NoApplyPermission checks

GPOZaurr.psd1

@@ -8,7 +8,7 @@
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
     FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Set-GPOZaurrStatus', 'Skip-GroupPolicy')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.96'
+    ModuleVersion        = '0.0.97'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{

Private/Get-XMLGPO.ps1

@@ -222,6 +222,7 @@
             'Enabled'                           = $EnabledBool
             'Optimized'                         = $Optimized
             'Problem'                           = $Problem
+            'ApplyPermission'                   = $null
             'Exclude'                           = $Exclude
             'ComputerPolicies'                  = $XMLContent.GPO.Computer.ExtensionData.Name -join ", "
             'UserPolicies'                      = $XMLContent.GPO.User.ExtensionData.Name -join ", "
@@ -297,6 +298,15 @@
             }
             'GPOObject'                         = $GPO
         }
+        if ($GPOOutput.ACL) {
+            $GPOOutput.ApplyPermission = $false
+            foreach ($Permission in $GPOOutput.ACL) {
+                if ($Permission.Permissions -eq 'Apply Group Policy') {
+                    $GPOOutput.ApplyPermission = $true
+                }
+            }
+        }
+
     }
     if ($PermissionsOnly -or $OwnerOnly) {
         $GPOOutput
@@ -319,6 +329,11 @@
                     $GPOOutput
                 }
             }
+            if ($Type -contains 'NoApplyPermission') {
+                if ($GPOOutput.ApplyPermission -eq $false) {
+                    $GPOOutput
+                }
+            }
         }
     }
 }

