Update

GPOZaurr.psd1

@@ -8,7 +8,7 @@
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
     FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.83'
+    ModuleVersion        = '0.0.84'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -26,7 +26,7 @@
             ModuleName    = 'ADEssentials'
             Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
         }, @{
-            ModuleVersion = '0.0.120'
+            ModuleVersion = '0.0.121'
             ModuleName    = 'PSWriteHTML'
             Guid          = 'a7bdf640-f5cb-4acf-9de0-365b322d245c'
         }, 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility', 'Microsoft.PowerShell.Security')

Private/Invoke.GPOZaurrNetLogonPermissions.ps1

@@ -109,14 +109,6 @@
                     New-HTMLTableCondition -Name 'PrincipalType' -Value "WellKnownAdministrative" -BackgroundColor LightGreen -ComparisonType string -Operator eq
                 }
             }
-            if ($Script:Reporting['NetLogonPermissions']['WarningsAndErrors']) {
-                New-HTMLSection -Name 'Warnings & Errors to Review' {
-                    New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['WarningsAndErrors'] -Filtering {
-                        New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
-                        New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
-                    }
-                }
-            }
             New-HTMLSection -Name 'Steps to fix NetLogon Owners ' {
                 New-HTMLContainer {
                     New-HTMLSpanStyle -FontSize 10pt {
@@ -141,7 +133,7 @@
                                 }
                                 New-HTMLText -Text "Alternatively if you prefer working with console you can run: "
                                 New-HTMLCodeBlock -Code {
-                                    $NetLogonOutput = Get-GPOZaurrNetLogon -Verbose
+                                    $NetLogonOutput = Get-GPOZaurrNetLogon -OwnerOnly -Verbose
                                     $NetLogonOutput | Format-Table
                                 }
                                 New-HTMLText -Text "It provides same data as you see in table above just doesn't prettify it for you."
@@ -177,10 +169,48 @@
                     }
                 }
             }
+            if ($Script:Reporting['NetLogonPermissions']['WarningsAndErrors']) {
+                New-HTMLSection -Name 'Warnings & Errors to Review' {
+                    New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['WarningsAndErrors'] -Filtering {
+                        New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
+                        New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
+                    }
+                }
+            }
         }
         New-HTMLTab -Name 'NetLogon Permissions' {
+            New-HTMLSection -Invisible {
+                New-HTMLPanel {
+                    #& $Script:GPOConfiguration['NetLogonPermissions']['Summary']
+                }
+                New-HTMLPanel {
+                    #New-HTMLChart {
+                    #    New-ChartPie -Name 'Correct Owners' -Value $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersAdministrators'] -Color LightGreen
+                    #    New-ChartPie -Name 'Incorrect Owners' -Value $Script:Reporting['NetLogonPermissions']['Variables']['NetLogonOwnersToFix'] -Color Crimson
+                    #} -Title 'NetLogon Owners' -TitleAlignment center
+                }
+            }
+            # New-HTMLSection -Name 'NetLogon Files List' {
+            #     New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['Variables']['Owner'] -Filtering {
+            #         New-HTMLTableCondition -Name 'PrincipalSid' -Value "S-1-5-32-544" -BackgroundColor LightGreen -ComparisonType string
+            #         New-HTMLTableCondition -Name 'PrincipalSid' -Value "S-1-5-32-544" -BackgroundColor Salmon -ComparisonType string -Operator ne
+            #         New-HTMLTableCondition -Name 'PrincipalType' -Value "WellKnownAdministrative" -BackgroundColor LightGreen -ComparisonType string -Operator eq
+            #     }
+            # }
             New-HTMLSection -Name 'NetLogon Files List' {
-                New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['Variables']['NonOwner'] -Filtering
+                New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['Variables']['NonOwner'] -Filtering {
+                    New-HTMLTableCondition -Name 'PrincipalType' -Value "Unknown" -BackgroundColor Salmon -ComparisonType string -Operator eq -Row
+                    New-HTMLTableCondition -Name 'PrincipalType' -Value "WellKnownAdministrative" -BackgroundColor LightGreen -ComparisonType string -Operator eq -Row
+                    New-HTMLTableCondition -Name 'Status' -Value "Review Required" -BackgroundColor PaleGoldenrod -ComparisonType string -Operator eq -Row
+                }
+            }
+            if ($Script:Reporting['NetLogonPermissions']['WarningsAndErrors']) {
+                New-HTMLSection -Name 'Warnings & Errors to Review' {
+                    New-HTMLTable -DataTable $Script:Reporting['NetLogonPermissions']['WarningsAndErrors'] -Filtering {
+                        New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
+                        New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
+                    }
+                }
             }
         }
     }

