Update

.github/FUNDING.yml

@@ -0,0 +1,7 @@
+# These are supported funding model platforms
+
+github: PrzemyslawKlys
+patreon: przemyslawklys
+ko_fi: przemyslawklys
+open_collective: evotec
+custom: https://paypal.me/PrzemyslawKlys

Docs/Backup-GPOZaurr.md

@@ -0,0 +1,214 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Backup-GPOZaurr
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Backup-GPOZaurr [[-LimitProcessing] <Int32>] [[-Type] <String[]>] [[-Forest] <String>]
+ [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>]
+ [[-GPOPath] <String[]>] [[-BackupPath] <String>] [-BackupDated] [-WhatIf] [-Confirm] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -BackupDated
+{{ Fill BackupDated Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -BackupPath
+{{ Fill BackupPath Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 7
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 6
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -LimitProcessing
+{{ Fill LimitProcessing Description }}
+
+```yaml
+Type: Int32
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Type
+{{ Fill Type Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: All, Empty, Unlinked
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurr.md

@@ -0,0 +1,197 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurr
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurr [[-GPOName] <String>] [[-GPOGuid] <String>] [[-Forest] <String>] [[-ExcludeDomains] <String[]>]
+ [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>] [[-GPOPath] <String[]>]
+ [-PermissionsOnly] [-OwnerOnly] [-Limited] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOGuid
+{{ Fill GPOGuid Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: GUID, GPOID
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOName
+{{ Fill GPOName Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 6
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Limited
+{{ Fill Limited Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -OwnerOnly
+{{ Fill OwnerOnly Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -PermissionsOnly
+{{ Fill PermissionsOnly Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrBackupInformation.md

@@ -0,0 +1,60 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrBackupInformation
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurrBackupInformation [[-BackupFolder] <String[]>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -BackupFolder
+{{ Fill BackupFolder Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrLink.md

@@ -0,0 +1,152 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrLink
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurrLink [[-ADObject] <ADObject[]>] [-Limited] [[-GPOCache] <IDictionary>] [[-Forest] <String>]
+ [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>]
+ [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ADObject
+{{ Fill ADObject Description }}
+
+```yaml
+Type: ADObject[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: True (ByPropertyName, ByValue)
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOCache
+{{ Fill GPOCache Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Limited
+{{ Fill Limited Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### Microsoft.ActiveDirectory.Management.ADObject[]
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrPassword.md

@@ -0,0 +1,121 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrPassword
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurrPassword [[-Forest] <String>] [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>]
+ [[-ExtendedForestInformation] <IDictionary>] [[-GPOPath] <String[]>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrPermission.md

@@ -0,0 +1,280 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrPermission
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+### GPO (Default)
+```
+Get-GPOZaurrPermission [-Type <String[]>] [-SkipWellKnown] [-SkipAdministrative] [-ResolveAccounts]
+ [-IncludeOwner] [-IncludePermissionType <GPPermissionType[]>] [-ExcludePermissionType <GPPermissionType[]>]
+ [-IncludeGPOObject] [-Forest <String>] [-ExcludeDomains <String[]>] [-IncludeDomains <String[]>]
+ [-ExtendedForestInformation <IDictionary>] [<CommonParameters>]
+```
+
+### GPOName
+```
+Get-GPOZaurrPermission [-GPOName <String>] [-Type <String[]>] [-SkipWellKnown] [-SkipAdministrative]
+ [-ResolveAccounts] [-IncludeOwner] [-IncludePermissionType <GPPermissionType[]>]
+ [-ExcludePermissionType <GPPermissionType[]>] [-IncludeGPOObject] [-Forest <String>]
+ [-ExcludeDomains <String[]>] [-IncludeDomains <String[]>] [-ExtendedForestInformation <IDictionary>]
+ [<CommonParameters>]
+```
+
+### GPOGUID
+```
+Get-GPOZaurrPermission [-GPOGuid <String>] [-Type <String[]>] [-SkipWellKnown] [-SkipAdministrative]
+ [-ResolveAccounts] [-IncludeOwner] [-IncludePermissionType <GPPermissionType[]>]
+ [-ExcludePermissionType <GPPermissionType[]>] [-IncludeGPOObject] [-Forest <String>]
+ [-ExcludeDomains <String[]>] [-IncludeDomains <String[]>] [-ExtendedForestInformation <IDictionary>]
+ [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludePermissionType
+{{ Fill ExcludePermissionType Description }}
+
+```yaml
+Type: GPPermissionType[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: None, GpoApply, GpoRead, GpoEdit, GpoEditDeleteModifySecurity, GpoCustom, WmiFilterEdit, WmiFilterFullControl, WmiFilterCustom, StarterGpoRead, StarterGpoEdit, StarterGpoFullControl, StarterGpoCustom, SomCreateWmiFilter, SomWmiFilterFullControl, SomCreateGpo, SomCreateStarterGpo, SomLogging, SomPlanning, SomLink
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOGuid
+{{ Fill GPOGuid Description }}
+
+```yaml
+Type: String
+Parameter Sets: GPOGUID
+Aliases: GUID, GPOID
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOName
+{{ Fill GPOName Description }}
+
+```yaml
+Type: String
+Parameter Sets: GPOName
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeGPOObject
+{{ Fill IncludeGPOObject Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeOwner
+{{ Fill IncludeOwner Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludePermissionType
+{{ Fill IncludePermissionType Description }}
+
+```yaml
+Type: GPPermissionType[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: None, GpoApply, GpoRead, GpoEdit, GpoEditDeleteModifySecurity, GpoCustom, WmiFilterEdit, WmiFilterFullControl, WmiFilterCustom, StarterGpoRead, StarterGpoEdit, StarterGpoFullControl, StarterGpoCustom, SomCreateWmiFilter, SomWmiFilterFullControl, SomCreateGpo, SomCreateStarterGpo, SomLogging, SomPlanning, SomLink
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ResolveAccounts
+{{ Fill ResolveAccounts Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -SkipAdministrative
+{{ Fill SkipAdministrative Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -SkipWellKnown
+{{ Fill SkipWellKnown Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Type
+{{ Fill Type Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: Unknown, All
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrWMI.md

@@ -0,0 +1,136 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrWMI
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurrWMI [[-Guid] <Guid[]>] [[-Name] <String[]>] [[-Forest] <String>] [[-ExcludeDomains] <String[]>]
+ [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Guid
+{{ Fill Guid Description }}
+
+```yaml
+Type: Guid[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Name
+{{ Fill Name Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/New-GPOZaurrWMI.md

@@ -0,0 +1,213 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# New-GPOZaurrWMI
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+New-GPOZaurrWMI [-Name] <String> [[-Description] <String>] [-Query] <String> [-SkipQueryCheck] [-Force]
+ [[-Forest] <String>] [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>]
+ [[-ExtendedForestInformation] <IDictionary>] [-WhatIf] [-Confirm] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Description
+{{ Fill Description Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 6
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Force
+{{ Fill Force Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Name
+{{ Fill Name Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: True
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Query
+{{ Fill Query Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: True
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -SkipQueryCheck
+{{ Fill SkipQueryCheck Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Readme.md

@@ -0,0 +1,52 @@
+---
+Module Name: GPOZaurr
+Module Guid: f7d4c9e4-0298-4f51-ad77-e8e3febebbde
+Download Help Link: {{ Update Download Link }}
+Help Version: {{ Please enter version of help manually (X.X.X.X) format }}
+Locale: en-US
+---
+
+# GPOZaurr Module
+## Description
+{{ Fill in the Description }}
+
+## GPOZaurr Cmdlets
+### [Backup-GPOZaurr](Backup-GPOZaurr.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurr](Get-GPOZaurr.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrBackupInformation](Get-GPOZaurrBackupInformation.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrLink](Get-GPOZaurrLink.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrPassword](Get-GPOZaurrPassword.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrPermission](Get-GPOZaurrPermission.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrWMI](Get-GPOZaurrWMI.md)
+{{ Fill in the Description }}
+
+### [New-GPOZaurrWMI](New-GPOZaurrWMI.md)
+{{ Fill in the Description }}
+
+### [Remove-GPOZaurr](Remove-GPOZaurr.md)
+{{ Fill in the Description }}
+
+### [Remove-GPOZaurrWMI](Remove-GPOZaurrWMI.md)
+{{ Fill in the Description }}
+
+### [Restore-GPOZaurr](Restore-GPOZaurr.md)
+{{ Fill in the Description }}
+
+### [Save-GPOZaurrFiles](Save-GPOZaurrFiles.md)
+{{ Fill in the Description }}
+
+### [Set-GPOZaurrOwner](Set-GPOZaurrOwner.md)
+{{ Fill in the Description }}
+

Docs/Remove-GPOZaurr.md

@@ -0,0 +1,214 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Remove-GPOZaurr
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Remove-GPOZaurr [-Type] <String[]> [[-LimitProcessing] <Int32>] [[-Forest] <String>]
+ [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>]
+ [[-GPOPath] <String[]>] [[-BackupPath] <String>] [-BackupDated] [-WhatIf] [-Confirm] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -BackupDated
+{{ Fill BackupDated Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -BackupPath
+{{ Fill BackupPath Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 7
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 6
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -LimitProcessing
+{{ Fill LimitProcessing Description }}
+
+```yaml
+Type: Int32
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Type
+{{ Fill Type Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: Empty, Unlinked
+
+Required: True
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Remove-GPOZaurrWMI.md

@@ -0,0 +1,168 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Remove-GPOZaurrWMI
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Remove-GPOZaurrWMI [[-Guid] <Guid[]>] [[-Name] <String[]>] [[-Forest] <String>] [[-ExcludeDomains] <String[]>]
+ [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>] [-WhatIf] [-Confirm]
+ [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Guid
+{{ Fill Guid Description }}
+
+```yaml
+Type: Guid[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Name
+{{ Fill Name Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Restore-GPOZaurr.md

@@ -0,0 +1,121 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Restore-GPOZaurr
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Restore-GPOZaurr [-BackupFolder] <String> [[-DisplayName] <String>] [[-NewDisplayName] <String>]
+ [[-Domain] <String>] [-SkipBackupSummary] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -BackupFolder
+{{ Fill BackupFolder Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: True
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -DisplayName
+{{ Fill DisplayName Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: Name
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Domain
+{{ Fill Domain Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -NewDisplayName
+{{ Fill NewDisplayName Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -SkipBackupSummary
+{{ Fill SkipBackupSummary Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Save-GPOZaurrFiles.md

@@ -0,0 +1,136 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Save-GPOZaurrFiles
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Save-GPOZaurrFiles [[-Forest] <String>] [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>]
+ [[-ExtendedForestInformation] <IDictionary>] [[-GPOPath] <String[]>] [-DeleteExisting] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -DeleteExisting
+{{ Fill DeleteExisting Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Set-GPOZaurrOwner.md

@@ -0,0 +1,222 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Set-GPOZaurrOwner
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+### Type (Default)
+```
+Set-GPOZaurrOwner -Type <String[]> [-Forest <String>] [-ExcludeDomains <String[]>] [-IncludeDomains <String[]>]
+ [-ExtendedForestInformation <IDictionary>] [-LimitProcessing <Int32>] [-WhatIf] [-Confirm]
+ [<CommonParameters>]
+```
+
+### Named
+```
+Set-GPOZaurrOwner [-GPOName <String>] [-GPOGuid <String>] [-Forest <String>] [-ExcludeDomains <String[]>]
+ [-IncludeDomains <String[]>] [-ExtendedForestInformation <IDictionary>] -Principal <String>
+ [-LimitProcessing <Int32>] [-WhatIf] [-Confirm] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOGuid
+{{ Fill GPOGuid Description }}
+
+```yaml
+Type: String
+Parameter Sets: Named
+Aliases: GUID, GPOID
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOName
+{{ Fill GPOName Description }}
+
+```yaml
+Type: String
+Parameter Sets: Named
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -LimitProcessing
+{{ Fill LimitProcessing Description }}
+
+```yaml
+Type: Int32
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Principal
+{{ Fill Principal Description }}
+
+```yaml
+Type: String
+Parameter Sets: Named
+Aliases:
+
+Required: True
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Type
+{{ Fill Type Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: Type
+Aliases:
+Accepted values: EmptyOrUnknown, NotAdministrative
+
+Required: True
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Examples/Example-00-GPOPermissionTypes.ps1

@@ -0,0 +1,24 @@
+$GPPermissions = [ordered] @{
+    GpoApply                    = 'The trustee can apply the GPO; corresponds to the READ and APPLY Group Policy access rights being set to "Allow" for a user.'
+    GpoCustom                   = 'The trustee has custom permissions for the GPO.'
+    GpoEdit                     = 'The trustee can read and edit the policy settings for the GPO; corresponds to the READ, WRITE, CREATE CHILD OBJECT, and DELETE CHILD OBJECT Group Policy access rights set to "Allow" for a user.'
+    GpoEditDeleteModifySecurity = 'The trustee can read, edit and delete the permissions for the GPO; corresponds to the Group Policy access rights specified by GpoEdit plus the DELETE, MODIFY PERMISSIONS, and MODIFY OWNER access rights set to "Allow" for a user.'
+    GpoRead                     = 'The trustee can read the GPO; corresponds to the READ Group Policy access right set to "Allow" for a user.'
+    None                        = 'This value is reserved for internal use by the Group Policy Windows PowerShell cmdlets.'
+    SomCreateGpo                = 'The trustee can create GPOs in the domain. Applies to domains only.'
+    SomCreateStarterGpo         = 'The trustee can create Starter GPOs in the domain. Applies to domains only.'
+    SomCreateWmiFilter          = 'The trustee can create WMI filters in the domain. Applies to domains only.'
+    SomLink                     = 'The trustee can link GPOs to the SOM. Applies to sites, domains and OUs.'
+    SomLogging                  = 'The trustee can generate RSoP logging data for the SOM. Applies to domains and OUs.'
+    SomPlanning                 = 'The trustee can generate RSoP planning data for the SOM. Applies to domains and OUs.'
+    SomWmiFilterFullControl     = 'The trustee has full control over all WMI filters in the domain. Applies to domains only.'
+    StarterGpoCustom            = 'The trustee has custom permissions for the Starter GPO.'
+    StarterGpoEdit              = 'The trustee can read and edit the administrative template policy settings for the Starter GPO; corresponds to the READ, WRITE, CREATE CHILD OBJECT, and DELETE CHILD OBJECT Group Policy access rights set to "Allow" for a user.'
+    StarterGpoFullControl       = 'The trustee has full control for the Starter GPO. Applies to domains only.'
+    StarterGpoRead              = 'The trustee can read the Starter GPO; corresponds to the READ Group Policy access right set to "Allow" for a user.'
+    WmiFilterCustom             = 'The trustee has custom permissions for the WMI filter.'
+    WmiFilterEdit               = 'The trustee can edit the WMI filter.'
+    WmiFilterFullControl        = 'The trustee has full control over the WMI filter.'
+}
+
+$GPPermissions | Format-Table

Examples/Example-01-BackupGPOs.ps1

@@ -2,7 +2,7 @@
 
 # Backup GPOs
 $BackupPath = "$Env:UserProfile\Desktop\GPO"
-$GPOSummary = Backup-GPOZaurr -BackupPath $BackupPath -Verbose -Type EmptyAndUnlinked -BackupDated #-LimitProcessing 1
+$GPOSummary = Backup-GPOZaurr -BackupPath $BackupPath -Verbose -Type Unlinked -BackupDated #-LimitProcessing 1
 $GPOSummary | Format-Table -AutoSize
 
 # Confirm GPOs are backed up properly

Examples/Example-02-RemoveEmptyAndUnlinkedGPOs.ps1

@@ -2,4 +2,4 @@
 
 # Remove GPOS
 $BackupPath = "$Env:UserProfile\Desktop\GPO"
-Remove-GPOZaurr -Type EmptyAndUnlinked -BackupPath $BackupPath -BackupDated -LimitProcessing 2 -Verbose
+Remove-GPOZaurr -Type Empty, Unlinked -BackupPath $BackupPath -BackupDated -LimitProcessing 2 -Verbose

Examples/Example-03-RestoreGPO.ps1

@@ -1,6 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$RestoreFrom = 'C:\Users\przemyslaw.klys\Desktop\GPO\2020-04-02_20_20_04'
+$RestoreFrom = 'C:\Users\przemyslaw.klys\Desktop\GPO\2020-04-26_10_29_34'
 
 $BackupInformation = Get-GPOZaurrBackupInformation -BackupFolder $RestoreFrom
 $BackupInformation | Format-Table -a
@@ -10,5 +10,5 @@ $RestoredGPOs = Restore-GPOZaurr -BackupFolder $RestoreFrom -Verbose
 $RestoredGPOs | Format-Table -AutoSize
 
 # restore just one Gpo
-$RestoredGPOs = Restore-GPOZaurr -BackupFolder $RestoreFrom -Verbose -DisplayName 'Users | Synced Office 365 Users'
-$RestoredGPOs | Format-Table -AutoSize
+#$RestoredGPOs = Restore-GPOZaurr -BackupFolder $RestoreFrom -Verbose -DisplayName 'Users | Synced Office 365 Users'
+#$RestoredGPOs | Format-Table -AutoSize

Examples/Example-04-GPOinformation.ps1

@@ -9,4 +9,4 @@ $GPOs[0].ACL | Format-Table -AutoSize
 
 $GPOs.Links | Format-Table -AutoSize
 
-$GPOS | Format-Table -AutoSize Name, WmiFilter, WMIDescription
+$GPOS | Format-Table -AutoSize DisplayName, WmiFilter, WMIDescription

Examples/Example-05-ListingWMIFiltersByName.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrWMI -Name 'Test - Dual Filter' | Format-Table -AutoSize *

Examples/Example-07-CreatingWMIFilters.ps1

@@ -1,7 +1,7 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 # By default it creates WMI filter in $Env:USERDNSDOMAIN if no Forest/IncludeDomains/ExcludeDomains are specified
-New-GPOZaurrWMI -Query 'select * from Win32_OperatingSystem where Version like "6.0%" and ProductType = "3"' -Name 'Test' -Verbose -Force
+New-GPOZaurrWMI -Query 'select * from Win32_OperatingSystem where Version like "6.0%" and ProductType = "3"' -Name 'Test' -Verbose #-Force
 
