Compare commits

...

24 Commits

Author SHA1 Message Date
Przemyslaw Klys edd6dbdfa5 Update 2020-06-29 22:33:51 +02:00
Przemyslaw Klys 9e837d2218 Update WIP 2020-06-29 20:52:38 +02:00
Przemyslaw Klys 9030233e18 Removed dead code 2020-06-28 23:49:07 +02:00
Przemyslaw Klys d02396f591 update 2020-06-28 23:03:36 +02:00
Przemyslaw Klys efb1ddf056 Update 2020-06-28 23:03:00 +02:00
Przemyslaw Klys f6c5cbe901 Readme update 2020-06-28 22:48:29 +02:00
Przemyslaw Klys a7583508f5 Update 2020-06-28 22:47:51 +02:00
Przemyslaw Klys f73c445385 Update 2020-06-28 22:20:33 +02:00
Przemyslaw Klys de4ff8ff07 Update 2020-06-28 22:00:27 +02:00
Przemyslaw Klys 7501693276 Invoke-GPOZaurr WIP 2020-06-28 18:42:06 +02:00
Przemyslaw Klys e76c4d9094 Update 2020-06-28 15:47:37 +02:00
Przemyslaw Klys 2f25064090 Update 2020-06-28 10:32:02 +02:00
Przemyslaw Klys 97ffc8bfd5 Update 2020-06-28 10:08:09 +02:00
Przemyslaw Klys 27bd83eaba Update 2020-06-27 20:57:06 +02:00
Przemyslaw Klys 7cff95cc81 Updates to Find-GPO 2020-06-27 18:19:45 +02:00
Przemyslaw Klys 99d489290d More work on Find-GPO 2020-06-27 17:44:25 +02:00
Przemyslaw Klys d94bf27669 Improvements to Find-GPO 2020-06-27 17:04:19 +02:00
Przemyslaw Klys 570b1cbc83 Added Find-GPO WIP 2020-06-27 12:45:23 +02:00
Przemyslaw Klys 2286f0cb0b XML parsing improvements 2020-06-27 10:26:06 +02:00
Przemyslaw Klys e253bb39e0 Update to Save-GPOZaurrFiles 2020-06-27 10:25:30 +02:00
Przemyslaw Klys 1054d8a38b Update 2020-06-27 10:24:59 +02:00
Przemyslaw Klys 3874098738 Additional protection against CNF duplicates 2020-06-27 10:24:12 +02:00
Przemyslaw Klys 5d81539ba6 Update 2020-06-26 10:08:25 +02:00
Przemyslaw Klys 15b467b1ff Update 2020-06-24 20:22:37 +02:00
38 changed files with 1216 additions and 34 deletions
+10
View File
@@ -0,0 +1,10 @@
Clear-Host
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
$Output = Get-GPOZaurrSysvol | ForEach-Object {
$Path = $_.Path
Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File | ForEach-Object {
Get-FileMetaData -File $_ -Signature -HashAlgorithm 'SHA256'
}
}
$Output | Format-Table
+4
View File
@@ -0,0 +1,4 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
#Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport -DeleteExisting
Save-GPOZaurrFiles -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' #-DeleteExisting
@@ -0,0 +1,34 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
#$OutputNoTranslation = Invoke-GPOZaurr -GPOPath $Env:UserProfile\Desktop\GPOExport -NoTranslation
#$OutputNoTranslation = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
$OutputNoTranslation | Format-Table *
<#
New-HTML {
foreach ($GPOCategory in $OutputNoTranslation.Keys) {
New-HTMLTab -Name $GPOCategory {
if ($OutputNoTranslation["$GPOCategory"] -is [System.Collections.IDictionary]) {
foreach ($GpoSettings in $OutputNoTranslation["$GPOCategory"].Keys) {
New-HTMLTab -Name $GpoSettings {
New-HTMLTable -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
}
}
} else {
New-HTMLTable -DataTable $OutputNoTranslation[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
}
}
}
} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-NoTranslationFromDisk.html
#>
foreach ($GPOCategory in $OutputNoTranslation.Keys) {
if ($OutputNoTranslation["$GPOCategory"] -is [System.Collections.IDictionary]) {
foreach ($GpoSettings in $OutputNoTranslation["$GPOCategory"].Keys) {
ConvertTo-Excel -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -AllProperties -ExcelWorkSheetName $GpoSettings -FilePath $Env:UserProfile\Desktop\Export\$GpoSettings.xlsx -AutoFilter -AutoFit
}
} else {
ConvertTo-Excel -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -AllProperties -ExcelWorkSheetName $GpoSettings -FilePath $Env:UserProfile\Desktop\Export\$GpoSettings.xlsx -AutoFilter -AutoFit
}
}
+36
View File
@@ -0,0 +1,36 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
#Invoke-GPOZaurr -OutputType Excel, Object, HTML -Open | Format-Table
$Output = Invoke-GPOZaurr -GPOPath $Env:USERPROFILE\Desktop\GPOExport -NoTranslation #| Format-Table
#$Output.Count
<# 4073 files - 212MB / no translation
Days : 0
Hours : 0
Minutes : 0
Seconds : 51
Milliseconds : 756
Ticks : 517566534
TotalDays : 0,000599035340277778
TotalHours : 0,0143768481666667
TotalMinutes : 0,86261089
TotalSeconds : 51,7566534
TotalMilliseconds : 51756,6534
#>
<# 4073 files - 212MB / no translation / But with 2 diff types ($OutputByCategory / $OutputByGPO)
Days : 0
Hours : 0
Minutes : 0
Seconds : 53
Milliseconds : 246
Ticks : 532466109
TotalDays : 0,00061628021875
TotalHours : 0,01479072525
TotalMinutes : 0,887443515
TotalSeconds : 53,2466109
TotalMilliseconds : 53246,6109
#>
+20
View File
@@ -0,0 +1,20 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
$Output = Invoke-GPOZaurr #-NoTranslation
$Output | Format-Table
New-HTML {
foreach ($GPOCategory in $Output.Keys) {
New-HTMLTab -Name $GPOCategory {
if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
New-HTMLTab -Name $GpoSettings {
New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
