update

Examples/Example-01-BackupGPOs.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Backup GPOs
+$BackupPath = "$Env:UserProfile\Desktop\GPO"
+$GPOSummary = Backup-GPOZaurr -BackupPath $BackupPath -Verbose -Type EmptyAndUnlinked -BackupDated #-LimitProcessing 1
+$GPOSummary | Format-Table -AutoSize
+
+# Confirm GPOs are backed up properly
+Get-GPOZaurrBackupInformation -BackupFolder $GPOSummary[0].BackupDirectory | Format-Table -a

Examples/Example-02-RemoveEmptyAndUnlinkedGPOs.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Remove GPOS
+$BackupPath = "$Env:UserProfile\Desktop\GPO"
+Remove-GPOZaurr -Type EmptyAndUnlinked -BackupPath $BackupPath -BackupDated -LimitProcessing 2 -Verbose

Examples/Example-03-RestoreGPO.ps1

@@ -0,0 +1,14 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$RestoreFrom = 'C:\Users\przemyslaw.klys\Desktop\GPO\2020-04-02_20_20_04'
+
+$BackupInformation = Get-GPOZaurrBackupInformation -BackupFolder $RestoreFrom
+$BackupInformation | Format-Table -a
+
+# restore all gpos
+$RestoredGPOs = Restore-GPOZaurr -BackupFolder $RestoreFrom -Verbose
+$RestoredGPOs | Format-Table -AutoSize
+
+# restore just one Gpo
+$RestoredGPOs = Restore-GPOZaurr -BackupFolder $RestoreFrom -Verbose -DisplayName 'Users | Synced Office 365 Users'
+$RestoredGPOs | Format-Table -AutoSize

Examples/Example-04-GPOinformation.ps1

@@ -0,0 +1,12 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$GPOS = Get-GPOZaurr
+$GPOS | Format-Table -AutoSize
+
+$GPOS[0] | Format-List
+
+$GPOs[0].ACL | Format-Table -AutoSize
+
+$GPOs.Links | Format-Table -AutoSize
+
+$GPOS | Format-Table -AutoSize Name, WmiFilter, WMIDescription

Examples/Example-05-ListingWMIFilters.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrWMI | Format-Table -AutoSize *

Examples/Example-06-RemovingWMIFilters.ps1

@@ -0,0 +1,7 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# By default it deletes WMI filter in $Env:USERDNSDOMAIN if no Forest/IncludeDomains/ExcludeDomains are specified
+Remove-GPOZaurrWMI -Name 'Test' -WhatIf
+
+# If we want to remove it from all domains within forest
+Remove-GPOZaurrWMI -Name 'Test' -Forest 'ad.evotec.xyz' -WhatIf

Examples/Example-07-CreatingWMIFilters.ps1

@@ -0,0 +1,10 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# By default it creates WMI filter in $Env:USERDNSDOMAIN if no Forest/IncludeDomains/ExcludeDomains are specified
+New-GPOZaurrWMI -Query 'select * from Win32_OperatingSystem where Version like "6.0%" and ProductType = "3"' -Name 'Test' -Verbose -Force
+
+# If you want to force creation of same filter in all domains of a forest (this overwrites set value)
+#New-GPOZaurrWMI -Query 'select * from Win32_OperatingSystem where Version like "6.0%" and ProductType = "3"' -Name 'Test' -Verbose -Forest 'ad.evotec.xyz' -WhatIf
+
+# this will target different forest
+#New-GPOZaurrWMI -Query 'select * from Win32_OperatingSystem where Version like "6.0%" and ProductType = "3"' -Name 'Test' -Verbose -Forest 'test.evotec.pl' -WhatIf

Examples/Example-08-ListingPermissions.ps1

@@ -0,0 +1,16 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#$GPOS = Get-GPOZaurr
+#$GPOS | Format-Table -AutoSize
+
+#$GPOS[0] | Format-List
+
+#$GPOs[0].ACL | Format-Table -AutoSize
+
+#Get-GPOZaurrPermissions | Format-Table -AutoSize
+$T = Get-GPOZaurrPermissions #| Out-HtmlView
+#$T[0] | Format-List *
+$T | Format-Table -AutoSize
+#$T[0].Trustee
+#$T[0].Permission
+#$T[0]

