Update

Examples/Example-08-ListingPermissionIssues.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Issues = Get-GPOZaurrPermissionIssue
+$Issues | Format-Table

Examples/Example-11-ReplaceGPOOwnerAutomated.ps1

@@ -4,14 +4,18 @@
 # And also can fix at the same time NotAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins
 # regardless if current user is still Domain Admin or not
 
-$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName
+$GPOs = Get-GPOZaurrOwner -IncludeSysvol
 $GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
 
-#Set-GPOZaurrOwner -Type Unknown -Verbose  #-LimitProcessing 2 -WhatIf
-Set-GPOZaurrOwner -Type NotAdministrative -Verbose -LimitProcessing 2 -WhatIf
-#Set-GPOZaurrOwner -Type NotMatching -Verbose -LimitProcessing 2 -WhatIf
+Set-GPOZaurrOwner -Type Unknown -Verbose -WhatIf  #-LimitProcessing 2
+Set-GPOZaurrOwner -Type All -Verbose -LimitProcessing 2 -WhatIf -IncludeDomains 'ad.evotec.pl'
+Set-GPOZaurrOwner -Type NotMatching -Verbose -LimitProcessing 2 -WhatIf
 
-#Set-GPOZaurrOwner -GPOName 'COMPUTERS | Enable Sets' -Verbose -Principal 'przemyslaw.klys' -WhatIf #-SkipSysvol
-#Set-GPOZaurrOwner -GPOName 'New Group Policy Object' -Verbose #-WhatIf #-SkipSysvol
-#$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName 'New Group Policy Object'
-#$GPOs | Format-Table DisplayName, Owner, OwnerSID
+# This will only set it to przemyslaw klys if the owner is not Domain Admins / Enterprise Admins
+# it's not working currently for any other object
+# You can enforce -Force to set it to any other principal
+Set-GPOZaurrOwner -GPOName 'COMPUTERS | Enable Sets' -Verbose -Principal 'przemyslaw.klys' -WhatIf:$false -Force #-SkipSysvol
+Set-GPOZaurrOwner -GPOName 'New Group Policy Object' -Verbose -WhatIf #-SkipSysvol
+
+$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName 'New Group Policy Object'
+$GPOs | Format-Table DisplayName, Owner, OwnerSID

GPOZaurr.psd1

@@ -6,9 +6,9 @@
     CompatiblePSEditions = @('Desktop')
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
-    FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner')
+    FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.80'
+    ModuleVersion        = '0.0.83'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -18,7 +18,7 @@
         }
     }
     RequiredModules      = @(@{
-            ModuleVersion = '0.0.187'
+            ModuleVersion = '0.0.188'
             ModuleName    = 'PSSharedGoods'
             Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
         }, @{

Private/Get-PrivPermission.ps1

@@ -166,7 +166,7 @@
             #>
 
             # I don't trust the returned data, some stuff like 'alias' shows up for groups. To unify it with everything else... using my own function
-            $PermissionAccount = Get-WinADObject -Identity $GPOPermission.Trustee.Sid.Value -AddType -Cache
+            $PermissionAccount = Get-WinADObject -Identity $GPOPermission.Trustee.Sid.Value -AddType -Cache -Verbose:$false
             if ($PermissionAccount) {
                 $UserNameDomain = $PermissionAccount.DomainName
                 $UserName = $PermissionAccount.Name
@@ -214,7 +214,7 @@
         if ($IncludeOwner) {
             if ($GPO.Owner) {
                 # I don't trust the returned data, some stuff like 'alias' shows up for groups. To unify it with everything else... using my own function
-                $OwnerAccount = Get-WinADObject -Identity $GPO.Owner -AddType -Cache
+                $OwnerAccount = Get-WinADObject -Identity $GPO.Owner -AddType -Cache -Verbose:$false
                 if ($OwnerAccount) {
                     $UserNameDomain = $OwnerAccount.DomainName
                     $UserName = $OwnerAccount.Name