 # If you want to force creation of same filter in all domains of a forest (this overwrites set value)
 #New-GPOZaurrWMI -Query 'select * from Win32_OperatingSystem where Version like "6.0%" and ProductType = "3"' -Name 'Test' -Verbose -Forest 'ad.evotec.xyz' -WhatIf

Examples/Example-08-ListingPermissions.ps1

@@ -1,16 +1,7 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-#$GPOS = Get-GPOZaurr
-#$GPOS | Format-Table -AutoSize
+$T = Get-GPOZaurrPermission -GPOName 'DC | PowerShell Logging' -Type Unknown
 
-#$GPOS[0] | Format-List
-
-#$GPOs[0].ACL | Format-Table -AutoSize
-
-#Get-GPOZaurrPermissions | Format-Table -AutoSize
-$T = Get-GPOZaurrPermissions #| Out-HtmlView
-#$T[0] | Format-List *
+#$T = Get-GPOZaurrPermission -ResolveAccounts -IncludeOwner #-ExcludePermissionType GpoRead,GpoApply #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView
 $T | Format-Table -AutoSize *
-#$T[0].Trustee
-#$T[0].Permission
-#$T[0]
+#$T | Out-HtmlView -ScrollX -Filtering -Online -DisablePaging

Examples/Example-08-ListingPermissionsAdministrative.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrPermission -GPOName 'Default Domain Policy' -Type 'All'
+$T | Format-Table *

Examples/Example-08-ListingPermissionsPerGPO.ps1

@@ -0,0 +1,12 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' #-Principal 'marikegerard' -PrincipalType Name # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'marikegerard' -PrincipalType Name # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'EVOTEC\marikegerard' -PrincipalType Name # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'S-1-5-18' -PrincipalType Sid # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'CN=Enterprise Admins,CN=Users,DC=ad,DC=evotec,DC=xyz' -PrincipalType DistinguishedName # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *

Examples/Example-08-ListingPermissionsUnknown.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrPermission -Type Unknown -Verbose
+$T | Format-Table *

Examples/Example-09-RemovingGPOPermissionUnknown.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+#Clear-Host
+Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 1 #-WhatIf

Examples/Example-09-RemovingGPOPermissionUnknown02.ps1

@@ -0,0 +1,19 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Step 1 - Create report
+$Report = Get-GPOZaurrPermission -Type All
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOutput.xlsx -ExcelWorkSheetName 'GPO Permissions Before' -AutoFilter -AutoFit
+
+# Step 2 - Verify couple of GPOS returned with whatif
+#Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 4 -WhatIf
+
+# Step 3 - Confirm the change without whatif
+#Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 4
+
+# Step 4 - Analyze GPO manually to confirm only unknown sids were removed
+
+# Step 5 - if everything went ok, continue process without whatif
+
+# Step-6 - Generate new report
+#$Report = Get-GPOZaurrPermission -Type All
+#$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOutput.xlsx -ExcelWorkSheetName 'GPO Permissions After' -AutoFilter -AutoFit

Examples/Example-09-RemovingGPOpermissionNamed.ps1

@@ -0,0 +1,6 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy'
+$T | Format-Table -AutoSize *
+
+Remove-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'S-1-5-21-853615985-2870445339-3163598659-3755' -Verbose #-WhatIf #-IncludePermissionType GpoApply #-WhatIf

Examples/Example-10-ListingGPO.ps1

@@ -0,0 +1,6 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrAD | Format-Table
+Get-GPOZaurrAD -Forest 'test.evotec.pl' | Format-Table
+
+Get-GPOZaurrAD -GPOName 'Default Domain Policy' -IncludeDomains 'ad.evotec.pl' | Format-Table

Examples/Example-10-ListingGPOLong.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$GPOS = Get-GPOZaurr
+$GPOS | Format-Table -AutoSize

Examples/Example-11-ReplaceGPOOwnerAutomated.ps1

@@ -0,0 +1,17 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This Example shows how to deal with GPOs that have owner that doesn't exists anymore (deleted userr or diff domain) - EmptyOrUnknown
+# And also can fix at the same time NotAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins
+# regardless if current user is still Domain Admin or not
+
+$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName
+$GPOs | Format-Table  DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
+
+#Set-GPOZaurrOwner -Type Unknown -Verbose  #-LimitProcessing 2 -WhatIf
+Set-GPOZaurrOwner -Type NotAdministrative  -Verbose -LimitProcessing 2 -WhatIf
+#Set-GPOZaurrOwner -Type NotMatching -Verbose -LimitProcessing 2 -WhatIf
+
+#Set-GPOZaurrOwner -GPOName 'COMPUTERS | Enable Sets' -Verbose -Principal 'przemyslaw.klys' -WhatIf #-SkipSysvol
+#Set-GPOZaurrOwner -GPOName 'New Group Policy Object' -Verbose #-WhatIf #-SkipSysvol
+#$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName 'New Group Policy Object'
+#$GPOs | Format-Table DisplayName, Owner, OwnerSID

Examples/Example-11-ReplaceGPOOwnerManual.ps1

@@ -0,0 +1,22 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# You can set owner per guid if you want to have more control.
+$LImitProcessing = 2
+
+# check what is there now
+$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
+$GPOs | Format-Table DisplayName, Owner, OwnerSID
+$Count = 0
+
+# loop thru all GPOS (or use LimitProcessing)
+foreach ($GPO in $GPOS) {
+    $Count++
+    Set-GPOZaurrOwner -GPOID $GPO.GUID -Verbose -Principal 'przemyslaw.klys@evotec.pl' #-WhatIf
+    if ($Count -eq $LImitProcessing) {
+        break
+    }
+}
+
+# Confirm what changed
+$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
+$GPOs | Format-Table DisplayName, Owner, OwnerSID

Examples/Example-11-ReplaceGPOOwnerPerGPO.ps1

@@ -0,0 +1,15 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# this example shows how to replace owner of a single GPO
+
+$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
+$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType
+
+# If Principal is not provided Domain Admins are set as default principal
+Set-GPOZaurrOwner -GPOName 'ALL | Enable RDP' -WhatIf
+
+# If principal is given it is set (of course if it exits). Otherwise warning is returned.
+Set-GPOZaurrOwner -GPOName 'ALL | Enable RDP' -Principal 'przemyslaw.klys' #-WhatIf
+
+$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
+$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType

Examples/Example-11-ReplaceGPOwner.ps1

@@ -0,0 +1,12 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Step 1 - Create report
+$Report = Get-GPOZaurrOwner -IncludeSysvol
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOwners.xlsx -ExcelWorkSheetName 'GPO Owners Before' -AutoFilter -AutoFit
+
+# Step 2 - Fix owners / use WhatIf and LimitProcessing / verify changes before/after
+Set-GPOZaurrOwner -Type NotAdministrative  -Verbose -LimitProcessing 2 -WhatIf
+
+# Step 3
+$Report = Get-GPOZaurrOwner -IncludeSysvol
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOwners.xlsx -ExcelWorkSheetName 'GPO Owners After' -AutoFilter -AutoFit

Examples/Example-12-GPOInformationPermissionOnly.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$GPOS = Get-GPOZaurr -PermissionsOnly
+# to screen
+$GPOS | Format-Table -AutoSize
+# to html
+#$GPOS | Out-HtmlView
+# to excel
+#$GPOS | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOExport.xlsx -ExcelWorkSheetName 'Permissions' -AutoFit -AutoFilter

Examples/Example-13-ListingOwners01.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Owners = Get-GPOZaurr -OwnerOnly
+$Owners | Format-Table

Examples/Example-13-ListingOwners02.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol
+$T | Format-Table *
+#$T | Out-HtmlView -ScrollX
+
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOName 'Default Domain Policy'
+$T | Format-Table *
+
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOGuid '4E1F9C70-1DDB-4AB6-BBA3-14A8E07F0B4B'
+$T | Format-Table *

Examples/Example-14-ListingGPOsPerOU1.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink | Format-Table -AutoSize *

Examples/Example-14-ListingGPOsPerOU2.ps1

@@ -0,0 +1,7 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -SearchBase 'OU=Domain Controllers,DC=ad,DC=evotec,DC=xyz' | Format-Table -AutoSize
+
+Get-GPOZaurrLink -SearchBase 'OU=Computers,OU=Production,DC=ad,DC=evotec,DC=xyz' | Format-Table -AutoSize
+
+Get-GPOZaurrLink -SearchBase 'DC=ad,DC=evotec,DC=xyz' -SearchScope Base | Format-Table -AutoSize

Examples/Example-14-ListingGPOsPerOU3.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-ADOrganizationalUnit -Filter * -Properties distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
+Get-ADObject -Filter * -Properties distinguishedName, gplink -Server 'ad.evotec.pl' | Get-GPOZaurrLink | Format-Table -AutoSize
+Get-GPOZaurrLink | Format-Table -AutoSize

Examples/Example-14-ListingGPOsPerOU4.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -Linked 'Root' -IncludeDomains 'ad.evotec.pl' | ft

Examples/Example-14-ListingGPOsSpecial.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Clear-Host
+
+Get-GPOZaurrLink -Linked Root | Format-Table -AutoSize
+
+Get-GPOZaurrLink -Linked Site | Format-Table -AutoSize
+
+Get-GPOZaurrLink -Linked DomainControllers | Format-Table -AutoSize
+
+Get-GPOZaurrLink -Linked Other | Format-Table -AutoSize

Examples/Example-15-FixingGPOPermissions.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink | Format-Table -AutoSize

Examples/Example-16-AddRemoveGPOPermission01.ps1

@@ -0,0 +1,17 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Clear-Host
+
+$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-IncludeGPOObject #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+
+Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -Verbose
+
+$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+
+Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -Verbose
+Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+
+$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *

Examples/Example-16-AddRemoveGPOPermission02.ps1

@@ -0,0 +1,38 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Clear-Host
+
+$GPOName = 'ALL | Enable RDP'
+
+$T = Get-GPOZaurrPermission -GPOName $GPOName -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow -Principal 'Domain Admins' -PrincipalType 'Name'
+$T | Format-Table *
+
+<#
+# this will go and check for both Domain Admins / Enterprise Admins - if found won't do anything
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Type Administrative -Verbose
+# this will go thru, because PrincipalType is not set to look by Name. Be precise with what you ask for
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -Verbose
+# this will be detected as already existing
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -PrincipalType Name -Verbose
+# this will be added only if it doesn't exists - assuming that przemyslaw.klys is displayed in Get-GPOZaurrPermissions
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+# this will be added only if it doesn't exists - assuming that przemyslaw.klys is displayed in Get-GPOZaurrPermissions
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+# this will ADD system if it doesn't eists
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Type WellKnownAdministrative -Verbose
+
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -Verbose
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -Verbose
+# this will not work because we already have GPOEditDeleteModifySecurity which is higher than GpoEDIT
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEdit -Principal 'przemyslaw.klys' -Verbose
+#>
+Add-GPOZaurrPermission -GPOName $GPOName -Type AuthenticatedUsers -PermissionType GpoRead -Verbose #-WhatIf
+
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T | Format-Table -AutoSize *
+
+#Remove-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T | Format-Table -AutoSize *

Examples/Example-16-AddRemoveGPOPermission03.ps1

@@ -0,0 +1,20 @@
+#Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$ApprovedGroups = @(
+    'GDS-TestGroup10'
+)
+$RootGroups = @(
+    #'przemyslaw.klys'
+)
+
+
+Invoke-GPOZaurrPermission -Linked Root -Verbose {
+    Set-GPOOwner -Type Administrative
+    #Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'
+    #Set-GPOOwner -Principal 'Domain Admins'
+    Remove-GPOPermission -Type Administrative -IncludePermissionType GPOCustom
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
+    #Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
+} #-WhatIf #| Format-Table *

Examples/Example-16-AddRemoveGPOPermission04.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=Computers,OU=Production,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    #Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'
+    #Set-GPOOwner -Principal 'Domain Admins'
+    #Remove-GPOPermission -Type Administrative -IncludePermissionType GPOCustom
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
+    #Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
+    #Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
+} #-WhatIf #| Format-Table *

Examples/Example-16-KeepPermissions.ps1

@@ -0,0 +1,42 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Apply permissions for ROOT
+Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+# Apply perrmissions for Domain Controllers
+Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+# Apply permissions for Regions, with exclusions for those 4 groups
+$Exclude = @(
+    'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} #-WhatIf
+
+$Exclude = @(
+    'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} #-WhatIf

Examples/Example-16-KeepPermissions02.ps1

@@ -0,0 +1,43 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Apply permissions for ROOT
+Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.pl' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+
+# Apply perrmissions for Domain Controllers
+Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+# Apply permissions for Regions, with exclusions for those 4 groups
+$Exclude = @(
+    'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} #-WhatIf
+
+$Exclude = @(
+    'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} #-WhatIf

Examples/Example-16-KeepPermissions03.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This is a bit special - I would read blog post before running this
+Invoke-GPOZaurrPermission -Verbose -Level 1 -Limit 1 {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf

Examples/Example-17-ListInconsistentACL.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
+Get-GPOZaurrPermissionConsistency -Type All | Format-Table

Examples/Example-17-RepairInconsistentACL.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz'
+
+Repair-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -Verbose #-WhatIf -Verbose

Examples/Example-17-RepairInconsistentACLAll.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrPermissionConsistency -Type All | Format-Table
+
+Repair-GPOZaurrPermissionConsistency -LimitProcessing 2 -WhatIf -Verbose

Examples/Example-18-ListInconsistenciesACLAdvanced.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
+
+$Output = Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -VerifyInheritance
+$Output | Format-Table DisplayName, DomainName, ACLConsistent, ACLConsistentInside
+$Output.ACLConsistentInsideDetails | Format-Table
+
+$Output = Get-GPOZaurrPermissionConsistency -VerifyInheritance -Type 'All'
+$Output | Format-Table

Examples/Example-19-TestSysvol.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrSysvol -Verbose | Format-Table

Examples/Example-19-TestSysvolDomainControllers.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrSysvol -VerifyDomainControllers -Verbose | Format-Table *

Examples/Example-20-RemoveOrphanedFoldersSysvol.ps1

@@ -0,0 +1,7 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# this allows you to process X amount of orphaned folders/files (good for testing)
+Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf -LimitProcessing 2
+
+# this runs for whole SYSVOL and checks things against GPOS
+Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf

Examples/Example-21-ListLegacyADMFiles.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLegacyFiles | Format-Table -AutoSize

Examples/Example-22-RemoveLegacyADMFiles.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Remove-GPOZaurrLegacyFiles -Verbose -WhatIf

Examples/Example-23-Links.ps1

@@ -0,0 +1,14 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Get-GPOZaurrLinkSummary | Format-Table *
+#Get-GPOZaurrLinkSummary -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'MultipleLinks' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'OneLink' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'LinksSummary' -UnlimitedProperties | Format-Table *
+
+$Report = Get-GPOZaurrLinkSummary #-UnlimitedProperties
+$Report | Format-Table *
+$Report.MultipleLinks | Format-Table *
+$Report.OneLink | Format-Table *
+$Report.LinksSummary | Format-Table *

Examples/Example-24-Links02.ps1

@@ -0,0 +1,12 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Report = Get-GPOZaurrLinkSummary -Report OneLink
+$Report | Format-Table
+$AffectedGPOs = foreach ($GPO in $Report) {
+    if ($GPO.Level1 -gt 1) {
+        $GPO
+    }
+}
+
+$AffectedGPOs | Format-Table *

GPOZaurr.psd1

@@ -5,9 +5,9 @@
     CompatiblePSEditions = 'Desktop'
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
     Description          = 'Group Policy Eater'
-    FunctionsToExport    = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermissions', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles'
+    FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.9'
+    ModuleVersion        = '0.0.39'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -17,9 +17,13 @@
         }
     }
     RequiredModules      = @{
-        ModuleVersion = '0.0.134'
+        ModuleVersion = '0.0.147'
         ModuleName    = 'PSSharedGoods'
         Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
+    }, @{
+        ModuleVersion = '0.0.57'
+        ModuleName    = 'ADEssentials'
+        Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
     }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
     RootModule           = 'GPOZaurr.psm1'
 }

Private/ConvertTo-TableFormat.ps1

@@ -1,45 +0,0 @@
-function ConvertTo-TableFormat {
-    <#
-    .SYNOPSIS
-        Rebuild an object based on the Format Data for the object.
-    .DESCRIPTION
-        Allows an object to be rebuilt based on the view data for the object. Uses Select-Object to create a new PSCustomObject.
-    #>
-    [CmdletBinding()]
-    param (
-        [Parameter(ValueFromPipeline)]
-        [Object]$InputObject
-    )
-    begin {
-        $isFirst = $true
-    }
-    process {
-        $format = if ($isFirst) {
-            $formatData = Get-FormatData -TypeName $InputObject.PSTypeNames | Select-Object -First 1
-            if ($formatData) {
-                $viewDefinition = $formatData.FormatViewDefinition | Where-Object Control -match 'TableControl'
-
-                for ($i = 0; $i -lt $viewDefinition.Control.Headers.Count; $i++) {
-                    $name = $viewDefinition.Control.Headers[$i].Label
-
-                    $displayEntry = $viewDefinition.Control.Rows.Columns[$i].DisplayEntry
-                    if (-not $name) {
-                        $name = $displayEntry.Value
-                    }
-
-                    $expression = switch ($displayEntry.ValueType) {
-                        'Property' { $displayEntry.Value }
-                        'ScriptBlock' { [ScriptBlock]::Create($displayEntry.Value) }
-                    }
-
-                    @{ Name = $name; Expression = $expression }
-                }
-            }
-        }
-        if ($format) {
-            $InputObject | Select-Object -Property $format
-        } else {
-            $InputObject
-        }
-    }
-}

