Added GPOPermissionsUnknown

GPOZaurr.psd1

@@ -8,7 +8,7 @@
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
     FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.89'
+    ModuleVersion        = '0.0.90'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{

Private/Invoke.GPOZaurrDuplicate.ps1

@@ -40,7 +40,7 @@
             }
             New-HTMLPanel {
                 New-HTMLChart {
-                    New-ChartLegend -Names 'Bad' -Color PaleGreen, Salmon
+                    New-ChartLegend -Names 'Bad' -Color Salmon
                     New-ChartBar -Name 'Duplicate (CNF) object' -Value $Script:Reporting['GPODuplicates']['Data'].Count
                 } -Title 'Duplicate (CNF) Objects' -TitleAlignment center
             }
@@ -61,7 +61,6 @@
         New-HTMLSection -Name 'Steps to fix - Remove duplicate (CNF) objects' {
             New-HTMLContainer {
                 New-HTMLSpanStyle -FontSize 10pt {
-                    New-HTMLText -Text 'Following steps will guide you how to remove duplicate objects'
                     New-HTMLWizard {
                         New-HTMLWizardStep -Name 'Prepare environment' {
                             New-HTMLText -Text "To be able to execute actions in automated way please install required modules. Those modules will be installed straight from Microsoft PowerShell Gallery."

