Update

if sysvol doesn't exists

Examples/Example-02-RemoveEmptyAndUnlinkedGPOs.ps1

@@ -2,4 +2,4 @@
 
 # Remove GPOS
 $BackupPath = "$Env:UserProfile\Desktop\GPO"
-Remove-GPOZaurr -Type Empty, Unlinked -BackupPath $BackupPath -BackupDated -LimitProcessing 2 -Verbose
+Remove-GPOZaurr -Type Empty, Unlinked -BackupPath $BackupPath -BackupDated -LimitProcessing 2 -Verbose -WhatIf

Examples/Example-04-GPOinformation.ps1

@@ -1,7 +1,7 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 $GPOS = Get-GPOZaurr
-$GPOS | Format-Table -AutoSize
+$GPOS | Format-Table -AutoSize *
 
 $GPOS[0] | Format-List
 

Examples/Example-08-ListingPermissionsAdministrative.ps1

@@ -1,4 +1,4 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$T = Get-GPOZaurrPermission -GPOName 'Default Domain Policy' -Type 'All'
+$T = Get-GPOZaurrPermission -GPOName 'Default Domain Policy' -Type 'All' -IncludeOwner
 $T | Format-Table *

Examples/Example-08-ListingPermissionsUnknown.ps1

@@ -1,4 +1,4 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 $T = Get-GPOZaurrPermission -Type Unknown -Verbose
-$T | Format-Table *
+$T | Out-HtmlView -ScrollX -Filtering -DisablePaging -ScrollY -Online

Examples/Example-11-ReplaceGPOOwnerAutomated.ps1

@@ -1,14 +1,14 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-# This Example shows how to deal with GPOs that have owner that doesn't exists anymore (deleted userr or diff domain) - EmptyOrUnknown
+# This Example shows how to deal with GPOs that have owner that doesn't exists anymore (deleted userr or diff domain) - Unknown
 # And also can fix at the same time NotAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins
 # regardless if current user is still Domain Admin or not
 
 $GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName
-$GPOs | Format-Table  DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
+$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
 
 #Set-GPOZaurrOwner -Type Unknown -Verbose  #-LimitProcessing 2 -WhatIf
-Set-GPOZaurrOwner -Type NotAdministrative  -Verbose -LimitProcessing 2 -WhatIf
+Set-GPOZaurrOwner -Type NotAdministrative -Verbose -LimitProcessing 2 -WhatIf
 #Set-GPOZaurrOwner -Type NotMatching -Verbose -LimitProcessing 2 -WhatIf
 
 #Set-GPOZaurrOwner -GPOName 'COMPUTERS | Enable Sets' -Verbose -Principal 'przemyslaw.klys' -WhatIf #-SkipSysvol

Examples/Example-17-RepairInconsistentACL.ps1

@@ -2,4 +2,4 @@
 
 Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz'
 
-Repair-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -Verbose #-WhatIf -Verbose
+Repair-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -Verbose -WhatIf

Examples/Example-17-RepairInconsistentACLAll.ps1

@@ -1,5 +1,5 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-Get-GPOZaurrPermissionConsistency -Type All | Format-Table
+Get-GPOZaurrPermissionConsistency -Type All -VerifyInheritance | Format-Table
 
 Repair-GPOZaurrPermissionConsistency -LimitProcessing 2 -WhatIf -Verbose

Examples/Example-19-TestSysvol.ps1

@@ -1,3 +1,4 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-Get-GPOZaurrSysvol -Verbose | Format-Table
+Get-GPOZaurrSysvol -Verbose | Format-Table
+#Get-GPOZaurrSysvol | Out-HtmlView -ScrollX

Examples/Example-20-RemoveOrphanedFoldersSysvol.ps1

@@ -1,7 +1,7 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 # this allows you to process X amount of orphaned folders/files (good for testing)
-Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf -LimitProcessing 2
+Remove-GPOZaurrOrphaned -Verbose -WhatIf -IncludeDomains 'ad.evotec.xyz' #-LimitProcessing 2
 
 # this runs for whole SYSVOL and checks things against GPOS
-Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf
+Remove-GPOZaurrOrphaned -Verbose -IncludeDomains 'ad.evotec.xyz' -BackupPath $Env:UserProfile\Desktop\MyBackup1 -WhatIf

Examples/Example-22-RemoveLegacyADMFiles.ps1

@@ -1,3 +1,3 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-Remove-GPOZaurrLegacyFiles -Verbose -WhatIf
+Remove-GPOZaurrLegacyFiles -Verbose -BackupPath $Env:USERPROFILE\Desktop\BackupADM1 -BackupDated -RemoveEmptyFolders -WhatIf -LimitProcessing 2

Examples/Example-26-Files.ps1

@@ -1,10 +0,0 @@
-Clear-Host
-Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-
-$Output = Get-GPOZaurrSysvol | ForEach-Object {
-    $Path = $_.Path
-    Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File | ForEach-Object {
-        Get-FileMetaData -File $_ -Signature -HashAlgorithm 'SHA256'
-    }
-}
-$Output | Format-Table

Examples/Example-26-ListInvokeGpozaurrTypes.ps1

@@ -0,0 +1,6 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Dictionary = Get-GPOZaurrDictionary #-Splitter '; '
+$Dictionary | Format-Table
+$Dictionary | Out-HtmlView

Examples/Example-28-SaveGPO.ps1

@@ -1,4 +1,3 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-#Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport -DeleteExisting
-Save-GPOZaurrFiles -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' #-DeleteExisting
+Save-GPOZaurrFiles -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportEvotec' -DeleteExisting -Verbose

Examples/Example-29-FindGPO-FromDisk-Notranslation.ps1

@@ -1,34 +0,0 @@
-Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-
-# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
-#$OutputNoTranslation = Invoke-GPOZaurr -GPOPath $Env:UserProfile\Desktop\GPOExport -NoTranslation
-#$OutputNoTranslation = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
-$OutputNoTranslation | Format-Table *
-
-<#
-New-HTML {
-    foreach ($GPOCategory in $OutputNoTranslation.Keys) {
-        New-HTMLTab -Name $GPOCategory {
-            if ($OutputNoTranslation["$GPOCategory"] -is [System.Collections.IDictionary]) {
-                foreach ($GpoSettings in $OutputNoTranslation["$GPOCategory"].Keys) {
-                    New-HTMLTab -Name $GpoSettings {
-                        New-HTMLTable -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
-                    }
-                }
-            } else {
-                New-HTMLTable -DataTable $OutputNoTranslation[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
-            }
-        }
-    }
-} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-NoTranslationFromDisk.html
-
-#>
-foreach ($GPOCategory in $OutputNoTranslation.Keys) {
-    if ($OutputNoTranslation["$GPOCategory"] -is [System.Collections.IDictionary]) {
-        foreach ($GpoSettings in $OutputNoTranslation["$GPOCategory"].Keys) {
-            ConvertTo-Excel -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -AllProperties -ExcelWorkSheetName $GpoSettings -FilePath $Env:UserProfile\Desktop\Export\$GpoSettings.xlsx -AutoFilter -AutoFit
-        }
-    } else {
-        ConvertTo-Excel -DataTable $OutputNoTranslation[$GPOCategory][$GpoSettings] -AllProperties -ExcelWorkSheetName $GpoSettings -FilePath $Env:UserProfile\Desktop\Export\$GpoSettings.xlsx -AutoFilter -AutoFit
-    }
-}

Examples/Example-29-FindGPO0.ps1

@@ -1,36 +0,0 @@
-Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-
-#Invoke-GPOZaurr -OutputType Excel, Object, HTML -Open | Format-Table
-$Output = Invoke-GPOZaurr -GPOPath $Env:USERPROFILE\Desktop\GPOExport -NoTranslation #| Format-Table
-#$Output.Count
-
-
-
-<# 4073 files - 212MB / no translation
-
-Days              : 0
-Hours             : 0
-Minutes           : 0
-Seconds           : 51
-Milliseconds      : 756
-Ticks             : 517566534
-TotalDays         : 0,000599035340277778
-TotalHours        : 0,0143768481666667
-TotalMinutes      : 0,86261089
-TotalSeconds      : 51,7566534
-TotalMilliseconds : 51756,6534
-#>
-
-<# 4073 files - 212MB / no translation / But with 2 diff types ($OutputByCategory / $OutputByGPO)
-Days              : 0
-Hours             : 0
-Minutes           : 0
-Seconds           : 53
-Milliseconds      : 246
-Ticks             : 532466109
-TotalDays         : 0,00061628021875
-TotalHours        : 0,01479072525
-TotalMinutes      : 0,887443515
-TotalSeconds      : 53,2466109
-TotalMilliseconds : 53246,6109
-#>

Examples/Example-29-FindGPO1.ps1

@@ -1,20 +1,22 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$Output = Invoke-GPOZaurr #-NoTranslation
+#$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPODefender'
+$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' -Type WindowsHelloForBusiness
 $Output | Format-Table
+$Output.WindowsDefenderExploitGuard | Format-Table
+$Output.Reports.RegistrySetting | Format-Table
 
+# Report to Excel of translated reports
+foreach ($Key in $Output.Keys) {
+    $Output[$Key] | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOAnalysis.xlsx -ExcelWorkSheetName $Key -AutoFilter -AutoFit -FreezeTopRowFirstColumn
+}
+
+# Report to HTML of translated reports
 New-HTML {
-    foreach ($GPOCategory in $Output.Keys) {
-        New-HTMLTab -Name $GPOCategory {
-            if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
-                foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
-                    New-HTMLTab -Name $GpoSettings {
-                        New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
-                    }
-                }
-            } else {
-                New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
-            }
+    New-HTMLTableOption -DataStore JavaScript
+    foreach ($Key in $Output.Keys) {
+        New-HTMLTab -Name $Key {
+            New-HTMLTable -DataTable $Output[$Key] -Filtering -Title $Key
         }
     }
-} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO.html
+} -FilePath $Env:USERPROFILE\Desktop\GPOAnalysis.html -ShowHTML -Online

Examples/Example-29-FindGPO2-NoTranslation.ps1

@@ -1,20 +0,0 @@
-Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-
-$Output = Invoke-GPOZaurr -NoTranslation
-$Output | Format-Table
-
-New-HTML {
-    foreach ($GPOCategory in $Output.Keys) {
-        New-HTMLTab -Name $GPOCategory {
-            if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
-                foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
-                    New-HTMLTab -Name $GpoSettings {
-                        New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
-                    }
-                }
-            } else {
-                New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
-            }
-        }
-    }
-} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-NoTranslation.html

Examples/Example-29-FindGPO2.ps1

@@ -0,0 +1,8 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This gets the same thing as earlier examples
+# with a difference where one entry per gpo and all settings for that GPO is stored under settings property.
+$Output = Invoke-GPOZaurr -SingleObject -Verbose
+$Output | Format-Table
+$Output.Reports.RegistrySettings | Format-Table *
+$Output.Reports.RegistrySettings[0].Settings | Format-Table *

Examples/Example-29-FindGPO3-FromDisk.ps1

@@ -1,22 +0,0 @@
-Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-
-# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
-
-$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' # -NoTranslation
-$Output | Format-Table *
-
-New-HTML {
-    foreach ($GPOCategory in $Output.Keys) {
-        New-HTMLTab -Name $GPOCategory {
-            if ($Output["$GPOCategory"] -is [System.Collections.IDictionary]) {
-                foreach ($GpoSettings in $Output["$GPOCategory"].Keys) {
-                    New-HTMLTab -Name $GpoSettings {
-                        New-HTMLTable -DataTable $Output[$GPOCategory][$GpoSettings] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
-                    }
-                }
-            } else {
-                New-HTMLTable -DataTable $Output[$GPOCategory] -ScrollX -DisablePaging -AllProperties -Title $GpoSettings
-            }
-        }
-    }
-} -Online -ShowHTML -FilePath $Env:UserProfile\Desktop\OutputFromFindGPO-FromDisk.html

Examples/Example-29-FindGPO3.ps1

@@ -0,0 +1,15 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExportAudit
+
+# This will allow you to process offline data more than once
+# It's useful for when you want to request different types
+$Output = Invoke-GPOZaurr -GPOPath $ENV:USERPROFILE\Desktop\GPOExportAudit -Extended -Verbose
+$Output | Format-Table *
+$Output.Reports | Format-Table
+
+# Export to Excel
+foreach ($Key in $Output.Reports.Keys) {
+    $Output.Reports[$Key] | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOAnalysis.xlsx -ExcelWorkSheetName $Key -AutoFilter -AutoFit -FreezeTopRowFirstColumn
+}
+Start-Process "$Env:USERPROFILE\Desktop\GPOAnalysis.xlsx"

Examples/Example-29-FindGPO4.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Output = Invoke-GPOZaurr -Verbose -OutputType HTML, Object -Open
+$Output | Format-Table

Examples/Example-29-FindGPO5.ps1

@@ -0,0 +1,23 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Asses GPO based on exported data
+$Output = Invoke-GPOZaurr -GPOPath $Env:USERPROFILE\Desktop\GPOExport_2020.10.12 -Verbose -Type RegistrySetting
+$Output | Format-Table *
+
+
+# Export to Excel
+foreach ($Key in $Output.Keys) {
+    $Output[$Key] | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\EFGPOAnalysis.xlsx -ExcelWorkSheetName $Key -AutoFilter -AutoFit -FreezeTopRowFirstColumn
+}
+# Show the Excel
+Start-Process "$Env:USERPROFILE\Desktop\EFGPOAnalysis.xlsx"
+
+# Show HTML
+New-HTML {
+    New-HTMLTableOption -DataStore JavaScript
+    foreach ($Key in $Output.Keys) {
+        New-HTMLTab -Name $Key {
+            New-HTMLTable -DataTable $Output[$Key] -Filtering -Title $Key
+        }
+    }
+} -FilePath $Env:USERPROFILE\Desktop\EFGPOAnalysis.html -ShowHTML -Online

Examples/Example-29-FindGPO7.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Output = Invoke-GPOZaurr -GPOPath $ENV:USERPROFILE\Desktop\GPOTestingUserAccess -Verbose
+$Output | Format-Table *

Examples/Example-29-FindGPOFromDiskWork.ps1

@@ -1,25 +0,0 @@
-Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-
-# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
-
-$OutputTranslation = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport'
-$OutputTranslation | Format-Table
-$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExport' -NoTranslation
-$Output | Format-Table *
-
-#$Output.LugsSettings.LocalUsersAndGroups | Format-List *
-
-$GPOEntry = $Output.LugsSettings.LocalUsersAndGroups[0]
-
-$CreateGPO = @{}
-foreach ($User in $GPOEntry.User) {
-    # $User | Format-Table
-    # $User.Properties | Format-Table
-}
-
-
-foreach ($Group in $GPOEntry.Group) {
-    #$Group | Format-Table
-    $Group.Properties | Format-Table
-    $Group.Properties.Members | Format-Table
-}

Examples/Example-29-FindGPOHtmlOutput.ps1

@@ -1,6 +0,0 @@
-Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-
-# Use Save-GPOZaurrFiles -GPOPath $ENV:USERPROFILE\Desktop\GPOExport
-
-$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
-$Output | Format-Table *

Examples/Example-29-FindGPOTranslationHelp.ps1

@@ -1,11 +0,0 @@
-Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-
-# This is purely for building GPO Dictionary, mostly for development needs to help asses what is there
-
-$Output = Invoke-GPOZaurr -GPOPath 'C:\Support\GitHub\GpoZaurr\Ignore\GPOExportTest' -NoTranslation
-#$Output | Format-Table *
-
-$LookingFor = $Output | Select-GPOTranslation -Category 'SecuritySettings' -Settings 'UserRightsAssignment'
-$LookingFor | Format-Table
-$LookingFor.Types | Format-Table
-#$LookingFor.Data | Format-Table

Examples/Example-30-AssesSyvolFiles.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Files = Get-GPOZaurrFiles -Limited -Signature
+$Files | ConvertTo-Excel -OpenWorkBook -FilePath $Env:USERPROFILE\Desktop\GPOTesting.xlsx -ExcelWorkSheetName 'GPO Output' -AutoFilter -AutoFit -FreezeTopRowFirstColumn

Examples/Example-30-FindPolicyDefinitions.ps1

@@ -0,0 +1,6 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Policies = Get-GPOZaurrFilesPolicyDefinition -Signature
+$Policies | Format-Table
+#$Policies.FilesToDelete | Format-Table *
+$Policies['ad.evotec.xyz'] | Format-Table *

Examples/Example-31-FindAndRemoveEmptyFolders.ps1

@@ -0,0 +1,7 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Report on empty folders
+Get-GPOZaurrFolders -FolderType Empty | Format-Table *
+
+# ! NOT READY FOR EMPTY
+#Remove-GPOZaurrFolders -FolderType Empty -Verbose -BackupPath $Env:USERPROFILE\Desktop\SomeBackup1 -WhatIf

Examples/Example-32-FindAndRemoveNTFRSFolders.ps1

@@ -0,0 +1,7 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Report on NTFRS folders
+Get-GPOZaurrFolders -FolderType NTFRS | Format-Table *
+
+# Remove NTFRS (broken replication folders)
+Remove-GPOZaurrFolders -FolderType NTFRS -Verbose -BackupPath $Env:USERPROFILE\Desktop\SomeBackup -WhatIf

Examples/Example-33-CleanupPrivateDFSR.ps1

@@ -0,0 +1,10 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Cleanup based on https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/manually-clearing-the-conflictanddeleted-folder-in-dfsr/ba-p/395711
+
+# Get dfsr information
+$DFSR = Get-GPOZaurrSysvolDFSR
+$DFSR | Format-Table *
+
+# Cleanup DFSR Conflict Path
+Clear-GPOZaurrSysvolDFSR -WhatIf

Examples/Example-34-GPOSupport.ps1

@@ -0,0 +1,81 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Invoke-GPOZaurrSupport -ComputerName 'ad1.ad.evotec.xyz' -UserName 'EVOTEC\przemyslaw.klys' -Type NativeHTML -ForceGPResult -Verbose
+
+return
+#$Support1 = Invoke-GPOZaurrSupport -ComputerName 'AD1' -UserName 'przemyslaw.klys' -Type Object
+#$Support = Invoke-GPOZaurrSupport -ComputerName 'AD1' -UserName 'EVOTEC\Administrator' -Type Object
+#$Support.ComputerResults.ExtensionData
+
+
+foreach ($GpoType in @('UserResults', 'ComputerResults')) {
+    if ($Support.$GpoType.ExtensionData) {
+        foreach ($Extension in $Support.$GpoType.ExtensionData) {
+            $GPOSettingTypeSplit = ($Extension.type -split ':')
+            #$Extension
+            #$Extension | Get-Member -MemberType Properties -ErrorAction Stop
+            $KeysToLoop = $Extension | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin @($GPOSettingTypeSplit[0], 'xmlns', 'blocked', 'type') }
+            foreach ($GpoSettings in $KeysToLoop.Name) {
+                $Extension.$GpoSettings | Format-Table
+            }
+        }
+    }
+}
+
+# $env:LOGONSERVER
+# if($env:LOGONSERVER -match "MicrosoftAccount") {"Logged on with Windows account"}
+
+# If it reports \\MicrosoftAccount, they are using their Windows account to sign in instead of domain credentials.
+#You can check this by using the IF statement as shown here:
+
+
+#[System.DirectoryServices.ActiveDirectory.ActiveDirectorySite]::GetComputerSite().Name
+
+#[System.DirectoryServices.ActiveDirectory.DomainController]::
+
+# https://concurrency.com/blog/may-2018/domain-controller-selection
+#echo %logonserver% - This shows the DC that was used to authenticate and log in the current user
+#nltest /dsgetsite - This shows the AD site that the current server has detected that it's in
+#nltest /dclist: (include the colon at the end) - This shows the list of DCs in the current domain, including which site each is in.
+# nslookup -type=srv _ldap._tcp.mydomain.local. - This will query the primary DNS server for all domain controller SRV records.  This should return all of the DCs in the domain.  In this example, MGLABDC4 and MGLABDC5 are returned.
+# nslookup -type=srv _ldap._tcp.mysitename._sites.dc._msdcs.mydomain.local. - This will query the primary DNS server for domain controllers that are registered in "mysitename".  In this example, only MGLABDC4 is in the site that was queried, which matches the information we found with nltest /dclist: previously.
+
+
+# Windows 10
+
+#Add-WindowsCapability -Online -Name 'Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0'
+#Add-WindowsCapability -Online -Name 'Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0'
+#Remove-WindowsCapability -Online -Name 'Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0'
+
+Write-Output %logonserver%
+nltest /dsgetsite
+nltest /dclist:
+
+$env:LOGONSERVER
+[System.DirectoryServices.ActiveDirectory.ActiveDirectorySite]::GetComputerSite().Name
+nslookup -type=srv _ldap._tcp.ad.colmore.com.
+nslookup -type=srv _ldap._tcp.birmingham._sites.dc._msdcs.ad.colmore.com.
+
+
+function Get-PreData {
+    param(
+
+    )
+    [PSCustomObject] @{
+        Site = [System.DirectoryServices.ActiveDirectory.ActiveDirectorySite]::GetComputerSite().Name
+    }
+}
+
+function Get-ComputerDataInformation {
+    [cmdletBinding()]
+    param(
+        [string] $ComputerName = $Env:COMPUTERNAME
+    )
+    [PSCustomObject] @{
+        Bios        = Get-ComputerBios -ComputerName $ComputerName
+        Network     = Get-ComputerNetwork -ComputerName $ComputerName
+        NetworkCard = Get-ComputerNetworkCard -ComputerName $ComputerName
+    }
+}
+Get-ComputerDataInformation -ComputerName 'AD1.AD.EVOTEC.XYZ'
+#Get-ComputerNetwork -ComputerName 'AD1.AD.EVOTEC.XYZ' #| Format-Table

Examples/Example-35-FindCSE01.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+ConvertFrom-CSExtension -CSE '{FC715823-C5FB-11D1-9EEF-00A0C90347FF}'
+ConvertFrom-CSExtension -CSE '{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}'

Examples/Example-35-FindCSE02.ps1

@@ -0,0 +1,21 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Extracts CSE from registry
+$AllRegistryExtensions = Find-CSExtension
+$AllRegistryExtensions | Format-Table
+
+# Uses Hashtable - similar to above but much faster
+$AllRegistryExtensionsFaster = foreach ($CSE in $AllRegistryExtensions) {
+    ConvertFrom-CSExtension -CSE $CSE.CSE
+}
+$AllRegistryExtensionsFaster | Format-Table
+
+# With this we can find out if we're missing anything in hashtable so we can update code if nessecary
+$MissingEntries = foreach ($CSE in $AllRegistryExtensions) {
+    $Output = ConvertFrom-CSExtension -CSE $CSE.CSE
+    if ($Output.CSE -eq $Output.Description) {
+        # THis means the value in hashtable is missing this entry and we should add it
+        $CSE
+    }
+}
+$MissingEntries | Format-Table

Examples/Example-36-FindBlockedInheritance.ps1

@@ -0,0 +1,10 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Get basic output DN, CanonicalName, BlockInheritance (True/False)
+#$Objects = Get-GPOZaurrInheritance
+#$Objects | Format-Table
+
+# Get same output DN, CanonicalName, BlockInheritance (True/False) + Users/Computers + UsersCount/ComputerCount for those with Blocked Inhertiance
+# This is so you can have a list what machines are affected
+$Objects = Get-GPOZaurrInheritance -IncludeBlockedObjects -OnlyBlockedInheritance
+$Objects | Format-Table

Examples/Example-37-GPOPermissionSummary.ps1

@@ -0,0 +1,10 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Default Permissions:
+# 'GpoApply', 'GpoEdit', 'GPOCustom', 'GpoEditDeleteModifySecurity', 'GPORead'
+# If you want to see also owners
+# 'GpoOwner'
+# If you want to include Root Level Permissions
+# 'GpoRootCreate', 'GpoRootOwner'
+$SummaryPermission = Get-GPOZaurrPermissionSummary -IncludePermissionType 'GpoCustom', 'GpoEdit', 'GpoEditDeleteModifySecurity', 'GpoOwner', 'GpoRootCreate', 'GpoRootOwner'
+$SummaryPermission | Sort-Object -Property Permission | Format-Table

Examples/Example-38-GPOPermissionRoot.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrPermissionRoot -Verbose | Format-Table *

Examples/Example-39-SharePermissions.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$FilesAll = Get-GPOZaurrNetlogon
+$FilesAll | Format-Table -a *

GPOZaurr.psd1

@@ -1,29 +1,34 @@
 @{
-    AliasesToExport      = 'Find-GPO'
+    AliasesToExport      = @('Get-GPOZaurrFilesPolicyDefinitions', 'Find-GPO')
     Author               = 'Przemyslaw Klys'
+    CmdletsToExport      = @()
     CompanyName          = 'Evotec'
-    CompatiblePSEditions = 'Desktop'
+    CompatiblePSEditions = @('Desktop')
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
-    Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows easy fixing for issues that you may expect finding in them.'
-    FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrFiles', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Select-GPOTranslation', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
+    Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
+    FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvol', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphaned', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Show-GPOZaurr')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.47'
+    ModuleVersion        = '0.0.63'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
-            Tags                       = 'Windows', 'ActiveDirectory', 'GPO', 'GroupPolicy'
+            Tags                       = @('Windows', 'ActiveDirectory', 'GPO', 'GroupPolicy')
             ProjectUri                 = 'https://github.com/EvotecIT/GPOZaurr'
-            ExternalModuleDependencies = 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
+            ExternalModuleDependencies = @('CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility')
         }
     }
-    RequiredModules      = @{
-        ModuleVersion = '0.0.155'
-        ModuleName    = 'PSSharedGoods'
-        Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
-    }, @{
-        ModuleVersion = '0.0.58'
-        ModuleName    = 'ADEssentials'
-        Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
-    }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
+    RequiredModules      = @(@{
+            ModuleVersion = '0.0.183'
+            ModuleName    = 'PSSharedGoods'
+            Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
+        }, @{
+            ModuleVersion = '0.0.99'
+            ModuleName    = 'ADEssentials'
+            Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
+        }, @{
+            ModuleVersion = '0.0.112'
+            ModuleName    = 'PSWriteHTML'
+            Guid          = 'a7bdf640-f5cb-4acf-9de0-365b322d245c'
+        }, 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility')
     RootModule           = 'GPOZaurr.psm1'
 }

