Update

GPOZaurr.psd1

@@ -8,7 +8,7 @@
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
     FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.76'
+    ModuleVersion        = '0.0.78'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{

Private/Invoke.GPOZaurrConsistency.ps1

@@ -73,9 +73,8 @@
             }
             New-HTMLPanel {
                 New-HTMLChart {
-                    # New-ChartLegend -Names 'Bad', 'Good' -Color PaleGreen, Salmon
                     New-ChartBarOptions -Type barStacked
-                    New-ChartLegend -Name 'Consistent', 'Inconsistent'
+                    New-ChartLegend -Name 'Consistent', 'Inconsistent' -Color PaleGreen, Salmon
                     New-ChartBar -Name 'TopLevel' -Value $Script:Reporting['GPOConsistency']['Variables']['Consistent'], $Script:Reporting['GPOConsistency']['Variables']['Inconsistent']
                     New-ChartBar -Name 'Inherited' -Value $Script:Reporting['GPOConsistency']['Variables']['ConsistentInside'], $Script:Reporting['GPOConsistency']['Variables']['InconsistentInside']
                 } -Title 'Permissions Consistency' -TitleAlignment center

Private/Invoke.GPOZaurrNetLogonPermissions.ps1

@@ -69,26 +69,31 @@
 
         }
     }
+    Summary        = {
+        New-HTMLText -TextBlock {
+            "NetLogon is crucial part of Active Directory. Files stored there are available on each and every computer or server in the company. "
+            "Keeping those files clean and secure is very important task. "
+            "It's important that NetLogon file owners are set to BUILTIN\Administrators (SID: S-1-5-32-544). "
+            "Owners have full control over the file object. Current owner of the file may be an Administrator but it doesn't guarentee that he/she will be in the future. "
+            "That's why as a best-practice it's recommended to change any non-administrative owners to BUILTIN\Administrators, and even Administrative accounts should be replaced with it. "
+        } -FontSize 10pt
+        New-HTMLList -Type Unordered {
+            New-HTMLListItem -Text 'NetLogon Files in Total: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwners'] -FontWeight normal, bold
+            New-HTMLListItem -Text 'NetLogon BUILTIN\Administrators as Owner: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrators'] -FontWeight normal, bold
+            New-HTMLListItem -Text "NetLogon Owners requiring change: ", $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'] -FontWeight normal, bold {
+                New-HTMLList -Type Unordered {
+                    New-HTMLListItem -Text 'Not Administrative: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersNotAdministrative'] -FontWeight normal, bold
+                    New-HTMLListItem -Text 'Administrative, but not BUILTIN\Administrators: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrativeNotAdministrators'] -FontWeight normal, bold
+                }
+            }
+        } -FontSize 10pt
+        New-HTMLText -Text "Follow the steps below table to get NetLogon Owners into compliant state." -FontSize 10pt
+    }
     Solution       = {
         New-HTMLTab -Name 'NetLogon Owners' {
             New-HTMLSection -Invisible {
                 New-HTMLPanel {
-                    New-HTMLText -TextBlock {
-                        "Following table shows NetLogon file owners. It's important that NetLogon file owners are set to BUILTIN\Administrators (SID: S-1-5-32-544). "
-                        "Owners have full control over the file object. Current owner of the file may be an Administrator but it doesn't guarentee that he will be in the future. "
-                        "That's why as a best-practice it's recommended to change any non-administrative owners to BUILTIN\Administrators, and even Administrative accounts should be replaced with it. "
-                    } -FontSize 10pt
-                    New-HTMLList -Type Unordered {
-                        New-HTMLListItem -Text 'NetLogon Files in Total: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwners'] -FontWeight normal, bold
-                        New-HTMLListItem -Text 'NetLogon BUILTIN\Administrators as Owner: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrators'] -FontWeight normal, bold
-                        New-HTMLListItem -Text "NetLogon Owners requiring change: ", $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'] -FontWeight normal, bold {
-                            New-HTMLList -Type Unordered {
-                                New-HTMLListItem -Text 'Not Administrative: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersNotAdministrative'] -FontWeight normal, bold
-                                New-HTMLListItem -Text 'Administrative, but not BUILTIN\Administrators: ', $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrativeNotAdministrators'] -FontWeight normal, bold
-                            }
-                        }
-                    } -FontSize 10pt
-                    New-HTMLText -Text "Follow the steps below table to get NetLogon Owners into compliant state." -FontSize 10pt
+                    & $Script:GPOConfiguration['NetLogonPermissions']['Summary']
                 }
                 New-HTMLPanel {
                     New-HTMLChart {

