Update

Examples/Example-04-GPOInformation02.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$GPOS = Get-GPOZaurr -GPOName 'TEST | Office Configuration'
+$GPOS | Format-Table -AutoSize *

Examples/Example-20-RemoveOrphanedFoldersSysvol.ps1

@@ -1,7 +1,10 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
+# Find broken GPOs
+Get-GPOZaurrBroken -Verbose -IncludeDomains 'ad.evotec.pl' | Format-Table
+
 # this allows you to process X amount of orphaned folders/files (good for testing)
-Remove-GPOZaurrOrphaned -Verbose -WhatIf -IncludeDomains 'ad.evotec.xyz' #-LimitProcessing 2
+Remove-GPOZaurrBroken -Verbose -WhatIf -IncludeDomains 'ad.evotec.pl' #-LimitProcessing 2
 
 # this runs for whole SYSVOL and checks things against GPOS
-Remove-GPOZaurrOrphaned -Verbose -IncludeDomains 'ad.evotec.xyz' -BackupPath $Env:UserProfile\Desktop\MyBackup1 -WhatIf
+Remove-GPOZaurrBroken -Verbose -IncludeDomains 'ad.evotec.xyz' -BackupPath $Env:UserProfile\Desktop\MyBackup1 -WhatIf

Examples/Example-40-ShowGPO4.ps1

@@ -0,0 +1,15 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Types = @(
+    @{ Name = 'GPOOwners'; Path = "$PSScriptRoot\Reports\GPOOwners.html" }
+    @{ Name = 'GPOConsistency'; Path = "$PSScriptRoot\Reports\GPOConsistency.html" }
+    @{ Name = 'GPODuplicates'; Path = "$PSScriptRoot\Reports\GPODuplicates.html" }
+    @{ Name = 'GPOList'; Path = "$PSScriptRoot\Reports\GPOList.html" }
+    @{ Name = 'GPOOrphans'; Path = "$PSScriptRoot\Reports\GPOOrphans.html" }
+    @{ Name = 'GPOPassword'; Path = "$PSScriptRoot\Reports\GPOPassword.html" }
+    @{ Name = 'NetLogonPermissions'; Path = "$PSScriptRoot\Reports\NetLogonPermissions.html" }
+)
+
+foreach ($Type in $Types) {
+    Invoke-GPOZaurr -FilePath $Type.Path -Type $Type.Name -HideHTML
+}

Examples/Example-43-OptimizeGPO.ps1

@@ -0,0 +1,2 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+

GPOZaurr.psd1

@@ -8,7 +8,7 @@
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
     FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.74'
+    ModuleVersion        = '0.0.78'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{

Private/Get-XMLGPO.ps1

@@ -27,13 +27,11 @@
         $LinksDisabledCount = 0
         $LinksTotalCount = 0
     }
-    if ($null -eq $XMLContent.GPO.Computer.ExtensionData -and $null -eq $XMLContent.GPO.User.ExtensionData) {
-        $Empty = $true
-    } else {
-        $Empty = $false
-    }
-
-
+    #if ($null -eq $XMLContent.GPO.Computer.ExtensionData -and $null -eq $XMLContent.GPO.User.ExtensionData) {
+    #    $Empty = $true
+    #} else {
+    #    $Empty = $false
+    #}
     # Find proper values for enabled/disabled user/computer settings
     if ($XMLContent.GPO.Computer.Enabled -eq 'False') {
         $ComputerEnabled = $false
@@ -59,12 +57,55 @@
     $ComputerSettingsAvailable = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true }
     $UserSettingsAvailable = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true }
 