Private/Invoke.GPOZaurrList.ps1

@@ -19,6 +19,8 @@
         $Script:Reporting['GPOList']['Variables']['GPOOptimizedPerDomain'] = @{}
         $Script:Reporting['GPOList']['Variables']['GPOProblemPerDomain'] = @{}
         $Script:Reporting['GPOList']['Variables']['GPONoProblemPerDomain'] = @{}
+        $Script:Reporting['GPOList']['Variables']['GPOApplyPermissionYesPerDomain'] = @{}
+        $Script:Reporting['GPOList']['Variables']['GPOApplypermissionNoPerDomain'] = @{}
         foreach ($GPO in $Script:Reporting['GPOList']['Data']) {
             # Create Per Domain Variables
             if (-not $Script:Reporting['GPOList']['Variables']['GPONotValidPerDomain'][$GPO.DomainName]) {
@@ -39,7 +41,13 @@
             if (-not $Script:Reporting['GPOList']['Variables']['GPONoProblemPerDomain'][$GPO.DomainName]) {
                 $Script:Reporting['GPOList']['Variables']['GPONoProblemPerDomain'][$GPO.DomainName] = 0
             }
-            if ($GPO.Enabled -eq $false -or $GPO.Empty -eq $true -or $GPO.Linked -eq $false) {
+            if (-not $Script:Reporting['GPOList']['Variables']['GPOApplyPermissionYesPerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOList']['Variables']['GPOApplyPermissionYesPerDomain'][$GPO.DomainName] = 0
+            }
+            if (-not $Script:Reporting['GPOList']['Variables']['GPOApplypermissionNoPerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOList']['Variables']['GPOApplypermissionNoPerDomain'][$GPO.DomainName] = 0
+            }
+            if ($GPO.Enabled -eq $false -or $GPO.Empty -eq $true -or $GPO.Linked -eq $false -or $GPO.ApplyPermission -eq $false) {
                 $Script:Reporting['GPOList']['Variables']['GPONotValid']++
                 $Script:Reporting['GPOList']['Variables']['GPONotValidPerDomain'][$GPO.DomainName]++
             } else {
@@ -78,6 +86,11 @@
             } else {
                 $Script:Reporting['GPOList']['Variables']['GPODisabled']++
             }
+            if ($GPO.ApplyPermission -eq $true) {
+                $Script:Reporting['GPOList']['Variables']['ApplyPermissionYes']++
+            } else {
+                $Script:Reporting['GPOList']['Variables']['ApplyPermissionNo']++
+            }
             if ($GPO.LinksDisabledCount -eq $GPO.LinksCount -and $GPO.LinksCount -gt 0) {
                 $Script:Reporting['GPOList']['Variables']['GPOLinkedButLinkDisabled']++
             }
@@ -127,38 +140,42 @@
         }
     }
     Variables  = @{
-        GPONotValidPerDomain     = $null
-        GPOValidPerDomain        = $null
-        GPONotOptimizedPerDomain = $null
-        GPOOptimizedPerDomain    = $null
-        GPOProblemPerDomain      = $null
-        GPONoProblemPerDomain    = $null
-        GPOWithProblems          = 0
-        ComputerOptimizedYes     = 0
-        ComputerOptimizedNo      = 0
-        ComputerProblemYes       = 0
-        ComputerProblemNo        = 0
-        UserOptimizedYes         = 0
-        UserOptimizedNo          = 0
-        UserProblemYes           = 0
-        UserProblemNo            = 0
-        GPOOptimized             = 0
-        GPONotOptimized          = 0
-        GPOProblem               = 0
-        GPONoProblem             = 0
-        GPONotLinked             = 0
-        GPOLinked                = 0
-        GPOEmpty                 = 0
-        GPONotEmpty              = 0
-        GPOEmptyAndUnlinked      = 0
-        GPOEmptyOrUnlinked       = 0
-        GPOLinkedButEmpty        = 0
-        GPOEnabled               = 0
-        GPODisabled              = 0
-        GPOValid                 = 0
-        GPONotValid              = 0
-        GPOLinkedButLinkDisabled = 0
-        GPOTotal                 = 0
+        GPONotValidPerDomain           = $null
+        GPOValidPerDomain              = $null
+        GPONotOptimizedPerDomain       = $null
+        GPOOptimizedPerDomain          = $null
+        GPOProblemPerDomain            = $null
+        GPONoProblemPerDomain          = $null
+        GPOApplyPermissionYesPerDomain = $null
+        GPOApplyPermissionNoPerDomain  = $null
+        GPOWithProblems                = 0
+        ComputerOptimizedYes           = 0
+        ComputerOptimizedNo            = 0
+        ComputerProblemYes             = 0
+        ComputerProblemNo              = 0
+        UserOptimizedYes               = 0
+        UserOptimizedNo                = 0
+        UserProblemYes                 = 0
+        UserProblemNo                  = 0
+        GPOOptimized                   = 0
+        GPONotOptimized                = 0
+        GPOProblem                     = 0
+        GPONoProblem                   = 0
+        GPONotLinked                   = 0
+        GPOLinked                      = 0
+        GPOEmpty                       = 0
+        GPONotEmpty                    = 0
+        GPOEmptyAndUnlinked            = 0
+        GPOEmptyOrUnlinked             = 0
+        GPOLinkedButEmpty              = 0
+        GPOEnabled                     = 0
+        GPODisabled                    = 0
+        GPOValid                       = 0
+        GPONotValid                    = 0
+        GPOLinkedButLinkDisabled       = 0
+        GPOTotal                       = 0
+        ApplyPermissionYes             = 0
+        ApplyPermissionNo              = 0
     }
     Overview   = {
 
