #: Task
|
||||
|
||||
Comment = $Entry.Properties.comment
|
||||
}
|
||||
if ($Entry.Properties.startOnlyIfIdle) {
|
||||
# Old legacy task
|
||||
$Middle = [ordered] @{
|
||||
AllowStartOnDemand = $null #: true
|
||||
DisallowStartIfOnBatteries = $Entry.Properties.noStartIfOnBatteries #: false
|
||||
StopIfGoingOnBatteries = $Entry.Properties.stopIfGoingOnBatteries #: false
|
||||
AllowHardTerminate = $null #: true
|
||||
Enabled = $Entry.Properties.enabled #: true
|
||||
Hidden = $null #: false
|
||||
MultipleInstancesPolicy = $null #: IgnoreNew
|
||||
Priority = $null #: 7
|
||||
ExecutionTimeLimit = $null #: PT1H
|
||||
#IdleSettings = $Entry.Properties.Task.Settings.IdleSettings #: IdleSettings
|
||||
|
||||
IdleDuration = $Entry.Properties.deadlineMinutes # : PT5M
|
||||
IdleWaitTimeout = $null # : PT1H
|
||||
IdleStopOnIdleEnd = $Entry.Properties.stopOnIdleEnd # : false
|
||||
IdleRestartOnIdle = $Entry.Properties.startOnlyIfIdle # : false
|
||||
|
||||
RegistrationInfoAuthor = $null
|
||||
RegistrationInfoDescription = $null
|
||||
deleteWhenDone = $Entry.Properties.deleteWhenDone
|
||||
|
||||
<#
|
||||
action : U
|
||||
name : Task Name
|
||||
appName : Run command
|
||||
args : args for command
|
||||
startIn : start me in
|
||||
comment : Oops i did it again
|
||||
enabled : 1
|
||||
deleteWhenDone : 1
|
||||
maxRunTime : 259200000
|
||||
startOnlyIfIdle : 1
|
||||
idleMinutes : 10
|
||||
deadlineMinutes : 60
|
||||
stopOnIdleEnd : 1
|
||||
noStartIfOnBatteries : 1
|
||||
stopIfGoingOnBatteries : 1
|
||||
systemRequired : 0
|
||||
Triggers : Triggers
|
||||
#>
|
||||
}
|
||||
} else {
|
||||
$Middle = [ordered] @{
|
||||
AllowStartOnDemand = $Entry.Properties.Task.Settings.AllowStartOnDemand #: true
|
||||
DisallowStartIfOnBatteries = $Entry.Properties.Task.Settings.DisallowStartIfOnBatteries #: false
|
||||
StopIfGoingOnBatteries = $Entry.Properties.Task.Settings.StopIfGoingOnBatteries #: false
|
||||
AllowHardTerminate = $Entry.Properties.Task.Settings.AllowHardTerminate #: true
|
||||
Enabled = $Entry.Properties.Task.Settings.Enabled #: true
|
||||
Hidden = $Entry.Properties.Task.Settings.Hidden #: false
|
||||
MultipleInstancesPolicy = $Entry.Properties.Task.Settings.MultipleInstancesPolicy #: IgnoreNew
|
||||
Priority = $Entry.Properties.Task.Settings.Priority #: 7
|
||||
ExecutionTimeLimit = $Entry.Properties.Task.Settings.ExecutionTimeLimit #: PT1H
|
||||
#IdleSettings = $Entry.Properties.Task.Settings.IdleSettings #: IdleSettings
|
||||
|
||||
IdleDuration = $Entry.Properties.Task.Settings.IdleSettings.Duration # : PT5M
|
||||
IdleWaitTimeout = $Entry.Properties.Task.Settings.IdleSettings.WaitTimeout # : PT1H
|
||||
IdleStopOnIdleEnd = $Entry.Properties.Task.Settings.IdleSettings.StopOnIdleEnd # : false
|
||||
IdleRestartOnIdle = $Entry.Properties.Task.Settings.IdleSettings.RestartOnIdle # : false
|
||||
|
||||
RegistrationInfoAuthor = $Entry.Properties.Task.RegistrationInfo.Author
|
||||
RegistrationInfoDescription = $Entry.Properties.Task.RegistrationInfo.Description
|
||||
|
||||
deleteWhenDone = $Entry.Properties.deleteWhenDone
|
||||
}
|
||||
}
|
||||
$End = [ordered] @{
|
||||
id = $Entry.Properties.Principals.Principal.id # : Author
|
||||
UserId = $Entry.Properties.Principals.Principal.UserId # : NT AUTHORITY\System
|
||||
LogonType = $Entry.Properties.Principals.Principal.LogonType # : InteractiveToken
|
||||
RunLevel = $Entry.Properties.Principals.Principal.RunLevel # : HighestAvailable
|
||||
|
||||
#Persistent = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
|
||||
#UseLetter = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
|
||||
#Letter = $Entry.Properties.letter
|
||||
}
|
||||
$CreateGPO = $CreateGPO + $Middle + $End + $Action
|
||||
$Last = [ordered] @{
|
||||
#Uid = $Group.uid #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
|
||||
RunInLoggedOnUserSecurityContext = if ($Entry.userContext -eq '1') { 'Enabled' } elseif ($Entry.userContext -eq '0') { 'Disabled' } else { $Entry.userContext };
|
||||
RemoveThisItemWhenItIsNoLongerApplied = if ($Entry.removePolicy -eq '1') { 'Enabled' } elseif ($Entry.removePolicy -eq '0') { 'Disabled' } else { $Entry.removePolicy };
|
||||
Filters = $Group.Filters #::
|
||||
}
|
||||
$CreateGPO = $CreateGPO + $Last
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
function Find-MissingProperties {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[Array] $Objects,
|
||||
[string[]] $PossibleProperties
|
||||
)
|
||||
$AllProperties = Select-Properties -AllProperties -Objects $Objects
|
||||
$MissingProperties = $AllProperties | Where-Object { $_ -notin 'DisplayName', 'DomainName', 'GUID', 'Linked', 'LinksCount', 'Links', 'GPOType', 'GPOCategory', 'GPOSettings' }
|
||||
[Array] $ConsiderAdding = foreach ($Property in $MissingProperties) {
|
||||
if ($Property -notin $PossibleProperties) {
|
||||
$Property
|
||||
}
|
||||
}
|
||||
$ConsiderAdding
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
function Get-GPOCategories {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[System.Xml.XmlElement[]] $GPOOutput,
|
||||
[string] $Splitter,
|
||||
[switch] $FullObjects,
|
||||
[System.Collections.IDictionary] $CachedCategories
|
||||
)
|
||||
if (-not $CachedCategories) {
|
||||
$CachedCategories = [ordered] @{}
|
||||
}
|
||||
$LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects
|
||||
foreach ($GpoType in @('User', 'Computer')) {
|
||||
if ($GPOOutput.$GpoType.ExtensionData.Extension) {
|
||||
foreach ($ExtensionType in $GPOOutput.$GpoType.ExtensionData.Extension) {
|
||||
# It's possible that one of the ExtensionType records has value null. Weird but happend.
|
||||
if ($ExtensionType) {
|
||||
$GPOSettingTypeSplit = ($ExtensionType.type -split ':')
|
||||
try {
|
||||
$KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
|
||||
} catch {
|
||||
Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
|
||||
continue
|
||||
}
|
||||
|
||||
foreach ($GpoSettings in $KeysToLoop.Name) {
|
||||
$Template = [ordered] @{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.Guid
|
||||
GpoType = $GpoType
|
||||
GpoCategory = $GPOSettingTypeSplit[1]
|
||||
GpoSettings = $GpoSettings
|
||||
}
|
||||
$Template['Linked'] = $LinksInformation.Linked
|
||||
$Template['LinksCount'] = $LinksInformation.LinksCount
|
||||
$Template['Links'] = $LinksInformation.Links
|
||||
$Template['IncludeComments'] = [bool]::Parse($GPOOutput.IncludeComments)
|
||||
$Template['CreatedTime'] = [DateTime] $GPOOutput.CreatedTime
|
||||
$Template['ModifiedTime'] = [DateTime] $GPOOutput.ModifiedTime
|
||||
$Template['ReadTime'] = [DateTime] $GPOOutput.ReadTime
|
||||
$Template['SecurityDescriptor'] = $GPOOutput.SecurityDescriptor
|
||||
$Template['FilterDataAvailable'] = [bool]::Parse($GPOOutput.FilterDataAvailable)
|
||||
$Template['DataSet'] = $ExtensionType.$GpoSettings
|
||||
$ConvertedObject = [PSCustomObject] $Template
|
||||
|
||||
if (-not $CachedCategories["$($Template.GpoCategory)"]) {
|
||||
$CachedCategories["$($Template.GpoCategory)"] = [ordered] @{}
|
||||
}
|
||||
if (-not $CachedCategories["$($Template.GpoCategory)"]["$($Template.GpoSettings)"]) {
|
||||
$CachedCategories["$($Template.GpoCategory)"]["$($Template.GpoSettings)"] = [System.Collections.Generic.List[PSCustomObject]]::new()
|
||||
}
|
||||
$CachedCategories["$($Template.GpoCategory)"]["$($Template.GpoSettings)"].Add($ConvertedObject)
|
||||
# return GPOCategory
|
||||
$ConvertedObject
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
function Get-LinksFromXML {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[System.Xml.XmlElement[]] $GPOOutput,
|
||||
[string] $Splitter,
|
||||
[switch] $FullObjects
|
||||
)
|
||||
$Links = [ordered] @{
|
||||
Linked = $null
|
||||
LinksCount = $null
|
||||
Links = $null
|
||||
}
|
||||
if ($GPOOutput.LinksTo) {
|
||||
$Links.Linked = $true
|
||||
$Links.LinksCount = ([Array] $GPOOutput.LinksTo).Count
|
||||
$Links.Links = foreach ($Link in $GPOOutput.LinksTo) {
|
||||
if ($FullObjects) {
|
||||
[PSCustomObject] @{
|
||||
Path = $Link.SOMPath
|
||||
Enabled = if ($Link.Enabled -eq 'true') { $true } else { $false }
|
||||
NoOverride = if ($Link.NoOverride -eq 'true') { $true } else { $false }
|
||||
}
|
||||
} else {
|
||||
if ($Link.Enabled) {
|
||||
$Link.SOMPath
|
||||
}
|
||||