+    if ($ComputerSettingsAvailable -eq $false -and $UserSettingsAvailable -eq $false) {
+        $Empty = $true
+    } else {
+        $Empty = $false
+    }
+
+    # $OutputUser = $XMLContent.GPO.User.ExtensionData.Extension | Where-Object { $_.PSObject.Properties.TypeNameOfValue -in 'System.Xml.XmlElement', 'System.Object[]' }
+    # $OutputComputer = $XMLContent.GPO.Computer.ExtensionData.Extension | Where-Object { $_.PSObject.Properties.TypeNameOfValue -in 'System.Xml.XmlElement', 'System.Object[]' }
+
+    $OutputUser = foreach ($ExtensionType in $XMLContent.GPO.User.ExtensionData.Extension) {
+        if ($ExtensionType) {
+            $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
+            try {
+                $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
+            } catch {
+                Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
+                continue
+            }
+        }
+        $KeysToLoop
+    }
+    $OutputComputer = foreach ($ExtensionType in $XMLContent.GPO.Computer.ExtensionData.Extension) {
+        if ($ExtensionType) {
+            $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
+            try {
+                $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
+            } catch {
+                Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
+                continue
+            }
+        }
+        $KeysToLoop
+    }
+
+    $ComputerSettingsAvailableReal = if ($OutputComputer) { $true } else { $false }
+    $UserSettingsAvailableReal = if ($OutputUser) { $true } else { $false }
+
+    if (-not $ComputerSettingsAvailableReal -and -not $UserSettingsAvailableReal) {
+        $EmptyMaybe = $true
+    } else {
+        $EmptyMaybe = $false
+    }
+
     $ComputerProblem = $false
-    if ($ComputerEnabled -eq $true -and $ComputerSettingsAvailable -eq $true) {
+    if ($ComputerEnabled -eq $true -and $ComputerSettingsAvailableReal -eq $true) {
         $ComputerOptimized = $true
-    } elseif ($ComputerEnabled -eq $true -and $ComputerSettingsAvailable -eq $false) {
+    } elseif ($ComputerEnabled -eq $true -and $ComputerSettingsAvailableReal -eq $false) {
         $ComputerOptimized = $false
-    } elseif ($ComputerEnabled -eq $false -and $ComputerSettingsAvailable -eq $false) {
+    } elseif ($ComputerEnabled -eq $false -and $ComputerSettingsAvailableReal -eq $false) {
         $ComputerOptimized = $true
     } else {
         # Enabled $false, but ComputerData is there.
@@ -73,11 +114,11 @@
     }
 
     $UserProblem = $false
-    if ($UserEnabled -eq $true -and $UserSettingsAvailable -eq $true) {
+    if ($UserEnabled -eq $true -and $UserSettingsAvailableReal -eq $true) {
         $UserOptimized = $true
-    } elseif ($UserEnabled -eq $true -and $UserSettingsAvailable -eq $false) {
+    } elseif ($UserEnabled -eq $true -and $UserSettingsAvailableReal -eq $false) {
         $UserOptimized = $false
-    } elseif ($UserEnabled -eq $false -and $UserSettingsAvailable -eq $false) {
+    } elseif ($UserEnabled -eq $false -and $UserSettingsAvailableReal -eq $false) {
         $UserOptimized = $true
     } else {
         # Enabled $false, but UserData is there.
@@ -148,6 +189,7 @@
             'DomainName'                        = $XMLContent.GPO.Identifier.Domain.'#text'
             'GUID'                              = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
             'Empty'                             = $Empty
+            'EmptyMaybe'                        = $EmptyMaybe
             'Linked'                            = $Linked
             'LinksCount'                        = $LinksTotalCount
             'LinksEnabledCount'                 = $LinksEnabledCount
@@ -161,6 +203,10 @@
             'UserProblem'                       = $UserProblem
             'ComputerSettingsAvailable'         = $ComputerSettingsAvailable
             'UserSettingsAvailable'             = $UserSettingsAvailable
+            'ComputerSettingsAvailableReal'     = $ComputerSettingsAvailableReal
+            'UserSettingsAvailableReal'         = $UserSettingsAvailableReal
+            'ComputerSettingsTypes'             = $OutputComputer.Name
+            'UserSettingsTypes'                 = $OutputUser.Name
             'ComputerSettingsStatus'            = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
             'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false }
             'ComputerSettings'                  = $XMLContent.GPO.Computer.ExtensionData.Extension

Private/Invoke.GPOZaurrConsistency.ps1

@@ -73,9 +73,8 @@
             }
             New-HTMLPanel {
                 New-HTMLChart {
-                    # New-ChartLegend -Names 'Bad', 'Good' -Color PaleGreen, Salmon
                     New-ChartBarOptions -Type barStacked
-                    New-ChartLegend -Name 'Consistent', 'Inconsistent'
+                    New-ChartLegend -Name 'Consistent', 'Inconsistent' -Color PaleGreen, Salmon
                     New-ChartBar -Name 'TopLevel' -Value $Script:Reporting['GPOConsistency']['Variables']['Consistent'], $Script:Reporting['GPOConsistency']['Variables']['Inconsistent']
                     New-ChartBar -Name 'Inherited' -Value $Script:Reporting['GPOConsistency']['Variables']['ConsistentInside'], $Script:Reporting['GPOConsistency']['Variables']['InconsistentInside']
                 } -Title 'Permissions Consistency' -TitleAlignment center

