Update

Examples/Example-04-GPOInformation02.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$GPOS = Get-GPOZaurr -GPOName 'TEST | Office Configuration'
+$GPOS | Format-Table -AutoSize *

Examples/Example-20-RemoveOrphanedFoldersSysvol.ps1

@@ -1,7 +1,10 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
+# Find broken GPOs
+Get-GPOZaurrBroken -Verbose -IncludeDomains 'ad.evotec.pl' | Format-Table
+
 # this allows you to process X amount of orphaned folders/files (good for testing)
-Remove-GPOZaurrOrphaned -Verbose -WhatIf -IncludeDomains 'ad.evotec.xyz' #-LimitProcessing 2
+Remove-GPOZaurrBroken -Verbose -WhatIf -IncludeDomains 'ad.evotec.pl' #-LimitProcessing 2
 
 # this runs for whole SYSVOL and checks things against GPOS
-Remove-GPOZaurrOrphaned -Verbose -IncludeDomains 'ad.evotec.xyz' -BackupPath $Env:UserProfile\Desktop\MyBackup1 -WhatIf
+Remove-GPOZaurrBroken -Verbose -IncludeDomains 'ad.evotec.xyz' -BackupPath $Env:UserProfile\Desktop\MyBackup1 -WhatIf

GPOZaurr.psd1

@@ -8,7 +8,7 @@
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
     FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.77'
+    ModuleVersion        = '0.0.78'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{

Private/Get-XMLGPO.ps1

@@ -27,13 +27,11 @@
         $LinksDisabledCount = 0
         $LinksTotalCount = 0
     }
-    if ($null -eq $XMLContent.GPO.Computer.ExtensionData -and $null -eq $XMLContent.GPO.User.ExtensionData) {
-        $Empty = $true
-    } else {
-        $Empty = $false
-    }
-
-
+    #if ($null -eq $XMLContent.GPO.Computer.ExtensionData -and $null -eq $XMLContent.GPO.User.ExtensionData) {
+    #    $Empty = $true
+    #} else {
+    #    $Empty = $false
+    #}
     # Find proper values for enabled/disabled user/computer settings
     if ($XMLContent.GPO.Computer.Enabled -eq 'False') {
         $ComputerEnabled = $false
@@ -59,12 +57,55 @@
     $ComputerSettingsAvailable = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true }
     $UserSettingsAvailable = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true }
 
+    if ($ComputerSettingsAvailable -eq $false -and $UserSettingsAvailable -eq $false) {
+        $Empty = $true
+    } else {
+        $Empty = $false
+    }
+
+    # $OutputUser = $XMLContent.GPO.User.ExtensionData.Extension | Where-Object { $_.PSObject.Properties.TypeNameOfValue -in 'System.Xml.XmlElement', 'System.Object[]' }
+    # $OutputComputer = $XMLContent.GPO.Computer.ExtensionData.Extension | Where-Object { $_.PSObject.Properties.TypeNameOfValue -in 'System.Xml.XmlElement', 'System.Object[]' }
+
+    $OutputUser = foreach ($ExtensionType in $XMLContent.GPO.User.ExtensionData.Extension) {
+        if ($ExtensionType) {
+            $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
+            try {
+                $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
+            } catch {
+                Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
+                continue
+            }
+        }
+        $KeysToLoop
+    }
+    $OutputComputer = foreach ($ExtensionType in $XMLContent.GPO.Computer.ExtensionData.Extension) {
+        if ($ExtensionType) {
+            $GPOSettingTypeSplit = ($ExtensionType.type -split ':')
+            try {
+                $KeysToLoop = $ExtensionType | Get-Member -MemberType Properties -ErrorAction Stop | Where-Object { $_.Name -notin 'type', $GPOSettingTypeSplit[0] -and $_.Name -notin @('Blocked') }
+            } catch {
+                Write-Warning "Get-XMLStandard - things went sideways $($_.Exception.Message)"
+                continue
+            }
+        }
+        $KeysToLoop
+    }
+
+    $ComputerSettingsAvailableReal = if ($OutputComputer) { $true } else { $false }
+    $UserSettingsAvailableReal = if ($OutputUser) { $true } else { $false }
+
+    if (-not $ComputerSettingsAvailableReal -and -not $UserSettingsAvailableReal) {
+        $EmptyMaybe = $true
+    } else {
+        $EmptyMaybe = $false
+    }
+
     $ComputerProblem = $false
-    if ($ComputerEnabled -eq $true -and $ComputerSettingsAvailable -eq $true) {
+    if ($ComputerEnabled -eq $true -and $ComputerSettingsAvailableReal -eq $true) {
         $ComputerOptimized = $true
-    } elseif ($ComputerEnabled -eq $true -and $ComputerSettingsAvailable -eq $false) {
+    } elseif ($ComputerEnabled -eq $true -and $ComputerSettingsAvailableReal -eq $false) {
         $ComputerOptimized = $false
-    } elseif ($ComputerEnabled -eq $false -and $ComputerSettingsAvailable -eq $false) {
+    } elseif ($ComputerEnabled -eq $false -and $ComputerSettingsAvailableReal -eq $false) {
         $ComputerOptimized = $true
     } else {
         # Enabled $false, but ComputerData is there.
@@ -73,11 +114,11 @@
     }
 
