PSD1 update

Examples/Example-40-ShowGPO01.ps1

@@ -1,7 +1,7 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$Output = Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Type GPOPassword -PassThru
+$Output = Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Type GPOList -PassThru
 $Output
 
 Write-Color -Text 'Output of nested report' -Color DarkYellow -LinesBefore 1 -LinesAfter 1
-$Output.GPOPassword
+$Output.GPOList

Examples/Example-40-ShowGPO02.ps1

@@ -1,3 +1,3 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Verbose -Type NetLogonPermissions, GPOOrphans, GPOList, GPOConsistency,GPOOwners
+Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Type NetLogonPermissions, GPOOrphans, GPOList, GPOConsistency, GPOOwners, GPODuplicates

Examples/Example-40-ShowGPO4.ps1

@@ -0,0 +1,15 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Types = @(
+    @{ Name = 'GPOOwners'; Path = "$PSScriptRoot\Reports\GPOOwners.html" }
+    @{ Name = 'GPOConsistency'; Path = "$PSScriptRoot\Reports\GPOConsistency.html" }
+    @{ Name = 'GPODuplicates'; Path = "$PSScriptRoot\Reports\GPODuplicates.html" }
+    @{ Name = 'GPOList'; Path = "$PSScriptRoot\Reports\GPOList.html" }
+    @{ Name = 'GPOOrphans'; Path = "$PSScriptRoot\Reports\GPOOrphans.html" }
+    @{ Name = 'GPOPassword'; Path = "$PSScriptRoot\Reports\GPOPassword.html" }
+    @{ Name = 'NetLogonPermissions'; Path = "$PSScriptRoot\Reports\NetLogonPermissions.html" }
+)
+
+foreach ($Type in $Types) {
+    Invoke-GPOZaurr -FilePath $Type.Path -Type $Type.Name -HideHTML
+}

Examples/Example-43-OptimizeGPO.ps1

@@ -0,0 +1,2 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+

GPOZaurr.psd1

@@ -6,9 +6,9 @@
     CompatiblePSEditions = @('Desktop')
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
-    FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner')
+    FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.73'
+    ModuleVersion        = '0.0.76'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -18,11 +18,11 @@
         }
     }
     RequiredModules      = @(@{
-            ModuleVersion = '0.0.186'
+            ModuleVersion = '0.0.187'
             ModuleName    = 'PSSharedGoods'
             Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
         }, @{
-            ModuleVersion = '0.0.100'
+            ModuleVersion = '0.0.102'
             ModuleName    = 'ADEssentials'
             Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
         }, @{

Private/Get-XMLGPO.ps1

@@ -6,7 +6,8 @@
         [switch] $PermissionsOnly,
         [switch] $OwnerOnly,
         [System.Collections.IDictionary] $ADAdministrativeGroups,
-        [string] $Splitter = [System.Environment]::NewLine
+        [string] $Splitter = [System.Environment]::NewLine,
+        [switch] $ReturnObject
     )
     if ($XMLContent.GPO.LinksTo) {
         $LinkSplit = ([Array] $XMLContent.GPO.LinksTo).Where( { $_.Enabled -eq $true }, 'Split')
@@ -215,6 +216,7 @@
                     }
                 }
             }
+            'GPOObject'                         = $GPO
         }
     }
 }

Public/Get-GPOZaurr.ps1

@@ -13,7 +13,7 @@
         [switch] $PermissionsOnly,
         [switch] $OwnerOnly,
         [switch] $Limited,
-
+        [switch] $ReturnObject,
         [System.Collections.IDictionary] $ADAdministrativeGroups
     )
     Begin {
@@ -43,7 +43,7 @@
                                 Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
                                 continue
                             }
-                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups -ReturnObject:$ReturnObject.IsPresent
                         } else {
                             $_
                         }
@@ -61,7 +61,7 @@
                                 Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
                                 continue
                             }
-                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups -ReturnObject:$ReturnObject.IsPresent
                         } else {
                             $_
                         }
@@ -79,7 +79,7 @@
                                 Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
                                 continue
                             }
-                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups -ReturnObject:$ReturnObject.IsPresent
                         } else {
                             $_
                         }