}
}
} else {
New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
}
}
}
} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO.html
@@ -0,0 +1,20 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
$Output = Invoke-GPOZaurr -NoTranslation
$Output | Format-Table
New-HTML {
foreach ($GPOCategory in $Output.Keys) {
New-HTMLTab -Name $GPOCategory {
if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
New-HTMLTab -Name $GpoSettings {
New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
}
}
} else {
New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
}
}
}
} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-NoTranslation.html
+22
View File
@@ -0,0 +1,22 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' # -NoTranslation
$Output | Format-Table *
New-HTML {
foreach ($GPOCategory in $Output.Keys) {
New-HTMLTab -Name $GPOCategory {
if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
New-HTMLTab -Name $GpoSettings {
New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
}
}
} else {
New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
}
}
}
} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-FromDisk.html
@@ -0,0 +1,25 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
$OutputTranslation = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport'
$OutputTranslation | Format-Table
$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' -NoTranslation
$Output | Format-Table *
#$Output.LugsSettings.LocalUsersAndGroups | Format-List *
$GPOEntry = $Output.LugsSettings.LocalUsersAndGroups[0]
$CreateGPO = @{}
foreach ($User in $GPOEntry.User) {
# $User | Format-Table
# $User.Properties | Format-Table
}
foreach ($Group in $GPOEntry.Group) {
#$Group | Format-Table
$Group.Properties | Format-Table
$Group.Properties.Members | Format-Table
}
@@ -0,0 +1,6 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
$Output | Format-Table *
@@ -0,0 +1,11 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
# This is purely for building GPO Dictionary, mostly for development needs to help asses what is there
$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
#$Output | Format-Table *
$LookingFor = $Output | Select-GPOTranslation -Category 'SecuritySettings' -Settings 'UserRightsAssignment'
$LookingFor | Format-Table
$LookingFor.Types | Format-Table
#$LookingFor.Data | Format-Table
+5 -5
View File
@@ -1,13 +1,13 @@
@{
AliasesToExport = ''
AliasesToExport = 'Find-GPO'
Author = 'Przemyslaw Klys'
CompanyName = 'Evotec'
CompatiblePSEditions = 'Desktop'
Copyright = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
Description = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows easy fixing for issues that you may expect finding in them.'
FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrFiles', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
FunctionsToExport = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrFiles', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Select-GPOTranslation', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
ModuleVersion = '0.0.43'
ModuleVersion = '0.0.47'
PowerShellVersion = '5.1'
PrivateData = @{
PSData = @{
@@ -17,11 +17,11 @@
}
}
RequiredModules = @{
ModuleVersion = '0.0.153'
ModuleVersion = '0.0.155'
ModuleName = 'PSSharedGoods'
Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
}, @{
ModuleVersion = '0.0.57'
ModuleVersion = '0.0.58'
ModuleName = 'ADEssentials'
Guid = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
}, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
+31
View File
@@ -0,0 +1,31 @@
# TODO: #2 Identical to ConvertTo-EventLog - decide what to do later on
function ConvertTo-AccountPolicies {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
Type = $GPOEntry.Type
Policy = $GPOEntry.Name
}
if ($GPOEntry.SettingBoolean) {
$CreateGPO['Setting'] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { $null };
#try { [bool]::Parse($GPOEntry.SettingBoolean) } catch { $null };
} elseif ($GPOEntry.SettingNumber) {
$CreateGPO['Setting'] = $GPOEntry.SettingNumber
}
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
+35
View File
@@ -0,0 +1,35 @@
function ConvertTo-Audit {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
$SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null };
$FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null };
if ($SuccessAttempts -and $FailureAttempts) {
$Setting = 'Success, Failure'
} elseif ($SuccessAttempts) {
$Setting = 'Success'
} elseif ($FailureAttempts) {
$Setting = 'Failure'
} else {
$Setting = 'No auditing'
}
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
Policy = $GPOEntry.Name
Setting = $Setting
SuccessAttempts = $SuccessAttempts
FailureAttempts = $FailureAttempts
}
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
+37
View File
@@ -0,0 +1,37 @@
function ConvertTo-AuditAlternative {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
$SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null };
$FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null };