}
|
||||
}
|
||||
if ($Splitter) {
|
||||
$Links.Links = $Links.Links -join $Splitter
|
||||
}
|
||||
} else {
|
||||
$Links.Linked = $false
|
||||
$Links.LinksCount = 0
|
||||
$Links.Links = $null
|
||||
}
|
||||
[PSCustomObject] $Links
|
||||
}
|
||||
@@ -13,7 +13,7 @@
|
||||
$DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
|
||||
$Output = [ordered] @{
|
||||
DistinguishedName = $Object.DistinguishedName
|
||||
CanonicalName = $Object.CanonicalName.TrimEnd('/');
|
||||
CanonicalName = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
|
||||
Guid = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
|
||||
}
|
||||
$Search = -join ($DomainCN, $Output['Guid'])
|
||||
@@ -45,7 +45,7 @@
|
||||
$DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
|
||||
$Output = [ordered] @{
|
||||
DistinguishedName = $Object.DistinguishedName
|
||||
CanonicalName = $Object.CanonicalName.TrimEnd('/');
|
||||
CanonicalName = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
|
||||
Guid = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
|
||||
}
|
||||
$Search = -join ($DomainCN, $Output['Guid'])
|
||||
|
||||
@@ -112,6 +112,9 @@
|
||||
'UserSettingsVersionIdentical' = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
|
||||
'UserSettings' = $XMLContent.GPO.User.ExtensionData.Extension
|
||||
|
||||
ComputerPolicies = $XMLContent.GPO.Computer.ExtensionData.Name -join ", "
|
||||
UserPolicies = $XMLContent.GPO.User.ExtensionData.Name -join ", "
|
||||
|
||||
'CreationTime' = [DateTime] $XMLContent.GPO.CreatedTime
|
||||
'ModificationTime' = [DateTime] $XMLContent.GPO.ModifiedTime
|
||||
'ReadTime' = [DateTime] $XMLContent.GPO.ReadTime
|
||||
|
||||
@@ -0,0 +1,111 @@
|
||||
function Get-XMLNestedRegistry {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[System.Xml.XmlElement[]] $DataSet,
|
||||
[string] $Collection,
|
||||
[switch] $Limited
|
||||
)
|
||||
if ($DataSet.Properties) {
|
||||
$Registry = $DataSet
|
||||
foreach ($Registry in $DataSet) {
|
||||
if ($Limited) {
|
||||
[PSCustomObject] @{
|
||||
Collection = $Collection
|
||||
Changed = [DateTime] $Registry.changed
|
||||
GPOSettingOrder = $Registry.GPOSettingOrder
|
||||
Hive = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
|
||||
Key = $Registry.Properties.key #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
|
||||
Name = $Registry.Properties.name #: AutoAdminLogon
|
||||
Type = $Registry.Properties.type #: REG_SZ
|
||||
Value = $Registry.Properties.value #
|
||||
Filters = $Registry.Filters
|
||||
}
|
||||
} else {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Collection = $Collection
|
||||
Changed = [DateTime] $Registry.changed
|
||||
GPOSettingOrder = $Registry.GPOSettingOrder
|
||||
Hive = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
|
||||
Key = $Registry.Properties.key #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
|
||||
Name = $Registry.Properties.name #: AutoAdminLogon
|
||||
Type = $Registry.Properties.type #: REG_SZ
|
||||
Value = $Registry.Properties.value #
|
||||
Filters = $Registry.Filters
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
foreach ($Name in @('Registry', 'Collection')) {
|
||||
foreach ($Registry in $DataSet.$Name) {
|
||||
if ($Registry.Properties) {
|
||||
if ($Limited) {
|
||||
[PSCustomObject] @{
|
||||
Collection = $Collection
|
||||
Changed = [DateTime] $Registry.changed
|
||||
GPOSettingOrder = $Registry.GPOSettingOrder
|
||||
Hive = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
|
||||
Key = $Registry.Properties.key #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
|
||||
Name = $Registry.Properties.name #: AutoAdminLogon
|
||||
Type = $Registry.Properties.type #: REG_SZ
|
||||
Value = $Registry.Properties.value #
|
||||
Filters = $Registry.Filters
|
||||
}
|
||||
} else {
|
||||
$CreateGPO = [ordered]@{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.GUID
|
||||
GpoType = $GPO.GpoType
|
||||
#GpoCategory = $GPOEntry.GpoCategory
|
||||
#GpoSettings = $GPOEntry.GpoSettings
|
||||
Collection = $Collection
|
||||
Changed = [DateTime] $Registry.changed
|
||||
GPOSettingOrder = $Registry.GPOSettingOrder
|
||||
Hive = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
|
||||
Key = $Registry.Properties.key #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
|
||||
Name = $Registry.Properties.name #: AutoAdminLogon
|
||||
Type = $Registry.Properties.type #: REG_SZ
|
||||
Value = $Registry.Properties.value #
|
||||
Filters = $Registry.Filters
|
||||
}
|
||||
$CreateGPO['Linked'] = $GPO.Linked
|
||||
$CreateGPO['LinksCount'] = $GPO.LinksCount
|
||||
$CreateGPO['Links'] = $GPO.Links
|
||||
[PSCustomObject] $CreateGPO
|
||||
}
|
||||
} else {
|
||||
if ($Registry.Registry) {
|
||||
#$Collection = $Registry.name
|
||||
$TempCollection = $Collection
|
||||
if ($Collection) {
|
||||
$Collection = "$Collection\$($Registry.name)"
|
||||
} else {
|
||||
$Collection = $Registry.name
|
||||
}
|
||||
Get-XMLNestedRegistry -GPO $GPO -DataSet $Registry.Registry -Collection $Collection
|
||||
$Collection = $TempCollection
|
||||
}
|
||||
if ($Registry.Collection) {
|
||||
if ($Collection) {
|
||||
$Collection = "$Collection\$($Registry.Collection.name)"
|
||||
} else {
|
||||
$Collection = "$($Registry.name)\$($Registry.Collection.name)"
|
||||
}
|
||||
Get-XMLNestedRegistry -GPO $GPO -DataSet $Registry.Collection -Collection $Collection
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
function Get-XMLOutput {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[System.Xml.XmlElement[]] $GPOOutput,
|
||||
[string] $Splitter,
|
||||
[switch] $FullObjects
|
||||
)
|
||||
$LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects
|
||||
foreach ($GpoType in @('User', 'Computer')) {
|
||||
if ($GPOOutput.$GpoType.ExtensionData.Extension) {
|
||||
foreach ($ExtensionType in $GPOOutput.$GpoType.ExtensionData.Extension) {
|
||||
# It's possible that one of the ExtensionType records has value null. Weird but happend.
|
||||
if ($ExtensionType) {
|
||||
$GPOSettingTypeSplit = ($ExtensionType.type -split ':')
|
||||
try {
|
||||
$KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
|
||||
} catch {
|
||||
Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
|
||||
continue
|
||||
}
|
||||
foreach ($GpoSettings in $KeysToLoop.Name) {
|
||||
$Template = [ordered] @{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.Guid
|
||||
GpoType = $GpoType
|
||||
GpoCategory = $GPOSettingTypeSplit[1]
|
||||
GpoSettings = $GpoSettings
|
||||
}
|
||||
[PSCustomObject] $Template
|
||||
}
|
||||
continue
|
||||
|
||||
foreach ($GpoSettings in $KeysToLoop.Name) {
|
||||
foreach ($Key in $ExtensionType.$GpoSettings) {
|
||||
$Template = [ordered] @{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.Guid
|
||||
GpoType = $GpoType
|
||||
GpoCategory = $GPOSettingTypeSplit[1]
|
||||
GpoSettings = $GpoSettings
|
||||
}
|
||||
try {
|
||||
$Properties = ($Key | Get-Member -MemberType Properties -ErrorAction Stop).Name
|
||||
} catch {
|
||||
Write-Warning "Get-XMLStandard - things went sideways 1 $($_.Exception.Message)"
|
||||
$Properties = $null
|
||||
}
|
||||
foreach ($Property in $Properties) {
|
||||
$Template["$Property"] = $Key.$Property
|
||||
}
|
||||
$Template['Linked'] = $LinksInformation.Linked
|
||||
$Template['LinksCount'] = $LinksInformation.LinksCount
|
||||
$Template['Links'] = $LinksInformation.Links
|
||||
<#
|
||||
$Template['IncludeComments'] = $GPOOutput.IncludeComments # : true #: true
|
||||
$Template['CreatedTime'] = $GPOOutput.CreatedTime # : 2020-06-17T11:23:22 #: 2020-06-17T11:23:22
|
||||
$Template['ModifiedTime'] = $GPOOutput.ModifiedTime # : 2020-06-28T15:49:52 #: 2020-06-28T15:49:52
|
||||
$Template['ReadTime'] = $GPOOutput.ReadTime # : 2020-06-28T16:14:09.2209011Z #: 2020-06-28T16:14:09.2209011Z
|
||||
$Template['SecurityDescriptor'] = $GPOOutput.SecurityDescriptor # : SecurityDescriptor #: SecurityDescriptor
|
||||
$Template['FilterDataAvailable'] = $GPOOutput.FilterDataAvailable # : true #: true
|
||||
#>
|
||||
[PSCustomObject] $Template
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
function Get-XMLStandard {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[PSCustomObject] $GPO,
|
||||
[System.Xml.XmlElement[]] $GPOOutput,
|
||||
[string] $Splitter,
|
||||
[switch] $FullObjects
|
||||
)