Private/ConvertFrom-XMLRSOP.ps1

@@ -0,0 +1,243 @@
+function ConvertFrom-XMLRSOP {
+    [cmdletBinding()]
+    param(
+        [System.Xml.XmlElement]$Content,
+        [string] $ResultsType,
+        [Microsoft.GroupPolicy.GPRsop] $ResultantSetPolicy,
+        [string] $Splitter = [System.Environment]::NewLine
+    )
+    $GPOPrimary = [ordered] @{
+        Summary              = $null
+        SummaryDetails       = [System.Collections.Generic.List[PSCustomObject]]::new()
+        SummaryDownload      = $null
+        ResultantSetPolicy   = $ResultantSetPolicy
+
+        GroupPolicies        = $null
+        GroupPoliciesLinks   = $null
+        GroupPoliciesApplied = $null
+        GroupPoliciesDenied  = $null
+        Results              = [ordered]@{}
+    }
+
+    $Object = [ordered] @{
+        ReadTime           = [DateTime] $Content.ReadTime
+        ComputerName       = $Content.$ResultsType.Name
+        DomainName         = $Content.$ResultsType.Domain
+        OrganizationalUnit = $Content.$ResultsType.SOM
+        Site               = $Content.$ResultsType.Site
+        GPOTypes           = $Content.$ResultsType.ExtensionData.Name.'#text' -join $Splitter
+        SlowLink           = if ($Content.$ResultsType.SlowLink -eq 'true') { $true } else { $false };
+    }
+
+    $GPOPrimary['Summary'] = $Object
+    [Array] $GPOPrimary['SecurityGroups'] = foreach ($Group in $Content.$ResultsType.SecurityGroup) {
+        [PSCustomObject] @{
+            Name = $Group.Name.'#Text'
+            SID  = $Group.SID.'#Text'
+        }
+    }
+    [Array] $GPOPrimary['GroupPolicies'] = foreach ($GPO in $Content.$ResultsType.GPO) {
+
+        <#
+        $EventsReason = @{
+            'NOTAPPLIED-EMPTY' = 'Not Applied (Empty)'
+            'DENIED-WMIFILTER' = 'Denied (WMI Filter)'
+            'DENIED-SECURITY'  = 'Denied (Security)'
+        }
+        #>
+        # Lets translate CSE extensions as some didn't translate automatically
+        $ExtensionName = $GPO.ExtensionName | ForEach-Object {
+            ConvertFrom-CSExtension -CSE $_ -Limited
+        }
+        $GPOObject = [PSCustomObject] @{
+            Name           = $GPO.Name
+            #Path             = $GPO.Path
+            GUID           = $GPO.Path.Identifier.'#text'
+            DomainName     = if ($GPO.Path.Domain.'#text') { $GPO.Path.Domain.'#text' } else { 'Local Policy' };
+            #VersionDirectory = $GPO.VersionDirectory
+            #VersionSysvol    = $GPO.VersionSysvol
+            Revision       = -join ('AD (', $GPO.VersionDirectory, '), SYSVOL (', $GPO.VersionSysvol, ')')
+            IsValid        = if ($GPO.IsValid -eq 'true') { $true } else { $false };
+            Status         = if ($GPO.FilterAllowed -eq 'true' -and $GPO.AccessDenied -eq 'false') { 'Applied' } else { 'Denied' };
+            FilterAllowed  = if ($GPO.FilterAllowed -eq 'true') { $true } else { $false };
+            AccessAllowed  = if ($GPO.AccessDenied -eq 'true') { $false } else { $true };
+            FilterName     = $GPO.FilterName  # : Test
+            ExtensionName  = ($ExtensionName | Sort-Object -Unique) -join '; '
+            # This isn't really pretty for large amount of links but can be useful for assesing things
+            SOMOrder       = $GPO.Link.SOMOrder -join '; '
+            AppliedOrder   = $GPO.Link.AppliedOrder -join '; '
+            LinkOrder      = $GPO.Link.LinkOrder -join '; '
+            Enabled        = ($GPO.Link.Enabled | ForEach-Object { if ($_ -eq 'true') { $true } else { $false }; }) -join '; '
+            Enforced       = ($GPO.Link.NoOverride | ForEach-Object { if ($_ -eq 'true') { $true } else { $false }; }) -join '; ' # : true
+            SecurityFilter = $GPO.SecurityFilter -join '; ' # SecurityFilter   : {NT AUTHORITY\Authenticated Users, EVOTEC\GDS-TestGroup3}
+            FilterId       = $GPO.FilterID #   : MSFT_SomFilter.ID="{ff08bc72-dae6-4890-b4cf-85a9c3b00056}",Domain="ad.evotec.xyz"
+            Links          = $GPO.Link.SOMPath -join '; '
+        }
+        $GPOObject
+    }
+    [Array] $GPOPrimary['GroupPoliciesLinks'] = foreach ($GPO in $Content.$ResultsType.GPO) {
+        foreach ($Link in $GPO.Link) {
+            [PSCustomObject] @{
+                DisplayName  = $GPO.Name
+                DomainName   = $GPO.Path.Domain.'#text'
+                GUID         = $GPO.Path.Identifier.'#text'
+                SOMPath      = $Link.SOMPath      # : ad.evotec.xyz
+                SOMOrder     = $Link.SOMOrder     # : 2
+                AppliedOrder = $Link.AppliedOrder # : 0
+                LinkOrder    = $Link.LinkOrder    # : 4
+                Enabled      = if ($Link.Enabled -eq 'true') { $true } else { $false }; # : true
+                Enforced     = if ($Link.NoOverride -eq 'true') { $true } else { $false }; # : true
+            }
+        }
+    }
+
+    [Array] $GPOPrimary['ScopeOfManagement'] = foreach ($SOM in $Content.$ResultsType.SearchedSOM) {
+        [PSCustomObject] @{
+            Path              = $SOM.Path
+            Type              = $SOM.Type
+            Order             = $SOM.Order
+            BlocksInheritance = if ($SOM.BlocksInheritance -eq 'true') { $true } else { $false };
+            Blocked           = if ($SOM.Blocked -eq 'true') { $true } else { $false };
+            Reason            = if ($SOM.Reason -eq 'true') { $true } else { $false };
+        }
+    }
+    [Array] $GPOPrimary['ExtensionStatus'] = foreach ($Details in $Content.$ResultsType.ExtensionStatus) {
+        [PSCustomObject] @{
+            Name          = $Details.Name          # : Registry
+            Identifier    = $Details.Identifier    # : {35378EAC-683F-11D2-A89A-00C04FBBCFA2}
+            BeginTime     = $Details.BeginTime     # : 2020-04-02T12:05:10
+            EndTime       = $Details.EndTime       # : 2020-04-02T12:05:10
+            LoggingStatus = $Details.LoggingStatus # : Complete
+            Error         = $Details.Error         # : 0
+        }
+    }
+    [Array] $GPOPrimary['ExtensionData'] = $Content.$ResultsType.ExtensionData.Extension
+
+
+    foreach ($Single in $Content.$ResultsType.EventsDetails.SinglePassEventsDetails) {
+        $GPOPrimary['Results']["$($Single.ActivityId)"] = [ordered] @{}
+
+        $GPOPrimary['Results']["$($Single.ActivityId)"]['SummaryDetails'] = [Ordered] @{
+            ActivityId                      = $Single.ActivityId                      # : {6400d0bf-ac88-4ee6-b2c2-ca2cbbab0695}
+            ProcessingTrigger               = $Single.ProcessingTrigger               # : Periodic
+            ProcessingAppMode               = $Single.ProcessingAppMode               # : Background
+            LinkSpeedInKbps                 = $Single.LinkSpeedInKbps                 # : 0
+            SlowLinkThresholdInKbps         = $Single.SlowLinkThresholdInKbps         # : 500
+            DomainControllerName            = $Single.DomainControllerName            # : AD1.ad.evotec.xyz
+            DomainControllerIPAddress       = $Single.DomainControllerIPAddress       # : 192.168.240.189
+            PolicyProcessingMode            = $Single.PolicyProcessingMode            # : None
+            PolicyElapsedTimeInMilliseconds = $Single.PolicyElapsedTimeInMilliseconds # : 1202
+            ErrorCount                      = $Single.ErrorCount                      # : 0
+            WarningCount                    = $Single.WarningCount                    # : 0
+        }
+
+        $GPOPrimary['SummaryDetails'].Add([PSCustomObject] $GPOPrimary['Results']["$($Single.ActivityId)"]['SummaryDetails'])
+
+        [Array] $GPOPrimary['Results']["$($Single.ActivityId)"]['ProcessingTime'] = foreach ($Details in $Single.ExtensionProcessingTime) {
+            [PSCustomObject] @{
+                ExtensionName             = $Details.ExtensionName
+                ExtensionGuid             = $Details.ExtensionGuid
+                ElapsedTimeInMilliseconds = $Details.ElapsedTimeInMilliseconds
+                ProcessedTimeStamp        = $Details.ProcessedTimeStamp
+            }
+        }
+
+
+        $EventsLevel = @{
+            '5' = 'Verbose'
+            '4' = 'Informational'
+            '3' = 'Warning'
+            '2' = 'Error'
+            '1' = 'Critical'
+            '0' = 'LogAlways'
+        }
+        $EventsReason = @{
+            'NOTAPPLIED-EMPTY' = 'Not Applied (Empty)'
+            'DENIED-WMIFILTER' = 'Denied (WMI Filter)'
+            'DENIED-SECURITY'  = 'Denied (Security)'
+        }
+
+        [Array] $GPOPrimary['Results']["$($Single.ActivityId)"]['Events'] = foreach ($Event in $Single.EventRecord) {
+            [xml] $EventDetails = $Event.EventXML
+            $EventInformation = [ordered] @{
+                Description   = $Event.EventDescription
+                Provider      = $EventDetails.Event.System.Provider.Name      # : Provider
+                ProviderGUID  = $EventDetails.Event.System.Provider.Guid
+                EventID       = $EventDetails.Event.System.EventID       # : 4006
+                Version       = $EventDetails.Event.System.Version       # : 1
+                Level         = $EventsLevel[$EventDetails.Event.System.Level]        # : 4
+                Task          = $EventDetails.Event.System.Task          # : 0
+                Opcode        = $EventDetails.Event.System.Opcode        # : 1
+                Keywords      = $EventDetails.Event.System.Keywords      # : 0x4000000000000000
+                TimeCreated   = [DateTime] $EventDetails.Event.System.TimeCreated.SystemTime   # : TimeCreated, 2020-08-09T20:16:44.5668052Z
+                EventRecordID = $EventDetails.Event.System.EventRecordID # : 10641325
+                Correlation   = $EventDetails.Event.System.Correlation.ActivityID   # : Correlation
+                Execution     = -join ("ProcessID: ", $EventDetails.Event.System.Execution.ProcessID, " ThreadID: ", $EventDetails.Event.System.Execution.ThreadID)       # : Execution
+                Channel       = $EventDetails.Event.System.Channel       # : Microsoft-Windows-GroupPolicy / Operational
+                Computer      = $EventDetails.Event.System.Computer      # : AD1.ad.evotec.xyz
+                Security      = $EventDetails.Event.System.Security.UserID      # : Security
+            }
+            foreach ($Entry in $EventDetails.Event.EventData.Data) {
+                $EventInformation["$($Entry.Name)"] = $Entry.'#text'
+            }
+            [PSCustomObject] $EventInformation
+        }
+
+        # Lets build events by ID, this will be useful for better/easier processing
+        $GPOPrimary['Results']["$($Single.ActivityId)"]['EventsByID'] = [ordered] @{}
+        $GroupedEvents = $GPOPrimary['Results']["$($Single.ActivityId)"]['Events'] | Group-Object -Property EventId
+        foreach ($Events in $GroupedEvents) {
+            $GPOPrimary['Results']["$($Single.ActivityId)"]['EventsByID'][$Events.Name] = $Events.Group
+        }
+
+        $GPOPrimary['Results']["$($Single.ActivityId)"]['GroupPoliciesApplied'] = & {
+            if ($GPOPrimary['Results']["$($Single.ActivityId)"]['EventsByID']['5312']) {
+                [xml] $GPODetailsApplied = -join ('<Details>', $GPOPrimary['Results']["$($Single.ActivityId)"]['EventsByID']['5312'].GPOinfoList, '</Details>')
+                foreach ($GPO in $GPODetailsApplied.Details.GPO) {
+                    $ReturnObject = [ordered] @{
+                        GUID        = $GPO.ID         # : { 4E1F9C70-1DDB-4AB6-BBA3-14A8E07F0B4B }
+                        DisplayName = $GPO.Name       # : DC | Event Log Settings
+                        Version     = $GPO.Version    # : 851981
+                        Link        = $GPO.SOM        # : LDAP: / / OU = Domain Controllers, DC = ad, DC = evotec, DC = xyz
+                        SysvolPath  = $GPO.FSPath     # : \\ad.evotec.xyz\SysVol\ad.evotec.xyz\Policies\ { 4E1F9C70-1DDB-4AB6-BBA3-14A8E07F0B4B }\Machine
+                        #GPOTypes    = $GPO.Extensions -join '; ' # : [ { 35378EAC-683F-11D2-A89A-00C04FBBCFA2 } { D02B1F72 - 3407 - 48AE-BA88-E8213C6761F1 }]
+                    }
+                    $TranslatedExtensions = foreach ($Extension in $GPO.Extensions) {
+                        ConvertFrom-CSExtension -CSE $Extension -Limited
+                    }
+                    $ReturnObject['GPOTypes'] = $TranslatedExtensions -join '; '
+                    [PSCustomObject] $ReturnObject
+                }
+            }
+        }
+        $GPOPrimary['Results']["$($Single.ActivityId)"]['GroupPoliciesDenied'] = & {
+            if ($GPOPrimary['Results']["$($Single.ActivityId)"]['EventsByID']['5312']) {
+                [xml] $GPODetailsDenied = -join ('<Details>', $GPOPrimary['Results']["$($Single.ActivityId)"]['EventsByID']['5313'].GPOinfoList, '</Details>')
+                foreach ($GPO in $GPODetailsDenied.Details.GPO) {
+                    [PSCustomObject] @{
+                        GUID        = $GPO.ID      #: { 6AC1786C-016F-11D2-945F-00C04fB984F9 }
+                        DisplayName = $GPO.Name    #: Default Domain Controllers Policy
+                        Version     = $GPO.Version #: 131074
+                        Link        = $GPO.SOM     #: LDAP: / / OU = Domain Controllers, DC = ad, DC = evotec, DC = xyz
+                        SysvolPath  = $GPO.FSPath  #: \\ad.evotec.xyz\sysvol\ad.evotec.xyz\Policies\ { 6AC1786C-016F-11D2-945F-00C04fB984F9 }\Machine
+                        Reason      = $EventsReason["$($GPO.Reason)"]  #: DENIED-WMIFILTER
+                    }
+                }
+            }
+        }
+
+        $GPOPrimary['Results']["$($Single.ActivityId)"]['SummaryDownload'] = & {
+            if ($GPOPrimary['Results']["$($Single.ActivityId)"]['EventsByID']['5126']) {
+                [PSCustomObject] @{
+                    IsBackgroundProcessing  = if ($GPOPrimary['Results']["$($Single.ActivityId)"]['EventsByID']['5126'].IsBackgroundProcessing -eq 'true') { $true } else { $false }; # : true
+                    IsAsyncProcessing       = if ($GPOPrimary['Results']["$($Single.ActivityId)"]['EventsByID']['5126'].IsAsyncProcessing -eq 'true') { $true } else { $false }; # : false
+                    Downloaded              = $GPOPrimary['Results']["$($Single.ActivityId)"]['EventsByID']['5126'].NumberOfGPOsDownloaded               # : 7
+                    Applicable              = $GPOPrimary['Results']["$($Single.ActivityId)"]['EventsByID']['5126'].NumberOfGPOsApplicable               # : 6
+                    DownloadTimeMiliseconds = $GPOPrimary['Results']["$($Single.ActivityId)"]['EventsByID']['5126'].GPODownloadTimeElapsedInMilliseconds # : 375
+                }
+
+            }
+        }
+    }
+    $GPOPrimary
+}

Private/ConvertTo-AccountPolicies.ps1

@@ -1,31 +0,0 @@
-# TODO: #2 Identical to ConvertTo-EventLog - decide what to do later on
-
-function ConvertTo-AccountPolicies {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-        $CreateGPO = [ordered]@{
-            DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-            DomainName  = $GPOEntry.DomainName    #: area1.local
-            GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-            GpoType     = $GPOEntry.GpoType       #: Computer
-            GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
-            GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
-            Type        = $GPOEntry.Type
-            Policy      = $GPOEntry.Name
-
-        }
-        if ($GPOEntry.SettingBoolean) {
-            $CreateGPO['Setting'] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { $null };
-            #try { [bool]::Parse($GPOEntry.SettingBoolean) } catch { $null };
-        } elseif ($GPOEntry.SettingNumber) {
-            $CreateGPO['Setting'] = $GPOEntry.SettingNumber
-        }
-        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-        [PSCustomObject] $CreateGPO
-    }
-}

Private/ConvertTo-Audit.ps1

@@ -1,35 +0,0 @@
-function ConvertTo-Audit {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-        $SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null };
-        $FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null };
-        if ($SuccessAttempts -and $FailureAttempts) {
-            $Setting = 'Success, Failure'
-        } elseif ($SuccessAttempts) {
-            $Setting = 'Success'
-        } elseif ($FailureAttempts) {
-            $Setting = 'Failure'
-        } else {
-            $Setting = 'No auditing'
-        }
-        $CreateGPO = [ordered]@{
-            DisplayName     = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-            DomainName      = $GPOEntry.DomainName    #: area1.local
-            GUID            = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-            GpoType         = $GPOEntry.GpoType       #: Computer
-            GpoCategory     = $GPOEntry.GpoCategory   #: SecuritySettings
-            GpoSettings     = $GPOEntry.GpoSettings   #: SecurityOptions
-            Policy          = $GPOEntry.Name
-            Setting         = $Setting
-            SuccessAttempts = $SuccessAttempts
-            FailureAttempts = $FailureAttempts
-        }
-        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-        [PSCustomObject] $CreateGPO
-    }
-}

Private/ConvertTo-AuditAlternative.ps1

@@ -1,37 +0,0 @@
-function ConvertTo-AuditAlternative {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-        $SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null };
-        $FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null };
-        if ($SuccessAttempts -and $FailureAttempts) {
-            $Setting = 'Success, Failure'
-        } elseif ($SuccessAttempts) {
-            $Setting = 'Success'
-        } elseif ($FailureAttempts) {
-            $Setting = 'Failure'
-        } else {
-            $Setting = 'No auditing'
-        }
-        $CreateGPO = [ordered]@{
-            DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-            DomainName  = $GPOEntry.DomainName    #: area1.local
-            GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-            GpoType     = $GPOEntry.GpoType       #: Computer
-            GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
-            GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
-            Policy      = $GPOEntry.Name
-            Setting     = $Setting
-            #SuccessAttempts = $SuccessAttempts
-            #FailureAttempts = $FailureAttempts
-        }
-
-
-        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-        [PSCustomObject] $CreateGPO
-    }
-}

Private/ConvertTo-EventLog.ps1

@@ -1,29 +0,0 @@
-function ConvertTo-EventLog {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-        $CreateGPO = [ordered]@{
-            DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-            DomainName  = $GPOEntry.DomainName    #: area1.local
-            GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-            GpoType     = $GPOEntry.GpoType       #: Computer
-            GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
-            GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
-            Type        = $GPOEntry.Type
-            Policy      = $GPOEntry.Name
-
-        }
-        if ($GPOEntry.SettingBoolean) {
-            $CreateGPO['Setting'] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { $null };
-            #try { [bool]::Parse($GPOEntry.SettingBoolean) } catch { $null };
-        } elseif ($GPOEntry.SettingNumber) {
-            $CreateGPO['Setting'] = $GPOEntry.SettingNumber
-        }
-        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-        [PSCustomObject] $CreateGPO
-    }
-}

Private/ConvertTo-LocalUserAndGroups.ps1

@@ -1,89 +0,0 @@
-function ConvertTo-LocalUserAndGroups {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-        foreach ($User in $GPOEntry.User) {
-            $CreateGPO = [ordered]@{
-                DisplayName      = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-                DomainName       = $GPOEntry.DomainName    #: area1.local
-                GUID             = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-                GpoType          = $GPOEntry.GpoType       #: Computer
-                GpoCategory      = $GPOEntry.GpoCategory   #: SecuritySettings
-                GpoSettings      = $GPOEntry.GpoSettings   #: SecurityOptions
-                Changed          = [DateTime] $User.Changed
-                GPOSettingOrder  = $User.GPOSettingOrder
-                UserAction       = $Script:Actions["$($User.Properties.action)"]       #: U
-                UserNewName      = $User.Properties.newName      #:
-                UserFullName     = $User.Properties.fullName     #:
-                UserDescription  = $User.Properties.description  #:
-                UserCpassword    = $User.Properties.cpassword    #:
-                UserChangeLogon  = $User.Properties.changeLogon  #: 0
-                UserNoChange     = $User.Properties.noChange     #: 0
-                UserNeverExpires = $User.Properties.neverExpires #: 0
-                UserAcctDisabled = $User.Properties.acctDisabled #: 0
-                UserAubAuthority = $User.Properties.subAuthority #: RID_ADMIN
-                UserUserName     = $User.Properties.userName     #: Administrator (built-in)
-                UserMembers      = $User.Properties.Members      #:
-            }
-            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-            [PSCustomObject] $CreateGPO
-        }
-        foreach ($Group in $GPOEntry.Group) {
-            # We're mostly interested in Members
-            [Array] $Members = foreach ($Member in $Group.Properties.Members.Member) {
-                [ordered] @{
-                    MemberName   = $Member.Name
-                    MemberAction = $Member.Action
-                    MemberSID    = $Member.SID
-                }
-            }
-            # if we have no members we create dummy object to make sure we can use foreach below
-            if ($Members.Count -eq 0) {
-                $Members = @(
-                    [ordered] @{
-                        MemberName   = $null
-                        MemberAction = $null
-                        MemberSID    = $null
-                    }
-                )
-            }
-            foreach ($Member in $Members) {
-                $CreateGPO = [ordered]@{
-                    DisplayName          = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-                    DomainName           = $GPOEntry.DomainName    #: area1.local
-                    GUID                 = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-                    GpoType              = $GPOEntry.GpoType       #: Computer
-                    GpoCategory          = $GPOEntry.GpoCategory   #: SecuritySettings
-                    GpoSettings          = $GPOEntry.GpoSettings   #: SecurityOptions
-                    Changed              = [DateTime] $Group.Changed
-                    GPOSettingOrder      = $Group.GPOSettingOrder
-                    GroupUid             = $Group.uid             #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
-                    GroupUserContext     = $Group.userContext     #: 0: 0
-                    GroupRemovePolicy    = $Group.removePolicy    #: 1: 1
-                    #Properties      = $Group.Properties      #: Properties: Properties
-                    Filters              = $Group.Filters         #::
-
-                    GroupAction          = $Script:Actions["$($Group.Properties.action)"]          #: U
-                    GroupNewName         = $Group.Properties.newName         #:
-                    GroupDescription     = $Group.Properties.description     #:
-                    GroupDeleteAllUsers  = $Group.Properties.deleteAllUsers  #: 0
-                    GroupDeleteAllGroups = $Group.Properties.deleteAllGroups #: 0
-                    GroupRemoveAccounts  = $Group.Properties.removeAccounts  #: 1
-                    GroupSid             = $Group.Properties.groupSid        #: S - 1 - 5 - 32 - 544
-                    GroupName            = $Group.Properties.groupName       #: Administrators (built -in )
-                }
-                # Merging GPO with Member
-                $CreateGPO = $CreateGPO + $Member
-
-                $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-                $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-                $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-                [PSCustomObject] $CreateGPO
-            }
-        }
-    }
-}

Private/ConvertTo-Policies.ps1

@@ -1,30 +0,0 @@
-function ConvertTo-Policies {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-        $CreateGPO = [ordered]@{
-            DisplayName        = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-            DomainName         = $GPOEntry.DomainName    #: area1.local
-            GUID               = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-            GpoType            = $GPOEntry.GpoType       #: Computer
-            GpoCategory        = $GPOEntry.GpoCategory   #: SecuritySettings
-            GpoSettings        = $GPOEntry.GpoSettings   #: SecurityOptions
-            PolicyName         = $GPOEntry.Name
-            PolicyState        = $GPOEntry.State
-            PolicyCategory     = $GPOEntry.Category
-            PolicySupported    = $GPOEntry.Supported
-            PolicyExplain      = $GPOEntry.Explain
-            PolicyText         = $GPOEntry.Text
-            PolicyCheckBox     = $GPOEntry.CheckBox
-            PolicyDropDownList = $GPOEntry.DropDownList
-            PolicyEditText     = $GPOEntry.EditText
-        }
-        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-        [PSCustomObject] $CreateGPO
-
-    }
-}

Private/ConvertTo-RegistryAutologon.ps1

@@ -1,49 +0,0 @@
-function ConvertTo-RegistryAutologon {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-
-        $CreateGPO = [ordered]@{
-            DisplayName       = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-            DomainName        = $GPOEntry.DomainName    #: area1.local
-            GUID              = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-            GpoType           = $GPOEntry.GpoType       #: Computer
-            GpoCategory       = $GPOEntry.GpoCategory   #: SecuritySettings
-            GpoSettings       = $GPOEntry.GpoSettings   #: SecurityOptions
-            AutoAdminLogon    = $null
-            DefaultDomainName = $null
-            DefaultUserName   = $null
-            DefaultPassword   = $null
-        }
-
-        foreach ($Registry in $GPOEntry.Registry) {
-            if ($Registry.Properties.Key -eq 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon') {
-                if ($Registry.Properties.Name -eq 'AutoAdminLogon') {
-                    $CreateGPO['AutoAdminLogon'] = [bool] $Registry.Properties.value
-                    $CreateGPO['DateChangedAutoAdminLogon'] = [DateTime] $Registry.changed
-                } elseif ($Registry.Properties.Name -eq 'DefaultDomainName') {
-                    $CreateGPO['DefaultDomainName'] = $Registry.Properties.value
-                    $CreateGPO['DateChangedDefaultDomainName'] = [DateTime] $Registry.changed
-                } elseif ($Registry.Properties.Name -eq 'DefaultUserName') {
-                    $CreateGPO['DefaultUserName'] = $Registry.Properties.value
-                    $CreateGPO['DateChangedDefaultUserName'] = [DateTime] $Registry.changed
-                } elseif ($Registry.Properties.Name -eq 'DefaultPassword') {
-                    $CreateGPO['DefaultPassword'] = $Registry.Properties.value
-                    $CreateGPO['DateChangedDefaultPassword'] = [DateTime] $Registry.changed
-                }
-            }
-        }
-        if ($null -ne $CreateGPO['AutoAdminLogon'] -or
-            $null -ne $CreateGPO['DefaultDomainName'] -or
-            $null -ne $CreateGPO['DefaultUserName'] -or
-            $null -ne $CreateGPO['DefaultPassword']
-        ) {
-            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-            [PSCustomObject] $CreateGPO
-        }
-    }
-}

Private/ConvertTo-RegistrySettings.ps1

@@ -1,30 +0,0 @@
-function ConvertTo-RegistrySettings {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-        foreach ($Registry in $GPOEntry.Registry) {
-            $CreateGPO = [ordered]@{
-                DisplayName     = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-                DomainName      = $GPOEntry.DomainName    #: area1.local
-                GUID            = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-                GpoType         = $GPOEntry.GpoType       #: Computer
-                GpoCategory     = $GPOEntry.GpoCategory   #: SecuritySettings
-                GpoSettings     = $GPOEntry.GpoSettings   #: SecurityOptions
-                Changed         = [DateTime] $Registry.changed
-                GPOSettingOrder = $Registry.GPOSettingOrder
-                Hive            = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
-                Key             = $Registry.Properties.key  #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
-                Name            = $Registry.Properties.name #: AutoAdminLogon
-                Type            = $Registry.Properties.type #: REG_SZ
-                Value           = $Registry.Properties.value #
-                Filters         = $Registry.Filters
-            }
-            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-            [PSCustomObject] $CreateGPO
-        }
-    }
-}

Private/ConvertTo-RegistrySettingsCollection.ps1

@@ -1,46 +0,0 @@
-function ConvertTo-RegistrySettingsCollection {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-        foreach ($Collection in $GPOEntry.Collection) {
-            $OutputDictionaries = foreach ($Registry in $Collection.Registry) {
-                [ordered] @{
-                    #"$($Registry.Name)FieldName"       = $Registry.Name
-                    #"$($Registry.Name)FieldStatus"     = $Registry.Status
-                    "$($Registry.Name)BypassErrors"    = try { [bool]::Parse($Registry.BypassErrors) } catch { $null };
-                    "$($Registry.Name)Changed"         = [DateTime] $Registry.Changed
-                    "$($Registry.Name)UID"             = $Registry.UID
-                    "$($Registry.Name)GPOSettingOrder" = $Registry.GPOSettingOrder
-                    "$($Registry.Name)Action"          = $Registry.Properties.action
-                    "$($Registry.Name)DisplayDecimal"  = $Registry.Properties.displayDecimal
-                    "$($Registry.Name)Default"         = $Registry.Properties.default
-                    "$($Registry.Name)Hive"            = $Registry.Properties.hive
-                    "$($Registry.Name)Name"            = $Registry.Properties.name
-                    "$($Registry.Name)Type"            = $Registry.Properties.type
-                    "$($Registry.Name)Value"           = $Registry.Properties.value
-                    "$($Registry.Name)Values"          = $Registry.Properties.Values
-                }
-            }
-            $CreateGPO = [ordered]@{
-                DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-                DomainName  = $GPOEntry.DomainName    #: area1.local
-                GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-                GpoType     = $GPOEntry.GpoType       #: Computer
-                GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
-                GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
-            }
-            foreach ($Dictionary in $OutputDictionaries) {
-                $CreateGPO = $CreateGPO + $Dictionary
-            }
-            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-            [PSCustomObject] $CreateGPO
-        }
-    }
-}
-
-
-

Private/ConvertTo-Scripts.ps1

@@ -1,26 +0,0 @@
-function ConvertTo-Scripts {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-        $CreateGPO = [ordered]@{
-            DisplayName = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-            DomainName  = $GPOEntry.DomainName    #: area1.local
-            GUID        = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-            GpoType     = $GPOEntry.GpoType       #: Computer
-            GpoCategory = $GPOEntry.GpoCategory   #: SecuritySettings
-            GpoSettings = $GPOEntry.GpoSettings   #: SecurityOptions
-            Command     = $GPOEntry.Command
-            Parameters  = $GPOEntry.Parameters
-            Type        = $GPOEntry.Type
-            Order       = $GPOEntry.Order
-            RunOrder    = $GPOEntry.RunOrder
-        }
-        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-        [PSCustomObject] $CreateGPO
-
-    }
-}

Private/ConvertTo-SecurityOptions.ps1

@@ -1,28 +0,0 @@
-function ConvertTo-SecurityOptions {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-        $CreateGPO = [ordered]@{
-            DisplayName            = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-            DomainName             = $GPOEntry.DomainName    #: area1.local
-            GUID                   = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-            GpoType                = $GPOEntry.GpoType       #: Computer
-            GpoCategory            = $GPOEntry.GpoCategory   #: SecuritySettings
-            GpoSettings            = $GPOEntry.GpoSettings   #: SecurityOptions
-            KeyName                = $GPOEntry.KeyName
-            KeyDisplayName         = $GPOEntry.Display.Name
-            KeyDisplayUnits        = $GPOEntry.Display.Units
-            KeyDisplayBoolean      = try { [bool]::Parse($GPOEntry.Display.DisplayBoolean) } catch { $null };
-            KeyDisplayString       = $GPOEntry.Display.DisplayString
-            SystemAccessPolicyName = $GPOEntry.SystemAccessPolicyName
-            SettingString          = $GPOEntry.SettingString
-            SettingNumber          = $GPOEntry.SettingNumber
-        }
-        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-        [PSCustomObject] $CreateGPO
-    }
-}

Private/ConvertTo-SoftwareInstallation.ps1

@@ -1,42 +0,0 @@
-function ConvertTo-SoftwareInstallation {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-        $CreateGPO = [ordered]@{
-            DisplayName         = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-            DomainName          = $GPOEntry.DomainName    #: area1.local
-            GUID                = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-            GpoType             = $GPOEntry.GpoType       #: Computer
-            GpoCategory         = $GPOEntry.GpoCategory   #: SecuritySettings
-            GpoSettings         = $GPOEntry.GpoSettings   #: SecurityOptions
-            Identifier          = $GPOEntry.Identifier          #: { 10495e9e-79c1-4a32-b278-a24cd495437f }
-            Name                = $GPOEntry.Name                #: Local Administrator Password Solution (2)
-            Path                = $GPOEntry.Path                #: \\area1.local\SYSVOL\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\LAPS.x64.msi
-            MajorVersion        = $GPOEntry.MajorVersion        #: 6
-            MinorVersion        = $GPOEntry.MinorVersion        #: 2
-            LanguageId          = $GPOEntry.LanguageId          #: 1033
-            Architecture        = $GPOEntry.Architecture        #: 9
-            IgnoreLanguage      = if ($GPOEntry.IgnoreLanguage -eq 'true') { $true } else { $false }      #: false
-            Allowx86Onia64      = if ($GPOEntry.Allowx86Onia64 -eq 'true') { $true } else { $false }       #: true
-            SupportURL          = $GPOEntry.SupportURL          #:
-            AutoInstall         = if ($GPOEntry.AutoInstall -eq 'true') { $true } else { $false }          #: true
-            DisplayInARP        = if ($GPOEntry.DisplayInARP -eq 'true') { $true } else { $false }        #: true
-            IncludeCOM          = if ($GPOEntry.IncludeCOM -eq 'true') { $true } else { $false }          #: true
-            SecurityDescriptor  = $GPOEntry.SecurityDescriptor  #: SecurityDescriptor
-            DeploymentType      = $GPOEntry.DeploymentType      #: Assign
-            ProductId           = $GPOEntry.ProductId           #: { ea8cb806-c109 - 4700 - 96b4-f1f268e5036c }
-            ScriptPath          = $GPOEntry.ScriptPath          #: \\area1.local\SysVol\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\Machine\Applications\ { EAC9B821-FB4D - 457A-806F-E5B528D1E41A }.aas
-            DeploymentCount     = $GPOEntry.DeploymentCount     #: 0
-            InstallationUILevel = $GPOEntry.InstallationUILevel #: Maximum
-            Upgrades            = if ($GPOEntry.Upgrades.Mandatory -eq 'true') { $true } else { $false }            #: Upgrades
-            UninstallUnmanaged  = if ($GPOEntry.UninstallUnmanaged -eq 'true') { $true } else { $false }   #: false
-            LossOfScopeAction   = $GPOEntry.LossOfScopeAction   #: Unmanage
-        }
-        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-        [PSCustomObject] $CreateGPO
-    }
-}

Private/ConvertTo-SystemServices.ps1

@@ -1,25 +0,0 @@
-function ConvertTo-SystemServices {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-        $CreateGPO = [ordered]@{
-            DisplayName                = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-            DomainName                 = $GPOEntry.DomainName    #: area1.local
-            GUID                       = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-            GpoType                    = $GPOEntry.GpoType       #: Computer
-            GpoCategory                = $GPOEntry.GpoCategory   #: SecuritySettings
-            GpoSettings                = $GPOEntry.GpoSettings   #: SecurityOptions
-            ServiceName                = $GPOEntry.Name
-            ServiceStartUpMode         = $GPOEntry.StartUpMode
-            SecurityAuditingPresent    = try { [bool]::Parse($GPOEntry.SecurityDescriptor.AuditingPresent.'#text') } catch { $null };
-            SecurityPermissionsPresent = try { [bool]::Parse($GPOEntry.SecurityDescriptor.PermissionsPresent.'#text') } catch { $null };
-            SecurityDescriptor         = $GPOEntry.SecurityDescriptor
-        }
-        $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-        $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-        [PSCustomObject] $CreateGPO
-    }
-}