@@ -167,7 +184,8 @@
         New-HTMLText -TextBlock {
             "Over time Administrators add more and more group policies, as business requirements change. "
             "Due to neglection or thinking it may serve it's purpose later on a lot of Group Policies often have no value at all. "
-            "Either the Group Policy is not linked to anything and just stays unlinked forever, or GPO is linked, but the link (links) are disabled. "
+            "Either the Group Policy is not linked to anything and just stays unlinked forever, or GPO is linked, but the link (links) are disabled or GPO is totally disabled. "
+            "Then there are Group Policies that are targetting certain group or person and that group is removed leaving Group Policy doing nothing. "
             "Additionally sometimes new GPO is created without any settings or the settings are removed over time, but GPO stays in place. "
         } -FontSize 10pt
         New-HTMLList -Type Unordered {
@@ -180,6 +198,7 @@
                     New-HTMLListItem -Text "Group Policies that are linked, but empty: ", $Script:Reporting['GPOList']['Variables']['GPOLinkedButEmpty'] -FontWeight normal, bold
                     New-HTMLListItem -Text "Group Policies that are linked, but link disabled: ", $Script:Reporting['GPOList']['Variables']['GPOLinkedButLinkDisabled'] -FontWeight normal, bold
                     New-HTMLListItem -Text "Group Policies that are disabled (both user/computer sections): ", $Script:Reporting['GPOList']['Variables']['GPODisabled'] -FontWeight normal, bold
+                    New-HTMLListItem -Text "Group Policies that have no Apply Permission: ", $Script:Reporting['GPOList']['Variables']['ApplyPermissionNo'] -FontWeight normal, bold
                 }
             }
         } -FontSize 10pt
@@ -270,6 +289,7 @@
                     New-ChartBar -Name 'Linked' -Value $Script:Reporting['GPOList']['Variables']['GPOLinked'], $Script:Reporting['GPOList']['Variables']['GPONotLinked']
                     New-ChartBar -Name 'Not Empty' -Value $Script:Reporting['GPOList']['Variables']['GPONotEmpty'], $Script:Reporting['GPOList']['Variables']['GPOEmpty']
                     New-ChartBar -Name 'Enabled' -Value $Script:Reporting['GPOList']['Variables']['GPOEnabled'], $Script:Reporting['GPOList']['Variables']['GPODisabled']
+                    New-ChartBar -Name 'Apply Permission' -Value $Script:Reporting['GPOList']['Variables']['ApplyPermissionYes'], $Script:Reporting['GPOList']['Variables']['ApplyPermissionNo']
                     New-ChartBar -Name 'Valid' -Value $Script:Reporting['GPOList']['Variables']['GPOValid'], $Script:Reporting['GPOList']['Variables']['GPONotValid']
                     New-ChartBar -Name 'Optimized (for speed)' -Value $Script:Reporting['GPOList']['Variables']['GPOOptimized'], $Script:Reporting['GPOList']['Variables']['GPONotOptimized']
                     New-ChartBar -Name 'No problem' -Value $Script:Reporting['GPOList']['Variables']['GPONoProblem'], $Script:Reporting['GPOList']['Variables']['GPOProblem']
@@ -289,6 +309,7 @@
                     New-HTMLListItem -FontWeight bold, normal -Text "Enabled", " - means GPO has at least one section enabled. If enabled is set to false that means both sections are disabled, and therefore GPO is not active. "
                     New-HTMLListItem -FontWeight bold, normal -Text "Optimized", " - means GPO section that is not in use is disabled. If section (user or computer) is enabled and there is no content, it's not optimized. "
                     New-HTMLListItem -FontWeight bold, normal -Text "Problem", " - means GPO has one or more section (user or computer) that is disabled, yet there is content in it. "
+                    New-HTMLListItem -FontWeight bold, normal -Text "ApplyPermission", " - means GPO has no Apply Permission. This means there's no user/computer/group it's applicable to. "
                 } -FontSize 10pt
                 New-HTMLTable -DataTable $Script:Reporting['GPOList']['Data'] -Filtering {
                     New-HTMLTableCondition -Name 'Exclude' -Value $true -BackgroundColor DeepSkyBlue -ComparisonType string -Row
@@ -298,6 +319,7 @@
                     New-HTMLTableCondition -Name 'Enabled' -Value $false -BackgroundColor Salmon -ComparisonType string
                     New-HTMLTableCondition -Name 'Optimized' -Value $false -BackgroundColor Salmon -ComparisonType string
                     New-HTMLTableCondition -Name 'Problem' -Value $true -BackgroundColor Salmon -ComparisonType string
+                    New-HTMLTableCondition -Name 'ApplyPermission' -Value $false -BackgroundColor Salmon -ComparisonType string
                     New-HTMLTableCondition -Name 'ComputerProblem' -Value $true -BackgroundColor Salmon -ComparisonType string
                     New-HTMLTableCondition -Name 'UserProblem' -Value $true -BackgroundColor Salmon -ComparisonType string
                     New-HTMLTableCondition -Name 'ComputerOptimized' -Value $false -BackgroundColor Salmon -ComparisonType string
@@ -308,6 +330,7 @@
                     New-HTMLTableCondition -Name 'Enabled' -Value $true -BackgroundColor SpringGreen -ComparisonType string
                     New-HTMLTableCondition -Name 'Optimized' -Value $true -BackgroundColor SpringGreen -ComparisonType string
                     New-HTMLTableCondition -Name 'Problem' -Value $false -BackgroundColor SpringGreen -ComparisonType string
+                    New-HTMLTableCondition -Name 'ApplyPermission' -Value $true -BackgroundColor SpringGreen -ComparisonType string
                     New-HTMLTableCondition -Name 'ComputerProblem' -Value $false -BackgroundColor SpringGreen -ComparisonType string
                     New-HTMLTableCondition -Name 'UserProblem' -Value $false -BackgroundColor SpringGreen -ComparisonType string