     $UserProblem = $false
-    if ($UserEnabled -eq $true -and $UserSettingsAvailable -eq $true) {
+    if ($UserEnabled -eq $true -and $UserSettingsAvailableReal -eq $true) {
         $UserOptimized = $true
-    } elseif ($UserEnabled -eq $true -and $UserSettingsAvailable -eq $false) {
+    } elseif ($UserEnabled -eq $true -and $UserSettingsAvailableReal -eq $false) {
         $UserOptimized = $false
-    } elseif ($UserEnabled -eq $false -and $UserSettingsAvailable -eq $false) {
+    } elseif ($UserEnabled -eq $false -and $UserSettingsAvailableReal -eq $false) {
         $UserOptimized = $true
     } else {
         # Enabled $false, but UserData is there.
@@ -148,6 +189,7 @@
             'DomainName'                        = $XMLContent.GPO.Identifier.Domain.'#text'
             'GUID'                              = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
             'Empty'                             = $Empty
+            'EmptyMaybe'                        = $EmptyMaybe
             'Linked'                            = $Linked
             'LinksCount'                        = $LinksTotalCount
             'LinksEnabledCount'                 = $LinksEnabledCount
@@ -161,6 +203,10 @@
             'UserProblem'                       = $UserProblem
             'ComputerSettingsAvailable'         = $ComputerSettingsAvailable
             'UserSettingsAvailable'             = $UserSettingsAvailable
+            'ComputerSettingsAvailableReal'     = $ComputerSettingsAvailableReal
+            'UserSettingsAvailableReal'         = $UserSettingsAvailableReal
+            'ComputerSettingsTypes'             = $OutputComputer.Name
+            'UserSettingsTypes'                 = $OutputUser.Name
             'ComputerSettingsStatus'            = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
             'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false }
             'ComputerSettings'                  = $XMLContent.GPO.Computer.ExtensionData.Extension