|
||||
$LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects
|
||||
foreach ($GpoType in @('User', 'Computer')) {
|
||||
if ($GPOOutput.$GpoType.ExtensionData.Extension) {
|
||||
foreach ($ExtensionType in $GPOOutput.$GpoType.ExtensionData.Extension) {
|
||||
# It's possible that one of the ExtensionType records has value null. Weird but happend.
|
||||
if ($ExtensionType) {
|
||||
$GPOSettingTypeSplit = ($ExtensionType.type -split ':')
|
||||
try {
|
||||
$KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
|
||||
} catch {
|
||||
Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
|
||||
continue
|
||||
}
|
||||
foreach ($GpoSettings in $KeysToLoop.Name) {
|
||||
foreach ($Key in $ExtensionType.$GpoSettings) {
|
||||
$Template = [ordered] @{
|
||||
DisplayName = $GPO.DisplayName
|
||||
DomainName = $GPO.DomainName
|
||||
GUID = $GPO.Guid
|
||||
GpoType = $GpoType
|
||||
GpoCategory = $GPOSettingTypeSplit[1]
|
||||
GpoSettings = $GpoSettings
|
||||
}
|
||||
try {
|
||||
$Properties = ($Key | Get-Member -MemberType Properties -ErrorAction Stop).Name
|
||||
} catch {
|
||||
Write-Warning "Get-XMLStandard - things went sideways 1 $($_.Exception.Message)"
|
||||
$Properties = $null
|
||||
}
|
||||
foreach ($Property in $Properties) {
|
||||
$Template["$Property"] = $Key.$Property
|
||||
}
|
||||
$Template['Linked'] = $LinksInformation.Linked
|
||||
$Template['LinksCount'] = $LinksInformation.LinksCount
|
||||
$Template['Links'] = $LinksInformation.Links
|
||||
<#
|
||||
$Template['IncludeComments'] = $GPOOutput.IncludeComments # : true #: true
|
||||
$Template['CreatedTime'] = $GPOOutput.CreatedTime # : 2020-06-17T11:23:22 #: 2020-06-17T11:23:22
|
||||
$Template['ModifiedTime'] = $GPOOutput.ModifiedTime # : 2020-06-28T15:49:52 #: 2020-06-28T15:49:52
|
||||
$Template['ReadTime'] = $GPOOutput.ReadTime # : 2020-06-28T16:14:09.2209011Z #: 2020-06-28T16:14:09.2209011Z
|
||||
$Template['SecurityDescriptor'] = $GPOOutput.SecurityDescriptor # : SecurityDescriptor #: SecurityDescriptor
|
||||
$Template['FilterDataAvailable'] = $GPOOutput.FilterDataAvailable # : true #: true
|
||||
#>
|
||||
[PSCustomObject] $Template
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
function Invoke-GPOTranslation {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[System.Collections.IDictionary] $InputData,
|
||||
[string] $Report,
|
||||
[string] $Category,
|
||||
[string] $Settings
|
||||
)
|
||||
if ($Category -and $Settings -and $InputData) {
|
||||
if ($Script:GPODitionary[$Report]['Code']) {
|
||||
$Script:GPOList = $InputData.$Category.$Settings
|
||||
return & $Script:GPODitionary[$Report]['Code']
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
$Script:Actions = @{
|
||||
C = 'Create'
|
||||
D = 'Delete'
|
||||
U = 'Update'
|
||||
R = 'Replace'
|
||||
}
|
||||
@@ -0,0 +1,240 @@
|
||||
$Script:GPODitionary = [ordered] @{
|
||||
AccountPolicies = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'SecuritySettings'
|
||||
Settings = 'Account'
|
||||
}
|
||||
)
|
||||
GPOPath = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies'
|
||||
Code = {
|
||||
ConvertTo-XMLAccountPolicy -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLAccountPolicy -GPO $GPO
|
||||
}
|
||||
}
|
||||
Audit = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'SecuritySettings'
|
||||
Settings = 'Audit'
|
||||
}
|
||||
)
|
||||
GPOPath = ''
|
||||
Code = {
|
||||
ConvertTo-XMLAudit -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLAudit -GPO $GPO
|
||||
}
|
||||
}
|
||||
Autologon = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'RegistrySettings'
|
||||
Settings = 'RegistrySettings'
|
||||
}
|
||||
)
|
||||
Code = {
|
||||
ConvertTo-XMLRegistryAutologon -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLRegistryAutologon -GPO $GPO
|
||||
}
|
||||
}
|
||||
DriveMapping = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'DriveMapSettings'
|
||||
Settings = 'DriveMapSettings'
|
||||
}
|
||||
)
|
||||
GPOPath = ''
|
||||
Code = {
|
||||
ConvertTo-XMLDriveMapSettings -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLDriveMapSettings -GPO $GPO -SingleObject
|
||||
}
|
||||
}
|
||||
EventLog = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'SecuritySettings'
|
||||
Settings = 'EventLog'
|
||||
}
|
||||
)
|
||||
GPOPath = ''
|
||||
Code = {
|
||||
ConvertTo-XMLEventLog -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLEventLog -GPO $GPO
|
||||
}
|
||||
}
|
||||
LocalUsers = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'LugsSettings'
|
||||
Settings = 'LocalUsersAndGroups'
|
||||
}
|
||||
)
|
||||
Code = {
|
||||
ConvertTo-XMLLocalUser -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLLocalUser -GPO $GPO -SingleObject
|
||||
}
|
||||
}
|
||||
LocalGroups = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'LugsSettings'
|
||||
Settings = 'LocalUsersAndGroups'
|
||||
}
|
||||
)
|
||||
Code = {
|
||||
ConvertTo-XMLLocalGroups -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLLocalGroups -GPO $GPO -SingleObject
|
||||
}
|
||||
}
|
||||
Policies = @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'RegistrySettings'
|
||||
Settings = 'Policy'
|
||||
}
|
||||
)
|
||||
Code = {
|
||||
ConvertTo-XMLPolicies -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLPolicies -GPO $GPO -SingleObject
|
||||
}
|
||||
}
|
||||
Printers = @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'PrintersSettings'
|
||||
Settings = 'Printers'
|
||||
}
|
||||
@{
|
||||
Category = 'PrinterConnectionSettings'
|
||||
Settings = 'PrinterConnection'
|
||||
}
|
||||
)
|
||||
Code = {
|
||||
ConvertTo-XMLPrinter -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLPrinter -GPO $GPO -SingleObject
|
||||
}
|
||||
}
|
||||
RegistrySettings = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'RegistrySettings'
|
||||
Settings = 'RegistrySettings'
|
||||
}
|
||||
)
|
||||
Code = {
|
||||
ConvertTo-XMLRegistrySettings -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLRegistrySettings -GPO $GPO -SingleObject
|
||||
}
|
||||
}
|
||||
Scripts = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'Scripts'
|
||||
Settings = 'Script'
|
||||
}
|
||||
)
|
||||
Code = {
|
||||
ConvertTo-XMLScripts -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLScripts -GPO $GPO -SingleObject
|
||||
}
|
||||
}
|
||||
SecurityOptions = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'SecuritySettings'
|
||||
Settings = 'SecurityOptions'
|
||||
}
|
||||
)
|
||||
Code = {
|
||||
ConvertTo-XMLSecurityOptions -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLSecurityOptions -GPO $GPO -SingleObject
|
||||
}
|
||||
}
|
||||
SoftwareInstallation = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'SoftwareInstallationSettings'
|
||||
Settings = 'MsiApplication'
|
||||
}
|
||||
)
|
||||
Code = {
|
||||
ConvertTo-XMLSoftwareInstallation -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLSoftwareInstallation -GPO $GPO -SingleObject
|
||||
}
|
||||
}
|
||||
SystemServices = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'SecuritySettings'
|
||||
Settings = 'SystemServices'
|
||||
}
|
||||
)
|
||||
Description = ''
|
||||
GPOPath = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> System Services'
|
||||
Code = {
|
||||
ConvertTo-XMLSystemServices -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLSystemServices -GPO $GPO -SingleObject
|
||||
}
|
||||
}
|
||||
SystemServicesNT = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'ServiceSettings'
|
||||
Settings = 'NTServices'
|
||||
}
|
||||
)
|
||||
Description = ''
|
||||
GPOPath = 'Computer Configuration -> Preferences -> Control Pannel Settings -> Services'
|
||||
Code = {
|
||||
ConvertTo-XMLSystemServicesNT -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLSystemServicesNT -GPO $GPO -SingleObject
|
||||
}
|
||||
}
|
||||
TaskScheduler = [ordered] @{
|
||||
Types = @(
|
||||
@{
|
||||
Category = 'ScheduledTasksSettings'
|
||||
Settings = 'ScheduledTasks'
|
||||
}
|
||||
)
|
||||
Description = ''
|
||||
GPOPath = ''
|
||||
Code = {
|
||||
ConvertTo-XMLTaskScheduler -GPO $GPO
|
||||
}
|
||||
CodeSingle = {
|
||||
ConvertTo-XMLTaskScheduler -GPO $GPO -SingleObject
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -3,7 +3,7 @@
|
||||
param(
|
||||
[validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
|
||||
[Microsoft.GroupPolicy.GPPermissionType] $IncludePermissionType,
|
||||
[alias('Trustee')][Array] $Principal,
|
||||
[alias('Trustee')][string] $Principal,
|
||||
[alias('TrusteeType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
|
||||
[validateSet('Allow', 'Deny')][string] $PermitType = 'Allow'
|
||||
)
|
||||
|
||||
+18
-13
@@ -50,19 +50,24 @@
|
||||
}
|
||||
Get-ADObject @Splat -Properties DisplayName, Name, Created, Modified, gPCFileSysPath, gPCFunctionalityVersion, gPCWQLFilter, gPCMachineExtensionNames, Description, CanonicalName, DistinguishedName | ForEach-Object -Process {
|
||||
$DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDomainCN
|
||||
$Output = [ordered]@{ }
|
||||
$Output['DisplayName'] = $_.DisplayName
|
||||
$Output['DomainName'] = $DomainCN
|
||||
$Output['Description'] = $_.Description
|
||||
$Output['GUID'] = $_.Name -replace '{' -replace '}'
|
||||
$Output['Path'] = $_.gPCFileSysPath
|
||||
$Output['FunctionalityVersion'] = $_.gPCFunctionalityVersion
|
||||
$Output['Created'] = $_.Created
|
||||
$Output['Modified'] = $_.Modified
|
||||
$Output['GPOCanonicalName'] = $_.CanonicalName
|
||||
$Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDC
|
||||
$Output['GPODistinguishedName'] = $_.DistinguishedName
|
||||
[PSCustomObject] $Output
|
||||
$GUID = $_.Name -replace '{' -replace '}'
|
||||
if (($GUID).Length -ne 36) {
|
||||
Write-Warning "Get-GPOZaurrAD - GPO GUID ($($($GUID.Replace("`n",' ')))) is incorrect. Skipping $($_.DisplayName) / Domain: $($DomainCN)"
|
||||
} else {
|
||||
$Output = [ordered]@{ }
|
||||
$Output['DisplayName'] = $_.DisplayName
|
||||
$Output['DomainName'] = $DomainCN
|
||||
$Output['Description'] = $_.Description
|
||||
$Output['GUID'] = $GUID
|
||||
$Output['Path'] = $_.gPCFileSysPath
|
||||
$Output['FunctionalityVersion'] = $_.gPCFunctionalityVersion
|
||||
$Output['Created'] = $_.Created
|
||||
$Output['Modified'] = $_.Modified
|
||||
$Output['GPOCanonicalName'] = $_.CanonicalName
|
||||
$Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDC
|
||||
$Output['GPODistinguishedName'] = $_.DistinguishedName
|
||||
[PSCustomObject] $Output
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,29 @@
|
||||
function Get-GPOZaurrEmptyFolders {
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