                     New-HTMLTableCondition -Name 'ComputerOptimized' -Value $true -BackgroundColor SpringGreen -ComparisonType string
@@ -373,7 +396,7 @@
                                         Skip-GroupPolicy -Name 'TEST | Drive Mapping'
                                         Skip-GroupPolicy -Name 'Default Domain Policy'
                                         Skip-GroupPolicy -Name 'Default Domain Controllers Policy' -DomaiName 'JustOneDomain'
-                                    }
+                                    } -WhatIf
                                 }
                                 New-HTMLText -Text @(
                                     "Code above when executed will scan YourDomainYouHavePermissionsFor, find all empty, unlinked, disabled group policies, backup any GPO just before it's to be deleted to `$Env:UserProfile\Desktop\GPO. "
@@ -382,11 +405,48 @@
                                     "Now go ahead and find what's there"
                                 )
                             }
-                            New-HTMLWizardStep -Name 'Remove GPOs that are EMPTY or UNLINKED' {
+                            New-HTMLWizardStep -Name 'Remove GPOs that are EMPTY' {
                                 New-HTMLText -Text @(
                                     "Following command when executed removes every ",
                                     "EMPTY"
-                                    " or "
+                                    " Group Policy. Make sure when running it for the first time to run it with ",
+                                    "WhatIf",
+                                    " parameter as shown below to prevent accidental removal.",
+                                    "Make sure to use BackupPath which will make sure that for each GPO that is about to be deleted a backup is made to folder on a desktop."
+                                    "You can skip parameters related to backup if you did backup all GPOs prior to running remove command. "
+                                ) -FontWeight normal, bold, normal, bold, normal, bold, normal, normal -Color Black, Red, Black, Red, Black
+                                New-HTMLCodeBlock -Code {
+                                    Remove-GPOZaurr -Type Empty -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf
+                                }
+                                New-HTMLText -TextBlock {
+                                    "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                                }
+                                New-HTMLCodeBlock -Code {
+                                    Remove-GPOZaurr -Type Empty -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                }
+                                New-HTMLText -TextBlock {
+                                    "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. "
+                                } -LineBreak
+                                New-HTMLText -Text "Once happy with results please follow with command (this will start fixing process): " -LineBreak -FontWeight bold
+                                New-HTMLCodeBlock -Code {
+                                    Remove-GPOZaurr -Type Empty -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose
+                                }
+                                New-HTMLText -TextBlock {
+                                    "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                                }
+                                New-HTMLCodeBlock -Code {
+                                    Remove-GPOZaurr -Type Empty -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                }
+                                New-HTMLText -TextBlock {
+                                    "This command when executed deletes only first X empty GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur."
+                                    "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly."
+                                    "Please make sure to check if backup is made as well before going all in."
+                                }
+                                New-HTMLText -Text "If there's nothing else to be deleted, we can skip to next step step"
+                            }
+                            New-HTMLWizardStep -Name 'Remove GPOs that are UNLINKED' {
+                                New-HTMLText -Text @(
+                                    "Following command when executed removes every ",
                                     "NOT LINKED"
                                     " Group Policy. Make sure when running it for the first time to run it with ",
                                     "WhatIf",
@@ -395,33 +455,33 @@
                                     "You can skip parameters related to backup if you did backup all GPOs prior to running remove command. "
                                 ) -FontWeight normal, bold, normal, bold, normal, bold, normal, normal -Color Black, Red, Black, Red, Black
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -Type Empty, Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf
+                                    Remove-GPOZaurr -Type Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf
                                 }
                                 New-HTMLText -TextBlock {
                                     "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                                 }
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -Type Empty, Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                    Remove-GPOZaurr -Type Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor'
                                 }
                                 New-HTMLText -TextBlock {
                                     "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. "
                                 } -LineBreak