GPOZaurr.psd1

@@ -1,122 +1,25 @@
-#
-# Module manifest for module 'GPOZaurr'
-#
-# Generated by: Przemyslaw Klys
-#
-# Generated on: 24.02.2020
-#
-
-@{
-
-    # Script module or binary module file associated with this manifest.
-    RootModule           = 'GPOZaurr.psm1'
-
-    # Version number of this module.
-    ModuleVersion        = '0.0.4'
-
-    # Supported PSEditions
-    CompatiblePSEditions = 'Desktop'
-
-    # ID used to uniquely identify this module
-    GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-
-    # Author of this module
+@{
+    AliasesToExport      = ''
     Author               = 'Przemyslaw Klys'
-
-    # Company or vendor of this module
     CompanyName          = 'Evotec'
-
-    # Copyright statement for this module
+    CompatiblePSEditions = 'Desktop'
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
-
-    # Description of the functionality provided by this module
     Description          = 'Group Policy Eater'
-
-    # Minimum version of the Windows PowerShell engine required by this module
+    FunctionsToExport    = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermissions', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles'
+    GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
+    ModuleVersion        = '0.0.7'
     PowerShellVersion    = '5.1'
-
-    # Name of the Windows PowerShell host required by this module
-    # PowerShellHostName = ''
-
-    # Minimum version of the Windows PowerShell host required by this module
-    # PowerShellHostVersion = ''
-
-    # Minimum version of Microsoft .NET Framework required by this module. This prerequisite is valid for the PowerShell Desktop edition only.
-    # DotNetFrameworkVersion = ''
-
-    # Minimum version of the common language runtime (CLR) required by this module. This prerequisite is valid for the PowerShell Desktop edition only.
-    # CLRVersion = ''
-
-    # Processor architecture (None, X86, Amd64) required by this module
-    # ProcessorArchitecture = ''
-
-    # Modules that must be imported into the global environment prior to importing this module
-    RequiredModules      = @(@{ModuleName = 'PSSharedGoods'; GUID = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'; ModuleVersion = '0.0.123'; })
-
-    # Assemblies that must be loaded prior to importing this module
-    # RequiredAssemblies = @()
-
-    # Script files (.ps1) that are run in the caller's environment prior to importing this module.
-    # ScriptsToProcess = @()
-
-    # Type files (.ps1xml) to be loaded when importing this module
-    # TypesToProcess = @()
-
-    # Format files (.ps1xml) to be loaded when importing this module
-    # FormatsToProcess = @()
-
-    # Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
-    # NestedModules = @()
-
-    # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
-    FunctionsToExport    = 'Get-GPOZaurr', 'Get-GPOZaurrPassword', 'Save-GPOZaurrFiles'
-
-    # Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
-    CmdletsToExport      = @()
-
-    # Variables to export from this module
-    # VariablesToExport = @()
-
-    # Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export.
-    AliasesToExport      = @()
-
-    # DSC resources to export from this module
-    # DscResourcesToExport = @()
-
-    # List of all modules packaged with this module
-    # ModuleList = @()
-
-    # List of all files packaged with this module
-    # FileList = @()
-
-    # Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell.
     PrivateData          = @{
-
         PSData = @{
-
-            # Tags applied to this module. These help with module discovery in online galleries.
-            Tags       = 'Windows', 'ActiveDirectory', 'GPO'
-
-            # A URL to the license for this module.
-            # LicenseUri = ''
-
-            # A URL to the main website for this project.
-            ProjectUri = 'https://github.com/EvotecIT/GPOZaurr'
-
-            # A URL to an icon representing this module.
-            # IconUri = ''
-
-            # ReleaseNotes of this module
-            # ReleaseNotes = ''
-
-        } # End of PSData hashtable
-
-    } # End of PrivateData hashtable
-
-    # HelpInfo URI of this module
-    # HelpInfoURI = ''
-
-    # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.
-    # DefaultCommandPrefix = ''
-
+            Tags                       = 'Windows', 'ActiveDirectory', 'GPO'
+            ProjectUri                 = 'https://github.com/EvotecIT/GPOZaurr'
+            ExternalModuleDependencies = 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
+        }
+    }
+    RequiredModules      = @{
+        ModuleVersion = '0.0.134'
+        ModuleName    = 'PSSharedGoods'
+        Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
+    }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
+    RootModule           = 'GPOZaurr.psm1'
 }

Private/ConvertTo-TableFormat.ps1

@@ -0,0 +1,45 @@
+function ConvertTo-TableFormat {
+    <#
+    .SYNOPSIS
+        Rebuild an object based on the Format Data for the object.
+    .DESCRIPTION
+        Allows an object to be rebuilt based on the view data for the object. Uses Select-Object to create a new PSCustomObject.
+    #>
+    [CmdletBinding()]
+    param (
+        [Parameter(ValueFromPipeline)]
+        [Object]$InputObject
+    )
+    begin {
+        $isFirst = $true
+    }
+    process {
+        $format = if ($isFirst) {
+            $formatData = Get-FormatData -TypeName $InputObject.PSTypeNames | Select-Object -First 1
+            if ($formatData) {
+                $viewDefinition = $formatData.FormatViewDefinition | Where-Object Control -match 'TableControl'
+
+                for ($i = 0; $i -lt $viewDefinition.Control.Headers.Count; $i++) {
+                    $name = $viewDefinition.Control.Headers[$i].Label
+
+                    $displayEntry = $viewDefinition.Control.Rows.Columns[$i].DisplayEntry
+                    if (-not $name) {
+                        $name = $displayEntry.Value
+                    }
+
+                    $expression = switch ($displayEntry.ValueType) {
+                        'Property' { $displayEntry.Value }
+                        'ScriptBlock' { [ScriptBlock]::Create($displayEntry.Value) }
+                    }
+
+                    @{ Name = $name; Expression = $expression }
+                }
+            }
+        }
+        if ($format) {
+            $InputObject | Select-Object -Property $format
+        } else {
+            $InputObject
+        }
+    }
+}