Private/Invoke.GPOZaurrPermissionsUnknown.ps1

@@ -0,0 +1,181 @@
+$GPOZaurrPermissionsUnknown = [ordered] @{
+    Name       = 'Group Policy Unknown Permissions'
+    Enabled    = $true
+    Action     = $null
+    Data       = $null
+    Execute    = {
+        Get-GPOZaurrPermission -Type Unknown -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
+    }
+    Processing = {
+        # Create Per Domain Variables
+        $Script:Reporting['GPOPermissionsUnknown']['Variables']['WillFixPerDomain'] = @{}
+        foreach ($GPO in $Script:Reporting['GPOPermissionsUnknown']['Data']) {
+            # Create Per Domain Variables
+            if (-not $Script:Reporting['GPOPermissionsUnknown']['Variables']['WillFixPerDomain'][$GPO[0].DomainName]) {
+                $Script:Reporting['GPOPermissionsUnknown']['Variables']['WillFixPerDomain'][$GPO[0].DomainName] = 0
+            }
+            # Checks
+            $Script:Reporting['GPOPermissionsUnknown']['Variables']['WillFix']++
+            $Script:Reporting['GPOPermissionsUnknown']['Variables']['WillFixPerDomain'][$GPO[0].DomainName]++
+        }
+        if ($Script:Reporting['GPOPermissionsUnknown']['Variables']['WillFix'] -gt 0) {
+            $Script:Reporting['GPOPermissionsUnknown']['ActionRequired'] = $true
+        } else {
+            $Script:Reporting['GPOPermissionsUnknown']['ActionRequired'] = $false
+        }
+    }
+    Variables  = @{
+        WillFix          = 0
+        WillFixPerDomain = $null
+    }
+    Overview   = {
+
+    }
+    Summary    = {
+        New-HTMLText -FontSize 10pt -TextBlock {
+            "Group Policies contain multiple permissions for different level of access. "
+            "Be it adminstrative permissions, read permissions or apply permissions. "
+            "Over time some users or groups get deleted for different reasons and such permission in Group Policies leave a trace in form of Unknown SID. "
+            "Unknown SIDs can also be remains of Active Directory Trusts, that have been deleted or are otherwise unavailable. "
+            "Following assesment detects all unknown permissions and provides them for review & deletion. "
+        } -LineBreak
+        New-HTMLText -FontSize 10pt -Text "Assesment results: " -FontWeight bold
+        New-HTMLList -Type Unordered {
+            New-HTMLListItem -Text 'Group Policies requiring removal of unknown SIDs: ', $Script:Reporting['GPOPermissionsUnknown']['Variables']['WillFix'] -FontWeight normal, bold
+        } -FontSize 10pt
+        New-HTMLText -Text 'Following domains require actions (permissions required):' -FontSize 10pt -FontWeight bold
+        New-HTMLList -Type Unordered {
+            foreach ($Domain in $Script:Reporting['GPOPermissionsUnknown']['Variables']['WillFixPerDomain'].Keys) {
+                New-HTMLListItem -Text "$Domain requires ", $Script:Reporting['GPOPermissionsUnknown']['Variables']['WillFixPerDomain'][$Domain], " changes." -FontWeight normal, bold, normal
+            }
+        } -FontSize 10pt
+        New-HTMLText -Text @(
+            "That means we need to fix permissions on: "
+            $($Script:Reporting['GPOPermissionsUnknown']['Variables'].WillFix)
+            " out of "
+            ($Script:Reporting['GPOPermissionsUnknown']['Data']).Count
+            " Group Policies. "
+        ) -FontSize 10pt -FontWeight bold, bold, normal, bold, normal -Color Black, FreeSpeechRed, Black, Black -LineBreak -TextDecoration none, underline, underline, underline, none
+    }
+    Solution   = {
+        New-HTMLSection -Invisible {
+            New-HTMLPanel {
+                & $Script:GPOConfiguration['GPOPermissionsUnknown']['Summary']
+            }
+            New-HTMLPanel {
+                New-HTMLChart {
+                    New-ChartBarOptions -Type barStacked
+                    New-ChartLegend -Name 'Yes' -Color Salmon
+                    New-ChartBar -Name 'Unknown Permissions Present' -Value $Script:Reporting['GPOPermissionsUnknown']['Variables']['WillFix']
+                } -Title 'Group Policy Permissions' -TitleAlignment center
+            }
+        }
+        New-HTMLSection -Name 'Group Policy Unknown Permissions Analysis' {
+            New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsUnknown']['Data'] -Filtering {
+                New-HTMLTableCondition -Name 'Permission' -Value '' -BackgroundColor Salmon -ComparisonType string -Row
+            } -PagingOptions 7, 15, 30, 45, 60
+        }
+        New-HTMLSection -Name 'Steps to fix Group Policy Unknown Permissions' {
+            New-HTMLContainer {
+                New-HTMLSpanStyle -FontSize 10pt {
+                    New-HTMLWizard {
+                        New-HTMLWizardStep -Name 'Prepare environment' {
+                            New-HTMLText -Text "To be able to execute actions in automated way please install required modules. Those modules will be installed straight from Microsoft PowerShell Gallery."
+                            New-HTMLCodeBlock -Code {
+                                Install-Module GPOZaurr -Force
+                                Import-Module GPOZaurr -Force
+                            } -Style powershell
+                            New-HTMLText -Text "Using force makes sure newest version is downloaded from PowerShellGallery regardless of what is currently installed. Once installed you're ready for next step."
+                        }
+                        New-HTMLWizardStep -Name 'Prepare report' {
+                            New-HTMLText -Text "Depending when this report was run you may want to prepare new report before proceeding with removing unknown permissions. To generate new report please use:"
+                            New-HTMLCodeBlock -Code {
+                                Invoke-GPOZaurr -FilePath $Env:UserProfile\Desktop\GPOZaurrGPOPermissionsUnknownBefore.html -Verbose -Type GPOPermissionsUnknown
+                            }
+                            New-HTMLText -TextBlock {
+                                "When executed it will take a while to generate all data and provide you with new report depending on size of environment. "
+                                "The table only shows GPO and their unknown permissions. "
+                                "It doesn't show permissions that are not subject of this investigation. "
+                                "Once confirmed that data is still showing issues and requires fixing please proceed with next step."
+                            }
+                            New-HTMLText -Text "Alternatively if you prefer working with console you can run: "
+                            New-HTMLCodeBlock -Code {
+                                $UnknownPermissions = Get-GPOZaurrPermission -Type Unknown
+                                $UnknownPermissions | Format-Table
+                            }
+                            New-HTMLText -Text "It provides same data as you see in table above just doesn't prettify it for you."
+                        }
+                        New-HTMLWizardStep -Name 'Make a backup (optional)' {
+                            New-HTMLText -TextBlock {
+                                "The process of fixing GPO Permissions does NOT touch GPO content. It simply removes permissionss on AD and SYSVOL at the same time for given GPO. "
+                                "However, it's always good to have a backup before executing changes that may impact Active Directory. "
+                            }
+                            New-HTMLCodeBlock -Code {
+                                $GPOSummary = Backup-GPOZaurr -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -Type All
+                                $GPOSummary | Format-Table # only if you want to display output of backup
+                            }
+                            New-HTMLText -TextBlock {
+                                "Above command when executed will make a backup to Desktop, create GPO folder and within it it will put all those GPOs. "
+                            }
+                        }
+                        New-HTMLWizardStep -Name 'Add Administrative Groups proper permissions GPO' {
+                            New-HTMLText -Text @(
+                                "Following command will find any GPO which has an unknown SID and will remove it. ",
+                                "This change doesn't change any other permissions. ",
+                                "It ensures that GPOs have no unknown permissions present. ",
+                                "Make sure when running it for the first time to run it with ",
+                                "WhatIf",
+                                " parameter as shown below to prevent accidental adding of permissions."
+                            ) -FontWeight normal, normal, normal, normal, bold, normal -Color Black, Black, Black, Black, Red, Black
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrPermission -Verbose -Type Unknown -WhatIf
+                            }
+                            New-HTMLText -TextBlock {
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                            }
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrPermission -Verbose -Type Unknown -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                            }
+                            New-HTMLText -TextBlock {
+                                "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be changed matches expected data."
+                            } -LineBreak
+                            New-HTMLText -Text "Once happy with results please follow with command (this will start fixing process): " -LineBreak -FontWeight bold
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 2
+                            }
+                            New-HTMLText -TextBlock {
+                                "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                            }
+                            New-HTMLCodeBlock -Code {
+                                Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 2 -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                            }
+                            New-HTMLText -TextBlock {
+                                "This command when executed removes only first X unknwon permissions from Group Policies. "
+                                "Use LimitProcessing parameter to prevent mass change and increase the counter when no errors occur."
+                                "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. "
+                                "In case of any issues please review and action accordingly."
+                            }
+                        }
+                        New-HTMLWizardStep -Name 'Verification report' {
+                            New-HTMLText -TextBlock {
+                                "Once cleanup task was executed properly, we need to verify that report now shows no problems."
+                            }
+                            New-HTMLCodeBlock -Code {
+                                Invoke-GPOZaurr -FilePath $Env:UserProfile\Desktop\GPOZaurrGPOPermissionsUnknownAfter.html -Verbose -Type GPOPermissionsUnknown
+                            }
+                            New-HTMLText -Text "If everything is healthy in the report you're done! Enjoy rest of the day!" -Color BlueDiamond
+                        }
+                    } -RemoveDoneStepOnNavigateBack -Theme arrows -ToolbarButtonPosition center
+                }
+            }
+        }
+        if ($Script:Reporting['GPOPermissionsUnknown']['WarningsAndErrors']) {
+            New-HTMLSection -Name 'Warnings & Errors to Review' {
+                New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsUnknown']['WarningsAndErrors'] -Filtering {
+                    New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
+                    New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
+                } -PagingOptions 10, 20, 30, 40, 50
+            }
+        }
+    }
+}