Private/Invoke.GPOZaurrNetLogonPermissions.ps1

@@ -69,26 +69,31 @@
 
         }
     }
+    Summary        = {
+        New-HTMLText -TextBlock {
+            "NetLogon is crucial part of Active Directory. Files stored there are available on each and every computer or server in the company. "
+            "Keeping those files clean and secure is very important task. "
+            "It's important that NetLogon file owners are set to BUILTIN\Administrators (SID: S-1-5-32-544). "
+            "Owners have full control over the file object. Current owner of the file may be an Administrator but it doesn't guarentee that he/she will be in the future. "
+            "That's why as a best-practice it's recommended to change any non-administrative owners to BUILTIN\Administrators, and even Administrative accounts should be replaced with it. "
+        } -FontSize 10pt
+        New-HTMLList -Type Unordered {
+            New-HTMLListItem -Text 'NetLogon Files in Total: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwners'] -FontWeight normal, bold
+            New-HTMLListItem -Text 'NetLogon BUILTIN\Administrators as Owner: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrators'] -FontWeight normal, bold
+            New-HTMLListItem -Text "NetLogon Owners requiring change: ", $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'] -FontWeight normal, bold {
+                New-HTMLList -Type Unordered {
+                    New-HTMLListItem -Text 'Not Administrative: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersNotAdministrative'] -FontWeight normal, bold
+                    New-HTMLListItem -Text 'Administrative, but not BUILTIN\Administrators: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrativeNotAdministrators'] -FontWeight normal, bold
+                }
+            }
+        } -FontSize 10pt
+        New-HTMLText -Text "Follow the steps below table to get NetLogon Owners into compliant state." -FontSize 10pt
+    }
     Solution       = {
         New-HTMLTab -Name 'NetLogon Owners' {
             New-HTMLSection -Invisible {
                 New-HTMLPanel {
-                    New-HTMLText -TextBlock {
-                        "Following table shows NetLogon file owners. It's important that NetLogon file owners are set to BUILTIN\Administrators (SID: S-1-5-32-544). "
-                        "Owners have full control over the file object. Current owner of the file may be an Administrator but it doesn't guarentee that he will be in the future. "
-                        "That's why as a best-practice it's recommended to change any non-administrative owners to BUILTIN\Administrators, and even Administrative accounts should be replaced with it. "
-                    } -FontSize 10pt
-                    New-HTMLList -Type Unordered {
-                        New-HTMLListItem -Text 'NetLogon Files in Total: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwners'] -FontWeight normal, bold
-                        New-HTMLListItem -Text 'NetLogon BUILTIN\Administrators as Owner: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrators'] -FontWeight normal, bold
-                        New-HTMLListItem -Text "NetLogon Owners requiring change: ", $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'] -FontWeight normal, bold {
-                            New-HTMLList -Type Unordered {
-                                New-HTMLListItem -Text 'Not Administrative: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersNotAdministrative'] -FontWeight normal, bold
-                                New-HTMLListItem -Text 'Administrative, but not BUILTIN\Administrators: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrativeNotAdministrators'] -FontWeight normal, bold
-                            }
-                        }
-                    } -FontSize 10pt
-                    New-HTMLText -Text "Follow the steps below table to get NetLogon Owners into compliant state." -FontSize 10pt
+                    & $Script:GPOConfiguration['NetLogonPermissions']['Summary']
                 }
                 New-HTMLPanel {
                     New-HTMLChart {