Private/Invoke.GPOZaurrOrphans.ps1

@@ -7,15 +7,26 @@
         Get-GPOZaurrBroken
     }
     Processing     = {
+        $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'] = @{}
+        $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssuePerDomain'] = @{}
         foreach ($GPO in $Script:Reporting['GPOOrphans']['Data']) {
+            if (-not $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'][$GPO.DomainName] = 0
+            }
+            if (-not $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssuePerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssuePerDomain'][$GPO.DomainName] = 0
+            }
             if ($GPO.Status -eq 'Not available in AD') {
                 $Script:Reporting['GPOOrphans']['Variables']['NotAvailableInAD']++
                 $Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted']++
+                $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'][$GPO.DomainName]++
             } elseif ($GPO.Status -eq 'Not available on SYSVOL') {
                 $Script:Reporting['GPOOrphans']['Variables']['NotAvailableOnSysvol']++
                 $Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted']++
+                $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'][$GPO.DomainName]++
             } elseif ($GPO.Status -eq 'Permissions issue') {
                 $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssue']++
+                $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssuePerDomain'][$GPO.DomainName]++
             }
         }
         if ($Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted'].Count -gt 0) {
@@ -25,12 +36,15 @@
         }
     }
     Variables      = @{
-        NotAvailableInAD            = 0
-        NotAvailableOnSysvol        = 0
-        NotAvailablePermissionIssue = 0
-        ToBeDeleted                 = 0
+        NotAvailableInAD                     = 0
+        NotAvailableOnSysvol                 = 0
+        NotAvailablePermissionIssue          = 0
+        NotAvailablePermissionIssuePerDomain = $null
+        ToBeDeleted                          = 0
+        ToBeDeletedPerDomain                 = $null
     }
     Overview       = {
+        <#
         New-HTMLPanel {
             New-HTMLText -TextBlock {
                 "Group Policies are stored in two places - Active Directory (metadata) and SYSVOL (content)."
@@ -55,12 +69,13 @@
                 New-ChartBar -Name 'Orphans' -Value $Script:Reporting['GPOOrphans']['Variables']['NotAvailableInAD'], $Script:Reporting['GPOOrphans']['Variables']['NotAvailableOnSysvol'], $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssue']
             } -Title 'Broken / Orphaned Group Policies' -TitleAlignment center
         }
+        #>
     }
     Summary        = {
         New-HTMLText -TextBlock {
             "Group Policies are stored in two places - Active Directory (metadata) and SYSVOL (content)."
             "Since those are managed in different ways, replicated in different ways it's possible because of different issues they get out of sync."
-        } -FontSize 10pt
+        } -FontSize 10pt -LineBreak
         New-HTMLText -Text "For example:" -FontSize 10pt -FontWeight bold
         New-HTMLList -Type Unordered {
             New-HTMLListItem -Text 'USN Rollback in AD could cause already deleted Group Policies to reapper in Active Directory, yet SYSVOL data would be unavailable'
@@ -74,6 +89,12 @@
             New-HTMLListItem -Text 'Group Policies in AD, but no content on SYSVOL: ', $Script:Reporting['GPOOrphans']['Variables']['NotAvailableOnSysvol'] -FontWeight normal, bold
             New-HTMLListItem -Text "Group Policies which couldn't be assed due to permissions issue: ", $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssue'] -FontWeight normal, bold
         } -FontSize 10pt
+        New-HTMLText -Text 'Following domains require actions (permissions required):' -FontSize 10pt -FontWeight bold
+        New-HTMLList -Type Unordered {
+            foreach ($Domain in $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'].Keys) {
+                New-HTMLListItem -Text "$Domain requires ", $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'][$Domain], " changes." -FontWeight normal, bold, normal
+            }
+        } -FontSize 10pt
         New-HTMLText -Text "Please review output in table and follow the steps below table to get Active Directory Group Policies in healthy state." -FontSize 10pt
     }
     Solution       = {
@@ -96,18 +117,9 @@
                 New-HTMLTableCondition -Name 'Status' -Value "Permissions issue" -BackgroundColor MediumVioletRed -ComparisonType string -Color White
             } -PagingOptions 10, 20, 30, 40, 50
         }
-        if ($Script:Reporting['GPOOrphans']['WarningsAndErrors']) {
-            New-HTMLSection -Name 'Warnings & Errors to Review' {
-                New-HTMLTable -DataTable $Script:Reporting['GPOOrphans']['WarningsAndErrors'] -Filtering {
-                    New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
-                    New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
-                }
-            }
-        }
         New-HTMLSection -Name 'Steps to fix - Not available on SYSVOL / Active Directory' {
             New-HTMLContainer {
                 New-HTMLSpanStyle -FontSize 10pt {
-                    New-HTMLText -Text 'Following steps will guide you how to fix GPOs which are not available on SYSVOL or AD.'
                     New-HTMLWizard {
                         New-HTMLWizardStep -Name 'Prepare environment' {
                             New-HTMLText -Text "To be able to execute actions in automated way please install required modules. Those modules will be installed straight from Microsoft PowerShell Gallery."
@@ -128,48 +140,91 @@
                             }
                             New-HTMLText -Text "Alternatively if you prefer working with console you can run: "
                             New-HTMLCodeBlock -Code {
-                                $GPOOutput = Get-GPOZaurrBroken
+                                $GPOOutput = Get-GPOZaurrBroken -Verbose
                                 $GPOOutput | Format-Table
                             }
                             New-HTMLText -Text "It provides same data as you see in table above just doesn't prettify it for you."
                         }
-                        New-HTMLWizardStep -Name 'Fix GPOs not available on SYSVOL' {
-                            New-HTMLText -Text "Following command when executed runs cleanup procedure that removes all broken GPOs on SYSVOL side."
-                            New-HTMLText -Text "Make sure when running it for the first time to run it with ", "WhatIf", " parameter as shown below to prevent accidental removal." -FontWeight normal, bold, normal -Color Black, Red, Black
+                        New-HTMLWizardStep -Name 'Fix GPOs not available in AD' {
+                            New-HTMLText -Text @(
+                                "Following command when executed runs cleanup procedure that removes all broken GPOs on SYSVOL side. ",
+                                "Make sure when running it for the first time to run it with ",
+                                "WhatIf ",
+                                "parameter as shown below to prevent accidental removal. ",
+                                'When run it will remove any GPO remains from SYSVOL, that should not be there, as AD metadata is already gone.'
+                                "Please notice I'm using SYSVOL as a type, because the removal will happen on SYSVOL. "
+                            ) -FontWeight normal, normal, bold, normal -Color Black, Black, Red, Black
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrBroken -Type SYSVOL -WhatIf -Verbose
+                            }
+                            New-HTMLText -TextBlock {
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                            }
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrBroken -Type SYSVOL -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor' -Verbose
+                            }
+                            New-HTMLText -TextBlock {
+                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. "
+                                "Keep in mind that what backup command does is simply copy SYSVOL content to given place. "
+                                "Since there is no GPO metadata in AD there's no real restore process for this step. "
+                                "It's there to make sure if someone kept some data in there and wants to get access to it, he/she can. "
+                            } -LineBreak
+                            New-HTMLText -Text "Once happy with results please follow with command (this will start deletion process): " -LineBreak -FontWeight bold
 