[System.Collections.IDictionary] $ExtendedForestInformation,
|
||||
[switch] $AllFolders
|
||||
)
|
||||
$ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies" -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -Force -Directory | ForEach-Object {
|
||||
$FullFolder = Test-Path -Path "$($_.FullName)\*"
|
||||
if (-not $FullFolder -or $AllFolders) {
|
||||
[PSCustomObject] @{
|
||||
FullName = $_.FullName
|
||||
IsEmptyFolder = -not $FullFolder
|
||||
Name = $_.Name
|
||||
Root = $_.Root
|
||||
Parent = $_.Parent
|
||||
CreationTime = $_.CreationTime
|
||||
LastWriteTime = $_.LastWriteTime
|
||||
Attributes = $_.Attributes
|
||||
DomainName = $Domain
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,309 @@
|
||||
function Get-GPOZaurrFiles {
|
||||
[cmdletbinding()]
|
||||
param(
|
||||
[ValidateSet('All', 'Netlogon', 'Sysvol')][string[]] $Type = 'All',
|
||||
[ValidateSet('None', 'MACTripleDES', 'MD5', 'RIPEMD160', 'SHA1', 'SHA256', 'SHA384', 'SHA512')][string] $HashAlgorithm = 'None',
|
||||
[switch] $Signature,
|
||||
[switch] $Limited,
|
||||
[switch] $AsHashTable,
|
||||
[switch] $Extended,
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
[System.Collections.IDictionary] $ExtendedForestInformation
|
||||
)
|
||||
$GPOCache = @{}
|
||||
$ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
$GPOList = Get-GPOZaurrAD -ExtendedForestInformation $ForestInformation
|
||||
foreach ($GPO in $GPOList) {
|
||||
if (-not $GPOCache[$GPO.DomainName]) {
|
||||
$GPOCache[$GPO.DomainName] = @{}
|
||||
}
|
||||
$GPOCache[$($GPO.DomainName)][($GPO.GUID)] = $GPO
|
||||
}
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
$Path = @(
|
||||
if ($Type -contains 'All') {
|
||||
"\\$Domain\SYSVOL\$Domain"
|
||||
}
|
||||
if ($Type -contains 'Sysvol') {
|
||||
"\\$Domain\SYSVOL\$Domain\policies"
|
||||
}
|
||||
if ($Type -contains 'NetLogon') {
|
||||
"\\$Domain\NETLOGON"
|
||||
}
|
||||
)
|
||||
# Order does matter
|
||||
$Folders = [ordered] @{
|
||||
"\\$Domain\SYSVOL\$Domain\policies\PolicyDefinitions" = @{
|
||||
Name = 'SYSVOL PolicyDefinitions'
|
||||
}
|
||||
"\\$Domain\SYSVOL\$Domain\policies" = @{
|
||||
Name = 'SYSVOL Policies'
|
||||
}
|
||||
"\\$Domain\SYSVOL\$Domain\scripts" = @{
|
||||
Name = 'NETLOGON Scripts'
|
||||
}
|
||||
"\\$Domain\SYSVOL\$Domain\StarterGPOs" = @{
|
||||
Name = 'SYSVOL GPO Starters'
|
||||
}
|
||||
"\\$Domain\NETLOGON" = @{
|
||||
Name = 'NETLOGON Scripts'
|
||||
}
|
||||
"\\$Domain\SYSVOL\$Domain" = @{
|
||||
Name = 'SYSVOL Root'
|
||||
}
|
||||
}
|
||||
Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File -Force | ForEach-Object {
|
||||
# Lets reset values just to be sure those are empty
|
||||
$GPO = $null
|
||||
$BelongsToGPO = $false
|
||||
$GPODisplayName = $null
|
||||
$SuggestedAction = $null
|
||||
$SuggestedActionComment = $null
|
||||
$FileType = foreach ($Key in $Folders.Keys) {
|
||||
if ($_.FullName -like "$Key*") {
|
||||
$Folders[$Key]
|
||||
break
|
||||
}
|
||||
}
|
||||
if ($FileType.Name -eq 'SYSVOL Policies') {
|
||||
$FoundGUID = $_.FullName -match '[\da-zA-Z]{8}-([\da-zA-Z]{4}-){3}[\da-zA-Z]{12}'
|
||||
if ($FoundGUID) {
|
||||
$GPO = $GPOCache[$Domain][$matches[0]]
|
||||
if ($GPO) {
|
||||
$BelongsToGPO = $true
|
||||
$GPODisplayName = $GPO.DisplayName
|
||||
}
|
||||
}
|
||||
$Correct = @(
|
||||
[System.IO.Path]::Combine($GPO.Path, 'GPT.INI')
|
||||
[System.IO.Path]::Combine($GPO.Path, 'GPO.cmt')
|
||||
[System.IO.Path]::Combine($GPO.Path, 'Group Policy', 'GPE.ini')
|
||||
foreach ($TypeM in @('Machine', 'User')) {
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Registry.pol')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'comment.cmtx')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Registry\Registry.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Printers\Printers.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\ScheduledTasks\ScheduledTasks.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Services\Services.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Groups\Groups.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\RegionalOptions\RegionalOptions.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\FolderOptions\FolderOptions.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Drives\Drives.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\InternetSettings\InternetSettings.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Folders\Folders.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\PowerOptions\PowerOptions.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Shortcuts\Shortcuts.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Files\Files.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\EnvironmentVariables\EnvironmentVariables.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\NetworkOptions\NetworkOptions.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\DataSources\DataSources.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\NetworkShares\NetworkShares.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\StartMenuTaskbar\StartMenuTaskbar.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Applications\Microsoft\TBLayout.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Applications\Microsoft\DefaultApps.xml')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Applications\ADE.CFG')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Scripts\scripts.ini')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Scripts\psscripts.ini')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Documents & Settings\fdeploy.ini')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Documents & Settings\fdeploy1.ini')
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Documents & Settings\fdeploy2.ini')
|
||||
if ($_.Extension -eq '.aas') {
|
||||
[System.IO.Path]::Combine($GPO.Path, $TypeM, 'Applications', $_.Name)
|
||||
}
|
||||
}
|
||||
[System.IO.Path]::Combine($GPO.Path, 'Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf')
|
||||
[System.IO.Path]::Combine($GPO.Path, 'Machine\Microsoft\Windows NT\Audit\audit.csv')
|
||||
)
|
||||
if ($GPO) {
|
||||
if ($_.FullName -in $Correct) {
|
||||
$SuggestedAction = 'Skip assesment'
|
||||
$SuggestedActionComment = 'Correctly placed in SYSVOL'
|
||||
} elseif ($_.FullName -like '*_NTFRS_*') {
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = 'Most likely replication error'
|
||||
} elseif ($_.Extension -eq '.adm') {
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = 'Most likely legacy ADM files'
|
||||
}
|
||||
if (-not $SuggestedAction) {
|
||||
$FullPathAdmFiles = [System.IO.Path]::Combine($GPO.Path, 'Adm\admfiles.ini')
|
||||
if ($_.FullName -eq $FullPathAdmFiles) {
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = 'Most likely legacy ADM files settings file'
|
||||
}
|
||||
}
|
||||
if (-not $SuggestedAction) {
|
||||
foreach ($Ext in @('*old*', '*bak*', '*bck', '.new')) {
|
||||
if ($_.Extension -like $Ext) {
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = 'Most likely backup files'
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
if (-not $SuggestedAction) {
|
||||
<#
|
||||
$IEAK = @(
|
||||
'microsoft\IEAK\install.ins'
|
||||
'MICROSOFT\IEAK\BRANDING\cs\connect.ras'
|
||||
'microsoft\IEAK\BRANDING\cs\connect.set'
|
||||
'microsoft\IEAK\BRANDING\cs\cs.dat'
|
||||
'microsoft\IEAK\BRANDING\ADM\inetcorp.iem'
|
||||
'microsoft\IEAK\BRANDING\ADM\inetcorp.inf'
|
||||
'microsoft\IEAK\install.ins'
|
||||
'microsoft\IEAK\BRANDING\favs\Outlook.ico'
|
||||
'microsoft\IEAK\BRANDING\favs\Bio.ico'
|
||||
'MICROSOFT\IEAK\BRANDING\favs\$fi380.ico'
|
||||
'microsoft\IEAK\BRANDING\PROGRAMS\programs.inf'
|
||||
'MICROSOFT\IEAK\BRANDING\RATINGS\ratings.inf'
|
||||
'MICROSOFT\IEAK\BRANDING\RATINGS\ratrsop.inf'
|
||||
'microsoft\IEAK\BRANDING\ZONES\seczones.inf'
|
||||
'microsoft\IEAK\BRANDING\ZONES\seczrsop.inf'
|
||||
'microsoft\IEAK\BRANDING\ZONES\seczrsop.inf'
|
||||
)
|
||||
#>
|
||||
if ($_.FullName -like '*microsoft\IEAK*') {
|
||||
# https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11#:~:text=The%20Internet%20Explorer%20Maintenance%20(IEM,Internet%20Explorer%2010%20or%20newer.
|
||||
$SuggestedAction = 'GPO requires cleanup'
|
||||
$SuggestedActionComment = 'Internet Explorer Maintenance (IEM) is deprecated for IE 11'
|
||||
}
|
||||
}
|
||||
} else {
|
||||
<#
|
||||
$FullPathAdmFiles = [System.IO.Path]::Combine($GPO.Path, 'Adm\admfiles.ini')
|
||||
if ($_.FullName -in $Correct) {
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = 'Most likely orphaned SYSVOL GPO'
|
||||
} elseif ($_.Extension -eq '.adm') {
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = 'Most likely orphaned SYSVOL GPO (legacy ADM files)'
|
||||
} elseif ($_.FullName -eq $FullPathAdmFiles) {
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = 'Most likely orphaned SYSVOL GPO (legacy ADM files)'
|
||||
}
|
||||
#>
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = 'Most likely orphaned SYSVOL GPO'
|
||||
}
|
||||
} elseif ($FileType.Name -eq 'NETLOGON Scripts') {
|
||||
foreach ($Ext in @('*old*', '*bak*', '*bck', '.new')) {
|
||||
if ($_.Extension -like $Ext) {
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = 'Most likely backup files'
|
||||
break
|
||||
}
|
||||
}
|
||||
if (-not $SuggestedAction) {
|
||||
# We didn't find it in earlier check, lets go deeper
|
||||
if ($_.Extension.Length -gt 6 -and $_.Extension -notin @('.config', '.sites', '.ipsec')) {
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = 'Extension longer then 5 chars'
|
||||
} elseif ($_.Extension -eq '') {
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = 'No extension'
|
||||
}
|
||||
}
|
||||
if (-not $SuggestedAction) {
|
||||
foreach ($Name in @('*old*', '*bak*', '*bck*', '*Copy', '*backup*')) {
|
||||
if ($_.BaseName -like $Name) {
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = "FileName contains backup related names ($Name)"
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
if (-not $SuggestedAction) {
|
||||
foreach ($FullName in @('*backup*', '*Delete*', '*Obsoleet*', '*Obsolete*', '*Archive*')) {
|
||||
if ($_.FullName -like $FullName) {
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = "Fullname contains backup related names ($FullName)"
|
||||
break
|
||||
}
|
||||
}
|
||||
}
|
||||
if (-not $SuggestedAction) {
|
||||
# We replace all letters leaving only numbers
|
||||
# We want to find if there is a date possibly
|
||||
$StrippedNumbers = $_.Name -replace "[^0-9]" , ''
|
||||
if ($StrippedNumbers.Length -gt 5) {
|
||||
$SuggestedAction = 'Consider deleting'
|
||||
$SuggestedActionComment = 'FileName contains over 5 numbers (date?)'