Private/ConvertTo-SystemServicesNT.ps1

@@ -1,36 +0,0 @@
-function ConvertTo-SystemServicesNT {
-    [cmdletBinding()]
-    param(
-        [Array] $GPOList
-    )
-    foreach ($GPOEntry in $GPOList) {
-        foreach ($Service in $GPOEntry.NTService) {
-            $CreateGPO = [ordered]@{
-                DisplayName          = $GPOEntry.DisplayName   #: WO_SEC_NTLM_Auth_Level
-                DomainName           = $GPOEntry.DomainName    #: area1.local
-                GUID                 = $GPOEntry.GUID          #: 364B095E-C7BF-4CC1-9BFA-393BD38975E5
-                GpoType              = $GPOEntry.GpoType       #: Computer
-                GpoCategory          = $GPOEntry.GpoCategory   #: SecuritySettings
-                GpoSettings          = $GPOEntry.GpoSettings   #: SecurityOptions
-                Changed              = [DateTime] $Service.Changed
-                GPOSettingOrder      = $Service.GPOSettingOrder
-                #ServiceName          = $Service.Name
-                ServiceName          = $Service.Properties.serviceName          #: AppIDSvc: AppIDSvc
-                ServiceStartupType   = $Service.Properties.startupType          #: NOCHANGE: NOCHANGE
-                ServiceAction        = $Service.Properties.serviceAction        #: START: START
-                Timeout              = $Service.Properties.timeout              #: 50: 50
-                FirstFailure         = $Service.Properties.firstFailure         #: REBOOT: REBOOT
-                SecondFailure        = $Service.Properties.secondFailure        #: REBOOT: REBOOT
-                ThirdFailure         = $Service.Properties.thirdFailure         #: REBOOT: REBOOT
-                ResetFailCountDelay  = $Service.Properties.resetFailCountDelay  #: 0: 0
-                RestartComputerDelay = $Service.Properties.restartComputerDelay #: 60000: 60000
-                Filter               = $Service.Filter
-
-            }
-            $CreateGPO['Linked'] = $GPOEntry.Linked        #: True
-            $CreateGPO['LinksCount'] = $GPOEntry.LinksCount    #: 1
-            $CreateGPO['Links'] = $GPOEntry.Links         #: area1.local
-            [PSCustomObject] $CreateGPO
-        }
-    }
-}

Private/ConvertTo-XMLAccountPolicy.ps1

@@ -0,0 +1,95 @@
+function ConvertTo-XMLAccountPolicy {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = @(
+            $Settings = [ordered]@{
+                DisplayName           = $GPO.DisplayName
+                DomainName            = $GPO.DomainName
+                GUID                  = $GPO.GUID
+                GpoType               = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                ClearTextPassword     = 'Not Set'
+                LockoutBadCount       = 'Not Set'
+                LockoutDuration       = 'Not Set'
+                MaximumPasswordAge    = 'Not Set'
+                MinimumPasswordAge    = 'Not Set'
+                MinimumPasswordLength = 'Not Set'
+                PasswordComplexity    = 'Not Set'
+                PasswordHistorySize   = 'Not Set'
+                ResetLockoutCount     = 'Not Set'
+                MaxClockSkew          = 'Not Set'
+                MaxRenewAge           = 'Not Set'
+                MaxServiceAge         = 'Not Set'
+                MaxTicketAge          = 'Not Set'
+                TicketValidateClient  = 'Not Set'
+            }
+            foreach ($GPOEntry in $GPO.DataSet) {
+                if ($GPOEntry.SettingBoolean) {
+                    $Settings[$($GPOEntry.Name)] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { 'Not set' };
+                } elseif ($GPOEntry.SettingNumber) {
+                    $Settings[$($GPOEntry.Name)] = [int] $GPOEntry.SettingNumber
+                }
+            }
+            [PSCustomObject] $Settings
+        )
+
+
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+
+
+
+        $CreateGPO = [ordered]@{
+            DisplayName           = $GPO.DisplayName
+            DomainName            = $GPO.DomainName
+            GUID                  = $GPO.GUID
+            GpoType               = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            ClearTextPassword     = 'Not Set'
+            LockoutBadCount       = 'Not Set'
+            LockoutDuration       = 'Not Set'
+            MaximumPasswordAge    = 'Not Set'
+            MinimumPasswordAge    = 'Not Set'
+            MinimumPasswordLength = 'Not Set'
+            PasswordComplexity    = 'Not Set'
+            PasswordHistorySize   = 'Not Set'
+            ResetLockoutCount     = 'Not Set'
+            MaxClockSkew          = 'Not Set'
+            MaxRenewAge           = 'Not Set'
+            MaxServiceAge         = 'Not Set'
+            MaxTicketAge          = 'Not Set'
+            TicketValidateClient  = 'Not Set'
+        }
+        foreach ($GPOEntry in $GPO.DataSet) {
+            if ($GPOEntry.SettingBoolean) {
+                $CreateGPO[$($GPOEntry.Name)] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { 'Not set' };
+            } elseif ($GPOEntry.SettingNumber) {
+                $CreateGPO[$($GPOEntry.Name)] = [int] $GPOEntry.SettingNumber
+            }
+        }
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-XMLAudit.ps1

@@ -0,0 +1,231 @@
+function ConvertTo-XMLAudit {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    $SettingType = @{
+        '0' = 'No Auditing'
+        '1' = 'Success'
+        '2' = 'Failure'
+        '3' = 'Success, Failure'
+    }
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = @(
+            $Settings = [ordered]@{
+                AuditAccountLogon                        = 'Not configured'
+                AuditAccountManage                       = 'Not configured'
+                AuditDSAccess                            = 'Not configured'
+                AuditLogonEvents                         = 'Not configured'
+                AuditObjectAccess                        = 'Not configured'
+                AuditPolicyChange                        = 'Not configured'
+                AuditPrivilegeUse                        = 'Not configured'
+                AuditProcessTracking                     = 'Not configured'
+                AuditSystemEvents                        = 'Not configured'
+                # Advanced Policies
+                AuditAccountLockout                      = 'Not configured'
+                AuditApplicationGenerated                = 'Not configured'
+                AuditApplicationGroupManagement          = 'Not configured'
+                AuditAuditPolicyChange                   = 'Not configured'
+                AuditAuthenticationPolicyChange          = 'Not configured'
+                AuditAuthorizationPolicyChange           = 'Not configured'
+                AuditCentralAccessPolicyStaging          = 'Not configured'
+                AuditCertificationServices               = 'Not configured'
+                AuditComputerAccountManagement           = 'Not configured'
+                AuditCredentialValidation                = 'Not configured'
+                AuditDetailedDirectoryServiceReplication = 'Not configured'
+                AuditDetailedFileShare                   = 'Not configured'
+                AuditDirectoryServiceAccess              = 'Not configured'
+                AuditDirectoryServiceChanges             = 'Not configured'
+                AuditDirectoryServiceReplication         = 'Not configured'
+                AuditDistributionGroupManagement         = 'Not configured'
+                AuditDPAPIActivity                       = 'Not configured'
+                AuditFileShare                           = 'Not configured'
+                AuditFileSystem                          = 'Not configured'
+                AuditFilteringPlatformConnection         = 'Not configured'
+                AuditFilteringPlatformPacketDrop         = 'Not configured'
+                AuditFilteringPlatformPolicyChange       = 'Not configured'
+                AuditGroupMembership                     = 'Not configured'
+                AuditHandleManipulation                  = 'Not configured'
+                AuditIPsecDriver                         = 'Not configured'
+                AuditIPsecExtendedMode                   = 'Not configured'
+                AuditIPsecMainMode                       = 'Not configured'
+                AuditIPsecQuickMode                      = 'Not configured'
+                AuditKerberosAuthenticationService       = 'Not configured'
+                AuditKerberosServiceTicketOperations     = 'Not configured'
+                AuditKernelObject                        = 'Not configured'
+                AuditLogoff                              = 'Not configured'
+                AuditLogon                               = 'Not configured'
+                AuditMPSSVCRuleLevelPolicyChange         = 'Not configured'
+                AuditNetworkPolicyServer                 = 'Not configured'
+                AuditNonSensitivePrivilegeUse            = 'Not configured'
+                AuditOtherAccountLogonEvents             = 'Not configured'
+                AuditOtherAccountManagementEvents        = 'Not configured'
+                AuditOtherLogonLogoffEvents              = 'Not configured'
+                AuditOtherObjectAccessEvents             = 'Not configured'
+                AuditOtherPolicyChangeEvents             = 'Not configured'
+                AuditOtherPrivilegeUseEvents             = 'Not configured'
+                AuditOtherSystemEvents                   = 'Not configured'
+                AuditPNPActivity                         = 'Not configured'
+                AuditProcessCreation                     = 'Not configured'
+                AuditProcessTermination                  = 'Not configured'
+                AuditRegistry                            = 'Not configured'
+                AuditRemovableStorage                    = 'Not configured'
+                AuditRPCEvents                           = 'Not configured'
+                AuditSAM                                 = 'Not configured'
+                AuditSecurityGroupManagement             = 'Not configured'
+                AuditSecurityStateChange                 = 'Not configured'
+                AuditSecuritySystemExtension             = 'Not configured'
+                AuditSensitivePrivilegeUse               = 'Not configured'
+                AuditSpecialLogon                        = 'Not configured'
+                AuditSystemIntegrity                     = 'Not configured'
+                AuditUserDeviceClaims                    = 'Not configured'
+                AuditUserAccountManagement               = 'Not configured'
+            }
+            foreach ($GPOEntry in $GPO.DataSet) {
+                if ($GPOEntry.PolicyTarget) {
+                    # Category = 'AuditSettings', Settings = 'AuditSetting'
+                    $Category = $GPOEntry.SubcategoryName -replace ' ', '' -replace '-', '' -replace '/', ''
+                    if ($Settings["$($Category)"]) {
+                        $Settings["$($Category)"] = $SettingType["$($GPOEntry.SettingValue)"]
+                    }
+                } else {
+                    # Category = 'SecuritySettings', Settings = 'Audit'
+                    $SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null };
+                    $FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null };
+                    if ($SuccessAttempts -and $FailureAttempts) {
+                        $Setting = 'Success, Failure'
+                    } elseif ($SuccessAttempts) {
+                        $Setting = 'Success'
+                    } elseif ($FailureAttempts) {
+                        $Setting = 'Failure'
+                    } else {
+                        $Setting = 'Not configured'
+                    }
+                    $Settings["$($GPOEntry.Name)"] = $Setting
+                }
+            }
+            [PSCustomObject] $Settings
+        )
+
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        $CreateGPO = [ordered]@{
+            DisplayName                              = $GPO.DisplayName
+            DomainName                               = $GPO.DomainName
+            GUID                                     = $GPO.GUID
+            GpoType                                  = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            AuditAccountLogon                        = 'Not configured'
+            AuditAccountManage                       = 'Not configured'
+            AuditDSAccess                            = 'Not configured'
+            AuditLogonEvents                         = 'Not configured'
+            AuditObjectAccess                        = 'Not configured'
+            AuditPolicyChange                        = 'Not configured'
+            AuditPrivilegeUse                        = 'Not configured'
+            AuditProcessTracking                     = 'Not configured'
+            AuditSystemEvents                        = 'Not configured'
+            # Advanced Policies
+            AuditAccountLockout                      = 'Not configured'
+            AuditApplicationGenerated                = 'Not configured'
+            AuditApplicationGroupManagement          = 'Not configured'
+            AuditAuditPolicyChange                   = 'Not configured'
+            AuditAuthenticationPolicyChange          = 'Not configured'
+            AuditAuthorizationPolicyChange           = 'Not configured'
+            AuditCentralAccessPolicyStaging          = 'Not configured'
+            AuditCertificationServices               = 'Not configured'
+            AuditComputerAccountManagement           = 'Not configured'
+            AuditCredentialValidation                = 'Not configured'
+            AuditDetailedDirectoryServiceReplication = 'Not configured'
+            AuditDetailedFileShare                   = 'Not configured'
+            AuditDirectoryServiceAccess              = 'Not configured'
+            AuditDirectoryServiceChanges             = 'Not configured'
+            AuditDirectoryServiceReplication         = 'Not configured'
+            AuditDistributionGroupManagement         = 'Not configured'
+            AuditDPAPIActivity                       = 'Not configured'
+            AuditFileShare                           = 'Not configured'
+            AuditFileSystem                          = 'Not configured'
+            AuditFilteringPlatformConnection         = 'Not configured'
+            AuditFilteringPlatformPacketDrop         = 'Not configured'
+            AuditFilteringPlatformPolicyChange       = 'Not configured'
+            AuditGroupMembership                     = 'Not configured'
+            AuditHandleManipulation                  = 'Not configured'
+            AuditIPsecDriver                         = 'Not configured'
+            AuditIPsecExtendedMode                   = 'Not configured'
+            AuditIPsecMainMode                       = 'Not configured'
+            AuditIPsecQuickMode                      = 'Not configured'
+            AuditKerberosAuthenticationService       = 'Not configured'
+            AuditKerberosServiceTicketOperations     = 'Not configured'
+            AuditKernelObject                        = 'Not configured'
+            AuditLogoff                              = 'Not configured'
+            AuditLogon                               = 'Not configured'
+            AuditMPSSVCRuleLevelPolicyChange         = 'Not configured'
+            AuditNetworkPolicyServer                 = 'Not configured'
+            AuditNonSensitivePrivilegeUse            = 'Not configured'
+            AuditOtherAccountLogonEvents             = 'Not configured'
+            AuditOtherAccountManagementEvents        = 'Not configured'
+            AuditOtherLogonLogoffEvents              = 'Not configured'
+            AuditOtherObjectAccessEvents             = 'Not configured'
+            AuditOtherPolicyChangeEvents             = 'Not configured'
+            AuditOtherPrivilegeUseEvents             = 'Not configured'
+            AuditOtherSystemEvents                   = 'Not configured'
+            AuditPNPActivity                         = 'Not configured'
+            AuditProcessCreation                     = 'Not configured'
+            AuditProcessTermination                  = 'Not configured'
+            AuditRegistry                            = 'Not configured'
+            AuditRemovableStorage                    = 'Not configured'
+            AuditRPCEvents                           = 'Not configured'
+            AuditSAM                                 = 'Not configured'
+            AuditSecurityGroupManagement             = 'Not configured'
+            AuditSecurityStateChange                 = 'Not configured'
+            AuditSecuritySystemExtension             = 'Not configured'
+            AuditSensitivePrivilegeUse               = 'Not configured'
+            AuditSpecialLogon                        = 'Not configured'
+            AuditSystemIntegrity                     = 'Not configured'
+            AuditUserDeviceClaims                    = 'Not configured'
+            AuditUserAccountManagement               = 'Not configured'
+        }
+        foreach ($GPOEntry in $GPO.DataSet) {
+            if ($GPOEntry.PolicyTarget) {
+                # Category = 'AuditSettings', Settings = 'AuditSetting'
+                $Category = $GPOEntry.SubcategoryName -replace ' ', '' -replace '-', '' -replace '/', ''
+                if ($CreateGPO["$($Category)"]) {
+                    $CreateGPO["$($Category)"] = $SettingType["$($GPOEntry.SettingValue)"]
+                }
+            } else {
+                # Category = 'SecuritySettings', Settings = 'Audit'
+                $SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null };
+                $FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null };
+                if ($SuccessAttempts -and $FailureAttempts) {
+                    $Setting = 'Success, Failure'
+                } elseif ($SuccessAttempts) {
+                    $Setting = 'Success'
+                } elseif ($FailureAttempts) {
+                    $Setting = 'Failure'
+                } else {
+                    $Setting = 'Not configured'
+                }
+                $CreateGPO["$($GPOEntry.Name)"] = $Setting
+            }
+        }
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-XMLDriveMapSettings.ps1

@@ -0,0 +1,75 @@
+function ConvertTo-XMLDriveMapSettings {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Entry in $GPO.DataSet.Drive) {
+            [PSCustomObject] @{
+                Changed         = [DateTime] $Entry.changed
+                #uid             = $Entry.uid
+                GPOSettingOrder = $Entry.GPOSettingOrder
+                Filter          = $Entry.Filter
+
+                Name            = $Entry.Name
+                Status          = $Entry.status
+                Action          = $Script:Actions["$($Entry.Properties.action)"]
+                ThisDrive       = $Entry.Properties.thisDrive
+                AllDrives       = $Entry.Properties.allDrives
+                UserName        = $Entry.Properties.userName
+                Path            = $Entry.Properties.path
+                Label           = $Entry.Properties.label
+                Persistent      = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
+                UseLetter       = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
+                Letter          = $Entry.Properties.letter
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Entry in $GPO.DataSet.Drive) {
+            $CreateGPO = [ordered]@{
+                DisplayName     = $GPO.DisplayName
+                DomainName      = $GPO.DomainName
+                GUID            = $GPO.GUID
+                GpoType         = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                Changed         = [DateTime] $Entry.changed
+                #uid             = $Entry.uid
+                GPOSettingOrder = $Entry.GPOSettingOrder
+                Filter          = $Entry.Filter
+
+                Name            = $Entry.Name
+                Status          = $Entry.status
+                Action          = $Script:Actions["$($Entry.Properties.action)"]
+                ThisDrive       = $Entry.Properties.thisDrive
+                AllDrives       = $Entry.Properties.allDrives
+                UserName        = $Entry.Properties.userName
+                Path            = $Entry.Properties.path
+                Label           = $Entry.Properties.label
+                Persistent      = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
+                UseLetter       = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
+                Letter          = $Entry.Properties.letter
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLEventLog.ps1

@@ -0,0 +1,51 @@
+function ConvertTo-XMLEventLog {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO
+    )
+    $RetionPeriod = @{
+        '0' = 'Overwrite events as needed'
+        '1' = 'Overwrite events by days'
+        '2' = 'Do not overwrite events (Clear logs manually)'
+    }
+    $CreateGPO = [ordered]@{
+        DisplayName                        = $GPO.DisplayName
+        DomainName                         = $GPO.DomainName
+        GUID                               = $GPO.GUID
+        GpoType                            = $GPO.GpoType
+        #GpoCategory = $GPOEntry.GpoCategory
+        #GpoSettings = $GPOEntry.GpoSettings
+        ApplicationAuditLogRetentionPeriod = $null
+        ApplicationMaximumLogSize          = $null
+        ApplicationRestrictGuestAccess     = $null
+        ApplicationRetentionDays           = $null
+        SystemAuditLogRetentionPeriod      = $null
+        SystemMaximumLogSize               = $null
+        SystemRestrictGuestAccess          = $null
+        SystemRetentionDays                = $null
+        SecurityAuditLogRetentionPeriod    = $null
+        SecurityMaximumLogSize             = $null
+        SecurityRestrictGuestAccess        = $null
+        SecurityRetentionDays              = $null
+    }
+    foreach ($GPOEntry in $GPO.DataSet) {
+        if ($GPOEntry.SettingBoolean) {
+            $CreateGPO["$($GPOEntry.Log)$($GPOEntry.Name)"] = if ($GPOEntry.SettingBoolean -eq 'true') { 'Enabled' } elseif ($GPOEntry.SettingBoolean -eq 'false') { 'Disabled' } else { 'Not set' };
+        } elseif ($GPOEntry.SettingNumber) {
+            if ($GPOEntry.Name -eq 'AuditLogRetentionPeriod') {
+                if ($GPOEntry.SettingNumber) {
+                    $CreateGPO["$($GPOEntry.Log)$($GPOEntry.Name)"] = $RetionPeriod[$($GPOEntry.SettingNumber)]
+                } else {
+                    # Won't happen?
+                    $CreateGPO["$($GPOEntry.Log)$($GPOEntry.Name)"] = $GPOEntry.SettingNumber
+                }
+            } else {
+                $CreateGPO["$($GPOEntry.Log)$($GPOEntry.Name)"] = $GPOEntry.SettingNumber
+            }
+        }
+    }
+    $CreateGPO['Linked'] = $GPO.Linked
+    $CreateGPO['LinksCount'] = $GPO.LinksCount
+    $CreateGPO['Links'] = $GPO.Links
+    [PSCustomObject] $CreateGPO
+}

Private/ConvertTo-XMLGenericPolicy.ps1

@@ -0,0 +1,179 @@
+function ConvertTo-XMLGenericPolicy {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [string[]] $Category,
+        [switch] $SingleObject
+    )
+    $UsedNames = [System.Collections.Generic.List[string]]::new()
+    [Array] $Policies = foreach ($Cat in $Category) {
+        $GPO.DataSet | Where-Object { $_.Category -like $Cat }
+    }
+    if ($Policies.Count -gt 0) {
+        if ($SingleObject) {
+            $CreateGPO = [ordered]@{
+                DisplayName = $GPO.DisplayName
+                DomainName  = $GPO.DomainName
+                GUID        = $GPO.GUID
+                GpoType     = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                Count       = 0
+                Settings    = $null
+            }
+
+            [Array] $CreateGPO['Settings'] = @(
+                $Settings = [ordered] @{}
+                foreach ($Policy in $Policies) {
+                    #if ($Policy.Category -notlike $Category) {
+                    # We check again for Category because one GPO can have multiple categories
+                    # First check checks GPO globally,
+                    #    continue
+                    #}
+
+                    $Name = Format-ToTitleCase -Text $Policy.Name -RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'
+                    $Settings[$Name] = $Policy.State
+
+                    foreach ($Setting in @('DropDownList', 'Numeric', 'EditText', 'Text', 'CheckBox', 'ListBox')) {
+                        if ($Policy.$Setting) {
+                            foreach ($Value in $Policy.$Setting) {
+                                if ($Value.Name) {
+                                    $SubName = Format-ToTitleCase -Text $Value.Name -RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'
+                                    $SubName = -join ($Name, $SubName)
+                                    if ($SubName -notin $UsedNames) {
+                                        $UsedNames.Add($SubName)
+                                    } else {
+                                        $TimesUsed = $UsedNames | Group-Object | Where-Object { $_.Name -eq $SubName }
+                                        $NumberToUse = $TimesUsed.Count + 1
+                                        # We add same name 2nd and 3rd time to make sure we count properly
+                                        $UsedNames.Add($SubName)
+                                        # We now build property name based on amnount of times
+                                        $SubName = -join ($SubName, "$NumberToUse")
+                                    }
+                                    if ($Value.Value -is [string]) {
+                                        $Settings["$SubName"] = $Value.Value
+                                    } elseif ($Value.Value -is [System.Xml.XmlElement]) {
+
+                                        <#
+                            if ($null -eq $Value.Value.Name) {
+                                # Shouldn't happen but lets see
+                                Write-Verbose $Value
+                            } else {
+                                $CreateGPO["$SubName"] = $Value.Value.Name
+                            }
+
+                            #>
+                                        if ($Value.Value.Element) {
+                                            $Settings["$SubName"] = $Value.Value.Element.Data -join '; '
+                                        } elseif ($null -eq $Value.Value.Name) {
+                                            # Shouldn't happen but lets see
+                                            Write-Verbose "Tracking $Value"
+                                        } else {
+                                            $Settings["$SubName"] = $Value.Value.Name
+                                        }
+
+                                    } elseif ($Value.State) {
+                                        $Settings["$SubName"] = $Value.State
+                                    } elseif ($null -eq $Value.Value) {
+                                        # This is most likely Setting 'Text
+                                        # Do nothing, usually it's just a text to display
+                                        #Write-Verbose "Skipping value for display because it's empty. Name: $($Value.Name)"
+                                    } else {
+                                        # shouldn't happen
+                                        Write-Verbose $Value
+                                    }
+                                }
+                            }
+                        }
+                    }
+
+
+                }
+                [PSCustomObject] $Settings
+            )
+
+            $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        } else {
+
+            $CreateGPO = [ordered]@{
+                DisplayName = $GPO.DisplayName
+                DomainName  = $GPO.DomainName
+                GUID        = $GPO.GUID
+                GpoType     = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+            }
+            foreach ($Policy in $Policies) {
+                #if ($Policy.Category -notlike $Category) {
+                # We check again for Category because one GPO can have multiple categories
+                # First check checks GPO globally,
+                #    continue
+                #}
+                $Name = Format-ToTitleCase -Text $Policy.Name -RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'
+                $CreateGPO[$Name] = $Policy.State
+
+                foreach ($Setting in @('DropDownList', 'Numeric', 'EditText', 'Text', 'CheckBox', 'ListBox')) {
+                    if ($Policy.$Setting) {
+                        foreach ($Value in $Policy.$Setting) {
+                            if ($Value.Name) {
+                                $SubName = Format-ToTitleCase -Text $Value.Name -RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'
+                                $SubName = -join ($Name, $SubName)
+                                if ($SubName -notin $UsedNames) {
+                                    $UsedNames.Add($SubName)
+                                } else {
+                                    $TimesUsed = $UsedNames | Group-Object | Where-Object { $_.Name -eq $SubName }
+                                    $NumberToUse = $TimesUsed.Count + 1
+                                    # We add same name 2nd and 3rd time to make sure we count properly
+                                    $UsedNames.Add($SubName)
+                                    # We now build property name based on amnount of times
+                                    $SubName = -join ($SubName, "$NumberToUse")
+                                }
+                                if ($Value.Value -is [string]) {
+                                    $CreateGPO["$SubName"] = $Value.Value
+                                } elseif ($Value.Value -is [System.Xml.XmlElement]) {
+
+                                    <#
+                                if ($null -eq $Value.Value.Name) {
+                                    # Shouldn't happen but lets see
+                                    Write-Verbose $Value
+                                } else {
+                                    $CreateGPO["$SubName"] = $Value.Value.Name
+                                }
+
+                                #>
+                                    if ($Value.Value.Element) {
+                                        $CreateGPO["$SubName"] = $Value.Value.Element.Data -join '; '
+                                    } elseif ($null -eq $Value.Value.Name) {
+                                        # Shouldn't happen but lets see
+                                        Write-Verbose "Tracking $Value"
+                                    } else {
+                                        $CreateGPO["$SubName"] = $Value.Value.Name
+                                    }
+
+                                } elseif ($Value.State) {
+                                    $CreateGPO["$SubName"] = $Value.State
+                                } elseif ($null -eq $Value.Value) {
+                                    # This is most likely Setting 'Text
+                                    # Do nothing, usually it's just a text to display
+                                    #Write-Verbose "Skipping value for display because it's empty. Name: $($Value.Name)"
+                                } else {
+                                    # shouldn't happen
+                                    Write-Verbose $Value
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+            #}
+        }
+    }
+}

Private/ConvertTo-XMLGenericPublicKey.ps1

@@ -0,0 +1,106 @@
+function ConvertTo-XMLGenericPublicKey {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [string[]] $Category,
+        [switch] $SingleObject
+    )
+    $SkipNames = ('Name', 'LocalName', 'NamespaceURI', 'Prefix', 'NodeType', 'ParentNode', 'OwnerDocument', 'IsEmpty', 'Attributes', 'HasAttributes', 'SchemaInfo', 'InnerXml', 'InnerText', 'NextSibling', 'PreviousSibling', 'ChildNodes', 'FirstChild', 'LastChild', 'HasChildNodes', 'IsReadOnly', 'OuterXml', 'BaseURI', 'PreviousText')
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Setting in $GPO.DataSet) {
+            $SettingName = $Setting.Name -split ":"
+            $MySettings = [ordered] @{
+                CreatedTime         = $GPO.CreatedTime         # : 06.06.2020 18:03:36
+                ModifiedTime        = $GPO.ModifiedTime        # : 17.06.2020 16:08:10
+                ReadTime            = $GPO.ReadTime            # : 13.08.2020 10:15:37
+                SecurityDescriptor  = $GPO.SecurityDescriptor  # : SecurityDescriptor
+                FilterDataAvailable = $GPO.FilterDataAvailable # : True
+            }
+            $Name = $SettingName[1]
+            #$Name = Format-ToTitleCase -Text $Setting.Name -RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'
+            $MySettings['Name'] = $Name # $Setting.Name
+
+            ConvertTo-XMLNested -CreateGPO $MySettings -Setting $Setting -SkipNames $SkipNames #-Name $Name
+            [PSCustomObject] $MySettings
+        }
+
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Setting in $GPO.DataSet) {
+            $CreateGPO = [ordered]@{
+                DisplayName = $GPO.DisplayName
+                DomainName  = $GPO.DomainName
+                GUID        = $GPO.GUID
+                GpoType     = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+            }
+            $SettingName = $Setting.Name -split ":"
+            $CreateGPO['CreatedTime'] = $GPO.CreatedTime         # : 06.06.2020 18:03:36
+            $CreateGPO['ModifiedTime'] = $GPO.ModifiedTime        # : 17.06.2020 16:08:10
+            $CreateGPO['ReadTime'] = $GPO.ReadTime            # : 13.08.2020 10:15:37
+            $CreateGPO['SecurityDescriptor'] = $GPO.SecurityDescriptor  # : SecurityDescriptor
+            $CreateGPO['FilterDataAvailable'] = $GPO.FilterDataAvailable # : True
+
+            $Name = $SettingName[1]
+            #$Name = Format-ToTitleCase -Text $Setting.Name -RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'
+            $CreateGPO['Name'] = $Name # $Setting.Name
+            #$CreateGPO['GPOSettingOrder'] = $Setting.GPOSettingOrder
+
+            #foreach ($Property in ($Setting.Properties | Get-Member -MemberType Properties).Name) {
+
+            ConvertTo-XMLNested -CreateGPO $CreateGPO -Setting $Setting -SkipNames $SkipNames #-Name $Name
+            <#
+        $Properties = $Setting.PSObject.Properties.Name | Where-Object { $_ -notin $SkipNames }
+        foreach ($Property in $Properties) {
+            If ($Property -eq 'Value') {
+                if ($Setting.$Property) {
+                    #$SubProperties = $Setting.$Property.PSObject.Properties.Name
+                    if ($Setting.$Property.Name) {
+                        $Name = $Setting.$Property.Name
+                    } else {
+                        $Name = 'Value'
+                    }
+                    if ($Setting.$Property.Number) {
+                        $CreateGPO[$Name] = $Setting.$Property.Number
+                    } elseif ($Setting.$Property.String) {
+                        $CreateGPO[$Name] = $Setting.$Property.String
+                    } else {
+                        throw
+                    }
+                }
+            } else {
+                $Name = Format-CamelCaseToDisplayName -Text $Property #-RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'
+                if ($Setting.$Property -is [System.Xml.XmlElement]) {
+                    $SubPropeties = $Setting.$Property.PSObject.Properties.Name | Where-Object { $_ -notin $SkipNames }
+
+
+
+                } else {
+                    $CreateGPO[$Name] = $Setting.$Property
+                }
+            }
+        }
+        #>
+            $CreateGPO['Filters'] = $Setting.Filters
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLGenericSecuritySettings.ps1