Private/Get-XMLGPO.ps1

@@ -1,7 +1,8 @@
 function Get-XMLGPO {
     [cmdletBinding()]
     param(
-        [XML] $XMLContent
+        [XML] $XMLContent,
+        [Microsoft.GroupPolicy.Gpo] $GPO
     )
     if ($XMLContent.GPO.LinksTo) {
         $Linked = $true
@@ -27,9 +28,9 @@
         $Enabled = 'Enabled'
     } elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $false) {
         $Enabled = 'All settings disabled'
-    }elseif ($UserEnabled -eq $true -and $ComputerEnabled -eq $false) {
+    } elseif ($UserEnabled -eq $true -and $ComputerEnabled -eq $false) {
         $Enabled = 'Computer configuration settings disabled'
-    }elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) {
+    } elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) {
         $Enabled = 'User configuration settings disabled'
     }
 
@@ -58,16 +59,37 @@
         'WMIFilter'                         = $GPO.WmiFilter.name
         'WMIFilterDescription'              = $GPO.WmiFilter.Description
         'Path'                              = $GPO.Path
-        #'SDDL'                      = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
+        'SDDL'                              = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
+        'Owner'                             = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+        'OwnerSID'                          = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
         'ACL'                               = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
-            [PsCustomObject] @{
-                'User'            = $_.trustee.name.'#Text'
-                'Permission Type' = $_.type.PermissionType
-                'Inherited'       = $_.Inherited
-                'Permissions'     = $_.Standard.GPOGroupedAccessEnum
+            if ($_) {
+                [PsCustomObject] @{
+                    'Name'           = $_.trustee.name.'#Text'
+                    'Sid'            = $_.trustee.SID.'#Text'
+                    'PermissionType' = $_.type.PermissionType
+                    'Inherited'      = $_.Inherited
+                    'Permissions'    = $_.Standard.GPOGroupedAccessEnum
+                }
             }
         }
-        'Links'                             = $XMLContent.GPO.LinksTo #| Select-Object -ExpandProperty SOMPath
+        'Auditing'                          = if ($XMLContent.GPO.SecurityDescriptor.AuditingPresent.'#text' -eq 'true') { $true } else { $false }
+        'Links'                             = $XMLContent.GPO.LinksTo | ForEach-Object -Process {
+            if ($_) {
+                [PSCustomObject] @{
+                    CanonicalName = $_.SOMPath
+                    Enabled       = $_.Enabled
+                    NoOverride    = $_.NoOverride
+                }
+            }
+        }
+        <#
+        SOMName SOMPath       Enabled NoOverride
+        ------- -------       ------- ----------
+        ad      ad.evotec.xyz true    false
+        #>
+
+        #| Select-Object -ExpandProperty SOMPath
 
     }
     #break

Private/Invoke-GPOZaurr.ps1

@@ -1,6 +0,0 @@
-function Invoke-GPOZaurr {
-    [cmdletBinding()]
-    param(
-
-    )
-}

Public/Backup-GPOZaurr.ps1

@@ -0,0 +1,92 @@
+function Backup-GPOZaurr {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [int] $LimitProcessing,
+        [validateset('All', 'Empty', 'Unlinked', 'EmptyAndUnlinked')][string] $Type = 'All',
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [string[]] $GPOPath,
+        [string] $BackupPath,
+        [switch] $BackupDated
+    )
+    Begin {
+        if ($BackupDated) {
+            $BackupFinalPath = "$BackupPath\$((Get-Date).ToString('yyyy-MM-dd_HH_mm_ss'))"
+        } else {
+            $BackupFinalPath = $BackupPath
+        }
+        Write-Verbose "Backup-GPOZaurr - Backing up to $BackupFinalPath"
+        $null = New-Item -ItemType Directory -Path $BackupFinalPath -Force
+        $Count = 0
+    }
+    Process {
+        Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOPath $GPOPath | ForEach-Object {
+            #$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+            #$GPOSummary = foreach ($GPO in $GPOs) {
+            #$QueryServer = $ForestInformation['QueryServers'][$_.Domain]['HostName'][0]
+            if ($Type -eq 'All') {
+                Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
+                $Count++
+                try {
+                    $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                    $BackupInfo
+                } catch {
+                    Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                }
+                if ($LimitProcessing -eq $Count) {
+                    break
+                }
+            } elseif ($Type -eq 'Empty') {
+                if ($_.ComputerSettingsAvailable -eq $false -and $_.UserSettingsAvailable -eq $false) {
+                    Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
+                    $Count++
+                    try {
+                        $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                        $BackupInfo
+                    } catch {
+                        Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                    }
+                    if ($LimitProcessing -eq $Count) {
+                        break
+                    }
+                }
+            } elseif ($Type -eq 'EmptyAndUnlinked') {
+                if ($_.ComputerSettingsAvailable -eq $false -and $_.UserSettingsAvailable -eq $false -or $_.Linked -eq $false) {
+                    Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
+                    $Count++
+                    try {
+                        $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                        $BackupInfo
+                    } catch {
+                        Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                    }
+                    if ($LimitProcessing -eq $Count) {
+                        break
+                    }
+                }
+            } elseif ($Type -eq 'Unlinked') {
+                if ($_.Linked -eq $false) {
+                    Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
+                    $Count++
+                    try {
+                        $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                        $BackupInfo
+                    } catch {
+                        Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                    }
+                    if ($LimitProcessing -eq $Count) {
+                        break
+                    }
+                }
+            }
+
+            #}
+            #$GPOSummary
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurr.ps1