|
||||
}
|
||||
}
|
||||
} elseif ($FileType.Name -eq 'SYSVOL PolicyDefinitions') {
|
||||
if ($_.Extension -in @('.admx', '.adml')) {
|
||||
$SuggestedAction = 'Skip assesment'
|
||||
$SuggestedActionComment = 'Most likely ADMX templates'
|
||||
}
|
||||
} elseif ($FileType.Name -eq 'SYSVOL GPO Starters') {
|
||||
$FoundGUID = $_.FullName -match '[\da-zA-Z]{8}-([\da-zA-Z]{4}-){3}[\da-zA-Z]{12}'
|
||||
if ($FoundGUID) {
|
||||
$GUID = $matches[0]
|
||||
$TemporaryStarterPath = "\\$Domain\SYSVOL\$Domain\StarterGPOs\{$GUID}"
|
||||
$Correct = @(
|
||||
[System.IO.Path]::Combine($TemporaryStarterPath, 'StarterGPO.tmplx')
|
||||
[System.IO.Path]::Combine($TemporaryStarterPath, 'en-US', 'StarterGPO.tmpll')
|
||||
foreach ($TypeM in @('Machine', 'User')) {
|
||||
[System.IO.Path]::Combine($TemporaryStarterPath, $TypeM, 'Registry.pol')
|
||||
[System.IO.Path]::Combine($TemporaryStarterPath, $TypeM, 'comment.cmtx')
|
||||
}
|
||||
)
|
||||
if ($_.FullName -in $Correct) {
|
||||
$SuggestedAction = 'Skip assesment'
|
||||
$SuggestedActionComment = 'Correctly placed in SYSVOL'
|
||||
}
|
||||
}
|
||||
} else {
|
||||
|
||||
}
|
||||
if (-not $SuggestedAction) {
|
||||
$SuggestedAction = 'Requires verification'
|
||||
$SuggestedActionComment = 'Not able to auto asses'
|
||||
}
|
||||
if ($Limited) {
|
||||
$MetaData = [ordered] @{
|
||||
LocationType = $FileType.Name
|
||||
FullName = $_.FullName
|
||||
#Name = $_.Name
|
||||
Extension = $_.Extension
|
||||
SuggestedAction = $SuggestedAction
|
||||
SuggestedActionComment = $SuggestedActionComment
|
||||
BelongsToGPO = $BelongsToGPO
|
||||
GPODisplayName = $GPODisplayName
|
||||
Attributes = $_.Attributes
|
||||
CreationTime = $_.CreationTime
|
||||
LastAccessTime = $_.LastAccessTime
|
||||
LastWriteTime = $_.LastWriteTime
|
||||
}
|
||||
} else {
|
||||
$MetaData = Get-FileMetaData -File $_ -AsHashTable
|
||||
}
|
||||
if ($Signature) {
|
||||
$DigitalSignature = Get-AuthenticodeSignature -FilePath $_.Fullname
|
||||
$MetaData['SignatureStatus'] = $DigitalSignature.Status
|
||||
$MetaData['IsOSBinary'] = $DigitalSignature.IsOSBinary
|
||||
$MetaData['SignatureCertificateSubject'] = $DigitalSignature.SignerCertificate.Subject
|
||||
if ($Extended) {
|
||||
$MetaData['SignatureCertificateIssuer'] = $DigitalSignature.SignerCertificate.Issuer
|
||||
$MetaData['SignatureCertificateSerialNumber'] = $DigitalSignature.SignerCertificate.SerialNumber
|
||||
$MetaData['SignatureCertificateNotBefore'] = $DigitalSignature.SignerCertificate.NotBefore
|
||||
$MetaData['SignatureCertificateNotAfter'] = $DigitalSignature.SignerCertificate.NotAfter
|
||||
$MetaData['SignatureCertificateThumbprint'] = $DigitalSignature.SignerCertificate.Thumbprint
|
||||
}
|
||||
}
|
||||
if ($HashAlgorithm -ne 'None') {
|
||||
$MetaData['ChecksumSHA256'] = (Get-FileHash -LiteralPath $_.FullName -Algorithm $HashAlgorithm).Hash
|
||||
}
|
||||
if ($AsHashTable) {
|
||||
$MetaData
|
||||
} else {
|
||||
[PSCustomObject] $MetaData
|
||||
}
|
||||
}
|
||||
foreach ($e in $err) {
|
||||
Write-Warning "Get-GPOZaurrFiles - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,96 @@
|
||||
function Get-GPOZaurrFilesPolicyDefinitions {
|
||||
[cmdletbinding()]
|
||||
param(
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
[System.Collections.IDictionary] $ExtendedForestInformation,
|
||||
|
||||
[switch] $Signature
|
||||
)
|
||||
$Output = [ordered] @{
|
||||
FilesToDelete = [System.Collections.Generic.List[Object]]::new()
|
||||
}
|
||||
$ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
$FilesCache = @{}
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
$Output[$Domain] = [ordered] @{}
|
||||
$FilesCache[$Domain] = [ordered] @{}
|
||||
$Directories = Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies\PolicyDefinitions" -Directory -ErrorAction SilentlyContinue -ErrorVariable err
|
||||
[Array] $Languages = foreach ($Directory in $Directories) {
|
||||
if ($Directory.BaseName.Length -eq 5) {
|
||||
$Directory.BaseName
|
||||
}
|
||||
}
|
||||
$Files = Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies\PolicyDefinitions" -ErrorAction SilentlyContinue -ErrorVariable +err -File #| Select-Object Name, FullName, CreationTime, LastWriteTime, Attributes
|
||||
foreach ($File in $Files) {
|
||||
$FilesCache[$Domain][$($File.BaseName)] = [ordered] @{
|
||||
Name = $File.BaseName
|
||||
FullName = $File.FullName
|
||||
IsReadOnly = $File.IsReadOnly
|
||||
CreationTime = $File.CreationTime
|
||||
LastAccessTime = $File.LastAccessTime
|
||||
LastWriteTime = $File.LastWriteTime
|
||||
IsConsistent = $false
|
||||
}
|
||||
foreach ($Language in $Languages) {
|
||||
$FilesCache[$Domain][$($File.BaseName)][$Language] = $false
|
||||
}
|
||||
if ($Signature) {
|
||||
$DigitalSignature = Get-AuthenticodeSignature -FilePath $File.FullName
|
||||
$FilesCache[$Domain][$($File.BaseName)]['SignatureStatus'] = $DigitalSignature.Status
|
||||
$FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateSubject'] = $DigitalSignature.SignerCertificate.Subject
|
||||
$FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateIssuer'] = $DigitalSignature.SignerCertificate.Issuer
|
||||
$FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateSerialNumber'] = $DigitalSignature.SignerCertificate.SerialNumber
|
||||
$FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateNotBefore'] = $DigitalSignature.SignerCertificate.NotBefore
|
||||
$FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateNotAfter'] = $DigitalSignature.SignerCertificate.NotAfter
|
||||
$FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateThumbprint'] = $DigitalSignature.SignerCertificate.Thumbprint
|
||||
$FilesCache[$Domain][$($File.BaseName)]['IsOSBinary'] = $DigitalSignature.IsOSBinary
|
||||
}
|
||||
}
|
||||
foreach ($Directory in $Directories) {
|
||||
$FilesLanguage = Get-ChildItem -Path $Directory.FullName -ErrorAction SilentlyContinue -ErrorVariable +err
|
||||
foreach ($FileLanguage in $FilesLanguage) {
|
||||
if ($FileLanguage.Extension -eq '.adml') {
|
||||
if ($FilesCache[$Domain][$FileLanguage.BaseName]) {
|
||||
$FilesCache[$Domain][$FileLanguage.BaseName][$Directory.Name] = $true
|
||||
} else {
|
||||
#Write-Warning "Get-GPOZaurrFilesPolicyDefinitions - File $($FileLanguage.FullName) doesn't have a match."
|
||||
$Output.FilesToDelete.Add(
|
||||
[PSCustomobject] @{
|
||||
Name = $FileLanguage.BaseName
|
||||
FullName = $FileLanguage.FullName
|
||||
IsReadOnly = $FileLanguage.IsReadOnly
|
||||
CreationTime = $FileLanguage.CreationTime
|
||||
LastAccessTime = $FileLanguage.LastAccessTime
|
||||
LastWriteTime = $FileLanguage.LastWriteTime
|
||||
}
|
||||
)
|
||||
}
|
||||
} else {
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
foreach ($e in $err) {
|
||||
Write-Warning "Get-GPOZaurrLegacy - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
|
||||
}
|
||||
$ExcludeProperty = @(
|
||||
'Name', 'FullName', 'IsReadOnly', 'CreationTime', 'LastAccessTime', 'LastWriteTime', 'IsConsistent'
|
||||
'SignatureCertificateSubject', 'SignatureCertificateIssuer', 'SignatureCertificateSerialNumber', 'SignatureCertificateNotBefore'
|
||||
'SignatureCertificateNotAfter', 'SignatureCertificateThumbprint', 'SignatureStatus', 'IsOSBinary'
|
||||
)
|
||||
$Properties = Select-Properties -Objects $FilesCache[$Domain][0] -ExcludeProperty $ExcludeProperty
|
||||
$Output[$Domain] = foreach ($File in $FilesCache[$Domain].Keys) {
|
||||
$Values = foreach ($Property in $Properties) {
|
||||
$FilesCache[$Domain][$File][$Property]
|
||||
}
|
||||
if ($Values -notcontains $false) {
|
||||
$FilesCache[$Domain][$File]['IsConsistent'] = $true
|
||||
}
|
||||
[PSCustomObject] $FilesCache[$Domain][$File]
|
||||
}
|
||||
}
|
||||
$Output
|
||||
}
|
||||
@@ -8,7 +8,17 @@
|
||||
)
|
||||
$ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies" -ErrorAction SilentlyContinue -Recurse -Include '*.adm' -ErrorVariable err | Select-Object Name, FullName, CreationTime, LastWriteTime, Attributes
|
||||
Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies" -ErrorAction SilentlyContinue -Recurse -Include '*.adm', 'admfiles.ini' -ErrorVariable err -Force | ForEach-Object {
|
||||
[PSCustomObject] @{
|
||||
Name = $_.Name
|
||||
FullName = $_.FullName
|
||||
CreationTime = $_.CreationTime
|
||||
LastWriteTime = $_.LastWriteTime
|
||||
Attributes = $_.Attributes
|
||||
DomainName = $Domain
|
||||
DirectoryName = $_.DirectoryName
|
||||
}
|
||||
}
|
||||
foreach ($e in $err) {
|
||||
Write-Warning "Get-GPOZaurrLegacy - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
|
||||
}
|
||||
|
||||
+34
-17
@@ -77,7 +77,11 @@
|
||||
#}
|
||||
$Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
$OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
foreach ($OutputGPO in $OutputGPOs) {
|
||||
@@ -101,7 +105,11 @@
|
||||
# }
|
||||
$Splat['Filter'] = "objectClass -eq 'domainDNS'"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
$OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
foreach ($OutputGPO in $OutputGPOs) {
|
||||
@@ -127,7 +135,11 @@
|
||||
#}
|
||||
$Splat['Filter'] = "(objectClass -eq 'site')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
}
|
||||
@@ -141,7 +153,11 @@
|
||||
#}
|
||||
$Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
if ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) {
|
||||
# other skips Domain Root
|
||||
@@ -174,7 +190,8 @@
|
||||
}
|
||||
if ($PSBoundParameters.ContainsKey('SearchBase')) {
|
||||
$DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
|
||||
if ($SearchBase -notlike "*$DomainDistinguishedName") {
|
||||
$SearchBaseDC = ConvertFrom-DistinguishedName -DistinguishedName $SearchBase -ToDC
|
||||
if ($SearchBaseDC -ne $DomainDistinguishedName) {
|
||||
# we check if SearchBase is part of domain distinugishname. If it isn't we skip
|
||||
continue
|
||||
}
|
||||
@@ -187,22 +204,22 @@
|
||||
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
$OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
foreach ($OutputGPO in $OutputGPOs) {
|
||||
if (-not $SkipDuplicates) {
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
$OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
foreach ($OutputGPO in $OutputGPOs) {
|
||||
if (-not $SkipDuplicates) {
|
||||
$OutputGPO
|
||||
} else {
|
||||
$UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
|
||||
if (-not $CacheReturnedGPOs[$UniqueGuid]) {
|
||||
$CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
|
||||
$OutputGPO
|
||||
} else {
|
||||
$UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
|
||||
if (-not $CacheReturnedGPOs[$UniqueGuid]) {
|
||||
$CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
|
||||
$OutputGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Processing error $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,13 +2,18 @@
|
||||
[cmdletBinding()]
|
||||
param(
|
||||
[ValidateSet('All', 'MultipleLinks', 'OneLink', 'LinksSummary')][string[]] $Report = 'All',
|
||||
[switch] $UnlimitedProperties
|
||||
[switch] $UnlimitedProperties,
|
||||
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
[System.Collections.IDictionary] $ExtendedForestInformation
|
||||
)
|
||||
$HighestCount = 0 # to keep number of depth
|
||||
$CacheSummaryLinks = [ordered] @{} # cache
|
||||
|
||||
# Get all links
|
||||
$Links = Get-GPOZaurrLink
|
||||
$Links = Get-GPOZaurrLink -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
foreach ($Link in $Links) {
|
||||
if (-not $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"]) {
|
||||
$CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"] = [System.Collections.Generic.List[System.Object]]::new()
|
||||
|
||||
@@ -71,6 +71,7 @@
|
||||
Server = $QueryServer
|
||||
ErrorAction = 'SilentlyContinue'
|
||||
}
|
||||
$TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / Name: $GPOName) with:"
|
||||
} elseif ($GPOGuid) {
|
||||
$getGPOSplat = @{
|
||||
Guid = $GPOGuid
|
||||
@@ -78,6 +79,7 @@
|
||||
Server = $QueryServer
|
||||
ErrorAction = 'SilentlyContinue'
|
||||
}
|
||||
$TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / GUID: $GPOGuid) with:"
|
||||
} else {
|
||||
$getGPOSplat = @{
|
||||
All = $true
|
||||
@@ -85,48 +87,58 @@
|
||||
Server = $QueryServer
|
||||
ErrorAction = 'SilentlyContinue'
|
||||
}
|
||||
$TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / All: $True) with:"
|
||||
}
|
||||
Get-GPO @getGPOSplat | ForEach-Object -Process {
|
||||
$GPOSecurity = $_.GetSecurityInfo()
