mirror of
https://github.com/EvotecIT/GPOZaurr.git
synced 2026-07-26 20:00:09 +00:00
Compare commits
6 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Przemyslaw Klys
|
428776afd7 | ||
|
Przemyslaw Klys
|
2c078d3b2d | ||
|
Przemyslaw Klys
|
b8ed284648 | ||
|
Przemyslaw Klys
|
8de9c32fd1 | ||
|
Przemyslaw Klys
|
3cd490937b | ||
|
Przemyslaw Klys
|
3557ecefc2 |
@@ -1,5 +1,6 @@
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
#Get-ADOrganizationalUnit -Filter * -Properties distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
|
||||
#Get-ADObject -Filter * -Properties distinguishedName, gplink -Server 'ad.evotec.pl' | Get-GPOZaurrLink | Format-Table -AutoSize
|
||||
Get-ADOrganizationalUnit -Filter * -Properties distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
|
||||
Get-ADOrganizationalUnit -Filter * -Properties canonicalname, distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
|
||||
Get-ADObject -Filter * -Properties distinguishedName, gplink -Server 'ad.evotec.pl' | Get-GPOZaurrLink | Format-Table -AutoSize
|
||||
Get-GPOZaurrLink | Format-Table -AutoSize
|
||||
@@ -1,14 +1,6 @@
|
||||
#Clear-Host
|
||||
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
|
||||
|
||||
$ApprovedGroups = @(
|
||||
'GDS-TestGroup10'
|
||||
)
|
||||
$RootGroups = @(
|
||||
#'przemyslaw.klys'
|
||||
)
|
||||
|
||||
|
||||
Invoke-GPOZaurrPermission -Linked Root -Verbose {
|
||||
Set-GPOOwner -Type Administrative
|
||||
#Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'
|
||||
|
||||
@@ -8,4 +8,4 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=Computers,OU=Production,DC=ad
|
||||
Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
|
||||
#Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
|
||||
#Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
|
||||
} #-WhatIf #| Format-Table *
|
||||
} -WhatIf #| Format-Table *
|
||||
@@ -26,7 +26,7 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz'
|
||||
Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
|
||||
Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
|
||||
Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
|
||||
} #-WhatIf
|
||||
} -WhatIf
|
||||
|
||||
$Exclude = @(
|
||||
'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
|
||||
@@ -39,4 +39,4 @@ Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz'
|
||||
Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
|
||||
Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
|
||||
Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
|
||||
} #-WhatIf
|
||||
} -WhatIf
|
||||
|
||||
+2
-2
@@ -7,7 +7,7 @@
|
||||
Description = 'Group Policy Eater'
|
||||
FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
|
||||
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
|
||||
ModuleVersion = '0.0.41'
|
||||
ModuleVersion = '0.0.42'
|
||||
PowerShellVersion = '5.1'
|
||||
PrivateData = @{
|
||||
PSData = @{
|
||||
@@ -17,7 +17,7 @@
|
||||
}
|
||||
}
|
||||
RequiredModules = @{
|
||||
ModuleVersion = '0.0.147'
|
||||
ModuleVersion = '0.0.148'
|
||||
ModuleName = 'PSSharedGoods'
|
||||
Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
|
||||
}, @{
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
$DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
|
||||
$Output = [ordered] @{
|
||||
DistinguishedName = $Object.DistinguishedName
|
||||
CanonicalName = $Object.CanonicalName.TrimEnd('/');
|
||||
CanonicalName = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
|
||||
Guid = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
|
||||
}
|
||||
$Search = -join ($DomainCN, $Output['Guid'])
|
||||
@@ -45,7 +45,7 @@
|
||||
$DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
|
||||
$Output = [ordered] @{
|
||||
DistinguishedName = $Object.DistinguishedName
|
||||
CanonicalName = $Object.CanonicalName.TrimEnd('/');
|
||||
CanonicalName = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
|
||||
Guid = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
|
||||
}
|
||||
$Search = -join ($DomainCN, $Output['Guid'])
|
||||
|
||||
+34
-17
@@ -77,7 +77,11 @@
|
||||
#}
|
||||
$Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
$OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
foreach ($OutputGPO in $OutputGPOs) {
|
||||
@@ -101,7 +105,11 @@
|
||||
# }
|
||||
$Splat['Filter'] = "objectClass -eq 'domainDNS'"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
$OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
foreach ($OutputGPO in $OutputGPOs) {
|
||||
@@ -127,7 +135,11 @@
|
||||
#}
|
||||
$Splat['Filter'] = "(objectClass -eq 'site')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
}
|
||||
@@ -141,7 +153,11 @@
|
||||
#}
|
||||
$Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
|
||||
$Splat['SearchBase'] = $SearchBase
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
if ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) {
|
||||
# other skips Domain Root
|
||||
@@ -174,7 +190,8 @@
|
||||
}
|
||||
if ($PSBoundParameters.ContainsKey('SearchBase')) {
|
||||
$DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
|
||||
if ($SearchBase -notlike "*$DomainDistinguishedName") {
|
||||
$SearchBaseDC = ConvertFrom-DistinguishedName -DistinguishedName $SearchBase -ToDC
|
||||
if ($SearchBaseDC -ne $DomainDistinguishedName) {
|
||||
# we check if SearchBase is part of domain distinugishname. If it isn't we skip
|
||||
continue
|
||||
}
|
||||
@@ -187,22 +204,22 @@
|
||||
|
||||
try {
|
||||
$ADObjectGPO = Get-ADObject @Splat
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
$OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
foreach ($OutputGPO in $OutputGPOs) {
|
||||
if (-not $SkipDuplicates) {
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
|
||||
}
|
||||
foreach ($_ in $ADObjectGPO) {
|
||||
$OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
|
||||
foreach ($OutputGPO in $OutputGPOs) {
|
||||
if (-not $SkipDuplicates) {
|
||||
$OutputGPO
|
||||
} else {
|
||||
$UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
|
||||
if (-not $CacheReturnedGPOs[$UniqueGuid]) {
|
||||
$CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
|
||||
$OutputGPO
|
||||
} else {
|
||||
$UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
|
||||
if (-not $CacheReturnedGPOs[$UniqueGuid]) {
|
||||
$CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
|
||||
$OutputGPO
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrLink - Processing error $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -71,6 +71,7 @@
|
||||
Server = $QueryServer
|
||||
ErrorAction = 'SilentlyContinue'
|
||||
}
|
||||
$TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / Name: $GPOName) with:"
|
||||
} elseif ($GPOGuid) {
|
||||
$getGPOSplat = @{
|
||||
Guid = $GPOGuid
|
||||
@@ -78,6 +79,7 @@
|
||||
Server = $QueryServer
|
||||
ErrorAction = 'SilentlyContinue'
|
||||
}
|
||||
$TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / GUID: $GPOGuid) with:"
|
||||
} else {
|
||||
$getGPOSplat = @{
|
||||
All = $true
|
||||
@@ -85,48 +87,58 @@
|
||||
Server = $QueryServer
|
||||
ErrorAction = 'SilentlyContinue'
|
||||
}
|
||||
$TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / All: $True) with:"
|
||||
}
|
||||
Get-GPO @getGPOSplat | ForEach-Object -Process {
|
||||
$GPOSecurity = $_.GetSecurityInfo()