                             New-HTMLCodeBlock -Code {
-                                Remove-GPOZaurrBroken -Type SYSVOL -WhatIf
+                                Remove-GPOZaurrBroken -Type SYSVOL -LimitProcessing 2 -BackupPath $Env:UserProfile\Desktop\GPOSYSVOLBackup -Verbose
                             }
                             New-HTMLText -TextBlock {
-                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. Once happy with results please follow with command: "
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                             }
                             New-HTMLCodeBlock -Code {
-                                Remove-GPOZaurrBroken -Type SYSVOL -LimitProcessing 2 -BackupPath $Env:UserProfile\Desktop\GPOSYSVOLBackup
+                                Remove-GPOZaurrBroken -Type SYSVOL -LimitProcessing 2 -BackupPath $Env:UserProfile\Desktop\GPOSYSVOLBackup -IncludeDomains 'YourDomainYouHavePermissionsFor' -Verbose
                             }
                             New-HTMLText -TextBlock {
-                                "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur."
-                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly."
+                                "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur. "
+                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly. "
+                                "If there's nothing else to be deleted on SYSVOL side, we can skip to next step step. "
                             }
-                            New-HTMLText -Text "If there's nothing else to be deleted on SYSVOL side, we can skip to next step step"
                         }
-                        New-HTMLWizardStep -Name 'Fix GPOs not available on AD' {
-                            New-HTMLText -Text "Following command when executed runs cleanup procedure that removes all broken GPOs on Active Directory side."
-                            New-HTMLText -Text "Make sure when running it for the first time to run it with ", "WhatIf", " parameter as shown below to prevent accidental removal." -FontWeight normal, bold, normal -Color Black, Red, Black
-
+                        New-HTMLWizardStep -Name 'Fix GPOs not available on SYSVOL' {
+                            New-HTMLText -Text @(
+                                "Following command when executed runs cleanup procedure that removes all broken GPOs on Active Directory side."
+                                "Make sure when running it for the first time to run it with ",
+                                "WhatIf",
+                                " parameter as shown below to prevent accidental removal."
+                                'When run it will remove any GPO remains from AD, that should not be there, as SYSVOL content is already gone.'
+                                "Please notice I'm using AD as a type, because the removal will happen on AD side. "
+                            ) -FontWeight normal, normal, bold, normal -Color Black, Black, Red, Black
                             New-HTMLCodeBlock -Code {
-                                Remove-GPOZaurrBroken -Type AD -WhatIf
+                                Remove-GPOZaurrBroken -Type AD -WhatIf -Verbose
                             }
                             New-HTMLText -TextBlock {
-                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. Once happy with results please follow with command: "
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                             }
                             New-HTMLCodeBlock -Code {
-                                Remove-GPOZaurrBroken -Type AD -LimitProcessing 2 -BackupPath $Env:UserProfile\Desktop\GPOSYSVOLBackup
+                                Remove-GPOZaurrBroken -Type AD -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor' -Verbose
                             }
                             New-HTMLText -TextBlock {
-                                "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur."
-                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly."
+                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. "
+                                "Keep in mind that there is no backup for this. "
+                                "Since there is no SYSVOL data, and only AD object is there there's no real restore process for this step. "
+                                "Once you delete it, it's gone. "
+                            } -LineBreak
+                            New-HTMLText -Text 'Once happy with results please follow with command (this will start deletion process): ' -LineBreak -FontWeight bold
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrBroken -Type AD -LimitProcessing 2 -Verbose
+                            }
+                            New-HTMLText -TextBlock {
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                            }
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrBroken -Type AD -LimitProcessing 2 -IncludeDomains 'YourDomainYouHavePermissionsFor' -Verbose
+                            }
+                            New-HTMLText -TextBlock {
+                                "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur. "
+                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly. "
+                                "If there's nothing else to be deleted on AD side, we can skip to next step step. "
                             }
-                            New-HTMLText -Text "If there's nothing else to be deleted on AD side, we can skip to next step step"
                         }
                         New-HTMLWizardStep -Name 'Verification report' {
                             New-HTMLText -TextBlock {
@@ -184,5 +239,13 @@
                 }
             }
         }
+        if ($Script:Reporting['GPOOrphans']['WarningsAndErrors']) {
+            New-HTMLSection -Name 'Warnings & Errors to Review' {
+                New-HTMLTable -DataTable $Script:Reporting['GPOOrphans']['WarningsAndErrors'] -Filtering {
+                    New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
+                    New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
+                }
+            }
+        }
     }
 }