|
||||
$getPrivPermissionSplat = @{
|
||||
Principal = $Principal
|
||||
PrincipalType = $PrincipalType
|
||||
PermitType = $PermitType
|
||||
Accounts = $Accounts
|
||||
Type = $Type
|
||||
GPO = $_
|
||||
SkipWellKnown = $SkipWellKnown.IsPresent
|
||||
SkipAdministrative = $SkipAdministrative.IsPresent
|
||||
IncludeOwner = $IncludeOwner.IsPresent
|
||||
IncludeGPOObject = $IncludeGPOObject.IsPresent
|
||||
IncludePermissionType = $IncludePermissionType
|
||||
ExcludePermissionType = $ExcludePermissionType
|
||||
ExcludePrincipal = $ExcludePrincipal
|
||||
ExcludePrincipalType = $ExcludePrincipalType
|
||||
ADAdministrativeGroups = $ADAdministrativeGroups
|
||||
ExtendedForestInformation = $ForestInformation
|
||||
SecurityRights = $GPOSecurity
|
||||
}
|
||||
$Output = Get-PrivPermission @getPrivPermissionSplat
|
||||
if (-not $Output) {
|
||||
if ($ReturnSecurityWhenNoData) {
|
||||
# there is no data to return, but we need to have GPO information to process ADD permissions.
|
||||
$ReturnObject = [PSCustomObject] @{
|
||||
DisplayName = $_.DisplayName # : ALL | Enable RDP
|
||||
GUID = $_.ID
|
||||
DomainName = $_.DomainName # : ad.evotec.xyz
|
||||
Enabled = $_.GpoStatus
|
||||
Description = $_.Description
|
||||
CreationDate = $_.CreationTime
|
||||
ModificationTime = $_.ModificationTime
|
||||
GPOObject = $_
|
||||
GPOSecurity = $GPOSecurity
|
||||
}
|
||||
$ReturnObject
|
||||
Try {
|
||||
Get-GPO @getGPOSplat | ForEach-Object -Process {
|
||||
$GPOSecurity = $_.GetSecurityInfo()
|
||||
$getPrivPermissionSplat = @{
|
||||
Principal = $Principal
|
||||
PrincipalType = $PrincipalType
|
||||
PermitType = $PermitType
|
||||
Accounts = $Accounts
|
||||
Type = $Type
|
||||
GPO = $_
|
||||
SkipWellKnown = $SkipWellKnown.IsPresent
|
||||
SkipAdministrative = $SkipAdministrative.IsPresent
|
||||
IncludeOwner = $IncludeOwner.IsPresent
|
||||
IncludeGPOObject = $IncludeGPOObject.IsPresent
|
||||
IncludePermissionType = $IncludePermissionType
|
||||
ExcludePermissionType = $ExcludePermissionType
|
||||
ExcludePrincipal = $ExcludePrincipal
|
||||
ExcludePrincipalType = $ExcludePrincipalType
|
||||
ADAdministrativeGroups = $ADAdministrativeGroups
|
||||
ExtendedForestInformation = $ForestInformation
|
||||
SecurityRights = $GPOSecurity
|
||||
}
|
||||
try {
|
||||
$Output = Get-PrivPermission @getPrivPermissionSplat
|
||||
} catch {
|
||||
$Output = $null
|
||||
Write-Warning "Get-GPOZaurrPermission - Error running Get-PrivPermission: $($_.Exception.Message)"
|
||||
}
|
||||
if (-not $Output) {
|
||||
if ($ReturnSecurityWhenNoData) {
|
||||
# there is no data to return, but we need to have GPO information to process ADD permissions.
|
||||
$ReturnObject = [PSCustomObject] @{
|
||||
DisplayName = $_.DisplayName # : ALL | Enable RDP
|
||||
GUID = $_.ID
|
||||
DomainName = $_.DomainName # : ad.evotec.xyz
|
||||
Enabled = $_.GpoStatus
|
||||
Description = $_.Description
|
||||
CreationDate = $_.CreationTime
|
||||
ModificationTime = $_.ModificationTime
|
||||
GPOObject = $_
|
||||
GPOSecurity = $GPOSecurity
|
||||
}
|
||||
$ReturnObject
|
||||
}
|
||||
} else {
|
||||
$Output
|
||||
}
|
||||
} else {
|
||||
$Output
|
||||
}
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrPermission - $TextForError $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,253 @@
|
||||
function Invoke-GPOZaurr {
|
||||
[alias('Find-GPO')]
|
||||
[cmdletBinding(DefaultParameterSetName = 'Default')]
|
||||
param(
|
||||
[Parameter(ParameterSetName = 'Default')][alias('ForestName')][string] $Forest,
|
||||
[Parameter(ParameterSetName = 'Default')][string[]] $ExcludeDomains,
|
||||
[Parameter(ParameterSetName = 'Default')][alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
[Parameter(ParameterSetName = 'Default')][System.Collections.IDictionary] $ExtendedForestInformation,
|
||||
|
||||
[Parameter(ParameterSetName = 'Local')][string] $GPOPath,
|
||||
|
||||
[Parameter(ParameterSetName = 'Default')]
|
||||
[Parameter(ParameterSetName = 'Local')]
|
||||
[string[]] $Type,
|
||||
[Parameter(ParameterSetName = 'Default')]
|
||||
[Parameter(ParameterSetName = 'Local')]
|
||||
[switch] $NoTranslation,
|
||||
|
||||
[Parameter(ParameterSetName = 'Default')]
|
||||
[Parameter(ParameterSetName = 'Local')]
|
||||
[string] $Splitter = [System.Environment]::NewLine,
|
||||
|
||||
[Parameter(ParameterSetName = 'Default')]
|
||||
[Parameter(ParameterSetName = 'Local')]
|
||||
[switch] $FullObjects,
|
||||
|
||||
[Parameter(ParameterSetName = 'Default')]
|
||||
[Parameter(ParameterSetName = 'Local')]
|
||||
[ValidateSet('HTML', 'Object', 'Excel')][string[]] $OutputType = 'Object',
|
||||
|
||||
[Parameter(ParameterSetName = 'Default')]
|
||||
[Parameter(ParameterSetName = 'Local')]
|
||||
[string] $OutputPath,
|
||||
|
||||
[Parameter(ParameterSetName = 'Default')]
|
||||
[Parameter(ParameterSetName = 'Local')]
|
||||
[switch] $Open,
|
||||
|
||||
[Parameter(ParameterSetName = 'Default')]
|
||||
[Parameter(ParameterSetName = 'Local')]
|
||||
[switch] $CategoriesOnly,
|
||||
|
||||
[Parameter(ParameterSetName = 'Default')]
|
||||
[Parameter(ParameterSetName = 'Local')]
|
||||
[switch] $SingleObject
|
||||
)
|
||||
if ($Type.Count -eq 0) {
|
||||
$Type = $Script:GPODitionary.Keys
|
||||
}
|
||||
if ($GPOPath) {
|
||||
if (Test-Path -LiteralPath $GPOPath) {
|
||||
<#
|
||||
$GPOListPath = [io.path]::Combine($GPOPath, "GPOList.xml")
|
||||
if ($GPOListPath) {
|
||||
$GPOs = Import-Clixml -Path $GPOListPath
|
||||
} else {
|
||||
|
||||
}
|
||||
#>
|
||||
$GPOFiles = Get-ChildItem -LiteralPath $GPOPath -Recurse -File -Filter *.xml
|
||||
[Array] $GPOs = foreach ($File in $GPOFiles) {
|
||||
if ($File.Name -ne 'GPOList.xml') {
|
||||
try {
|
||||
[xml] $GPORead = Get-Content -LiteralPath $File.FullName
|
||||
} catch {
|
||||
Write-Warning "Invoke-GPOZaurr - Couldn't process $($File.FullName) error: $($_.Exception.message)"
|
||||
continue
|
||||
}
|
||||
[PSCustomObject] @{
|
||||
DisplayName = $GPORead.GPO.Name
|
||||
DomainName = $GPORead.GPO.Identifier.Domain.'#text'
|
||||
GUID = $GPORead.GPO.Identifier.Identifier.'#text' -replace '{' -replace '}'
|
||||
GPOOutput = $GPORead
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
Write-Warning "Find-GPO - $GPOPath doesn't exists."