if ($SuccessAttempts -and $FailureAttempts) {
$Setting = 'Success, Failure'
} elseif ($SuccessAttempts) {
$Setting = 'Success'
} elseif ($FailureAttempts) {
$Setting = 'Failure'
} else {
$Setting = 'No auditing'
}
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
Policy = $GPOEntry.Name
Setting = $Setting
#SuccessAttempts = $SuccessAttempts
#FailureAttempts = $FailureAttempts
}
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
+29
View File
@@ -0,0 +1,29 @@
function ConvertTo-EventLog {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
Type = $GPOEntry.Type
Policy = $GPOEntry.Name
}
if ($GPOEntry.SettingBoolean) {
$CreateGPO['Setting'] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { $null };
#try { [bool]::Parse($GPOEntry.SettingBoolean) } catch { $null };
} elseif ($GPOEntry.SettingNumber) {
$CreateGPO['Setting'] = $GPOEntry.SettingNumber
}
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
+89
View File
@@ -0,0 +1,89 @@
function ConvertTo-LocalUserAndGroups {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
foreach ($User in $GPOEntry.User) {
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
Changed = [DateTime] $User.Changed
GPOSettingOrder = $User.GPOSettingOrder
UserAction = $Script:Actions["$($User.Properties.action)"] #: U
UserNewName = $User.Properties.newName #:
UserFullName = $User.Properties.fullName #:
UserDescription = $User.Properties.description #:
UserCpassword = $User.Properties.cpassword #:
UserChangeLogon = $User.Properties.changeLogon #: 0
UserNoChange = $User.Properties.noChange #: 0
UserNeverExpires = $User.Properties.neverExpires #: 0
UserAcctDisabled = $User.Properties.acctDisabled #: 0
UserAubAuthority = $User.Properties.subAuthority #: RID_ADMIN
UserUserName = $User.Properties.userName #: Administrator (built-in)
UserMembers = $User.Properties.Members #:
}
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
foreach ($Group in $GPOEntry.Group) {
# We're mostly interested in Members
[Array] $Members = foreach ($Member in $Group.Properties.Members.Member) {
[ordered] @{
MemberName = $Member.Name
MemberAction = $Member.Action
MemberSID = $Member.SID
}
}
# if we have no members we create dummy object to make sure we can use foreach below
if ($Members.Count -eq 0) {
$Members = @(
[ordered] @{
MemberName = $null
MemberAction = $null
MemberSID = $null
}
)
}
foreach ($Member in $Members) {
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
Changed = [DateTime] $Group.Changed
GPOSettingOrder = $Group.GPOSettingOrder
GroupUid = $Group.uid #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
GroupUserContext = $Group.userContext #: 0: 0
GroupRemovePolicy = $Group.removePolicy #: 1: 1
#Properties = $Group.Properties #: Properties: Properties
Filters = $Group.Filters #::
GroupAction = $Script:Actions["$($Group.Properties.action)"] #: U
GroupNewName = $Group.Properties.newName #:
GroupDescription = $Group.Properties.description #:
GroupDeleteAllUsers = $Group.Properties.deleteAllUsers #: 0
GroupDeleteAllGroups = $Group.Properties.deleteAllGroups #: 0
GroupRemoveAccounts = $Group.Properties.removeAccounts #: 1
GroupSid = $Group.Properties.groupSid #: S - 1 - 5 - 32 - 544
GroupName = $Group.Properties.groupName #: Administrators (built -in )
}
# Merging GPO with Member
$CreateGPO = $CreateGPO + $Member
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
}
}
+30
View File
@@ -0,0 +1,30 @@
function ConvertTo-Policies {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
PolicyName = $GPOEntry.Name
PolicyState = $GPOEntry.State
PolicyCategory = $GPOEntry.Category
PolicySupported = $GPOEntry.Supported
PolicyExplain = $GPOEntry.Explain
PolicyText = $GPOEntry.Text
PolicyCheckBox = $GPOEntry.CheckBox
PolicyDropDownList = $GPOEntry.DropDownList
PolicyEditText = $GPOEntry.EditText
}
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
+49
View File
@@ -0,0 +1,49 @@
function ConvertTo-RegistryAutologon {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
AutoAdminLogon = $null
DefaultDomainName = $null
DefaultUserName = $null
DefaultPassword = $null
}
foreach ($Registry in $GPOEntry.Registry) {
if ($Registry.Properties.Key -eq 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon') {
if ($Registry.Properties.Name -eq 'AutoAdminLogon') {
$CreateGPO['AutoAdminLogon'] = [bool] $Registry.Properties.value
$CreateGPO['DateChangedAutoAdminLogon'] = [DateTime] $Registry.changed
} elseif ($Registry.Properties.Name -eq 'DefaultDomainName') {
$CreateGPO['DefaultDomainName'] = $Registry.Properties.value
$CreateGPO['DateChangedDefaultDomainName'] = [DateTime] $Registry.changed
} elseif ($Registry.Properties.Name -eq 'DefaultUserName') {
$CreateGPO['DefaultUserName'] = $Registry.Properties.value
$CreateGPO['DateChangedDefaultUserName'] = [DateTime] $Registry.changed
} elseif ($Registry.Properties.Name -eq 'DefaultPassword') {
$CreateGPO['DefaultPassword'] = $Registry.Properties.value
$CreateGPO['DateChangedDefaultPassword'] = [DateTime] $Registry.changed
}
}
}
if ($null -ne $CreateGPO['AutoAdminLogon'] -or