Private/Invoke.GPOZaurrConsistency.ps1

@@ -17,7 +17,7 @@
                 $Script:Reporting['GPOConsistency']['Variables']['InconsistentInside']++
             }
         }
-        if ($Script:Reporting['GPOConsistency']['Variables']['Inconsistent'].Count -gt 0 -or $Script:Reporting['GPOConsistency']['Variables']['InconsistentInside'].Count -gt 0 ) {
+        if ($Script:Reporting['GPOConsistency']['Variables']['Inconsistent'] -gt 0 -or $Script:Reporting['GPOConsistency']['Variables']['InconsistentInside'] -gt 0 ) {
             $Script:Reporting['GPOConsistency']['ActionRequired'] = $true
         } else {
             $Script:Reporting['GPOConsistency']['ActionRequired'] = $false

Private/Invoke.GPOZaurrList.ps1

@@ -65,7 +65,7 @@
             }
         }
         $Script:Reporting['GPOList']['Variables']['GPOTotal'] = $Script:Reporting['GPOList']['Data'].Count
-        if ($Script:Reporting['GPOList']['Variables']['GPOEmptyOrUnlinked'].Count -gt 0) {
+        if ($Script:Reporting['GPOList']['Variables']['GPOEmptyOrUnlinked'] -gt 0) {
             $Script:Reporting['GPOList']['ActionRequired'] = $true
         } else {
             $Script:Reporting['GPOList']['ActionRequired'] = $false

Private/Invoke.GPOZaurrNetLogonPermissions.ps1

@@ -30,7 +30,7 @@
                 $Script:Reporting['NetLogonPermissions']['Variables']['NonOwner'].Add($File)
             }
         }
-        if ($Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'].Count -gt 0) {
+        if ($Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'] -gt 0) {
             $Script:Reporting['NetLogonPermissions']['ActionRequired'] = $true
         } else {
             $Script:Reporting['NetLogonPermissions']['ActionRequired'] = $false

Private/Invoke.GPOZaurrOrphans.ps1

@@ -29,7 +29,7 @@
                 $Script:Reporting['GPOOrphans']['Variables']['NotAvailablePermissionIssuePerDomain'][$GPO.DomainName]++
             }
         }
-        if ($Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted'].Count -gt 0) {
+        if ($Script:Reporting['GPOOrphans']['Variables']['ToBeDeleted'] -gt 0) {
             $Script:Reporting['GPOOrphans']['ActionRequired'] = $true
         } else {
             $Script:Reporting['GPOOrphans']['ActionRequired'] = $false

Private/Invoke.GPOZaurrOwners.ps1

@@ -37,7 +37,7 @@
                 $Script:Reporting['GPOOwners']['Variables']['WillNotTouch']++
             }
         }
-        if ($Script:Reporting['GPOOwners']['Variables']['WillFix'].Count -gt 0) {
+        if ($Script:Reporting['GPOOwners']['Variables']['WillFix'] -gt 0) {
             $Script:Reporting['GPOOwners']['ActionRequired'] = $true
         } else {
             $Script:Reporting['GPOOwners']['ActionRequired'] = $false
@@ -133,18 +133,10 @@
                 New-HTMLTableCondition -Name 'IsOwnerAdministrative' -Value $false -BackgroundColor Salmon -ComparisonType string -Row
             } -PagingOptions 10, 20, 30, 40, 50
         }
-        if ($Script:Reporting['GPOOwners']['WarningsAndErrors']) {
-            New-HTMLSection -Name 'Warnings & Errors to Review' {
-                New-HTMLTable -DataTable $Script:Reporting['GPOOwners']['WarningsAndErrors'] -Filtering {
-                    New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
-                    New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
-                }
-            }
-        }
         New-HTMLSection -Name 'Steps to fix Group Policy Owners' {
             New-HTMLContainer {
                 New-HTMLSpanStyle -FontSize 10pt {
-                    New-HTMLText -Text 'Following steps will guide you how to fix group policy owners'
+                    #New-HTMLText -Text 'Following steps will guide you how to fix group policy owners'
                     New-HTMLWizard {
                         New-HTMLWizardStep -Name 'Prepare environment' {
                             New-HTMLText -Text "To be able to execute actions in automated way please install required modules. Those modules will be installed straight from Microsoft PowerShell Gallery."
@@ -226,5 +218,13 @@
                 }
             }
         }
+        if ($Script:Reporting['GPOOwners']['WarningsAndErrors']) {
+            New-HTMLSection -Name 'Warnings & Errors to Review' {
+                New-HTMLTable -DataTable $Script:Reporting['GPOOwners']['WarningsAndErrors'] -Filtering {
+                    New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
+                    New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
+                } -PagingOptions 10, 20, 30, 40, 50
+            }
+        }
     }
 }