@@ -7,26 +7,31 @@
         [System.Collections.IDictionary] $ExtendedForestInformation,
         [string[]] $GPOPath
     )
-    if (-not $GPOPath) {
-        if (-not $ExtendedForestInformation) {
-            $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
-        } else {
-            $ForestInformation = $ExtendedForestInformation
+    Begin {
+        if (-not $GPOPath) {
+            $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         }
-
-        foreach ($Domain in $ForestInformation.Domains) {
-            Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
-                $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
-                Get-XMLGPO -XMLContent $XMLContent
+    }
+    Process {
+        if (-not $GPOPath) {
+            foreach ($Domain in $ForestInformation.Domains) {
+                Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
+                    Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
+                    $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
+                    Get-XMLGPO -XMLContent $XMLContent -GPO $_
+                }
             }
-        }
-    } else {
-        foreach ($Path in $GPOPath) {
-            Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml | ForEach-Object {
-                $XMLContent = [XML]::new()
-                $XMLContent.Load($_.FullName)
-                Get-XMLGPO -XMLContent $XMLContent
+        } else {
+            foreach ($Path in $GPOPath) {
+                Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml | ForEach-Object {
+                    $XMLContent = [XML]::new()
+                    $XMLContent.Load($_.FullName)
+                    Get-XMLGPO -XMLContent $XMLContent
+                }
             }
         }
     }
-}
+    End {
+
+    }
+}

Public/Get-GPOZaurrBackupInformation.ps1

@@ -0,0 +1,35 @@
+function Get-GPOZaurrBackupInformation {
+    [cmdletBinding()]
+    param(
+        [string[]] $BackupFolder
+    )
+    Begin {
+
+    }
+    Process {
+        foreach ($Folder in $BackupFolder) {
+            if ($Folder) {
+                if ((Test-Path -LiteralPath "$Folder\manifest.xml")) {
+                    [xml] $Xml = Get-Content -LiteralPath "$Folder\manifest.xml"
+                    $Xml.Backups.BackupInst | ForEach-Object {
+                        [PSCustomObject] @{
+                            DisplayName      = $_.GPODisplayName.'#cdata-section'
+                            Domain           = $_.GPODomain.'#cdata-section'
+                            Guid             = $_.GPOGUid.'#cdata-section'
+                            DomainGuid       = $_.GPODomainGuid.'#cdata-section'
+                            DomainController = $_.GPODomainController.'#cdata-section'
+                            BackupTime       = $_.BackupTime.'#cdata-section'
+                            ID               = $_.ID.'#cdata-section'
+                            Comment          = $_.Comment.'#cdata-section'
+                        }
+                    }
+                } else {
+                    Write-Warning "Get-GPOZaurrBackupInformation - No backup information available"
+                }
+            }
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrPermissions.ps1