Private/Invoke.GPOZaurrPermissionsRead.ps1

@@ -17,6 +17,7 @@
         $Script:Reporting['GPOPermissionsRead']['Variables']['WillNotTouchPerDomain'] = @{}
         $Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'] = @{}
         $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'] = @{}
+        $Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'] = @{}
 
         foreach ($GPO in $Script:Reporting['GPOPermissionsRead']['Data'].Issues) {
             # Create Per Domain Variables
@@ -26,6 +27,9 @@
             if (-not $Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'][$GPO.DomainName]) {
                 $Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'][$GPO.DomainName] = 0
             }
+            if (-not $Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'][$GPO.DomainName] = 0
+            }
             if ($GPO.PermissionIssue) {
                 $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotRead']++
                 $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'][$GPO.DomainName]++
@@ -33,6 +37,7 @@
                 $Script:Reporting['GPOPermissionsRead']['Variables']['Read']++
                 $Script:Reporting['GPOPermissionsRead']['Variables']['ReadPerDomain'][$GPO.DomainName]++
             }
+            $Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'][$GPO.DomainName]++
         }
         foreach ($GPO in $Script:Reporting['GPOPermissionsRead']['Data'].Permissions) {
             # Create Per Domain Variables
@@ -69,6 +74,7 @@
         Read                  = 0
         ReadPerDomain         = $null
         TotalToFix            = 0
+        TotalPerDomain        = $null
     }
     Overview   = {
 
@@ -108,6 +114,18 @@
             New-HTMLListItem -Text "Group Policies couldn't read at all: ", $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotRead'] -FontWeight normal, bold
             New-HTMLListItem -Text "Group Policies with permissions allowing read: ", $Script:Reporting['GPOPermissionsRead']['Variables']['Read'] -FontWeight normal, bold
         } -FontSize 10pt
+        New-HTMLText -Text 'With split per domain (permissions required):' -FontSize 10pt -FontWeight bold
+        New-HTMLList -Type Unordered {
+            foreach ($Domain in $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'].Keys) {
+                New-HTMLListItem -Text @(
+                    "$Domain requires ",
+                    $Script:Reporting['GPOPermissionsRead']['Variables']['CouldNotReadPerDomain'][$Domain],
+                    " changes out of ",
+                    $Script:Reporting['GPOPermissionsRead']['Variables']['TotalPerDomain'][$Domain],
+                    "."
+                ) -FontWeight normal, bold, normal
+            }
+        } -FontSize 10pt
         New-HTMLText -Text @(
             "That means we need to fix permissions on: "
             $($Script:Reporting['GPOPermissionsRead']['Variables']['TotalToFix'])

Public/Get-GPOZaurrNetlogon.ps1

@@ -30,8 +30,14 @@
             }
             if (-not $OwnerOnly) {
                 if (-not $SkipOwner) {
+                    if ($IdentityOwner.SID -eq "S-1-5-32-544") {
+                        $Status = 'OK'
+                    } else {
+                        $Status = 'Replace Owner Required'
+                    }
                     [PSCustomObject] @{
                         FullName          = $File.FullName
+                        Status            = $Status
                         Extension         = $File.Extension
                         CreationTime      = $File.CreationTime
                         LastAccessTime    = $File.LastAccessTime
@@ -44,14 +50,25 @@
                         FileSystemRights  = 'Owner'  # : FullControl
                         IsInherited       = $false
                         FullNameOnSysVol  = $File.FullName.Replace($Path, $PathOnSysvol)
-                        #Owner             = $ACL.Owner
                     }
                 }
-                $FilePermission = Get-FilePermissions -Path $_.FullName -ACLS $ACL -Verbose:$false
+                $FilePermission = Get-FilePermissions -Path $File.FullName -ACLS $ACL -Verbose:$false
                 foreach ($Perm in $FilePermission) {
                     $Identity = Convert-Identity -Identity $Perm.Principal -Verbose:$false
+                    $Status = $null
+                    if ($Perm.FileSystemRights -eq [System.Security.AccessControl.FileSystemRights]::FullControl) {
+                        if ($Identity.Type -eq 'WellKnownAdministrative') {
+                            $Status = 'OK'
+                        } else {
+                            $Status = 'Review Required'
+                        }
+                    }
+                    if ($Identity.Type -eq 'Unknown') {
+                        $Status = 'Removal Required'
+                    }
                     [PSCustomObject] @{
                         FullName          = $File.FullName
+                        Status            = $Status
                         Extension         = $File.Extension
                         CreationTime      = $File.CreationTime
                         LastAccessTime    = $File.LastAccessTime
@@ -65,6 +82,7 @@
                         IsInherited       = $Perm.IsInherited       # : True
                         FullNameOnSysVol  = $File.FullName.Replace($Path, $PathOnSysvol)
                     }
+
                 }
             } else {
                 [PSCustomObject] @{

README.md

@@ -57,6 +57,10 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
+- 0.0.84 - 16.11.2020
+  - [x] Improves `Invoke-GPOZaurr` (WIP)
+    - [x] Type `NetLogonPermissions`
+  - [x] Fix for `Get-GPOZaurrNetLogon`
 - 0.0.83 - 14.11.2020
   - [x] Improves `Invoke-GPOZaurr` (WIP)
     - [x] Fix for wrong ActionRequired count