Private/Invoke.GPOZaurrPermissionsRead.ps1

@@ -0,0 +1,246 @@
+$GPOZaurrPermissionsRead = [ordered] @{
+    Name       = 'Group Policy Authenticated Users Permissions'
+    Enabled    = $true
+    Action     = $null
+    Data       = $null
+    Execute    = {
+        [ordered] @{
+            Permissions = Get-GPOZaurrPermission -Type AuthenticatedUsers -ReturnSecurityWhenNoData
+            Issues      = Get-GPOZaurrPermissionIssue
+        }
+    }
+    Processing = {
+        # This is a workaround - we need to use it since we have 0 permissions
+
+        # Create Per Domain Variables
+        $Script:Reporting['GPOPermissionsRead']['Variables']['WillFixPerDomain'] = @{}
+        $Script:Reporting['GPOPermissionsRead']['Variables']['WillNotTouchPerDomain'] = @{}
+        $Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'] = @{}
+        $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'] = @{}
+
+        foreach ($GPO in $Script:Reporting['GPOPermissionsRead']['Data'].Issues) {
+            # Create Per Domain Variables
+            if (-not $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'][$GPO.DomainName] = 0
+            }
+            if (-not $Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'][$GPO.DomainName] = 0
+            }
+            if ($GPO.PermissionIssue) {
+                $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotRead']++
+                $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'][$GPO.DomainName]++
+            } else {
+                $Script:Reporting['GPOPermissionsRead']['Variables']['Read']++
+                $Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'][$GPO.DomainName]++
+            }
+        }
+        foreach ($GPO in $Script:Reporting['GPOPermissionsRead']['Data'].Permissions) {
+            # Create Per Domain Variables
+            if (-not $Script:Reporting['GPOPermissionsRead']['Variables']['WillFixPerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOPermissionsRead']['Variables']['WillFixPerDomain'][$GPO.DomainName] = 0
+            }
+            if (-not $Script:Reporting['GPOPermissionsRead']['Variables']['WillNotTouchPerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOPermissionsRead']['Variables']['WillNotTouchPerDomain'][$GPO.DomainName] = 0
+            }
+            # Checks
+            if ($GPO.Permission -in 'GpoApply', 'GpoRead') {
+                $Script:Reporting['GPOPermissionsRead']['Variables']['WillNotTouch']++
+                $Script:Reporting['GPOPermissionsRead']['Variables']['WillNotTouchPerDomain'][$GPO.DomainName]++
+            } else {
+                $Script:Reporting['GPOPermissionsRead']['Variables']['WillFix']++
+                $Script:Reporting['GPOPermissionsRead']['Variables']['WillFixPerDomain'][$GPO.DomainName]++
+            }
+        }
+        if ($Script:Reporting['GPOPermissionsRead']['Variables']['WillFix'] -gt 0 -or $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotRead'] -gt 0) {
+            $Script:Reporting['GPOPermissionsRead']['ActionRequired'] = $true
+        } else {
+            $Script:Reporting['GPOPermissionsRead']['ActionRequired'] = $false
+        }
+        # Summary from 2 reports
+        $Script:Reporting['GPOPermissionsRead']['Variables']['TotalToFix'] = $Script:Reporting['GPOPermissionsRead']['Variables']['WillFix'] + $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotRead']
+    }
+    Variables  = @{
+        WillFix               = 0
+        WillNotTouch          = 0
+        WillFixPerDomain      = $null
+        WillNotTouchPerDomain = $null
+        CouldNotRead          = 0
+        CouldNotReadPerDomain = $null
+        Read                  = 0
+        ReadPerDomain         = $null
+        TotalToFix            = 0
+    }
+    Overview   = {
+
+    }
+    Summary    = {
+        New-HTMLText -FontSize 10pt -TextBlock {
+            "When GPO is created one of the permissions that are required for proper functioning of Group Policies is NT AUTHORITY\Authenticated Users. "
+            "Some Administrators don't follow best practices and trying to remove GpoApply permission, remove also GpoRead permission from a GPO which can have consequences. "
+        } -LineBreak
+        New-HTMLText -Text "On June 14th, 2016 Microsoft released [HotFix](https://support.microsoft.com/en-gb/help/3159398/ms16-072-description-of-the-security-update-for-group-policy-june-14-2) that requires Authenticated Users to be present on all Group Policies to function properly: " -FontSize 10pt
+        New-HTMLText -TextBlock {
+            "MS16-072 changes the security context with which user group policies are retrieved. "
+            "This by-design behavior change protects customers’ computers from a security vulnerability. "
+            "Before MS16-072 is installed, user group policies were retrieved by using the user’s security context. "
+            "After MS16-072 is installed, user group policies are retrieved by using the computer's security context."
+        } -FontStyle italic -FontSize 10pt -FontWeight bold -LineBreak
+        New-HTMLText -FontSize 10pt -Text @(
+            "There are two parts to this assesment. Reading all Group Policies Permissions that account ",
+            $($Env:USERNAME.ToUpper()),
+            " has permissions to read and provide detailed assesment about permissions. ",
+            "Second assesment checks for permissions that this account is not able to read at all, and therefore it has no visibility about permissions set on it. "
+            "We just were able to detect the problem, but hopefully higher level account (Domain Admin) should be able to provide full assesment. "
+        ) -FontWeight normal, bold, normal
+        New-HTMLText -FontSize 10pt -Text "First assesment results: " -FontWeight bold
