Update PSD1

GPOZaurr.psd1

@@ -8,7 +8,7 @@
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
     FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.85'
+    ModuleVersion        = '0.0.88'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -26,7 +26,7 @@
             ModuleName    = 'ADEssentials'
             Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
         }, @{
-            ModuleVersion = '0.0.121'
+            ModuleVersion = '0.0.122'
             ModuleName    = 'PSWriteHTML'
             Guid          = 'a7bdf640-f5cb-4acf-9de0-365b322d245c'
         }, 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility', 'Microsoft.PowerShell.Security')

Private/Invoke.GPOZaurrAnalysis.ps1

@@ -4,7 +4,7 @@
     ActionRequired = $null
     Data           = $null
     Execute        = {
-        Invoke-GPOZaurrContent
+        Invoke-GPOZaurrContent -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
     }
     Processing     = {
 

Private/Invoke.GPOZaurrBlockedInheritance.ps1

@@ -4,7 +4,7 @@
     ActionRequired = $null
     Data           = $null
     Execute        = {
-        Get-GPOZaurrInheritance -IncludeBlockedObjects -OnlyBlockedInheritance
+        Get-GPOZaurrInheritance -IncludeBlockedObjects -OnlyBlockedInheritance -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
     }
     Processing     = {
 

Private/Invoke.GPOZaurrConsistency.ps1

@@ -3,7 +3,9 @@
     Enabled        = $true
     ActionRequired = $null
     Data           = $null
-    Execute        = { Get-GPOZaurrPermissionConsistency -Type All -VerifyInheritance }
+    Execute        = {
+        Get-GPOZaurrPermissionConsistency -Type All -VerifyInheritance -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
+    }
     Processing     = {
         foreach ($GPO in $Script:Reporting['GPOConsistency']['Data']) {
             if ($GPO.ACLConsistent -eq $true) {

Private/Invoke.GPOZaurrDuplicate.ps1

@@ -4,7 +4,7 @@
     Action     = $null
     Data       = $null
     Execute    = {
-        Get-GPOZaurrDuplicateObject
+        Get-GPOZaurrDuplicateObject -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
     }
     Processing = {
         $Script:Reporting['GPODuplicates']['Variables']['RequireDeletion'] = $Script:Reporting['GPODuplicates']['Data'].Count

Private/Invoke.GPOZaurrFiles.ps1

@@ -4,7 +4,7 @@
     ActionRequired = $null
     Data           = $null
     Execute        = {
-        Get-GPOZaurrFiles
+        Get-GPOZaurrFiles -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
     }
     Processing     = {
 

Private/Invoke.GPOZaurrList.ps1

@@ -4,7 +4,7 @@
     Action     = $null
     Data       = $null
     Execute    = {
-        Get-GPOZaurr
+        Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
     }
     Processing = {
         foreach ($GPO in $Script:Reporting['GPOList']['Data']) {

Private/Invoke.GPOZaurrNetLogonOwners.ps1

@@ -4,7 +4,7 @@
     ActionRequired = $null
     Data           = $null
     Execute        = {
-        Get-GPOZaurrNetLogon -OwnerOnly
+        Get-GPOZaurrNetLogon -OwnerOnly -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
     }
     Processing     = {
         foreach ($File in $Script:Reporting['NetLogonOwners']['Data']) {

Private/Invoke.GPOZaurrNetLogonPermissions.ps1

@@ -4,7 +4,7 @@
     ActionRequired = $null
     Data           = $null
     Execute        = {
-        Get-GPOZaurrNetLogon -SkipOwner
+        Get-GPOZaurrNetLogon -SkipOwner -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
     }
     Processing     = {
         $Script:Reporting['NetLogonPermissions']['Variables']['PermissionWriteReviewPerDomain'] = @{}