Private/Invoke.GPOZaurrOrphans.ps1

@@ -7,15 +7,26 @@
         Get-GPOZaurrBroken
     }
     Processing     = {
+        $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'] = @{}
+        $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssuePerDomain'] = @{}
         foreach ($GPO in $Script:Reporting['GPOOrphans']['Data']) {
+            if (-not $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'][$GPO.DomainName] = 0
+            }
+            if (-not $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssuePerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssuePerDomain'][$GPO.DomainName] = 0
+            }
             if ($GPO.Status -eq 'Not available in AD') {
                 $Script:Reporting['GPOOrphans']['Variables']['NotAvailableInAD']++
                 $Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted']++
+                $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'][$GPO.DomainName]++
             } elseif ($GPO.Status -eq 'Not available on SYSVOL') {
                 $Script:Reporting['GPOOrphans']['Variables']['NotAvailableOnSysvol']++
                 $Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted']++
+                $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'][$GPO.DomainName]++
             } elseif ($GPO.Status -eq 'Permissions issue') {
                 $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssue']++
+                $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssuePerDomain'][$GPO.DomainName]++
             }
         }
         if ($Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted'].Count -gt 0) {
@@ -25,17 +36,20 @@
         }
     }
     Variables      = @{
-        NotAvailableInAD            = 0
-        NotAvailableOnSysvol        = 0
-        NotAvailablePermissionIssue = 0
-        ToBeDeleted                 = 0
+        NotAvailableInAD                     = 0
+        NotAvailableOnSysvol                 = 0
+        NotAvailablePermissionIssue          = 0
+        NotAvailablePermissionIssuePerDomain = $null
+        ToBeDeleted                          = 0
+        ToBeDeletedPerDomain                 = $null
     }
     Overview       = {
+        <#
         New-HTMLPanel {
             New-HTMLText -TextBlock {
                 "Group Policies are stored in two places - Active Directory (metadata) and SYSVOL (content)."
                 "Since those are managed in different ways, replicated in different ways it's possible because of different issues they get out of sync."
-            }
+            } -LineBreak
             New-HTMLText -Text "For example:"
             New-HTMLList -Type Unordered {
                 New-HTMLListItem -Text 'USN Rollback in AD could cause group policies to reappar in Active Directory, yet SYSVOL data would be unavailable'
@@ -55,12 +69,13 @@
                 New-ChartBar -Name 'Orphans' -Value $Script:Reporting['GPOOrphans']['Variables']['NotAvailableInAD'], $Script:Reporting['GPOOrphans']['Variables']['NotAvailableOnSysvol'], $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssue']
             } -Title 'Broken / Orphaned Group Policies' -TitleAlignment center
         }
+        #>
     }
     Summary        = {
         New-HTMLText -TextBlock {
             "Group Policies are stored in two places - Active Directory (metadata) and SYSVOL (content)."
             "Since those are managed in different ways, replicated in different ways it's possible because of different issues they get out of sync."
-        } -FontSize 10pt
+        } -FontSize 10pt -LineBreak
         New-HTMLText -Text "For example:" -FontSize 10pt -FontWeight bold
         New-HTMLList -Type Unordered {
             New-HTMLListItem -Text 'USN Rollback in AD could cause already deleted Group Policies to reapper in Active Directory, yet SYSVOL data would be unavailable'
@@ -74,6 +89,12 @@
             New-HTMLListItem -Text 'Group Policies in AD, but no content on SYSVOL: ', $Script:Reporting['GPOOrphans']['Variables']['NotAvailableOnSysvol'] -FontWeight normal, bold
             New-HTMLListItem -Text "Group Policies which couldn't be assed due to permissions issue: ", $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssue'] -FontWeight normal, bold
         } -FontSize 10pt
+        New-HTMLText -Text 'Following domains require actions (permissions required):' -FontSize 10pt -FontWeight bold
+        New-HTMLList -Type Unordered {
+            foreach ($Domain in $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'].Keys) {
+                New-HTMLListItem -Text "$Domain requires ", $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'][$Domain], " changes." -FontWeight normal, bold, normal
+            }
+        } -FontSize 10pt
         New-HTMLText -Text "Please review output in table and follow the steps below table to get Active Directory Group Policies in healthy state." -FontSize 10pt
     }
     Solution       = {
@@ -96,18 +117,9 @@
                 New-HTMLTableCondition -Name 'Status' -Value "Permissions issue" -BackgroundColor MediumVioletRed -ComparisonType string -Color White
             } -PagingOptions 10, 20, 30, 40, 50
         }
-        if ($Script:Reporting['GPOOrphans']['WarningsAndErrors']) {
-            New-HTMLSection -Name 'Warnings & Errors to Review' {
-                New-HTMLTable -DataTable $Script:Reporting['GPOOrphans']['WarningsAndErrors'] -Filtering {
-                    New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
-                    New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
-                }
-            }
-        }
         New-HTMLSection -Name 'Steps to fix - Not available on SYSVOL / Active Directory' {
             New-HTMLContainer {
                 New-HTMLSpanStyle -FontSize 10pt {
-                    New-HTMLText -Text 'Following steps will guide you how to fix GPOs which are not available on SYSVOL or AD.'
                     New-HTMLWizard {
                         New-HTMLWizardStep -Name 'Prepare environment' {
                             New-HTMLText -Text "To be able to execute actions in automated way please install required modules. Those modules will be installed straight from Microsoft PowerShell Gallery."
@@ -128,48 +140,91 @@
                             }
                             New-HTMLText -Text "Alternatively if you prefer working with console you can run: "
                             New-HTMLCodeBlock -Code {
-                                $GPOOutput = Get-GPOZaurrBroken
+                                $GPOOutput = Get-GPOZaurrBroken -Verbose
                                 $GPOOutput | Format-Table
                             }
                             New-HTMLText -Text "It provides same data as you see in table above just doesn't prettify it for you."
                         }
-                        New-HTMLWizardStep -Name 'Fix GPOs not available on SYSVOL' {
-                            New-HTMLText -Text "Following command when executed runs cleanup procedure that removes all broken GPOs on SYSVOL side."
-                            New-HTMLText -Text "Make sure when running it for the first time to run it with ", "WhatIf", " parameter as shown below to prevent accidental removal." -FontWeight normal, bold, normal -Color Black, Red, Black
+                        New-HTMLWizardStep -Name 'Fix GPOs not available in AD' {
+                            New-HTMLText -Text @(
+                                "Following command when executed runs cleanup procedure that removes all broken GPOs on SYSVOL side. ",
+                                "Make sure when running it for the first time to run it with ",
+                                "WhatIf ",
+                                "parameter as shown below to prevent accidental removal. ",
+                                'When run it will remove any GPO remains from SYSVOL, that should not be there, as AD metadata is already gone.'
+                                "Please notice I'm using SYSVOL as a type, because the removal will happen on SYSVOL. "
+                            ) -FontWeight normal, normal, bold, normal -Color Black, Black, Red, Black
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrBroken -Type SYSVOL -WhatIf -Verbose
+                            }
+                            New-HTMLText -TextBlock {
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                            }
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrBroken -Type SYSVOL -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor' -Verbose
+                            }
+                            New-HTMLText -TextBlock {
+                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. "
+                                "Keep in mind that what backup command does is simply copy SYSVOL content to given place. "
+                                "Since there is no GPO metadata in AD there's no real restore process for this step. "
+                                "It's there to make sure if someone kept some data in there and wants to get access to it, he/she can. "
+                            } -LineBreak
+                            New-HTMLText -Text "Once happy with results please follow with command (this will start deletion process): " -LineBreak -FontWeight bold
 
