Update

GPOZaurr.psd1

@@ -8,7 +8,7 @@
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
     FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.92'
+    ModuleVersion        = '0.0.93'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{

Private/Get-XMLGPO.ps1

@@ -7,7 +7,8 @@
         [switch] $OwnerOnly,
         [System.Collections.IDictionary] $ADAdministrativeGroups,
         [string] $Splitter = [System.Environment]::NewLine,
-        [switch] $ReturnObject
+        [switch] $ReturnObject,
+        [System.Collections.IDictionary] $ExcludeGroupPolicies
     )
     if ($XMLContent.GPO.LinksTo) {
         $LinkSplit = ([Array] $XMLContent.GPO.LinksTo).Where( { $_.Enabled -eq $true }, 'Split')
@@ -159,6 +160,14 @@
             $OwnerType = 'Unable to asses (local files?)'
         }
     }
+    # Mark GPO as excluded
+    $Exclude = $false
+    if ($ExcludeGroupPolicies) {
+        $PolicyWithDomain = -join ($XMLContent.GPO.Identifier.Domain.'#text', $XMLContent.GPO.Name)
+        if ($ExcludeGroupPolicies[$XMLContent.GPO.Name] -or $ExcludeGroupPolicies[$PolicyWithDomain]) {
+            $Exclude = $true
+        }
+    }
     if ($PermissionsOnly) {
         [PsCustomObject] @{
             'DisplayName'          = $XMLContent.GPO.Name
@@ -211,6 +220,7 @@
             'Enabled'                           = $EnabledBool
             'Optimized'                         = $Optimized
             'Problem'                           = $Problem
+            'Exclude'                           = $Exclude
             'ComputerPolicies'                  = $XMLContent.GPO.Computer.ExtensionData.Name -join ", "
             'UserPolicies'                      = $XMLContent.GPO.User.ExtensionData.Name -join ", "
             'LinksCount'                        = $LinksTotalCount

Private/Invoke.GPOZaurrList.ps1

@@ -154,8 +154,8 @@
         ) -FontSize 10pt -FontWeight normal, bold, normal, bold, normal, bold, normal, normal, normal, normal
 
         New-HTMLText -LineBreak
-        <#
-        New-HTMLText -Text "Additionally, we're reviewing Group Policies that have their section disabled, but contain data. Please review them and make sure this configuration is as expected!" -FontSize 10pt
+
+        New-HTMLText -Text "Additionally, we're reviewing Group Policies that have their section disabled, but contain data." -FontSize 10pt
         New-HTMLList -Type Unordered {
             New-HTMLListItem -Text 'Group Policies with problems: ', $Script:Reporting['GPOList']['Variables']['GPOWithProblems'] -FontWeight normal, bold {
                 New-HTMLList -Type Unordered {
@@ -164,7 +164,15 @@
                 }
             }
         } -FontSize 10pt
-        New-HTMLText -Text "For best performance it's recommended that if there are no settings of certain kind (Computer or User settings) it's best to disable them. " -FontSize 10pt
+        New-HTMLText -Text @(
+            "Such policies require manual review from whoever owns them. "
+            "It could be a mistake tha section was disabled while containing data or that content is no longer needed in which case it should be deleted. "
+            "This can't be auto-handled and is INFORMATIONAL only. "
+        ) -FontSize 10pt
+
+        New-HTMLText -LineBreak
+
+        New-HTMLText -Text "Moreover, for best performance it's recommended that if there are no settings of certain kind (Computer or User settings) it's best to disable whole section. " -FontSize 10pt
         New-HTMLList -Type Unordered {
             New-HTMLListItem -Text 'Group Policies with optimization: ' -FontWeight normal, bold {
                 New-HTMLList -Type Unordered {
@@ -179,7 +187,11 @@
                 }
             }
         } -FontSize 10pt
-        #>
+        New-HTMLText -Text @(
+            "This means "
+            $Script:Reporting['GPOList']['Variables']['GPONotOptimized']
+            " could be optimized for performance reasons. "
+        ) -FontSize 10pt -FontWeight normal, bold, normal
     }
     Solution   = {
         New-HTMLSection -Invisible {
@@ -195,9 +207,9 @@
                     New-ChartBar -Name 'Enabled' -Value $Script:Reporting['GPOList']['Variables']['GPOEnabled'], $Script:Reporting['GPOList']['Variables']['GPODisabled']
                     New-ChartBar -Name 'Valid' -Value $Script:Reporting['GPOList']['Variables']['GPOValid'], $Script:Reporting['GPOList']['Variables']['GPONotValid']
                     New-ChartBar -Name 'Optimized (for speed)' -Value $Script:Reporting['GPOList']['Variables']['GPOOptimized'], $Script:Reporting['GPOList']['Variables']['GPONotOptimized']
-                    New-ChartBar -Name 'With problem' -Value $Script:Reporting['GPOList']['Variables']['GPOProblem'], $Script:Reporting['GPOList']['Variables']['GPONoProblem']
-                    New-ChartBar -Name 'With problem (computers)' -Value $Script:Reporting['GPOList']['Variables']['ComputerProblemNo'], $Script:Reporting['GPOList']['Variables']['ComputerProblemYes']
-                    New-ChartBar -Name 'With problem (users)' -Value $Script:Reporting['GPOList']['Variables']['UserProblemNo'], $Script:Reporting['GPOList']['Variables']['UserProblemYes']
+                    New-ChartBar -Name 'No problem' -Value $Script:Reporting['GPOList']['Variables']['GPONoProblem'], $Script:Reporting['GPOList']['Variables']['GPOProblem']
+                    New-ChartBar -Name 'No problem (computers)' -Value $Script:Reporting['GPOList']['Variables']['ComputerProblemNo'], $Script:Reporting['GPOList']['Variables']['ComputerProblemYes']
+                    New-ChartBar -Name 'No problem (users)' -Value $Script:Reporting['GPOList']['Variables']['UserProblemNo'], $Script:Reporting['GPOList']['Variables']['UserProblemYes']
                     New-ChartBar -Name 'Optimized Computers' -Value $Script:Reporting['GPOList']['Variables']['ComputerOptimizedYes'], $Script:Reporting['GPOList']['Variables']['ComputerOptimizedNo']
                     New-ChartBar -Name 'Optimized Users' -Value $Script:Reporting['GPOList']['Variables']['UserOptimizedYes'], $Script:Reporting['GPOList']['Variables']['UserOptimizedNo']
                 } -TitleAlignment center