Private/Invoke.GPOZaurrOrphans.ps1

@@ -4,7 +4,7 @@
     ActionRequired = $null
     Data           = $null
     Execute        = {
-        Get-GPOZaurrBroken
+        Get-GPOZaurrBroken -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
     }
     Processing     = {
         $Script:Reporting['GPOOrphans']['Variables']['ToBeDeletedPerDomain'] = @{}

Private/Invoke.GPOZaurrOwners.ps1

@@ -3,7 +3,9 @@
     Enabled        = $true
     ActionRequired = $null
     Data           = $null
-    Execute        = { Get-GPOZaurrOwner -IncludeSysvol }
+    Execute        = {
+        Get-GPOZaurrOwner -IncludeSysvol -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
+    }
     Processing     = {
         # Create Per Domain Variables
         $Script:Reporting['GPOOwners']['Variables']['RequiresDiffFixPerDomain'] = @{}

Private/Invoke.GPOZaurrPassword.ps1

@@ -4,7 +4,7 @@
     Action     = $null
     Data       = $null
     Execute    = {
-        Get-GPOZaurrPassword
+        Get-GPOZaurrPassword -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
     }
     Processing = {
 

Private/Invoke.GPOZaurrPermissions.ps1

@@ -4,7 +4,7 @@
     Action     = $null
     Data       = $null
     Execute    = {
-        Get-GPOZaurrPermission -Type All -IncludePermissionType GpoEditDeleteModifySecurity, GpoEdit, GpoCustom #-IncludeOwner
+        Get-GPOZaurrPermission -Type All -IncludePermissionType GpoEditDeleteModifySecurity, GpoEdit, GpoCustom -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
     }
     Processing = {
 

Private/Invoke.GPOZaurrPermissionsRead.ps1

@@ -5,7 +5,7 @@
     Data       = $null
     Execute    = {
         [ordered] @{
-            Permissions = Get-GPOZaurrPermission -Type AuthenticatedUsers -ReturnSecurityWhenNoData
+            Permissions = Get-GPOZaurrPermission -Type AuthenticatedUsers -ReturnSecurityWhenNoData -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
             Issues      = Get-GPOZaurrPermissionIssue
         }
     }

Private/Invoke.GPOZaurrPermissionsRoot.ps1

@@ -4,7 +4,7 @@
     Action     = $null
     Data       = $null
     Execute    = {
-        Get-GPOZaurrPermissionRoot -SkipNames
+        Get-GPOZaurrPermissionRoot -SkipNames -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
     }
     Processing = {
 

Private/Invoke.GPOZaurrSysVolLegacyFiles.ps1

@@ -4,7 +4,7 @@
     Action     = $null
     Data       = $null
     Execute    = {
-        Get-GPOZaurrLegacyFiles
+        Get-GPOZaurrLegacyFiles -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
     }
     Processing = {
 

Private/Test-SysvolFolders.ps1

@@ -96,7 +96,7 @@
             }
         }
         # Now we need to list thru Sysvol files and fine those that do not exists as GPO and create dummy GPO objects to show orphaned gpos
-        Write-Verbose "Get-GPOZaurrBroken - Processing SYSVOL differences and creating dummy objects"
+        Write-Verbose "Get-GPOZaurrBroken - Processing SYSVOL differences"
         foreach ($_ in $Differences.Keys) {
             if ($Differences[$_] -in 'Not available in AD', 'Permissions issue') {
                 $FullPath = $SysvolHash[$_].FullName

Public/Add-GPOZaurrPermission.ps1

@@ -23,7 +23,7 @@
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
         [System.Collections.IDictionary] $ExtendedForestInformation,
         [System.Collections.IDictionary] $ADAdministrativeGroups,
-        [int] $LimitProcessing
+        [int] $LimitProcessing = [int32]::MaxValue
     )
     $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Extended
     if (-not $ADAdministrativeGroups) {

Public/Invoke-GPOZaurr.ps1

@@ -5,7 +5,11 @@
         [string] $FilePath,
         [string[]] $Type,
         [switch] $PassThru,
-        [switch] $HideHTML
+        [switch] $HideHTML,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains
     )
     Reset-GPOZaurrStatus # This makes sure types are at it's proper status
 