Private/Get-PrivGPOZaurrLInk.ps1

@@ -0,0 +1,75 @@
+function Get-PrivGPOZaurrLink {
+    [cmdletBinding()]
+    param(
+        [Microsoft.ActiveDirectory.Management.ADObject] $Object,
+        [switch] $Limited,
+        [System.Collections.IDictionary] $GPOCache
+    )
+    if ($Object.GpLink -and $Object.GpLink.Trim() -ne '') {
+        #$Object.GpLink -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://'
+        $Object.GpLink -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            #Write-Verbose $_
+            if ($_.Length -gt 10) {
+                $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
+                $Output = [ordered] @{
+                    DistinguishedName = $Object.DistinguishedName
+                    CanonicalName     = $Object.CanonicalName.TrimEnd('/');
+                    Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
+                }
+                $Search = -join ($DomainCN, $Output['Guid'])
+                if ($GPOCache -and -not $Limited) {
+                    if ($GPOCache[$Search]) {
+                        $Output['DisplayName'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
+                }
+            }
+        }
+    } elseif ($Object.LinkedGroupPolicyObjects -and $Object.LinkedGroupPolicyObjects.Trim() -ne '') {
+        $Object.LinkedGroupPolicyObjects -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            if ($_.Length -gt 10) {
+                $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
+                $Output = [ordered] @{
+                    DistinguishedName = $Object.DistinguishedName
+                    CanonicalName     = $Object.CanonicalName.TrimEnd('/');
+                    Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
+                }
+                $Search = -join ($DomainCN, $Output['Guid'])
+                if ($GPOCache -and -not $Limited) {
+                    if ($GPOCache[$Search]) {
+                        $Output['Name'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
+                }
+            }
+        }
+    }
+}

Private/Get-PrivPermission.ps1

@@ -0,0 +1,260 @@
+function Get-PrivPermission {
+    [cmdletBinding()]
+    param(
+        [Microsoft.GroupPolicy.Gpo] $GPO,
+        [Object] $SecurityRights,
+
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
+        [switch] $SkipWellKnown,
+        [switch] $SkipAdministrative,
+        [switch] $IncludeOwner,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid',
+
+        [switch] $IncludeGPOObject,
+        [System.Collections.IDictionary] $ADAdministrativeGroups,
+        [validateSet('AuthenticatedUsers', 'DomainComputers', 'Unknown', 'WellKnownAdministrative', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All',
+        [System.Collections.IDictionary] $Accounts,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    Begin {
+        Write-Verbose "Get-PrivPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
+    }
+    Process {
+        $SecurityRights | ForEach-Object -Process {
+            $GPOPermission = $_
+            if ($PermitType -ne 'All') {
+                if ($PermitType -eq 'Deny') {
+                    if ($GPOPermission.Denied -eq $false) {
+                        return
+                    }
+                } else {
+                    if ($GPOPermission.Denied -eq $true) {
+                        return
+                    }
+                }
+            }
+            if ($ExcludePermissionType -contains $GPOPermission.Permission) {
+                return
+            }
+            if ($IncludePermissionType) {
+                if ($IncludePermissionType -notcontains $GPOPermission.Permission) {
+                    if ($IncludePermissionType -eq 'GpoRead' -and $GPOPermission.Permission -eq 'GpoApply') {
+                        # We treat GpoApply as GpoRead as well. This is because when GpoApply is set it becomes GpoRead as well but of course not vice versa
+                    } else {
+                        return
+                    }
+                }
+            }
+            if ($SkipWellKnown.IsPresent -or $Type -contains 'NotWellKnown') {
+                if ($GPOPermission.Trustee.SidType -eq 'WellKnownGroup') {
+                    return
+                }
+            }
+            if ($SkipAdministrative.IsPresent -or $Type -contains 'NotAdministrative') {
+                $IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
+                if ($IsAdministrative) {
+                    return
+                }
+            }
+            if ($Type -contains 'Administrative' -and $Type -notcontains 'All') {
+                $IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
+                if (-not $IsAdministrative) {
+                    return
+                }
+            }
+            if ($Type -contains 'NotWellKnownAdministrative' -and $Type -notcontains 'All') {
+                # We check for SYSTEM account
+                # Maybe we should make it a function and provide more
+                if ($GPOPermission.Trustee.Sid -eq 'S-1-5-18') {
+                    return
+                }
+            }
+            if ($Type -contains 'WellKnownAdministrative' -and $Type -notcontains 'All') {
+                # We check for SYSTEM account
+                # Maybe we should make it a function and provide more
+                if ($GPOPermission.Trustee.Sid -ne 'S-1-5-18') {
+                    return
+                }
+            }
+            if ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
+                # May need updates if there's more types
+                if ($GPOPermission.Trustee.SidType -ne 'Unknown') {
+                    return
+                }
+            }
+            if ($Type -contains 'AuthenticatedUsers' -and $Type -notcontains 'All') {
+                if ($GPOPermission.Trustee.Sid -ne 'S-1-5-11') {
+                    return
+                }
+            }
+            if ($Type -contains 'DomainComputers' -and $Type -notcontains 'All') {
+                $DomainComputersSID = -join ($ExtendedForestInformation['DomainsExtended'][$GPO.DomainName].DomainSID, '-515')
+                if ($GPOPermission.Trustee.Sid -ne $DomainComputersSID) {
+                    return
+                }
+            }
+            if ($Principal) {
+                if ($PrincipalType -eq 'Sid') {
+                    if ($Principal -notcontains $GPOPermission.Trustee.Sid.Value) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'DistinguishedName') {
+                    if ($Principal -notcontains $GPOPermission.Trustee.DSPath) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'Name') {
+                    $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                    if ($Principal -notcontains $UserMerge -and $Principal -notcontains $GPOPermission.Trustee.Name) {
+                        return
+                    }
+                }
+            }
+            if ($ExcludePrincipal) {
+                if ($ExcludePrincipalType -eq 'Sid') {
+                    if ($ExcludePrincipal -contains $GPOPermission.Trustee.Sid.Value) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'DistinguishedName') {
+                    if ($ExcludePrincipal -contains $GPOPermission.Trustee.DSPath) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'Name') {
+                    $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                    if ($ExcludePrincipal -contains $UserMerge -or $ExcludePrincipal -contains $GPOPermission.Trustee.Name) {
+                        return
+                    }
+                }
+            }
+            $ReturnObject = [ordered] @{
+                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
+                GUID              = $GPO.ID
+                DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
+                Enabled           = $GPO.GpoStatus
+                Description       = $GPO.Description
+                CreationDate      = $GPO.CreationTime
+                ModificationTime  = $GPO.ModificationTime
+                PermissionType    = if ($GPOPermission.Denied -eq $true) { 'Deny' } else { 'Allow' }
+                Permission        = $GPOPermission.Permission  # : GpoEditDeleteModifySecurity
+                Inherited         = $GPOPermission.Inherited   # : False
+                Domain            = $GPOPermission.Trustee.Domain  #: EVOTEC
+                DistinguishedName = $GPOPermission.Trustee.DSPath  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+                Name              = $GPOPermission.Trustee.Name    #: Domain Admins
+                Sid               = $GPOPermission.Trustee.Sid.Value     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+                SidType           = $GPOPermission.Trustee.SidType #: Group
+            }
+            if ($Accounts) {
+                $A = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                if ($A -and $Accounts[$A]) {
+                    $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
+                    $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
+                    $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
+                    $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
+                    $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
+                    if (-not $ReturnObject['Sid']) {
+                        $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
+                    }
+                    if ($Accounts[$A].ObjectClass -eq 'group') {
+                        $ReturnObject['SidType'] = 'Group'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'user') {
+                        $ReturnObject['SidType'] = 'User'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
+                        $ReturnObject['SidType'] = 'Computer'
+                    } else {
+                        $ReturnObject['SidType'] = 'EmptyOrUnknown'
+                    }
+                } else {
+                    $ReturnObject['UserPrincipalName'] = ''
+                    $ReturnObject['AccountEnabled'] = ''
+                    $ReturnObject['PasswordLastSet'] = ''
+                    $ReturnObject['LastLogonDate'] = ''
+                }
+            }
+            if ($IncludeGPOObject) {
+                $ReturnObject['GPOObject'] = $GPO
+                $ReturnObject['GPOSecurity'] = $SecurityRights
+                $ReturnObject['GPOSecurityPermissionItem'] = $GPOPermission
+            }
+            [PSCustomObject] $ReturnObject
+        }
+        if ($IncludeOwner.IsPresent) {
+            if ($GPO.Owner) {
+                $SplittedOwner = $GPO.Owner.Split('\')
+                $DomainOwner = $SplittedOwner[0]  #: EVOTEC
+                $DomainUserName = $SplittedOwner[1]   #: Domain Admins
+                $SID = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].Sid.Value
+                if ($SID) {
+                    $SIDType = 'Group'
+                    $DistinguishedName = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].DistinguishedName
+                } else {
+                    $SIDType = ''
+                    $DistinguishedName = ''
+                }
+            } else {
+                $DomainOwner = $GPO.Owner
+                $DomainUserName = ''
+                $SID = ''
+                $SIDType = 'EmptyOrUnknown'
+                $DistinguishedName = ''
+            }
+            $ReturnObject = [ordered] @{
+                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
+                GUID              = $GPO.Id
+                DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
+                Enabled           = $GPO.GpoStatus
+                Description       = $GPO.Description
+                CreationDate      = $GPO.CreationTime
+                ModificationTime  = $GPO.ModificationTime
+                Permission        = 'GpoOwner'  # : GpoEditDeleteModifySecurity
+                Inherited         = $false  # : False
+                Domain            = $DomainOwner
+                DistinguishedName = $DistinguishedName  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+                Name              = $DomainUserName
+                Sid               = $SID     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+                SidType           = $SIDType #  #: Group
+            }
+            if ($Accounts) {
+                $A = $GPO.Owner
+                if ($A -and $Accounts[$A]) {
+                    $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
+                    $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
+                    $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
+                    $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
+                    $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
+                    if (-not $ReturnObject['Sid']) {
+                        $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
+                    }
+                    if ($Accounts[$A].ObjectClass -eq 'group') {
+                        $ReturnObject['SidType'] = 'Group'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'user') {
+                        $ReturnObject['SidType'] = 'User'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
+                        $ReturnObject['SidType'] = 'Computer'
+                    } else {
+                        $ReturnObject['SidType'] = 'EmptyOrUnknown'
+                    }
+                } else {
+                    $ReturnObject['UserPrincipalName'] = ''
+                    $ReturnObject['AccountEnabled'] = ''
+                    $ReturnObject['PasswordLastSet'] = ''
+                    $ReturnObject['LastLogonDate'] = ''
+                }
+            }
+            if ($IncludeGPOObject) {
+                $ReturnObject['GPOObject'] = $GPO
+                $ReturnObject['GPOSecurity'] = $SecurityRights
+                $ReturnObject['GPOSecurityPermissionItem'] = $null
+            }
+            [PSCustomObject] $ReturnObject
+        }
+    }
+    End {
+
+    }
+}

Private/Get-XMLGPO.ps1

@@ -2,7 +2,10 @@
     [cmdletBinding()]
     param(
         [XML] $XMLContent,
-        [Microsoft.GroupPolicy.Gpo] $GPO
+        [Microsoft.GroupPolicy.Gpo] $GPO,
+        [switch] $PermissionsOnly,
+        [switch] $OwnerOnly,
+        [System.Collections.IDictionary] $ADAdministrativeGroups
     )
     if ($XMLContent.GPO.LinksTo) {
         $Linked = $true
@@ -33,64 +36,132 @@
     } elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) {
         $Enabled = 'User configuration settings disabled'
     }
-
-    [PsCustomObject] @{
-        'Name'                              = $XMLContent.GPO.Name
-        'Domain'                            = $XMLContent.GPO.Identifier.Domain.'#text'
-        'GUID'                              = $XMLContent.GPO.Identifier.Identifier.InnerText
-        'Linked'                            = $Linked
-        'LinksCount'                        = $LinksCount
-        'Enabled'                           = $Enabled
-        'ComputerEnabled'                   = $ComputerEnabled
-        'UserEnabled'                       = $UserEnabled
-        'ComputerSettingsAvailable'         = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true }
-        'UserSettingsAvailable'             = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true }
-        'ComputerSettingsStatus'            = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
-        'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false }
-        'ComputerSettings'                  = $XMLContent.GPO.Computer.ExtensionData.Extension
-        'UserSettingsStatus'                = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
-        'UserSettingsVersionIdentical'      = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
-        'UserSettings'                      = $XMLContent.GPO.User.ExtensionData.Extension
-
-        'CreationTime'                      = [DateTime] $XMLContent.GPO.CreatedTime
-        'ModificationTime'                  = [DateTime] $XMLContent.GPO.ModifiedTime
-        'ReadTime'                          = [DateTime] $XMLContent.GPO.ReadTime
-
-        'WMIFilter'                         = $GPO.WmiFilter.name
-        'WMIFilterDescription'              = $GPO.WmiFilter.Description
-        'Path'                              = $GPO.Path
-        'SDDL'                              = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
-        'Owner'                             = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
-        'OwnerSID'                          = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
-        'ACL'                               = $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
+    if (-not $PermissionsOnly) {
+        if ($XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text') {
+            $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text')"]
+            $WellKnown = ConvertFrom-SID -SID $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text' -OnlyWellKnown
+            if ($AdministrativeGroup) {
+                $OwnerType = 'Administrative'
+            } elseif ($WellKnown.Name) {
+                $OwnerType = 'WellKnown'
+            } else {
+                $OwnerType = 'NotAdministrative'
+            }
+        } else {
+            $OwnerType = 'EmptyOrUnknown'
+        }
+    }
+    if ($PermissionsOnly) {
+        [PsCustomObject] @{
+            'DisplayName'          = $XMLContent.GPO.Name
+            'DomainName'           = $XMLContent.GPO.Identifier.Domain.'#text'
+            'GUID'                 = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+            'Enabled'              = $Enabled
+            'Name'                 = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+            'Sid'                  = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            #'SidType'        = if (($XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text').Length -le 10) { 'WellKnown' } else { 'Other' }
+            'PermissionType'       = 'Allow'
+            'Inherited'            = $false
+            'Permissions'          = 'Owner'
+            'GPODistinguishedName' = $GPO.Path
+        }
+        $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
             if ($_) {
                 [PsCustomObject] @{
-                    'Name'           = $_.trustee.name.'#Text'
-                    'Sid'            = $_.trustee.SID.'#Text'
-                    'PermissionType' = $_.type.PermissionType
-                    'Inherited'      = $_.Inherited
-                    'Permissions'    = $_.Standard.GPOGroupedAccessEnum
+                    'DisplayName'          = $XMLContent.GPO.Name
+                    'DomainName'           = $XMLContent.GPO.Identifier.Domain.'#text'
+                    'GUID'                 = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+                    'Enabled'              = $Enabled
+                    'Name'                 = $_.trustee.name.'#Text'
+                    'Sid'                  = $_.trustee.SID.'#Text'
+                    #'SidType'        = if (($XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text').Length -le 10) { 'WellKnown' } else { 'Other' }
+                    'PermissionType'       = $_.type.PermissionType
+                    'Inherited'            = if ($_.Inherited -eq 'false') { $false } else { $true }
+                    'Permissions'          = $_.Standard.GPOGroupedAccessEnum
+                    'GPODistinguishedName' = $GPO.Path
                 }
             }
         }
-        'Auditing'                          = if ($XMLContent.GPO.SecurityDescriptor.AuditingPresent.'#text' -eq 'true') { $true } else { $false }
-        'Links'                             = $XMLContent.GPO.LinksTo | ForEach-Object -Process {
-            if ($_) {
-                [PSCustomObject] @{
-                    CanonicalName = $_.SOMPath
-                    Enabled       = $_.Enabled
-                    NoOverride    = $_.NoOverride
+    } elseif ($OwnerOnly) {
+        [PsCustomObject] @{
+            'DisplayName'          = $XMLContent.GPO.Name
+            'DomainName'           = $XMLContent.GPO.Identifier.Domain.'#text'
+            'GUID'                 = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+            'Enabled'              = $Enabled
+            'Owner'                = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+            'OwnerSID'             = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'OwnerType'            = $OwnerType
+            'GPODistinguishedName' = $GPO.Path
+        }
+    } else {
+        [PsCustomObject] @{
+            'DisplayName'                       = $XMLContent.GPO.Name
+            'DomainName'                        = $XMLContent.GPO.Identifier.Domain.'#text'
+            'GUID'                              = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+            'Linked'                            = $Linked
+            'LinksCount'                        = $LinksCount
+            'Enabled'                           = $Enabled
+            'ComputerEnabled'                   = $ComputerEnabled
+            'UserEnabled'                       = $UserEnabled
+            'ComputerSettingsAvailable'         = if ($null -eq $XMLContent.GPO.Computer.ExtensionData) { $false } else { $true }
+            'UserSettingsAvailable'             = if ($null -eq $XMLContent.GPO.User.ExtensionData) { $false } else { $true }
+            'ComputerSettingsStatus'            = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
+            'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false }
+            'ComputerSettings'                  = $XMLContent.GPO.Computer.ExtensionData.Extension
+            'UserSettingsStatus'                = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
+            'UserSettingsVersionIdentical'      = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
+            'UserSettings'                      = $XMLContent.GPO.User.ExtensionData.Extension
+
+            'CreationTime'                      = [DateTime] $XMLContent.GPO.CreatedTime
+            'ModificationTime'                  = [DateTime] $XMLContent.GPO.ModifiedTime
+            'ReadTime'                          = [DateTime] $XMLContent.GPO.ReadTime
+
+            'WMIFilter'                         = $GPO.WmiFilter.name
+            'WMIFilterDescription'              = $GPO.WmiFilter.Description
+            'GPODistinguishedName'              = $GPO.Path
+            'SDDL'                              = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
+            'Owner'                             = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+            'OwnerSID'                          = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'OwnerType'                         = $OwnerType
+            'ACL'                               = @(
+                [PsCustomObject] @{
+                    'Name'           = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+                    'Sid'            = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+                    'PermissionType' = 'Allow'
+                    'Inherited'      = $false
+                    'Permissions'    = 'Owner'
+                }
+                $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
+                    if ($_) {
+                        [PsCustomObject] @{
+                            'Name'           = $_.trustee.name.'#Text'
+                            'Sid'            = $_.trustee.SID.'#Text'
+                            'PermissionType' = $_.type.PermissionType
+                            'Inherited'      = if ($_.Inherited -eq 'false') { $false } else { $true }
+                            'Permissions'    = $_.Standard.GPOGroupedAccessEnum
+                        }
+                    }
+                }
+            )
+            'Auditing'                          = if ($XMLContent.GPO.SecurityDescriptor.AuditingPresent.'#text' -eq 'true') { $true } else { $false }
+            'Links'                             = $XMLContent.GPO.LinksTo | ForEach-Object -Process {
+                if ($_) {
+                    [PSCustomObject] @{
+                        CanonicalName = $_.SOMPath
+                        Enabled       = $_.Enabled
+                        NoOverride    = $_.NoOverride
+                    }
                 }
             }
-        }
-        <#
+            <#
         SOMName SOMPath       Enabled NoOverride
         ------- -------       ------- ----------
         ad      ad.evotec.xyz true    false
         #>
 