|
||||
return
|
||||
}
|
||||
} else {
|
||||
[Array] $GPOs = Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
}
|
||||
$Output = [ordered] @{}
|
||||
$OutputByGPO = [ordered] @{}
|
||||
$TranslatedOutput = [ordered] @{}
|
||||
$CachedCategories = [ordered] @{}
|
||||
|
||||
[Array] $GPOCategories = foreach ($GPO in $GPOs) {
|
||||
if ($GPOPath) {
|
||||
$GPOOutput = $GPO.GPOOutput
|
||||
} else {
|
||||
[xml] $GPOOutput = Get-GPOReport -Guid $GPO.GUID -Domain $GPO.DomainName -ReportType Xml
|
||||
}
|
||||
Get-GPOCategories -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects -CachedCategories $CachedCategories
|
||||
}
|
||||
|
||||
# Return Categories or save it
|
||||
if ($CategoriesOnly) {
|
||||
return $GPOCategories | Select-Object -Property * -ExcludeProperty DataSet
|
||||
} else {
|
||||
$Output['Categories'] = $GPOCategories | Select-Object -Property * -ExcludeProperty DataSet
|
||||
}
|
||||
# Save Cached Categories
|
||||
$Output['CategoriesFull'] = $CachedCategories
|
||||
# Process Reporting
|
||||
$Output['Reports'] = [ordered] @{}
|
||||
|
||||
if ($CachedCategories.Count -gt 0) {
|
||||
foreach ($Report in $Type) {
|
||||
|
||||
foreach ($CategoryType in $Script:GPODitionary[$Report].Types) {
|
||||
|
||||
$Category = $CategoryType.Category
|
||||
$Settings = $CategoryType.Settings
|
||||
|
||||
# Those are checks for making sure we have data to be even able to process it
|
||||
if (-not $CachedCategories[$Category]) {
|
||||
continue
|
||||
}
|
||||
if (-not $CachedCategories[$Category][$Settings]) {
|
||||
continue
|
||||
}
|
||||
# Translation
|
||||
$CategorizedGPO = $CachedCategories[$Category][$Settings]
|
||||
foreach ($GPO in $CategorizedGPO) {
|
||||
if (-not $Output['Reports'][$Report]) {
|
||||
$Output['Reports'][$Report] = [System.Collections.Generic.List[PSCustomObject]]::new()
|
||||
}
|
||||
$TranslatedGpo = $null
|
||||
if ($SingleObject) {
|
||||
if ($Script:GPODitionary[$Report]['CodeSingle']) {
|
||||
$TranslatedGpo = Invoke-Command -ScriptBlock $Script:GPODitionary[$Report]['CodeSingle']
|
||||
}
|
||||
} else {
|
||||
if ($Script:GPODitionary[$Report]['Code']) {
|
||||
$TranslatedGpo = Invoke-Command -ScriptBlock $Script:GPODitionary[$Report]['Code']
|
||||
}
|
||||
}
|
||||
foreach ($T in $TranslatedGpo) {
|
||||
$Output['Reports'][$Report].Add($T)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return $Output
|
||||
<#
|
||||
foreach ($GPO in $GPOs) {
|
||||
if ($GPOPath) {
|
||||
$GPOOutput = $GPO.GPOOutput
|
||||
} else {
|
||||
[xml] $GPOOutput = Get-GPOReport -Guid $GPO.GUID -Domain $GPO.DomainName -ReportType Xml
|
||||
}
|
||||
[Array] $Data = Get-XMLStandard -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects
|
||||
foreach ($D in $Data) {
|
||||
if (-not $Output["$($D.GpoCategory)"]) {
|
||||
$Output["$($D.GpoCategory)"] = [ordered] @{}
|
||||
}
|
||||
if (-not $Output["$($D.GpoCategory)"]["$($D.GpoSettings)"]) {
|
||||
$Output["$($D.GpoCategory)"]["$($D.GpoSettings)"] = [System.Collections.Generic.List[PSCustomObject]]::new()
|
||||
}
|
||||
$Output["$($D.GpoCategory)"]["$($D.GpoSettings)"].Add($D)
|
||||
|
||||
if (-not $OutputByGPO["$($D.DomainName)"]) {
|
||||
$OutputByGPO["$($D.DomainName)"] = [ordered] @{}
|
||||
}
|
||||
if (-not $OutputByGPO[$D.DomainName][$D.DisplayName]) {
|
||||
$OutputByGPO[$D.DomainName][$D.DisplayName] = [System.Collections.Generic.List[PSCustomObject]]::new()
|
||||
}
|
||||
$OutputByGPO[$D.DomainName][$D.DisplayName].Add($D)
|
||||
}
|
||||
|
||||
}
|
||||
if ($NoTranslation) {
|
||||
if ($OutputType -contains 'Object') {
|
||||
$Output
|
||||
}
|
||||
} else {
|
||||
foreach ($Report in $Type) {
|
||||
$Category = $Script:GPODitionary[$Report]['Category']
|
||||
$Settings = $Script:GPODitionary[$Report]['Settings']
|
||||
$TranslatedOutput[$Report] = Invoke-GPOTranslation -InputData $Output -Category $Category -Settings $Settings -Report $Report
|
||||
}
|
||||
if ($OutputType -contains 'Object') {
|
||||
$TranslatedOutput
|
||||
}
|
||||
}
|
||||
|
||||
if ($NoTranslation) {
|
||||
$SingleSource = $Output
|
||||
} else {
|
||||
$SingleSource = $TranslatedOutput
|
||||
}
|
||||
|
||||
if ($OutputPath) {
|
||||
$FolderPath = $OutputPath
|
||||
} else {
|
||||
$FolderPath = [io.path]::GetTempPath()
|
||||
}
|
||||
if ($OutputType -contains 'HTML') {
|
||||
$FilePathHTML = [io.path]::Combine($FolderPath, "GPOZaurr-Summary-$((Get-Date).ToString('yyyy-MM-dd_HH_mm_ss')).html")
|
||||
Write-Warning "Invoke-GPOZaurr - $FilePathHTML"
|
||||
New-HTML {
|
||||
foreach ($GPOCategory in $SingleSource.Keys) {
|
||||
New-HTMLTab -Name $GPOCategory {
|
||||
if ($SingleSource["$GPOCategory"] -is [System.Collections.IDictionary]) {
|
||||
foreach ($GpoSettings in $SingleSource["$GPOCategory"].Keys) {
|
||||
New-HTMLTab -Name $GpoSettings {
|
||||
if ($SingleSource[$GPOCategory][$GpoSettings].Count -gt 0) {
|
||||
New-HTMLTable -DataTable $SingleSource[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
if ($SingleSource[$GPOCategory].Count -gt 0) {
|
||||
New-HTMLTable -DataTable $SingleSource[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} -Online -ShowHTML:$Open.IsPresent -FilePath $FilePathHTML
|
||||
}
|
||||
if ($OutputType -contains 'Excel') {
|
||||
$FilePathExcel = [io.path]::Combine($FolderPath, "GPOZaurr-Summary-$((Get-Date).ToString('yyyy-MM-dd_HH_mm_ss')).xlsx")
|
||||
Write-Warning "Invoke-GPOZaurr - $FilePathExcel"
|
||||
foreach ($GPOCategory in $SingleSource.Keys) {
|
||||
if ($SingleSource["$GPOCategory"] -is [System.Collections.IDictionary]) {
|
||||
foreach ($GpoSettings in $SingleSource["$GPOCategory"].Keys) {
|
||||
if ($SingleSource[$GPOCategory][$GpoSettings].Count -gt 0) {
|
||||
ConvertTo-Excel -DataTable $SingleSource[$GPOCategory][$GpoSettings] -AllProperties -ExcelWorkSheetName $GpoSettings -FilePath $FilePathExcel -AutoFilter -AutoFit -Option Rename
|
||||
}
|
||||
}
|
||||
} else {
|
||||
if ($SingleSource[$GPOCategory].Count -gt 0) {
|
||||
ConvertTo-Excel -DataTable $SingleSource[$GPOCategory] -AllProperties -ExcelWorkSheetName $GPOCategory -FilePath $FilePathExcel -AutoFilter -AutoFit -Option Rename
|
||||
}
|
||||
}
|
||||
}
|
||||
if ($Open) {
|
||||
Invoke-Item -Path $FilePathExcel
|
||||
}
|
||||
}
|
||||
#>
|
||||
|
||||
}
|
||||
|
||||
[scriptblock] $SourcesAutoCompleter = {
|
||||
param($commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters)
|
||||
|
||||
$Script:GPODitionary.Keys | Sort-Object | Where-Object { $_ -like "*$wordToComplete*" }
|
||||
}
|
||||
Register-ArgumentCompleter -CommandName Find-GPO -ParameterName Type -ScriptBlock $SourcesAutoCompleter
|
||||
@@ -0,0 +1,25 @@
|
||||
function Remove-GPOZaurrEmptyFolders {
|
||||
[cmdletBinding(SupportsShouldProcess)]
|
||||
param(
|
||||
[ValidateSet('Adm')][string] $Folders,
|
||||
[int] $LimitProcessing = [int32]::MaxValue,
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
[System.Collections.IDictionary] $ExtendedForestInformation
|
||||
)
|
||||
Get-GPOZaurrEmptyFolders -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation | Where-Object {
|
||||
foreach ($Folder in $Folders) {
|
||||
if ($_.IsEmptyFolder -eq $true -and $_.Name -eq $Folder) {
|
||||
$_
|
||||
}
|
||||
}
|
||||
} | Select-Object | Select-Object -First $LimitProcessing | ForEach-Object {
|
||||
try {
|
||||
Write-Verbose "Remove-GPOZaurrEmptyFolders - Removing $($_.FullName)"
|
||||
Remove-Item -Path $_.FullName
|
||||
} catch {
|
||||
Write-Warning "Remove-GPOZaurrEmptyFolders - Failed to remove directory $($_.FullName): $($_.Exception.Message)."
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,12 +1,24 @@
|
||||
function Remove-GPOZaurrLegacyFiles {
|
||||
[cmdletBinding(SupportsShouldProcess)]
|
||||
param(
|
||||
[string] $BackupPath,
|
||||
[switch] $BackupDated,
|
||||
[switch] $RemoveEmptyFolders,
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
|
||||
[int] $LimitProcessing = [int32]::MaxValue
|
||||
)
|
||||
if ($BackupPath) {
|
||||
if ($BackupDated) {
|
||||
$BackupFinalPath = "$BackupPath\$((Get-Date).ToString('yyyy-MM-dd_HH_mm_ss'))"
|
||||
} else {
|
||||
$BackupFinalPath = $BackupPath
|
||||
}
|
||||
} else {
|
||||
$BackupFinalPath = ''
|
||||
}
|
||||
$Splat = @{
|
||||
Forest = $Forest
|
||||
IncludeDomains = $IncludeDomains
|
||||
@@ -14,12 +26,63 @@
|
||||
ExtendedForestInformation = $ExtendedForestInformation
|
||||
Verbose = $VerbosePreference
|
||||
}
|
||||
Get-GPOZaurrLegacyFiles @Splat | Select-Object -First $LimitProcessing | ForEach-Object {
|
||||
try {
|
||||
Remove-Item -Path $_.FullName -ErrorAction Stop
|
||||
} catch {
|
||||
$ErrorMessage = $_.Exception.Message
|
||||
Write-Warning "Remove-GPOZaurrLegacyFiles - Failed to remove file $($_.FullName): $($ErrorMessage)."