Private/Invoke.GPOZaurrOrphans.ps1

@@ -35,7 +35,7 @@
             New-HTMLText -TextBlock {
                 "Group Policies are stored in two places - Active Directory (metadata) and SYSVOL (content)."
                 "Since those are managed in different ways, replicated in different ways it's possible because of different issues they get out of sync."
-            }
+            } -LineBreak
             New-HTMLText -Text "For example:"
             New-HTMLList -Type Unordered {
                 New-HTMLListItem -Text 'USN Rollback in AD could cause group policies to reappar in Active Directory, yet SYSVOL data would be unavailable'
@@ -96,18 +96,9 @@
                 New-HTMLTableCondition -Name 'Status' -Value "Permissions issue" -BackgroundColor MediumVioletRed -ComparisonType string -Color White
             } -PagingOptions 10, 20, 30, 40, 50
         }
-        if ($Script:Reporting['GPOOrphans']['WarningsAndErrors']) {
-            New-HTMLSection -Name 'Warnings & Errors to Review' {
-                New-HTMLTable -DataTable $Script:Reporting['GPOOrphans']['WarningsAndErrors'] -Filtering {
-                    New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
-                    New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
-                }
-            }
-        }
         New-HTMLSection -Name 'Steps to fix - Not available on SYSVOL / Active Directory' {
             New-HTMLContainer {
                 New-HTMLSpanStyle -FontSize 10pt {
-                    New-HTMLText -Text 'Following steps will guide you how to fix GPOs which are not available on SYSVOL or AD.'
                     New-HTMLWizard {
                         New-HTMLWizardStep -Name 'Prepare environment' {
                             New-HTMLText -Text "To be able to execute actions in automated way please install required modules. Those modules will be installed straight from Microsoft PowerShell Gallery."
@@ -128,48 +119,91 @@
                             }
                             New-HTMLText -Text "Alternatively if you prefer working with console you can run: "
                             New-HTMLCodeBlock -Code {
-                                $GPOOutput = Get-GPOZaurrBroken
+                                $GPOOutput = Get-GPOZaurrBroken -Verbose
                                 $GPOOutput | Format-Table
                             }
                             New-HTMLText -Text "It provides same data as you see in table above just doesn't prettify it for you."
                         }
-                        New-HTMLWizardStep -Name 'Fix GPOs not available on SYSVOL' {
-                            New-HTMLText -Text "Following command when executed runs cleanup procedure that removes all broken GPOs on SYSVOL side."
-                            New-HTMLText -Text "Make sure when running it for the first time to run it with ", "WhatIf", " parameter as shown below to prevent accidental removal." -FontWeight normal, bold, normal -Color Black, Red, Black
+                        New-HTMLWizardStep -Name 'Fix GPOs not available in AD' {
+                            New-HTMLText -Text @(
+                                "Following command when executed runs cleanup procedure that removes all broken GPOs on SYSVOL side. ",
+                                "Make sure when running it for the first time to run it with ",
+                                "WhatIf ",
+                                "parameter as shown below to prevent accidental removal. ",
+                                'When run it will remove any GPO remains from SYSVOL, that should not be there, as AD metadata is already gone.'
+                                "Please notice I'm using SYSVOL as a type, because the removal will happen on SYSVOL. "
+                            ) -FontWeight normal, normal, bold, normal -Color Black, Black, Red, Black
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrBroken -Type SYSVOL -WhatIf -Verbose
+                            }
+                            New-HTMLText -TextBlock {
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                            }
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrBroken -Type SYSVOL -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor' -Verbose
+                            }
+                            New-HTMLText -TextBlock {
+                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. "
+                                "Keep in mind that what backup command does is simply copy SYSVOL content to given place. "
+                                "Since there is no GPO metadata in AD there's no real restore process for this step. "
+                                "It's there to make sure if someone kept some data in there and wants to get access to it, he/she can. "
+                            } -LineBreak
+                            New-HTMLText -Text "Once happy with results please follow with command (this will start deletion process): " -LineBreak -FontWeight bold
 