Public/Get-GPOZaurr.ps1

@@ -10,6 +10,8 @@
         [System.Collections.IDictionary] $ExtendedForestInformation,
         [string[]] $GPOPath,
 
+        [Array] $ExcludeGroupPolicies,
+
         [switch] $PermissionsOnly,
         [switch] $OwnerOnly,
         [switch] $Limited,
@@ -24,6 +26,22 @@
         if (-not $GPOPath) {
             $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         }
+        $ExcludeGPO = [ordered] @{}
+        if ($ExcludeGroupPolicies) {
+            foreach ($GroupPolicy in $ExcludeGroupPolicies) {
+                if ($GroupPolicy -is [string]) {
+                    $ExcludeGPO[$GroupPolicy] = $true
+                } elseif ($GroupPolicy -is [System.Collections.IDictionary] -and $GroupPolicy.Name -and $GroupPolicy.DomainName) {
+                    $PolicyName = -join ($GroupPolicy.DomainName, $GroupPolicy.Name)
+                    $ExcludeGPO[$PolicyName] = $true
+                } elseif ($GroupPolicy -is [System.Collections.IDictionary] -and $GroupPolicy.Name) {
+                    $ExcludeGPO[$GroupPolicy.Name] = $true
+                } else {
+                    Write-Warning "Get-GPOZaurr - Exclusion takes only Group Policy Name as string, or as hashtable with domain name @{ Name = 'Group Policy Name'; DomainName = 'Domain' }."
+                    continue
+                }
+            }
+        }
     }
     Process {
         if (-not $GPOPath) {
@@ -43,7 +61,7 @@
                                 Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
                                 continue
                             }
-                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups -ReturnObject:$ReturnObject.IsPresent
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups -ReturnObject:$ReturnObject.IsPresent -ExcludeGroupPolicies $ExcludeGPO
                         } else {
                             $_
                         }
@@ -61,7 +79,7 @@
                                 Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
                                 continue
                             }
-                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups -ReturnObject:$ReturnObject.IsPresent
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups -ReturnObject:$ReturnObject.IsPresent -ExcludeGroupPolicies $ExcludeGPO
                         } else {
                             $_
                         }
@@ -79,7 +97,7 @@
                                 Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
                                 continue
                             }
-                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups -ReturnObject:$ReturnObject.IsPresent
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups -ReturnObject:$ReturnObject.IsPresent -ExcludeGroupPolicies $ExcludeGPO
                         } else {
                             $_
                         }
@@ -92,7 +110,7 @@
                 Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml | ForEach-Object {
                     $XMLContent = [XML]::new()
                     $XMLContent.Load($_.FullName)
-                    Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent
+                    Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent -ExcludeGroupPolicies $ExcludeGPO
                 }
                 Write-Verbose "Get-GPOZaurr - Finished GPO content from XML files"
             }