-        #| Select-Object -ExpandProperty SOMPath
+            #| Select-Object -ExpandProperty SOMPath
 
+        }
     }
     #break
 }

Private/New-ADForestDrives.ps1

@@ -0,0 +1,56 @@
+function New-ADForestDrives {
+    [cmdletbinding()]
+    param(
+        [string] $ForestName,
+        [string] $ObjectDN
+    )
+    if (-not $Global:ADDrivesMapped) {
+        if ($ForestName) {
+            $Forest = Get-ADForest -Identity $ForestName
+        } else {
+            $Forest = Get-ADForest
+        }
+        if ($ObjectDN) {
+            # This doesn't work because no Domain and no $Server
+            $DNConverted = (ConvertFrom-Distinguishedname -DistinguishedName $ObjectDN -ToDC) -replace '=' -replace ','
+            if (-not(Get-PSDrive -Name $DNConverted -ErrorAction SilentlyContinue)) {
+                try {
+
+                    if ($Server) {
+                        $null = New-PSDrive -Name $DNConverted -Root '' -PsProvider ActiveDirectory -Server $Server.Hostname[0] -Scope Global -WhatIf:$false
+                        Write-Verbose "New-ADForestDrives - Mapped drive $Domain / $($Server.Hostname[0])"
+                    } else {
+                        $null = New-PSDrive -Name $DNConverted -Root '' -PsProvider ActiveDirectory -Server $Domain -Scope Global -WhatIf:$false
+                    }
+                } catch {
+                    Write-Warning "New-ADForestDrives - Couldn't map new AD psdrive for $Domain / $($Server.Hostname[0])"
+                }
+            }
+        } else {
+            foreach ($Domain in $Forest.Domains) {
+                try {
+                    $Server = Get-ADDomainController -Discover -DomainName $Domain
+                    $DomainInformation = Get-ADDomain -Server $Server.Hostname[0]
+                } catch {
+                    Write-Warning "New-ADForestDrives - Can't process domain $Domain - $($_.Exception.Message)"
+                    continue
+                }
+                $ObjectDN = $DomainInformation.DistinguishedName
+                $DNConverted = (ConvertFrom-Distinguishedname -DistinguishedName $ObjectDN -ToDC) -replace '=' -replace ','
+                if (-not(Get-PSDrive -Name $DNConverted -ErrorAction SilentlyContinue)) {
+                    try {
+                        if ($Server) {
+                            $null = New-PSDrive -Name $DNConverted -Root '' -PsProvider ActiveDirectory -Server $Server.Hostname[0] -Scope Global -WhatIf:$false
+                            Write-Verbose "New-ADForestDrives - Mapped drive $Domain / $Server"
+                        } else {
+                            $null = New-PSDrive -Name $DNConverted -Root '' -PsProvider ActiveDirectory -Server $Domain -Scope Global -WhatIf:$false
+                        }
+                    } catch {
+                        Write-Warning "New-ADForestDrives - Couldn't map new AD psdrive for $Domain / $Server $($_.Exception.Message)"
+                    }
+                }
+            }
+        }
+        $Global:ADDrivesMapped = $true
+    }
+}

Private/Remove-PrivPermission.ps1

@@ -0,0 +1,66 @@
+function Remove-PrivPermission {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [string] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+        [PSCustomObject] $GPOPermission,
+        [alias('PermissionType')][Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType
+    )
+    if ($GPOPermission.Name) {
+        $Text = "Removing SID: $($GPOPermission.Sid), Name: $($GPOPermission.Domain)\$($GPOPermission.Name), SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
+    } else {
+        $Text = "Removing SID: $($GPOPermission.Sid), Name: EMPTY, SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
+    }
+    if ($PrincipalType -eq 'DistinguishedName') {
+        if ($GPOPermission.DistinguishedName -eq $Principal -and $GPOPermission.Permission -eq $IncludePermissionType) {
+            if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, $Text)) {
+                try {
+                    Write-Verbose "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType for $($Principal) / $($GPOPermission.Name) / Type: $($GPOPermission.PermissionType)"
+                    $GPOPermission.GPOSecurity.Remove($GPOPermission.GPOSecurityPermissionItem)
+                    $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                } catch {
+                    Write-Warning "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                }
+            }
+        }
+    } elseif ($PrincipalType -eq 'Sid') {
+        if ($GPOPermission.Sid -eq $Principal -and $GPOPermission.Permission -eq $IncludePermissionType) {
+            if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, $Text)) {
+                try {
+                    Write-Verbose "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType for $($Principal) / $($GPOPermission.Name) / Type: $($GPOPermission.PermissionType)"
+                    $GPOPermission.GPOSecurity.Remove($GPOPermission.GPOSecurityPermissionItem)
+                    $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                } catch {
+                    if ($_.Exception.Message -like '*The request is not supported. (Exception from HRESULT: 0x80070032)*') {
+                        Write-Warning "Remove-GPOZaurrPermission - Bummer! The request is not supported, but lets fix it differently."
+                        # This is basically atomic approach. We will totally remove any permissions for that user on ACL level to get rid of this situation.
+                        # This situation should only happen if DENY is on FULL Control
+                        $ACL = Get-ADACL -ADObject $GPOPermission.GPOObject.Path -Bundle #-Verbose:$VerbosePreference
+                        if ($ACL) {
+                            Remove-ADACL -ACL $ACL -Principal $Principal -AccessControlType Deny -Verbose:$VerbosePreference
+                        }
+                        # I've noticed that in situation where Edit settings, delete, modify security is set and then set to Deny we need to fix it once more
+                        $ACL = Get-ADACL -ADObject $GPOPermission.GPOObject.Path -Bundle
+                        if ($ACL) {
+                            Remove-ADACL -ACL $ACL -Principal $Principal -AccessControlType Allow -Verbose:$VerbosePreference
+                        }
+                    } else {
+                        Write-Warning "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+            }
+        }
+    } elseif ($PrincipalType -eq 'Name') {
+        if ($GPOPermission.Name -eq $Principal -and $GPOPermission.Permission -eq $IncludePermissionType) {
+            if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, $Text)) {
+                try {
+                    Write-Verbose "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType for $($Principal) / $($GPOPermission.Name) / Type: $($GPOPermission.PermissionType)"
+                    $GPOPermission.GPOSecurity.Remove($GPOPermission.GPOSecurityPermissionItem)
+                    $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                } catch {
+                    Write-Warning "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                }
+            }
+        }
+    }
+}

Private/Test-SysvolFolders.ps1

@@ -0,0 +1,119 @@
+function Test-SysVolFolders {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOs,
+        [string] $Server,
+        [string] $Domain
+    )
+    $Differences = @{ }
+    $SysvolHash = @{ }
+
+    $GPOGUIDS = $GPOs.ID.GUID
+    try {
+        $SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -ErrorAction Stop
+    } catch {
+        $Sysvol = $Null
+    }
+    foreach ($_ in $SYSVOL) {
+        $GUID = $_.Name -replace '{' -replace '}'
+        $SysvolHash[$GUID] = $_
+    }
+    $Files = $SYSVOL.Name -replace '{' -replace '}'
+    if ($Files) {
+        $Comparing = Compare-Object -ReferenceObject $GPOGUIDS -DifferenceObject $Files -IncludeEqual
+        foreach ($_ in $Comparing) {
+            if ($_.SideIndicator -eq '==') {
+                $Found = 'Exists'
+            } elseif ($_.SideIndicator -eq '<=') {
+                $Found = 'Not available on SYSVOL'
+            } elseif ($_.SideIndicator -eq '=>') {
+                $Found = 'Orphaned GPO'
+            } else {
+                $Found = 'Orphaned GPO'
+            }
+            $Differences[$_.InputObject] = $Found
+        }
+    }
+    $GPOSummary = @(
+        foreach ($GPO in $GPOS) {
+            if ($null -ne $SysvolHash[$GPO.Id.GUID].FullName) {
+                $FullPath = $SysvolHash[$GPO.Id.GUID].FullName
+                try {
+                    $ACL = Get-Acl -Path $SysvolHash[$GPO.Id.GUID].FullName -ErrorAction Stop
+                    $Owner = $ACL.Owner
+                    $ErrorMessage = ''
+                } catch {
+                    Write-Warning "Get-GPOZaurrSysvol - ACL reading (1) failed for $FullPath with error: $($_.Exception.Message)"
+                    $ACL = $null
+                    $Owner = ''
+                    $ErrorMessage = $_.Exception.Message
+                }
+            } else {
+                $ACL = $null
+            }
+            if ($null -eq $Differences[$GPO.Id.Guid]) {
+                $SysVolStatus = 'Not available on SYSVOL'
+            } else {
+                $SysVolStatus = $Differences[$GPO.Id.Guid]
+            }
+            [PSCustomObject] @{
+                DisplayName      = $GPO.DisplayName
+                Status           = $Differences[$GPO.Id.Guid]
+                DomainName       = $GPO.DomainName
+                SysvolServer     = $Server
+                SysvolStatus     = $SysVolStatus
+                Owner            = $GPO.Owner
+                FileOwner        = $Owner
+                Id               = $GPO.Id.Guid
+                GpoStatus        = $GPO.GpoStatus
+                Path             = $FullPath
+                Description      = $GPO.Description
+                CreationTime     = $GPO.CreationTime
+                ModificationTime = $GPO.ModificationTime
+                UserVersion      = $GPO.UserVersion
+                ComputerVersion  = $GPO.ComputerVersion
+                WmiFilter        = $GPO.WmiFilter
+                Error            = $ErrorMessage
+            }
+        }
+        # Now we need to list thru Sysvol files and fine those that do not exists as GPO and create dummy GPO objects to show orphaned gpos
+        foreach ($_ in $Differences.Keys) {
+            if ($Differences[$_] -eq 'Orphaned GPO') {
+                if ($SysvolHash[$_].BaseName -notcontains 'PolicyDefinitions') {
+                    $FullPath = $SysvolHash[$_].FullName
+                    try {
+                        $ACL = Get-Acl -Path $FullPath -ErrorAction Stop
+                        $Owner = $ACL.Owner
+                        $ErrorMessage = ''
+                    } catch {
+                        Write-Warning "Get-GPOZaurrSysvol - ACL reading (2) failed for $FullPath with error: $($_.Exception.Message)"
+                        $ACL = $null
+                        $Owner = $null
+                        $ErrorMessage = $_.Exception.Message
+                    }
+
+                    [PSCustomObject] @{
+                        DisplayName      = $SysvolHash[$_].BaseName
+                        Status           = 'Orphaned GPO'
+                        DomainName       = $Domain
+                        SysvolServer     = $Server
+                        SysvolStatus     = $Differences[$GPO.Id.Guid]
+                        Owner            = ''
+                        FileOwner        = $Owner
+                        Id               = $_
+                        GpoStatus        = 'Orphaned'
+                        Path             = $FullPath
+                        Description      = $null
+                        CreationTime     = $SysvolHash[$_].CreationTime
+                        ModificationTime = $SysvolHash[$_].LastWriteTime
+                        UserVersion      = $null
+                        ComputerVersion  = $null
+                        WmiFilter        = $null
+                        Error            = $ErrorMessage
+                    }
+                }
+            }
+        }
+    )
+    $GPOSummary | Sort-Object -Property DisplayName
+}

Public/Add-GPOPermission.ps1

@@ -0,0 +1,41 @@
+function Add-GPOPermission {
+    [cmdletBinding()]
+    param(
+        [validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
+        [Microsoft.GroupPolicy.GPPermissionType] $IncludePermissionType,
+        [alias('Trustee')][Array] $Principal,
+        [alias('TrusteeType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+        [validateSet('Allow', 'Deny')][string] $PermitType = 'Allow'
+    )
+    if ($Type -eq 'Default') {
+        @{
+            Action                = 'Add'
+            Type                  = 'Default'
+            Principal             = $Principal
+            IncludePermissionType = $IncludePermissionType
+            PrincipalType         = $PrincipalType
+            PermitType            = $PermitType
+        }
+    } elseif ($Type -eq 'AuthenticatedUsers') {
+        @{
+            Action                = 'Add'
+            Type                  = 'AuthenticatedUsers'
+            IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
+        }
+    } elseif ($Type -eq 'Administrative') {
+        @{
+            Action                = 'Add'
+            Type                  = 'Administrative'
+            IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
+        }
+    } elseif ($Type -eq 'WellKnownAdministrative') {
+        @{
+            Action                = 'Add'
+            Type                  = 'WellKnownAdministrative'
+            IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
+        }
+    }
+}

Public/Add-GPOZaurrPermission.ps1

@@ -0,0 +1,213 @@
+function Add-GPOZaurrPermission {
+    [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'GPOGUID')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName', Mandatory)]
+        [string] $GPOName,
+
+        [Parameter(ParameterSetName = 'GPOGUID', Mandatory)]
+        [alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [Parameter(ParameterSetName = 'ADObject', Mandatory)]
+        [alias('OrganizationalUnit', 'DistinguishedName')][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
+
+        [validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
+
+        [alias('Trustee')][string] $Principal,
+        [alias('TrusteeType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+
+        [Parameter(Mandatory)][alias('IncludePermissionType')][Microsoft.GroupPolicy.GPPermissionType] $PermissionType,
+        [switch] $Inheritable,
+
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [System.Collections.IDictionary] $ADAdministrativeGroups,
+        [int] $LimitProcessing
+    )
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Extended
+    if (-not $ADAdministrativeGroups) {
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    }
+    if ($GPOName) {
+        $Splat = @{
+            GPOName = $GPOName
+        }
+    } elseif ($GPOGUID) {
+        $Splat = @{
+            GPOGUID = $GPOGUID
+        }
+    } else {
+        $Splat = @{}
+    }
+    $Splat['IncludeGPOObject'] = $true
+    $Splat['Forest'] = $Forest
+    $Splat['IncludeDomains'] = $IncludeDomains
+    if ($Type -ne 'Default') {
+        $Splat['Type'] = $Type
+    }
+    $Splat['PermitType'] = $PermitType
+    $Splat['Principal'] = $Principal
+    if ($PrincipalType) {
+        $Splat.PrincipalType = $PrincipalType
+    }
+    $Splat['ExcludeDomains'] = $ExcludeDomains
+    $Splat['ExtendedForestInformation'] = $ExtendedForestInformation
+    #$Splat['ExcludePermissionType'] = $ExcludePermissionType
+    $Splat['IncludePermissionType'] = $PermissionType
+    $Splat['SkipWellKnown'] = $SkipWellKnown.IsPresent
+    $Splat['SkipAdministrative'] = $SkipAdministrative.IsPresent
+
+    $AdministrativeExists = @{
+        DomainAdmins     = $false
+        EnterpriseAdmins = $false
+    }
+
+    # This should always return results. When no data is found it should return basic information that will allow us to add credentials.
+    [Array] $GPOPermissions = Get-GPOZaurrPermission @Splat -ReturnSecurityWhenNoData
+    # When it has GPOSecurityPermissionItem property it means it has permissions, if it doesn't it means we have clean object to process
+    if ($GPOPermissions.GPOSecurityPermissionItem) {
+        # Permission exists, but may be incomplete
+        foreach ($GPOPermission in $GPOPermissions) {
+            if ($Type -eq 'Default') {
+                # We were looking for specific principal and we got it. nothing to do
+                # this is for standard users such as przemyslaw.klys / adam.gonzales
+                return
+            } elseif ($Type -eq 'Administrative') {
+                # We are looking for administrative but we need to make sure we got correct administrative
+                if ($GPOPermission.Permission -eq $PermissionType) {
+                    $AdministrativeGroup = $ADAdministrativeGroups['BySID'][$GPOPermission.SID]
+                    if ($AdministrativeGroup.SID -like '*-519') {
+                        $AdministrativeExists['EnterpriseAdmins'] = $true
+                    } elseif ($AdministrativeGroup.SID -like '*-512') {
+                        $AdministrativeExists['DomainAdmins'] = $true
+                    }
+                    <#
+                    if ($AdministrativeGroup) {
+                        $DomainAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-512')
+                        $EnterpriseAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-519')
+                        if ($GPOPermission.SID -eq $DomainAdminsSID) {
+                            $AdministrativeExists['DomainAdmins'] = $true
+                        } elseif ($GPOPermission.SID -eq $EnterpriseAdminsSID) {
+                            $AdministrativeExists['EnterpriseAdmins'] = $true
+                        }
+                    }
+                    #>
+                }
+            } elseif ($Type -eq 'WellKnownAdministrative') {
+                # this is for SYSTEM account
+                return
+            } elseif ($Type -eq 'AuthenticatedUsers') {
+                # this is for Authenticated Users
+                return
+            }
+        }
+    }
+    if (-not $GPOPermissions) {
+        # This is bad - things went wrong
+        Write-Warning "Add-GPOZaurrPermission - Couldn't get permissions for GPO. Things aren't what they should be. Skipping!"
+    } else {
+        $GPO = $GPOPermissions[0]
+        if ($GPOPermissions.GPOSecurityPermissionItem) {
+            # We asked, we got response, now we need to check if maybe we're missing one of the two administrative groups
+            if ($Type -eq 'Administrative') {
+                # this is a case where something was returned. Be it Domain Admins or Enterprise Admins or both. But we still need to check because it may have been Domain Admins from other domain or just one of the two required groups
+                if ($AdministrativeExists['DomainAdmins'] -eq $false) {
+                    $Principal = $ADAdministrativeGroups[$GPO.DomainName]['DomainAdmins']
+                    Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                    if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                        try {
+                            $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                            $GPO.GPOSecurity.Add($AddPermission)
+                            $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                        } catch {
+                            Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                        }
+                    }
+                }
+                if ($AdministrativeExists['EnterpriseAdmins'] -eq $false) {
+                    $Principal = $ADAdministrativeGroups[$ForestInformation.Forest.RootDomain]['EnterpriseAdmins']
+                    Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                    if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                        try {
+                            $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                            $GPO.GPOSecurity.Add($AddPermission)
+                            $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                        } catch {
+                            Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                        }
+                    }
+                }
+            } elseif ($Type -eq 'Default') {
+                # This shouldn't really happen, as if we got response, and it didn't exists it wouldn't be here
+                Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType skipped for $($Principal). This shouldn't even happen!"
+            }
+        } else {
+            # We got no response. That means we either asked incorrectly or we need to fix permission. Trying to do so
+            if ($Type -eq 'Default') {
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal)"
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'Administrative') {
+                # this is a case where both Domain Admins/Enterprise Admins were missing
+                $Principal = $ADAdministrativeGroups[$GPO.DomainName]['DomainAdmins']
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+                $Principal = $ADAdministrativeGroups[$ForestInformation.Forest.RootDomain]['EnterpriseAdmins']
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'WellKnownAdministrative') {
+                $Principal = 'S-1-5-18'
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal (SYSTEM) / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) (SYSTEM) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'AuthenticatedUsers') {
+                $Principal = 'S-1-5-11'
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal (Authenticated Users) / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) (Authenticated Users) with error: $($_.Exception.Message)"
+                    }
+                }
+            }
+        }
+
+    }
+}