$null -ne $CreateGPO['DefaultDomainName'] -or
$null -ne $CreateGPO['DefaultUserName'] -or
$null -ne $CreateGPO['DefaultPassword']
) {
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
}
+30
View File
@@ -0,0 +1,30 @@
function ConvertTo-RegistrySettings {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
foreach ($Registry in $GPOEntry.Registry) {
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
Changed = [DateTime] $Registry.changed
GPOSettingOrder = $Registry.GPOSettingOrder
Hive = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
Key = $Registry.Properties.key #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Name = $Registry.Properties.name #: AutoAdminLogon
Type = $Registry.Properties.type #: REG_SZ
Value = $Registry.Properties.value #
Filters = $Registry.Filters
}
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
}
@@ -0,0 +1,46 @@
function ConvertTo-RegistrySettingsCollection {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
foreach ($Collection in $GPOEntry.Collection) {
$OutputDictionaries = foreach ($Registry in $Collection.Registry) {
[ordered] @{
#"$($Registry.Name)FieldName" = $Registry.Name
#"$($Registry.Name)FieldStatus" = $Registry.Status
"$($Registry.Name)BypassErrors" = try { [bool]::Parse($Registry.BypassErrors) } catch { $null };
"$($Registry.Name)Changed" = [DateTime] $Registry.Changed
"$($Registry.Name)UID" = $Registry.UID
"$($Registry.Name)GPOSettingOrder" = $Registry.GPOSettingOrder
"$($Registry.Name)Action" = $Registry.Properties.action
"$($Registry.Name)DisplayDecimal" = $Registry.Properties.displayDecimal
"$($Registry.Name)Default" = $Registry.Properties.default
"$($Registry.Name)Hive" = $Registry.Properties.hive
"$($Registry.Name)Name" = $Registry.Properties.name
"$($Registry.Name)Type" = $Registry.Properties.type
"$($Registry.Name)Value" = $Registry.Properties.value
"$($Registry.Name)Values" = $Registry.Properties.Values
}
}
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
}
foreach ($Dictionary in $OutputDictionaries) {
$CreateGPO = $CreateGPO + $Dictionary
}
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
}
+26
View File
@@ -0,0 +1,26 @@
function ConvertTo-Scripts {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
Command = $GPOEntry.Command
Parameters = $GPOEntry.Parameters
Type = $GPOEntry.Type
Order = $GPOEntry.Order
RunOrder = $GPOEntry.RunOrder
}
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
+28
View File
@@ -0,0 +1,28 @@
function ConvertTo-SecurityOptions {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
KeyName = $GPOEntry.KeyName
KeyDisplayName = $GPOEntry.Display.Name
KeyDisplayUnits = $GPOEntry.Display.Units
KeyDisplayBoolean = try { [bool]::Parse($GPOEntry.Display.DisplayBoolean) } catch { $null };
KeyDisplayString = $GPOEntry.Display.DisplayString
SystemAccessPolicyName = $GPOEntry.SystemAccessPolicyName
SettingString = $GPOEntry.SettingString
SettingNumber = $GPOEntry.SettingNumber
}
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
@@ -0,0 +1,42 @@
function ConvertTo-SoftwareInstallation {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
Identifier = $GPOEntry.Identifier #: { 10495e9e-79c1-4a32-b278-a24cd495437f }
Name = $GPOEntry.Name #: Local Administrator Password Solution (2)
Path = $GPOEntry.Path #: \\area1.local\SYSVOL\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\LAPS.x64.msi
MajorVersion = $GPOEntry.MajorVersion #: 6
MinorVersion = $GPOEntry.MinorVersion #: 2
LanguageId = $GPOEntry.LanguageId #: 1033
Architecture = $GPOEntry.Architecture #: 9
IgnoreLanguage = if ($GPOEntry.IgnoreLanguage -eq 'true') { $true } else { $false } #: false
Allowx86Onia64 = if ($GPOEntry.Allowx86Onia64 -eq 'true') { $true } else { $false } #: true
SupportURL = $GPOEntry.SupportURL #:
AutoInstall = if ($GPOEntry.AutoInstall -eq 'true') { $true } else { $false } #: true
DisplayInARP = if ($GPOEntry.DisplayInARP -eq 'true') { $true } else { $false } #: true
IncludeCOM = if ($GPOEntry.IncludeCOM -eq 'true') { $true } else { $false } #: true
SecurityDescriptor = $GPOEntry.SecurityDescriptor #: SecurityDescriptor
DeploymentType = $GPOEntry.DeploymentType #: Assign
ProductId = $GPOEntry.ProductId #: { ea8cb806-c109 - 4700 - 96b4-f1f268e5036c }
ScriptPath = $GPOEntry.ScriptPath #: \\area1.local\SysVol\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\Machine\Applications\ { EAC9B821-FB4D - 457A-806F-E5B528D1E41A }.aas
DeploymentCount = $GPOEntry.DeploymentCount #: 0
InstallationUILevel = $GPOEntry.InstallationUILevel #: Maximum
Upgrades = if ($GPOEntry.Upgrades.Mandatory -eq 'true') { $true } else { $false } #: Upgrades
UninstallUnmanaged = if ($GPOEntry.UninstallUnmanaged -eq 'true') { $true } else { $false } #: false
LossOfScopeAction = $GPOEntry.LossOfScopeAction #: Unmanage
}
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
+25
View File
@@ -0,0 +1,25 @@
function ConvertTo-SystemServices {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
ServiceName = $GPOEntry.Name
ServiceStartUpMode = $GPOEntry.StartUpMode