Public/Invoke-GPOZaurr.ps1

@@ -2,6 +2,7 @@
     [alias('Show-GPOZaurr', 'Show-GPO')]
     [cmdletBinding()]
     param(
+        [scriptblock] $Extension,
         [string] $FilePath,
         [string[]] $Type,
         [switch] $PassThru,
@@ -41,6 +42,25 @@
     Write-Color '[i]', "[GPOZaurr] ", 'Domain Information', ' [Informative] ', "Included Domains: ", $DisplayIncludedDomains -Color Yellow, DarkGray, Yellow, DarkGray, Yellow, Magenta
     Write-Color '[i]', "[GPOZaurr] ", 'Domain Information', ' [Informative] ', "Excluded Domains: ", $DisplayExcludedDomains -Color Yellow, DarkGray, Yellow, DarkGray, Yellow, Magenta
 
+    # Exclusions support, converts ScriptBlock into list of GPOs
+    $Exclusions = [ordered]@{}
+    if ($Extension) {
+        $Exclusions['All'] = [System.Collections.Generic.List[PSCustomObject]]::new()
+        [Array] $ExecuteExtension = & $Extension
+        foreach ($Ext in $ExecuteExtension) {
+            if ($Ext.Type -eq 'Exclusion') {
+                if ($Ext.Type) {
+                    if (-not $Exclusions[$Ext.Type]) {
+                        $Exclusions[$Ext.Type] = [System.Collections.Generic.List[PSCustomObject]]::new()
+                    }
+                    $Exclusions[$Ext.Type].Add($Ext)
+                } else {
+                    $Exclusions['All'].Add($Ext)
+                }
+            }
+        }
+    }
+
     # Lets make sure we only enable those types which are requestd by user
     if ($Type) {
         foreach ($T in $Script:GPOConfiguration.Keys) {
@@ -59,11 +79,16 @@
                 Name              = $Script:GPOConfiguration[$T].Name
                 ActionRequired    = $null
                 Data              = $null
+                Exclusions        = $null
                 WarningsAndErrors = $null
                 Time              = $null
                 Summary           = $null
                 Variables         = Copy-Dictionary -Dictionary $Script:GPOConfiguration[$T]['Variables']
             }
+            if ($Exclusions) {
+                $Script:Reporting[$T]['Exclusions'] = $Extension
+            }
+
             $TimeLogGPOList = Start-TimeLog
             Write-Color -Text '[i]', '[Start] ', $($Script:GPOConfiguration[$T]['Name']) -Color Yellow, DarkGray, Yellow
             $OutputCommand = Invoke-Command -ScriptBlock $Script:GPOConfiguration[$T]['Execute'] -WarningVariable CommandWarnings -ErrorVariable CommandErrors -ArgumentList $Forest, $ExcludeDomains, $IncludeDomains

Public/Skip-GroupPolicy.ps1

@@ -0,0 +1,14 @@
+function Skip-GroupPolicy {
+    [cmdletBinding()]
+    param(
+        [ValidateSet('GPOList')][string] $Type,
+        [string] $Name,
+        [string] $DomaiName
+    )
+    @{
+        Type       = 'Exclusion'
+        ReportType = $Type
+        Name       = $Name
+        DomainName = $DomaiName
+    }
+}

README.md

@@ -57,6 +57,12 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
+- 0.0.93 - 03.12.2020
+  - [x] Improved `Invoke-GPOZaurr`
+    - [x] Type `GPOList` reverted charts colors for entries to match colors
+    - [ ] Added `Skip-GroupPolicy` to use within `Invoke-GPOZaurr`
+  - [x] Improved `Invoke-GPOZaurr` with basic support for Exclusions
+  - [x] Improved `Get-GPOZaurr` with basic support for Exclusions
 - 0.0.92 - 01.12.2020
   - [x] Improved `Invoke-GPOZaurrSupport`
   - [x] Improved `Invoke-GPOZaurr`