                             New-HTMLCodeBlock -Code {
-                                Remove-GPOZaurrBroken -Type SYSVOL -WhatIf
+                                Remove-GPOZaurrBroken -Type SYSVOL -LimitProcessing 2 -BackupPath $Env:UserProfile\Desktop\GPOSYSVOLBackup -Verbose
                             }
                             New-HTMLText -TextBlock {
-                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. Once happy with results please follow with command: "
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                             }
                             New-HTMLCodeBlock -Code {
-                                Remove-GPOZaurrBroken -Type SYSVOL -LimitProcessing 2 -BackupPath $Env:UserProfile\Desktop\GPOSYSVOLBackup
+                                Remove-GPOZaurrBroken -Type SYSVOL -LimitProcessing 2 -BackupPath $Env:UserProfile\Desktop\GPOSYSVOLBackup -IncludeDomains 'YourDomainYouHavePermissionsFor' -Verbose
                             }
                             New-HTMLText -TextBlock {
-                                "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur."
-                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly."
+                                "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur. "
+                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly. "
+                                "If there's nothing else to be deleted on SYSVOL side, we can skip to next step step. "
                             }
-                            New-HTMLText -Text "If there's nothing else to be deleted on SYSVOL side, we can skip to next step step"
                         }
-                        New-HTMLWizardStep -Name 'Fix GPOs not available on AD' {
-                            New-HTMLText -Text "Following command when executed runs cleanup procedure that removes all broken GPOs on Active Directory side."
-                            New-HTMLText -Text "Make sure when running it for the first time to run it with ", "WhatIf", " parameter as shown below to prevent accidental removal." -FontWeight normal, bold, normal -Color Black, Red, Black
-
+                        New-HTMLWizardStep -Name 'Fix GPOs not available on SYSVOL' {
+                            New-HTMLText -Text @(
+                                "Following command when executed runs cleanup procedure that removes all broken GPOs on Active Directory side."
+                                "Make sure when running it for the first time to run it with ",
+                                "WhatIf",
+                                " parameter as shown below to prevent accidental removal."
+                                'When run it will remove any GPO remains from AD, that should not be there, as SYSVOL content is already gone.'
+                                "Please notice I'm using AD as a type, because the removal will happen on AD side. "
+                            ) -FontWeight normal, normal, bold, normal -Color Black, Black, Red, Black
                             New-HTMLCodeBlock -Code {
-                                Remove-GPOZaurrBroken -Type AD -WhatIf
+                                Remove-GPOZaurrBroken -Type AD -WhatIf -Verbose
                             }
                             New-HTMLText -TextBlock {
-                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. Once happy with results please follow with command: "
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                             }
                             New-HTMLCodeBlock -Code {
-                                Remove-GPOZaurrBroken -Type AD -LimitProcessing 2 -BackupPath $Env:UserProfile\Desktop\GPOSYSVOLBackup
+                                Remove-GPOZaurrBroken -Type AD -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor' -Verbose
                             }
                             New-HTMLText -TextBlock {
-                                "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur."
-                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly."
+                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. "
+                                "Keep in mind that there is no backup for this. "
+                                "Since there is no SYSVOL data, and only AD object is there there's no real restore process for this step. "
+                                "Once you delete it, it's gone. "
+                            } -LineBreak
+                            New-HTMLText -Text 'Once happy with results please follow with command (this will start deletion process): ' -LineBreak -FontWeight bold
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrBroken -Type AD -LimitProcessing 2 -Verbose
+                            }
+                            New-HTMLText -TextBlock {
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                            }
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrBroken -Type AD -LimitProcessing 2 -IncludeDomains 'YourDomainYouHavePermissionsFor' -Verbose
+                            }
+                            New-HTMLText -TextBlock {
+                                "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur. "
+                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly. "
+                                "If there's nothing else to be deleted on AD side, we can skip to next step step. "
                             }
-                            New-HTMLText -Text "If there's nothing else to be deleted on AD side, we can skip to next step step"
                         }
                         New-HTMLWizardStep -Name 'Verification report' {
                             New-HTMLText -TextBlock {
@@ -184,5 +218,13 @@
                 }
             }
         }
+        if ($Script:Reporting['GPOOrphans']['WarningsAndErrors']) {
+            New-HTMLSection -Name 'Warnings & Errors to Review' {
+                New-HTMLTable -DataTable $Script:Reporting['GPOOrphans']['WarningsAndErrors'] -Filtering {
+                    New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
+                    New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
+                }
+            }
+        }
     }
 }