                                 New-HTMLText -Text "Once happy with results please follow with command (this will start fixing process): " -LineBreak -FontWeight bold
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -Type Empty, Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose
+                                    Remove-GPOZaurr -Type Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose
                                 }
                                 New-HTMLText -TextBlock {
                                     "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                                 }
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurr -Type Empty, Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                    Remove-GPOZaurr -Type Unlinked -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
                                 }
                                 New-HTMLText -TextBlock {
-                                    "This command when executed deletes only first X empty or unlinked GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur."
+                                    "This command when executed deletes only first X unlinked GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur."
                                     "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly."
                                     "Please make sure to check if backup is made as well before going all in."
                                 }
-                                New-HTMLText -Text "If there's nothing else to be deleted on SYSVOL side, we can skip to next step step"
+                                New-HTMLText -Text "If there's nothing else to be deleted, we can skip to next step step"
                             }
                             New-HTMLWizardStep -Name 'Remove GPOs that are DISABLED' {
                                 New-HTMLText -Text @(
@@ -465,6 +525,48 @@
                                 }
                                 New-HTMLText -Text "If there's nothing else to be deleted, we can skip to next step step."
                             }
+                            New-HTMLWizardStep -Name 'Remove GPOs that do not APPLY' {
+                                New-HTMLText -Text @(
+                                    "Following command when executed removes every ",
+                                    "NoApplyPermission"
+                                    " Group Policy. Make sure when running it for the first time to run it with ",
+                                    "WhatIf",
+                                    " parameter as shown below to prevent accidental removal.",
+                                    "Make sure to use BackupPath which will make sure that for each GPO that is about to be deleted a backup is made to folder on a desktop."
+                                    "You can skip parameters related to backup if you did backup all GPOs prior to running remove command. "
+                                ) -FontWeight normal, bold, normal, bold, normal, bold, normal, normal -Color Black, Red, Black, Red, Black
+                                New-HTMLText -TextBlock {
+                                    ""
+                                }
+                                New-HTMLCodeBlock -Code {
+                                    Remove-GPOZaurr -Type NoApplyPermission -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf
+                                }
+                                New-HTMLText -TextBlock {
+                                    "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                                }
+                                New-HTMLCodeBlock -Code {
+                                    Remove-GPOZaurr -Type NoApplyPermission -BackupPath "$Env:UserProfile\Desktop\GPO" -Verbose -WhatIf -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                }
+                                New-HTMLText -TextBlock {
+                                    "After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. "
+                                } -LineBreak
+                                New-HTMLText -Text "Once happy with results please follow with command (this will start fixing process): " -LineBreak -FontWeight bold
+                                New-HTMLCodeBlock -Code {
+                                    Remove-GPOZaurr -Type NoApplyPermission -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose
+                                }
+                                New-HTMLText -TextBlock {
+                                    "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
+                                }
+                                New-HTMLCodeBlock -Code {
+                                    Remove-GPOZaurr -Type NoApplyPermission -BackupPath "$Env:UserProfile\Desktop\GPO" -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                }
+                                New-HTMLText -TextBlock {
+                                    "This command when executed deletes only first X NoApplyPermission GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur. "
+                                    "Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly. "
+                                    "Please make sure to check if backup is made as well before going all in."
+                                }
+                                New-HTMLText -Text "If there's nothing else to be deleted, we can skip to next step step."
+                            }
                             New-HTMLWizardStep -Name 'Optimize GPOs (optional)' {
                                 New-HTMLText -Text @(
                                     "Following command when executed disables user or computer section when there's no content for given type. ",