Private/Test-SysvolFolders.ps1

@@ -12,6 +12,7 @@
 
     $GPOGUIDS = $GPOs.ID.GUID
     $SysVolPath = "\\$($Server)\SYSVOL\$Domain\Policies"
+    Write-Verbose "Get-GPOZaurrBroken - Processing SYSVOL from \\$($Server)\SYSVOL\$Domain\Policies"
     try {
         $SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -Exclude 'PolicyDefinitions' -ErrorAction Stop -Verbose:$false
     } catch {
@@ -46,7 +47,10 @@
         }
     }
     $GPOSummary = @(
+        $Count = 0
         foreach ($GPO in $GPOS) {
+            $Count++
+            Write-Verbose "Get-GPOZaurrBroken - Processing [$($GPO.DomainName)]($Count/$($GPOS.Count)) $($GPO.DisplayName)"
             if ($null -ne $SysvolHash[$GPO.Id.GUID].FullName) {
                 $FullPath = $SysvolHash[$GPO.Id.GUID].FullName
                 try {
@@ -92,6 +96,7 @@
             }
         }
         # Now we need to list thru Sysvol files and fine those that do not exists as GPO and create dummy GPO objects to show orphaned gpos
+        Write-Verbose "Get-GPOZaurrBroken - Processing SYSVOL differences and creating dummy objects"
         foreach ($_ in $Differences.Keys) {
             if ($Differences[$_] -in 'Not available in AD', 'Permissions issue') {
                 $FullPath = $SysvolHash[$_].FullName

Public/Remove-GPOZaurrBroken.ps1

@@ -21,7 +21,7 @@
     } else {
         $BackupFinalPath = ''
     }
-    Get-GPOZaurrSysvol -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation | Where-Object {
+    Get-GPOZaurrBroken -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation | Where-Object {
         if ($Type -contains 'SYSVOL') {
             if ($_.Status -eq 'Not available in AD') {
                 $_

README.md

@@ -57,6 +57,12 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
+- 0.0.78 - 10.11.2020
+  - Improved `Remove-GPOZaurrBroken` more verbose
+  - Improved `Get-GPOZaurrBroken` more verbose
+  - Improved `Invoke-GPOZaurr` - type `GPOOrphans`
+  - Improved `Invoke-GPOZaurr` - type `GPOList` - needs more work
+  - Improved `Get-GPOZaurr` with better detection of Empty Policies (needs testing)
 - 0.0.77 - 9.11.2020
   - Improved `Invoke-GPOZaurr` (WIP)
 - 0.0.76 - 8.11.2020