Public/Backup-GPOZaurr.ps1

@@ -2,7 +2,7 @@
     [cmdletBinding(SupportsShouldProcess)]
     param(
         [int] $LimitProcessing,
-        [validateset('All', 'Empty', 'Unlinked', 'EmptyAndUnlinked')][string] $Type = 'All',
+        [validateset('All', 'Empty', 'Unlinked')][string[]] $Type = 'All',
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
@@ -23,67 +23,49 @@
     }
     Process {
         Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOPath $GPOPath | ForEach-Object {
-            #$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-            #$GPOSummary = foreach ($GPO in $GPOs) {
-            #$QueryServer = $ForestInformation['QueryServers'][$_.Domain]['HostName'][0]
-            if ($Type -eq 'All') {
-                Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
+            if ($Type -contains 'All') {
+                Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName)"
                 $Count++
                 try {
-                    $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                    $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.DomainName -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
                     $BackupInfo
                 } catch {
-                    Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                    Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
                 }
                 if ($LimitProcessing -eq $Count) {
                     break
                 }
-            } elseif ($Type -eq 'Empty') {
+            }
+            if ($Type -notcontains 'All' -and $Type -contains 'Empty') {
                 if ($_.ComputerSettingsAvailable -eq $false -and $_.UserSettingsAvailable -eq $false) {
-                    Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
+                    Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName)"
                     $Count++
                     try {
-                        $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                        $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.DomainName -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
                         $BackupInfo
                     } catch {
-                        Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
-                    }
-                    if ($LimitProcessing -eq $Count) {
-                        break
-                    }
-                }
-            } elseif ($Type -eq 'EmptyAndUnlinked') {
-                if ($_.ComputerSettingsAvailable -eq $false -and $_.UserSettingsAvailable -eq $false -or $_.Linked -eq $false) {
-                    Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
-                    $Count++
-                    try {
-                        $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
-                        $BackupInfo
-                    } catch {
-                        Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
-                    }
-                    if ($LimitProcessing -eq $Count) {
-                        break
-                    }
-                }
-            } elseif ($Type -eq 'Unlinked') {
-                if ($_.Linked -eq $false) {
-                    Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
-                    $Count++
-                    try {
-                        $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
-                        $BackupInfo
-                    } catch {
-                        Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                        Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
+                    }
+                    if ($LimitProcessing -eq $Count) {
+                        break
+                    }
+                }
+            }
+            if ($Type -notcontains 'All' -and $Type -contains 'Unlinked') {
+                if ($_.Linked -eq $false) {
+                    Write-Verbose "Backup-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName)"
+                    $Count++
+                    try {
+                        $BackupInfo = Backup-GPO -Guid $_.GUID -Domain $_.DomainName -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                        $BackupInfo
+                    } catch {
+                        Write-Warning "Backup-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
                     }
                     if ($LimitProcessing -eq $Count) {
                         break
                     }
                 }
             }
-
-            #}
-            #$GPOSummary
         }
     }
     End {

Public/Get-GPOZaurr.ps1

@@ -1,13 +1,26 @@
 function Get-GPOZaurr {
     [cmdletBinding()]
     param(
+        [string] $GPOName,
+        [alias('GUID', 'GPOID')][string] $GPOGuid,
+
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
         [System.Collections.IDictionary] $ExtendedForestInformation,
-        [string[]] $GPOPath
+        [string[]] $GPOPath,
+
+        [switch] $PermissionsOnly,
+        [switch] $OwnerOnly,
+        [switch] $Limited,
+
+        [System.Collections.IDictionary] $ADAdministrativeGroups
     )
     Begin {
+        if (-not $ADAdministrativeGroups) {
+            Write-Verbose "Get-GPOZaurr - Getting ADAdministrativeGroups"
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
         if (-not $GPOPath) {
             $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         }
@@ -15,10 +28,52 @@
     Process {
         if (-not $GPOPath) {
             foreach ($Domain in $ForestInformation.Domains) {
-                Get-GPO -All -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain | ForEach-Object {
-                    Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
-                    $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
-                    Get-XMLGPO -XMLContent $XMLContent -GPO $_
+                $QueryServer = $ForestInformation.QueryServers[$Domain]['HostName'][0]
+                if ($GPOName) {
+                    Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
+                        Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
+                        if (-not $Limited) {
+                            try {
+                                $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
+                            } catch {
+                                Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
+                                continue
+                            }
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
+                        } else {
+                            $_
+                        }
+                    }
+                } elseif ($GPOGuid) {
+                    Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
+                        Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
+                        if (-not $Limited) {
+                            try {
+                                $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
+                            } catch {
+                                Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
+                                continue
+                            }
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
+                        } else {
+                            $_
+                        }
+                    }
+                } else {
+                    Get-GPO -All -Server $QueryServer -Domain $Domain -ErrorAction SilentlyContinue | ForEach-Object {
+                        Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
+                        if (-not $Limited) {
+                            try {
+                                $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
+                            } catch {
+                                Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
+                                continue
+                            }
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
+                        } else {
+                            $_
+                        }
+                    }
                 }
             }
         } else {
@@ -26,7 +81,7 @@
                 Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml | ForEach-Object {
                     $XMLContent = [XML]::new()
                     $XMLContent.Load($_.FullName)
-                    Get-XMLGPO -XMLContent $XMLContent
+                    Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent
                 }
             }
         }

Public/Get-GPOZaurrAD.ps1

@@ -0,0 +1,72 @@
+function Get-GPOZaurrAD {
+    [cmdletbinding(DefaultParameterSetName = 'Default')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')]
+        [string] $GPOName,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    }
+    Process {
+        foreach ($Domain in $ForestInformation.Domains) {
+            if ($PSCmdlet.ParameterSetName -eq 'GPOGUID') {
+                if ($GPOGuid) {
+                    if ($GPOGUID -notlike '*{*') {
+                        $GUID = -join ("{", $GPOGUID, '}')
+                    } else {
+                        $GUID = $GPOGUID
+                    }
+                    $Splat = @{
+                        Filter = "(objectClass -eq 'groupPolicyContainer') -and (Name -eq '$GUID')"
+                        Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                    }
+                } else {
+                    Write-Warning "Get-GPOZaurrAD - GPOGUID parameter is empty. Provide name and try again."
+                    continue
+                }
+            } elseif ($PSCmdlet.ParameterSetName -eq 'GPOName') {
+                if ($GPOName) {
+                    $Splat = @{
+                        Filter = "(objectClass -eq 'groupPolicyContainer') -and (DisplayName -eq '$GPOName')"
+                        Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                    }
+                } else {
+                    Write-Warning "Get-GPOZaurrAD - GPOName parameter is empty. Provide name and try again."
+                    continue
+                }
+            } else {
+                $Splat = @{
+                    Filter = "(objectClass -eq 'groupPolicyContainer')"
+                    Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                }
+            }
+            Get-ADObject @Splat -Properties DisplayName, Name, Created, Modified, gPCFileSysPath, gPCFunctionalityVersion, gPCWQLFilter, gPCMachineExtensionNames, Description, CanonicalName, DistinguishedName | ForEach-Object -Process {
+                $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDomainCN
+                $Output = [ordered]@{ }
+                $Output['DisplayName'] = $_.DisplayName
+                $Output['DomainName'] = $DomainCN
+                $Output['Description'] = $_.Description
+                $Output['GUID'] = $_.Name -replace '{' -replace '}'
+                $Output['Path'] = $_.gPCFileSysPath
+                $Output['FunctionalityVersion'] = $_.gPCFunctionalityVersion
+                $Output['Created'] = $_.Created
+                $Output['Modified'] = $_.Modified
+                $Output['GPOCanonicalName'] = $_.CanonicalName
+                $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDC
+                $Output['GPODistinguishedName'] = $_.DistinguishedName
+                [PSCustomObject] $Output
+            }
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrBackupInformation.ps1

@@ -11,15 +11,15 @@
             if ($Folder) {
                 if ((Test-Path -LiteralPath "$Folder\manifest.xml")) {
                     [xml] $Xml = Get-Content -LiteralPath "$Folder\manifest.xml"
-                    $Xml.Backups.BackupInst | ForEach-Object {
+                    $Xml.Backups.BackupInst | ForEach-Object -Process {
                         [PSCustomObject] @{
                             DisplayName      = $_.GPODisplayName.'#cdata-section'
-                            Domain           = $_.GPODomain.'#cdata-section'
-                            Guid             = $_.GPOGUid.'#cdata-section'
-                            DomainGuid       = $_.GPODomainGuid.'#cdata-section'
+                            DomainName       = $_.GPODomain.'#cdata-section'
+                            Guid             = $_.GPOGUid.'#cdata-section' -replace '{' -replace '}'
+                            DomainGuid       = $_.GPODomainGuid.'#cdata-section' -replace '{' -replace '}'
                             DomainController = $_.GPODomainController.'#cdata-section'
-                            BackupTime       = $_.BackupTime.'#cdata-section'
-                            ID               = $_.ID.'#cdata-section'
+                            BackupTime       = [DateTime]::Parse($_.BackupTime.'#cdata-section')
+                            ID               = $_.ID.'#cdata-section' -replace '{' -replace '}'
                             Comment          = $_.Comment.'#cdata-section'
                         }
                     }

Public/Get-GPOZaurrLegacyFiles.ps1

@@ -0,0 +1,16 @@
+function Get-GPOZaurrLegacyFiles {
+    [cmdletbinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies" -ErrorAction SilentlyContinue -Recurse -Include '*.adm' -ErrorVariable err | Select-Object Name, FullName, CreationTime, LastWriteTime, Attributes
+        foreach ($e in $err) {
+            Write-Warning "Get-GPOZaurrLegacy - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
+        }
+    }
+}

Public/Get-GPOZaurrLink.ps1

@@ -0,0 +1,163 @@
+function Get-GPOZaurrLink {
+    [cmdletbinding()]
+    param(
+        [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
+        # weirdly enough site doesn't really work this way unless you give it 'CN=Configuration,DC=ad,DC=evotec,DC=xyz' as SearchBase
+        [parameter(ParameterSetName = 'Filter')][string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')",
+        [parameter(ParameterSetName = 'Filter')][string] $SearchBase,
+        [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
+
+        [parameter(ParameterSetName = 'Linked', Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [switch] $Limited,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [System.Collections.IDictionary] $GPOCache,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [alias('ForestName')][string] $Forest,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [string[]] $ExcludeDomains,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        if (-not $GPOCache -and -not $Limited) {
+            $GPOCache = @{ }
+            # While initially we used $ForestInformation.Domains but the thing is GPOs can be linked to other domains so we need to get them all so we can use cache of it later on even if we're processing just one domain
+            # That's why we use $ForestInformation.Forest.Domains instead
+            foreach ($Domain in $ForestInformation.Forest.Domains) {
+                $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                Get-GPO -All -DomainName $Domain -Server $QueryServer | ForEach-Object {
+                    $GPOCache["$Domain$($_.ID.Guid)"] = $_
+                }
+            }
+        }
+    }
+    Process {
+        if (-not $ADObject) {
+            if ($Linked) {
+                foreach ($Domain in $ForestInformation.Domains) {
+                    $Splat = @{
+                        #Filter     = $Filter
+                        Properties = 'distinguishedName', 'gplink', 'CanonicalName'
+                        # Filter     = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')"
+                        Server     = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                    }
+                    if ($Linked -contains 'DomainControllers') {
+                        $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']
+                        #if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                        # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                        #    continue
+                        #}
+                        $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
+                        $Splat['SearchBase'] = $SearchBase
+                        Get-ADObject @Splat | ForEach-Object -Process {
+                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        }
+                    }
+                    if ($Linked -contains 'Root') {
+                        $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
+                        #if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                        # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                        #    continue
+                        # }
+                        $Splat['Filter'] = "objectClass -eq 'domainDNS'"
+                        $Splat['SearchBase'] = $SearchBase
+                        Get-ADObject @Splat | ForEach-Object -Process {
+                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        }
+                    }
+                    if ($Linked -contains 'Site') {
+                        # Sites are defined only in primary domain
+                        if ($ForestInformation['DomainsExtended'][$Domain]['DNSRoot'] -eq $ForestInformation['DomainsExtended'][$Domain]['Forest']) {
+                            $SearchBase = -join ("CN=Configuration,", $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'])
+                            # if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                            # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                            #continue
+                            #}
+                            $Splat['Filter'] = "(objectClass -eq 'site')"
+                            $Splat['SearchBase'] = $SearchBase
+                            Get-ADObject @Splat | ForEach-Object -Process {
+                                Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            }
+                        }
+                    }
+                    if ($Linked -contains 'Other') {
+                        $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
+                        #if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                        # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                        #    continue
+                        #}
+                        $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
+                        $Splat['SearchBase'] = $SearchBase
+                        Get-ADObject @Splat | ForEach-Object -Process {
+                            if ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) {
+                                # other skips Domain Root
+                            } elseif ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']) {
+                                # other skips Domain Controllers
+                            } else {
+                                Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            }
+                        }
+                    }
+                }
+            } else {
+                foreach ($Domain in $ForestInformation.Domains) {
+                    $Splat = @{
+                        Filter     = $Filter
+                        Properties = 'distinguishedName', 'gplink', 'CanonicalName'
+                        Server     = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+
+                    }
+                    if ($PSBoundParameters.ContainsKey('SearchBase')) {
+                        $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
+                        if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                            # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                            continue
+                        }
+                        $Splat['SearchBase'] = $SearchBase
+
+                    }
+                    if ($PSBoundParameters.ContainsKey('SearchScope')) {
+                        $Splat['SearchScope'] = $SearchScope
+                    }
+
+                    try {
+                        Get-ADObject @Splat | ForEach-Object {
+                            Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        }
+                    } catch {
+                        Write-Warning "Get-GPOZaurrLink - Processing error $($_.Exception.Message)"
+                    }
+                }
+            }
+        } else {
+            foreach ($Object in $ADObject) {
+                Get-PrivGPOZaurrLink -Object $Object -Limited:$Limited.IsPresent -GPOCache $GPOCache
+            }
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrLinkSummary.ps1

@@ -0,0 +1,159 @@
+function Get-GPOZaurrLinkSummary {
+    [cmdletBinding()]
+    param(
+        [ValidateSet('All', 'MultipleLinks', 'OneLink', 'LinksSummary')][string[]] $Report = 'All',
+        [switch] $UnlimitedProperties
+    )
+    $HighestCount = 0 # to keep number of depth
+    $CacheSummaryLinks = [ordered] @{} # cache
+
+    # Get all links
+    $Links = Get-GPOZaurrLink
+    foreach ($Link in $Links) {
+        if (-not $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"]) {
+            $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"] = [System.Collections.Generic.List[System.Object]]::new()
+        }
+        $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"].Add($Link)
+    }
+
+    $ReturnObject = [ordered] @{
+        MultipleLinks = [System.Collections.Generic.List[System.Object]]::new()
+        OneLink       = [System.Collections.Generic.List[System.Object]]::new()
+        LinksSummary  = [System.Collections.Generic.List[System.Object]]::new()
+    }
+
+    foreach ($Key in $CacheSummaryLinks.Keys) {
+        $GPOs = $CacheSummaryLinks[$Key]
+
+        [Array] $LinkingSummary = foreach ($GPO in $GPOs) {
+            $SplitttedOU = ($GPO.DistinguishedName -split ',')
+            [Array] $Clean = foreach ($_ in $SplitttedOU) {
+                if ($_ -notlike 'DC=*') { $_ -replace 'OU=' }
+            }
+            if ($Clean.Count -gt $HighestCount) {
+                $HighestCount = $Clean.Count
+            }
+            if ($Clean) {
+                $Test = [ordered] @{
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = ConvertFrom-DistinguishedName -DistinguishedName $GPO.DistinguishedName -ToDomainCN
+                }
+                for ($i = 1; $i -le 10; $i++) {
+                    $Test["Level$i"] = $Clean[ - $i]
+                }
+                [PSCustomobject] $Test
+            } else {
+                $Test = [ordered] @{
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = $GPO.CanonicalName
+                }
+                for ($i = 1; $i -le 10; $i++) {
+                    $Test["Level$i"] = $null
+                }
+                [PSCustomobject] $Test
+            }
+        }
+        if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') {
+            foreach ($Link in $LinkingSummary) {
+                $ReturnObject.MultipleLinks.Add($Link)
+            }
+            #continue
+        }
+        if ($Report -eq 'OneLink' -or $Report -contains 'All') {
+            $List = [ordered] @{
+                DisplayName = $GPOs[0].DisplayName
+                Guid        = $GPOs[0].Guid
+                DomainName  = $GPOs[0].DomainName
+                LinksCount  = $GPOs.Count
+            }
+            for ($i = 0; $i -le 10; $i++) {
+                $List["Level$i"] = ($LinkingSummary."Level$i" | Select-Object -Unique).Count
+                $List["Level$($i)List"] = ($LinkingSummary."Level$i" | Select-Object -Unique)
+            }
+            $List.LinksDistinguishedName = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
+            $List.LinksCanonicalName = $GPOs.CanonicalName
+
+            $List.Owner = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
+            $List.GpoStatus = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
+            $List.Description = $GPOs[0].Description                #:
+            $List.CreationTime = $GPOs[0].CreationTime               #: 16.12.2019 21:25:32
+            $List.ModificationTime = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
+            $List.GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
+            $List.GPODistinguishedName = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
+
+            $ReturnObject.OneLink.Add( [PSCustomObject] $List)
+        }
+        if ($Report -eq 'LinksSummary' -or $Report -contains 'All') {
+            $Output = [PSCustomObject] @{
+                DisplayName                = $GPOs[0].DisplayName                #: COMPUTERS | LAPS
+                Guid                       = $GPOs[0].Guid                       #: AA782787 - 002B-4B8C-886F-05873F2DC0CA
+                DomainName                 = $GPOs[0].DomainName                 #: ad.evotec.xyz
+                LinksCount                 = $GPOs.Count
+                LinksDistinguishedName     = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
+                LinksCanonicalName         = $GPOs.CanonicalName              #: ad.evotec.xyz / ITR02 / Computers
+                Owner                      = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
+                GpoStatus                  = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
+                Description                = $GPOs[0].Description                #:
+                CreationTime               = $GPOs[0].CreationTime               #: 16.12.2019 21:25:32
+                ModificationTime           = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
+                GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
+                GPODistinguishedName       = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
+            }
+            $ReturnObject.LinksSummary.Add($Output)
+        }
+    }
+    # Processing output
+    if (-not $UnlimitedProperties) {
+        if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') {
+            $Properties = @(
+                'DisplayName'
+                'DomainName'
+                'GUID'
+                for ($i = 0; $i -le $HighestCount; $i++) {
+                    "Level$i"
+                }
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
+            )
+            $ReturnObject.MultipleLinks = $ReturnObject.MultipleLinks | Select-Object -Property $Properties
+        }
+        if ($Report -contains 'OneLink' -or $Report -contains 'All') {
+            $Properties = @(
+                'DisplayName'
+                'DomainName'
+                'GUID'
+                for ($i = 0; $i -le $HighestCount; $i++) {
+                    "Level$i"
+                    "Level$($i)List"
+                }
+                'LinksDistinguishedName'
+                'LinksCanonicalName'
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
+            )
+            $ReturnObject.OneLink = $ReturnObject.OneLink | Select-Object -Property $Properties
+        }
+        #if ($Report -contains 'LinksSummary' -or $Report -contains 'All') {
+        # Not needed because there's no dynamic properties, but if there would be we need to uncomment and fix it
+        #}
+    }
+    if ($Report.Count -eq 1 -and $Report -notcontains 'All') {
+        $ReturnObject["$Report"]
+    } else {
+        $ReturnObject
+    }
+}