Public/Get-GPOZaurr.ps1

@@ -5,7 +5,7 @@
         [string] $GPOName,
         [alias('GUID', 'GPOID')][string] $GPOGuid,
 
-        [validateset('Empty', 'Unlinked', 'Disabled', 'All')][string[]] $Type,
+        [validateset('Empty', 'Unlinked', 'Disabled', 'NoApplyPermission', 'All')][string[]] $Type,
 
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,

Public/Remove-GPOZaurr.ps1

@@ -2,7 +2,7 @@
     [cmdletBinding(SupportsShouldProcess)]
     param(
         [Parameter(Position = 1)][scriptblock] $ExcludeGroupPolicies,
-        [parameter(Position = 0, Mandatory)][validateset('Empty', 'Unlinked', 'Disabled')][string[]] $Type,
+        [parameter(Position = 0, Mandatory)][validateset('Empty', 'Unlinked', 'Disabled', 'NoApplyPermission')][string[]] $Type,
         [int] $LimitProcessing,
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
@@ -55,6 +55,11 @@
                     $DeleteRequired = $true
                 }
             }
+            if ($Type -contains 'NoApplyPermission') {
+                if ($_.ApplyPermission -eq $false) {
+                    $DeleteRequired = $true
+                }
+            }
             if ($_.Exclude -eq $true) {
                 Write-Verbose "Remove-GPOZaurr - Excluded GPO $($_.DisplayName) from $($_.DomainName). Skipping!"
             } elseif ($DeleteRequired) {