|
||||
$getPrivPermissionSplat = @{
|
||||
Principal = $Principal
|
||||
PrincipalType = $PrincipalType
|
||||
PermitType = $PermitType
|
||||
Accounts = $Accounts
|
||||
Type = $Type
|
||||
GPO = $_
|
||||
SkipWellKnown = $SkipWellKnown.IsPresent
|
||||
SkipAdministrative = $SkipAdministrative.IsPresent
|
||||
IncludeOwner = $IncludeOwner.IsPresent
|
||||
IncludeGPOObject = $IncludeGPOObject.IsPresent
|
||||
IncludePermissionType = $IncludePermissionType
|
||||
ExcludePermissionType = $ExcludePermissionType
|
||||
ExcludePrincipal = $ExcludePrincipal
|
||||
ExcludePrincipalType = $ExcludePrincipalType
|
||||
ADAdministrativeGroups = $ADAdministrativeGroups
|
||||
ExtendedForestInformation = $ForestInformation
|
||||
SecurityRights = $GPOSecurity
|
||||
}
|
||||
$Output = Get-PrivPermission @getPrivPermissionSplat
|
||||
if (-not $Output) {
|
||||
if ($ReturnSecurityWhenNoData) {
|
||||
# there is no data to return, but we need to have GPO information to process ADD permissions.
|
||||
$ReturnObject = [PSCustomObject] @{
|
||||
DisplayName = $_.DisplayName # : ALL | Enable RDP
|
||||
GUID = $_.ID
|
||||
DomainName = $_.DomainName # : ad.evotec.xyz
|
||||
Enabled = $_.GpoStatus
|
||||
Description = $_.Description
|
||||
CreationDate = $_.CreationTime
|
||||
ModificationTime = $_.ModificationTime
|
||||
GPOObject = $_
|
||||
GPOSecurity = $GPOSecurity
|
||||
}
|
||||
$ReturnObject
|
||||
Try {
|
||||
Get-GPO @getGPOSplat | ForEach-Object -Process {
|
||||
$GPOSecurity = $_.GetSecurityInfo()
|
||||
$getPrivPermissionSplat = @{
|
||||
Principal = $Principal
|
||||
PrincipalType = $PrincipalType
|
||||
PermitType = $PermitType
|
||||
Accounts = $Accounts
|
||||
Type = $Type
|
||||
GPO = $_
|
||||
SkipWellKnown = $SkipWellKnown.IsPresent
|
||||
SkipAdministrative = $SkipAdministrative.IsPresent
|
||||
IncludeOwner = $IncludeOwner.IsPresent
|
||||
IncludeGPOObject = $IncludeGPOObject.IsPresent
|
||||
IncludePermissionType = $IncludePermissionType
|
||||
ExcludePermissionType = $ExcludePermissionType
|
||||
ExcludePrincipal = $ExcludePrincipal
|
||||
ExcludePrincipalType = $ExcludePrincipalType
|
||||
ADAdministrativeGroups = $ADAdministrativeGroups
|
||||
ExtendedForestInformation = $ForestInformation
|
||||
SecurityRights = $GPOSecurity
|
||||
}
|
||||
try {
|
||||
$Output = Get-PrivPermission @getPrivPermissionSplat
|
||||
} catch {
|
||||
$Output = $null
|
||||
Write-Warning "Get-GPOZaurrPermission - Error running Get-PrivPermission: $($_.Exception.Message)"
|
||||
}
|
||||
if (-not $Output) {
|
||||
if ($ReturnSecurityWhenNoData) {
|
||||
# there is no data to return, but we need to have GPO information to process ADD permissions.
|
||||
$ReturnObject = [PSCustomObject] @{
|
||||
DisplayName = $_.DisplayName # : ALL | Enable RDP
|
||||
GUID = $_.ID
|
||||
DomainName = $_.DomainName # : ad.evotec.xyz
|
||||
Enabled = $_.GpoStatus
|
||||
Description = $_.Description
|
||||
CreationDate = $_.CreationTime
|
||||
ModificationTime = $_.ModificationTime
|
||||
GPOObject = $_
|
||||
GPOSecurity = $GPOSecurity
|
||||
}
|
||||
$ReturnObject
|
||||
}
|
||||
} else {
|
||||
$Output
|
||||
}
|
||||
} else {
|
||||
$Output
|
||||
}
|
||||
} catch {
|
||||
Write-Warning "Get-GPOZaurrPermission - $TextForError $($_.Exception.Message)"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -39,6 +39,9 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
|
||||
|
||||
## Changelog
|
||||
|
||||
- 0.0.42 - 19.06.2020
|
||||
- Fix for `Get-GPOZaurrLink` and `SearchBase` parameter
|
||||
- Fix for `Get-GPOZaurrLink` - canonical link Trim() throwing errors if empty
|
||||
- 0.0.41 - 18.06.2020
|
||||
- Added paramerter `SkipDuplicates` to `Invoke-GPOZaurrPermission` which prevents applying permissions over and over again if 1 GPO is linked to a multiple OU's within another OU
|
||||
- 0.0.40 - 18.06.2020
|
||||
|
||||
Reference in New Issue
Block a user