@@ -0,0 +1,45 @@
+function ConvertTo-XMLGenericSecuritySettings {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [string[]] $Category
+    )
+    $SkipNames = ('Name', 'LocalName', 'NamespaceURI', 'Prefix', 'NodeType', 'ParentNode', 'OwnerDocument', 'IsEmpty', 'Attributes', 'HasAttributes', 'SchemaInfo', 'InnerXml', 'InnerText', 'NextSibling', 'PreviousSibling', 'Value', 'ChildNodes', 'FirstChild', 'LastChild', 'HasChildNodes', 'IsReadOnly', 'OuterXml', 'BaseURI', 'PreviousText')
+    #$UsedNames = [System.Collections.Generic.List[string]]::new()
+    [Array] $Settings = foreach ($Cat in $Category) {
+        $GPO.DataSet | Where-Object { $null -ne $_.$Cat }
+    }
+
+    if ($Settings.Count -gt 0) {
+        foreach ($Cat in $Category) {
+            foreach ($Setting in $Settings.$Cat) {
+                $CreateGPO = [ordered]@{
+                    DisplayName = $GPO.DisplayName
+                    DomainName  = $GPO.DomainName
+                    GUID        = $GPO.GUID
+                    GpoType     = $GPO.GpoType
+                    #GpoCategory = $GPOEntry.GpoCategory
+                    #GpoSettings = $GPOEntry.GpoSettings
+                }
+                #$Name = Format-ToTitleCase -Text $Setting.Name -RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'
+                $CreateGPO['Name'] = $Setting.Name
+                $CreateGPO['GPOSettingOrder'] = $Setting.GPOSettingOrder
+                #foreach ($Property in ($Setting.Properties | Get-Member -MemberType Properties).Name) {
+
+                $Properties = $Setting.Properties.PSObject.Properties.Name | Where-Object { $_ -notin $SkipNames }
+                foreach ($Property in $Properties) {
+
+                    $Name = Format-CamelCaseToDisplayName -Text $Property #-RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'
+                    $CreateGPO[$Name] = $Setting.Properties.$Property
+                }
+                $CreateGPO['Filters'] = $Setting.Filters
+
+                $CreateGPO['Linked'] = $GPO.Linked
+                $CreateGPO['LinksCount'] = $GPO.LinksCount
+                $CreateGPO['Links'] = $GPO.Links
+                [PSCustomObject] $CreateGPO
+            }
+        }
+    }
+
+}

Private/ConvertTo-XMLLocalGroups.ps1

@@ -0,0 +1,126 @@
+function ConvertTo-XMLLocalGroups {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        if (-not $GPO.DataSet.Group) {
+            continue
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Group in $GPO.DataSet.Group) {
+            # We're mostly interested in Members
+            [Array] $Members = foreach ($Member in $Group.Properties.Members.Member) {
+                [ordered] @{
+                    MemberName   = $Member.Name
+                    MemberAction = $Member.Action
+                    MemberSID    = $Member.SID
+                }
+            }
+            # if we have no members we create dummy object to make sure we can use foreach below
+            if ($Members.Count -eq 0) {
+                $Members = @(
+                    [ordered] @{
+                        MemberName   = $null
+                        MemberAction = $null
+                        MemberSID    = $null
+                    }
+                )
+            }
+            foreach ($Member in $Members) {
+                $GroupObject = [ordered]@{
+                    Changed         = [DateTime] $Group.Changed
+                    GPOSettingOrder = $Group.GPOSettingOrder
+                    Name            = $Group.name
+                    Action          = $Script:Actions["$($Group.Properties.action)"]
+                    GroupName       = $Group.Properties.groupName       #: Administrators (built -in )
+                    NewName         = $Group.Properties.newName         #:
+                    Description     = $Group.Properties.description     #:
+                    DeleteAllUsers  = if ($Group.Properties.deleteAllUsers -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllUsers -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllUsers };
+                    DeleteAllGroups = if ($Group.Properties.deleteAllGroups -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllGroups -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllGroups };
+                    RemoveAccounts  = if ($Group.Properties.removeAccounts -eq '1') { 'Enabled' } elseif ($Group.Properties.removeAccounts -eq '0') { 'Disabled' } else { $Group.Properties.removeAccounts };
+                    GroupSid        = $Group.Properties.groupSid        #: S - 1 - 5 - 32 - 544
+                }
+                $Last = [ordered] @{
+                    #Uid                                   = $Group.uid             #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
+                    RunInLoggedOnUserSecurityContext      = if ($Group.userContext -eq '1') { 'Enabled' } elseif ($Group.userContext -eq '0') { 'Disabled' } else { $Group.userContext };
+                    RemoveThisItemWhenItIsNoLongerApplied = if ($Group.removePolicy -eq '1') { 'Enabled' } elseif ($Group.removePolicy -eq '0') { 'Disabled' } else { $Group.removePolicy };
+                    Filters                               = $Group.Filters         #::
+                }
+                # Merging GPO with Member
+                $GroupObject = $GroupObject + $Member + $Last
+                [PSCustomObject] $GroupObject
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Group in $GPO.DataSet.Group) {
+            # We're mostly interested in Members
+            [Array] $Members = foreach ($Member in $Group.Properties.Members.Member) {
+                [ordered] @{
+                    MemberName   = $Member.Name
+                    MemberAction = $Member.Action
+                    MemberSID    = $Member.SID
+                }
+            }
+            # if we have no members we create dummy object to make sure we can use foreach below
+            if ($Members.Count -eq 0) {
+                $Members = @(
+                    [ordered] @{
+                        MemberName   = $null
+                        MemberAction = $null
+                        MemberSID    = $null
+                    }
+                )
+            }
+            foreach ($Member in $Members) {
+                $CreateGPO = [ordered]@{
+                    DisplayName     = $GPO.DisplayName
+                    DomainName      = $GPO.DomainName
+                    GUID            = $GPO.GUID
+                    GpoType         = $GPO.GpoType
+                    #GpoCategory          = $GPO.GpoCategory   #: SecuritySettings
+                    #GpoSettings          = $GPO.GpoSettings   #: SecurityOptions
+                    Changed         = [DateTime] $Group.Changed
+                    GPOSettingOrder = $Group.GPOSettingOrder
+                    Name            = $Group.name
+                    Action          = $Script:Actions["$($Group.Properties.action)"]
+                    GroupName       = $Group.Properties.groupName       #: Administrators (built -in )
+                    NewName         = $Group.Properties.newName         #:
+                    Description     = $Group.Properties.description     #:
+                    DeleteAllUsers  = if ($Group.Properties.deleteAllUsers -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllUsers -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllUsers };
+                    DeleteAllGroups = if ($Group.Properties.deleteAllGroups -eq '1') { 'Enabled' } elseif ($Group.Properties.deleteAllGroups -eq '0') { 'Disabled' } else { $Group.Properties.deleteAllGroups };
+                    RemoveAccounts  = if ($Group.Properties.removeAccounts -eq '1') { 'Enabled' } elseif ($Group.Properties.removeAccounts -eq '0') { 'Disabled' } else { $Group.Properties.removeAccounts };
+                    GroupSid        = $Group.Properties.groupSid        #: S - 1 - 5 - 32 - 544
+                }
+                $Last = [ordered] @{
+                    # Uid                                   = $Group.uid             #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
+                    RunInLoggedOnUserSecurityContext      = if ($Group.userContext -eq '1') { 'Enabled' } elseif ($Group.userContext -eq '0') { 'Disabled' } else { $Group.userContext };
+                    RemoveThisItemWhenItIsNoLongerApplied = if ($Group.removePolicy -eq '1') { 'Enabled' } elseif ($Group.removePolicy -eq '0') { 'Disabled' } else { $Group.removePolicy };
+                    Filters                               = $Group.Filters         #::
+                }
+                # Merging GPO with Member
+                $CreateGPO = $CreateGPO + $Member + $Last
+                $CreateGPO['Linked'] = $GPO.Linked
+                $CreateGPO['LinksCount'] = $GPO.LinksCount
+                $CreateGPO['Links'] = $GPO.Links
+                [PSCustomObject] $CreateGPO
+            }
+        }
+    }
+}

Private/ConvertTo-XMLLocalUser.ps1

@@ -0,0 +1,74 @@
+function ConvertTo-XMLLocalUser {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        if (-not $GPO.DataSet.User) {
+            continue
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($User in $GPO.DataSet.User) {
+            [PSCustomObject] @{
+                Changed                       = [DateTime] $User.Changed
+                GPOSettingOrder               = $User.GPOSettingOrder
+                Action                        = $Script:Actions["$($User.Properties.action)"]
+                UserName                      = $User.Properties.userName
+                NewName                       = $User.Properties.newName
+                FullName                      = $User.Properties.fullName
+                Description                   = $User.Properties.description
+                Password                      = $User.Properties.cpassword
+                MustChangePasswordAtNextLogon = if ($User.Properties.changeLogon -eq '1') { $true } elseif ($User.Properties.changeLogon -eq '0') { $false } else { $User.Properties.changeLogon };
+                CannotChangePassword          = if ($User.Properties.noChange -eq '1') { $true } elseif ($User.Properties.noChange -eq '0') { $false } else { $User.Properties.noChange };
+                PasswordNeverExpires          = if ($User.Properties.neverExpires -eq '1') { $true } elseif ($User.Properties.neverExpires -eq '0') { $false } else { $User.Properties.neverExpires };
+                AccountIsDisabled             = if ($User.Properties.acctDisabled -eq '1') { $true } elseif ($User.Properties.acctDisabled -eq '0') { $false } else { $User.Properties.acctDisabled };
+                AccountExpires                = try { [DateTime] $User.Properties.expires } catch { $User.Properties.expires };
+                SubAuthority                  = $User.Properties.subAuthority
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($User in $GPO.DataSet.User) {
+            $CreateGPO = [ordered]@{
+                DisplayName                   = $GPO.DisplayName
+                DomainName                    = $GPO.DomainName
+                GUID                          = $GPO.GUID
+                GpoType                       = $GPO.GpoType
+                #GpoCategory      = $GPO.GpoCategory   #: SecuritySettings
+                #GpoSettings      = $GPO.GpoSettings   #: SecurityOptions
+                Changed                       = [DateTime] $User.Changed
+                GPOSettingOrder               = $User.GPOSettingOrder
+                Action                        = $Script:Actions["$($User.Properties.action)"]
+                UserName                      = $User.Properties.userName
+                NewName                       = $User.Properties.newName
+                FullName                      = $User.Properties.fullName
+                Description                   = $User.Properties.description
+                Password                      = $User.Properties.cpassword
+                MustChangePasswordAtNextLogon = if ($User.Properties.changeLogon -eq '1') { $true } elseif ($User.Properties.changeLogon -eq '0') { $false } else { $User.Properties.changeLogon };
+                CannotChangePassword          = if ($User.Properties.noChange -eq '1') { $true } elseif ($User.Properties.noChange -eq '0') { $false } else { $User.Properties.noChange };
+                PasswordNeverExpires          = if ($User.Properties.neverExpires -eq '1') { $true } elseif ($User.Properties.neverExpires -eq '0') { $false } else { $User.Properties.neverExpires };
+                AccountIsDisabled             = if ($User.Properties.acctDisabled -eq '1') { $true } elseif ($User.Properties.acctDisabled -eq '0') { $false } else { $User.Properties.acctDisabled };
+                AccountExpires                = try { [DateTime] $User.Properties.expires } catch { $User.Properties.expires };
+                SubAuthority                  = $User.Properties.subAuthority
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLNested.ps1

@@ -0,0 +1,49 @@
+function ConvertTo-XMLNested {
+    [cmdletBinding()]
+    param(
+        [System.Collections.IDictionary] $CreateGPO,
+        [System.Xml.XmlElement] $Setting,
+        [string[]] $SkipNames,
+        [string] $Name
+    )
+
+    $Properties = $Setting.PSObject.Properties.Name | Where-Object { $_ -notin $SkipNames }
+    $TempName = $Name
+    foreach ($Property in $Properties) {
+        If ($Property -eq 'Value') {
+            if ($Setting.$Property) {
+                #$SubProperties = $Setting.$Property.PSObject.Properties.Name
+                if ($Setting.$Property.Name) {
+                    $Name = $Setting.$Property.Name
+                } else {
+                    if (-not $Name) {
+                        $Name = 'Value'
+                    }
+                }
+                if ($Setting.$Property.Number) {
+                    $CreateGPO[$Name] = $Setting.$Property.Number
+                } elseif ($Setting.$Property.String) {
+                    $CreateGPO[$Name] = $Setting.$Property.String
+                } else {
+                    $CreateGPO[$Name] = $Setting.$Property
+
+                    #throw
+                }
+            }
+        } else {
+            $Name = -join ($Name, $Property)
+            $Name = Format-CamelCaseToDisplayName -Text $Name #-RemoveWhiteSpace -RemoveChar ',', '-', "'", '\(', '\)', ':'
+            if ($Setting.$Property -is [System.Xml.XmlElement]) {
+                #$SubPropeties = $Setting.$Property.PSObject.Properties.Name | Where-Object { $_ -notin $SkipNames }
+
+
+                ConvertTo-XMLNested -Setting $Setting.$Property -CreateGPO $CreateGPO -Name $Name -SkipNames $SkipNames
+
+
+            } else {
+                $CreateGPO[$Name] = $Setting.$Property
+            }
+        }
+        $Name = $TempName
+    }
+}

Private/ConvertTo-XMLPolicies.ps1

@@ -0,0 +1,61 @@
+function ConvertTo-XMLPolicies {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings        = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Policy in $GPO.DataSet) {
+            [PSCustomObject] @{
+                PolicyName         = $Policy.Name
+                PolicyState        = $Policy.State
+                PolicyCategory     = $Policy.Category
+                PolicySupported    = $Policy.Supported
+                PolicyExplain      = $Policy.Explain
+                PolicyText         = $Policy.Text
+                PolicyCheckBox     = $Policy.CheckBox
+                PolicyDropDownList = $Policy.DropDownList
+                PolicyEditText     = $Policy.EditText
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Policy in $GPO.DataSet) {
+            $CreateGPO = [ordered]@{
+                DisplayName        = $GPO.DisplayName
+                DomainName         = $GPO.DomainName
+                GUID               = $GPO.GUID
+                GpoType            = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                PolicyName         = $Policy.Name
+                PolicyState        = $Policy.State
+                PolicyCategory     = $Policy.Category
+                PolicySupported    = $Policy.Supported
+                PolicyExplain      = $Policy.Explain
+                PolicyText         = $Policy.Text
+                PolicyCheckBox     = $Policy.CheckBox
+                PolicyDropDownList = $Policy.DropDownList
+                PolicyEditText     = $Policy.EditText
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLPrinter.ps1

@@ -0,0 +1,51 @@
+function ConvertTo-XMLPrinter {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = @(
+            foreach ($Type in @('SharedPrinter', 'PortPrinter', 'LocalPrinter')) {
+                foreach ($Entry in $GPO.DataSet.$Type) {
+                    if ($Entry) {
+                        ConvertTo-XMLPrinterInternal -GPO $GPO -Entry $Entry -Type $Type -Limited
+                    }
+                }
+            }
+            if ($GPO.GpoCategory -eq 'PrinterConnectionSettings') {
+                foreach ($Entry in $GPO.DataSet) {
+                    ConvertTo-XMLPrinterInternal -GPO $GPO -Entry $Entry -Type 'PrinterConnections' -Limited
+                }
+            }
+        )
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Type in @('SharedPrinter', 'PortPrinter', 'LocalPrinter')) {
+            foreach ($Entry in $GPO.DataSet.$Type) {
+                if ($Entry) {
+                    ConvertTo-XMLPrinterInternal -GPO $GPO -Entry $Entry -Type $Type
+                }
+            }
+        }
+        if ($GPO.GpoCategory -eq 'PrinterConnectionSettings') {
+            foreach ($Entry in $GPO.DataSet) {
+                ConvertTo-XMLPrinterInternal -GPO $GPO -Entry $Entry -Type 'PrinterConnections'
+            }
+        }
+    }
+}

Private/ConvertTo-XMLPrinterInternal.ps1

@@ -0,0 +1,95 @@
+function ConvertTo-XMLPrinterInternal {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        $Entry,
+        $Type,
+        [switch] $Limited
+    )
+    if ($Limited) {
+        $CreateGPO = [ordered]@{
+            Changed              = try { [DateTime] $Entry.changed } catch { $Entry.Changed };
+            #uid             = $Entry.uid
+            BypassErrors         = if ($Entry.bypassErrors -eq '1') { $true } else { $false };
+            GPOSettingOrder      = $Entry.GPOSettingOrder
+            Filter               = $Entry.Filter
+            type                 = $Type
+            Action               = $null #$Script:Actions["$($Entry.Properties.action)"]
+            Comment              = $Entry.Properties.comment
+            Path                 = if ($Entry.Properties.path) { $Entry.Properties.Path } elseif ($Entry.Path) { $Entry.Path } else { '' }
+            Location             = $Entry.Properties.location
+
+            HostName             = $Entry.Properties.ipAddress     #: 10.42.20.204
+            LocalName            = $Entry.Properties.localName     #: CZ02PRT00017
+            UseDNS               = if ($Entry.Properties.useDNS -eq '1') { $true } elseif ($Entry.Properties.useDNS -eq '0') { $false } else { $Entry.Properties.useDNS };
+            UseIPv6              = if ($Entry.Properties.useIPv6 -eq '1') { $true } elseif ($Entry.Properties.useIPv6 -eq '0') { $false } else { $Entry.Properties.useIPv6 };
+            Default              = if ($Entry.Properties.default -eq '1') { $true } elseif ($Entry.Properties.default -eq '0') { $false } else { $Entry.Properties.default };
+            SkipLocal            = if ($Entry.Properties.skipLocal -eq '1') { $true } elseif ($Entry.Properties.skipLocal -eq '0') { $false } else { $Entry.Properties.skipLocal };
+            DeleteAllShared      = if ($Entry.Properties.deleteAll -eq '1') { $true } elseif ($Entry.Properties.deleteAll -eq '0') { $false } else { $Entry.Properties.deleteAll };
+            Persistent           = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
+            DeleteMaps           = if ($Entry.Properties.deleteMaps -eq '1') { $true } elseif ($Entry.Properties.deleteMaps -eq '0') { $false } else { $Entry.Properties.deleteMaps };
+            LPRSettingsQueueName = $Entry.Properties.lprQueue      #:
+
+            Protocol             = $Entry.Properties.protocol      #: PROTOCOL_RAWTCP_TYPE
+            PortNumber           = if ($Entry.Properties.portNumber) { $Entry.Properties.portNumber } else { $Entry.Properties.port }
+            DoubleSpool          = if ($Entry.Properties.doubleSpool -eq '1') { $true } elseif ($Entry.Properties.doubleSpool -eq '0') { $false } else { $Entry.Properties.doubleSpool };
+
+            SNMPEnabled          = if ($Entry.Properties.snmpEnabled -eq '1') { $true } elseif ($Entry.Properties.snmpEnabled -eq '0') { $false } else { $Entry.Properties.snmpEnabled };
+            SNMPCommunityName    = $Entry.Properties.snmpCommunity #: public
+            SNMPDeviceIndex      = $Entry.Properties.snmpDevIndex  #: 1
+        }
+        if ($Entry.Properties.Action) {
+            $CreateGPO['Action'] = $Script:Actions["$($Entry.Properties.action)"]
+        } else {
+            $CreateGPO['Action'] = 'Deploy'
+        }
+        [PSCustomObject] $CreateGPO
+    } else {
+        $CreateGPO = [ordered]@{
+            DisplayName          = $GPO.DisplayName
+            DomainName           = $GPO.DomainName
+            GUID                 = $GPO.GUID
+            GpoType              = $GPO.GpoType
+            GpoCategory          = $GPO.GpoCategory
+            GpoSettings          = $GPO.GpoSettings
+            Changed              = try { [DateTime] $Entry.changed } catch { $Entry.Changed };
+            #uid             = $Entry.uid
+            BypassErrors         = if ($Entry.bypassErrors -eq '1') { $true } else { $false };
+            GPOSettingOrder      = $Entry.GPOSettingOrder
+            Filter               = $Entry.Filter
+            type                 = $Type
+            Action               = $null #$Script:Actions["$($Entry.Properties.action)"]
+            Comment              = $Entry.Properties.comment
+            Path                 = if ($Entry.Properties.path) { $Entry.Properties.Path } elseif ($Entry.Path) { $Entry.Path } else { '' }
+            Location             = $Entry.Properties.location
+
+            HostName             = $Entry.Properties.ipAddress     #: 10.42.20.204
+            LocalName            = $Entry.Properties.localName     #: CZ02PRT00017
+            UseDNS               = if ($Entry.Properties.useDNS -eq '1') { $true } elseif ($Entry.Properties.useDNS -eq '0') { $false } else { $Entry.Properties.useDNS };
+            UseIPv6              = if ($Entry.Properties.useIPv6 -eq '1') { $true } elseif ($Entry.Properties.useIPv6 -eq '0') { $false } else { $Entry.Properties.useIPv6 };
+            Default              = if ($Entry.Properties.default -eq '1') { $true } elseif ($Entry.Properties.default -eq '0') { $false } else { $Entry.Properties.default };
+            SkipLocal            = if ($Entry.Properties.skipLocal -eq '1') { $true } elseif ($Entry.Properties.skipLocal -eq '0') { $false } else { $Entry.Properties.skipLocal };
+            DeleteAllShared      = if ($Entry.Properties.deleteAll -eq '1') { $true } elseif ($Entry.Properties.deleteAll -eq '0') { $false } else { $Entry.Properties.deleteAll };
+            Persistent           = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
+            DeleteMaps           = if ($Entry.Properties.deleteMaps -eq '1') { $true } elseif ($Entry.Properties.deleteMaps -eq '0') { $false } else { $Entry.Properties.deleteMaps };
+            LPRSettingsQueueName = $Entry.Properties.lprQueue      #:
+
+            Protocol             = $Entry.Properties.protocol      #: PROTOCOL_RAWTCP_TYPE
+            PortNumber           = if ($Entry.Properties.portNumber) { $Entry.Properties.portNumber } else { $Entry.Properties.port }
+            DoubleSpool          = if ($Entry.Properties.doubleSpool -eq '1') { $true } elseif ($Entry.Properties.doubleSpool -eq '0') { $false } else { $Entry.Properties.doubleSpool };
+
+            SNMPEnabled          = if ($Entry.Properties.snmpEnabled -eq '1') { $true } elseif ($Entry.Properties.snmpEnabled -eq '0') { $false } else { $Entry.Properties.snmpEnabled };
+            SNMPCommunityName    = $Entry.Properties.snmpCommunity #: public
+            SNMPDeviceIndex      = $Entry.Properties.snmpDevIndex  #: 1
+        }
+        if ($Entry.Properties.Action) {
+            $CreateGPO['Action'] = $Script:Actions["$($Entry.Properties.action)"]
+        } else {
+            $CreateGPO['Action'] = 'Deploy'
+        }
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-XMLRegistryAutologon.ps1

@@ -0,0 +1,49 @@
+function ConvertTo-XMLRegistryAutologon {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO
+    )
+    $CreateGPO = [ordered]@{
+        DisplayName                  = $GPO.DisplayName
+        DomainName                   = $GPO.DomainName
+        GUID                         = $GPO.GUID
+        GpoType                      = $GPO.GpoType
+        #GpoCategory = $GPOEntry.GpoCategory
+        #GpoSettings = $GPOEntry.GpoSettings
+        AutoAdminLogon               = $null
+        DefaultDomainName            = $null
+        DefaultUserName              = $null
+        DefaultPassword              = $null
+        DateChangedAutoAdminLogon    = $null
+        DateChangedDefaultDomainName = $null
+        DateChangedDefaultUserName   = $null
+        DateChangedDefaultPassword   = $null
+    }
+    foreach ($Registry in $GPO.DataSet.Registry) {
+        if ($Registry.Properties.Key -eq 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon') {
+            if ($Registry.Properties.Name -eq 'AutoAdminLogon') {
+                $CreateGPO['AutoAdminLogon'] = [bool] $Registry.Properties.value
+                $CreateGPO['DateChangedAutoAdminLogon'] = [DateTime] $Registry.changed
+            } elseif ($Registry.Properties.Name -eq 'DefaultDomainName') {
+                $CreateGPO['DefaultDomainName'] = $Registry.Properties.value
+                $CreateGPO['DateChangedDefaultDomainName'] = [DateTime] $Registry.changed
+            } elseif ($Registry.Properties.Name -eq 'DefaultUserName') {
+                $CreateGPO['DefaultUserName'] = $Registry.Properties.value
+                $CreateGPO['DateChangedDefaultUserName'] = [DateTime] $Registry.changed
+            } elseif ($Registry.Properties.Name -eq 'DefaultPassword') {
+                $CreateGPO['DefaultPassword'] = $Registry.Properties.value
+                $CreateGPO['DateChangedDefaultPassword'] = [DateTime] $Registry.changed
+            }
+        }
+    }
+    if ($null -ne $CreateGPO['AutoAdminLogon'] -or
+        $null -ne $CreateGPO['DefaultDomainName'] -or
+        $null -ne $CreateGPO['DefaultUserName'] -or
+        $null -ne $CreateGPO['DefaultPassword']
+    ) {
+        $CreateGPO['Linked'] = $GPOEntry.Linked
+        $CreateGPO['LinksCount'] = $GPOEntry.LinksCount
+        $CreateGPO['Links'] = $GPOEntry.Links
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-XMLRegistryAutologonOnReport.ps1

@@ -0,0 +1,49 @@
+function ConvertTo-XMLRegistryAutologonOnReport {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO
+    )
+    $CreateGPO = [ordered]@{
+        DisplayName                  = $GPO.DisplayName
+        DomainName                   = $GPO.DomainName
+        GUID                         = $GPO.GUID
+        GpoType                      = $GPO.GpoType
+        #GpoCategory = $GPOEntry.GpoCategory
+        #GpoSettings = $GPOEntry.GpoSettings
+        AutoAdminLogon               = $null
+        DefaultDomainName            = $null
+        DefaultUserName              = $null
+        DefaultPassword              = $null
+        DateChangedAutoAdminLogon    = $null
+        DateChangedDefaultDomainName = $null
+        DateChangedDefaultUserName   = $null
+        DateChangedDefaultPassword   = $null
+    }
+    foreach ($Registry in $GPO.Settings) {
+        if ($Registry.Key -eq 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon') {
+            if ($Registry.Name -eq 'AutoAdminLogon') {
+                $CreateGPO['AutoAdminLogon'] = [bool] $Registry.value
+                $CreateGPO['DateChangedAutoAdminLogon'] = [DateTime] $Registry.changed
+            } elseif ($Registry.Name -eq 'DefaultDomainName') {
+                $CreateGPO['DefaultDomainName'] = $Registry.value
+                $CreateGPO['DateChangedDefaultDomainName'] = [DateTime] $Registry.changed
+            } elseif ($Registry.Name -eq 'DefaultUserName') {
+                $CreateGPO['DefaultUserName'] = $Registry.value
+                $CreateGPO['DateChangedDefaultUserName'] = [DateTime] $Registry.changed
+            } elseif ($Registry.Name -eq 'DefaultPassword') {
+                $CreateGPO['DefaultPassword'] = $Registry.value
+                $CreateGPO['DateChangedDefaultPassword'] = [DateTime] $Registry.changed
+            }
+        }
+    }
+    if ($null -ne $CreateGPO['AutoAdminLogon'] -or
+        $null -ne $CreateGPO['DefaultDomainName'] -or
+        $null -ne $CreateGPO['DefaultUserName'] -or
+        $null -ne $CreateGPO['DefaultPassword']
+    ) {
+        $CreateGPO['Linked'] = $GPO.Linked        #: True
+        $CreateGPO['LinksCount'] = $GPO.LinksCount    #: 1
+        $CreateGPO['Links'] = $GPO.Links         #: area1.local
+        [PSCustomObject] $CreateGPO
+    }
+}

Private/ConvertTo-XMLRegistryInternetExplorerZones.ps1

@@ -0,0 +1,76 @@
+function ConvertTo-XMLRegistryInternetExplorerZones {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO
+    )
+    foreach ($Registry in $GPO.Settings) {
+        $Keys = @(
+            'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\'
+            'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\'
+        )
+        $Found = $false
+        foreach ($Key in $Keys) {
+            if ($Registry.Key -like "$Key*") {
+                $Found = $true
+            }
+        }
+        if ($Found -eq $false) {
+            continue
+        }
+        # https://support.microsoft.com/en-us/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users
+        if ($Registry.Key -like 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\*') {
+            $CreateGPO = [ordered]@{
+                DisplayName = $GPO.DisplayName
+                DomainName  = $GPO.DomainName
+                GUID        = $GPO.GUID
+                GpoType     = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+            }
+            $CreateGPO['Disabled'] = $Registry.Disabled
+            if ($Registry.Key -like '*EscDomains*') {
+                $CreateGPO['Configuration'] = 'Enhanced Security Configuration (ESC)'
+            } else {
+                $CreateGPO['Configuration'] = 'Domains'
+            }
+            if ($Registry.Hive -eq 'HKEY_CURRENT_USER') {
+                $CreateGPO['Type'] = 'User Policy'
+            } elseif ($Registry.Hive -eq 'HKEY_LOCAL_MACHINE') {
+                $CreateGPO['Type'] = 'Computer Policy'
+            } else {
+                $CreateGPO['Type'] = $Registry.Hive
+            }
+            if ($Registry.Value -eq '00000000') {
+                $CreateGPO['Zone'] = 'My Computer (0)'
+            } elseif ($Registry.Value -eq '00000001') {
+                $CreateGPO['Zone'] = 'Local Intranet Zone (1)'
+            } elseif ($Registry.Value -eq '00000002') {
+                $CreateGPO['Zone'] = 'Trusted Sites Zone (2)'
+            } elseif ($Registry.Value -eq '00000003') {
+                $CreateGPO['Zone'] = 'Internet Zone (3)'
+            } elseif ($Registry.Value -eq '00000004') {
+                $CreateGPO['Zone'] = 'Restricted Sites Zone (4)'
+            } else {
+                $CreateGPO['Zone'] = $Registry.Value
+            }
+            [string] $FullKey = foreach ($Key in $Keys) {
+                if ($Registry.Key -like "$Key*") {
+                    $Registry.Key.Replace($Key, '')
+                }
+            }
+            $DomainSplit = $FullKey.Split('\')
+            $Reversed = for ($i = $DomainSplit.Count - 1; $i -ge 0; $i--) {
+                $DomainSplit[$i]
+            }
+            if ($Registry.Name -eq '*') {
+                $CreateGPO['DomainZone'] = $Reversed -join '.'
+            } else {
+                $CreateGPO['DomainZone'] = -join ($Registry.Name, '://', ($Reversed -join '.'))
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLRegistrySettings.ps1