SecurityAuditingPresent = try { [bool]::Parse($GPOEntry.SecurityDescriptor.AuditingPresent.'#text') } catch { $null };
SecurityPermissionsPresent = try { [bool]::Parse($GPOEntry.SecurityDescriptor.PermissionsPresent.'#text') } catch { $null };
SecurityDescriptor = $GPOEntry.SecurityDescriptor
}
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
+36
View File
@@ -0,0 +1,36 @@
function ConvertTo-SystemServicesNT {
[cmdletBinding()]
param(
[Array] $GPOList
)
foreach ($GPOEntry in $GPOList) {
foreach ($Service in $GPOEntry.NTService) {
$CreateGPO = [ordered]@{
DisplayName = $GPOEntry.DisplayName #: WO_SEC_NTLM_Auth_Level
DomainName = $GPOEntry.DomainName #: area1.local
GUID = $GPOEntry.GUID #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
GpoType = $GPOEntry.GpoType #: Computer
GpoCategory = $GPOEntry.GpoCategory #: SecuritySettings
GpoSettings = $GPOEntry.GpoSettings #: SecurityOptions
Changed = [DateTime] $Service.Changed
GPOSettingOrder = $Service.GPOSettingOrder
#ServiceName = $Service.Name
ServiceName = $Service.Properties.serviceName #: AppIDSvc: AppIDSvc
ServiceStartupType = $Service.Properties.startupType #: NOCHANGE: NOCHANGE
ServiceAction = $Service.Properties.serviceAction #: START: START
Timeout = $Service.Properties.timeout #: 50: 50
FirstFailure = $Service.Properties.firstFailure #: REBOOT: REBOOT
SecondFailure = $Service.Properties.secondFailure #: REBOOT: REBOOT
ThirdFailure = $Service.Properties.thirdFailure #: REBOOT: REBOOT
ResetFailCountDelay = $Service.Properties.resetFailCountDelay #: 0: 0
RestartComputerDelay = $Service.Properties.restartComputerDelay #: 60000: 60000
Filter = $Service.Filter
}
$CreateGPO['Linked'] = $GPOEntry.Linked #: True
$CreateGPO['LinksCount'] = $GPOEntry.LinksCount #: 1
$CreateGPO['Links'] = $GPOEntry.Links #: area1.local
[PSCustomObject] $CreateGPO
}
}
}
+15
View File
@@ -0,0 +1,15 @@
function Find-MissingProperties {
[cmdletBinding()]
param(
[Array] $Objects,
[string[]] $PossibleProperties
)
$AllProperties = Select-Properties -AllProperties -Objects $Objects
$MissingProperties = $AllProperties | Where-Object { $_ -notin 'DisplayName', 'DomainName', 'GUID', 'Linked', 'LinksCount', 'Links', 'GPOType', 'GPOCategory', 'GPOSettings' }
[Array] $ConsiderAdding = foreach ($Property in $MissingProperties) {
if ($Property -notin $PossibleProperties) {
$Property
}
}
$ConsiderAdding
}
+38
View File
@@ -0,0 +1,38 @@
function Get-LinksFromXML {
[cmdletBinding()]
param(
[System.Xml.XmlElement[]] $GPOOutput,
[string] $Splitter,
[switch] $FullObjects
)
$Links = [ordered] @{
Linked = $null
LinksCount = $null
Links = $null
}
if ($GPOOutput.LinksTo) {
$Links.Linked = $true
$Links.LinksCount = ([Array] $GPOOutput.LinksTo).Count
$Links.Links = foreach ($Link in $GPOOutput.LinksTo) {
if ($FullObjects) {
[PSCustomObject] @{
Path = $Link.SOMPath
Enabled = if ($Link.Enabled -eq 'true') { $true } else { $false }
NoOverride = if ($Link.NoOverride -eq 'true') { $true } else { $false }
}
} else {
if ($Link.Enabled) {
$Link.SOMPath
}
}
}
if ($Splitter) {
$Links.Links = $Links.Links -join $Splitter
}
} else {
$Links.Linked = $false
$Links.LinksCount = 0
$Links.Links = $null
}
[PSCustomObject] $Links
}
+3
View File
@@ -112,6 +112,9 @@
'UserSettingsVersionIdentical' = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
'UserSettings' = $XMLContent.GPO.User.ExtensionData.Extension
ComputerPolicies = $XMLContent.GPO.Computer.ExtensionData.Name -join ", "
UserPolicies = $XMLContent.GPO.User.ExtensionData.Name -join ", "
'CreationTime' = [DateTime] $XMLContent.GPO.CreatedTime
'ModificationTime' = [DateTime] $XMLContent.GPO.ModifiedTime
'ReadTime' = [DateTime] $XMLContent.GPO.ReadTime
+51
View File
@@ -0,0 +1,51 @@
function Get-XMLStandard {
[cmdletBinding()]
param(
[PSCustomObject] $GPO,
[System.Xml.XmlElement[]] $GPOOutput,
[string] $Splitter,
[switch] $FullObjects
)
$LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects
foreach ($GpoType in @('User', 'Computer')) {
if ($GPOOutput.$GpoType.ExtensionData.Extension) {
foreach ($ExtensionType in $GPOOutput.$GpoType.ExtensionData.Extension) {
# It's possible that one of the ExtensionType records has value null. Weird but happend.
if ($ExtensionType) {
$GPOSettingTypeSplit = ($ExtensionType.type -split ':')
try {
$KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] }
} catch {
Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
continue
}
foreach ($GpoSettings in $KeysToLoop.Name) {
foreach ($Key in $ExtensionType.$GpoSettings) {
$Template = [ordered] @{
DisplayName = $GPO.DisplayName
DomainName = $GPO.DomainName
GUID = $GPO.Guid
GpoType = $GpoType
GpoCategory = $GPOSettingTypeSplit[1]
GpoSettings = $GpoSettings
}
try {
$Properties = ($Key | Get-Member -MemberType Properties -ErrorAction Stop).Name
} catch {
Write-Warning "Get-XMLStandard - things went sideways 1 $($_.Exception.Message)"
$Properties = $null
}
foreach ($Property in $Properties) {
$Template["$Property"] = $Key.$Property
}
$Template['Linked'] = $LinksInformation.Linked