|
||||
[Array] $Deleted = Get-GPOZaurrLegacyFiles @Splat | Select-Object -First $LimitProcessing | ForEach-Object {
|
||||
Write-Verbose "Remove-GPOZaurrLegacyFiles - Processing $($_.FullName)"
|
||||
if ($BackupFinalPath) {
|
||||
$SYSVOLRoot = "\\$($_.DomainName)\SYSVOL\$($_.DomainName)\policies\"
|
||||
$DestinationFile = ($_.FullName).Replace($SYSVOLRoot, '')
|
||||
#$DestinationMissingFolder = $DestinationFile.Replace($DestinationFile, '')
|
||||
$DestinationFilePath = [system.io.path]::Combine($BackupFinalPath, $DestinationFile)
|
||||
#$DestinationFolderPath = [system.io.path]::Combine($BackupFinalPath, $DestinationMissingFolder)
|
||||
|
||||
Write-Verbose "Remove-GPOZaurrLegacyFiles - Backing up $($_.FullName)"
|
||||
$Created = New-Item -ItemType File -Path $DestinationFilePath -Force
|
||||
if ($Created) {
|
||||
Try {
|
||||
Copy-Item -LiteralPath $_.FullName -Recurse -Destination $DestinationFilePath -ErrorAction Stop -Force
|
||||
$BackupWorked = $true
|
||||
} catch {
|
||||
Write-Warning "Remove-GPOZaurrLegacyFiles - Error backing up error: $($_.Exception.Message)"
|
||||
$BackupWorked = $false
|
||||
}
|
||||
} else {
|
||||
$BackupWorked = $false
|
||||
}
|
||||
}
|
||||
if ($BackupWorked -or $BackupFinalPath -eq '') {
|
||||
try {
|
||||
Write-Verbose "Remove-GPOZaurrLegacyFiles - Deleting $($_.FullName)"
|
||||
Remove-Item -Path $_.FullName -ErrorAction Stop -Force
|
||||
$_
|
||||
} catch {
|
||||
Write-Warning "Remove-GPOZaurrLegacyFiles - Failed to remove file $($_.FullName): $($_.Exception.Message)."
|
||||
}
|
||||
}
|
||||
}
|
||||
if ($Deleted.Count -gt 0) {
|
||||
if ($RemoveEmptyFolders) {
|
||||
$FoldersToCheck = $Deleted.DirectoryName | Sort-Object -Unique
|
||||
foreach ($Folder in $FoldersToCheck) {
|
||||
$FolderName = $Folder.Substring($Folder.Length - 4)
|
||||
if ($FolderName -eq '\Adm') {
|
||||
try {
|
||||
$MeasureCount = Get-ChildItem -LiteralPath $Folder -Force -ErrorAction Stop | Select-Object -First 1 | Measure-Object
|
||||
} catch {
|
||||
Write-Warning "Remove-GPOZaurrLegacyFiles - Couldn't verify if folder $Folder is empty. Skipping. Error: $($_.Exception.Message)."
|
||||
continue
|
||||
}
|
||||
if ($MeasureCount.Count -eq 0) {
|
||||
Write-Verbose "Remove-GPOZaurrLegacyFiles - Deleting empty folder $($Folder)"
|
||||
try {
|
||||
Remove-Item -LiteralPath $Folder -Force -Recurse:$false
|
||||
} catch {
|
||||
Write-Warning "Remove-GPOZaurrLegacyFiles - Failed to remove folder $($Folder): $($_.Exception.Message)."
|
||||
}
|
||||
} else {
|
||||
Write-Verbose "Remove-GPOZaurrLegacyFiles - Skipping not empty folder from deletion $($Folder)"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,13 +1,48 @@
|
||||
function Remove-GPOZaurrOrphanedSysvolFolders {
|
||||
[cmdletBinding(SupportsShouldProcess)]
|
||||
param(
|
||||
[int] $LimitProcessing = [int32]::MaxValue
|
||||
[string] $BackupPath,
|
||||
[switch] $BackupDated,
|
||||
[int] $LimitProcessing = [int32]::MaxValue,
|
||||
|
||||
[alias('ForestName')][string] $Forest,
|
||||
[string[]] $ExcludeDomains,
|
||||
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
|
||||
[System.Collections.IDictionary] $ExtendedForestInformation
|
||||
)
|
||||
Get-GPOZaurrSysvol | Where-Object {
|
||||
if ($BackupPath) {
|
||||
if ($BackupDated) {
|
||||
$BackupFinalPath = "$BackupPath\$((Get-Date).ToString('yyyy-MM-dd_HH_mm_ss'))"
|
||||
} else {
|
||||
$BackupFinalPath = $BackupPath
|
||||
}
|
||||
} else {
|
||||
$BackupFinalPath = ''
|
||||
}
|
||||
Get-GPOZaurrSysvol -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation | Where-Object {
|
||||
if ($_.Status -eq 'Orphaned GPO') {
|
||||
$_
|
||||
}
|
||||
} | Select-Object | Select-Object -First $LimitProcessing | ForEach-Object {
|
||||
Remove-Item -Recurse -Force -LiteralPath $_.Path
|
||||
Write-Verbose "Remove-GPOZaurrOrphanedSysvolFolders - Processing $($_.Path)"
|
||||
if ($BackupFinalPath) {
|
||||
Try {
|
||||
Write-Verbose "Remove-GPOZaurrOrphanedSysvolFolders - Backing up $($_.Path)"
|
||||
Copy-Item -LiteralPath $_.Path -Recurse -Destination $BackupFinalPath -ErrorAction Stop
|
||||
$BackupWorked = $true
|
||||
} catch {
|
||||
Write-Warning "Remove-GPOZaurrOrphanedSysvolFolders - Error backing up error: $($_.Exception.Message)"
|
||||
$BackupWorked = $false
|
||||
}
|
||||
}
|
||||
if ($BackupWorked -or $BackupFinalPath -eq '') {
|
||||
Write-Verbose "Remove-GPOZaurrOrphanedSysvolFolders - Deleting $($_.Path)"
|
||||
try {
|
||||
Remove-Item -Recurse -Force -LiteralPath $_.Path
|
||||
} catch {
|
||||
$ErrorMessage = $_.Exception.Message
|
||||
Write-Warning "Remove-GPOZaurrOrphanedSysvolFolders - Failed to remove file $($_.Path): $($ErrorMessage)."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -9,12 +9,6 @@
|
||||
[switch] $DeleteExisting
|
||||
)
|
||||
if ($GPOPath) {
|
||||
if (-not $ExtendedForestInformation) {
|
||||
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
|
||||
} else {
|
||||
$ForestInformation = $ExtendedForestInformation
|
||||
}
|
||||
|
||||
if ($DeleteExisting) {
|
||||
$Test = Test-Path -LiteralPath $GPOPath
|
||||
if ($Test) {
|
||||
@@ -22,16 +16,18 @@
|
||||
Remove-Item -LiteralPath $GPOPath -Recurse
|
||||
}
|
||||
}
|
||||
|
||||
$null = New-Item -ItemType Directory -Path $GPOPath -Force
|
||||
foreach ($Domain in $ForestInformation.Domains) {
|
||||
Write-Verbose "Save-GPOZaurrFiles - Processing GPO for $Domain"
|
||||
Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
|
||||
$XMLContent = Get-GPOReport -ID $_.ID.Guid -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
|
||||
$Path = [io.path]::Combine($GPOPath, "$($_.ID.Guid).xml")
|
||||
|
||||
$XMLContent | Set-Content -LiteralPath $Path -Force -Encoding Unicode
|
||||
$GPOs = Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
|
||||
foreach ($GPO in $GPOS) {
|
||||
$XMLContent = Get-GPOReport -ID $GPO.Guid -ReportType XML -Domain $GPO.DomainName
|
||||
$GPODOmainFolder = [io.path]::Combine($GPOPath, $GPO.DomainName)
|
||||
if (-not (Test-Path -Path $GPODOmainFolder)) {
|
||||
$null = New-Item -ItemType Directory -Path $GPODOmainFolder -Force
|
||||
}
|
||||
$Path = [io.path]::Combine($GPODOmainFolder, "$($GPO.Guid).xml")
|
||||
$XMLContent | Set-Content -LiteralPath $Path -Force -Encoding Unicode
|
||||
}
|
||||
$GPOListPath = [io.path]::Combine($GPOPath, "GPOList.xml")
|
||||
$GPOs | Export-Clixml -Depth 5 -Path $GPOListPath
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
function Select-GPOTranslation {
|
||||
[cmdletbInding()]
|
||||
param(
|
||||
[Parameter(ValueFromPipeline)][System.Collections.IDictionary] $InputObject,
|
||||
[string] $Category,
|
||||
[string] $Settings
|
||||
)
|
||||
|
||||
$Important = [ordered] @{}
|
||||
$AllProperties = Select-Properties -AllProperties -Objects $InputObject.$Category.$Settings
|
||||
$MissingProperties = $AllProperties | Where-Object { $_ -notin 'DisplayName', 'DomainName', 'GUID', 'Linked', 'LinksCount', 'Links', 'GPOType', 'GPOCategory', 'GPOSettings' }
|
||||
$Types = foreach ($Property in $MissingProperties) {
|
||||
($InputObject.$Category.$Settings | Where-Object { $null -ne $_.$Property }).$Property | ForEach-Object {
|
||||
($_ | Get-Member -MemberType Properties) | Where-Object { $_.Name -notin 'Length' }
|
||||
}
|
||||
}
|
||||
$Important['AllProperties'] = $AllProperties
|
||||
$Important['MissingProperties'] = $MissingProperties
|
||||
$Important['Types'] = $Types | Select-Object -Unique
|
||||
$Important['Data'] = $InputObject.$Category.$Settings
|
||||
$Important
|
||||
}
|
||||
@@ -39,6 +39,30 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
|
||||
|
||||
## Changelog
|
||||
|
||||
- 0.0.49 - 23.07.2020
|
||||
- Hidden files were skipped - and people do crazy things with them
|
||||
- 0.0.48 - 21.07.2020
|
||||
- Added `Get-GPOZaurrFilesPolicyDefinitions`
|
||||
- Updates to `Invoke-GPOZaurr` - still work in progress
|
||||
- Updates to `Get-GPOZaurrFiles` - still work in progress
|
||||
- Updates to `Remove-GPOZaurrOrphanedSysvolFolders` with backup and support for domains
|
||||
- Module will now be signed
|
||||
- 0.0.47 - 29.06.2020
|
||||
- Update to `Get-GPOZaurrAD` for better error reporting
|
||||
- Updates to `Invoke-GPOZaurr` - still work in progress
|
||||
- 0.0.46 - 28.06.2020
|
||||
- Additional protection for `Get-GPOZaurrAD` for CNF duplicates
|
||||
- Update to `Save-GPOZaurrFiles`
|
||||
- Added `Invoke-GPOZaurr` (alias: `Find-GPO`) (heavy work in progress)
|
||||
- 0.0.45 - 26.06.2020
|
||||
- During publishing ADEssentials required functions are now merged to prevent cyclic dependency bug [Using ModuleSpec syntax in RequiredModules causes incorrect "cyclic dependency" failures](https://github.com/PowerShell/PowerShell/issues/2607)
|
||||
- 0.0.44 - 24.06.2020
|
||||
- Improvement to `Get-GPOZaurrLinkSummary`
|
||||
- 0.0.43 - 21.06.2020
|
||||
- Added `Get-GPOZaurrFiles` to list files on NETLOGON/SYSVOL shares with a lot of details
|
||||
- 0.0.42 - 19.06.2020
|
||||
- Fix for `Get-GPOZaurrLink` and `SearchBase` parameter
|
||||
- Fix for `Get-GPOZaurrLink` - canonical link Trim() throwing errors if empty
|
||||
- 0.0.41 - 18.06.2020
|
||||
- Added paramerter `SkipDuplicates` to `Invoke-GPOZaurrPermission` which prevents applying permissions over and over again if 1 GPO is linked to a multiple OU's within another OU
|
||||
- 0.0.40 - 18.06.2020
|
||||
|
||||
Reference in New Issue
Block a user