Public/Get-GPOZaurrNetlogon.ps1

@@ -13,9 +13,16 @@
     $FilesAll = foreach ($Domain in $ForestInformation.Domains) {
         $Path = -join ("\\", $Domain, '\Netlogon')
         $PathOnSysvol = -join ("\\", $Domain, "\SYSVOL\", $Domain, "\Scripts")
-        $Files = Get-ChildItem -LiteralPath $Path -Recurse -Force
-        foreach ($_ in $Files) {
-            $ACL = Get-Acl -Path $_.FullName
+        $Files = Get-ChildItem -LiteralPath $Path -Recurse -Force -ErrorVariable Err -ErrorAction SilentlyContinue
+        foreach ($e in $err) {
+            Write-Warning "Get-GPOZaurrNetLogon - Listing file failed with error $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
+        }
+        foreach ($File in $Files) {
+            try {
+                $ACL = Get-Acl -Path $File.FullName -ErrorAction Stop
+            } catch {
+                Write-Warning "Get-GPOZaurrNetLogon - ACL reading failed for $($File.FullName) with error $($_.Exception.Message) ($($_.CategoryInfo.Reason))"
+            }
             if ($ACL.Owner) {
                 $IdentityOwner = Convert-Identity -Identity $ACL.Owner -Verbose:$false
             } else {
@@ -24,19 +31,19 @@
             if (-not $OwnerOnly) {
                 if (-not $SkipOwner) {
                     [PSCustomObject] @{
-                        FullName          = $_.FullName
-                        Extension         = $_.Extension
-                        CreationTime      = $_.CreationTime
-                        LastAccessTime    = $_.LastAccessTime
-                        LastWriteTime     = $_.LastWriteTime
-                        Attributes        = $_.Attributes
+                        FullName          = $File.FullName
+                        Extension         = $File.Extension
+                        CreationTime      = $File.CreationTime
+                        LastAccessTime    = $File.LastAccessTime
+                        LastWriteTime     = $File.LastWriteTime
+                        Attributes        = $File.Attributes
                         AccessControlType = 'Allow' # : Allow
                         Principal         = $IdentityOwner.Name         # : BUILTIN\Administrators
                         PrincipalSid      = $IdentityOwner.SID
                         PrincipalType     = $IdentityOwner.Type
                         FileSystemRights  = 'Owner'  # : FullControl
                         IsInherited       = $false
-                        FullNameOnSysVol  = $_.FullName.Replace($Path, $PathOnSysvol)
+                        FullNameOnSysVol  = $File.FullName.Replace($Path, $PathOnSysvol)
                         #Owner             = $ACL.Owner
                     }
                 }
@@ -44,33 +51,33 @@
                 foreach ($Perm in $FilePermission) {
                     $Identity = Convert-Identity -Identity $Perm.Principal -Verbose:$false
                     [PSCustomObject] @{
-                        FullName          = $_.FullName
-                        Extension         = $_.Extension
-                        CreationTime      = $_.CreationTime
-                        LastAccessTime    = $_.LastAccessTime
-                        LastWriteTime     = $_.LastWriteTime
-                        Attributes        = $_.Attributes
+                        FullName          = $File.FullName
+                        Extension         = $File.Extension
+                        CreationTime      = $File.CreationTime
+                        LastAccessTime    = $File.LastAccessTime
+                        LastWriteTime     = $File.LastWriteTime
+                        Attributes        = $File.Attributes
                         AccessControlType = $Perm.AccessControlType # : Allow
                         Principal         = $Identity.Name         # : BUILTIN\Administrators
                         PrincipalSid      = $Identity.SID
                         PrincipalType     = $Identity.Type
                         FileSystemRights  = $Perm.FileSystemRights  # : FullControl
                         IsInherited       = $Perm.IsInherited       # : True
-                        FullNameOnSysVol  = $_.FullName.Replace($Path, $PathOnSysvol)
+                        FullNameOnSysVol  = $File.FullName.Replace($Path, $PathOnSysvol)
                     }
                 }
             } else {
                 [PSCustomObject] @{
-                    FullName         = $_.FullName
-                    Extension        = $_.Extension
-                    CreationTime     = $_.CreationTime
-                    LastAccessTime   = $_.LastAccessTime
-                    LastWriteTime    = $_.LastWriteTime
-                    Attributes       = $_.Attributes
+                    FullName         = $File.FullName
+                    Extension        = $File.Extension
+                    CreationTime     = $File.CreationTime
+                    LastAccessTime   = $File.LastAccessTime
+                    LastWriteTime    = $File.LastWriteTime
+                    Attributes       = $File.Attributes
                     Owner            = $IdentityOwner.Name
                     OwnerSid         = $IdentityOwner.SID
                     OwnerType        = $IdentityOwner.Type
-                    FullNameOnSysVol = $_.FullName.Replace($Path, $PathOnSysvol)
+                    FullNameOnSysVol = $File.FullName.Replace($Path, $PathOnSysvol)
                 }
             }
         }