@@ -0,0 +1,75 @@
+function Get-GPOZaurrPermissions {
+    [cmdletBinding()]
+    param(
+        [switch] $SkipWellKnownGroup,
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+        Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
+            $GPO = $_
+
+            <#
+            DisplayName      : ALL | Enable RDP
+            DomainName       : ad.evotec.xyz
+            Owner            : EVOTEC\Domain Admins
+            Id               : 051bcddf-cc11-427b-bdf0-684c0a6e3ddb
+            GpoStatus        : AllSettingsEnabled
+            Description      :
+            CreationTime     : 07.08.2018 12:47:44
+            ModificationTime : 07.04.2020 22:09:24
+            UserVersion      : AD Version: 1, SysVol Version: 1
+            ComputerVersion  : AD Version: 1, SysVol Version: 1
+            WmiFilter        :
+            #>
+            Get-GPPermissions -Name $GPO.DisplayName -DomainName $GPO.DomainName -All -Server $QueryServer | ForEach-Object -Process {
+                $GPOPermission = $_
+                #$GPOPermissionFormatted = ConvertTo-TableFormat -InputObject $_
+                [PSCustomObject] @{
+                    DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
+                    GUID              = $GPO.ID
+                    DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
+                    Enabled           = $GPO.GpoStatus
+                    Description       = $GPO.Description
+                    CreationDate      = $GPO.CreationTime
+                    ModificationTime  = $GPO.ModificationTime
+                    #Owner             = $GPO.Owner       #      : EVOTEC\Domain Admins
+                    #Trustee     = $GPOPermission.Trustee     # : Domain Admins
+                    #TrusteeType       = $GPOPermissionFormatted.TrusteeType # # : Group
+                    Permission        = $GPOPermission.Permission  # : GpoEditDeleteModifySecurity
+                    Inherited         = $GPOPermission.Inherited   # : False
+                    Domain            = $GPOPermission.Trustee.Domain  #: EVOTEC
+                    DistinguishedName = $GPOPermission.Trustee.DSPath  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+                    Name              = $GPOPermission.Trustee.Name    #: Domain Admins
+                    Sid               = $GPOPermission.Trustee.Sid     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+                    SidType           = $GPOPermission.Trustee.SidType #: Group
+                }
+            }
+            $SplittedOwner = $GPO.Owner.Split('\')
+            [PSCustomObject] @{
+                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
+                GUID              = $GPO.GUID
+                DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
+                #Owner             = $GPO.Owner       #      : EVOTEC\Domain Admins
+                #Trustee     = $GPOPermission.Trustee     # : Domain Admins
+                #TrusteeType       = $GPOPermissionFormatted.TrusteeType # # : Group
+                Enabled           = $GPO.GpoStatus
+                Description       = $GPO.Description
+                CreationDate      = $GPO.CreationTime
+                ModificationTime  = $GPO.ModificationTime
+
+                Permission        = 'Owner'  # : GpoEditDeleteModifySecurity
+                Inherited         = $false  # : False
+                Domain            = $SplittedOwner[0]  #: EVOTEC
+                DistinguishedName = ''  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+                Name              = $SplittedOwner[1]   #: Domain Admins
+                Sid               = ''     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+                SidType           = '' #: Group
+            }
+        }
+    }
+}

Public/Get-GPOZaurrWmi.ps1

@@ -0,0 +1,125 @@
+function Get-GPOZaurrWMI {
+    [cmdletBinding()]
+    Param(
+        [Guid[]] $Guid,
+        [string[]] $Name,
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $wmiFilterAttr = "msWMI-Name", "msWMI-Parm1", "msWMI-Parm2", "msWMI-Author", "msWMI-ID", 'CanonicalName', 'Created', 'Modified'
+
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+        if ($Guid -or $Name) {
+            foreach ($N in $Name) {
+                try {
+                    $ldapFilter = "(&(objectClass=msWMI-Som)(msWMI-Name=$N))"
+                    Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
+                        $WMI = $_.'msWMI-Parm2' -split ';'
+                        [PSCustomObject] @{
+                            Name              = $_.'msWMI-Name'
+                            Description       = $_.'msWMI-Parm1'
+                            Domain            = $Domain
+                            NameSpace         = $WMI[5]
+                            Query             = $WMI[6]
+                            Author            = $_.'msWMI-Author'
+                            ID                = $_.'msWMI-ID'
+                            Created           = $_.Created
+                            Modified          = $_.Modified
+                            ObjectGUID        = $_.'ObjectGUID'
+                            CanonicalName     = $_.CanonicalName
+                            DistinguishedName = $_.'DistinguishedName'
+                        }
+                    }
+                } catch {
+                    Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
+                }
+            }
+            foreach ($G in $GUID) {
+                $ldapFilter = "(&(objectClass=msWMI-Som)(Name={$G}))"
+                try {
+                    Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
+                        $WMI = $_.'msWMI-Parm2' -split ';'
+                        [PSCustomObject] @{
+                            Name              = $_.'msWMI-Name'
+                            Description       = $_.'msWMI-Parm1'
+                            Domain            = $Domain
+                            NameSpace         = $WMI[5]
+                            Query             = $WMI[6]
+                            Author            = $_.'msWMI-Author'
+                            ID                = $_.'msWMI-ID'
+                            Created           = $_.Created
+                            Modified          = $_.Modified
+                            ObjectGUID        = $_.'ObjectGUID'
+                            CanonicalName     = $_.CanonicalName
+                            DistinguishedName = $_.'DistinguishedName'
+                        }
+                    }
+                } catch {
+                    Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
+                }
+            }
+        } else {
+            $ldapFilter = "(objectClass=msWMI-Som)"
+            try {
+                Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
+                    $WMI = $_.'msWMI-Parm2' -split ';'
+                    [PSCustomObject] @{
+                        Name              = $_.'msWMI-Name'
+                        Description       = $_.'msWMI-Parm1'
+                        Domain            = $Domain
+                        NameSpace         = $WMI[5]
+                        Query             = $WMI[6]
+                        Author            = $_.'msWMI-Author'
+                        ID                = $_.'msWMI-ID'
+                        Created           = $_.Created
+                        Modified          = $_.Modified
+                        ObjectGUID        = $_.'ObjectGUID'
+                        CanonicalName     = $_.CanonicalName
+                        DistinguishedName = $_.'DistinguishedName'
+                    }
+                }
+            } catch {
+                Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
+            }
+        }
+    }
+}
+<#
+CanonicalName                   : ad.evotec.xyz/System/WMIPolicy/SOM/{E988C890-BDBC-4946-87B5-BF70F39F4686}
+CN                              : {E988C890-BDBC-4946-87B5-BF70F39F4686}
+Created                         : 08.04.2020 19:04:06
+createTimeStamp                 : 08.04.2020 19:04:06
+Deleted                         :
+Description                     :
+DisplayName                     :
+DistinguishedName               : CN={E988C890-BDBC-4946-87B5-BF70F39F4686},CN=SOM,CN=WMIPolicy,CN=System,DC=ad,DC=evotec,DC=xyz
+dSCorePropagationData           : {01.01.1601 01:00:00}
+instanceType                    : 4
+isDeleted                       :
+LastKnownParent                 :
+Modified                        : 08.04.2020 19:04:06
+modifyTimeStamp                 : 08.04.2020 19:04:06
+msWMI-Author                    : przemyslaw.klys@evotec.pl
+msWMI-ChangeDate                : 20200408170406.280000-000
+msWMI-CreationDate              : 20200408170406.280000-000
+msWMI-ID                        : {E988C890-BDBC-4946-87B5-BF70F39F4686}
+msWMI-Name                      : Virtual Machines
+msWMI-Parm1                     : Oh my description
+msWMI-Parm2                     : 1;3;10;66;WQL;root\CIMv2;SELECT * FROM Win32_ComputerSystem WHERE Model = "Virtual Machine";
+Name                            : {E988C890-BDBC-4946-87B5-BF70F39F4686}
+nTSecurityDescriptor            : System.DirectoryServices.ActiveDirectorySecurity
+ObjectCategory                  : CN=ms-WMI-Som,CN=Schema,CN=Configuration,DC=ad,DC=evotec,DC=xyz
+ObjectClass                     : msWMI-Som
+ObjectGUID                      : c1ee708d-7a67-46e2-b13f-d11a573d2597
+ProtectedFromAccidentalDeletion : False
+sDRightsEffective               : 15
+showInAdvancedViewOnly          : True
+uSNChanged                      : 12785589
+uSNCreated                      : 12785589
+whenChanged                     : 08.04.2020 19:04:06
+whenCreated                     : 08.04.2020 19:04:06
+#>