                             New-HTMLCodeBlock -Code {
-                                Remove-GPOZaurrBroken -Type SYSVOL -WhatIf
+                                Remove-GPOZaurrBroken -Type SYSVOL -LimitProcessing 2 -BackupPath $Env:UserProfile\Desktop\GPOSYSVOLBackup -Verbose
                             }
                             New-HTMLText -TextBlock {
-                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. Once happy with results please follow with command: "
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                             }
                             New-HTMLCodeBlock -Code {
-                                Remove-GPOZaurrBroken -Type SYSVOL -LimitProcessing 2 -BackupPath $Env:UserProfile\Desktop\GPOSYSVOLBackup
+                                Remove-GPOZaurrBroken -Type SYSVOL -LimitProcessing 2 -BackupPath $Env:UserProfile\Desktop\GPOSYSVOLBackup -IncludeDomains 'YourDomainYouHavePermissionsFor' -Verbose
                             }
                             New-HTMLText -TextBlock {
-                                "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur."
-                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly."
+                                "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur. "
+                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly. "
+                                "If there's nothing else to be deleted on SYSVOL side, we can skip to next step step. "
                             }
-                            New-HTMLText -Text "If there's nothing else to be deleted on SYSVOL side, we can skip to next step step"
                         }
-                        New-HTMLWizardStep -Name 'Fix GPOs not available on AD' {
-                            New-HTMLText -Text "Following command when executed runs cleanup procedure that removes all broken GPOs on Active Directory side."
-                            New-HTMLText -Text "Make sure when running it for the first time to run it with ", "WhatIf", " parameter as shown below to prevent accidental removal." -FontWeight normal, bold, normal -Color Black, Red, Black
-
+                        New-HTMLWizardStep -Name 'Fix GPOs not available on SYSVOL' {
+                            New-HTMLText -Text @(
+                                "Following command when executed runs cleanup procedure that removes all broken GPOs on Active Directory side."
+                                "Make sure when running it for the first time to run it with ",
+                                "WhatIf",
+                                " parameter as shown below to prevent accidental removal."
+                                'When run it will remove any GPO remains from AD, that should not be there, as SYSVOL content is already gone.'
+                                "Please notice I'm using AD as a type, because the removal will happen on AD side. "
+                            ) -FontWeight normal, normal, bold, normal -Color Black, Black, Red, Black
                             New-HTMLCodeBlock -Code {
-                                Remove-GPOZaurrBroken -Type AD -WhatIf
+                                Remove-GPOZaurrBroken -Type AD -WhatIf -Verbose
                             }
                             New-HTMLText -TextBlock {
-                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. Once happy with results please follow with command: "
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                             }
                             New-HTMLCodeBlock -Code {
-                                Remove-GPOZaurrBroken -Type AD -LimitProcessing 2 -BackupPath $Env:UserProfile\Desktop\GPOSYSVOLBackup
+                                Remove-GPOZaurrBroken -Type AD -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor' -Verbose
                             }
                             New-HTMLText -TextBlock {
-                                "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur."
-                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly."
+                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. "
+                                "Keep in mind that there is no backup for this. "
+                                "Since there is no SYSVOL data, and only AD object is there there's no real restore process for this step. "
+                                "Once you delete it, it's gone. "
+                            } -LineBreak
+                            New-HTMLText -Text 'Once happy with results please follow with command (this will start deletion process): ' -LineBreak -FontWeight bold
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrBroken -Type AD -LimitProcessing 2 -Verbose
+                            }
+                            New-HTMLText -TextBlock {
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                            }
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrBroken -Type AD -LimitProcessing 2 -IncludeDomains 'YourDomainYouHavePermissionsFor' -Verbose
+                            }
+                            New-HTMLText -TextBlock {
+                                "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur. "
+                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly. "
+                                "If there's nothing else to be deleted on AD side, we can skip to next step step. "
                             }
-                            New-HTMLText -Text "If there's nothing else to be deleted on AD side, we can skip to next step step"
                         }
                         New-HTMLWizardStep -Name 'Verification report' {
                             New-HTMLText -TextBlock {
@@ -184,5 +239,13 @@
                 }
             }
         }
+        if ($Script:Reporting['GPOOrphans']['WarningsAndErrors']) {
+            New-HTMLSection -Name 'Warnings & Errors to Review' {
+                New-HTMLTable -DataTable $Script:Reporting['GPOOrphans']['WarningsAndErrors'] -Filtering {
+                    New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
+                    New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
+                }
+            }
+        }
     }
 }