@@ -0,0 +1,28 @@
+function ConvertTo-XMLRegistrySettings {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+
+        [Array] $CreateGPO['Settings'] = Get-XMLNestedRegistry -GPO $GPO -DataSet $GPO.DataSet
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        Get-XMLNestedRegistry -GPO $GPO -DataSet $GPO.DataSet
+    }
+}

Private/ConvertTo-XMLScripts.ps1

@@ -0,0 +1,53 @@
+function ConvertTo-XMLScripts {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings        = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Script in $GPO.DataSet) {
+            [PSCustomObject] @{
+                Type       = $GPO.DataSet.Type
+                Command    = $GPO.DataSet.Command
+                Parameters = $GPO.DataSet.Parameters
+                Order      = $GPO.DataSet.Order
+                RunOrder   = $GPO.DataSet.RunOrder
+            }
+        }
+        $CreateGPO['DataCount'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Script in $GPO.DataSet) {
+            $CreateGPO = [ordered]@{
+                DisplayName = $GPO.DisplayName
+                DomainName  = $GPO.DomainName
+                GUID        = $GPO.GUID
+                GpoType     = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                Type        = $Script.Type
+                Command     = $Script.Command
+                Parameters  = $Script.Parameters
+                Order       = $Script.Order
+                RunOrder    = $Script.RunOrder
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLSecurityOptions.ps1

@@ -0,0 +1,65 @@
+function ConvertTo-XMLSecurityOptions {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Entry in $GPO.DataSet) {
+            $Object = [ordered] @{}
+            $Object['KeyName'] = $Entry.KeyName
+            $Object['KeyDisplayName'] = $Entry.Display.Name
+            $Object['KeyDisplayUnits'] = $Entry.Display.Units
+            $Object['KeyDisplayBoolean'] = try { [bool]::Parse($Entry.Display.DisplayBoolean) } catch { $null };
+            $Object['KeyDisplayString'] = $Entry.Display.DisplayString
+            $Object['SystemAccessPolicyName'] = $Entry.SystemAccessPolicyName
+            if ($Entry.SettingString) {
+                $Object['KeyValue'] = $Entry.SettingString
+            } else {
+                $Object['KeyValue'] = $Entry.SettingNumber
+            }
+            [PSCustomObject] $Object
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Entry in $GPO.DataSet) {
+            $CreateGPO = [ordered]@{
+                DisplayName = $GPO.DisplayName
+                DomainName  = $GPO.DomainName
+                GUID        = $GPO.GUID
+                GpoType     = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+            }
+            $CreateGPO['KeyName'] = $Entry.KeyName
+            $CreateGPO['KeyDisplayName'] = $Entry.Display.Name
+            $CreateGPO['KeyDisplayUnits'] = $Entry.Display.Units
+            $CreateGPO['KeyDisplayBoolean'] = try { [bool]::Parse($Entry.Display.DisplayBoolean) } catch { $null };
+            $CreateGPO['KeyDisplayString'] = $Entry.Display.DisplayString
+            $CreateGPO['SystemAccessPolicyName'] = $Entry.SystemAccessPolicyName
+            if ($Entry.SettingString) {
+                $CreateGPO['KeyValue'] = $Entry.SettingString
+            } else {
+                $CreateGPO['KeyValue'] = $Entry.SettingNumber
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLSoftwareInstallation.ps1

@@ -0,0 +1,87 @@
+function ConvertTo-XMLSoftwareInstallation {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($MsiInstallerr in $GPO.DataSet) {
+            [PSCustomObject] @{
+                Identifier          = $MsiInstallerr.Identifier          #: { 10495e9e-79c1-4a32-b278-a24cd495437f }
+                Name                = $MsiInstallerr.Name                #: Local Administrator Password Solution (2)
+                Path                = $MsiInstallerr.Path                #: \\area1.local\SYSVOL\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\LAPS.x64.msi
+                MajorVersion        = $MsiInstallerr.MajorVersion        #: 6
+                MinorVersion        = $MsiInstallerr.MinorVersion        #: 2
+                LanguageId          = $MsiInstallerr.LanguageId          #: 1033
+                Architecture        = $MsiInstallerr.Architecture        #: 9
+                IgnoreLanguage      = if ($MsiInstallerr.IgnoreLanguage -eq 'true') { $true } else { $false }      #: false
+                Allowx86Onia64      = if ($MsiInstallerr.Allowx86Onia64 -eq 'true') { $true } else { $false }       #: true
+                SupportURL          = $MsiInstallerr.SupportURL          #:
+                AutoInstall         = if ($MsiInstallerr.AutoInstall -eq 'true') { $true } else { $false }          #: true
+                DisplayInARP        = if ($MsiInstallerr.DisplayInARP -eq 'true') { $true } else { $false }        #: true
+                IncludeCOM          = if ($MsiInstallerr.IncludeCOM -eq 'true') { $true } else { $false }          #: true
+                SecurityDescriptor  = $MsiInstallerr.SecurityDescriptor  #: SecurityDescriptor
+                DeploymentType      = $MsiInstallerr.DeploymentType      #: Assign
+                ProductId           = $MsiInstallerr.ProductId           #: { ea8cb806-c109 - 4700 - 96b4-f1f268e5036c }
+                ScriptPath          = $MsiInstallerr.ScriptPath          #: \\area1.local\SysVol\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\Machine\Applications\ { EAC9B821-FB4D - 457A-806F-E5B528D1E41A }.aas
+                DeploymentCount     = $MsiInstallerr.DeploymentCount     #: 0
+                InstallationUILevel = $MsiInstallerr.InstallationUILevel #: Maximum
+                Upgrades            = if ($MsiInstallerr.Upgrades.Mandatory -eq 'true') { $true } else { $false }            #: Upgrades
+                UninstallUnmanaged  = if ($MsiInstallerr.UninstallUnmanaged -eq 'true') { $true } else { $false }   #: false
+                LossOfScopeAction   = $MsiInstallerr.LossOfScopeAction   #: Unmanage
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($MsiInstallerr in $GPO.DataSet) {
+            $CreateGPO = [ordered]@{
+                DisplayName         = $GPO.DisplayName
+                DomainName          = $GPO.DomainName
+                GUID                = $GPO.GUID
+                GpoType             = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                Identifier          = $MsiInstallerr.Identifier          #: { 10495e9e-79c1-4a32-b278-a24cd495437f }
+                Name                = $MsiInstallerr.Name                #: Local Administrator Password Solution (2)
+                Path                = $MsiInstallerr.Path                #: \\area1.local\SYSVOL\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\LAPS.x64.msi
+                MajorVersion        = $MsiInstallerr.MajorVersion        #: 6
+                MinorVersion        = $MsiInstallerr.MinorVersion        #: 2
+                LanguageId          = $MsiInstallerr.LanguageId          #: 1033
+                Architecture        = $MsiInstallerr.Architecture        #: 9
+                IgnoreLanguage      = if ($MsiInstallerr.IgnoreLanguage -eq 'true') { $true } else { $false }      #: false
+                Allowx86Onia64      = if ($MsiInstallerr.Allowx86Onia64 -eq 'true') { $true } else { $false }       #: true
+                SupportURL          = $MsiInstallerr.SupportURL          #:
+                AutoInstall         = if ($MsiInstallerr.AutoInstall -eq 'true') { $true } else { $false }          #: true
+                DisplayInARP        = if ($MsiInstallerr.DisplayInARP -eq 'true') { $true } else { $false }        #: true
+                IncludeCOM          = if ($MsiInstallerr.IncludeCOM -eq 'true') { $true } else { $false }          #: true
+                SecurityDescriptor  = $MsiInstallerr.SecurityDescriptor  #: SecurityDescriptor
+                DeploymentType      = $MsiInstallerr.DeploymentType      #: Assign
+                ProductId           = $MsiInstallerr.ProductId           #: { ea8cb806-c109 - 4700 - 96b4-f1f268e5036c }
+                ScriptPath          = $MsiInstallerr.ScriptPath          #: \\area1.local\SysVol\area1.local\Policies\ { 5F5042A0-008F-45E3-8657-79C87BD002E3 }\Machine\Applications\ { EAC9B821-FB4D - 457A-806F-E5B528D1E41A }.aas
+                DeploymentCount     = $MsiInstallerr.DeploymentCount     #: 0
+                InstallationUILevel = $MsiInstallerr.InstallationUILevel #: Maximum
+                Upgrades            = if ($MsiInstallerr.Upgrades.Mandatory -eq 'true') { $true } else { $false }            #: Upgrades
+                UninstallUnmanaged  = if ($MsiInstallerr.UninstallUnmanaged -eq 'true') { $true } else { $false }   #: false
+                LossOfScopeAction   = $MsiInstallerr.LossOfScopeAction   #: Unmanage
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLSystemServices.ps1

@@ -0,0 +1,53 @@
+function ConvertTo-XMLSystemServices {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($GPOEntry in $GPO.DataSet) {
+            [PSCustomObject] @{
+                ServiceName                = $GPOEntry.Name
+                ServiceStartUpMode         = $GPOEntry.StartUpMode
+                SecurityAuditingPresent    = try { [bool]::Parse($GPOEntry.SecurityDescriptor.AuditingPresent.'#text') } catch { $null };
+                SecurityPermissionsPresent = try { [bool]::Parse($GPOEntry.SecurityDescriptor.PermissionsPresent.'#text') } catch { $null };
+                SecurityDescriptor         = $GPOEntry.SecurityDescriptor
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($GPOEntry in $GPO.DataSet) {
+            $CreateGPO = [ordered]@{
+                DisplayName                = $GPO.DisplayName
+                DomainName                 = $GPO.DomainName
+                GUID                       = $GPO.GUID
+                GpoType                    = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                ServiceName                = $GPOEntry.Name
+                ServiceStartUpMode         = $GPOEntry.StartUpMode
+                SecurityAuditingPresent    = try { [bool]::Parse($GPOEntry.SecurityDescriptor.AuditingPresent.'#text') } catch { $null };
+                SecurityPermissionsPresent = try { [bool]::Parse($GPOEntry.SecurityDescriptor.PermissionsPresent.'#text') } catch { $null };
+                SecurityDescriptor         = $GPOEntry.SecurityDescriptor
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLSystemServicesNT.ps1

@@ -0,0 +1,106 @@
+function ConvertTo-XMLSystemServicesNT {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Service in $GPO.DataSet.NTService) {
+            [PSCustomObject] @{
+                GPOSettingOrder                      = $Service.GPOSettingOrder
+                #ServiceName          = $Service.Name
+                ServiceName                          = $Service.Properties.serviceName          #: AppIDSvc: AppIDSvc
+                ServiceStartupType                   = $Service.Properties.startupType          #: NOCHANGE: NOCHANGE
+                ServiceAction                        = $Service.Properties.serviceAction        #: START: START
+                Timeout                              = $Service.Properties.timeout              #: 50: 50
+                FirstFailure                         = $Service.Properties.firstFailure         #: REBOOT: REBOOT
+                SecondFailure                        = $Service.Properties.secondFailure        #: REBOOT: REBOOT
+                ThirdFailure                         = $Service.Properties.thirdFailure         #: REBOOT: REBOOT
+                ResetFailCountDelay                  = $Service.Properties.resetFailCountDelay  #: 0: 0
+                RestartComputerDelay                 = $Service.Properties.restartComputerDelay #: 60000: 60000
+                Filter                               = $Service.Filter
+                AccountName                          = $Service.Properties.accountName
+                AllowServiceToInteractWithTheDesktop = if ($Service.Properties.interact -eq 1) { 'Yes' } elseif ($Service.Properties.interact -eq 0) { 'No' } else { $null }
+                RunThisProgram                       = $Service.Properties.program
+                CommandLineParameters                = $Service.Properties.args
+                AppendFailCountToEndOfCommandLine    = if ($Service.Properties.append -eq 1) { 'Yes' } elseif ($Service.Properties.append -eq 0) { 'No' } else { $null }
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Service in $GPO.DataSet.NTService) {
+            $CreateGPO = [ordered]@{
+                DisplayName                          = $GPO.DisplayName
+                DomainName                           = $GPO.DomainName
+                GUID                                 = $GPO.GUID
+                GpoType                              = $GPO.GpoType
+                #GpoCategory = $GPOEntry.GpoCategory
+                #GpoSettings = $GPOEntry.GpoSettings
+                GPOSettingOrder                      = $Service.GPOSettingOrder
+                #ServiceName          = $Service.Name
+                ServiceName                          = $Service.Properties.serviceName          #: AppIDSvc: AppIDSvc
+                ServiceStartupType                   = $Service.Properties.startupType          #: NOCHANGE: NOCHANGE
+                ServiceAction                        = $Service.Properties.serviceAction        #: START: START
+                Timeout                              = $Service.Properties.timeout              #: 50: 50
+                FirstFailure                         = $Service.Properties.firstFailure         #: REBOOT: REBOOT
+                SecondFailure                        = $Service.Properties.secondFailure        #: REBOOT: REBOOT
+                ThirdFailure                         = $Service.Properties.thirdFailure         #: REBOOT: REBOOT
+                ResetFailCountDelay                  = $Service.Properties.resetFailCountDelay  #: 0: 0
+                RestartComputerDelay                 = $Service.Properties.restartComputerDelay #: 60000: 60000
+                Filter                               = $Service.Filter
+                AccountName                          = $Service.Properties.accountName
+                AllowServiceToInteractWithTheDesktop = if ($Service.Properties.interact -eq 1) { 'Yes' } elseif ($Service.Properties.interact -eq 0) { 'No' } else { $null }
+                RunThisProgram                       = $Service.Properties.program
+                CommandLineParameters                = $Service.Properties.args
+                AppendFailCountToEndOfCommandLine    = if ($Service.Properties.append -eq 1) { 'Yes' } elseif ($Service.Properties.append -eq 0) { 'No' } else { $null }
+                <#$
+
+                startupType         : NOCHANGE
+                serviceName         : AudioEndpointBuilder
+                timeout             : 30
+                accountName         : LocalSystem
+                interact            : 1
+                thirdFailure        : RUNCMD
+                resetFailCountDelay : 0
+                program             : fgdfg
+                args                : dg
+                append              : 1
+
+                Service name AudioEndpointBuilder
+                Action No change
+                Startup type: No change
+                Wait timeout if service is locked: 30 seconds
+                Service AccountLog on service as: LocalSystem
+                Allow service to interact with the desktop: Yes
+
+                First failure: No change
+                Second failure: No change
+                Subsequent failures: Run a program
+                Reset fail count after: 0 days
+                Run this program: fgdfg
+                Command line parameters: dg
+                Append fail count to end of command line: Yes
+
+                #>
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/ConvertTo-XMLTaskScheduler.ps1

@@ -0,0 +1,243 @@
+function ConvertTo-XMLTaskScheduler {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Entry in $GPO.DataSet.Drive) {
+            [PSCustomObject] @{
+                Changed         = [DateTime] $Entry.changed
+                #uid             = $Entry.uid
+                GPOSettingOrder = $Entry.GPOSettingOrder
+                Filter          = $Entry.Filter
+
+                Name            = $Entry.Name
+                Action          = $Script:Actions["$($Entry.Properties.action)"]
+                ThisDrive       = $Entry.Properties.thisDrive
+                AllDrives       = $Entry.Properties.allDrives
+                UserName        = $Entry.Properties.userName
+                Path            = $Entry.Properties.path
+                Label           = $Entry.Properties.label
+                Persistent      = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
+                UseLetter       = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
+                Letter          = $Entry.Properties.letter
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Type in @('TaskV2', 'Task', 'ImmediateTaskV2', 'ImmediateTask')) {
+            foreach ($Entry in $GPO.DataSet.$Type) {
+                $ListActions = foreach ($LoopAction in $Entry.Properties.Task.Actions) {
+
+                    foreach ($InternalAction in $LoopAction.Exec) {
+                        $Action = [ordered] @{
+                            ActionType       = 'Execute'
+                            Command          = $InternalAction.Command         # : cmd
+                            Arguments        = $InternalAction.Arguments       # : / c wevtutil qe security / rd:true / f:text / c:1 / q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4727 or EventID=4759 or EventID=4754 or EventID=4731)]]" >group-creation.txt
+                            WorkingDirectory = $InternalAction.WorkingDirectory# : % windir % \temp
+                            Server           = $Null
+                            Subject          = $Null
+                            To               = $Null
+                            From             = $Null
+                            Body             = $Null
+                            Attachments      = $Null
+                        }
+                        $Action
+                    }
+                    foreach ($InternalAction in $LoopAction.SendEmail) {
+                        $Action = [ordered] @{
+                            ActionType       = 'SendEmail'
+                            Command          = $null
+                            Arguments        = $null      # : / c wevtutil qe security / rd:true / f:text / c:1 / q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4727 or EventID=4759 or EventID=4754 or EventID=4731)]]" >group-creation.txt
+                            WorkingDirectory = $null # : % windir % \temp
+                            Server           = $InternalAction.Server     # : smtp-de
+                            Subject          = $InternalAction.Subject    # : AD Group creation
+                            To               = $InternalAction.To         # : gm6b@eurofins.de,RalphThomasAussem@eurofins.de,karlthomaseggert@eurofins.de
+                            From             = $InternalAction.From       # : %computername%@eurofins.local
+                            Body             = $InternalAction.Body       # : A new security group has been created. Check attachment for further details.
+                            Attachments      = $InternalAction.Attachments.File -join '; ' # : Attachments
+                        }
+                        $Action
+                    }
+                }
+
+
+                <#
+                [DBG]: PS C:\Support\GitHub\GpoZaurr> $Entry.Properties.Task.Triggers.EventTrigger
+
+                Enabled Subscription
+                ------- ------------
+                true    <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4727]]</Select></Query></QueryList>
+                true    <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4731]]</Select></Query></QueryList>
+                true    <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4754]]</Select></Query></QueryList>
+                false   <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4759]]</Select></Query></QueryList>
+                #>
+                if ($ListActions.Count -eq 0) {
+                    $ListActions = @(
+
+                        if ($Entry.Properties.appName) {
+                            # This supports Scheduled Task (legacy)
+                            $Action = [ordered] @{
+                                ActionType       = $Script:Actions["$($Entry.Properties.action)"]
+                                Command          = $Entry.Properties.appName
+                                Arguments        = $Entry.Properties.args  #
+                                WorkingDirectory = $Entry.Properties.startIn  # : % windir % \temp
+                                Server           = $null     # : smtp-de
+                                Subject          = $null    # : AD Group creation
+                                To               = $null
+                                From             = $null
+                                Body             = $null
+                                Attachments      = $null
+                            }
+                            $Action
+                        } else {
+
+                            $Action = [ordered] @{
+                                ActionType       = $Script:Actions["$($Entry.Properties.action)"]
+                                Command          = $null
+                                Arguments        = $null      #
+                                WorkingDirectory = $null # : % windir % \temp
+                                Server           = $null     # : smtp-de
+                                Subject          = $null    # : AD Group creation
+                                To               = $null
+                                From             = $null
+                                Body             = $null
+                                Attachments      = $null
+                            }
+                            $Action
+                        }
+                    )
+                }
+                foreach ($Action in $ListActions) {
+                    $CreateGPO = [ordered]@{
+                        DisplayName     = $GPO.DisplayName
+                        DomainName      = $GPO.DomainName
+                        GUID            = $GPO.GUID
+                        GpoType         = $GPO.GpoType
+                        #GpoCategory = $GPOEntry.GpoCategory
+                        #GpoSettings = $GPOEntry.GpoSettings
+                        Type            = $Type
+                        Changed         = [DateTime] $Entry.changed
+                        GPOSettingOrder = $Entry.GPOSettingOrder
+                        userContext     = ''
+
+                        Name            = $Entry.Name
+                        Status          = $Entry.status
+                        Action          = $Script:Actions["$($Entry.Properties.action)"]
+
+
+                        runAs           = $Entry.Properties.runAs     #: NT AUTHORITY\System
+                        #logonType                   = $Entry.Properties.logonType #: InteractiveToken
+                        #Task = $Entry.Properties.Task      #: Task
+
+                        Comment         = $Entry.Properties.comment
+                    }
+                    if ($Entry.Properties.startOnlyIfIdle) {
+                        # Old legacy task
+                        $Middle = [ordered] @{
+                            AllowStartOnDemand          = $null        #: true
+                            DisallowStartIfOnBatteries  = $Entry.Properties.noStartIfOnBatteries #: false
+                            StopIfGoingOnBatteries      = $Entry.Properties.stopIfGoingOnBatteries     #: false
+                            AllowHardTerminate          = $null       #: true
+                            Enabled                     = $Entry.Properties.enabled               #: true
+                            Hidden                      = $null                   #: false
+                            MultipleInstancesPolicy     = $null    #: IgnoreNew
+                            Priority                    = $null                   #: 7
+                            ExecutionTimeLimit          = $null         #: PT1H
+                            #IdleSettings                = $Entry.Properties.Task.Settings.IdleSettings               #: IdleSettings
+
+                            IdleDuration                = $Entry.Properties.deadlineMinutes      # : PT5M
+                            IdleWaitTimeout             = $null   # : PT1H
+                            IdleStopOnIdleEnd           = $Entry.Properties.stopOnIdleEnd # : false
+                            IdleRestartOnIdle           = $Entry.Properties.startOnlyIfIdle # : false
+
+                            RegistrationInfoAuthor      = $null
+                            RegistrationInfoDescription = $null
+                            deleteWhenDone              = $Entry.Properties.deleteWhenDone
+
+                            <#
+                            action                 : U
+                            name                   : Task Name
+                            appName                : Run command
+                            args                   : args for command
+                            startIn                : start me in
+                            comment                : Oops i did it again
+                            enabled                : 1
+                            deleteWhenDone         : 1
+                            maxRunTime             : 259200000
+                            startOnlyIfIdle        : 1
+                            idleMinutes            : 10
+                            deadlineMinutes        : 60
+                            stopOnIdleEnd          : 1
+                            noStartIfOnBatteries   : 1
+                            stopIfGoingOnBatteries : 1
+                            systemRequired         : 0
+                            Triggers               : Triggers
+                            #>
+                        }
+                    } else {
+                        $Middle = [ordered] @{
+                            AllowStartOnDemand          = $Entry.Properties.Task.Settings.AllowStartOnDemand         #: true
+                            DisallowStartIfOnBatteries  = $Entry.Properties.Task.Settings.DisallowStartIfOnBatteries #: false
+                            StopIfGoingOnBatteries      = $Entry.Properties.Task.Settings.StopIfGoingOnBatteries     #: false
+                            AllowHardTerminate          = $Entry.Properties.Task.Settings.AllowHardTerminate         #: true
+                            Enabled                     = $Entry.Properties.Task.Settings.Enabled                    #: true
+                            Hidden                      = $Entry.Properties.Task.Settings.Hidden                     #: false
+                            MultipleInstancesPolicy     = $Entry.Properties.Task.Settings.MultipleInstancesPolicy    #: IgnoreNew
+                            Priority                    = $Entry.Properties.Task.Settings.Priority                   #: 7
+                            ExecutionTimeLimit          = $Entry.Properties.Task.Settings.ExecutionTimeLimit         #: PT1H
+                            #IdleSettings                = $Entry.Properties.Task.Settings.IdleSettings               #: IdleSettings
+
+                            IdleDuration                = $Entry.Properties.Task.Settings.IdleSettings.Duration      # : PT5M
+                            IdleWaitTimeout             = $Entry.Properties.Task.Settings.IdleSettings.WaitTimeout   # : PT1H
+                            IdleStopOnIdleEnd           = $Entry.Properties.Task.Settings.IdleSettings.StopOnIdleEnd # : false
+                            IdleRestartOnIdle           = $Entry.Properties.Task.Settings.IdleSettings.RestartOnIdle # : false
+
+                            RegistrationInfoAuthor      = $Entry.Properties.Task.RegistrationInfo.Author
+                            RegistrationInfoDescription = $Entry.Properties.Task.RegistrationInfo.Description
+
+                            deleteWhenDone              = $Entry.Properties.deleteWhenDone
+                        }
+                    }
+                    $End = [ordered] @{
+                        id        = $Entry.Properties.Principals.Principal.id        # : Author
+                        UserId    = $Entry.Properties.Principals.Principal.UserId    # : NT AUTHORITY\System
+                        LogonType = $Entry.Properties.Principals.Principal.LogonType # : InteractiveToken
+                        RunLevel  = $Entry.Properties.Principals.Principal.RunLevel  # : HighestAvailable
+
+                        #Persistent = if ($Entry.Properties.persistent -eq '1') { $true } elseif ($Entry.Properties.persistent -eq '0') { $false } else { $Entry.Properties.persistent };
+                        #UseLetter = if ($Entry.Properties.useLetter -eq '1') { $true } elseif ($Entry.Properties.useLetter -eq '0') { $false } else { $Entry.Properties.useLetter };
+                        #Letter = $Entry.Properties.letter
+                    }
+                    $CreateGPO = $CreateGPO + $Middle + $End + $Action
+                    $Last = [ordered] @{
+                        #Uid                                   = $Group.uid             #: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}: {8F435B0A-CD15-464E-85F3-B6A55B9E816A}
+                        RunInLoggedOnUserSecurityContext      = if ($Entry.userContext -eq '1') { 'Enabled' } elseif ($Entry.userContext -eq '0') { 'Disabled' } else { $Entry.userContext };
+                        RemoveThisItemWhenItIsNoLongerApplied = if ($Entry.removePolicy -eq '1') { 'Enabled' } elseif ($Entry.removePolicy -eq '0') { 'Disabled' } else { $Entry.removePolicy };
+                        Filters                               = $Group.Filters         #::
+                    }
+                    $CreateGPO = $CreateGPO + $Last
+                    $CreateGPO['Linked'] = $GPO.Linked
+                    $CreateGPO['LinksCount'] = $GPO.LinksCount
+                    $CreateGPO['Links'] = $GPO.Links
+                    [PSCustomObject] $CreateGPO
+                }
+            }
+        }
+    }
+}

Private/ConvertTo-XMLUserRightsAssignment.ps1

@@ -0,0 +1,86 @@
+function ConvertTo-XMLUserRightsAssignment {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+
+    $UserRightsTranslation = @{
+        SeNetworkLogonRight             = 'Access this computer from the network'
+        SeMachineAccountPrivilege       = 'Add workstations to domain'
+        SeIncreaseQuotaPrivilege        = 'Adjust memory quotas for a process'
+        SeInteractiveLogonRight         = 'Allow log on locally'
+        SeBackupPrivilege               = 'Back up files and directories'
+        SeChangeNotifyPrivilege         = 'Bypass traverse checking Everyone'
+        SeSystemTimePrivilege           = 'Change the system time'
+        SeCreatePagefilePrivilege       = 'Create a pagefile'
+        SeDebugPrivilege                = 'Debug programs'
+        SeEnableDelegationPrivilege     = 'Enable computer and user accounts to be trusted for delegation'
+        SeRemoteShutdownPrivilege       = 'Force shutdown from a remote system'
+        SeAuditPrivilege                = 'Generate security audits'
+        SeIncreaseBasePriorityPrivilege = 'Increase scheduling priority'
+        SeLoadDriverPrivilege           = 'Load and unload device drivers'
+        SeBatchLogonRight               = 'Log on as a batch job'
+        SeSecurityPrivilege             = 'Manage auditing and security log'
+        SeSystemEnvironmentPrivilege    = 'Modify firmware environment values'
+        SeProfileSingleProcessPrivilege = 'Profile single process'
+        SeSystemProfilePrivilege        = 'Profile system performance'
+        SeUndockPrivilege               = 'Remove computer from docking station'
+        SeAssignPrimaryTokenPrivilege   = 'Replace a process level token'
+        SeRestorePrivilege              = 'Restore files and directories'
+        SeShutdownPrivilege             = 'Shut down the system'
+        SeTakeOwnershipPrivilege        = 'Take ownership of files or other objects'
+    }
+
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Entry in $GPO.DataSet) {
+            foreach ($Member in $Entry.Member) {
+                [PSCustomObject]@{
+                    'UserRightsAssignment'            = $Entry.Name
+                    'UserRightsAssignmentDescription' = $UserRightsTranslation[$Entry.Name]
+                    'Name'                            = $Member.Name.'#text'
+                    'Sid'                             = $Member.SID.'#text'
+                }
+            }
+        }
+        $CreateGPO['Count'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Entry in $GPO.DataSet) {
+            foreach ($Member in $Entry.Member) {
+                $CreateGPO = [ordered]@{
+                    DisplayName = $GPO.DisplayName
+                    DomainName  = $GPO.DomainName
+                    GUID        = $GPO.GUID
+                    GpoType     = $GPO.GpoType
+                    #GpoCategory = $GPOEntry.GpoCategory
+                    #GpoSettings = $GPOEntry.GpoSettings
+                }
+                $CreateGPO['UserRightsAssignment'] = $Entry.Name
+                $CreateGPO['UserRightsAssignmentDescription'] = $UserRightsTranslation[$Entry.Name]
+                $CreateGPO['Name'] = $Member.Name.'#text'
+                $CreateGPO['Sid'] = $Member.SID.'#text'
+                #$CreateGPO['CreatedTime'] = $GPO.CreatedTime         # : 06.06.2020 18:03:36
+                #$CreateGPO['ModifiedTime'] = $GPO.ModifiedTime        # : 17.06.2020 16:08:10
+                #$CreateGPO['ReadTime'] = $GPO.ReadTime            # : 13.08.2020 10:15:37
+                $CreateGPO['Linked'] = $GPO.Linked
+                $CreateGPO['LinksCount'] = $GPO.LinksCount
+                $CreateGPO['Links'] = $GPO.Links
+                [PSCustomObject] $CreateGPO
+            }
+        }
+    }
+}

Private/Find-MissingProperties.ps1

@@ -1,15 +0,0 @@
-function Find-MissingProperties {
-    [cmdletBinding()]
-    param(
-        [Array] $Objects,
-        [string[]] $PossibleProperties
-    )
-    $AllProperties = Select-Properties -AllProperties -Objects $Objects
-    $MissingProperties = $AllProperties | Where-Object { $_ -notin 'DisplayName', 'DomainName', 'GUID', 'Linked', 'LinksCount', 'Links', 'GPOType', 'GPOCategory', 'GPOSettings' }
-    [Array] $ConsiderAdding = foreach ($Property in $MissingProperties) {
-        if ($Property -notin $PossibleProperties) {
-            $Property
-        }
-    }
-    $ConsiderAdding
-}

Private/Format-CamelCaseToDisplayName.ps1

@@ -0,0 +1,27 @@
+function Format-CamelCaseToDisplayName {
+    [cmdletBinding()]
+    param(
+        [string[]] $Text,
+        [string] $AddChar
+    )
+    foreach ($string in $Text) {
+        $newString = ''
+        $stringChars = $string.GetEnumerator()
+        $charIndex = 0
+        foreach ($char in $stringChars) {
+            # If upper and not first character, add a space
+            if ([char]::IsUpper($char) -eq 'True' -and $charIndex -gt 0) {
+                $newString = $newString + $AddChar + $char.ToString()
+            } elseif ($charIndex -eq 0) {
+                # If the first character, make it a capital always
+                $newString = $newString + $char.ToString().ToUpper()
+            } else {
+                $newString = $newString + $char.ToString()
+            }
+            $charIndex++
+        }
+        $newString
+    }
+}
+
+#Format-CamelCaseToDisplayName -Text 'Test1', 'TestingMyAss', 'OtherTest', 'otherTEst'