Public/New-GPOZaurrWMi.ps1

@@ -0,0 +1,81 @@
+function New-GPOZaurrWMI {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [parameter(Mandatory)][string] $Name,
+        [string] $Description = ' ',
+        [parameter(Mandatory)][string] $Query,
+        [switch] $SkipQueryCheck,
+        [switch] $Force,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    if (-not $Forest -and -not $ExcludeDomains -and -not $IncludeDomains -and -not $ExtendedForestInformation) {
+        $IncludeDomains = $Env:USERDNSDOMAIN
+    }
+
+    if (-not $SkipQueryCheck) {
+        try {
+            $null = Get-CimInstance -Query $Query -ErrorAction Stop -Verbose:$false
+        } catch {
+            Write-Warning "New-GPOZaurrWMI - Query error $($_.Exception.Message). Terminating."
+            return
+        }
+    }
+
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+        $DomainInformation = Get-ADDomain -Server $QueryServer
+        $defaultNamingContext = $DomainInformation.DistinguishedName
+        #$defaultNamingContext = (Get-ADRootDSE).defaultnamingcontext
+        [string] $Author = (([ADSI]"LDAP://<SID=$([System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value)>").UserPrincipalName).ToString()
+        [string] $GUID = "{" + ([System.Guid]::NewGuid()) + "}"
+
+        [string] $DistinguishedName = -join ("CN=", $GUID, ",CN=SOM,CN=WMIPolicy,CN=System,", $defaultNamingContext)
+        $CurrentTime = (Get-Date).ToUniversalTime()
+        [string] $CurrentDate = -join (
+            ($CurrentTime.Year).ToString("0000"),
+            ($CurrentTime.Month).ToString("00"),
+            ($CurrentTime.Day).ToString("00"),
+            ($CurrentTime.Hour).ToString("00"),
+            ($CurrentTime.Minute).ToString("00"),
+            ($CurrentTime.Second).ToString("00"),
+            ".",
+            ($CurrentTime.Millisecond * 1000).ToString("000000"),
+            "-000"
+        )
+
+        [Array] $ExistingWmiFilter = Get-GPOZaurrWMI -ExtendedForestInformation $ForestInformation -IncludeDomains $Domain -Name $Name
+        if ($ExistingWmiFilter.Count -eq 0) {
+            [string] $WMIParm2 = -join ("1;3;10;", $Query.Length.ToString(), ";WQL;root\CIMv2;", $Query , ";")
+            $OtherAttributes = @{
+                "msWMI-Name"             = $Name
+                "msWMI-Parm1"            = $Description
+                "msWMI-Parm2"            = $WMIParm2
+                "msWMI-Author"           = $Author
+                "msWMI-ID"               = $GUID
+                "instanceType"           = 4
+                "showInAdvancedViewOnly" = "TRUE"
+                "distinguishedname"      = $DistinguishedName
+                "msWMI-ChangeDate"       = $CurrentDate
+                "msWMI-CreationDate"     = $CurrentDate
+            }
+            $WMIPath = -join ("CN=SOM,CN=WMIPolicy,CN=System,", $defaultNamingContext)
+
+            try {
+                Write-Verbose "New-GPOZaurrWMI - Creating WMI filter $Name in $Domain"
+                New-ADObject -name $GUID -type "msWMI-Som" -Path $WMIPath -OtherAttributes $OtherAttributes -Server $QueryServer
+            } catch {
+                Write-Warning "New-GPOZaurrWMI - Creating GPO filter error $($_.Exception.Message). Terminating."
+                return
+            }
+        } else {
+            foreach ($_ in $ExistingWmiFilter) {
+                Write-Warning "New-GPOZaurrWMI - Skipping creation of GPO because name: $($_.Name) guid: $($_.ID) for $($_.Domain) already exists."
+            }
+        }
+    }
+}