+        New-HTMLList -Type Unordered {
+            New-HTMLListItem -Text 'Group Policies requiring Authenticated Users with GpoRead permission: ', $Script:Reporting['GPOPermissionsRead']['Variables']['WillFix'] -FontWeight normal, bold
+            New-HTMLListItem -Text "Group Policies which don't require changes: ", $Script:Reporting['GPOPermissionsRead']['Variables']['WillNotTouch'] -FontWeight normal, bold
+        } -FontSize 10pt
+        New-HTMLText -Text 'Following domains require actions (permissions required):' -FontSize 10pt -FontWeight bold
+        New-HTMLList -Type Unordered {
+            foreach ($Domain in $Script:Reporting['GPOPermissionsRead']['Variables']['WillFixPerDomain'].Keys) {
+                New-HTMLListItem -Text "$Domain requires ", $Script:Reporting['GPOPermissionsRead']['Variables']['WillFixPerDomain'][$Domain], " changes." -FontWeight normal, bold, normal
+            }
+        } -FontSize 10pt
+        New-HTMLText -FontSize 10pt -Text "Secondary assesment results: " -FontWeight bold
+        New-HTMLList -Type Unordered {
+            New-HTMLListItem -Text "Group Policies couldn't read at all: ", $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotRead'] -FontWeight normal, bold
+            New-HTMLListItem -Text "Group Policies with permissions allowing read: ", $Script:Reporting['GPOPermissionsRead']['Variables']['Read'] -FontWeight normal, bold
+        } -FontSize 10pt
+        New-HTMLText -Text @(
+            "That means we need to fix permissions on: "
+            $($Script:Reporting['GPOPermissionsRead']['Variables']['TotalToFix'])
+            " out of "
+            $($Script:Reporting['GPOPermissionsRead']['Data'].Issues).Count
+            " Group Policies. "
+        ) -FontSize 10pt -FontWeight bold, bold, normal, bold, normal -Color Black, FreeSpeechRed, Black, Black -LineBreak -TextDecoration none, underline, underline, underline, none
+    }
+    Solution   = {
+        New-HTMLSection -Invisible {
+            New-HTMLPanel {
+                & $Script:GPOConfiguration['GPOPermissionsRead']['Summary']
+            }
+            New-HTMLPanel {
+                New-HTMLChart {
+                    New-ChartBarOptions -Type barStacked
+                    New-ChartLegend -Name 'Yes', 'No' -Color LightGreen, Salmon
+                    New-ChartBar -Name 'Authenticated Users Available' -Value $Script:Reporting['GPOPermissionsRead']['Variables']['WillNotTouch'], $Script:Reporting['GPOPermissionsRead']['Variables']['WillFix']
+                    New-ChartBar -Name 'Accessible Group Policies' -Value $Script:Reporting['GPOPermissionsRead']['Variables']['Read'], $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotRead']
+                } -Title 'Group Policy Permissions' -TitleAlignment center
+            }
+        }
+        New-HTMLSection -Name 'Group Policy Authenticated Users Analysis' {
+            New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsRead']['Data'].Permissions -Filtering {
+                New-HTMLTableCondition -Name 'Permission' -Value '' -BackgroundColor Salmon -ComparisonType string -Row
+            } -PagingOptions 7, 15, 30, 45, 60
+        }
+        New-HTMLSection -Name 'Group Policy Issues Assesment' {
+            New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsRead']['Data'].Issues -Filtering {
+                New-HTMLTableCondition -Name 'PermissionIssue' -Value $true -BackgroundColor Salmon -ComparisonType string -Row
+            } -PagingOptions 7, 15, 30, 45, 60 -DefaultSortColumn PermissionIssue -DefaultSortOrder Descending
+        }
+        New-HTMLSection -Name 'Steps to fix Group Policy Authenticated Users' {
+            New-HTMLContainer {
+                New-HTMLSpanStyle -FontSize 10pt {
+                    New-HTMLWizard {
+                        New-HTMLWizardStep -Name 'Prepare environment' {
+                            New-HTMLText -Text "To be able to execute actions in automated way please install required modules. Those modules will be installed straight from Microsoft PowerShell Gallery."
+                            New-HTMLCodeBlock -Code {
+                                Install-Module GPOZaurr -Force
+                                Import-Module GPOZaurr -Force
+                            } -Style powershell
+                            New-HTMLText -Text "Using force makes sure newest version is downloaded from PowerShellGallery regardless of what is currently installed. Once installed you're ready for next step."
+                        }
+                        New-HTMLWizardStep -Name 'Prepare report' {
+                            New-HTMLText -Text "Depending when this report was run you may want to prepare new report before proceeding with fixing Group Policy Authenticated Users. To generate new report please use:"
+                            New-HTMLCodeBlock -Code {
+                                Invoke-GPOZaurr -FilePath $Env:UserProfile\Desktop\GPOZaurrGPOPermissionsReadBefore.html -Verbose -Type GPOPermissionsRead
+                            }
+                            New-HTMLText -TextBlock {
+                                "When executed it will take a while to generate all data and provide you with new report depending on size of environment. "
+                                "GPOs with problems will be those not having any value for Permission/PermissionType columns. "
+                                "Once confirmed that data is still showing issues and requires fixing please proceed with next step."
+                            }
+                            New-HTMLText -Text "Alternatively if you prefer working with console you can run: "
+                            New-HTMLCodeBlock -Code {
+                                $AuthenticatedUsers = Get-GPOZaurrPermission -Type AuthenticatedUsers -ReturnSecurityWhenNoData