@@ -30,6 +34,12 @@
         Write-Color '[i]', "[GPOZaurr] ", 'Not supported types', ' [Informative] ', "Please use one/multiple from the list: ", ($Script:GPOConfiguration.Keys -join ', ') -Color Yellow, DarkGray, Yellow, DarkGray, Yellow, Magenta
         return
     }
+    $DisplayForest = if ($Forest) { $Forest } else { 'Not defined. Using current one' }
+    $DisplayIncludedDomains = if ($IncludeDomains) { $IncludeDomains -join "," } else { 'Not defined. Using all domains of forest' }
+    $DisplayExcludedDomains = if ($ExcludeDomains) { $ExcludeDomains -join ',' } else { 'No exclusions provided' }
+    Write-Color '[i]', "[GPOZaurr] ", 'Domain Information', ' [Informative] ', "Forest: ", $DisplayForest -Color Yellow, DarkGray, Yellow, DarkGray, Yellow, Magenta
+    Write-Color '[i]', "[GPOZaurr] ", 'Domain Information', ' [Informative] ', "Included Domains: ", $DisplayIncludedDomains -Color Yellow, DarkGray, Yellow, DarkGray, Yellow, Magenta
+    Write-Color '[i]', "[GPOZaurr] ", 'Domain Information', ' [Informative] ', "Excluded Domains: ", $DisplayExcludedDomains -Color Yellow, DarkGray, Yellow, DarkGray, Yellow, Magenta
 
     # Lets make sure we only enable those types which are requestd by user
     if ($Type) {
@@ -56,7 +66,7 @@
             }
             $TimeLogGPOList = Start-TimeLog
             Write-Color -Text '[i]', '[Start] ', $($Script:GPOConfiguration[$T]['Name']) -Color Yellow, DarkGray, Yellow
-            $Script:Reporting[$T]['Data'] = Invoke-Command -ScriptBlock $Script:GPOConfiguration[$T]['Execute'] -WarningVariable CommandWarnings -ErrorVariable CommandErrors
+            $Script:Reporting[$T]['Data'] = Invoke-Command -ScriptBlock $Script:GPOConfiguration[$T]['Execute'] -WarningVariable CommandWarnings -ErrorVariable CommandErrors -ArgumentList $Forest, $ExcludeDomains, $IncludeDomains
             Invoke-Command -ScriptBlock $Script:GPOConfiguration[$T]['Processing']
             $Script:Reporting[$T]['WarningsAndErrors'] = @(
                 foreach ($War in $CommandWarnings) {