Private/Test-SysvolFolders.ps1

@@ -12,6 +12,7 @@
 
     $GPOGUIDS = $GPOs.ID.GUID
     $SysVolPath = "\\$($Server)\SYSVOL\$Domain\Policies"
+    Write-Verbose "Get-GPOZaurrBroken - Processing SYSVOL from \\$($Server)\SYSVOL\$Domain\Policies"
     try {
         $SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -Exclude 'PolicyDefinitions' -ErrorAction Stop -Verbose:$false
     } catch {
@@ -46,7 +47,10 @@
         }
     }
     $GPOSummary = @(
+        $Count = 0
         foreach ($GPO in $GPOS) {
+            $Count++
+            Write-Verbose "Get-GPOZaurrBroken - Processing [$($GPO.DomainName)]($Count/$($GPOS.Count)) $($GPO.DisplayName)"
             if ($null -ne $SysvolHash[$GPO.Id.GUID].FullName) {
                 $FullPath = $SysvolHash[$GPO.Id.GUID].FullName
                 try {
@@ -92,6 +96,7 @@
             }
         }
         # Now we need to list thru Sysvol files and fine those that do not exists as GPO and create dummy GPO objects to show orphaned gpos
+        Write-Verbose "Get-GPOZaurrBroken - Processing SYSVOL differences and creating dummy objects"
         foreach ($_ in $Differences.Keys) {
             if ($Differences[$_] -in 'Not available in AD', 'Permissions issue') {
                 $FullPath = $SysvolHash[$_].FullName