+                                $AuthenticatedUsers | Format-Table
+                            }
+                            New-HTMLText -Text "It provides same data as you see in table above just doesn't prettify it for you."
+                        }
+                        New-HTMLWizardStep -Name 'Make a backup (optional)' {
+                            New-HTMLText -TextBlock {
+                                "The process of fixing GPO Permissions does NOT touch GPO content. It simply adds permissionss on AD and SYSVOL at the same time for given GPO. "
+                                "However, it's always good to have a backup before executing changes that may impact Active Directory. "
+                            }
+                            New-HTMLCodeBlock -Code {
+                                $GPOSummary = Backup-GPOZaurr -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -Type All
+                                $GPOSummary | Format-Table # only if you want to display output of backup
+                            }
+                            New-HTMLText -TextBlock {
+                                "Above command when executed will make a backup to Desktop, create GPO folder and within it it will put all those GPOs. "
+                            }
+                        }
+
+                        New-HTMLWizardStep -Name 'Add Authenticated Users ability to read all GPO' {
+                            New-HTMLText -Text @(
+                                "Following command will find any GPO which doesn't have Authenticated User as GpoRead or GpoApply and will add it as GpoRead. ",
+                                "This change doesn't change GpoApply permission, therefore it won't change to whom the GPO applies to. ",
+                                "It ensures that COMPUTERS can read GPO properly to be able to Apply it. ",
+                                "Make sure when running it for the first time to run it with ",
+                                "WhatIf",
+                                " parameter as shown below to prevent accidental adding of permissions."
+                            ) -FontWeight normal, normal, normal, normal, bold, normal -Color Black, Black, Black, Black, Red, Black
+                            New-HTMLCodeBlock -Code {
+                                Add-GPOZaurrPermission -Type AuthenticatedUsers -PermissionType GpoRead -All -WhatIf -Verbose
+                            }
+                            New-HTMLText -TextBlock {
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                            }
+                            New-HTMLCodeBlock -Code {
+                                Add-GPOZaurrPermission -Type AuthenticatedUsers -PermissionType GpoRead -All -WhatIf -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                            }
+                            New-HTMLText -TextBlock {
+                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be changed matches expected data."
+                            } -LineBreak
+                            New-HTMLText -Text "Once happy with results please follow with command (this will start fixing process): " -LineBreak -FontWeight bold
+                            New-HTMLCodeBlock -Code {
+                                Add-GPOZaurrPermission -Type AuthenticatedUsers -PermissionType GpoRead -All -Verbose -LimitProcessing 2
+                            }
+                            New-HTMLText -TextBlock {
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                            }
+                            New-HTMLCodeBlock -Code {
+                                Add-GPOZaurrPermission -Type AuthenticatedUsers -PermissionType GpoRead -All -Verbose -LimitProcessing 2 -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                            }
+                            New-HTMLText -TextBlock {
+                                "This command when executed adds Authenticated Users (GpoRead permission) only on first X non-compliant Group Policies. "
+                                "Use LimitProcessing parameter to prevent mass change and increase the counter when no errors occur."
+                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. "
+                                "In case of any issues please review and action accordingly."
+                            }
+                        }
+                        New-HTMLWizardStep -Name 'Verification report' {
+                            New-HTMLText -TextBlock {
+                                "Once cleanup task was executed properly, we need to verify that report now shows no problems."
+                            }
+                            New-HTMLCodeBlock -Code {
+                                Invoke-GPOZaurr -FilePath $Env:UserProfile\Desktop\GPOZaurrGPOPermissionsReadAfter.html -Verbose -Type GPOPermissionsRead
+                            }
+                            New-HTMLText -Text "If everything is healthy in the report you're done! Enjoy rest of the day!" -Color BlueDiamond
+                        }
+                    } -RemoveDoneStepOnNavigateBack -Theme arrows -ToolbarButtonPosition center
+                }
+            }
+        }
+        if ($Script:Reporting['GPOPermissionsRead']['WarningsAndErrors']) {
+            New-HTMLSection -Name 'Warnings & Errors to Review' {
+                New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsRead']['WarningsAndErrors'] -Filtering {
+                    New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
+                    New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
+                } -PagingOptions 10, 20, 30, 40, 50
+            }
+        }
+    }
+}