Private/Test-SysvolFolders.ps1

@@ -12,6 +12,7 @@
 
     $GPOGUIDS = $GPOs.ID.GUID
     $SysVolPath = "\\$($Server)\SYSVOL\$Domain\Policies"
+    Write-Verbose "Get-GPOZaurrBroken - Processing SYSVOL from \\$($Server)\SYSVOL\$Domain\Policies"
     try {
         $SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -Exclude 'PolicyDefinitions' -ErrorAction Stop -Verbose:$false
     } catch {
@@ -46,7 +47,10 @@
         }
     }
     $GPOSummary = @(
+        $Count = 0
         foreach ($GPO in $GPOS) {
+            $Count++
+            Write-Verbose "Get-GPOZaurrBroken - Processing [$($GPO.DomainName)]($Count/$($GPOS.Count)) $($GPO.DisplayName)"
             if ($null -ne $SysvolHash[$GPO.Id.GUID].FullName) {
                 $FullPath = $SysvolHash[$GPO.Id.GUID].FullName
                 try {
@@ -92,6 +96,7 @@
             }
         }
         # Now we need to list thru Sysvol files and fine those that do not exists as GPO and create dummy GPO objects to show orphaned gpos
+        Write-Verbose "Get-GPOZaurrBroken - Processing SYSVOL differences and creating dummy objects"
         foreach ($_ in $Differences.Keys) {
             if ($Differences[$_] -in 'Not available in AD', 'Permissions issue') {
                 $FullPath = $SysvolHash[$_].FullName

Public/Invoke-GPOZaurr.ps1

@@ -51,6 +51,7 @@
                 Data              = $null
                 WarningsAndErrors = $null
                 Time              = $null
+                Summary           = $null
                 Variables         = Copy-Dictionary -Dictionary $Script:GPOConfiguration[$T]['Variables']
             }
             $TimeLogGPOList = Start-TimeLog
@@ -75,6 +76,9 @@
                     }
                 }
             )
+            if ($Script:GPOConfiguration[$T]['Summary']) {
+                $Script:Reporting[$T]['Summary'] = Invoke-Command -ScriptBlock $Script:GPOConfiguration[$T]['Summary']
+            }
             $TimeEndGPOList = Stop-TimeLog -Time $TimeLogGPOList -Option OneLiner
             $Script:Reporting[$T]['Time'] = $TimeEndGPOList
             Write-Color -Text '[i]', '[End  ] ', $($Script:GPOConfiguration[$T]['Name']), " [Time to execute: $TimeEndGPOList]" -Color Yellow, DarkGray, Yellow, DarkGray

Public/Remove-GPOZaurrBroken.ps1

@@ -21,7 +21,7 @@
     } else {
         $BackupFinalPath = ''
     }
-    Get-GPOZaurrSysvol -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation | Where-Object {
+    Get-GPOZaurrBroken -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation | Where-Object {
         if ($Type -contains 'SYSVOL') {
             if ($_.Status -eq 'Not available in AD') {
                 $_

README.md

@@ -19,7 +19,15 @@
 
 # GPOZaurr
 
-## To install
+## Table of Contents
+
+- [GPOZaurr](#gpozaurr)
+  - [Table of Contents](#table-of-contents)
+  - [Installing](#installing)
+  - [Updating](#updating)
+  - [Changelog](#changelog)
+
+## Installing
 
 GPOZaurr requires `RSAT` installed to provide results. If you don't have them you can install them as below. Keep in mind it also installs GUI tools so it shouldn't be installed on user workstations.
 
@@ -37,7 +45,7 @@ Install-Module -Name GPOZaurr -AllowClobber -Force
 
 Force and AllowClobber aren't necessary, but they do skip errors in case some appear.
 
-## And to update
+## Updating
 
 ```powershell
 Update-Module -Name GPOZaurr
@@ -49,6 +57,12 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
+- 0.0.78 -
+  - Improved `Remove-GPOZaurrBroken` more verbose
+  - Improved `Get-GPOZaurrBroken` more verbose
+  - Improved `Invoke-GPOZaurr` - type `GPOOrphans`
+- 0.0.77 - 9.11.2020
+  - Improved `Invoke-GPOZaurr` (WIP)
 - 0.0.76 - 8.11.2020
   - Improved `Get-GPOZaurrNetLogon` to better handle errors
 - 0.0.75 - 8.11.2020