Public/Get-GPOZaurrNetlogon.ps1

@@ -13,9 +13,16 @@
     $FilesAll = foreach ($Domain in $ForestInformation.Domains) {
         $Path = -join ("\\", $Domain, '\Netlogon')
         $PathOnSysvol = -join ("\\", $Domain, "\SYSVOL\", $Domain, "\Scripts")
-        $Files = Get-ChildItem -LiteralPath $Path -Recurse -Force
-        foreach ($_ in $Files) {
-            $ACL = Get-Acl -Path $_.FullName
+        $Files = Get-ChildItem -LiteralPath $Path -Recurse -Force -ErrorVariable Err -ErrorAction SilentlyContinue
+        foreach ($e in $err) {
+            Write-Warning "Get-GPOZaurrNetLogon - Listing file failed with error $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
+        }
+        foreach ($File in $Files) {
+            try {
+                $ACL = Get-Acl -Path $File.FullName -ErrorAction Stop
+            } catch {
+                Write-Warning "Get-GPOZaurrNetLogon - ACL reading failed for $($File.FullName) with error $($_.Exception.Message) ($($_.CategoryInfo.Reason))"
+            }
             if ($ACL.Owner) {
                 $IdentityOwner = Convert-Identity -Identity $ACL.Owner -Verbose:$false
             } else {
@@ -24,19 +31,19 @@
             if (-not $OwnerOnly) {
                 if (-not $SkipOwner) {
                     [PSCustomObject] @{
-                        FullName          = $_.FullName
-                        Extension         = $_.Extension
-                        CreationTime      = $_.CreationTime
-                        LastAccessTime    = $_.LastAccessTime
-                        LastWriteTime     = $_.LastWriteTime
-                        Attributes        = $_.Attributes
+                        FullName          = $File.FullName
+                        Extension         = $File.Extension
+                        CreationTime      = $File.CreationTime
+                        LastAccessTime    = $File.LastAccessTime
+                        LastWriteTime     = $File.LastWriteTime
+                        Attributes        = $File.Attributes
                         AccessControlType = 'Allow' # : Allow
                         Principal         = $IdentityOwner.Name         # : BUILTIN\Administrators
                         PrincipalSid      = $IdentityOwner.SID
                         PrincipalType     = $IdentityOwner.Type
                         FileSystemRights  = 'Owner'  # : FullControl
                         IsInherited       = $false
-                        FullNameOnSysVol  = $_.FullName.Replace($Path, $PathOnSysvol)
+                        FullNameOnSysVol  = $File.FullName.Replace($Path, $PathOnSysvol)
                         #Owner             = $ACL.Owner
                     }
                 }
@@ -44,33 +51,33 @@
                 foreach ($Perm in $FilePermission) {
                     $Identity = Convert-Identity -Identity $Perm.Principal -Verbose:$false
                     [PSCustomObject] @{
-                        FullName          = $_.FullName
-                        Extension         = $_.Extension
-                        CreationTime      = $_.CreationTime
-                        LastAccessTime    = $_.LastAccessTime
-                        LastWriteTime     = $_.LastWriteTime
-                        Attributes        = $_.Attributes
+                        FullName          = $File.FullName
+                        Extension         = $File.Extension
+                        CreationTime      = $File.CreationTime
+                        LastAccessTime    = $File.LastAccessTime
+                        LastWriteTime     = $File.LastWriteTime
+                        Attributes        = $File.Attributes
                         AccessControlType = $Perm.AccessControlType # : Allow
                         Principal         = $Identity.Name         # : BUILTIN\Administrators
                         PrincipalSid      = $Identity.SID
                         PrincipalType     = $Identity.Type
                         FileSystemRights  = $Perm.FileSystemRights  # : FullControl
                         IsInherited       = $Perm.IsInherited       # : True
-                        FullNameOnSysVol  = $_.FullName.Replace($Path, $PathOnSysvol)
+                        FullNameOnSysVol  = $File.FullName.Replace($Path, $PathOnSysvol)
                     }
                 }
             } else {
                 [PSCustomObject] @{
-                    FullName         = $_.FullName
-                    Extension        = $_.Extension
-                    CreationTime     = $_.CreationTime
-                    LastAccessTime   = $_.LastAccessTime
-                    LastWriteTime    = $_.LastWriteTime
-                    Attributes       = $_.Attributes
+                    FullName         = $File.FullName
+                    Extension        = $File.Extension
+                    CreationTime     = $File.CreationTime
+                    LastAccessTime   = $File.LastAccessTime
+                    LastWriteTime    = $File.LastWriteTime
+                    Attributes       = $File.Attributes
                     Owner            = $IdentityOwner.Name
                     OwnerSid         = $IdentityOwner.SID
                     OwnerType        = $IdentityOwner.Type
-                    FullNameOnSysVol = $_.FullName.Replace($Path, $PathOnSysvol)
+                    FullNameOnSysVol = $File.FullName.Replace($Path, $PathOnSysvol)
                 }
             }
         }