Public/Get-GPOZaurrOwner.ps1

@@ -0,0 +1,60 @@
+function Get-GPOZaurrOwner {
+    [cmdletbinding(DefaultParameterSetName = 'Default')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [switch] $IncludeSysvol,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [System.Collections.IDictionary] $ADAdministrativeGroups
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        if (-not $ADAdministrativeGroups) {
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
+    }
+    Process {
+        $getGPOZaurrADSplat = @{
+            Forest                    = $Forest
+            IncludeDomains            = $IncludeDomains
+            ExcludeDomains            = $ExcludeDomains
+            ExtendedForestInformation = $ForestInformation
+        }
+        if ($GPOName) {
+            $getGPOZaurrADSplat['GPOName'] = $GPOName
+        } elseif ($GPOGuid) {
+            $getGPOZaurrADSplat['GPOGUID'] = $GPOGuid
+        }
+        $Objects = Get-GPOZaurrAD @getGPOZaurrADSplat
+        foreach ($_ in $Objects) {
+            Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)"
+            $ACL = Get-ADACLOwner -ADObject $_.GPODistinguishedName -Resolve -ADAdministrativeGroups $ADAdministrativeGroups
+            $Object = [ordered] @{
+                DisplayName = $_.DisplayName
+                DomainName  = $_.DomainName
+                GUID        = $_.GUID
+                Owner       = $ACL.OwnerName
+                OwnerSid    = $ACL.OwnerSid
+                OwnerType   = $ACL.OwnerType
+            }
+            if ($IncludeSysvol) {
+                $FileOwner = Get-FileOwner -JustPath -Path $_.Path -Resolve
+                $Object['SysvolOwner'] = $FileOwner.OwnerName
+                $Object['SysvolSid'] = $FileOwner.OwnerSid
+                $Object['SysvolType'] = $FileOwner.OwnerType
+                $Object['SysvolPath'] = $_.Path
+                $Object['IsOwnerConsistent'] = if ($ACL.OwnerName -eq $FileOwner.OwnerName) { $true } else { $false }
+            }
+            $Object['DistinguishedName'] = $_.GPODistinguishedName
+            [PSCUstomObject] $Object
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrPassword.ps1

@@ -14,7 +14,7 @@
             $ForestInformation = $ExtendedForestInformation
         }
 
-        $GPOPath = foreach ($Domain in $ForestInformation.Domains) {
+        [Array] $GPOPath = foreach ($Domain in $ForestInformation.Domains) {
             -join ('\\', $Domain, '\SYSVOL\', $Domain, '\Policies')
         }
     }

Public/Get-GPOZaurrPermission.ps1

@@ -0,0 +1,136 @@
+function Get-GPOZaurrPermission {
+    [cmdletBinding(DefaultParameterSetName = 'GPO' )]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')]
+        [string] $GPOName,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
+        [validateSet('AuthenticatedUsers', 'DomainComputers', 'Unknown', 'WellKnownAdministrative', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All',
+
+        [switch] $SkipWellKnown,
+        [switch] $SkipAdministrative,
+        [switch] $ResolveAccounts,
+
+        [switch] $IncludeOwner,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid',
+
+        [switch] $IncludeGPOObject,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [System.Collections.IDictionary] $ADAdministrativeGroups,
+        [switch] $ReturnSecurityWhenNoData # if no data return all data
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Extended
+        if (-not $ADAdministrativeGroups) {
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
+        if ($Type -eq 'Unknown') {
+            if ($SkipAdministrative -or $SkipWellKnown) {
+                Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
+            }
+        }
+        if ($ResolveAccounts) {
+            $Accounts = @{ }
+            foreach ($Domain in $ForestInformation.Domains) {
+                $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                $DomainInformation = Get-ADDomain -Server $QueryServer
+                $Users = Get-ADUser -Filter * -Server $QueryServer -Properties PasswordLastSet, LastLogonDate, UserPrincipalName
+                foreach ($User in $Users) {
+                    $U = -join ($DomainInformation.NetBIOSName, '\', $User.SamAccountName)
+                    $Accounts[$U] = $User
+                }
+                $Groups = Get-ADGroup -Filter * -Server $QueryServer
+                foreach ($Group in $Groups) {
+                    $G = -join ($DomainInformation.NetBIOSName, '\', $Group.SamAccountName)
+                    $Accounts[$G] = $Group
+                }
+            }
+        }
+    }
+    Process {
+        foreach ($Domain in $ForestInformation.Domains) {
+            $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+            if ($GPOName) {
+                $getGPOSplat = @{
+                    Name        = $GPOName
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } elseif ($GPOGuid) {
+                $getGPOSplat = @{
+                    Guid        = $GPOGuid
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } else {
+                $getGPOSplat = @{
+                    All         = $true
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            }
+            Get-GPO @getGPOSplat | ForEach-Object -Process {
+                $GPOSecurity = $_.GetSecurityInfo()
+                $getPrivPermissionSplat = @{
+                    Principal                 = $Principal
+                    PrincipalType             = $PrincipalType
+                    PermitType                = $PermitType
+                    Accounts                  = $Accounts
+                    Type                      = $Type
+                    GPO                       = $_
+                    SkipWellKnown             = $SkipWellKnown.IsPresent
+                    SkipAdministrative        = $SkipAdministrative.IsPresent
+                    IncludeOwner              = $IncludeOwner.IsPresent
+                    IncludeGPOObject          = $IncludeGPOObject.IsPresent
+                    IncludePermissionType     = $IncludePermissionType
+                    ExcludePermissionType     = $ExcludePermissionType
+                    ExcludePrincipal          = $ExcludePrincipal
+                    ExcludePrincipalType      = $ExcludePrincipalType
+                    ADAdministrativeGroups    = $ADAdministrativeGroups
+                    ExtendedForestInformation = $ForestInformation
+                    SecurityRights            = $GPOSecurity
+                }
+                $Output = Get-PrivPermission @getPrivPermissionSplat
+                if (-not $Output) {
+                    if ($ReturnSecurityWhenNoData) {
+                        # there is no data to return, but we need to have GPO information to process ADD permissions.
+                        $ReturnObject = [PSCustomObject] @{
+                            DisplayName      = $_.DisplayName #      : ALL | Enable RDP
+                            GUID             = $_.ID
+                            DomainName       = $_.DomainName  #      : ad.evotec.xyz
+                            Enabled          = $_.GpoStatus
+                            Description      = $_.Description
+                            CreationDate     = $_.CreationTime
+                            ModificationTime = $_.ModificationTime
+                            GPOObject        = $_
+                            GPOSecurity      = $GPOSecurity
+                        }
+                        $ReturnObject
+                    }
+                } else {
+                    $Output
+                }
+            }
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrPermissionConsistency.ps1

@@ -0,0 +1,122 @@
+function Get-GPOZaurrPermissionConsistency {
+    [cmdletBinding(DefaultParameterSetName = 'Type')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+        [Parameter(ParameterSetName = 'Type')][validateSet('Consistent', 'Inconsistent', 'All')][string[]] $Type = 'All',
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [switch] $IncludeGPOObject,
+        [switch] $VerifyInheritance
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    }
+    Process {
+        foreach ($Domain in $ForestInformation.Domains) {
+            $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+            if ($GPOName) {
+                $getGPOSplat = @{
+                    Name        = $GPOName
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } elseif ($GPOGuid) {
+                $getGPOSplat = @{
+                    Guid        = $GPOGuid
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } else {
+                $getGPOSplat = @{
+                    All         = $true
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            }
+            Get-GPO @getGPOSplat | ForEach-Object -Process {
+                try {
+                    $IsConsistent = $_.IsAclConsistent()
+                    $ErrorMessage = ''
+                } catch {
+                    $ErrorMessage = $_.Exception.Message
+                    Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
+                    $IsConsistent = 'Not available.'
+                }
+                $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
+                if ($VerifyInheritance) {
+                    $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath
+                    [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) {
+                        if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) {
+                            $File
+                        }
+                    }
+                    if ($NotInheritedPermissions.Count -eq 0) {
+                        $ACLConsistentInside = $true
+                    } else {
+                        $ACLConsistentInside = $false
+                    }
+                } else {
+                    $ACLConsistentInside = $null
+                }
+                $Object = [ordered] @{
+                    DisplayName   = $_.DisplayName     # : New Group Policy Object
+                    DomainName    = $_.DomainName      # : ad.evotec.xyz
+                    ACLConsistent = $IsConsistent
+                }
+                if ($VerifyInheritance) {
+                    $Object['ACLConsistentInside'] = $ACLConsistentInside
+                }
+                $Object['Owner'] = $_.Owner           # : EVOTEC\Enterprise Admins
+                $Object['Path'] = $_.Path
+                $Object['SysVolPath '] = $SysvolPath
+                $Object['Id       '] = $_.Id              # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
+                $Object['GpoStatus'] = $_.GpoStatus       # : AllSettingsEnabled
+                $Object['Description'] = $_.Description     # :
+                $Object['CreationTime'] = $_.CreationTime    # : 04.03.2020 17:19:42
+                $Object['ModificationTime'] = $_.ModificationTime# : 06.05.2020 10:30:36
+                $Object['UserVersion'] = $_.UserVersion     # : AD Version: 0, SysVol Version: 0
+                $Object['ComputerVersion'] = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
+                $Object['WmiFilter'] = $_.WmiFilter       # :
+                $Object['Error'] = $ErrorMessage
+                if ($IncludeGPOObject) {
+                    $Object['IncludeGPOObject'] = $_
+                }
+                if ($VerifyInheritance) {
+                    $Object['ACLConsistentInsideDetails'] = $NotInheritedPermissions
+                }
+                if ($Type -eq 'All') {
+                    [PSCustomObject] $Object
+                } elseif ($Type -eq 'Inconsistent') {
+                    if ($VerifyInheritance) {
+                        if (-not $IsConsistent -or -not $ACLConsistentInside) {
+                            [PSCustomObject] $Object
+                        }
+                    } else {
+                        if (-not $IsConsistent) {
+                            [PSCustomObject] $Object
+                        }
+                    }
+                } elseif ($Type -eq 'Consistent') {
+                    if ($VerifyInheritance) {
+                        if ($IsConsistent -and $ACLConsistentInside) {
+                            [PSCustomObject] $Object
+                        }
+                    } else {
+                        if ($IsConsistent) {
+                            [PSCustomObject] $Object
+                        }
+                    }
+                }
+            }
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrPermissions.ps1

@@ -1,83 +0,0 @@
-function Get-GPOZaurrPermissions {
-    [cmdletBinding()]
-    param(
-        [switch] $SkipWellKnownGroup,
-        [alias('ForestName')][string] $Forest,
-        [string[]] $ExcludeDomains,
-        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
-        [System.Collections.IDictionary] $ExtendedForestInformation
-    )
-    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-    foreach ($Domain in $ForestInformation.Domains) {
-        $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
-        Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
-            $GPO = $_
-
-            <#
-            DisplayName      : ALL | Enable RDP
-            DomainName       : ad.evotec.xyz
-            Owner            : EVOTEC\Domain Admins
-            Id               : 051bcddf-cc11-427b-bdf0-684c0a6e3ddb
-            GpoStatus        : AllSettingsEnabled
-            Description      :
-            CreationTime     : 07.08.2018 12:47:44
-            ModificationTime : 07.04.2020 22:09:24
-            UserVersion      : AD Version: 1, SysVol Version: 1
-            ComputerVersion  : AD Version: 1, SysVol Version: 1
-            WmiFilter        :
-            #>
-            Get-GPPermissions -Guid $GPO.ID -DomainName $GPO.DomainName -All -Server $QueryServer | ForEach-Object -Process {
-                $GPOPermission = $_
-                #$GPOPermissionFormatted = ConvertTo-TableFormat -InputObject $_
-                [PSCustomObject] @{
-                    DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
-                    GUID              = $GPO.ID
-                    DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
-                    Enabled           = $GPO.GpoStatus
-                    Description       = $GPO.Description
-                    CreationDate      = $GPO.CreationTime
-                    ModificationTime  = $GPO.ModificationTime
-                    #Owner             = $GPO.Owner       #      : EVOTEC\Domain Admins
-                    #Trustee     = $GPOPermission.Trustee     # : Domain Admins
-                    #TrusteeType       = $GPOPermissionFormatted.TrusteeType # # : Group
-                    Permission        = $GPOPermission.Permission  # : GpoEditDeleteModifySecurity
-                    Inherited         = $GPOPermission.Inherited   # : False
-                    Domain            = $GPOPermission.Trustee.Domain  #: EVOTEC
-                    DistinguishedName = $GPOPermission.Trustee.DSPath  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
-                    Name              = $GPOPermission.Trustee.Name    #: Domain Admins
-                    Sid               = $GPOPermission.Trustee.Sid     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
-                    SidType           = $GPOPermission.Trustee.SidType #: Group
-                }
-            }
-
-            if ($GPO.Owner) {
-                $SplittedOwner = $GPO.Owner.Split('\')
-                $DomainOwner = $SplittedOwner[0]  #: EVOTEC
-                $DomainUserName = $SplittedOwner[1]   #: Domain Admins
-            } else {
-                $DomainOwner = $GPO.Owner
-                $DomainUserName = ''
-            }
-            [PSCustomObject] @{
-                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
-                GUID              = $GPO.GUID
-                DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
-                #Owner             = $GPO.Owner       #      : EVOTEC\Domain Admins
-                #Trustee     = $GPOPermission.Trustee     # : Domain Admins
-                #TrusteeType       = $GPOPermissionFormatted.TrusteeType # # : Group
-                Enabled           = $GPO.GpoStatus
-                Description       = $GPO.Description
-                CreationDate      = $GPO.CreationTime
-                ModificationTime  = $GPO.ModificationTime
-
-                Permission        = 'Owner'  # : GpoEditDeleteModifySecurity
-                Inherited         = $false  # : False
-                Domain            = $DomainOwner
-                DistinguishedName = ''  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
-                Name              = $DomainUserName
-                Sid               = ''     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
-                SidType           = '' #: Group
-            }
-        }
-    }
-}

Public/Get-GPOZaurrSysvol.ps1

@@ -0,0 +1,37 @@
+function Get-GPOZaurrSysvol {
+    [cmdletBinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [string[]] $ExcludeDomainControllers,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [alias('DomainControllers')][string[]] $IncludeDomainControllers,
+        [switch] $SkipRODC,
+        [Array] $GPOs,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [switch] $VerifyDomainControllers
+    )
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExcludeDomainControllers $ExcludeDomainControllers -IncludeDomainControllers $IncludeDomainControllers -SkipRODC:$SkipRODC -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        Write-Verbose "Get-WinADGPOSysvolFolders - Processing $Domain"
+        $QueryServer = $ForestInformation['QueryServers']["$Domain"].HostName[0]
+        Try {
+            [Array]$GPOs = Get-GPO -All -Domain $Domain -Server $QueryServer
+        } catch {
+            Write-Warning "Get-GPOZaurrSysvol - Couldn't get GPOs from $Domain. Error: $($_.Exception.Message)"
+            continue
+        }
+        if ($GPOs.Count -ge 2) {
+            if (-not $VerifyDomainControllers) {
+                Test-SysVolFolders -GPOs $GPOs -Server $Domain -Domain $Domain
+            } else {
+                foreach ($Server in $ForestInformation['DomainDomainControllers']["$Domain"]) {
+                    Write-Verbose "Get-GPOZaurrSysvol - Processing $Domain \ $($Server.HostName.Trim())"
+                    Test-SysVolFolders -GPOs $GPOs -Server $Server.Hostname -Domain $Domain
+                }
+            }
+        } else {
+            Write-Warning "Get-GPOZaurrSysvol - GPO count for $Domain is less then 2. This is not expected for fully functioning domain. Skipping processing SYSVOL folder."
+        }
+    }
+}