Private/Script.GPOConfiguration.ps1

@@ -6,9 +6,10 @@
     GPOList                      = $GPOZaurrList
     GPOPassword                  = $GPOZaurrPassword
     GPOPermissions               = $GPOZaurrPermissions
+    GPOPermissionsAdministrative = $GPOZaurrPermissionsAdministrative
     GPOPermissionsRead           = $GPOZaurrPermissionsRead
     GPOPermissionsRoot           = $GPOZaurrPermissionsRoot
-    GPOPermissionsAdministrative = $GPOZaurrPermissionsAdministrative
+    GPOPermissionsUnknown        = $GPOZaurrPermissionsUnknown
     GPOFiles                     = $GPOZaurrFiles
     GPOBlockedInheritance        = $GPOZaurrBlockedInheritance
     GPOAnalysis                  = $GPOZaurrAnalysis

Public/Get-GPOZaurrNetlogon.ps1

@@ -13,11 +13,14 @@
     $FilesAll = foreach ($Domain in $ForestInformation.Domains) {
         $Path = -join ("\\", $Domain, '\Netlogon')
         $PathOnSysvol = -join ("\\", $Domain, "\SYSVOL\", $Domain, "\Scripts")
-        $Files = Get-ChildItem -LiteralPath $Path -Recurse -Force -ErrorVariable Err -ErrorAction SilentlyContinue
+        [Array] $Files = Get-ChildItem -LiteralPath $Path -Recurse -Force -ErrorVariable Err -ErrorAction SilentlyContinue
         foreach ($e in $err) {
             Write-Warning "Get-GPOZaurrNetLogon - Listing file failed with error $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
         }
+        $Count = 0
         foreach ($File in $Files) {
+            $Count++
+            Write-Verbose "GPOZaurrNetLogon - Processing [$($Domain)]($Count/$($Files.Count)) $($File.FullName)"
             try {
                 $ACL = Get-Acl -Path $File.FullName -ErrorAction Stop
             } catch {