Public/Remove-GPOZaurr.ps1

@@ -0,0 +1,117 @@
+function Remove-GPOZaurr {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [parameter(Mandatory)][validateset('Empty', 'Unlinked', 'EmptyAndUnlinked')][string] $Type,
+        [int] $LimitProcessing,
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [string[]] $GPOPath,
+        [string] $BackupPath,
+        [switch] $BackupDated
+    )
+    Begin {
+        if ($BackupPath) {
+            $BackupRequired = $true
+            if ($BackupDated) {
+                $BackupFinalPath = "$BackupPath\$((Get-Date).ToString('yyyy-MM-dd_HH_mm_ss'))"
+            } else {
+                $BackupFinalPath = $BackupPath
+            }
+            Write-Verbose "Remove-GPOZaurr - Backing up to $BackupFinalPath"
+            $null = New-Item -ItemType Directory -Path $BackupFinalPath -Force
+        } else {
+            $BackupRequired = $false
+        }
+        $Count = 0
+    }
+    Process {
+        Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOPath $GPOPath | ForEach-Object {
+            #$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+
+            #$GPOSummary = foreach ($GPO in $GPOs) {
+            #$QueryServer = $ForestInformation['QueryServers'][$_.Domain]['HostName'][0]
+            if ($Type -eq 'Empty') {
+                if ($_.ComputerSettingsAvailable -eq $false -and $_.UserSettingsAvailable -eq $false) {
+                    if ($BackupRequired) {
+                        try {
+                            Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
+                            $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                            $BackupInfo
+                        } catch {
+                            Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+
+                        }
+                    }
+                    if (($BackupRequired -and $BackupInfo) -or (-not $BackupRequired)) {
+                        try {
+                            Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain)"
+                            Remove-GPO -Domain $_.Domain -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
+                        } catch {
+                            Write-Warning "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                        }
+                    }
+                    $Count++
+                    if ($LimitProcessing -eq $Count) {
+                        break
+                    }
+                }
+            } elseif ($Type -eq 'EmptyAndUnlinked') {
+                if ($_.ComputerSettingsAvailable -eq $false -and $_.UserSettingsAvailable -eq $false -or $_.Linked -eq $false) {
+
+                    if ($BackupRequired) {
+                        try {
+                            Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
+                            $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                            $BackupInfo
+                        } catch {
+                            Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                        }
+                    }
+                    if (($BackupRequired -and $BackupInfo) -or (-not $BackupRequired)) {
+                        try {
+                            Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain)"
+                            Remove-GPO -Domain $_.Domain -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
+                        } catch {
+                            Write-Warning "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                        }
+                    }
+                    $Count++
+                    if ($LimitProcessing -eq $Count) {
+                        break
+                    }
+                }
+            } elseif ($Type -eq 'Unlinked') {
+                if ($_.Linked -eq $false) {
+                    if ($BackupRequired) {
+                        try {
+                            Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
+                            $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                            $BackupInfo
+                        } catch {
+                            Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                        }
+                    }
+                    if (($BackupRequired -and $BackupInfo) -or (-not $BackupRequired)) {
+                        try {
+                            Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain)"
+                            Remove-GPO -Domain $_.Domain -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
+                        } catch {
+                            Write-Warning "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                        }
+                    }
+                    $Count++
+                    if ($LimitProcessing -eq $Count) {
+                        break
+                    }
+                }
+            }
+            #}
+            #$GPOSummary
+        }
+    }
+    End {
+
+    }
+}