Public/Get-GPOZaurrWmi.ps1

@@ -1,4 +1,11 @@
-function Get-GPOZaurrWMI {
+function Get-WMIFilter {
+    param(
+
+    )
+
+}
+
+function Get-GPOZaurrWMI {
     [cmdletBinding()]
     Param(
         [Guid[]] $Guid,
@@ -13,79 +20,63 @@
     $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
     foreach ($Domain in $ForestInformation.Domains) {
         $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
-        if ($Guid -or $Name) {
-            foreach ($N in $Name) {
-                try {
-                    $ldapFilter = "(&(objectClass=msWMI-Som)(msWMI-Name=$N))"
-                    Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
-                        $WMI = $_.'msWMI-Parm2' -split ';'
-                        [PSCustomObject] @{
-                            Name              = $_.'msWMI-Name'
-                            Description       = $_.'msWMI-Parm1'
-                            Domain            = $Domain
-                            NameSpace         = $WMI[5]
-                            Query             = $WMI[6]
-                            Author            = $_.'msWMI-Author'
-                            ID                = $_.'msWMI-ID'
-                            Created           = $_.Created
-                            Modified          = $_.Modified
-                            ObjectGUID        = $_.'ObjectGUID'
-                            CanonicalName     = $_.CanonicalName
-                            DistinguishedName = $_.'DistinguishedName'
-                        }
+        $Objects = @(
+            if ($Name) {
+                foreach ($N in $Name) {
+                    try {
+                        $ldapFilter = "(&(objectClass=msWMI-Som)(msWMI-Name=$N))"
+                        Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer
+                    } catch {
+                        Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
                     }
+                }
+            } elseif ($GUID) {
+                foreach ($G in $GUID) {
+                    try {
+                        $ldapFilter = "(&(objectClass=msWMI-Som)(Name={$G}))"
+                        Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer
+                    } catch {
+                        Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
+                    }
+                }
+            } else {
+                try {
+                    $ldapFilter = "(objectClass=msWMI-Som)"
+                    Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer
                 } catch {
                     Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
                 }
             }
-            foreach ($G in $GUID) {
-                $ldapFilter = "(&(objectClass=msWMI-Som)(Name={$G}))"
-                try {
-                    Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
-                        $WMI = $_.'msWMI-Parm2' -split ';'
-                        [PSCustomObject] @{
-                            Name              = $_.'msWMI-Name'
-                            Description       = $_.'msWMI-Parm1'
-                            Domain            = $Domain
-                            NameSpace         = $WMI[5]
-                            Query             = $WMI[6]
-                            Author            = $_.'msWMI-Author'
-                            ID                = $_.'msWMI-ID'
-                            Created           = $_.Created
-                            Modified          = $_.Modified
-                            ObjectGUID        = $_.'ObjectGUID'
-                            CanonicalName     = $_.CanonicalName
-                            DistinguishedName = $_.'DistinguishedName'
-                        }
-                    }
-                } catch {
-                    Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
+        )
+        foreach ($_ in $Objects) {
+            $WMI = $_.'msWMI-Parm2' -split ';' #$WMI = $_.'msWMI-Parm2'.Split(';',8)
+            [Array] $Data = for ($i = 0; $i -lt $WMI.length; $i += 6) {
+                if ($WMI[$i + 5]) {
+                    #[PSCustomObject] @{
+                    #    NameSpace = $WMI[$i + 5]
+                    #    Query     = $WMI[$i + 6]
+                    #}
+                    -join ($WMI[$i + 5], ';' , $WMI[$i + 6])
                 }
             }
-        } else {
-            $ldapFilter = "(objectClass=msWMI-Som)"
-            try {
-                Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
-                    $WMI = $_.'msWMI-Parm2' -split ';'
-                    [PSCustomObject] @{
-                        Name              = $_.'msWMI-Name'
-                        Description       = $_.'msWMI-Parm1'
-                        Domain            = $Domain
-                        NameSpace         = $WMI[5]
-                        Query             = $WMI[6]
-                        Author            = $_.'msWMI-Author'
-                        ID                = $_.'msWMI-ID'
-                        Created           = $_.Created
-                        Modified          = $_.Modified
-                        ObjectGUID        = $_.'ObjectGUID'
-                        CanonicalName     = $_.CanonicalName
-                        DistinguishedName = $_.'DistinguishedName'
-                    }
-                }
-            } catch {
-                Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
+            [PSCustomObject] @{
+                DisplayName       = $_.'msWMI-Name'
+                Description       = $_.'msWMI-Parm1'
+                DomainName        = $Domain
+                #NameSpace         = $WMI[$i + 5]
+                #Query             = $WMI[$i + 6]
+                QueryCount        = $Data.Count
+                Query             = $Data -join ","
+                Author            = $_.'msWMI-Author'
+                ID                = $_.'msWMI-ID'
+                Created           = $_.Created
+                Modified          = $_.Modified
+                ObjectGUID        = $_.'ObjectGUID'
+                CanonicalName     = $_.CanonicalName
+                DistinguishedName = $_.'DistinguishedName'
             }
         }
+
     }
 }
 <#

Public/Invoke-GPOZaurrPermission.ps1

@@ -0,0 +1,270 @@
+function Invoke-GPOZaurrPermission {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [parameter(Position = 0)]
+        [scriptblock] $PermissionRules,
+
+        # ParameterSet1
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+
+        # ParameterSet2
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        # ParameterSet3
+        [parameter(ParameterSetName = 'Level', Mandatory)][int] $Level,
+        [parameter(ParameterSetName = 'Level', Mandatory)][int] $Limit,
+
+        # ParameterSet4
+        [parameter(ParameterSetName = 'Linked', Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
+
+        # ParameterSet5
+        [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
+
+        # ParameterSet6
+        [parameter(ParameterSetName = 'Filter')][string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')",
+        [parameter(ParameterSetName = 'Filter')][string] $SearchBase,
+        [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
+
+        # All other paramerrs are for for all parametersets
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'All')][string[]] $Type,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [Array] $ApprovedGroups,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [alias('Principal')][Array] $Trustee,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [Microsoft.GroupPolicy.GPPermissionType] $TrusteePermissionType,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName',
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [System.Collections.IDictionary] $GPOCache,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [alias('ForestName')][string] $Forest,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [string[]] $ExcludeDomains,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [switch] $LimitAdministrativeGroupsToDomain
+    )
+    if ($PermissionRules) {
+        $Rules = & $PermissionRules
+    } else {
+        Write-Warning "Invoke-GPOZaurrPermission - No rules defined. Stopping processing."
+        return
+    }
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    if ($LimitAdministrativeGroupsToDomain) {
+        # This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
+    } else {
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
+    }
+    if ($PSCmdlet.ParameterSetName -ne 'Level') {
+        $Splat = @{
+            Forest                    = $Forest
+            IncludeDomains            = $IncludeDomains
+            ExcludeDomains            = $ExcludeDomains
+            ExtendedForestInformation = $ForestInformation
+        }
+        if ($ADObject) {
+            $Splat['ADObject'] = $ADObject
+        } elseif ($Linked) {
+            $Splat['Linked'] = $Linked
+        } elseif ($GPOName) {
+
+        } elseif ($GPOGuid) {
+
+        } else {
+            if ($Filter) {
+                $Splat['Filter'] = $Filter
+            }
+            if ($SearchBase) {
+                $Splat['SearchBase'] = $SearchBase
+            }
+            if ($SearchScope) {
+                $Splat['SearchScope'] = $SearchScope
+            }
+        }
+
+
+
+        Get-GPOZaurrLink @Splat | ForEach-Object -Process {
+            $GPO = $_
+            foreach ($Rule in $Rules) {
+                if ($Rule.Action -eq 'Owner') {
+                    if ($Rule.Type -eq 'Administrative') {
+                        # We check for Owner (sometimes it can be empty)
+                        if ($GPO.Owner) {
+                            $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                        } else {
+                            $AdministrativeGroup = $null
+                        }
+                        if (-not $AdministrativeGroup) {
+                            $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+                            Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
+                            #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                            Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
+                        }
+                    } elseif ($Rule.Type -eq 'Default') {
+                        Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
+                        #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
+                        Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
+                    }
+                } elseif ($Rule.Action -eq 'Remove') {
+                    $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType -ADAdministrativeGroups $ADAdministrativeGroups
+                    foreach ($Permission in $GPOPermissions) {
+                        Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
+                    }
+                } elseif ($Rule.Action -eq 'Add') {
+                    # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
+                    $SplatPermissions = @{
+                        #Forest                    = $Forest
+                        IncludeDomains         = $GPO.DomainName
+                        #ExcludeDomains            = $ExcludeDomains
+                        #ExtendedForestInformation = $ForestInformation
+
+                        GPOGuid                = $GPO.GUID
+                        IncludePermissionType  = $Rule.IncludePermissionType
+                        Type                   = $Rule.Type
+                        PermitType             = $Rule.PermitType
+                        Principal              = $Rule.Principal
+                        ADAdministrativeGroups = $ADAdministrativeGroups
+                    }
+                    if ($Rule.PrincipalType) {
+                        $SplatPermissions.PrincipalType = $Rule.PrincipalType
+                    }
+                    Add-GPOZaurrPermission @SplatPermissions
+                }
+            }
+        }
+    } else {
+        # This is special case based on different command
+        $Report = Get-GPOZaurrLinkSummary -Report OneLink
+        $AffectedGPOs = foreach ($GPO in $Report) {
+            $Property = "Level$($Level)"
+            if ($GPO."$Property" -gt $Limit) {
+                foreach ($Rule in $Rules) {
+                    if ($Rule.Action -eq 'Owner') {
+                        if ($Rule.Type -eq 'Administrative') {
+                            # We check for Owner (sometimes it can be empty)
+                            if ($GPO.Owner) {
+                                $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                            } else {
+                                $AdministrativeGroup = $null
+                            }
+                            if (-not $AdministrativeGroup) {
+                                $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+                                Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
+                                #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                                Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
+                            }
+                        } elseif ($Rule.Type -eq 'Default') {
+                            Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
+                            #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
+                            Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
+                        }
+                    } elseif ($Rule.Action -eq 'Remove') {
+                        $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType -ADAdministrativeGroups $ADAdministrativeGroups
+                        foreach ($Permission in $GPOPermissions) {
+                            Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
+                        }
+                    } elseif ($Rule.Action -eq 'Add') {
+                        # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
+                        $SplatPermissions = @{
+                            #Forest                    = $Forest
+                            IncludeDomains         = $GPO.DomainName
+                            #ExcludeDomains            = $ExcludeDomains
+                            #ExtendedForestInformation = $ForestInformation
+
+                            GPOGuid                = $GPO.GUID
+                            IncludePermissionType  = $Rule.IncludePermissionType
+                            Type                   = $Rule.Type
+                            PermitType             = $Rule.PermitType
+                            Principal              = $Rule.Principal
+                            ADAdministrativeGroups = $ADAdministrativeGroups
+                        }
+                        if ($Rule.PrincipalType) {
+                            $SplatPermissions.PrincipalType = $Rule.PrincipalType
+                        }
+                        Add-GPOZaurrPermission @SplatPermissions
+                    }
+                }
+            }
+        }
+        $AffectedGPOs
+    }
+}

Public/New-GPOZaurrWMi.ps1

@@ -3,6 +3,7 @@
     param(
         [parameter(Mandatory)][string] $Name,
         [string] $Description = ' ',
+        [string] $Namespace = 'root\CIMv2',
         [parameter(Mandatory)][string] $Query,
         [switch] $SkipQueryCheck,
         [switch] $Force,
@@ -50,7 +51,7 @@
 
         [Array] $ExistingWmiFilter = Get-GPOZaurrWMI -ExtendedForestInformation $ForestInformation -IncludeDomains $Domain -Name $Name
         if ($ExistingWmiFilter.Count -eq 0) {
-            [string] $WMIParm2 = -join ("1;3;10;", $Query.Length.ToString(), ";WQL;root\CIMv2;", $Query , ";")
+            [string] $WMIParm2 = -join ("1;3;10;", $Query.Length.ToString(), ";WQL;$Namespace;", $Query , ";")
             $OtherAttributes = @{
                 "msWMI-Name"             = $Name
                 "msWMI-Parm1"            = $Description
@@ -67,14 +68,14 @@
 
             try {
                 Write-Verbose "New-GPOZaurrWMI - Creating WMI filter $Name in $Domain"
-                New-ADObject -name $GUID -type "msWMI-Som" -Path $WMIPath -OtherAttributes $OtherAttributes -Server $QueryServer
+                New-ADObject -Name $GUID -Type "msWMI-Som" -Path $WMIPath -OtherAttributes $OtherAttributes -Server $QueryServer
             } catch {
                 Write-Warning "New-GPOZaurrWMI - Creating GPO filter error $($_.Exception.Message). Terminating."
                 return
             }
         } else {
             foreach ($_ in $ExistingWmiFilter) {
-                Write-Warning "New-GPOZaurrWMI - Skipping creation of GPO because name: $($_.Name) guid: $($_.ID) for $($_.Domain) already exists."
+                Write-Warning "New-GPOZaurrWMI - Skipping creation of GPO because name: $($_.DisplayName) guid: $($_.ID) for $($_.DomainName) already exists."
             }
         }
     }

Public/Remove-GPOPermission.ps1

@@ -0,0 +1,29 @@
+function Remove-GPOPermission {
+    [cmdletBinding()]
+    param(
+        [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'Administrative', 'NotAdministrative', 'All')][string[]] $Type,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'Allow',
+
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid'
+    )
+
+    if ($Type) {
+        @{
+            Action                = 'Remove'
+            Type                  = $Type
+            IncludePermissionType = $IncludePermissionType
+            ExcludePermissionType = $ExcludePermissionType
+            PermitType            = $PermitType
+            Principal             = $Principal
+            PrincipalType         = $PrincipalType
+            ExcludePrincipal      = $ExcludePrincipal
+            ExcludePrincipalType  = $ExcludePrincipalType
+        }
+    }
+}

Public/Remove-GPOZaurr.ps1

@@ -1,7 +1,7 @@
 function Remove-GPOZaurr {
     [cmdletBinding(SupportsShouldProcess)]
     param(
-        [parameter(Mandatory)][validateset('Empty', 'Unlinked', 'EmptyAndUnlinked')][string] $Type,
+        [parameter(Mandatory)][validateset('Empty', 'Unlinked')][string[]] $Type,
         [int] $LimitProcessing,
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
@@ -28,77 +28,52 @@
     }
     Process {
         Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOPath $GPOPath | ForEach-Object {
-            #$ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-
-            #$GPOSummary = foreach ($GPO in $GPOs) {
-            #$QueryServer = $ForestInformation['QueryServers'][$_.Domain]['HostName'][0]
-            if ($Type -eq 'Empty') {
+            if ($Type -contains 'Empty') {
                 if ($_.ComputerSettingsAvailable -eq $false -and $_.UserSettingsAvailable -eq $false) {
                     if ($BackupRequired) {
                         try {
-                            Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
-                            $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                            Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName)"
+                            $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.DomainName -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
                             $BackupInfo
+                            $BackupOK = $true
                         } catch {
-                            Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
-
+                            Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
+                            $BackupOK = $false
                         }
                     }
-                    if (($BackupRequired -and $BackupInfo) -or (-not $BackupRequired)) {
+                    if (($BackupRequired -and $BackupOK) -or (-not $BackupRequired)) {
                         try {
-                            Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain)"
-                            Remove-GPO -Domain $_.Domain -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
+                            Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.DisplayName) from $($_.DomainName)"
+                            Remove-GPO -Domain $_.DomainName -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
                         } catch {
-                            Write-Warning "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
-                        }
-                    }
-                    $Count++
-                    if ($LimitProcessing -eq $Count) {
-                        break
-                    }
-                }
-            } elseif ($Type -eq 'EmptyAndUnlinked') {
-                if ($_.ComputerSettingsAvailable -eq $false -and $_.UserSettingsAvailable -eq $false -or $_.Linked -eq $false) {
-
-                    if ($BackupRequired) {
-                        try {
-                            Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
-                            $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
-                            $BackupInfo
-                        } catch {
-                            Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
-                        }
-                    }
-                    if (($BackupRequired -and $BackupInfo) -or (-not $BackupRequired)) {
-                        try {
-                            Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain)"
-                            Remove-GPO -Domain $_.Domain -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
-                        } catch {
-                            Write-Warning "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
-                        }
-                    }
-                    $Count++
-                    if ($LimitProcessing -eq $Count) {
-                        break
-                    }
-                }
-            } elseif ($Type -eq 'Unlinked') {
-                if ($_.Linked -eq $false) {
-                    if ($BackupRequired) {
-                        try {
-                            Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain)"
-                            $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.Domain -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
-                            $BackupInfo
-                        } catch {
-                            Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
-                        }
-                    }
-                    if (($BackupRequired -and $BackupInfo) -or (-not $BackupRequired)) {
-                        try {
-                            Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain)"
-                            Remove-GPO -Domain $_.Domain -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
-                        } catch {
-                            Write-Warning "Remove-GPOZaurr - Removing GPO $($_.Name) from $($_.Domain) failed: $($_.Exception.Message)"
+                            Write-Warning "Remove-GPOZaurr - Removing GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
+                        }
+                    }
+                    $Count++
+                    if ($LimitProcessing -eq $Count) {
+                        break
+                    }
+                }
+            }
+            if ($Type -contains 'Unlinked') {
+                if ($_.Linked -eq $false) {
+                    if ($BackupRequired) {
+                        try {
+                            Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName)"
+                            $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.DomainName -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
+                            $BackupInfo
+                            $BackupOK = $true
+                        } catch {
+                            Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
+                            $BackupOK = $false
+                        }
+                    }
+                    if (($BackupRequired -and $BackupOK) -or (-not $BackupRequired)) {
+                        try {
+                            Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.DisplayName) from $($_.DomainName)"
+                            Remove-GPO -Domain $_.DomainName -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
+                        } catch {
+                            Write-Warning "Remove-GPOZaurr - Removing GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
                         }
                     }
                     $Count++
@@ -107,8 +82,6 @@
                     }
                 }
             }
-            #}
-            #$GPOSummary
         }
     }
     End {