Private/Get-GPOCategories.ps1

@@ -0,0 +1,62 @@
+function Get-GPOCategories {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [System.Xml.XmlElement[]] $GPOOutput,
+        [string] $Splitter,
+        [switch] $FullObjects,
+        [System.Collections.IDictionary] $CachedCategories
+    )
+    if (-not $CachedCategories) {
+        $CachedCategories = [ordered] @{}
+    }
+    $LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects
+    foreach ($GpoType in @('User', 'Computer')) {
+        if ($GPOOutput.$GpoType.ExtensionData.Extension) {
+            foreach ($ExtensionType in $GPOOutput.$GpoType.ExtensionData.Extension) {
+                # It's possible that one of the ExtensionType records has value null. Weird but happend.
+                if ($ExtensionType) {
+                    $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
+                    try {
+                        $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
+                    } catch {
+                        Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
+                        continue
+                    }
+
+                    foreach ($GpoSettings in $KeysToLoop.Name) {
+                        $Template = [ordered] @{
+                            DisplayName = $GPO.DisplayName
+                            DomainName  = $GPO.DomainName
+                            GUID        = $GPO.Guid
+                            GpoType     = $GpoType
+                            GpoCategory = $GPOSettingTypeSplit[1]
+                            GpoSettings = $GpoSettings
+                        }
+                        $Template['Linked'] = $LinksInformation.Linked
+                        $Template['LinksCount'] = $LinksInformation.LinksCount
+                        $Template['Links'] = $LinksInformation.Links
+                        $Template['IncludeComments'] = [bool]::Parse($GPOOutput.IncludeComments)
+                        $Template['CreatedTime'] = [DateTime] $GPOOutput.CreatedTime
+                        $Template['ModifiedTime'] = [DateTime] $GPOOutput.ModifiedTime
+                        $Template['ReadTime'] = [DateTime] $GPOOutput.ReadTime
+                        $Template['SecurityDescriptor'] = $GPOOutput.SecurityDescriptor
+                        $Template['FilterDataAvailable'] = [bool]::Parse($GPOOutput.FilterDataAvailable)
+                        $Template['DataSet'] = $ExtensionType.$GpoSettings
+                        $ConvertedObject = [PSCustomObject] $Template
+
+                        if (-not $CachedCategories["$($Template.GpoCategory)"]) {
+                            $CachedCategories["$($Template.GpoCategory)"] = [ordered] @{}
+                        }
+                        if (-not $CachedCategories["$($Template.GpoCategory)"]["$($Template.GpoSettings)"]) {
+                            $CachedCategories["$($Template.GpoCategory)"]["$($Template.GpoSettings)"] = [System.Collections.Generic.List[PSCustomObject]]::new()
+                        }
+                        $CachedCategories["$($Template.GpoCategory)"]["$($Template.GpoSettings)"].Add($ConvertedObject)
+                        # return GPOCategory
+                        $ConvertedObject
+                    }
+                }
+            }
+        }
+    }
+}

Private/Get-PrivPermission.ps1

@@ -5,7 +5,7 @@
         [Object] $SecurityRights,
 
         [string[]] $Principal,
-        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+        [validateset('DistinguishedName', 'Name', 'NetbiosName', 'Sid')][string] $PrincipalType = 'Sid',
 
         [switch] $SkipWellKnown,
         [switch] $SkipAdministrative,
@@ -20,7 +20,7 @@
         [switch] $IncludeGPOObject,
         [System.Collections.IDictionary] $ADAdministrativeGroups,
         [validateSet('AuthenticatedUsers', 'DomainComputers', 'Unknown', 'WellKnownAdministrative', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All',
-        [System.Collections.IDictionary] $Accounts,
+        #[System.Collections.IDictionary] $Accounts,
         [System.Collections.IDictionary] $ExtendedForestInformation
     )
     Begin {
@@ -100,6 +100,11 @@
                     return
                 }
             }
+            if ($GPOPermission.Trustee.Domain) {
+                $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+            } else {
+                $UserMerge = $null
+            }
             if ($Principal) {
                 if ($PrincipalType -eq 'Sid') {
                     if ($Principal -notcontains $GPOPermission.Trustee.Sid.Value) {
@@ -110,8 +115,11 @@
                         return
                     }
                 } elseif ($PrincipalType -eq 'Name') {
-                    $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
-                    if ($Principal -notcontains $UserMerge -and $Principal -notcontains $GPOPermission.Trustee.Name) {
+                    if ($Principal -notcontains $GPOPermission.Trustee.Name) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'NetbiosName') {
+                    if ($Principal -notcontains $UserMerge) {
                         return
                     }
                 }
@@ -126,56 +134,76 @@
                         return
                     }
                 } elseif ($ExcludePrincipalType -eq 'Name') {
-                    $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
-                    if ($ExcludePrincipal -contains $UserMerge -or $ExcludePrincipal -contains $GPOPermission.Trustee.Name) {
+                    if ($ExcludePrincipal -contains $GPOPermission.Trustee.Name) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'NetbiosName') {
+                    if ($ExcludePrincipal -contains $UserMerge) {
                         return
                     }
                 }
             }
-            $ReturnObject = [ordered] @{
-                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
-                GUID              = $GPO.ID
-                DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
-                Enabled           = $GPO.GpoStatus
-                Description       = $GPO.Description
-                CreationDate      = $GPO.CreationTime
-                ModificationTime  = $GPO.ModificationTime
-                PermissionType    = if ($GPOPermission.Denied -eq $true) { 'Deny' } else { 'Allow' }
-                Permission        = $GPOPermission.Permission  # : GpoEditDeleteModifySecurity
-                Inherited         = $GPOPermission.Inherited   # : False
-                Domain            = $GPOPermission.Trustee.Domain  #: EVOTEC
-                DistinguishedName = $GPOPermission.Trustee.DSPath  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
-                Name              = $GPOPermission.Trustee.Name    #: Domain Admins
-                Sid               = $GPOPermission.Trustee.Sid.Value     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
-                SidType           = $GPOPermission.Trustee.SidType #: Group
-            }
-            if ($Accounts) {
-                $A = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
-                if ($A -and $Accounts[$A]) {
-                    $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
-                    $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
-                    $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
-                    $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
-                    $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
-                    if (-not $ReturnObject['Sid']) {
-                        $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
-                    }
-                    if ($Accounts[$A].ObjectClass -eq 'group') {
-                        $ReturnObject['SidType'] = 'Group'
-                    } elseif ($Accounts[$A].ObjectClass -eq 'user') {
-                        $ReturnObject['SidType'] = 'User'
-                    } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
-                        $ReturnObject['SidType'] = 'Computer'
-                    } else {
-                        $ReturnObject['SidType'] = 'EmptyOrUnknown'
+
+            <#
+            # Sets permissions name, domain, distinguishedname to proper values
+            if ($GPOPermission.Trustee.Name) {
+                $DomainPlusName = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                if ($GPOPermission.Trustee.DSPath) {
+                    $NetbiosConversion = ConvertFrom-NetbiosName -Identity $DomainPlusName
+                    if ($NetbiosConversion.DomainName) {
+                        $UserNameDomain = $NetbiosConversion.DomainName
+                        $UserName = $NetbiosConversion.Name
                     }
                 } else {
-                    $ReturnObject['UserPrincipalName'] = ''
-                    $ReturnObject['AccountEnabled'] = ''
-                    $ReturnObject['PasswordLastSet'] = ''
-                    $ReturnObject['LastLogonDate'] = ''
+                    $UserNameDomain = ''
+                    $Username = $DomainPlusName
+                }
+            } else {
+                $DomainPlusName = ''
+                $UserNameDomain = ''
+                $Username = ''
+            }
+            #>
+
+            # I don't trust the returned data, some stuff like 'alias' shows up for groups. To unify it with everything else... using my own function
+            $PermissionAccount = Get-WinADObject -Identity $GPOPermission.Trustee.Sid.Value -AddType -Cache
+            if ($PermissionAccount) {
+                $UserNameDomain = $PermissionAccount.DomainName
+                $UserName = $PermissionAccount.Name
+                $SidType = $PermissionAccount.Type
+                $ObjectClass = $PermissionAccount.ObjectClass
+            } else {
+                $ConvertFromSID = ConvertFrom-SID -SID $GPOPermission.Trustee.Sid.Value
+                $UserNameDomain = ''
+                $Username = $ConvertFromSID.Name
+                $SidType = $ConvertFromSID.Type
+                if ($SidType -eq 'Unknown') {
+                    $ObjectClass = 'unknown'
+                } else {
+                    $ObjectClass = 'foreignSecurityPrincipal'
                 }
             }
+            $ReturnObject = [ordered] @{
+                DisplayName                = $GPO.DisplayName #      : ALL | Enable RDP
+                GUID                       = $GPO.ID
+                DomainName                 = $GPO.DomainName  #      : ad.evotec.xyz
+                Enabled                    = $GPO.GpoStatus
+                Description                = $GPO.Description
+                CreationDate               = $GPO.CreationTime
+                ModificationTime           = $GPO.ModificationTime
+                PermissionType             = if ($GPOPermission.Denied -eq $true) { 'Deny' } else { 'Allow' }
+                Permission                 = $GPOPermission.Permission  # : GpoEditDeleteModifySecurity
+                Inherited                  = $GPOPermission.Inherited   # : False
+                PrincipalNetBiosName       = $UserMerge
+                PrincipalDistinguishedName = $GPOPermission.Trustee.DSPath  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+                PrincipalDomainName        = $UserNameDomain  #: EVOTEC
+                PrincipalName              = $UserName    #: Domain Admins
+                PrincipalSid               = $GPOPermission.Trustee.Sid.Value     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+                PrincipalSidType           = $SidType #$GPOPermission.Trustee.SidType #: Group
+                PrincipalObjectClass       = $ObjectClass
+            }
+
+
             if ($IncludeGPOObject) {
                 $ReturnObject['GPOObject'] = $GPO
                 $ReturnObject['GPOSecurity'] = $SecurityRights
@@ -183,69 +211,139 @@
             }
             [PSCustomObject] $ReturnObject
         }
-        if ($IncludeOwner.IsPresent) {
+        if ($IncludeOwner) {
             if ($GPO.Owner) {
-                $SplittedOwner = $GPO.Owner.Split('\')
-                $DomainOwner = $SplittedOwner[0]  #: EVOTEC
-                $DomainUserName = $SplittedOwner[1]   #: Domain Admins
-                $SID = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].Sid.Value
-                if ($SID) {
-                    $SIDType = 'Group'
-                    $DistinguishedName = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].DistinguishedName
+                # I don't trust the returned data, some stuff like 'alias' shows up for groups. To unify it with everything else... using my own function
+                $OwnerAccount = Get-WinADObject -Identity $GPO.Owner -AddType -Cache
+                if ($OwnerAccount) {
+                    $UserNameDomain = $OwnerAccount.DomainName
+                    $UserName = $OwnerAccount.Name
+                    $SidType = $OwnerAccount.Type
+                    $OwnerObjectClass = $OwnerAccount.ObjectClass
+                    $SID = $OwnerAccount.ObjectSID
                 } else {
-                    $SIDType = ''
-                    $DistinguishedName = ''
+                    $ConvertFromSID = ConvertFrom-SID -SID $GPO.Owner
+                    $UserNameDomain = ''
+                    $Username = $ConvertFromSID.Name
+                    $SidType = $ConvertFromSID.Type
+                    if ($SidType -eq 'Unknown') {
+                        $OwnerObjectClass = 'unknown'
+                    } else {
+                        $OwnerObjectClass = 'foreignSecurityPrincipal'
+                    }
+                    $SID = $ConvertFromSID.SID
                 }
             } else {
-                $DomainOwner = $GPO.Owner
-                $DomainUserName = ''
+                $UserName = ''
+                $UserNameDomain = ''
                 $SID = ''
-                $SIDType = 'EmptyOrUnknown'
+                $SIDType = 'Unknown'
                 $DistinguishedName = ''
+                $OwnerObjectClass = 'unknown'
             }
-            $ReturnObject = [ordered] @{
-                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
-                GUID              = $GPO.Id
-                DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
-                Enabled           = $GPO.GpoStatus
-                Description       = $GPO.Description
-                CreationDate      = $GPO.CreationTime
-                ModificationTime  = $GPO.ModificationTime
-                Permission        = 'GpoOwner'  # : GpoEditDeleteModifySecurity
-                Inherited         = $false  # : False
-                Domain            = $DomainOwner
-                DistinguishedName = $DistinguishedName  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
-                Name              = $DomainUserName
-                Sid               = $SID     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
-                SidType           = $SIDType #  #: Group
-            }
-            if ($Accounts) {
-                $A = $GPO.Owner
-                if ($A -and $Accounts[$A]) {
-                    $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
-                    $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
-                    $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
-                    $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
-                    $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
-                    if (-not $ReturnObject['Sid']) {
-                        $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
-                    }
-                    if ($Accounts[$A].ObjectClass -eq 'group') {
-                        $ReturnObject['SidType'] = 'Group'
-                    } elseif ($Accounts[$A].ObjectClass -eq 'user') {
-                        $ReturnObject['SidType'] = 'User'
-                    } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
-                        $ReturnObject['SidType'] = 'Computer'
-                    } else {
-                        $ReturnObject['SidType'] = 'EmptyOrUnknown'
+            # We have to process it for owners after querying user because $Owners are not as established as standard permissions so we don't know a lot
+
+            if ($Type -contains 'Administrative' -and $Type -notcontains 'All') {
+                if ($SID) {
+                    $IsAdministrative = $ADAdministrativeGroups['BySID'][$SID]
+                    if (-not $IsAdministrative) {
+                        return
                     }
                 } else {
-                    $ReturnObject['UserPrincipalName'] = ''
-                    $ReturnObject['AccountEnabled'] = ''
-                    $ReturnObject['PasswordLastSet'] = ''
-                    $ReturnObject['LastLogonDate'] = ''
+                    # if there is no SID, it's not administrative
+                    return
                 }
             }
+            if ($Type -contains 'NotWellKnownAdministrative' -and $Type -notcontains 'All') {
+                # We check for SYSTEM account
+                # Maybe we should make it a function and provide more
+                if ($SID -eq 'S-1-5-18') {
+                    return
+                }
+            }
+            if ($Type -contains 'WellKnownAdministrative' -and $Type -notcontains 'All') {
+                # We check for SYSTEM account
+                # Maybe we should make it a function and provide more
+                if ($SID -ne 'S-1-5-18') {
+                    return
+                }
+            }
+            if ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
+                # May need updates if there's more types
+                if ($SidType -ne 'Unknown') {
+                    return
+                }
+            }
+            if ($Type -contains 'AuthenticatedUsers' -and $Type -notcontains 'All') {
+                if ($SID -ne 'S-1-5-11') {
+                    return
+                }
+            }
+            if ($Type -contains 'DomainComputers' -and $Type -notcontains 'All') {
+                $DomainComputersSID = -join ($ExtendedForestInformation['DomainsExtended'][$GPO.DomainName].DomainSID, '-515')
+                if ($SID -ne $DomainComputersSID) {
+                    return
+                }
+            }
+
+            if ($Principal) {
+                if ($PrincipalType -eq 'Sid') {
+                    if ($Principal -notcontains $SID) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'DistinguishedName') {
+                    if ($Principal -notcontains $DistinguishedName) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'Name') {
+                    if ($Principal -notcontains $UserName) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'NetbiosName') {
+                    if ($Principal -notcontains $GPO.Owner) {
+                        return
+                    }
+                }
+            }
+            if ($ExcludePrincipal) {
+                if ($ExcludePrincipalType -eq 'Sid') {
+                    if ($ExcludePrincipal -contains $SID) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'DistinguishedName') {
+                    if ($ExcludePrincipal -contains $DistinguishedName) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'Name') {
+                    if ($ExcludePrincipal -contains $UserName) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'NetbiosName') {
+                    if ($ExcludePrincipal -contains $GPO.Owner) {
+                        return
+                    }
+                }
+            }
+
+            $ReturnObject = [ordered] @{
+                DisplayName                = $GPO.DisplayName #      : ALL | Enable RDP
+                GUID                       = $GPO.Id
+                DomainName                 = $GPO.DomainName  #      : ad.evotec.xyz
+                Enabled                    = $GPO.GpoStatus
+                Description                = $GPO.Description
+                CreationDate               = $GPO.CreationTime
+                ModificationTime           = $GPO.ModificationTime
+                PermissionType             = 'Allow'
+                Permission                 = 'GpoOwner'  # : GpoEditDeleteModifySecurity
+                Inherited                  = $false  # : False
+                PrincipalNetBiosName       = $GPO.Owner
+                PrincipalDistinguishedName = $DistinguishedName  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+                PrincipalDomainName        = $UserNameDomain
+                PrincipalName              = $UserName
+                PrincipalSid               = $SID     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+                PrincipalSidType           = $SIDType #  #: Group
+                PrincipalObjectClass       = $OwnerObjectClass
+            }
             if ($IncludeGPOObject) {
                 $ReturnObject['GPOObject'] = $GPO
                 $ReturnObject['GPOSecurity'] = $SecurityRights

Private/Get-XMLGPO.ps1

@@ -5,15 +5,33 @@
         [Microsoft.GroupPolicy.Gpo] $GPO,
         [switch] $PermissionsOnly,
         [switch] $OwnerOnly,
-        [System.Collections.IDictionary] $ADAdministrativeGroups
+        [System.Collections.IDictionary] $ADAdministrativeGroups,
+        [string] $Splitter = [System.Environment]::NewLine
     )
     if ($XMLContent.GPO.LinksTo) {
-        $Linked = $true
-        $LinksCount = ([Array] $XMLContent.GPO.LinksTo).Count
+        $LinkSplit = ([Array] $XMLContent.GPO.LinksTo).Where( { $_.Enabled -eq $true }, 'Split')
+        [Array] $LinksEnabled = $LinkSplit[0]
+        [Array] $LinksDisabled = $LinkSplit[1]
+        $LinksEnabledCount = $LinksEnabled.Count
+        $LinksDisabledCount = $LinksDisabled.Count
+        $LinksTotalCount = ([Array] $XMLContent.GPO.LinksTo).Count
+        if ($LinksEnabledCount -eq 0) {
+            $Linked = $false
+        } else {
+            $Linked = $true
+        }
     } else {
         $Linked = $false
-        $LinksCount = 0
+        $LinksEnabledCount = 0
+        $LinksDisabledCount = 0
+        $LinksTotalCount = 0
     }
+    if ($null -eq $XMLContent.GPO.Computer.ExtensionData -and $null -eq $XMLContent.GPO.User.ExtensionData) {
+        $Empty = $true
+    } else {
+        $Empty = $false
+    }
+
 
     # Find proper values for enabled/disabled user/computer settings
     if ($XMLContent.GPO.Computer.Enabled -eq 'False') {
@@ -48,7 +66,7 @@
                 $OwnerType = 'NotAdministrative'
             }
         } else {
-            $OwnerType = 'EmptyOrUnknown'
+            $OwnerType = 'Unknown'
         }
     }
     if ($PermissionsOnly) {
@@ -98,8 +116,11 @@
             'DisplayName'                       = $XMLContent.GPO.Name
             'DomainName'                        = $XMLContent.GPO.Identifier.Domain.'#text'
             'GUID'                              = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+            'Empty'                             = $Empty
             'Linked'                            = $Linked
-            'LinksCount'                        = $LinksCount
+            'LinksCount'                        = $LinksTotalCount
+            'LinksEnabledCount'                 = $LinksEnabledCount
+            'LinksDisabledCount'                = $LinksDisabledCount
             'Enabled'                           = $Enabled
             'ComputerEnabled'                   = $ComputerEnabled
             'UserEnabled'                       = $UserEnabled
@@ -111,14 +132,11 @@
             'UserSettingsStatus'                = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
             'UserSettingsVersionIdentical'      = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
             'UserSettings'                      = $XMLContent.GPO.User.ExtensionData.Extension
-
-            ComputerPolicies                    = $XMLContent.GPO.Computer.ExtensionData.Name -join ", "
-            UserPolicies                        = $XMLContent.GPO.User.ExtensionData.Name -join ", "
-
+            'ComputerPolicies'                  = $XMLContent.GPO.Computer.ExtensionData.Name -join ", "
+            'UserPolicies'                      = $XMLContent.GPO.User.ExtensionData.Name -join ", "
             'CreationTime'                      = [DateTime] $XMLContent.GPO.CreatedTime
             'ModificationTime'                  = [DateTime] $XMLContent.GPO.ModifiedTime
             'ReadTime'                          = [DateTime] $XMLContent.GPO.ReadTime
-
             'WMIFilter'                         = $GPO.WmiFilter.name
             'WMIFilterDescription'              = $GPO.WmiFilter.Description
             'GPODistinguishedName'              = $GPO.Path
@@ -147,7 +165,14 @@
                 }
             )
             'Auditing'                          = if ($XMLContent.GPO.SecurityDescriptor.AuditingPresent.'#text' -eq 'true') { $true } else { $false }
-            'Links'                             = $XMLContent.GPO.LinksTo | ForEach-Object -Process {
+            'Links'                             = @(
+                $XMLContent.GPO.LinksTo | ForEach-Object -Process {
+                    if ($_) {
+                        $_.SOMPath
+                    }
+                }
+            ) -join $Splitter
+            'LinksObjects'                      = $XMLContent.GPO.LinksTo | ForEach-Object -Process {
                 if ($_) {
                     [PSCustomObject] @{
                         CanonicalName = $_.SOMPath
@@ -156,15 +181,6 @@
                     }
                 }
             }
-            <#
-        SOMName SOMPath       Enabled NoOverride
-        ------- -------       ------- ----------
-        ad      ad.evotec.xyz true    false
-        #>
-
-            #| Select-Object -ExpandProperty SOMPath
-
         }
     }
-    #break
 }

Private/Get-XMLNestedRegistry.ps1

@@ -0,0 +1,151 @@
+function Get-XMLNestedRegistry {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [System.Xml.XmlElement[]] $DataSet,
+        [string] $Collection,
+        [switch] $Limited
+    )
+    if ($DataSet.Properties) {
+        $Registry = $DataSet
+        foreach ($Registry in $DataSet) {
+            if ($Registry.Properties) {
+                if ($Limited) {
+                    [PSCustomObject] @{
+                        Collection      = $Collection
+                        Description     = $Registry.descr
+                        Changed         = try { [DateTime] $Registry.changed } catch { $Registry.changed };
+                        Disabled        = if ($Registry.disabled -eq '1') { $true } else { $false };
+                        GPOSettingOrder = [int] $Registry.GPOSettingOrder
+                        Action          = $Script:Actions[$Registry.Properties.action]
+                        DisplayDecimal  = if ($Registry.Properties.displayDecimal -eq '1') { $true } else { $false };
+                        Default         = if ($Registry.Properties.default -eq '1') { $true } else { $false };
+                        Hive            = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
+                        Key             = $Registry.Properties.key  #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+                        Name            = $Registry.Properties.name #: AutoAdminLogon
+                        Type            = $Registry.Properties.type #: REG_SZ
+                        Value           = $Registry.Properties.value #
+                        Filters         = $Registry.Filters
+                        BypassErrors    = if ($Registry.bypassErrors -eq '1') { $true } else { $false };
+                    }
+                } else {
+                    $CreateGPO = [ordered]@{
+                        DisplayName     = $GPO.DisplayName
+                        DomainName      = $GPO.DomainName
+                        GUID            = $GPO.GUID
+                        GpoType         = $GPO.GpoType
+                        #GpoCategory = $GPOEntry.GpoCategory
+                        #GpoSettings = $GPOEntry.GpoSettings
+                        Collection      = $Collection
+                        Description     = $Registry.descr
+                        Changed         = try { [DateTime] $Registry.changed } catch { $Registry.changed };
+                        Disabled        = if ($Registry.disabled -eq '1') { $true } else { $false };
+                        GPOSettingOrder = [int] $Registry.GPOSettingOrder
+                        Action          = $Script:Actions[$Registry.Properties.action]
+                        DisplayDecimal  = if ($Registry.Properties.displayDecimal -eq '1') { $true } else { $false };
+                        Default         = if ($Registry.Properties.default -eq '1') { $true } else { $false };
+                        Hive            = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
+                        Key             = $Registry.Properties.key  #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+                        Name            = $Registry.Properties.name #: AutoAdminLogon
+                        Type            = $Registry.Properties.type #: REG_SZ
+                        Value           = $Registry.Properties.value #
+                        Filters         = $Registry.Filters
+                        BypassErrors    = if ($Registry.bypassErrors -eq '1') { $true } else { $false };
+                    }
+                    $CreateGPO['Linked'] = $GPO.Linked
+                    $CreateGPO['LinksCount'] = $GPO.LinksCount
+                    $CreateGPO['Links'] = $GPO.Links
+                    [PSCustomObject] $CreateGPO
+                }
+            }
+        }
+    }
+    foreach ($Name in @('Registry', 'Collection')) {
+        foreach ($Registry in $DataSet.$Name) {
+            if ($Registry.Properties) {
+                if ($Limited) {
+                    [PSCustomObject] @{
+                        Collection      = $Collection
+                        Description     = $Registry.descr
+                        Changed         = try { [DateTime] $Registry.changed } catch { $Registry.changed };
+                        Disabled        = if ($Registry.disabled -eq '1') { $true } else { $false };
+                        GPOSettingOrder = [int] $Registry.GPOSettingOrder
+                        Action          = $Script:Actions[$Registry.Properties.action]
+                        DisplayDecimal  = if ($Registry.Properties.displayDecimal -eq '1') { $true } else { $false };
+                        Default         = if ($Registry.Properties.default -eq '1') { $true } else { $false };
+                        Hive            = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
+                        Key             = $Registry.Properties.key  #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+                        Name            = $Registry.Properties.name #: AutoAdminLogon
+                        Type            = $Registry.Properties.type #: REG_SZ
+                        Value           = $Registry.Properties.value #
+                        Filters         = $Registry.Filters
+                        BypassErrors    = if ($Registry.bypassErrors -eq '1') { $true } else { $false };
+                    }
+                } else {
+                    $CreateGPO = [ordered]@{
+                        DisplayName     = $GPO.DisplayName
+                        DomainName      = $GPO.DomainName
+                        GUID            = $GPO.GUID
+                        GpoType         = $GPO.GpoType
+                        #GpoCategory = $GPOEntry.GpoCategory
+                        #GpoSettings = $GPOEntry.GpoSettings
+                        Collection      = $Collection
+                        Description     = $Registry.descr
+                        Changed         = try { [DateTime] $Registry.changed } catch { $Registry.changed };
+                        Disabled        = if ($Registry.disabled -eq '1') { $true } else { $false };
+                        GPOSettingOrder = [int] $Registry.GPOSettingOrder
+                        Action          = $Script:Actions[$Registry.Properties.action]
+                        DisplayDecimal  = if ($Registry.Properties.displayDecimal -eq '1') { $true } else { $false }; ;
+                        Default         = if ($Registry.Properties.default -eq '1') { $true } else { $false };
+                        Hive            = $Registry.Properties.hive #: HKEY_LOCAL_MACHINE
+                        Key             = $Registry.Properties.key  #: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+                        Name            = $Registry.Properties.name #: AutoAdminLogon
+                        Type            = $Registry.Properties.type #: REG_SZ
+                        Value           = $Registry.Properties.value #
+                        Filters         = $Registry.Filters
+                        BypassErrors    = if ($Registry.bypassErrors -eq '1') { $true } else { $false };
+                    }
+                    $CreateGPO['Linked'] = $GPO.Linked
+                    $CreateGPO['LinksCount'] = $GPO.LinksCount
+                    $CreateGPO['Links'] = $GPO.Links
+                    [PSCustomObject] $CreateGPO
+                }
+            } else {
+                if ($Registry.Registry) {
+                    #if ($Registry.Name.Count -gt 1) {
+                    #Write-Verbose "Registry Name count more than 1"
+                    #}
+                    $TempCollection = $Collection
+                    if ($Collection) {
+                        $Collection = "$Collection/$($Registry.name)"
+                    } else {
+                        $Collection = $Registry.name
+                    }
+                    Get-XMLNestedRegistry -GPO $GPO -DataSet $Registry.Registry -Collection $Collection
+                    $Collection = $TempCollection
+                }
+                if ($Registry.Collection) {
+                    $TempCollection = $Collection
+                    #if ($Registry.Collection.Count -gt 1) {
+                    # Write-Verbose "Registry collection count more than 1"
+                    #}
+                    foreach ($MyCollection in $Registry.Collection) {
+                        if ($Collection) {
+                            #Write-Verbose "Collection1: $Collection - $($Registry.name) - $($MyCollection.name) - $($($MyCollection.name).Count)"
+                            $Collection = "$Collection/$($Registry.name)/$($MyCollection.name)"
+                            #Write-Verbose "Collection2: $Collection"
+                        } else {
+                            #Write-Verbose "Collection3: $Collection - $($Registry.name) - $($MyCollection.name)"
+                            $Collection = "$($Registry.name)/$($MyCollection.name)"
+                            #Write-Verbose "Collection4: $Collection"
+                        }
+
+                        Get-XMLNestedRegistry -GPO $GPO -DataSet $MyCollection -Collection $Collection
+                        $Collection = $TempCollection
+                    }
+                }
+            }
+        }
+
+    }
+}

Private/Get-XMLStandard.ps1

@@ -1,51 +0,0 @@
-function Get-XMLStandard {
-    [cmdletBinding()]
-    param(
-        [PSCustomObject] $GPO,
-        [System.Xml.XmlElement[]] $GPOOutput,
-        [string] $Splitter,
-        [switch] $FullObjects
-    )
-    $LinksInformation = Get-LinksFromXML -GPOOutput $GPOOutput -Splitter $Splitter -FullObjects:$FullObjects
-    foreach ($GpoType in @('User', 'Computer')) {
-        if ($GPOOutput.$GpoType.ExtensionData.Extension) {
-            foreach ($ExtensionType in $GPOOutput.$GpoType.ExtensionData.Extension) {
-                # It's possible that one of the ExtensionType records has value null. Weird but happend.
-                if ($ExtensionType) {
-                    $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
-                    try {
-                        $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] }
-                    } catch {
-                        Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
-                        continue
-                    }
-                    foreach ($GpoSettings in $KeysToLoop.Name) {
-                        foreach ($Key in $ExtensionType.$GpoSettings) {
-                            $Template = [ordered] @{
-                                DisplayName = $GPO.DisplayName
-                                DomainName  = $GPO.DomainName
-                                GUID        = $GPO.Guid
-                                GpoType     = $GpoType
-                                GpoCategory = $GPOSettingTypeSplit[1]
-                                GpoSettings = $GpoSettings
-                            }
-                            try {
-                                $Properties = ($Key | Get-Member -MemberType Properties -ErrorAction Stop).Name
-                            } catch {
-                                Write-Warning "Get-XMLStandard - things went sideways 1 $($_.Exception.Message)"
-                                $Properties = $null
-                            }
-                            foreach ($Property in $Properties) {
-                                $Template["$Property"] = $Key.$Property
-                            }
-                            $Template['Linked'] = $LinksInformation.Linked
-                            $Template['LinksCount'] = $LinksInformation.LinksCount
-                            $Template['Links'] = $LinksInformation.Links
-                            [PSCustomObject] $Template
-                        }
-                    }
-                }
-            }
-        }
-    }
-}