$Template['LinksCount'] = $LinksInformation.LinksCount
$Template['Links'] = $LinksInformation.Links
[PSCustomObject] $Template
}
}
}
}
}
}
}
+15
View File
@@ -0,0 +1,15 @@
function Invoke-GPOTranslation {
[cmdletBinding()]
param(
[System.Collections.IDictionary] $InputData,
[string] $Report,
[string] $Category,
[string] $Settings
)
if ($Category -and $Settings -and $InputData) {
if ($Script:GPODitionary[$Report]['Code']) {
$Script:GPOList = $InputData.$Category.$Settings
return & $Script:GPODitionary[$Report]['Code']
}
}
}
+6
View File
@@ -0,0 +1,6 @@
$Script:Actions = @{
C = 'Create'
D = 'Delete'
U = 'Update'
R = 'Replace'
}
+111
View File
@@ -0,0 +1,111 @@
$Script:GPODitionary = [ordered] @{
AccountPolicies = [ordered] @{
Category = 'SecuritySettings'
Settings = 'Account'
GPOPath = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies'
Code = {
ConvertTo-AccountPolicies -GPOList $GPOList
}
}
Audit = [ordered] @{
Category = 'SecuritySettings'
Settings = 'Audit'
#GPOPath = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies'
Code = {
ConvertTo-Audit -GPOList $GPOList
}
}
AuditAlternative = [ordered] @{
Category = 'SecuritySettings'
Settings = 'Audit'
#GPOPath = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies'
Code = {
ConvertTo-AuditAlternative -GPOList $GPOList
}
}
Autologon = [ordered] @{
Category = 'RegistrySettings'
Settings = 'RegistrySettings'
Code = {
ConvertTo-RegistryAutologon -GPOList $GPOList
}
}
EventLog = [ordered] @{
Category = 'SecuritySettings'
Settings = 'EventLog'
#GPOPath = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies'
Code = {
ConvertTo-EventLog -GPOList $GPOList
}
}
LocalUsersAndGroups = [ordered] @{
Category = 'LugsSettings'
Settings = 'LocalUsersAndGroups'
Code = {
ConvertTo-LocalUserAndGroups -GPOList $GPOList
}
}
Policies = @{
Category = 'RegistrySettings'
Settings = 'Policy'
Code = {
ConvertTo-Policies -GPOList $GPOList
}
}
RegistrySettings = [ordered] @{
Category = 'RegistrySettings'
Settings = 'RegistrySettings'
Code = {
ConvertTo-RegistrySettings -GPOList $GPOList
}
}
RegistrySettingsCollection = [ordered] @{
Category = 'RegistrySettings'
Settings = 'RegistrySettings'
Code = {
ConvertTo-RegistrySettingsCollection -GPOList $GPOList
}
}
Scripts = [ordered] @{
Category = 'Scripts'
Settings = 'Script'
Code = {
ConvertTo-Scripts -GPOList $GPOList
}
}
SecurityOptions = [ordered] @{
Category = 'SecuritySettings'
Settings = 'SecurityOptions'
Code = {
ConvertTo-SecurityOptions -GPOList $GPOList
}
}
SoftwareInstallation = [ordered] @{
Category = 'SoftwareInstallationSettings'
Settings = 'MsiApplication'
Code = {
ConvertTo-SoftwareInstallation -GPOList $GPOList
}
}
SystemServices = [ordered] @{
Description = ''
GPOPath = 'Computer Configuration -> Policies -> Windows Settings -> Security Settings -> System Services'
Category = 'SecuritySettings'
Settings = 'SystemServices'
Code = {
ConvertTo-SystemServices -GPOList $GPOList
}
}
SystemServicesNT = [ordered] @{
Description = ''
GPOPath = 'Computer Configuration -> Preferences -> Control Pannel Settings -> Services'
Category = 'ServiceSettings'
Settings = 'NTServices'
Code = {
ConvertTo-SystemServicesNT -GPOList $GPOList
}
}
#LugsSettings = @{
# LocalUsersAndGroups = $LugsSettingsLocalUsersAndGroups
}
+18 -13
View File
@@ -50,19 +50,24 @@
}
Get-ADObject @Splat -Properties DisplayName, Name, Created, Modified, gPCFileSysPath, gPCFunctionalityVersion, gPCWQLFilter, gPCMachineExtensionNames, Description, CanonicalName, DistinguishedName | ForEach-Object -Process {
$DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDomainCN
$Output = [ordered]@{ }
$Output['DisplayName'] = $_.DisplayName
$Output['DomainName'] = $DomainCN
$Output['Description'] = $_.Description
$Output['GUID'] = $_.Name -replace '{' -replace '}'
$Output['Path'] = $_.gPCFileSysPath
$Output['FunctionalityVersion'] = $_.gPCFunctionalityVersion
$Output['Created'] = $_.Created
$Output['Modified'] = $_.Modified
$Output['GPOCanonicalName'] = $_.CanonicalName
$Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDC
$Output['GPODistinguishedName'] = $_.DistinguishedName
[PSCustomObject] $Output
$GUID = $_.Name -replace '{' -replace '}'
if (($GUID).Length -ne 36) {
Write-Warning "Get-GPOZaurrAD - GPO GUID ($($($GUID.Replace("`n",' ')))) is incorrect. Skipping $($_.DisplayName) / Domain: $($DomainCN)"
} else {
$Output = [ordered]@{ }
$Output['DisplayName'] = $_.DisplayName
$Output['DomainName'] = $DomainCN
$Output['Description'] = $_.Description
$Output['GUID'] = $GUID
$Output['Path'] = $_.gPCFileSysPath
$Output['FunctionalityVersion'] = $_.gPCFunctionalityVersion
$Output['Created'] = $_.Created
$Output['Modified'] = $_.Modified
$Output['GPOCanonicalName'] = $_.CanonicalName
$Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDC
$Output['GPODistinguishedName'] = $_.DistinguishedName
[PSCustomObject] $Output
}
}
}
}
+7 -2
View File
@@ -2,13 +2,18 @@
[cmdletBinding()]
param(
[ValidateSet('All', 'MultipleLinks', 'OneLink', 'LinksSummary')][string[]] $Report = 'All',