Public/Remove-GPOZaurrLegacyFiles.ps1

@@ -0,0 +1,25 @@
+function Remove-GPOZaurrLegacyFiles {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+
+        [int] $LimitProcessing = [int32]::MaxValue
+    )
+    $Splat = @{
+        Forest                    = $Forest
+        IncludeDomains            = $IncludeDomains
+        ExcludeDomains            = $ExcludeDomains
+        ExtendedForestInformation = $ExtendedForestInformation
+        Verbose                   = $VerbosePreference
+    }
+    Get-GPOZaurrLegacyFiles @Splat | Select-Object -First $LimitProcessing | ForEach-Object {
+        try {
+            Remove-Item -Path $_.FullName -ErrorAction Stop
+        } catch {
+            $ErrorMessage = $_.Exception.Message
+            Write-Warning "Remove-GPOZaurrLegacyFiles - Failed to remove file $($_.FullName): $($ErrorMessage)."
+        }
+    }
+}

Public/Remove-GPOZaurrOrphanedSysvolFolders.ps1

@@ -0,0 +1,13 @@
+function Remove-GPOZaurrOrphanedSysvolFolders {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [int] $LimitProcessing = [int32]::MaxValue
+    )
+    Get-GPOZaurrSysvol | Where-Object {
+        if ($_.Status -eq 'Orphaned GPO') {
+            $_
+        }
+    } | Select-Object | Select-Object -First $LimitProcessing | ForEach-Object {
+        Remove-Item -Recurse -Force -LiteralPath $_.Path
+    }
+}

Public/Remove-GPOZaurrPermission.ps1

@@ -0,0 +1,143 @@
+function Remove-GPOZaurrPermission {
+    [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Global')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName', Mandatory)]
+        [string] $GPOName,
+
+        [Parameter(ParameterSetName = 'GPOGUID', Mandatory)]
+        [alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
+        [validateset('Unknown', 'NotAdministrative', 'Default')][string[]] $Type = 'Default',
+
+        [alias('PermissionType')][Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [switch] $SkipWellKnown,
+        [switch] $SkipAdministrative,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [int] $LimitProcessing
+    )
+    Begin {
+        $Count = 0
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
+        if ($Type -eq 'Unknown') {
+            if ($SkipAdministrative -or $SkipWellKnown) {
+                Write-Warning "Remove-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
+            }
+        }
+    }
+    Process {
+        if ($Type -contains 'Named' -and $Principal.Count -eq 0) {
+            Write-Warning "Remove-GPOZaurrPermission - When using type Named you need to provide names to remove. Terminating."
+            return
+        }
+        # $GPOPermission.GPOSecurity.RemoveTrustee($GPOPermission.Sid)
+        #void RemoveTrustee(string trustee)
+        #void RemoveTrustee(System.Security.Principal.IdentityReference identity)
+        #$GPOPermission.GPOSecurity.Remove
+        #void RemoveAt(int index)
+        #void IList[GPPermission].RemoveAt(int index)
+        #void IList.RemoveAt(int index)
+
+        foreach ($Domain in $ForestInformation.Domains) {
+            $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+            if ($GPOName) {
+                $getGPOSplat = @{
+                    Name        = $GPOName
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } elseif ($GPOGuid) {
+                $getGPOSplat = @{
+                    Guid        = $GPOGuid
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } else {
+                $getGPOSplat = @{
+                    All         = $true
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            }
+            Get-GPO @getGPOSplat | ForEach-Object -Process {
+                $getPrivPermissionSplat = @{
+                    Principal              = $Principal
+                    PrincipalType          = $PrincipalType
+                    Accounts               = $Accounts
+                    Type                   = $Type
+                    GPO                    = $_
+                    SkipWellKnown          = $SkipWellKnown.IsPresent
+                    SkipAdministrative     = $SkipAdministrative.IsPresent
+                    IncludeOwner           = $false
+                    IncludeGPOObject       = $true
+                    IncludePermissionType  = $IncludePermissionType
+                    ExcludePermissionType  = $ExcludePermissionType
+                    ADAdministrativeGroups = $ADAdministrativeGroups
+                }
+                [Array] $GPOPermissions = Get-PrivPermission @getPrivPermissionSplat
+                if ($GPOPermissions.Count -gt 0) {
+                    foreach ($Permission in $GPOPermissions) {
+                        Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission #-IncludeDomains $GPO.DomainName
+                    }
+                    $Count++
+                    if ($Count -eq $LimitProcessing) {
+                        # skipping skips per removed permission not per gpo.
+                        break
+                    }
+                }
+            }
+        }
+        <#
+        Get-GPOZaurrPermission @Splat | ForEach-Object -Process {
+            $GPOPermission = $_
+            if ($Type -contains 'Unknown') {
+                if ($GPOPermission.SidType -eq 'Unknown') {
+                    #Write-Verbose "Remove-GPOZaurrPermission - Removing $($GPOPermission.Sid) from $($GPOPermission.DisplayName) at $($GPOPermission.DomainName)"
+                    if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, "Removing $($GPOPermission.Sid) from $($GPOPermission.DisplayName) at $($GPOPermission.DomainName)")) {
+                        try {
+                            Write-Verbose "Remove-GPOZaurrPermission - Removing permission $($GPOPermission.Permission) for $($GPOPermission.Sid)"
+                            $GPOPermission.GPOSecurity.RemoveTrustee($GPOPermission.Sid)
+                            $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                            #$GPOPermission.GPOSecurity.RemoveAt($GPOPermission.GPOSecurityPermissionItem)
+                            #$GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                        } catch {
+                            Write-Warning "Remove-GPOZaurrPermission - Removing permission $($GPOPermission.Permission) for $($GPOPermission.Sid) with error: $($_.Exception.Message)"
+                        }
+                        # Set-GPPPermission doesn't work on Unknown Accounts
+                    }
+                    $Count++
+                    if ($Count -eq $LimitProcessing) {
+                        # skipping skips per removed permission not per gpo.
+                        break
+                    }
+                }
+            }
+            if ($Type -contains 'Named') {
+
+            }
+            if ($Type -contains 'NotAdministrative') {
+
+            }
+            if ($Type -contains 'Default') {
+                Remove-PrivPermission -Principal $Principal -PrincipalType $PrincipalType -GPOPermission $GPOPermission -IncludePermissionType $IncludePermissionType
+            }
+            #Set-GPPermission -PermissionLevel None -TargetName $GPOPermission.Sid -Verbose -DomainName $GPOPermission.DomainName -Guid $GPOPermission.GUID #-WhatIf
+            #Set-GPPermission -PermissionLevel GpoRead -TargetName 'Authenticated Users' -TargetType Group -Verbose -DomainName $Domain -Guid $_.GUID -WhatIf
+
+        }
+        #>
+    }
+    End {}
+}

Public/Repair-GPOZaurrPermissionConsistency.ps1

@@ -0,0 +1,44 @@
+function Repair-GPOZaurrPermissionConsistency {
+    [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Default')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [int] $LimitProcessing = [int32]::MaxValue
+    )
+    $ConsistencySplat = @{
+        Forest                    = $Forest
+        IncludeDomains            = $IncludeDomains
+        ExcludeDomains            = $ExcludeDomains
+        ExtendedForestInformation = $ExtendedForestInformation
+        Verbose                   = $VerbosePreference
+    }
+    if ($GPOName) {
+        $ConsistencySplat['GPOName'] = $GPOName
+    } elseif ($GPOGuid) {
+        $ConsistencySplat['GPOGuid'] = $GPOGUiD
+    } else {
+        $ConsistencySplat['Type'] = 'Inconsistent'
+    }
+
+    Get-GPOZaurrPermissionConsistency @ConsistencySplat -IncludeGPOObject | Where-Object {
+        if ($_.ACLConsistent -eq $false) {
+            $_
+        }
+    } | Select-Object -First $LimitProcessing | ForEach-Object {
+        #Write-Verbose "Repair-GPOZaurrPermissionConsistency - Repairing GPO consistency $($_.DisplayName) from domain: $($_.DomainName)"
+        if ($PSCmdlet.ShouldProcess($_.DisplayName, "Reparing GPO permissions consistency in domain $($_.DomainName)")) {
+            try {
+                $_.IncludeGPOObject.MakeAclConsistent()
+            } catch {
+                $ErrorMessage = $_.Exception.Message
+                Write-Warning "Repair-GPOZaurrPermissionConsistency - Failed to set consistency: $($ErrorMessage)."
+            }
+        }
+    }
+}

Public/Restore-GPOZaurr.ps1

@@ -13,7 +13,7 @@
                 if (-not $SkipBackupSummary) {
                     $BackupSummary = Get-GPOZaurrBackupInformation -BackupFolder $BackupFolder
                     if ($Domain) {
-                        [Array] $FoundGPO = $BackupSummary | Where-Object { $_.DisplayName -eq $DisplayName -and $_.Domain -eq $Domain }
+                        [Array] $FoundGPO = $BackupSummary | Where-Object { $_.DisplayName -eq $DisplayName -and $_.DomainName -eq $Domain }
                     } else {
                         [Array] $FoundGPO = $BackupSummary | Where-Object { $_.DisplayName -eq $DisplayName }
                     }
@@ -21,11 +21,11 @@
                         if ($NewDisplayName) {
                             Import-GPO -Path $BackupFolder -BackupID $GPO.ID -Domain $GPO.Domain -TargetName $NewDisplayName -CreateIfNeeded
                         } else {
-                            Write-Verbose "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.Domain) / BackupId: $($GPO.ID)"
+                            Write-Verbose "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.DomainName) / BackupId: $($GPO.ID)"
                             try {
-                                Restore-GPO -Path $BackupFolder -BackupID $GPO.ID -Domain $GPO.Domain
+                                Restore-GPO -Path $BackupFolder -BackupID $GPO.ID -Domain $GPO.DomainName
                             } catch {
-                                Write-Warning "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.Domain) failed: $($_.Exception.Message)"
+                                Write-Warning "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.DomainName) failed: $($_.Exception.Message)"
                             }
                         }
                     }
@@ -49,11 +49,11 @@
             } else {
                 $BackupSummary = Get-GPOZaurrBackupInformation -BackupFolder $BackupFolder
                 foreach ($GPO in $BackupSummary) {
-                    Write-Verbose "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.Domain) / BackupId: $($GPO.ID)"
+                    Write-Verbose "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.DomainName) / BackupId: $($GPO.ID)"
                     try {
-                        Restore-GPO -Path $BackupFolder -Domain $GPO.Domain -BackupId $GPO.ID
+                        Restore-GPO -Path $BackupFolder -Domain $GPO.DomainName -BackupId $GPO.ID
                     } catch {
-                        Write-Warning "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.Domain) failed: $($_.Exception.Message)"
+                        Write-Warning "Restore-GPOZaurr - Restoring GPO $($GPO.DisplayName) from $($GPO.DomainName) failed: $($_.Exception.Message)"
                     }
                 }
             }

Public/Set-GPOOwner.ps1

@@ -0,0 +1,22 @@
+function Set-GPOOwner {
+    [cmdletBinding()]
+    param(
+        [validateset('Administrative', 'Default')][string] $Type = 'Default',
+        [string] $Principal
+    )
+    if ($Type -eq 'Default') {
+        if ($Principal) {
+            @{
+                Action    = 'Owner'
+                Type      = 'Default'
+                Principal = $Principal
+            }
+        }
+    } elseif ($Type -eq 'Administrative') {
+        @{
+            Action    = 'Owner'
+            Type      = 'Administrative'
+            Principal = ''
+        }
+    }
+}

Public/Set-GPOZaurrOwner.ps1

@@ -0,0 +1,183 @@
+function Set-GPOZaurrOwner {
+    <#
+    .SYNOPSIS
+    Short description
+
+    .DESCRIPTION
+    Long description
+
+    .PARAMETER Type
+    Unknown - finds unknown Owners and sets them to Administrative (Domain Admins) or chosen principal
+    NotMatching - find administrative groups only and if sysvol and gpo doesn't match - replace with chosen principal or Domain Admins if not specified
+    NotAdministrative - combination of Unknown/NotMatching and NotAdministrative - replace with chosen principal or Domain Admins if not specified
+    All - if Owner is known it checks if it's Administrative, if it sn't it fixes that. If owner is unknown it fixes it
+    .PARAMETER GPOName
+    Parameter description
+
+    .PARAMETER GPOGuid
+    Parameter description
+
+    .PARAMETER Forest
+    Parameter description
+
+    .PARAMETER ExcludeDomains
+    Parameter description
+
+    .PARAMETER IncludeDomains
+    Parameter description
+
+    .PARAMETER ExtendedForestInformation
+    Parameter description
+
+    .PARAMETER Principal
+    Parameter description
+
+    .PARAMETER SkipSysvol
+    Parameter description
+
+    .PARAMETER LimitProcessing
+    Parameter description
+
+    .EXAMPLE
+    An example
+
+    .NOTES
+    General notes
+    #>
+    [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Type')]
+    param(
+        [Parameter(ParameterSetName = 'Type', Mandatory)]
+        [validateset('Unknown', 'NotAdministrative', 'NotMatching', 'All')][string] $Type,
+
+        [Parameter(ParameterSetName = 'Named')][string] $GPOName,
+        [Parameter(ParameterSetName = 'Named')][alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
+        [alias('ForestName')][string] $Forest,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
+        [string[]] $ExcludeDomains,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
+        [string] $Principal,
+
+        [switch] $SkipSysvol,
+
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
+        [int] $LimitProcessing = [int32]::MaxValue
+    )
+    Begin {
+        #Write-Verbose "Set-GPOZaurrOwner - Getting ADAdministrativeGroups"
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        #Write-Verbose "Set-GPOZaurrOwner - Processing GPO for Type $Type"
+    }
+    Process {
+        $getGPOZaurrOwnerSplat = @{
+            IncludeSysvol             = -not $SkipSysvol.IsPresent
+            Forest                    = $Forest
+            IncludeDomains            = $IncludeDomains
+            ExcludeDomains            = $ExcludeDomains
+            ExtendedForestInformation = $ExtendedForestInformation
+            ADAdministrativeGroups    = $ADAdministrativeGroups
+            Verbose                   = $VerbosePreference
+        }
+        if ($GPOName) {
+            $getGPOZaurrOwnerSplat['GPOName'] = $GPOName
+        } elseif ($GPOGuid) {
+            $getGPOZaurrOwnerSplat['GPOGuid'] = $GPOGUiD
+        }
+        Get-GPOZaurrOwner @getGPOZaurrOwnerSplat | Where-Object {
+            if ($_.Owner) {
+                $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
+            } else {
+                $AdministrativeGroup = $null
+            }
+            if (-not $SkipSysvol) {
+                if ($_.SysvolOwner) {
+                    $AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"]
+                } else {
+                    $AdministrativeGroupSysvol = $null
+                }
+            }
+            if ($Type -eq 'NotAdministrative') {
+                if (-not $AdministrativeGroup -or (-not $AdministrativeGroupSysvol -and -not $SkipSysvol)) {
+                    $_
+                } else {
+                    if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
+                        Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
+                        $_
+                    }
+                }
+            } elseif ($Type -eq 'Unknown') {
+                if (-not $_.Owner -or (-not $_.SysvolOwner -and -not $SkipSysvol)) {
+                    $_
+                }
+            } elseif ($Type -eq 'NotMatching') {
+                if ($SkipSysvol) {
+                    Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). SysVol scanning is disabled. Skipping."
+                } else {
+                    if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
+                        #Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
+                        $_
+                    }
+                }
+            } else {
+                # we run with no type, that means we need to either set it to principal or to Administrative
+                if ($_.Owner) {
+                    # we check if Principal is not set
+                    $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
+                    if (-not $SkipSysvol -and $_.SysvolOwner) {
+                        $AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"]
+                        if (-not $AdministrativeGroup -or -not $AdministrativeGroupSysvol) {
+                            $_
+                        }
+                    } else {
+                        if (-not $AdministrativeGroup) {
+                            $_
+                        }
+                    }
+                } else {
+                    $_
+                }
+            }
+        } | Select-Object -First $LimitProcessing | ForEach-Object -Process {
+            $GPO = $_
+            if (-not $Principal) {
+                $DefaultPrincipal = $ADAdministrativeGroups["$($_.DomainName)"]['DomainAdmins']
+            } else {
+                $DefaultPrincipal = $Principal
+            }
+            if ($Action -eq 'OnlyGPO') {
+                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) (SID: $($GPO.OwnerSID)) to $DefaultPrincipal"
+                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal  -Verbose:$false -WhatIf:$WhatIfPreference
+            } elseif ($Action -eq 'OnlyFileSystem') {
+                if (-not $SkipSysvol) {
+                    Write-Verbose "Set-GPOZaurrOwner - Changing Sysvol Owner GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.SysvolOwner) (SID: $($GPO.SysvolSid)) to $DefaultPrincipal"
+                    Set-FileOwner -JustPath -Path $GPO.SysvolPath -Owner $DefaultPrincipal  -Verbose:$true -WhatIf:$WhatIfPreference
+                }
+            } else {
+                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) (SID: $($GPO.OwnerSID)) to $DefaultPrincipal"
+                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal  -Verbose:$false -WhatIf:$WhatIfPreference
+                if (-not $SkipSysvol) {
+                    Write-Verbose "Set-GPOZaurrOwner - Changing Sysvol Owner GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.SysvolOwner) (SID: $($GPO.SysvolSid)) to $DefaultPrincipal"
+                    Set-FileOwner -JustPath -Path $GPO.SysvolPath -Owner $DefaultPrincipal -Verbose:$true -WhatIf:$WhatIfPreference
+                }
+            }
+        }
+    }
+    End {
+
+    }
+}

README.md

@@ -39,5 +39,13 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
-- 0.0.1 - Unreleased
+- 0.0.39 - 17.06.2020
+  - Updates to `Invoke-GPOZaurrPermission` with new parameter `LimitAdministrativeGroupsToDomain`
+    - This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)
+- 0.0.38 - 17.06.2020
+  - Update to Get-PrivGPOZaurrLink which would cause problems to `Invoke-GPOZaurrPermission` if it would be run without Administrative permission and GPO wouldn't be accessible for that user
+- 0.0.37 - 16.06.2020
+  - Updates to `Invoke-GPOZaurrPermission` with new parameterset `Level`
+  - Updates to `Get-GPOZaurrLinkSummary`
+- 0.0.36 - 15.06.2020
   - Initial release