Publish/Manage-Module.ps1

@@ -0,0 +1,288 @@
+Clear-Host
+Import-Module "C:\Users\przemyslaw.klys\OneDrive - Evotec\Support\GitHub\PSPublishModule\PSPublishModule.psd1" -Force
+
+$Configuration = @{
+    Information = @{
+        ModuleName        = 'GPOZaurr'
+        DirectoryProjects = 'C:\Support\GitHub'
+
+        FunctionsToExport = 'Public'
+        AliasesToExport   = 'Public'
+
+        Manifest          = @{
+            # Version number of this module.
+            ModuleVersion              = '0.0.X'
+            # Supported PSEditions
+            CompatiblePSEditions       = @('Desktop')
+            # ID used to uniquely identify this module
+            GUID                       = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
+            # Author of this module
+            Author                     = 'Przemyslaw Klys'
+            # Company or vendor of this module
+            CompanyName                = 'Evotec'
+            # Copyright statement for this module
+            Copyright                  = "(c) 2011 - $((Get-Date).Year) Przemyslaw Klys @ Evotec. All rights reserved."
+            # Description of the functionality provided by this module
+            Description                = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
+            # Minimum version of the Windows PowerShell engine required by this module
+            PowerShellVersion          = '5.1'
+            # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
+            Tags                       = @('Windows', 'ActiveDirectory', 'GPO', 'GroupPolicy')
+            #IconUri              = 'https://evotec.xyz/wp-content/uploads/2019/02/PSPublishModule.png'
+
+            ProjectUri                 = 'https://github.com/EvotecIT/GPOZaurr'
+
+            RequiredModules            = @(
+                @{ ModuleName = 'PSSharedGoods'; ModuleVersion = 'Latest'; Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe' }
+                @{ ModuleName = 'ADEssentials'; ModuleVersion = 'Latest'; Guid = '9fc9fd61-7f11-4f4b-a527-084086f1905f' }
+                @{ ModuleName = 'PSWriteHTML'; ModuleVersion = "0.0.122"; Guid = 'a7bdf640-f5cb-4acf-9de0-365b322d245c' }
+            )
+            ExternalModuleDependencies = @(
+                #"ActiveDirectory"
+                #"GroupPolicy"
+                "CimCmdlets"
+                'Microsoft.PowerShell.Management'
+                'Microsoft.PowerShell.Utility'
+                'Microsoft.PowerShell.Security'
+            )
+            CommandModuleDependencies  = @{
+                ActiveDirectory = @(
+                    'Add-GPOPermission'
+                    'Add-GPOZaurrPermission'
+                    'Backup-GPOZaurr'
+                    'Clear-GPOZaurrSysvolDFSR'
+                    'ConvertFrom-CSExtension'
+                    'Find-CSExtension'
+                    'Get-GPOZaurr'
+                    'Get-GPOZaurrAD'
+                    'Get-GPOZaurrBackupInformation'
+                    'Get-GPOZaurrBroken'
+                    'Get-GPOZaurrDictionary'
+                    'Get-GPOZaurrDuplicateObject'
+                    'Get-GPOZaurrFiles'
+                    'Get-GPOZaurrFilesPolicyDefinition'
+                    'Get-GPOZaurrFolders'
+                    'Get-GPOZaurrInheritance'
+                    'Get-GPOZaurrLegacyFiles'
+                    'Get-GPOZaurrLink'
+                    'Get-GPOZaurrLinkSummary'
+                    'Get-GPOZaurrNetLogon'
+                    'Get-GPOZaurrOwner'
+                    'Get-GPOZaurrPassword'
+                    'Get-GPOZaurrPermission'
+                    'Get-GPOZaurrPermissionConsistency'
+                    'Get-GPOZaurrPermissionRoot'
+                    'Get-GPOZaurrPermissionSummary'
+                    'Get-GPOZaurrSysvolDFSR'
+                    'Get-GPOZaurrWMI'
+                    'Invoke-GPOZaurr'
+                    #'Invoke-GPOZaurrContent'
+                    'Invoke-GPOZaurrPermission'
+                    'Invoke-GPOZaurrSupport'
+                    'New-GPOZaurrWMI'
+                    'Optimize-GPOZaurr'
+                    'Remove-GPOPermission'
+                    'Remove-GPOZaurr'
+                    'Remove-GPOZaurrBroken'
+                    'Remove-GPOZaurrDuplicateObject'
+                    'Remove-GPOZaurrFolders'
+                    'Remove-GPOZaurrLegacyFiles'
+                    'Remove-GPOZaurrPermission'
+                    'Remove-GPOZaurrWMI'
+                    'Repair-GPOZaurrNetLogonOwner'
+                    'Repair-GPOZaurrPermissionConsistency'
+                    'Restore-GPOZaurr'
+                    'Save-GPOZaurrFiles'
+                    'Set-GPOOwner'
+                    'Set-GPOZaurrOwner'
+                    'Find-GPO'
+                    'Get-GPOZaurrFilesPolicyDefinitions'
+                    'Get-GPOZaurrSysvol'
+                    'Remove-GPOZaurrOrphaned'
+                    'Show-GPO'
+                    'Show-GPOZaurr'
+                )
+                GroupPolicy     = @(
+                    'Add-GPOPermission'
+                    'Add-GPOZaurrPermission'
+                    'Backup-GPOZaurr'
+                    'Clear-GPOZaurrSysvolDFSR'
+                    'ConvertFrom-CSExtension'
+                    'Find-CSExtension'
+                    'Get-GPOZaurr'
+                    'Get-GPOZaurrAD'
+                    'Get-GPOZaurrBackupInformation'
+                    'Get-GPOZaurrBroken'
+                    'Get-GPOZaurrDictionary'
+                    'Get-GPOZaurrDuplicateObject'
+                    'Get-GPOZaurrFiles'
+                    'Get-GPOZaurrFilesPolicyDefinition'
+                    'Get-GPOZaurrFolders'
+                    'Get-GPOZaurrInheritance'
+                    'Get-GPOZaurrLegacyFiles'
+                    'Get-GPOZaurrLink'
+                    'Get-GPOZaurrLinkSummary'
+                    'Get-GPOZaurrNetLogon'
+                    'Get-GPOZaurrOwner'
+                    'Get-GPOZaurrPassword'
+                    'Get-GPOZaurrPermission'
+                    'Get-GPOZaurrPermissionConsistency'
+                    'Get-GPOZaurrPermissionRoot'
+                    'Get-GPOZaurrPermissionSummary'
+                    'Get-GPOZaurrSysvolDFSR'