[switch] $UnlimitedProperties
[switch] $UnlimitedProperties,
[alias('ForestName')][string] $Forest,
[string[]] $ExcludeDomains,
[alias('Domain', 'Domains')][string[]] $IncludeDomains,
[System.Collections.IDictionary] $ExtendedForestInformation
)
$HighestCount = 0 # to keep number of depth
$CacheSummaryLinks = [ordered] @{} # cache
# Get all links
$Links = Get-GPOZaurrLink
$Links = Get-GPOZaurrLink -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
foreach ($Link in $Links) {
if (-not $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"]) {
$CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"] = [System.Collections.Generic.List[System.Object]]::new()
+183
View File
@@ -0,0 +1,183 @@
function Invoke-GPOZaurr {
[alias('Find-GPO')]
[cmdletBinding(DefaultParameterSetName = 'Default')]
param(
[Parameter(ParameterSetName = 'Default')][alias('ForestName')][string] $Forest,
[Parameter(ParameterSetName = 'Default')][string[]] $ExcludeDomains,
[Parameter(ParameterSetName = 'Default')][alias('Domain', 'Domains')][string[]] $IncludeDomains,
[Parameter(ParameterSetName = 'Default')][System.Collections.IDictionary] $ExtendedForestInformation,
[Parameter(ParameterSetName = 'Local')][string] $GPOPath,
[Parameter(ParameterSetName = 'Default')]
[Parameter(ParameterSetName = 'Local')]
[string[]] $Type,
[Parameter(ParameterSetName = 'Default')]
[Parameter(ParameterSetName = 'Local')]
[switch] $NoTranslation,
[Parameter(ParameterSetName = 'Default')]
[Parameter(ParameterSetName = 'Local')]
[string] $Splitter = [System.Environment]::NewLine,
[Parameter(ParameterSetName = 'Default')]
[Parameter(ParameterSetName = 'Local')]
[switch] $FullObjects,
[Parameter(ParameterSetName = 'Default')]
[Parameter(ParameterSetName = 'Local')]
[ValidateSet('HTML', 'Object', 'Excel')][string[]] $OutputType = 'Object',
[Parameter(ParameterSetName = 'Default')]
[Parameter(ParameterSetName = 'Local')]
[string] $OutputPath,
[Parameter(ParameterSetName = 'Default')]
[Parameter(ParameterSetName = 'Local')]
[switch] $Open
)
if ($Type.Count -eq 0) {
$Type = $Script:GPODitionary.Keys
}
if ($GPOPath) {
if (Test-Path -LiteralPath $GPOPath) {
<#
$GPOListPath = [io.path]::Combine($GPOPath, "GPOList.xml")
if ($GPOListPath) {
$GPOs = Import-Clixml -Path $GPOListPath
} else {
}
#>
$GPOFiles = Get-ChildItem -LiteralPath $GPOPath -Recurse -File
[Array] $GPOs = foreach ($File in $GPOFiles) {
if ($File.Name -ne 'GPOList.xml') {
[xml] $GPORead = Get-Content -LiteralPath $File.FullName
[PSCustomObject] @{
DisplayName = $GPORead.GPO.Name
DomainName = $GPORead.GPO.Identifier.Domain.'#text'
GUID = $GPORead.GPO.Identifier.Identifier.'#text' -replace '{' -replace '}'
GPOOutput = $GPORead
}
}
}
} else {
Write-Warning "Find-GPO - $GPOPath doesn't exists."
return
}
} else {
[Array] $GPOs = Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
}
$Output = [ordered] @{}
$OutputByGPO = [ordered] @{}
foreach ($GPO in $GPOs) {
if ($GPOPath) {
$GPOOutput = $GPO.GPOOutput
} else {
[xml] $GPOOutput = Get-GPOReport -Guid $GPO.GUID -Domain $GPO.DomainName -ReportType Xml
}
[Array] $Data = Get-XMLStandard -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects
foreach ($D in $Data) {
if (-not $Output["$($D.GpoCategory)"]) {
$Output["$($D.GpoCategory)"] = [ordered] @{}
}
if (-not $Output["$($D.GpoCategory)"]["$($D.GpoSettings)"]) {
$Output["$($D.GpoCategory)"]["$($D.GpoSettings)"] = [System.Collections.Generic.List[PSCustomObject]]::new()
}
$Output["$($D.GpoCategory)"]["$($D.GpoSettings)"].Add($D)
if (-not $OutputByGPO["$($D.DomainName)"]) {
$OutputByGPO["$($D.DomainName)"] = [ordered] @{}
}
if (-not $OutputByGPO[$D.DomainName][$D.DisplayName]) {
$OutputByGPO[$D.DomainName][$D.DisplayName] = [System.Collections.Generic.List[PSCustomObject]]::new()
}
$OutputByGPO[$D.DomainName][$D.DisplayName].Add($D)
}
}
if ($NoTranslation) {
if ($OutputType -contains 'Object') {
$OutputByGPO
}
} else {
$TranslatedOutput = [ordered] @{}
foreach ($Report in $Type) {
$Category = $Script:GPODitionary[$Report]['Category']
$Settings = $Script:GPODitionary[$Report]['Settings']
#if (-not $TranslatedOutput[$Report]) {
# $TranslatedOutput[$Report] = [ordered] @{}
#}
#foreach ($Setting in $Settings) {
# if (-not $TranslatedOutput[$Category][$Settings]) {
# $TranslatedOutput[$Category][$Settings] = [ordered] @{}
# }
$TranslatedOutput[$Report] = Invoke-GPOTranslation -InputData $Output -Category $Category -Settings $Settings -Report $Report
#}
}
if ($OutputType -contains 'Object') {
$TranslatedOutput
}
}
if ($NoTranslation) {
$SingleSource = $OutputType
} else {
$SingleSource = $TranslatedOutput
}
if ($OutputPath) {
$FolderPath = $OutputPath
} else {
$FolderPath = [io.path]::GetTempPath()
}
if ($OutputType -contains 'HTML') {
$FilePathHTML = [io.path]::Combine($FolderPath, "GPOZaurr-Summary-$((Get-Date).ToString('yyyy-MM-dd_HH_mm_ss')).html")
Write-Warning "Invoke-GPOZaurr - $FilePathHTML"
New-HTML {
foreach ($GPOCategory in $SingleSource.Keys) {
New-HTMLTab -Name $GPOCategory {
if ($SingleSource["$GPOCategory"] -is [System.Collections.IDictionary]) {