Private/Invoke-GPOTranslation.ps1

@@ -1,15 +0,0 @@
-function Invoke-GPOTranslation {
-    [cmdletBinding()]
-    param(
-        [System.Collections.IDictionary] $InputData,
-        [string] $Report,
-        [string] $Category,
-        [string] $Settings
-    )
-    if ($Category -and $Settings -and $InputData) {
-        if ($Script:GPODitionary[$Report]['Code']) {
-            $Script:GPOList = $InputData.$Category.$Settings
-            return & $Script:GPODitionary[$Report]['Code']
-        }
-    }
-}

Private/New-ADForestDrives.ps1

@@ -1,56 +0,0 @@
-function New-ADForestDrives {
-    [cmdletbinding()]
-    param(
-        [string] $ForestName,
-        [string] $ObjectDN
-    )
-    if (-not $Global:ADDrivesMapped) {
-        if ($ForestName) {
-            $Forest = Get-ADForest -Identity $ForestName
-        } else {
-            $Forest = Get-ADForest
-        }
-        if ($ObjectDN) {
-            # This doesn't work because no Domain and no $Server
-            $DNConverted = (ConvertFrom-Distinguishedname -DistinguishedName $ObjectDN -ToDC) -replace '=' -replace ','
-            if (-not(Get-PSDrive -Name $DNConverted -ErrorAction SilentlyContinue)) {
-                try {
-
-                    if ($Server) {
-                        $null = New-PSDrive -Name $DNConverted -Root '' -PsProvider ActiveDirectory -Server $Server.Hostname[0] -Scope Global -WhatIf:$false
-                        Write-Verbose "New-ADForestDrives - Mapped drive $Domain / $($Server.Hostname[0])"
-                    } else {
-                        $null = New-PSDrive -Name $DNConverted -Root '' -PsProvider ActiveDirectory -Server $Domain -Scope Global -WhatIf:$false
-                    }
-                } catch {
-                    Write-Warning "New-ADForestDrives - Couldn't map new AD psdrive for $Domain / $($Server.Hostname[0])"
-                }
-            }
-        } else {
-            foreach ($Domain in $Forest.Domains) {
-                try {
-                    $Server = Get-ADDomainController -Discover -DomainName $Domain
-                    $DomainInformation = Get-ADDomain -Server $Server.Hostname[0]
-                } catch {
-                    Write-Warning "New-ADForestDrives - Can't process domain $Domain - $($_.Exception.Message)"
-                    continue
-                }
-                $ObjectDN = $DomainInformation.DistinguishedName
-                $DNConverted = (ConvertFrom-Distinguishedname -DistinguishedName $ObjectDN -ToDC) -replace '=' -replace ','
-                if (-not(Get-PSDrive -Name $DNConverted -ErrorAction SilentlyContinue)) {
-                    try {
-                        if ($Server) {
-                            $null = New-PSDrive -Name $DNConverted -Root '' -PsProvider ActiveDirectory -Server $Server.Hostname[0] -Scope Global -WhatIf:$false
-                            Write-Verbose "New-ADForestDrives - Mapped drive $Domain / $Server"
-                        } else {
-                            $null = New-PSDrive -Name $DNConverted -Root '' -PsProvider ActiveDirectory -Server $Domain -Scope Global -WhatIf:$false
-                        }
-                    } catch {
-                        Write-Warning "New-ADForestDrives - Couldn't map new AD psdrive for $Domain / $Server $($_.Exception.Message)"
-                    }
-                }
-            }
-        }
-        $Global:ADDrivesMapped = $true
-    }
-}

Private/New-GPOZaurrReportConsole.ps1

@@ -0,0 +1,52 @@
+function New-GPOZaurrReportConsole {
+    param(
+        [System.Collections.IDictionary] $Results
+    )
+    Begin {
+        $GPODeny = @{
+            Color       = 'Yellow', 'Red', 'Yellow', 'Red'
+            StartSpaces = 6
+        }
+        $GPOSuccess = @{
+            Color       = 'Yellow', 'Green', 'Yellow', 'Green'
+            StartSpaces = 6
+        }
+        $WriteSummary = @{
+            Color       = 'Yellow', 'Blue'
+            StartSpaces = 3
+        }
+        $ComputerWhereApplied = ($Results.ComputerResults.GroupPolicies | Sort-Object -Property DomainName, Name).Where( { $_.Status -eq 'Applied' }, 'split')
+        $UserWhereApplied = ($Results.UserResults.GroupPolicies | Sort-Object -Property Name).Where( { $_.Status -eq 'Applied' }, 'split')
+    }
+    Process {
+        Write-Color -Text 'Computer Settings' -Color White -LinesBefore 1
+        Write-Color -Text '[>] Last time Group Policy was applied: ', $Results.ComputerResults.Summary.ReadTime @WriteSummary
+        Write-Color -Text '[>] Computer Name: ', $Results.ComputerResults.Summary.ComputerName @WriteSummary
+        Write-Color -Text '[>] Domain Name: ', $Results.ComputerResults.Summary.DomainName @WriteSummary
+        Write-Color -Text '[>] Organizational Unit: ', $Results.ComputerResults.Summary.OrganizationalUnit @WriteSummary
+        Write-Color -Text '[>] Site: ', $Results.ComputerResults.Summary.Site @WriteSummary
+        Write-Color -Text '[>] GPO Types: ', ($Results.ComputerResults.Summary.GPOTypes -replace [System.Environment]::NewLine, ', ') @WriteSummary
+        Write-Color -Text '[>] Slow link: ', ($Results.ComputerResults.Summary.SlowLink) @WriteSummary
+
+        Write-Color -Text 'Applied Group Policy Objects' -StartSpaces 3 -LinesBefore 1
+        foreach ($GPO in $ComputerWhereApplied[0]) {
+            Write-Color -Text '[+] [', $GPO.DomainName, '] ', $GPO.Name @GPOSuccess
+        }
+
+        Write-Color -Text 'Denied Group Policy Objects' -StartSpaces 3
+        foreach ($GPO in $ComputerWhereApplied[1]) {
+            Write-Color -Text '[-] [', $GPO.DomainName, '] ', $GPO.Name @GPODeny
+        }
+
+        Write-Color -Text 'User Settings' -Color Yellow -LinesBefore 1
+        Write-Color -Text 'Applied Group Policy Objects' -StartSpaces 3
+        foreach ($GPO in $UserWhereApplied[0] ) {
+            Write-Color -Text '[+] [', $GPO.DomainName, '] ', $GPO.Name @GPOSuccess
+        }
+
+        Write-Color -Text 'Denied Group Policy Objects' -StartSpaces 3
+        foreach ($GPO in $UserWhereApplied[1]) {
+            Write-Color -Text '[-] [', $GPO.DomainName, '] ', $GPO.Name @GPODeny
+        }
+    }
+}

Private/New-GPOZaurrReportHTML.ps1

@@ -0,0 +1,138 @@
+function New-GPOZaurrReportHTML {
+    [cmdletBinding()]
+    param(
+        [System.Collections.IDictionary] $Support,
+        [string] $Path,
+        [switch] $Offline,
+        [switch] $Open
+    )
+    $PSDefaultParameterValues = @{
+        "New-HTMLTable:WarningAction" = 'SilentlyContinue'
+    }
+    if (-not $Path) {
+        $Path = [io.path]::GetTempFileName().Replace('.tmp', ".html")
+    }
+    $ComputerName = $($Support.ResultantSetPolicy.LoggingComputer)
+    #$UserName = $($Support.ResultantSetPolicy.UserName)
+    #$LoggingMode = $($Support.ResultantSetPolicy.LoggingMode)
+    New-HTML -TitleText "Group Policy Report - $ComputerName" {
+        #New-HTMLTabOptions -SlimTabs -Transition -LinearGradient -SelectorColor Akaroa
+        New-HTMLTabOptions -SlimTabs `
+            -BorderBottomStyleActive solid -BorderBottomColorActive LightSkyBlue -BackgroundColorActive none `
+            -TextColorActive Black -Align left -BorderRadius 0px -RemoveShadow -TextColor Grey -TextTransform capitalize
+        New-HTMLTab -Name 'Information' {
+            New-HTMLTable -DataTable $Support.ResultantSetPolicy -HideFooter
+        }
+        foreach ($Key in $Support.Keys) {
+            if ($Key -eq 'ResultantSetPolicy') {
+                continue
+            }
+            New-HTMLTab -Name $Key {
+                New-HTMLTab -Name 'Summary' {
+                    New-HTMLSection -Invisible {
+                        New-HTMLSection -HeaderText 'Summary' {
+                            New-HTMLTable -DataTable $Support.$Key.Summary -Filtering -PagingOptions @(7, 14 )
+                            New-HTMLTable -DataTable $Support.$Key.SummaryDetails -Filtering -PagingOptions @(7, 14)
+                        }
+                        New-HTMLSection -HeaderText 'Part of Security Groups' {
+                            New-HTMLTable -DataTable $Support.$Key.SecurityGroups -Filtering -PagingOptions @(7, 14)
+                        }
+                    }
+                    <#
+                    New-HTMLSection -HeaderText 'Summary Downloads' {
+                        New-HTMLTable -DataTable $Support.$Key.SummaryDownload -HideFooter
+                    }
+                    #>
+                    New-HTMLSection -HeaderText 'Resultant Set Policy' {
+                        New-HTMLTable -DataTable $Support.$Key.ResultantSetPolicy -HideFooter
+                    }
+                }
+                New-HTMLTab -Name 'Group Policies' {
+                    New-HTMLSection -Invisible {
+                        <#
+                        New-HTMLSection -HeaderText 'Processing Time' {
+                            New-HTMLTable -DataTable $Support.$Key.ProcessingTime -Filtering
+                        }
+                        #>
+                        New-HTMLSection -HeaderText 'ExtensionStatus' {
+                            New-HTMLTable -DataTable $Support.$Key.ExtensionStatus -Filtering
+                        }
+                    }
+                    New-HTMLSection -HeaderText 'Group Policies' {
+                        New-HTMLTable -DataTable $Support.$Key.GroupPolicies -Filtering
+                    }
+                    New-HTMLSection -HeaderText 'Group Policies Links' {
+                        New-HTMLTable -DataTable $Support.$Key.GroupPoliciesLinks -Filtering
+                    }
+                    <#
+                    New-HTMLSection -HeaderText 'Group Policies Applied' {
+                        New-HTMLTable -DataTable $Support.$Key.GroupPoliciesApplied -Filtering
+                    }
+                    New-HTMLSection -HeaderText 'Group Policies Denied' {
+                        New-HTMLTable -DataTable $Support.$Key.GroupPoliciesDenied -Filtering
+                    }
+                    #>
+                }
+                New-HTMLTab -Name 'Extension Data' {
+                    New-HTMLSection -HeaderText 'Extension Data' {
+                        New-HTMLTable -DataTable $Support.$Key.ExtensionData -Filtering
+                    }
+                }
+                New-HTMLTab -Name 'Scope of Management' {
+                    New-HTMLSection -HeaderText 'Scope of Management' {
+                        New-HTMLTable -DataTable $Support.$Key.ScopeOfManagement -Filtering
+                    }
+                }
+                <#
+                New-HTMLTab -Name 'Events By ID' {
+                    foreach ($ID in $Support.$Key.EventsByID.Keys) {
+                        New-HTMLSection -HeaderText "Event ID $ID" {
+                            New-HTMLTable -DataTable $Support.$Key.EventsByID[$ID] -Filtering -AllProperties
+                        }
+                    }
+                }
+                New-HTMLTab -Name 'Events' {
+                    New-HTMLSection -HeaderText 'Events' {
+                        New-HTMLTable -DataTable $Support.$Key.Events -Filtering -AllProperties
+                    }
+                }
+                #>
+            }
+        }
+        if ($Support.ComputerResults.Results) {
+            New-HTMLTab -Name 'Details' {
+                foreach ($Detail in $Support.ComputerResults.Results.Keys) {
+                    $ShortDetails = $Support.ComputerResults.Results[$Detail]
+                    New-HTMLTab -Name $Detail {
+                        New-HTMLTab -Name 'Test' {
+                            New-HTMLSection -HeaderText 'Summary Downloads' {
+                                New-HTMLTable -DataTable $ShortDetails.SummaryDownload -HideFooter
+                            }
+                            New-HTMLSection -HeaderText 'Processing Time' {
+                                New-HTMLTable -DataTable $ShortDetails.ProcessingTime -Filtering
+                            }
+                            New-HTMLSection -HeaderText 'Group Policies Applied' {
+                                New-HTMLTable -DataTable $ShortDetails.GroupPoliciesApplied -Filtering
+                            }
+                            New-HTMLSection -HeaderText 'Group Policies Denied' {
+                                New-HTMLTable -DataTable $ShortDetails.GroupPoliciesDenied -Filtering
+                            }
+                        }
+                        New-HTMLTab -Name 'Events By ID' {
+                            foreach ($ID in $ShortDetails.EventsByID.Keys) {
+                                New-HTMLSection -HeaderText "Event ID $ID" {
+                                    New-HTMLTable -DataTable $ShortDetails.EventsByID[$ID] -Filtering -AllProperties
+                                }
+                            }
+                        }
+                        New-HTMLTab -Name 'Events' {
+                            New-HTMLSection -HeaderText 'Events' {
+                                New-HTMLTable -DataTable $ShortDetails.Events -Filtering -AllProperties
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    } -Online:(-not $Offline.IsPresent) -Open:$Open.IsPresent -FilePath $Path
+}

Private/Script.GPOPropertiesComputers.ps1

@@ -1,52 +0,0 @@
-$Script:GPOPropetiesComputers = [ordered] @{
-    'Account'                       = ''
-    'Audit'                         = ''
-    'AuditSetting'                  = ''
-    'AutoEnrollmentSettings'        = ''
-    'Blocked'                       = ''
-    'certSettingsTrustedPublishers' = ''
-    'DataSourcesSettings'           = ''
-    'DomainProfile'                 = ''
-    'Dot3SvcSetting'                = ''
-    'EFSRecoveryAgent'              = ''
-    'EFSSettings'                   = ''
-    'EnvironmentVariables'          = ''
-    'EventLog'                      = ''
-    'File'                          = ''
-    'FilesSettings'                 = ''
-    'Folders'                       = ''
-    'General'                       = ''
-    'Global'                        = ''
-    'GlobalSettings'                = ''
-    'InboundFirewallRules'          = ''
-    'IntermediateCACertificate'     = ''
-    'InternetZoneRule'              = ''
-    'LocalUsersAndGroups'           = ''
-    'MsiApplication'                = ''
-    'NetworkOptions'                = ''
-    'NetworkShares'                 = ''
-    'NTServices'                    = ''
-    'OutboundFirewallRules'         = ''
-    'PathRule'                      = ''
-    'Policy'                        = ''
-    'PowerOptions'                  = ''
-    'PrinterConnection'             = ''
-    'Printers'                      = ''
-    'PrivateProfile'                = ''
-    'PublicProfile'                 = ''
-    'Registry'                      = ''
-    'RegistrySetting'               = ''
-    'RegistrySettings'              = ''
-    'RestrictedGroups'              = ''
-    'RootCertificate'               = ''
-    'RootCertificateSettings'       = ''
-    'ScheduledTasks'                = ''
-    'Script'                        = ''
-    'SecurityOptions'               = ''
-    'ShortcutSettings'              = ''
-    'SystemServices'                = ''
-    'TrustedPublishersCertificate'  = ''
-    'type'                          = ''
-    'UserRightsAssignment'          = ''
-    'WLanSvcSetting'                = ''
-}

Private/Script.GPOPropertiesUsers.ps1

@@ -1,54 +0,0 @@
-$Script:GPOPropertiesUsers = [ordered] @{
-    'AutoDetectConfigSettings'     = ''
-    'AutoEnrollmentSettings'       = ''
-    'AutomaticConfiguration'       = ''
-    'AutoSetupSetting'             = ''
-    'Blocked'                      = ''
-    'BrowserTitle'                 = ''
-    'CustomSetupSetting'           = ''
-    'DataSourcesSettings'          = ''
-    'DefinesConnectionSettings'    = ''
-    'DefinesEscOffSettings'        = ''
-    'DefinesEscOnSettings'         = ''
-    'DeleteChannels'               = ''
-    'DriveMapSettings'             = ''
-    'EscOffLocalSites'             = ''
-    'EscOffSecurityZoneAndPrivacy' = ''
-    'EscOffTrustedSites'           = ''
-    'EscOnLocalSites'              = ''
-    'EscOnSecurityZoneAndPrivacy'  = ''
-    'EscOnTrustedSites'            = ''
-    'FavoriteURL'                  = ''
-    'FilesSettings'                = ''
-    'Folder'                       = ''
-    'FolderOptions'                = ''
-    'Folders'                      = ''
-    'General'                      = ''
-    'HomePage'                     = ''
-    'ImportedContentRatings'       = ''
-    'InternetOptions'              = ''
-    'LocalUsersAndGroups'          = ''
-    'MsiApplication'               = ''
-    'NetworkOptions'               = ''
-    'PathRule'                     = ''
-    'PlaceFavoritesAtTop'          = ''
-    'Policy'                       = ''
-    'PowerOptions'                 = ''
-    'PreferenceMode'               = ''
-    'PrinterConnection'            = ''
-    'Printers'                     = ''
-    'Programs'                     = ''
-    'ProxySettings'                = ''
-    'RegionalOptionsSettings'      = ''
-    'RegistrySetting'              = ''
-    'RegistrySettings'             = ''
-    'RestartSetupSetting'          = ''
-    'ScheduledTasks'               = ''
-    'Script'                       = ''
-    'SearchBar'                    = ''
-    'ShortcutSettings'             = ''
-    'StartMenuSettings'            = ''
-    'ToolsSetting'                 = ''
-    'TrustedPublisherLockdown'     = ''
-    'type'                         = ''
-}

Private/Test-SysvolFolders.ps1

@@ -3,14 +3,17 @@
     param(
         [Array] $GPOs,
         [string] $Server,
-        [string] $Domain
+        [string] $Domain,
+        [System.Collections.IDictionary] $PoliciesAD,
+        [string] $PoliciesSearchBase
     )
     $Differences = @{ }
     $SysvolHash = @{ }
 
     $GPOGUIDS = $GPOs.ID.GUID
+    $SysVolPath = "\\$($Server)\SYSVOL\$Domain\Policies"
     try {
-        $SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -ErrorAction Stop
+        $SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -Exclude 'PolicyDefinitions' -ErrorAction Stop
     } catch {
         $Sysvol = $Null
     }
@@ -22,12 +25,20 @@
     if ($Files) {
         $Comparing = Compare-Object -ReferenceObject $GPOGUIDS -DifferenceObject $Files -IncludeEqual
         foreach ($_ in $Comparing) {
+            if ($_.InputObject -eq 'PolicyDefinitions') {
+                # we skip policy definitions
+                continue
+            }
             if ($_.SideIndicator -eq '==') {
                 $Found = 'Exists'
             } elseif ($_.SideIndicator -eq '<=') {
                 $Found = 'Not available on SYSVOL'
             } elseif ($_.SideIndicator -eq '=>') {
-                $Found = 'Orphaned GPO'
+                if ($PoliciesAD[$_.InputObject]) {
+                    $Found = $PoliciesAD[$_.InputObject]
+                } else {
+                    $Found = 'Not available in AD'
+                }
             } else {
                 $Found = 'Orphaned GPO'
             }
@@ -49,68 +60,71 @@
                     $ErrorMessage = $_.Exception.Message
                 }
             } else {
+                $FullPath = -join ($SysVolPath, "\{$($GPO.Id.Guid)}")
                 $ACL = $null
+                $Owner = ''
+                $ErrorMessage = 'Not found on SYSVOL'
             }
             if ($null -eq $Differences[$GPO.Id.Guid]) {
-                $SysVolStatus = 'Not available on SYSVOL'
+                $SysVolStatus = 'Unknown Issue'
             } else {
                 $SysVolStatus = $Differences[$GPO.Id.Guid]
             }
             [PSCustomObject] @{
-                DisplayName      = $GPO.DisplayName
-                Status           = $Differences[$GPO.Id.Guid]
-                DomainName       = $GPO.DomainName
-                SysvolServer     = $Server
-                SysvolStatus     = $SysVolStatus
-                Owner            = $GPO.Owner
-                FileOwner        = $Owner
-                Id               = $GPO.Id.Guid
-                GpoStatus        = $GPO.GpoStatus
-                Path             = $FullPath
-                Description      = $GPO.Description
-                CreationTime     = $GPO.CreationTime
-                ModificationTime = $GPO.ModificationTime
-                UserVersion      = $GPO.UserVersion
-                ComputerVersion  = $GPO.ComputerVersion
-                WmiFilter        = $GPO.WmiFilter
-                Error            = $ErrorMessage
+                DisplayName       = $GPO.DisplayName
+                Status            = $SysVolStatus
+                DomainName        = $GPO.DomainName
+                SysvolServer      = $Server
+                SysvolStatus      = $SysVolStatus
+                GpoStatus         = $GPO.GpoStatus
+                Owner             = $GPO.Owner
+                FileOwner         = $Owner
+                Id                = $GPO.Id.Guid
+                Path              = $FullPath
+                DistinguishedName = -join ("CN={", $GPO.Id.Guid, "},", $PoliciesSearchBase)
+                Description       = $GPO.Description
+                CreationTime      = $GPO.CreationTime
+                ModificationTime  = $GPO.ModificationTime
+                UserVersion       = $GPO.UserVersion
+                ComputerVersion   = $GPO.ComputerVersion
+                WmiFilter         = $GPO.WmiFilter
+                Error             = $ErrorMessage
             }
         }
         # Now we need to list thru Sysvol files and fine those that do not exists as GPO and create dummy GPO objects to show orphaned gpos
         foreach ($_ in $Differences.Keys) {
-            if ($Differences[$_] -eq 'Orphaned GPO') {
-                if ($SysvolHash[$_].BaseName -notcontains 'PolicyDefinitions') {
-                    $FullPath = $SysvolHash[$_].FullName
-                    try {
-                        $ACL = Get-Acl -Path $FullPath -ErrorAction Stop
-                        $Owner = $ACL.Owner
-                        $ErrorMessage = ''
-                    } catch {
-                        Write-Warning "Get-GPOZaurrSysvol - ACL reading (2) failed for $FullPath with error: $($_.Exception.Message)"
-                        $ACL = $null
-                        $Owner = $null
-                        $ErrorMessage = $_.Exception.Message
-                    }
+            if ($Differences[$_] -in 'Not available in AD', 'Permissions issue') {
+                $FullPath = $SysvolHash[$_].FullName
+                try {
+                    $ACL = Get-Acl -Path $FullPath -ErrorAction Stop
+                    $Owner = $ACL.Owner
+                    $ErrorMessage = ''
+                } catch {
+                    Write-Warning "Get-GPOZaurrSysvol - ACL reading (2) failed for $FullPath with error: $($_.Exception.Message)"
+                    $ACL = $null
+                    $Owner = $null
+                    $ErrorMessage = $_.Exception.Message
+                }
 
-                    [PSCustomObject] @{
-                        DisplayName      = $SysvolHash[$_].BaseName
-                        Status           = 'Orphaned GPO'
-                        DomainName       = $Domain
-                        SysvolServer     = $Server
-                        SysvolStatus     = $Differences[$GPO.Id.Guid]
-                        Owner            = ''
-                        FileOwner        = $Owner
-                        Id               = $_
-                        GpoStatus        = 'Orphaned'
-                        Path             = $FullPath
-                        Description      = $null
-                        CreationTime     = $SysvolHash[$_].CreationTime
-                        ModificationTime = $SysvolHash[$_].LastWriteTime
-                        UserVersion      = $null
-                        ComputerVersion  = $null
-                        WmiFilter        = $null
-                        Error            = $ErrorMessage
-                    }
+                [PSCustomObject] @{
+                    DisplayName       = $SysvolHash[$_].BaseName
+                    Status            = $Differences[$_]
+                    DomainName        = $Domain
+                    SysvolServer      = $Server
+                    SysvolStatus      = 'Exists' #$Differences[$GPO.Id.Guid]
+                    GpoStatus         = $Differences[$_]
+                    Owner             = ''
+                    FileOwner         = $Owner
+                    Id                = $_
+                    Path              = $FullPath
+                    DistinguishedName = -join ("CN={", $_, "},", $PoliciesSearchBase)
+                    Description       = $null
+                    CreationTime      = $SysvolHash[$_].CreationTime
+                    ModificationTime  = $SysvolHash[$_].LastWriteTime
+                    UserVersion       = $null
+                    ComputerVersion   = $null
+                    WmiFilter         = $null
+                    Error             = $ErrorMessage
                 }
             }
         }

Public/Add-GPOPermission.ps1

@@ -3,7 +3,7 @@
     param(
         [validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
         [Microsoft.GroupPolicy.GPPermissionType] $IncludePermissionType,
-        [alias('Trustee')][Array] $Principal,
+        [alias('Trustee')][string] $Principal,
         [alias('TrusteeType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
         [validateSet('Allow', 'Deny')][string] $PermitType = 'Allow'
     )

Public/Clear-GPOZaurrSysvolDFSR.ps1

@@ -0,0 +1,46 @@
+function Clear-GPOZaurrSysvolDFSR {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [string[]] $ExcludeDomainControllers,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [alias('DomainControllers')][string[]] $IncludeDomainControllers,
+        [switch] $SkipRODC,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [int] $LimitProcessing = [int32]::MaxValue
+    )
+    # Based on https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/manually-clearing-the-conflictanddeleted-folder-in-dfsr/ba-p/395711
+    $StatusCodes = @{
+        '0' = 'Success' # MONITOR_STATUS_SUCCESS
+        '1' = 'Generic database error' #MONITOR_STATUS_GENERIC_DB_ERROR
+        '2' = 'ID record not found' # MONITOR_STATUS_IDRECORD_NOT_FOUND
+        '3' = 'Volume not found' # MONITOR_STATUS_VOLUME_NOT_FOUND
+        '4' = 'Access denied' #MONITOR_STATUS_ACCESS_DENIED
+        '5' = 'Generic error' #MONITOR_STATUS_GENERIC_ERROR
+    }
+
+    #WMIC.EXE /namespace:\\root\microsoftdfs path dfsrreplicatedfolderconfig get replicatedfolderguid, replicatedfoldername
+    #WMIC.EXE /namespace:\\root\microsoftdfs path dfsrreplicatedfolderinfo where "replicatedfolderguid='<RF GUID>'" call cleanupconflictdirectory
+    #WMIC.EXE /namespace:\\root\microsoftdfs path dfsrreplicatedfolderinfo where "replicatedfolderguid='70bebd41-d5ae-4524-b7df-4eadb89e511e'" call cleanupconflictdirectory
+
+    # https://docs.microsoft.com/en-us/previous-versions/windows/desktop/dfsr/dfsrreplicatedfolderinfo
+    $getGPOZaurrSysvolDFSRSplat = @{
+        Forest                    = $Forest
+        IncludeDomains            = $IncludeDomains
+        ExcludeDomains            = $ExcludeDomains
+        ExtendedForestInformation = $ExtendedForestInformation
+        ExcludeDomainControllers  = $ExcludeDomainControllers
+        IncludeDomainControllers  = $IncludeDomainControllers
+        SkipRODC                  = $SkipRODC
+    }
+    Get-GPOZaurrSysvolDFSR @getGPOZaurrSysvolDFSRSplat | Select-Object -First $LimitProcessing | ForEach-Object {
+        $Executed = Invoke-CimMethod -InputObject $_.DFSR -MethodName 'cleanupconflictdirectory' -CimSession $_.ComputerName
+        if ($Executed) {
+            [PSCustomObject] @{
+                Status       = $StatusCodes["$($Executed.ReturnValue)"]
+                ComputerName = $Executed.PSComputerName
+            }
+        }
+    }
+}