Public/Get-GPOZaurrPermissionConsistency.ps1

@@ -47,15 +47,20 @@
                 $GPO = $_
                 $Count++
                 Write-Verbose "Get-GPOZaurrPermissionConsistency - Processing [$($_.DomainName)]($Count/$($GroupPolicies.Count)) $($_.DisplayName)"
-                try {
-                    $IsConsistent = $_.IsAclConsistent()
-                    $ErrorMessage = ''
-                } catch {
-                    $ErrorMessage = $_.Exception.Message
-                    Write-Warning "Get-GPOZaurrPermissionConsistency - Processing $($GPO.DisplayName) / $($GPO.DomainName) failed to get consistency with error: $($_.Exception.Message)."
-                    $IsConsistent = 'Not available'
+                $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $GPO.ID.GUID, '}')
+                if (Test-Path -LiteralPath $SysVolpath) {
+                    try {
+                        $IsConsistent = $GPO.IsAclConsistent()
+                        $ErrorMessage = ''
+                    } catch {
+                        $ErrorMessage = $_.Exception.Message
+                        Write-Warning "Get-GPOZaurrPermissionConsistency - Processing $($GPO.DisplayName) / $($GPO.DomainName) failed to get consistency with error: $($_.Exception.Message)."
+                        $IsConsistent = 'Not available'
+                    }
+                } else {
+                    Write-Warning "Get-GPOZaurrPermissionConsistency - Processing $($GPO.DisplayName) / $($GPO.DomainName) failed as path $SysvolPath doesn't exists!"
+                    $IsConsistent = $false
                 }
-                $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
                 if ($VerifyInheritance) {
                     if ($IsConsistent -eq $true) {
                         $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath -Verbose:$false

Public/Invoke-GPOZaurr.ps1

@@ -51,6 +51,7 @@
                 Data              = $null
                 WarningsAndErrors = $null
                 Time              = $null
+                Summary           = $null
                 Variables         = Copy-Dictionary -Dictionary $Script:GPOConfiguration[$T]['Variables']
             }
             $TimeLogGPOList = Start-TimeLog
@@ -75,6 +76,9 @@
                     }
                 }
             )
+            if ($Script:GPOConfiguration[$T]['Summary']) {
+                $Script:Reporting[$T]['Summary'] = Invoke-Command -ScriptBlock $Script:GPOConfiguration[$T]['Summary']
+            }
             $TimeEndGPOList = Stop-TimeLog -Time $TimeLogGPOList -Option OneLiner
             $Script:Reporting[$T]['Time'] = $TimeEndGPOList
             Write-Color -Text '[i]', '[End  ] ', $($Script:GPOConfiguration[$T]['Name']), " [Time to execute: $TimeEndGPOList]" -Color Yellow, DarkGray, Yellow, DarkGray

Public/Remove-GPOZaurrBroken.ps1

@@ -21,7 +21,7 @@
     } else {
         $BackupFinalPath = ''
     }
-    Get-GPOZaurrSysvol -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation | Where-Object {
+    Get-GPOZaurrBroken -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation | Where-Object {
         if ($Type -contains 'SYSVOL') {
             if ($_.Status -eq 'Not available in AD') {
                 $_

README.md

@@ -19,7 +19,15 @@
 
 # GPOZaurr
 
-## To install
+## Table of Contents
+
+- [GPOZaurr](#gpozaurr)
+  - [Table of Contents](#table-of-contents)
+  - [Installing](#installing)
+  - [Updating](#updating)
+  - [Changelog](#changelog)
+
+## Installing
 
 GPOZaurr requires `RSAT` installed to provide results. If you don't have them you can install them as below. Keep in mind it also installs GUI tools so it shouldn't be installed on user workstations.
 
@@ -37,7 +45,7 @@ Install-Module -Name GPOZaurr -AllowClobber -Force
 
 Force and AllowClobber aren't necessary, but they do skip errors in case some appear.
 
-## And to update
+## Updating
 
 ```powershell
 Update-Module -Name GPOZaurr
@@ -49,6 +57,20 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
+- 0.0.78 - 10.11.2020
+  - Improved `Remove-GPOZaurrBroken` more verbose
+  - Improved `Get-GPOZaurrBroken` more verbose
+  - Improved `Invoke-GPOZaurr` - type `GPOOrphans`
+  - Improved `Invoke-GPOZaurr` - type `GPOList` - needs more work
+  - Improved `Get-GPOZaurr` with better detection of Empty Policies (needs testing)
+- 0.0.77 - 9.11.2020
+  - Improved `Invoke-GPOZaurr` (WIP)
+- 0.0.76 - 8.11.2020
+  - Improved `Get-GPOZaurrNetLogon` to better handle errors
+- 0.0.75 - 8.11.2020
+  - Improved `Get-GPOZaurrPermissionConsistency` to stop checking consistency if path doesn't exists
+- 0.0.74 - 8.11.2020
+  - Improved `Invoke-GPOZaurr` (WIP)
 - 0.0.73 - 7.11.2020
   - Improved `Invoke-GPOZaurr` (WIP)
   - Improved `Get-GPOZaurr`