foreach ($GpoSettings in $SingleSource["$GPOCategory"].Keys) {
New-HTMLTab -Name $GpoSettings {
if ($SingleSource[$GPOCategory][$GpoSettings].Count -gt 0) {
New-HTMLTable -DataTable $SingleSource[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
}
}
}
} else {
if ($SingleSource[$GPOCategory].Count -gt 0) {
New-HTMLTable -DataTable $SingleSource[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
}
}
}
}
} -Online -ShowHTML:$Open.IsPresent -FilePath $FilePathHTML
}
if ($OutputType -contains 'Excel') {
$FilePathExcel = [io.path]::Combine($FolderPath, "GPOZaurr-Summary-$((Get-Date).ToString('yyyy-MM-dd_HH_mm_ss')).xlsx")
Write-Warning "Invoke-GPOZaurr - $FilePathExcel"
foreach ($GPOCategory in $SingleSource.Keys) {
if ($SingleSource["$GPOCategory"] -is [System.Collections.IDictionary]) {
foreach ($GpoSettings in $SingleSource["$GPOCategory"].Keys) {
if ($SingleSource[$GPOCategory][$GpoSettings].Count -gt 0) {
ConvertTo-Excel -DataTable $SingleSource[$GPOCategory][$GpoSettings] -AllProperties -ExcelWorkSheetName $GpoSettings -FilePath $FilePathExcel -AutoFilter -AutoFit -Option Rename
}
}
} else {
if ($SingleSource[$GPOCategory].Count -gt 0) {
ConvertTo-Excel -DataTable $SingleSource[$GPOCategory] -AllProperties -ExcelWorkSheetName $GPOCategory -FilePath $FilePathExcel -AutoFilter -AutoFit -Option Rename
}
}
}
if ($Open) {
Invoke-Item -Path $FilePathExcel
}
}
}
[scriptblock] $SourcesAutoCompleter = {
param($commandName, $parameterName, $wordToComplete, $commandAst, $fakeBoundParameters)
$Script:GPODitionary.Keys | Sort-Object | Where-Object { $_ -like "*$wordToComplete*" }
}
Register-ArgumentCompleter -CommandName Find-GPO -ParameterName Type -ScriptBlock $SourcesAutoCompleter
+10 -14
View File
@@ -9,12 +9,6 @@
[switch] $DeleteExisting
)
if ($GPOPath) {
if (-not $ExtendedForestInformation) {
$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
} else {
$ForestInformation = $ExtendedForestInformation
}
if ($DeleteExisting) {
$Test = Test-Path -LiteralPath $GPOPath
if ($Test) {
@@ -22,16 +16,18 @@
Remove-Item -LiteralPath $GPOPath -Recurse
}
}
$null = New-Item -ItemType Directory -Path $GPOPath -Force
foreach ($Domain in $ForestInformation.Domains) {
Write-Verbose "Save-GPOZaurrFiles - Processing GPO for $Domain"
Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
$XMLContent = Get-GPOReport -ID $_.ID.Guid -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
$Path = [io.path]::Combine($GPOPath, "$($_.ID.Guid).xml")
$XMLContent | Set-Content -LiteralPath $Path -Force -Encoding Unicode
$GPOs = Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
foreach ($GPO in $GPOS) {
$XMLContent = Get-GPOReport -ID $GPO.Guid -ReportType XML -Domain $GPO.DomainName
$GPODOmainFolder = [io.path]::Combine($GPOPath, $GPO.DomainName)
if (-not (Test-Path -Path $GPODOmainFolder)) {
$null = New-Item -ItemType Directory -Path $GPODOmainFolder -Force
}
$Path = [io.path]::Combine($GPODOmainFolder, "$($GPO.Guid).xml")
$XMLContent | Set-Content -LiteralPath $Path -Force -Encoding Unicode
}
$GPOListPath = [io.path]::Combine($GPOPath, "GPOList.xml")
$GPOs | Export-Clixml -Depth 5 -Path $GPOListPath
}
}
+22
View File
@@ -0,0 +1,22 @@
function Select-GPOTranslation {
[cmdletbInding()]
param(
[Parameter(ValueFromPipeline)][System.Collections.IDictionary] $InputObject,
[string] $Category,
[string] $Settings
)
$Important = [ordered] @{}
$AllProperties = Select-Properties -AllProperties -Objects $InputObject.$Category.$Settings
$MissingProperties = $AllProperties | Where-Object { $_ -notin 'DisplayName', 'DomainName', 'GUID', 'Linked', 'LinksCount', 'Links', 'GPOType', 'GPOCategory', 'GPOSettings' }
$Types = foreach ($Property in $MissingProperties) {
($InputObject.$Category.$Settings | Where-Object { $null -ne $_.$Property }).$Property | ForEach-Object {
($_ | Get-Member -MemberType Properties) | Where-Object { $_.Name -notin 'Length' }
}
}
$Important['AllProperties'] = $AllProperties
$Important['MissingProperties'] = $MissingProperties
$Important['Types'] = $Types | Select-Object -Unique
$Important['Data'] = $InputObject.$Category.$Settings
$Important
}
+11
View File
@@ -39,6 +39,17 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
## Changelog
- 0.0.47 - 29.06.2020
- Update to `Get-GPOZaurrAD` for better error reporting
- Updates to `Invoke-GPOZaurr` - still work in progress
- 0.0.46 - 28.06.2020
- Additional protection for `Get-GPOZaurrAD` for CNF duplicates
- Update to `Save-GPOZaurrFiles`
- Added `Invoke-GPOZaurr` (alias: `Find-GPO`) (heavy work in progress)
- 0.0.45 - 26.06.2020
- During publishing ADEssentials required functions are now merged to prevent cyclic dependency bug [Using ModuleSpec syntax in RequiredModules causes incorrect "cyclic dependency" failures](https://github.com/PowerShell/PowerShell/issues/2607)
- 0.0.44 - 24.06.2020
- Improvement to `Get-GPOZaurrLinkSummary`
- 0.0.43 - 21.06.2020
- Added `Get-GPOZaurrFiles` to list files on NETLOGON/SYSVOL shares with a lot of details
- 0.0.42 - 19.06.2020