Public/ConvertFrom-CSExtension.ps1

@@ -0,0 +1,90 @@
+function ConvertFrom-CSExtension {
+    [cmdletBinding()]
+    param(
+        [string[]] $CSE,
+        [switch] $Limited
+    )
+    $GUIDs = @{
+        # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpreg/f0dba6b8-704f-45d5-999f-1a0a694a6df9
+        '{35378EAC-683F-11D2-A89A-00C04FBBCFA2}' = 'Client-side extension GUID (CSE GUID)'
+        '{0F6B957E-509E-11D1-A7CC-0000F87571E3}' = 'Tool Extension GUID (User Policy Settings)'
+        '{D02B1F73-3407-48AE-BA88-E8213C6761F1}' = 'Tool Extension GUID (User Policy Settings)'
+        '{0F6B957D-509E-11D1-A7CC-0000F87571E3}' = 'Tool Extension GUID (Computer Policy Settings)'
+        '{D02B1F72-3407-48AE-BA88-E8213C6761F1}' = 'Tool Extension GUID (Computer Policy Settings)'
+        '{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}' = 'Wireless Group Policy'
+        '{0E28E245-9368-4853-AD84-6DA3BA35BB75}' = 'Group Policy Environment'
+        '{16be69fa-4209-4250-88cb-716cf41954e0}' = 'Central Access Policy Configuration'
+        '{17D89FEC-5C44-4972-B12D-241CAEF74509}' = 'Group Policy Local Users and Groups'
+        '{1A6364EB-776B-4120-ADE1-B63A406A76B5}' = 'Group Policy Device Settings'
+        '{25537BA6-77A8-11D2-9B6C-0000F8080861}' = 'Folder Redirection'
+        '{2A8FDC61-2347-4C87-92F6-B05EB91A201A}' = 'MitigationOptions'
+        '{346193F5-F2FD-4DBD-860C-B88843475FD3}' = 'ConfigMgr User State Management Extension.'
+        '{3610eda5-77ef-11d2-8dc5-00c04fa31a66}' = 'Microsoft Disk Quota'
+        '{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}' = 'Group Policy Network Options'
+        '{426031c0-0b47-4852-b0ca-ac3d37bfcb39}' = 'QoS Packet Scheduler'
+        '{42B5FAAE-6536-11d2-AE5A-0000F87571E3}' = 'Scripts'
+        '{4bcd6cde-777b-48b6-9804-43568e23545d}' = 'Remote Desktop USB Redirection'
+        '{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}' = 'Internet Explorer Zonemapping'
+        '{4D2F9B6F-1E52-4711-A382-6A8B1A003DE6}' = 'RADCProcessGroupPolicyEx'
+        '{4d968b55-cac2-4ff5-983f-0a54603781a3}' = 'Work Folders'
+        '{5794DAFD-BE60-433f-88A2-1A31939AC01F}' = 'Group Policy Drive Maps'
+        '{6232C319-91AC-4931-9385-E70C2B099F0E}' = 'Group Policy Folders'
+        '{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}' = 'Group Policy Network Shares'
+        '{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}' = 'Group Policy Files'
+        '{728EE579-943C-4519-9EF7-AB56765798ED}' = 'Group Policy Data Sources'
+        '{74EE6C03-5363-4554-B161-627540339CAB}' = 'Group Policy Ini Files'
+        '{7933F41E-56F8-41d6-A31C-4148A711EE93}' = 'Windows Search Group Policy Extension'
+        '{7B849a69-220F-451E-B3FE-2CB811AF94AE}' = 'Internet Explorer User Accelerators'
+        '{827D319E-6EAC-11D2-A4EA-00C04F79F83A}' = 'Security'
+        '{8A28E2C5-8D06-49A4-A08C-632DAA493E17}' = 'Deployed Printer Connections'
+        '{91FBB303-0CD5-4055-BF42-E512A681B325}' = 'Group Policy Services'
+        '{A3F3E39B-5D83-4940-B954-28315B82F0A8}' = 'Group Policy Folder Options'
+        '{AADCED64-746C-4633-A97C-D61349046527}' = 'Group Policy Scheduled Tasks'
+        '{B087BE9D-ED37-454f-AF9C-04291E351182}' = 'Group Policy Registry'
+        '{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}' = '802.3 Group Policy'
+        '{BA649533-0AAC-4E04-B9BC-4DBAE0325B12}' = 'Windows To Go Startup Options'
+        '{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}' = 'Group Policy Printers'
+        '{C34B2751-1CF4-44F5-9262-C3FC39666591}' = 'Windows To Go Hibernate Options'
+        '{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}' = 'Group Policy Shortcuts'
+        '{C631DF4C-088F-4156-B058-4375F0853CD8}' = 'Microsoft Offline Files'
+        '{c6dc5466-785a-11d2-84d0-00c04fb169f7}' = 'Software Installation'
+        '{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}' = 'TCPIP'
+        '{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}' = 'Internet Explorer Machine Accelerators'
+        '{e437bc1c-aa7d-11d2-a382-00c04f991e27}' = 'IP Security'
+        '{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}' = 'Group Policy Internet Settings'
+        '{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}' = 'Group Policy Start Menu Settings'
+        '{E5094040-C46C-4115-B030-04FB2E545B00}' = 'Group Policy Regional Options'
+        '{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}' = 'Group Policy Power Options'
+        '{F312195E-3D9D-447A-A3F5-08DFFA24735E}' = 'ProcessVirtualizationBasedSecurityGroupPolicy'
+        '{f3ccc681-b74c-4060-9f26-cd84525dca2a}' = 'Audit Policy Configuration'
+        '{F9C77450-3A41-477E-9310-9ACD617BD9E3}' = 'Group Policy Applications'
+        '{FB2CA36D-0B40-4307-821B-A13B252DE56C}' = 'Enterprise QoS'
+        '{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}' = 'CP'
+        '{FC491EF1-C4AA-4CE1-B329-414B101DB823}' = 'ProcessConfigCIPolicyGroupPolicy'
+        '{169EBF44-942F-4C43-87CE-13C93996EBBE}' = 'UEV Policy'
+        '{2BFCC077-22D2-48DE-BDE1-2F618D9B476D}' = 'AppV Policy'
+        '{4B7C3B0F-E993-4E06-A241-3FBE06943684}' = 'Per-process Mitigation Options'
+        '{7909AD9E-09EE-4247-BAB9-7029D5F0A278}' = 'MDM Policy'
+        '{CFF649BD-601D-4361-AD3D-0FC365DB4DB7}' = 'Delivery Optimization GP extension'
+        '{D76B9641-3288-4f75-942D-087DE603E3EA}' = 'AdmPwd'
+        '{9650FDBC-053A-4715-AD14-FC2DC65E8330}' = 'Unknown'
+        '{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}' = 'EFS Recovery'
+        '{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}' = 'Internet Explorer Maintenance Policy Processing'
+        '{FC715823-C5FB-11D1-9EEF-00A0C90347FF}' = 'Internet Explorer Maintenance Extension Protocol' # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpie/f566a58a-4114-4981-b1e2-30b9d1a3c0e6
+    }
+    foreach ($C in $CSE) {
+        if (-not $Limited) {
+            if ($GUIDs[$C]) {
+                [PSCustomObject] @{ Name = $C; Description = $GUIDs[$C] }
+            } else {
+                [PSCustomObject] @{ Name = $C; Description = $C }
+            }
+        } else {
+            if ($GUIDs[$C]) {
+                $GUIDs[$C]
+            } else {
+                $CSE
+            }
+        }
+    }
+}

Public/Find-CSExtension.ps1

@@ -0,0 +1,21 @@
+function Find-CSExtension {
+    [cmdletBinding()]
+    param(
+        [string[]] $CSE,
+        [string] $ComputerName
+    )
+    #List Group Policy Client Side Extensions, CSEs, from Windows 10
+    $Keys = Get-PSRegistry -RegistryPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" -ComputerName $ComputerName
+    foreach ($Key in $Keys.PSSubKeys) {
+        $RegistryKey = Get-PSRegistry -RegistryPath "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\$Key" -ComputerName $ComputerName
+        if ($CSE) {
+            foreach ($C in $CSE) {
+                if ($RegistryKey.DefaultKey -eq $Key) {
+                    [PSCustomObject] @{ Name = $Key; Description = $RegistryKey.DefaultKey }
+                }
+            }
+        } else {
+            [PSCustomObject] @{ CSE = $Key; Description = $RegistryKey.DefaultKey }
+        }
+    }
+}

Public/Get-GPOZaurrFiles.ps1

@@ -3,12 +3,24 @@
     param(
         [ValidateSet('All', 'Netlogon', 'Sysvol')][string[]] $Type = 'All',
         [ValidateSet('None', 'MACTripleDES', 'MD5', 'RIPEMD160', 'SHA1', 'SHA256', 'SHA384', 'SHA512')][string] $HashAlgorithm = 'None',
+        [switch] $Signature,
+        [switch] $AsHashTable,
+        [switch] $Extended,
+        [switch] $ExtendedMetaData,
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
         [System.Collections.IDictionary] $ExtendedForestInformation
     )
+    $GPOCache = @{}
     $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    $GPOList = Get-GPOZaurrAD -ExtendedForestInformation $ForestInformation
+    foreach ($GPO in $GPOList) {
+        if (-not $GPOCache[$GPO.DomainName]) {
+            $GPOCache[$GPO.DomainName] = @{}
+        }
+        $GPOCache[$($GPO.DomainName)][($GPO.GUID)] = $GPO
+    }
     foreach ($Domain in $ForestInformation.Domains) {
         $Path = @(
             if ($Type -contains 'All') {
@@ -21,8 +33,298 @@
                 "\\$Domain\NETLOGON"
             }
         )
-        Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File | ForEach-Object {
-            Get-FileMetaData -File $_ -Signature -HashAlgorithm $HashAlgorithm
+        # Order does matter
+        $Folders = [ordered] @{
+            "\\$Domain\SYSVOL\$Domain\policies\PolicyDefinitions" = @{
+                Name = 'SYSVOL PolicyDefinitions'
+            }
+            "\\$Domain\SYSVOL\$Domain\policies"                   = @{
+                Name = 'SYSVOL Policies'
+            }
+            "\\$Domain\SYSVOL\$Domain\scripts"                    = @{
+                Name = 'NETLOGON Scripts'
+            }
+            "\\$Domain\SYSVOL\$Domain\StarterGPOs"                = @{
+                Name = 'SYSVOL GPO Starters'
+            }
+            "\\$Domain\NETLOGON"                                  = @{
+                Name = 'NETLOGON Scripts'
+            }
+            "\\$Domain\SYSVOL\$Domain\DfsrPrivate"                = @{
+                Name = 'DfsrPrivate'
+            }
+            "\\$Domain\SYSVOL\$Domain"                            = @{
+                Name = 'SYSVOL Root'
+            }
+        }
+        Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File -Force | ForEach-Object {
+            # Lets reset values just to be sure those are empty
+            $GPO = $null
+            $BelongsToGPO = $false
+            $GPODisplayName = $null
+            $SuggestedAction = $null
+            $SuggestedActionComment = $null
+            $FileType = foreach ($Key in $Folders.Keys) {
+                if ($_.FullName -like "$Key*") {
+                    $Folders[$Key]
+                    break
+                }
+            }
+            if ($FileType.Name -eq 'SYSVOL Policies') {
+                $FoundGUID = $_.FullName -match '[\da-zA-Z]{8}-([\da-zA-Z]{4}-){3}[\da-zA-Z]{12}'
+                if ($FoundGUID) {
+                    $GPO = $GPOCache[$Domain][$matches[0]]
+                    if ($GPO) {
+                        $BelongsToGPO = $true
+                        $GPODisplayName = $GPO.DisplayName
+                    }
+                }
+                $Correct = @(
+                    [System.IO.Path]::Combine($GPO.Path, 'GPT.INI')
+                    [System.IO.Path]::Combine($GPO.Path, 'GPO.cmt')
+                    [System.IO.Path]::Combine($GPO.Path, 'Group Policy', 'GPE.ini')
+                    foreach ($TypeM in @('Machine', 'User')) {
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Registry.pol')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'comment.cmtx')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Registry\Registry.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Printers\Printers.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\ScheduledTasks\ScheduledTasks.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Services\Services.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Groups\Groups.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\RegionalOptions\RegionalOptions.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\FolderOptions\FolderOptions.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Drives\Drives.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\InternetSettings\InternetSettings.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Folders\Folders.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\PowerOptions\PowerOptions.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Shortcuts\Shortcuts.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\Files\Files.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\EnvironmentVariables\EnvironmentVariables.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\NetworkOptions\NetworkOptions.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\DataSources\DataSources.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\NetworkShares\NetworkShares.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Preferences\StartMenuTaskbar\StartMenuTaskbar.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Applications\Microsoft\TBLayout.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Applications\Microsoft\DefaultApps.xml')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Applications\ADE.CFG')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Scripts\scripts.ini')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Scripts\psscripts.ini')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Documents & Settings\fdeploy.ini')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Documents & Settings\fdeploy1.ini')
+                        [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Documents & Settings\fdeploy2.ini')
+                        if ($_.Extension -eq '.aas') {
+                            [System.IO.Path]::Combine($GPO.Path, $TypeM, 'Applications', $_.Name)
+                        }
+                    }
+                    [System.IO.Path]::Combine($GPO.Path, 'Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf')
+                    [System.IO.Path]::Combine($GPO.Path, 'Machine\Microsoft\Windows NT\Audit\audit.csv')
+                )
+                if ($GPO) {
+                    if ($_.FullName -in $Correct) {
+                        $SuggestedAction = 'Skip assesment'
+                        $SuggestedActionComment = 'Correctly placed in SYSVOL'
+                    } elseif ($_.FullName -like '*_NTFRS_*') {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Most likely replication error'
+                    } elseif ($_.Extension -eq '.adm') {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Most likely legacy ADM files'
+                    }
+                    if (-not $SuggestedAction) {
+                        $FullPathAdmFiles = [System.IO.Path]::Combine($GPO.Path, 'Adm\admfiles.ini')
+                        if ($_.FullName -eq $FullPathAdmFiles) {
+                            $SuggestedAction = 'Consider deleting'
+                            $SuggestedActionComment = 'Most likely legacy ADM files settings file'
+                        }
+                    }
+                    if (-not $SuggestedAction) {
+                        foreach ($Ext in @('*old*', '*bak*', '*bck', '.new')) {
+                            if ($_.Extension -like $Ext) {
+                                $SuggestedAction = 'Consider deleting'
+                                $SuggestedActionComment = 'Most likely backup files'
+                                break
+                            }
+                        }
+                    }
+                    if (-not $SuggestedAction) {
+                        <#
+                        $IEAK = @(
+                            'microsoft\IEAK\install.ins'
+                            'MICROSOFT\IEAK\BRANDING\cs\connect.ras'
+                            'microsoft\IEAK\BRANDING\cs\connect.set'
+                            'microsoft\IEAK\BRANDING\cs\cs.dat'
+                            'microsoft\IEAK\BRANDING\ADM\inetcorp.iem'
+                            'microsoft\IEAK\BRANDING\ADM\inetcorp.inf'
+                            'microsoft\IEAK\install.ins'
+                            'microsoft\IEAK\BRANDING\favs\Outlook.ico'
+                            'microsoft\IEAK\BRANDING\favs\Bio.ico'
+                            'MICROSOFT\IEAK\BRANDING\favs\$fi380.ico'
+                            'microsoft\IEAK\BRANDING\PROGRAMS\programs.inf'
+                            'MICROSOFT\IEAK\BRANDING\RATINGS\ratings.inf'
+                            'MICROSOFT\IEAK\BRANDING\RATINGS\ratrsop.inf'
+                            'microsoft\IEAK\BRANDING\ZONES\seczones.inf'
+                            'microsoft\IEAK\BRANDING\ZONES\seczrsop.inf'
+                            'microsoft\IEAK\BRANDING\ZONES\seczrsop.inf'
+                        )
+                        #>
+                        if ($_.FullName -like '*microsoft\IEAK*') {
+                            # https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11#:~:text=The%20Internet%20Explorer%20Maintenance%20(IEM,Internet%20Explorer%2010%20or%20newer.
+                            $SuggestedAction = 'GPO requires cleanup'
+                            $SuggestedActionComment = 'Internet Explorer Maintenance (IEM) is deprecated for IE 11'
+                        }
+                    }
+                } else {
+                    <#
+                    $FullPathAdmFiles = [System.IO.Path]::Combine($GPO.Path, 'Adm\admfiles.ini')
+                    if ($_.FullName -in $Correct) {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Most likely orphaned SYSVOL GPO'
+                    } elseif ($_.Extension -eq '.adm') {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Most likely orphaned SYSVOL GPO (legacy ADM files)'
+                    } elseif ($_.FullName -eq $FullPathAdmFiles) {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Most likely orphaned SYSVOL GPO (legacy ADM files)'
+                    }
+                    #>
+                    $SuggestedAction = 'Consider deleting'
+                    $SuggestedActionComment = 'Most likely orphaned SYSVOL GPO'
+                }
+            } elseif ($FileType.Name -eq 'NETLOGON Scripts') {
+                foreach ($Ext in @('*old*', '*bak*', '*bck', '.new')) {
+                    if ($_.Extension -like $Ext) {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Most likely backup files'
+                        break
+                    }
+                }
+                if (-not $SuggestedAction) {
+                    # We didn't find it in earlier check, lets go deeper
+                    if ($_.Extension.Length -gt 6 -and $_.Extension -notin @('.config', '.sites', '.ipsec')) {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'Extension longer then 5 chars'
+                    } elseif ($_.Extension -eq '') {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'No extension'
+                    }
+                }
+                if (-not $SuggestedAction) {
+                    foreach ($Name in @('*old*', '*bak*', '*bck*', '*Copy', '*backup*')) {
+                        if ($_.BaseName -like $Name) {
+                            $SuggestedAction = 'Consider deleting'
+                            $SuggestedActionComment = "FileName contains backup related names ($Name)"
+                            break
+                        }
+                    }
+                }
+                if (-not $SuggestedAction) {
+                    foreach ($FullName in @('*backup*', '*Delete*', '*Obsoleet*', '*Obsolete*', '*Archive*')) {
+                        if ($_.FullName -like $FullName) {
+                            $SuggestedAction = 'Consider deleting'
+                            $SuggestedActionComment = "Fullname contains backup related names ($FullName)"
+                            break
+                        }
+                    }
+                }
+                if (-not $SuggestedAction) {
+                    # We replace all letters leaving only numbers
+                    # We want to find if there is a date possibly
+                    $StrippedNumbers = $_.Name -replace "[^0-9]" , ''
+                    if ($StrippedNumbers.Length -gt 5) {
+                        $SuggestedAction = 'Consider deleting'
+                        $SuggestedActionComment = 'FileName contains over 5 numbers (date?)'
+                    }
+                }
+            } elseif ($FileType.Name -eq 'SYSVOL PolicyDefinitions') {
+                if ($_.Extension -in @('.admx', '.adml')) {
+                    $SuggestedAction = 'Skip assesment'
+                    $SuggestedActionComment = 'Most likely ADMX templates'
+                }
+            } elseif ($FileType.Name -eq 'SYSVOL GPO Starters') {
+                $FoundGUID = $_.FullName -match '[\da-zA-Z]{8}-([\da-zA-Z]{4}-){3}[\da-zA-Z]{12}'
+                if ($FoundGUID) {
+                    $GUID = $matches[0]
+                    $TemporaryStarterPath = "\\$Domain\SYSVOL\$Domain\StarterGPOs\{$GUID}"
+                    $Correct = @(
+                        [System.IO.Path]::Combine($TemporaryStarterPath, 'StarterGPO.tmplx')
+                        [System.IO.Path]::Combine($TemporaryStarterPath, 'en-US', 'StarterGPO.tmpll')
+                        foreach ($TypeM in @('Machine', 'User')) {
+                            [System.IO.Path]::Combine($TemporaryStarterPath, $TypeM, 'Registry.pol')
+                            [System.IO.Path]::Combine($TemporaryStarterPath, $TypeM, 'comment.cmtx')
+                        }
+                    )
+                    if ($_.FullName -in $Correct) {
+                        $SuggestedAction = 'Skip assesment'
+                        $SuggestedActionComment = 'Correctly placed in SYSVOL'
+                    }
+                }
+            } else {
+
+            }
+            if (-not $SuggestedAction) {
+                $SuggestedAction = 'Requires verification'
+                $SuggestedActionComment = 'Not able to auto asses'
+            }
+            if (-not $ExtendedMetaData) {
+                $MetaData = [ordered] @{
+                    LocationType           = $FileType.Name
+                    FullName               = $_.FullName
+                    #Name                   = $_.Name
+                    Extension              = $_.Extension
+                    SuggestedAction        = $SuggestedAction
+                    SuggestedActionComment = $SuggestedActionComment
+                    BelongsToGPO           = $BelongsToGPO
+                    GPODisplayName         = $GPODisplayName
+                    Attributes             = $_.Attributes
+                    CreationTime           = $_.CreationTime
+                    LastAccessTime         = $_.LastAccessTime
+                    LastWriteTime          = $_.LastWriteTime
+                }
+            } else {
+                $MetaData = Get-FileMetaData -File $_ -AsHashTable
+                $MetaData['SuggestedAction'] = $SuggestedAction
+                $MetaData['SuggestedActionComment'] = $SuggestedActionComment
+                $MetaData['BelongsToGPO'] = $BelongsToGPO
+                $MetaData['GPODisplayName'] = $GPODisplayName
+            }
+            if ($Signature) {
+                try {
+                    $DigitalSignature = Get-AuthenticodeSignature -FilePath $_.Fullname -ErrorAction Stop
+                } catch {
+                    Write-Warning "Get-GPOZaurrFiles - Error when reading signature: $($_.Exception.Message)"
+                }
+                if ($DigitalSignature) {
+                    $MetaData['SignatureStatus'] = $DigitalSignature.Status
+                    $MetaData['IsOSBinary'] = $DigitalSignature.IsOSBinary
+                    $MetaData['SignatureCertificateSubject'] = $DigitalSignature.SignerCertificate.Subject
+                    if ($Extended) {
+                        $MetaData['SignatureCertificateIssuer'] = $DigitalSignature.SignerCertificate.Issuer
+                        $MetaData['SignatureCertificateSerialNumber'] = $DigitalSignature.SignerCertificate.SerialNumber
+                        $MetaData['SignatureCertificateNotBefore'] = $DigitalSignature.SignerCertificate.NotBefore
+                        $MetaData['SignatureCertificateNotAfter'] = $DigitalSignature.SignerCertificate.NotAfter
+                        $MetaData['SignatureCertificateThumbprint'] = $DigitalSignature.SignerCertificate.Thumbprint
+                    }
+                } else {
+                    $MetaData['SignatureStatus'] = 'Not available'
+                    $MetaData['IsOSBinary'] = $null
+                    $MetaData['SignatureCertificateSubject'] = $null
+                    if ($Extended) {
+                        $MetaData['SignatureCertificateIssuer'] = $null
+                        $MetaData['SignatureCertificateSerialNumber'] = $null
+                        $MetaData['SignatureCertificateNotBefore'] = $null
+                        $MetaData['SignatureCertificateNotAfter'] = $null
+                        $MetaData['SignatureCertificateThumbprint'] = $null
+                    }
+                }
+            }
+            if ($HashAlgorithm -ne 'None') {
+                $MetaData['ChecksumSHA256'] = (Get-FileHash -LiteralPath $_.FullName -Algorithm $HashAlgorithm).Hash
+            }
+            if ($AsHashTable) {
+                $MetaData
+            } else {
+                [PSCustomObject] $MetaData
+            }
         }
         foreach ($e in $err) {
             Write-Warning "Get-GPOZaurrFiles - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"

Public/Get-GPOZaurrFilesPolicyDefinition.ps1

@@ -0,0 +1,97 @@
+function Get-GPOZaurrFilesPolicyDefinition {
+    [alias('Get-GPOZaurrFilesPolicyDefinitions')]
+    [cmdletbinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [switch] $Signature
+    )
+    $Output = [ordered] @{
+        FilesToDelete = [System.Collections.Generic.List[Object]]::new()
+    }
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    $FilesCache = @{}
+    foreach ($Domain in $ForestInformation.Domains) {
+        $Output[$Domain] = [ordered] @{}
+        $FilesCache[$Domain] = [ordered] @{}
+        $Directories = Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies\PolicyDefinitions" -Directory -ErrorAction SilentlyContinue -ErrorVariable err
+        [Array] $Languages = foreach ($Directory in $Directories) {
+            if ($Directory.BaseName.Length -eq 5) {
+                $Directory.BaseName
+            }
+        }
+        $Files = Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies\PolicyDefinitions" -ErrorAction SilentlyContinue -ErrorVariable +err -File #| Select-Object Name, FullName, CreationTime, LastWriteTime, Attributes
+        foreach ($File in $Files) {
+            $FilesCache[$Domain][$($File.BaseName)] = [ordered] @{
+                Name           = $File.BaseName
+                FullName       = $File.FullName
+                IsReadOnly     = $File.IsReadOnly
+                CreationTime   = $File.CreationTime
+                LastAccessTime = $File.LastAccessTime
+                LastWriteTime  = $File.LastWriteTime
+                IsConsistent   = $false
+            }
+            foreach ($Language in $Languages) {
+                $FilesCache[$Domain][$($File.BaseName)][$Language] = $false
+            }
+            if ($Signature) {
+                $DigitalSignature = Get-AuthenticodeSignature -FilePath $File.FullName
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureStatus'] = $DigitalSignature.Status
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateSubject'] = $DigitalSignature.SignerCertificate.Subject
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateIssuer'] = $DigitalSignature.SignerCertificate.Issuer
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateSerialNumber'] = $DigitalSignature.SignerCertificate.SerialNumber
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateNotBefore'] = $DigitalSignature.SignerCertificate.NotBefore
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateNotAfter'] = $DigitalSignature.SignerCertificate.NotAfter
+                $FilesCache[$Domain][$($File.BaseName)]['SignatureCertificateThumbprint'] = $DigitalSignature.SignerCertificate.Thumbprint
+                $FilesCache[$Domain][$($File.BaseName)]['IsOSBinary'] = $DigitalSignature.IsOSBinary
+            }
+        }
+        foreach ($Directory in $Directories) {
+            $FilesLanguage = Get-ChildItem -Path $Directory.FullName -ErrorAction SilentlyContinue -ErrorVariable +err
+            foreach ($FileLanguage in $FilesLanguage) {
+                if ($FileLanguage.Extension -eq '.adml') {
+                    if ($FilesCache[$Domain][$FileLanguage.BaseName]) {
+                        $FilesCache[$Domain][$FileLanguage.BaseName][$Directory.Name] = $true
+                    } else {
+                        #Write-Warning "Get-GPOZaurrFilesPolicyDefinition - File $($FileLanguage.FullName) doesn't have a match."
+                        $Output.FilesToDelete.Add(
+                            [PSCustomobject] @{
+                                Name           = $FileLanguage.BaseName
+                                FullName       = $FileLanguage.FullName
+                                IsReadOnly     = $FileLanguage.IsReadOnly
+                                CreationTime   = $FileLanguage.CreationTime
+                                LastAccessTime = $FileLanguage.LastAccessTime
+                                LastWriteTime  = $FileLanguage.LastWriteTime
+                            }
+                        )
+                    }
+                } else {
+
+                }
+            }
+        }
+
+        foreach ($e in $err) {
+            Write-Warning "Get-GPOZaurrLegacy - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
+        }
+        $ExcludeProperty = @(
+            'Name', 'FullName', 'IsReadOnly', 'CreationTime', 'LastAccessTime', 'LastWriteTime', 'IsConsistent'
+            'SignatureCertificateSubject', 'SignatureCertificateIssuer', 'SignatureCertificateSerialNumber', 'SignatureCertificateNotBefore'
+            'SignatureCertificateNotAfter', 'SignatureCertificateThumbprint', 'SignatureStatus', 'IsOSBinary'
+        )
+        $Properties = Select-Properties -Objects $FilesCache[$Domain][0] -ExcludeProperty $ExcludeProperty
+        $Output[$Domain] = foreach ($File in $FilesCache[$Domain].Keys) {
+            $Values = foreach ($Property in $Properties) {
+                $FilesCache[$Domain][$File][$Property]
+            }
+            if ($Values -notcontains $false) {
+                $FilesCache[$Domain][$File]['IsConsistent'] = $true
+            }
+            [PSCustomObject] $FilesCache[$Domain][$File]
+        }
+    }
+    $Output
+}

Public/Get-GPOZaurrFolders.ps1

@@ -0,0 +1,140 @@
+function Get-GPOZaurrFolders {
+    [cmdletBinding()]
+    param(
+        [ValidateSet('All', 'Netlogon', 'Sysvol')][string[]] $Type = 'All',
+        [ValidateSet('All', 'NTFRS', 'Empty')][string] $FolderType = 'All',
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [switch] $AsHashTable
+    )
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        $Path = @(
+            if ($Type -contains 'All') {
+                "\\$Domain\SYSVOL\$Domain"
+            }
+            if ($Type -contains 'Sysvol') {
+                "\\$Domain\SYSVOL\$Domain\policies"
+            }
+            if ($Type -contains 'NetLogon') {
+                "\\$Domain\NETLOGON"
+            }
+        )
+        # Order does matter
+        $Folders = [ordered] @{
+            "\\$Domain\SYSVOL\$Domain\policies\PolicyDefinitions" = @{
+                Name = 'SYSVOL PolicyDefinitions'
+            }
+            "\\$Domain\SYSVOL\$Domain\policies"                   = @{
+                Name = 'SYSVOL Policies'
+            }
+            "\\$Domain\SYSVOL\$Domain\scripts"                    = @{
+                Name = 'NETLOGON Scripts'
+            }
+            "\\$Domain\SYSVOL\$Domain\StarterGPOs"                = @{
+                Name = 'SYSVOL GPO Starters'
+            }
+            "\\$Domain\NETLOGON"                                  = @{
+                Name = 'NETLOGON Scripts'
+            }
+            "\\$Domain\SYSVOL\$Domain\DfsrPrivate"                = @{
+                Name = 'DfsrPrivate'
+            }
+            "\\$Domain\SYSVOL\$Domain"                            = @{
+                Name = 'SYSVOL Root'
+            }
+        }
+        $Exclusions = @{
+            DfsrPrivate                = @{
+                ConflictAndDeleted = $true
+                Deleted            = $true
+                Installing         = $true
+            }
+            'SYSVOL Policies'          = @{
+                User    = $true
+                Machine = $true
+            }
+            'NETLOGON Scripts'         = @{
+
+            }
+            'SYSVOL Root'              = @{
+
+            }
+            'SYSVOL GPO Starters'      = @{
+
+            }
+            'SYSVOL PolicyDefinitions' = @{
+
+            }
+        }
+
+        Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable +err -Force -Directory | ForEach-Object {
+            $FileType = foreach ($Key in $Folders.Keys) {
+                if ($_.FullName -like "$Key*") {
+                    $Folders[$Key]
+                    break
+                }
+            }
+            $RootFolder = $Folders["$($_.FullName)"]
+            if ($RootFolder) {
+                $IsRootFolder = $true
+            } else {
+                $IsRootFolder = $false
+            }
+
+            $IsExcluded = $Exclusions["$($FileType.Name)"]["$($_.Name)"] -is [bool]
+            if ($IsRootFolder -and $IsExcluded -eq $false) {
+                $IsExcluded = $true
+            }
+
+            $FullFolder = Test-Path -Path "$($_.FullName)\*"
+            $BrokenReplicationRoot = $_.Name -like '*_NTFRS_*'
+            $BrokenReplicationChild = $_.FullName -like '*_NTFRS_*' -and $_.Name -notlike '*_NTFRS_*'
+            $BrokenReplication = $_.FullName -like '*_NTFRS_*'
+
+            $Object = [ordered] @{
+                FolderType               = $FileType.Name
+                FullName                 = $_.FullName
+                IsEmptyFolder            = -not $FullFolder
+                IsBrokenReplication      = $BrokenReplication
+                IsBrokenReplicationRoot  = $BrokenReplicationRoot
+                IsBrokenReplicationChild = $BrokenReplicationChild
+                IsRootFolder             = $IsRootFolder
+                IsExcluded               = $IsExcluded
+                Name                     = $_.Name
+                Root                     = $_.Root
+                Parent                   = $_.Parent
+                CreationTime             = $_.CreationTime
+                LastWriteTime            = $_.LastWriteTime
+                Attributes               = $_.Attributes
+                DomainName               = $Domain
+            }
+            if (-not $Object.IsExcluded) {
+                if ($FolderType -eq 'Empty' -and $Object.IsEmptyFolder -eq $true) {
+                    if ($AsHashTable) {
+                        $Object
+                    } else {
+                        [PSCustomObject] $Object
+                    }
+                } elseif ($FolderType -eq 'NTFRS' -and $Object.IsBrokenReplicationRoot -eq $true) {
+                    if ($AsHashTable) {
+                        $Object
+                    } else {
+                        [PSCustomObject] $Object
+                    }
+                } elseif ($FolderType -eq 'All') {
+                    if ($AsHashTable) {
+                        $Object
+                    } else {
+                        [PSCustomObject] $Object
+                    }
+                }
+            }
+        }
+    }
+    foreach ($e in $err) {
+        Write-Warning "Get-GPOZaurrFolders - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
+    }
+}