Public/Get-GPOZaurrPermissionConsistency.ps1

@@ -47,15 +47,20 @@
                 $GPO = $_
                 $Count++
                 Write-Verbose "Get-GPOZaurrPermissionConsistency - Processing [$($_.DomainName)]($Count/$($GroupPolicies.Count)) $($_.DisplayName)"
-                try {
-                    $IsConsistent = $_.IsAclConsistent()
-                    $ErrorMessage = ''
-                } catch {
-                    $ErrorMessage = $_.Exception.Message
-                    Write-Warning "Get-GPOZaurrPermissionConsistency - Processing $($GPO.DisplayName) / $($GPO.DomainName) failed to get consistency with error: $($_.Exception.Message)."
-                    $IsConsistent = 'Not available'
+                $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $GPO.ID.GUID, '}')
+                if (Test-Path -LiteralPath $SysVolpath) {
+                    try {
+                        $IsConsistent = $GPO.IsAclConsistent()
+                        $ErrorMessage = ''
+                    } catch {
+                        $ErrorMessage = $_.Exception.Message
+                        Write-Warning "Get-GPOZaurrPermissionConsistency - Processing $($GPO.DisplayName) / $($GPO.DomainName) failed to get consistency with error: $($_.Exception.Message)."
+                        $IsConsistent = 'Not available'
+                    }
+                } else {
+                    Write-Warning "Get-GPOZaurrPermissionConsistency - Processing $($GPO.DisplayName) / $($GPO.DomainName) failed as path $SysvolPath doesn't exists!"
+                    $IsConsistent = $false
                 }
-                $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
                 if ($VerifyInheritance) {
                     if ($IsConsistent -eq $true) {
                         $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath -Verbose:$false

Public/Optimize-GPOZaurr.ps1

@@ -0,0 +1,19 @@
+function Optimize-GPOZaurr {
+    [cmdletBinding()]
+    param(
+
+    )
+
+    $GPOS = Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($GPO in $GPOS) {
+        if ($GPO.UserSettingsAvailable -eq $false -and $GPO.ComputerSettingsAvailable -eq $false) {
+            if ($GPO.Enabled -ne 'All setttings disabled') {
+               # $GPO
+            }
+        } elseif ($GPO.UserSettingsAvailable -eq $false) {
+
+        } elseif ($GPO.ComputerSettingsAvailable -eq $false) {
+
+        }
+    }
+}

README.md

@@ -49,6 +49,12 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
+- 0.0.76 - 8.11.2020
+  - Improved `Get-GPOZaurrNetLogon` to better handle errors
+- 0.0.75 - 8.11.2020
+  - Improved `Get-GPOZaurrPermissionConsistency` to stop checking consistency if path doesn't exists
+- 0.0.74 - 8.11.2020
+  - Improved `Invoke-GPOZaurr` (WIP)
 - 0.0.73 - 7.11.2020
   - Improved `Invoke-GPOZaurr` (WIP)
   - Improved `Get-GPOZaurr`