Private/Script.GPOConfiguration.ps1

@@ -6,6 +6,7 @@
     GPOList               = $GPOZaurrList
     GPOPassword           = $GPOZaurrPassword
     GPOPermissions        = $GPOZaurrPermissions
+    GPOPermissionsRead    = $GPOZaurrPermissionsRead
     GPOPermissionsRoot    = $GPOZaurrPermissionsRoot
     GPOFiles              = $GPOZaurrFiles
     GPOBlockedInheritance = $GPOZaurrBlockedInheritance

Public/Get-GPOZaurrOwner.ps1

@@ -19,7 +19,7 @@
     Doesn't display GPOs that have no SYSVOL content (orphaned GPOs)
 
     .PARAMETER Forest
-    Target different Forest
+    Target different Forest, by default current forest is used
 
     .PARAMETER ExcludeDomains
     Exclude domain from search, by default whole forest is scanned

Public/Get-GPOZaurrPassword.ps1

@@ -7,16 +7,16 @@
     Tries to find CPassword in Group Policies or given path and translate it to readable value
 
     .PARAMETER Forest
-    Specify forest name. By default current forest is used
+    Target different Forest, by default current forest is used
 
     .PARAMETER ExcludeDomains
-    Exclude Domain or Domains
+    Exclude domain from search, by default whole forest is scanned
 
     .PARAMETER IncludeDomains
-    Include only certain Domain or Domains
+    Include only specific domains, by default whole forest is scanned
 
     .PARAMETER ExtendedForestInformation
-    Ability to provide extended forest information in advanced scenarios
+    Ability to provide Forest Information from another command to speed up processing
 
     .PARAMETER GPOPath
     Path where Group Policy content is located or where backup is located