Public/Remove-GPOZaurrWMI.ps1

@@ -0,0 +1,33 @@
+function Remove-GPOZaurrWMI {
+    [CmdletBinding(SupportsShouldProcess)]
+    Param (
+        [Guid[]] $Guid,
+        [string[]] $Name,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    if (-not $Forest -and -not $ExcludeDomains -and -not $IncludeDomains -and -not $ExtendedForestInformation) {
+        $IncludeDomains = $Env:USERDNSDOMAIN
+    }
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+        [Array] $Objects = @(
+            if ($Guid) {
+                Get-GPOZaurrWMI -Guid $Guid -ExtendedForestInformation $ForestInformation -IncludeDomains $Domain
+            }
+            if ($Name) {
+                Get-GPOZaurrWMI -Name $Name -ExtendedForestInformation $ForestInformation -IncludeDomains $Domain
+            }
+        )
+        $Objects | ForEach-Object -Process {
+            if ($_.DistinguishedName) {
+                Write-Verbose "Remove-GPOZaurrWMI - Removing WMI Filter $($_.DistinguishedName)"
+                Remove-ADObject $_.DistinguishedName -Confirm:$false -Server $QueryServer
+            }
+        }
+    }
+}

Public/Restore-GPOZaurr.ps1

@@ -0,0 +1,64 @@
+function Restore-GPOZaurr {
+    [cmdletBinding()]
+    param(
+        [parameter(Mandatory)][string] $BackupFolder,
+        [alias('Name')][string] $DisplayName,
+        [string] $NewDisplayName,
+        [string] $Domain,
+        [switch] $SkipBackupSummary
+    )
+    if ($BackupFolder) {
+        if (Test-Path -LiteralPath $BackupFolder) {
+            if ($DisplayName) {
+                if (-not $SkipBackupSummary) {
+                    $BackupSummary = Get-GPOZaurrBackupInformation -BackupFolder $BackupFolder
+                    if ($Domain) {
+                        [Array] $FoundGPO = $BackupSummary | Where-Object { $_.DisplayName -eq $DisplayName -and $_.Domain -eq $Domain }
+                    } else {
+                        [Array] $FoundGPO = $BackupSummary | Where-Object { $_.DisplayName -eq $DisplayName }
+                    }
+                    foreach ($GPO in $FoundGPO) {
+                        if ($NewDisplayName) {
+                            Import-GPO -Path $BackupFolder -BackupID $GPO.ID -Domain $GPO.Domain -TargetName $NewDisplayName -CreateIfNeeded
+                        } else {
+                            Write-Verbose "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.Domain) / BackupId: $($GPO.ID)"
+                            try {
+                                Restore-GPO -Path $BackupFolder -BackupID $GPO.ID -Domain $GPO.Domain
+                            } catch {
+                                Write-Warning "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.Domain) failed: $($_.Exception.Message)"
+                            }
+                        }
+                    }
+                } else {
+                    if ($Domain) {
+                        Write-Verbose "Restore-GPOZaurr - Restoring GPO $($Name) from $($Domain)"
+                        try {
+                            Restore-GPO -Path $BackupFolder -Name $Name -Domain $Domain
+                        } catch {
+                            Write-Warning "Restore-GPOZaurr - Restoring GPO $($Name) from $($Domain) failed: $($_.Exception.Message)"
+                        }
+                    } else {
+                        Write-Verbose "Restore-GPOZaurr - Restoring GPO $($Name)"
+                        try {
+                            Restore-GPO -Path $BackupFolder -Name $Name
+                        } catch {
+                            Write-Warning "Restore-GPOZaurr - Restoring GPO $($Name) failed: $($_.Exception.Message)"
+                        }
+                    }
+                }
+            } else {
+                $BackupSummary = Get-GPOZaurrBackupInformation -BackupFolder $BackupFolder
+                foreach ($GPO in $BackupSummary) {
+                    Write-Verbose "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.Domain) / BackupId: $($GPO.ID)"
+                    try {
+                        Restore-GPO -Path $BackupFolder -Domain $GPO.Domain -BackupId $GPO.ID
+                    } catch {
+                        Write-Warning "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.Domain) failed: $($_.Exception.Message)"
+                    }
+                }
+            }
+        } else {
+            Write-Warning "Restore-GPOZaurr - BackupFolder incorrect ($BackupFolder)"
+        }
+    }
+}

Public/Save-GPOZaurrFiles.ps1

@@ -5,7 +5,8 @@
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
         [System.Collections.IDictionary] $ExtendedForestInformation,
-        [string[]] $GPOPath
+        [string[]] $GPOPath,
+        [switch] $DeleteExisting
     )
     if ($GPOPath) {
         if (-not $ExtendedForestInformation) {
@@ -13,8 +14,18 @@
         } else {
             $ForestInformation = $ExtendedForestInformation
         }
+
+        if ($DeleteExisting) {
+            $Test = Test-Path -LiteralPath $GPOPath
+            if ($Test) {
+                Write-Verbose "Save-GPOZaurrFiles - Removing existing content in $GPOPath"
+                Remove-Item -LiteralPath $GPOPath -Recurse
+            }
+        }
+
         $null = New-Item -ItemType Directory -Path $GPOPath -Force
         foreach ($Domain in $ForestInformation.Domains) {
+            Write-Verbose "Save-GPOZaurrFiles - Processing GPO for $Domain"
             Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
                 $XMLContent = Get-GPOReport -ID $_.ID.Guid -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
                 $Path = [io.path]::Combine($GPOPath, "$($_.ID.Guid).xml")