Public/Invoke-GPOZaurr.ps1

@@ -66,7 +66,14 @@
             }
             $TimeLogGPOList = Start-TimeLog
             Write-Color -Text '[i]', '[Start] ', $($Script:GPOConfiguration[$T]['Name']) -Color Yellow, DarkGray, Yellow
-            $Script:Reporting[$T]['Data'] = Invoke-Command -ScriptBlock $Script:GPOConfiguration[$T]['Execute'] -WarningVariable CommandWarnings -ErrorVariable CommandErrors -ArgumentList $Forest, $ExcludeDomains, $IncludeDomains
+            $OutputCommand = Invoke-Command -ScriptBlock $Script:GPOConfiguration[$T]['Execute'] -WarningVariable CommandWarnings -ErrorVariable CommandErrors -ArgumentList $Forest, $ExcludeDomains, $IncludeDomains
+            if ($OutputCommand -is [System.Collections.IDictionary]) {
+                # in some cases the return will be wrapped in Hashtable/orderedDictionary and we need to handle this without an array
+                $Script:Reporting[$T]['Data'] = $OutputCommand
+            } else {
+                # since sometimes it can be 0 or 1 objects being returned we force it being an array
+                $Script:Reporting[$T]['Data'] = [Array] $OutputCommand
+            }
             Invoke-Command -ScriptBlock $Script:GPOConfiguration[$T]['Processing']
             $Script:Reporting[$T]['WarningsAndErrors'] = @(
                 foreach ($War in $CommandWarnings) {

Public/Remove-GPOZaurrDuplicateObject.ps1

@@ -7,7 +7,6 @@
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
         [System.Collections.IDictionary] $ExtendedForestInformation
     )
-
     $getGPOZaurrDuplicateObjectSplat = @{
         Forest                    = $Forest
         IncludeDomains            = $IncludeDomains
@@ -18,7 +17,7 @@
     $DuplicateGpoObjects = Get-GPOZaurrDuplicateObject @getGPOZaurrDuplicateObjectSplat
     foreach ($Duplicate in $DuplicateGpoObjects | Select-Object -First $LimitProcessing) {
         try {
-            Remove-ADObject -Identity $Duplicate.ObjectGUID -Recursive -ErrorAction Stop -Server $Duplicate.DomainName
+            Remove-ADObject -Identity $Duplicate.ObjectGUID -Recursive -ErrorAction Stop -Server $Duplicate.DomainName -Confirm:$false
         } catch {
             Write-Warning "Remove-GPOZaurrDuplicateObject - Deleting $($Duplicate.ConflictDN) / $($Duplicate.DomainName) via GUID: $($Duplicate.ObjectGUID) failed with error: $($_.Exception.Message)"
         }

Public/Repair-GPOZaurrNetLogonOwner.ps1

@@ -17,18 +17,18 @@
     $Principal = $Identity.Name
 
     $getGPOZaurrNetLogonSplat = @{
-        OwnerOnly = $true
-        Forest = $Forest
-        IncludeDomains = $IncludeDomains
-        ExcludeDomains = $ExcludeDomains
+        OwnerOnly                 = $true
+        Forest                    = $Forest
+        IncludeDomains            = $IncludeDomains
+        ExcludeDomains            = $ExcludeDomains
         ExtendedForestInformation = $ExtendedForestInformation
     }
 
-    Get-GPOZaurrNetLogon @getGPOZaurrNetLogonSplat | Select-Object -First $LimitProcessing | Where-Object {
+    Get-GPOZaurrNetLogon @getGPOZaurrNetLogonSplat -Verbose | Where-Object {
         if ($_.OwnerSid -ne 'S-1-5-32-544') {
             $_
         }
-    } | ForEach-Object {
+    } | Select-Object -First $LimitProcessing | ForEach-Object {
         if ($PSCmdlet.ShouldProcess($_.FullName, "Setting NetLogon Owner to $($Principal)")) {
             Set-FileOwner -JustPath -Path $_.FullName -Owner $Principal -Verbose:$true -WhatIf:$WhatIfPreference
         }

README.md

@@ -57,7 +57,16 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
-- 0.0.89
+- 0.0.90 - 23.11.2020
+  - [x] Improves `Invoke-GPOZaurr` (WIP)
+    - [x] Improves Type `GPODuplicates`
+      - [x] Fix for chart color to be RED
+    - [x] Add Type `GPOPermissionsUnknown`
+    - [x] Improves logic for Data with 0/1 element
+  - [x] Improves `Remove-GPOZaurrDuplicateObject` - removed `Confirm` requirement
+  - [x] Improves `Get-GPOZaurrNetLogon` with more verbose
+  - [x] Improves `Repair-GPOZaurrNetLogonOwner` with more verbose and fix for `LimitProcessing`
+- 0.0.89 - 22.11.2020
   - [x] Small update `Add-GPOZaurrPermission`
   - [x] Improves `Invoke-GPOZaurr` (WIP)
     - [x] Added Type `GPOPermissionsAdministrative`