+                    'Get-GPOZaurrWMI'
+                    'Invoke-GPOZaurr'
+                    #'Invoke-GPOZaurrContent'
+                    'Invoke-GPOZaurrPermission'
+                    'Invoke-GPOZaurrSupport'
+                    'New-GPOZaurrWMI'
+                    'Optimize-GPOZaurr'
+                    'Remove-GPOPermission'
+                    'Remove-GPOZaurr'
+                    'Remove-GPOZaurrBroken'
+                    'Remove-GPOZaurrDuplicateObject'
+                    'Remove-GPOZaurrFolders'
+                    'Remove-GPOZaurrLegacyFiles'
+                    'Remove-GPOZaurrPermission'
+                    'Remove-GPOZaurrWMI'
+                    'Repair-GPOZaurrNetLogonOwner'
+                    'Repair-GPOZaurrPermissionConsistency'
+                    'Restore-GPOZaurr'
+                    'Save-GPOZaurrFiles'
+                    'Set-GPOOwner'
+                    'Set-GPOZaurrOwner'
+                    'Find-GPO'
+                    'Get-GPOZaurrFilesPolicyDefinitions'
+                    'Get-GPOZaurrSysvol'
+                    'Remove-GPOZaurrOrphaned'
+                    'Show-GPO'
+                    'Show-GPOZaurr'
+                )
+            }
+        }
+    }
+    Options     = @{
+        Merge             = @{
+            Sort           = 'None'
+            FormatCodePSM1 = @{
+                Enabled           = $true
+                RemoveComments    = $false
+                FormatterSettings = @{
+                    IncludeRules = @(
+                        'PSPlaceOpenBrace',
+                        'PSPlaceCloseBrace',
+                        'PSUseConsistentWhitespace',
+                        'PSUseConsistentIndentation',
+                        'PSAlignAssignmentStatement',
+                        'PSUseCorrectCasing'
+                    )
+
+                    Rules        = @{
+                        PSPlaceOpenBrace           = @{
+                            Enable             = $true
+                            OnSameLine         = $true
+                            NewLineAfter       = $true
+                            IgnoreOneLineBlock = $true
+                        }
+
+                        PSPlaceCloseBrace          = @{
+                            Enable             = $true
+                            NewLineAfter       = $false
+                            IgnoreOneLineBlock = $true
+                            NoEmptyLineBefore  = $false
+                        }
+
+                        PSUseConsistentIndentation = @{
+                            Enable              = $true
+                            Kind                = 'space'
+                            PipelineIndentation = 'IncreaseIndentationAfterEveryPipeline'
+                            IndentationSize     = 4
+                        }
+
+                        PSUseConsistentWhitespace  = @{
+                            Enable          = $true
+                            CheckInnerBrace = $true
+                            CheckOpenBrace  = $true
+                            CheckOpenParen  = $true
+                            CheckOperator   = $true
+                            CheckPipe       = $true
+                            CheckSeparator  = $true
+                        }
+
+                        PSAlignAssignmentStatement = @{
+                            Enable         = $true
+                            CheckHashtable = $true
+                        }
+
+                        PSUseCorrectCasing         = @{
+                            Enable = $true
+                        }
+                    }
+                }
+            }
+            FormatCodePSD1 = @{
+                Enabled        = $true
+                RemoveComments = $false
+            }
+            Integrate      = @{
+                ApprovedModules = 'PSSharedGoods', 'PSWriteColor', 'Connectimo', 'PSUnifi', 'PSWebToolbox', 'PSMyPassword', 'ADEssentials'
+            }
+        }
+        Standard          = @{
+            FormatCodePSM1 = @{
+
+            }
+            FormatCodePSD1 = @{
+                Enabled = $true
+                #RemoveComments = $true
+            }
+        }
+        PowerShellGallery = @{
+            ApiKey   = 'C:\Support\Important\PowerShellGalleryAPI.txt'
+            FromFile = $true
+        }
+        GitHub            = @{
+            ApiKey   = 'C:\Support\Important\GithubAPI.txt'
+            FromFile = $true
+            UserName = 'EvotecIT'
+            #RepositoryName = 'PSPublishModule' # not required, uses project name
+        }
+        Documentation     = @{
+            Path       = 'Docs'
+            PathReadme = 'Docs\Readme.md'
+        }
+        Style             = @{
+            PSD1 = 'Minimal' # Native
+        }
+    }
+    Steps       = @{
+        BuildModule        = @{  # requires Enable to be on to process all of that
+            Enable           = $true
+            DeleteBefore     = $false
+            Merge            = $true
+            MergeMissing     = $true
+            SignMerged       = $true
+            Releases         = $true
+            ReleasesUnpacked = $false
+            RefreshPSD1Only  = $false
+        }
+        BuildDocumentation = @{
+            Enable        = $false # enables documentation processing
+            StartClean    = $true # always starts clean
+            UpdateWhenNew = $true # always updates right after new
+        }
+        ImportModules      = @{
+            Self            = $true
+            RequiredModules = $false
+            Verbose         = $false
+        }
+        PublishModule      = @{  # requires Enable to be on to process all of that
+            Enabled      = $false
+            Prerelease   = ''
+            RequireForce = $false
+            GitHub       = $false
+        }
+    }
+}
+
+New-PrepareModule -Configuration $Configuration

README.md

@@ -57,7 +57,10 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
-- 0.0.96
+- 0.0.97 - 07.12.2020
+  - [x] Improved `Invoke-GPOZaurr`
+    - [x] Type `GPOList` - added more data, did small reorganization
+- 0.0.96 - 07.12.2020
   - [x] Improved `Invoke-GPOZaurr`
     - [x] Type `GPOList` - added more data, added Optimization Step
   - [x] Added `Set-GPOZaurrStatus`