Public/Remove-GPOZaurrBroken.ps1

@@ -33,42 +33,44 @@
             }
         }
     } | Select-Object | Select-Object -First $LimitProcessing | ForEach-Object {
-        if ($_.Status -eq 'Not available in AD') {
-            Write-Verbose "Remove-GPOZaurrBroken - Processing $($_.Path)"
+        $GPO = $_
+        if ($GPO.Status -eq 'Not available in AD') {
+            Write-Verbose "Remove-GPOZaurrBroken - Processing [AD] $($GPO.Path)"
             if ($BackupFinalPath) {
                 Try {
-                    Write-Verbose "Remove-GPOZaurrBroken - Backing up $($_.Path)"
-                    Copy-Item -LiteralPath $_.Path -Recurse -Destination $BackupFinalPath -ErrorAction Stop
+                    Write-Verbose "Remove-GPOZaurrBroken - Backing up $($GPO.Path)"
+                    Copy-Item -LiteralPath $GPO.Path -Recurse -Destination $BackupFinalPath -ErrorAction Stop
                     $BackupWorked = $true
                 } catch {
-                    Write-Warning "Remove-GPOZaurrBroken - Error backing up error: $($_.Exception.Message)"
+                    Write-Warning "Remove-GPOZaurrBroken - Error backing up $($GPO.Path) error: $($_.Exception.Message)"
                     $BackupWorked = $false
                 }
             }
             if ($BackupWorked -or $BackupFinalPath -eq '') {
-                Write-Verbose "Remove-GPOZaurrBroken - Deleting $($_.Path)"
+                Write-Verbose "Remove-GPOZaurrBroken - Deleting $($GPO.Path)"
                 try {
-                    Remove-Item -Recurse -Force -LiteralPath $_.Path
+                    Remove-Item -Recurse -Force -LiteralPath $GPO.Path -ErrorAction Stop
                 } catch {
-                    Write-Warning "Remove-GPOZaurrBroken - Failed to remove file $($_.Path): $($_.Exception.Message)."
+                    Write-Warning "Remove-GPOZaurrBroken - Failed to remove file $($GPO.Path): $($_.Exception.Message)."
                 }
             }
-        } elseif ($_.Status -eq 'Not available on SYSVOL') {
+        } elseif ($GPO.Status -eq 'Not available on SYSVOL') {
+            Write-Verbose "Remove-GPOZaurrBroken - Processing [SYSVOL] $($GPO.DistinguishedName)"
             try {
-                $ExistingObject = Get-ADObject -Identity $_.DistinguishedName -Server $_.DomainName -ErrorAction Stop
+                $ExistingObject = Get-ADObject -Identity $GPO.DistinguishedName -Server $GPO.DomainName -ErrorAction Stop
             } catch {
-                Write-Warning "Remove-GPOZaurrBroken - Error getting $($_.DistinguishedName) from AD error: $($_.Exception.Message)"
+                Write-Warning "Remove-GPOZaurrBroken - Error getting $($GPO.DistinguishedName) from AD error: $($_.Exception.Message)"
                 $ExistingObject = $null
             }
             if ($ExistingObject -and $ExistingObject.ObjectClass -eq 'groupPolicyContainer') {
-                Write-Verbose "Remove-GPOZaurrBroken - Removing DN: $($_.DistinguishedName) / ObjectClass: $($ExistingObject.ObjectClass)"
+                Write-Verbose "Remove-GPOZaurrBroken - Removing DN: $($GPO.DistinguishedName) / ObjectClass: $($ExistingObject.ObjectClass)"
                 try {
-                    Remove-ADObject -Server $_.DomainName -Identity $_.DistinguishedName -Recursive -Confirm:$false
+                    Remove-ADObject -Server $GPO.DomainName -Identity $GPO.DistinguishedName -Recursive -Confirm:$false -ErrorAction Stop
                 } catch {
-                    Write-Warning "Remove-GPOZaurrBroken - Failed to remove $($_.DistinguishedName) from AD error: $($_.Exception.Message)"
+                    Write-Warning "Remove-GPOZaurrBroken - Failed to remove $($GPO.DistinguishedName) from AD error: $($_.Exception.Message)"
                 }
             } else {
-                Write-Warning "Remove-GPOZaurrBroken - DistinguishedName $($_.DistinguishedName) not found or ObjectClass is not groupPolicyContainer ($($ExistingObject.ObjectClass))"
+                Write-Warning "Remove-GPOZaurrBroken - DistinguishedName $($GPO.DistinguishedName) not found or ObjectClass is not groupPolicyContainer ($($ExistingObject.ObjectClass))"
             }
         }
     }

README.md

@@ -57,6 +57,12 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
+- 0.0.88 - 18.11.2020
+  - [x] Fix for `Add-GPOZaurrPermission`
+- 0.0.87 - 18.11.2020
+  - [x] Improve error handling `Remove-GPOZaurrBroken`
+- 0.0.86 - 18.11.2020
+  - [x] Improve error handling `Remove-GPOZaurrBroken`
 - 0.0.85 - 17.11.2020
   - [x] Improves `Invoke-GPOZaurr` (WIP)
     - [x] Split `NetLogonPermissions` into `NetLogonPermissions` and `NetLogonOwners`