Public/Get-GPOZaurrPermissionIssue.ps1

@@ -0,0 +1,65 @@
+function Get-GPOZaurrPermissionIssue {
+    <#
+    .SYNOPSIS
+    Detects Group Policy missing Authenticated Users permission while not having higher permissions.
+
+    .DESCRIPTION
+    Detects Group Policy missing Authenticated Users permission while not having higher permissions.
+
+    .PARAMETER Forest
+    Target different Forest, by default current forest is used
+
+    .PARAMETER ExcludeDomains
+    Exclude domain from search, by default whole forest is scanned
+
+    .PARAMETER IncludeDomains
+    Include only specific domains, by default whole forest is scanned
+
+    .PARAMETER ExtendedForestInformation
+    Ability to provide Forest Information from another command to speed up processing
+
+    .EXAMPLE
+    $Issues = Get-GPOZaurrPermissionIssue
+    $Issues | Format-Table
+
+    .NOTES
+    General notes
+    #>
+    [cmdletBinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExcludeDomainControllers $ExcludeDomainControllers -IncludeDomainControllers $IncludeDomainControllers -SkipRODC:$SkipRODC -ExtendedForestInformation $ExtendedForestInformation -Extended
+    foreach ($Domain in $ForestInformation.Domains) {
+        $TimeLog = Start-TimeLog
+        Write-Verbose "Get-GPOZaurrPermissionIssue - Starting process for $Domain"
+        $QueryServer = $ForestInformation['QueryServers']["$Domain"].HostName[0]
+        $SystemsContainer = $ForestInformation['DomainsExtended'][$Domain].SystemsContainer
+        if ($SystemsContainer) {
+            $PoliciesSearchBase = -join ("CN=Policies,", $SystemsContainer)
+            $Properties = 'DisplayName', 'Name', 'DistinguishedName', 'ObjectClass', 'WhenCreated', 'WhenChanged'
+            $PoliciesInAD = Get-ADObject -SearchBase $PoliciesSearchBase -SearchScope OneLevel -Filter * -Server $QueryServer -Properties $Properties
+            foreach ($Policy in $PoliciesInAD) {
+                $GUIDFromDN = ConvertFrom-DistinguishedName -DistinguishedName $Policy.DistinguishedName
+                $GUIDFromDN = $GUIDFromDN -replace '{' -replace '}'
+                $GUID = $Policy.Name -replace '{' -replace '}'
+                [PSCustomObject] @{
+                    DisplayName       = $Policy.DisplayName
+                    DomainName        = $Domain
+                    PermissionIssue   = -not ($GUID -and $GUIDFromDN)
+                    ObjectClass       = $Policy.ObjectClass
+                    Name              = $Policy.Name
+                    DistinguishedName = $Policy.DistinguishedName
+                    GUID              = $GUIDFromDN
+                    WhenCreated       = $Policy.WhenCreated
+                    WhenChanged       = $Policy.WhenChanged
+                }
+            }
+        }
+        $TimeEnd = Stop-TimeLog -Time $TimeLog -Option OneLiner
+        Write-Verbose "Get-GPOZaurrPermissionIssue - Finishing process for $Domain (Time to process: $TimeEnd)"
+    }
+}

Public/Set-GPOZaurrOwner.ps1

@@ -18,7 +18,7 @@
     GUID of GPO. By default all GPOs are targetted
 
     .PARAMETER Forest
-    Target different Forest
+    Target different Forest, by default current forest is used
 
     .PARAMETER ExcludeDomains
     Exclude domain from search, by default whole forest is scanned

README.md

@@ -57,8 +57,19 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
-- 0.0.80
-  - [x] Improves `Invoke-GPOZaurr`
+- 0.0.83 - 14.11.2020
+  - [x] Improves `Invoke-GPOZaurr` (WIP)
+    - [x] Fix for wrong ActionRequired count
+- 0.0.82 - 14.11.2020
+  - [x] Added `Get-GPOZaurrPermissionIssue` to detect permission issue with no rights
+  - [x] Improves `Invoke-GPOZaurr` (WIP)
+    - [x] Type `GPOPermissionsRead` improved detection of problems with low permissions
+- 0.0.81 - 12.11.2020
+  - [x] Fix for `Set-GPOZaurrOwner` in case of missing permissions to not throw errors
+  - [x] Improves `Invoke-GPOZaurr` (WIP)
+    - [x] Type `GPOPermissionsRead` added
+- 0.0.80 - 12.11.2020
+  - [x] Improves `Invoke-GPOZaurr` (WIP)
     - [x] Type `GPOOrphans` clearer options, updated texts, split per domain
     - [x] Type `GPOOwners` clearer options, updated texts, split per domain
   - [x] Improves `Add-GPOZaurrPermission`