PSD1 / README update

Examples/Example-40-ShowGPO01.ps1

@@ -1,4 +1,4 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 #$Output = Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -PassThru -Type GPOConsistency, GPOList, GPODuplicates, GPOOrphans, GPOOwners, NetLogonOwners, GPOPermissionsRead, GPOPermissionsAdministrative,GPOPermissionsUnknown
-Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Type GPOPermissions
+Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Type GPOPermissions,GPOPermissionsRead

GPOZaurr.psd1

@@ -8,7 +8,7 @@
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
     FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionAnalysis', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermission', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Set-GPOZaurrStatus', 'Skip-GroupPolicy')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.99'
+    ModuleVersion        = '0.0.100'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -18,7 +18,7 @@
         }
     }
     RequiredModules      = @(@{
-            ModuleVersion = '0.0.190'
+            ModuleVersion = '0.0.192'
             ModuleName    = 'PSSharedGoods'
             Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
         }, @{

Private/Invoke.GPOZaurrPermissionsAnalysis.ps1

@@ -9,6 +9,7 @@
         }
         $Object['PermissionsPerRow'] = $Object['Permissions'] | ForEach-Object { $_ }
         $Object['PermissionsAnalysis'] = Get-GPOZaurrPermissionAnalysis -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -Permissions $Object.Permissions
+        $Object['PermissionsIssues'] = Get-GPOZaurrPermissionIssue -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
         $Object
     }
     Processing = {
@@ -28,6 +29,31 @@
         $Script:Reporting['GPOPermissions']['Variables']['WillNotFixPerDomain'] = @{}
         $Script:Reporting['GPOPermissions']['Variables']['WillFixPerDomain'] = @{}
 
+        $Script:Reporting['GPOPermissions']['Variables']['ReadPerDomain'] = @{}
+        $Script:Reporting['GPOPermissions']['Variables']['CouldNotReadPerDomain'] = @{}
+        $Script:Reporting['GPOPermissions']['Variables']['TotalPerDomain'] = @{}
+
+        foreach ($GPO in $Script:Reporting['GPOPermissions']['Data'].PermissionsIssues) {
+            # Create Per Domain Variables
+            if (-not $Script:Reporting['GPOPermissions']['Variables']['CouldNotReadPerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOPermissions']['Variables']['CouldNotReadPerDomain'][$GPO.DomainName] = 0
+            }
+            if (-not $Script:Reporting['GPOPermissions']['Variables']['ReadPerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOPermissions']['Variables']['ReadPerDomain'][$GPO.DomainName] = 0
+            }
+            if (-not $Script:Reporting['GPOPermissions']['Variables']['TotalPerDomain'][$GPO.DomainName]) {
+                $Script:Reporting['GPOPermissions']['Variables']['TotalPerDomain'][$GPO.DomainName] = 0
+            }
+            if ($GPO.PermissionIssue) {
+                $Script:Reporting['GPOPermissions']['Variables']['CouldNotRead']++
+                $Script:Reporting['GPOPermissions']['Variables']['CouldNotReadPerDomain'][$GPO.DomainName]++
+            } else {
+                $Script:Reporting['GPOPermissions']['Variables']['Read']++
+                $Script:Reporting['GPOPermissions']['Variables']['ReadPerDomain'][$GPO.DomainName]++
+            }
+            $Script:Reporting['GPOPermissions']['Variables']['Total']++
+            $Script:Reporting['GPOPermissions']['Variables']['TotalPerDomain'][$GPO.DomainName]++
+        }
         foreach ($GPO in $Script:Reporting['GPOPermissions']['Data'].PermissionsAnalysis) {
             # Create Per Domain Variables
             if (-not $Script:Reporting['GPOPermissions']['Variables']['WillFixPerDomain'][$GPO.DomainName]) {
@@ -99,13 +125,21 @@
                 $Script:Reporting['GPOPermissions']['Variables']['WillNotFixPerDomain'][$GPO.DomainName]++
             }
         }
-        if ($Script:Reporting['GPOPermissions']['Variables']['WillFix'] -gt 0) {
+        if ($Script:Reporting['GPOPermissions']['Variables']['WillFix'] -gt 0 -or $Script:Reporting['GPOPermissions']['Variables']['CouldNotRead'] -gt 0) {
             $Script:Reporting['GPOPermissions']['ActionRequired'] = $true
         } else {
             $Script:Reporting['GPOPermissions']['ActionRequired'] = $false
         }
     }
     Variables  = @{
+        # Issues / Couldnt read report
+        Read                                    = 0
+        ReadPerDomain                           = $null
+        CouldNotRead                            = 0
+        CouldNotReadPerDomain                   = $null
+        TotalPerDomain                          = $null
+        Total                                   = 0
+        # Permissions analysis
         WillFix                                 = 0
         WillNotFix                              = 0
         WillFixAdministrative                   = 0
@@ -150,7 +184,34 @@
             New-HTMLListItem -Text "After MS16-072 is installed, user group policies are retrieved by using the computer's security context."
         } -FontSize 10pt
 
-        New-HTMLText -FontSize 10pt -Text "Assesment results " -FontWeight bold
+        New-HTMLText -FontSize 10pt -Text @(
+            "Unfortunetly it's not as simple as it sounds. While checking for permissions mostly works fine, it's possible a Group Policy has totally removed account permissions from being able to asses any of it. ",
+            "The account we're using "
+            "$($Env:USERDOMAIN)\$($Env:USERNAME.ToUpper())",
+            " may simply not have enough permisions to properly asses permissions for a GPO. "
+            "Therefore we're using dual assesment for this situation, where first assesment is checking for GPO visibility or lack of it, and second assesment is checking for direct permissions assignement. "
+            "We just were able to detect the problem, but hopefully higher level account (Domain Admin) should be able to provide full assesment. "
+        ) -FontWeight normal, normal, bold, normal -Color None, None, BlueDiamond, none, none
+
+        New-HTMLText -FontSize 10pt -Text "First assesment results: " -FontWeight bold
+        New-HTMLList -Type Unordered {
+            New-HTMLListItem -Text "Group Policies couldn't read at all: ", $Script:Reporting['GPOPermissions']['Variables']['CouldNotRead'] -FontWeight normal, bold
+            New-HTMLListItem -Text "Group Policies with permissions allowing read: ", $Script:Reporting['GPOPermissions']['Variables']['Read'] -FontWeight normal, bold
+        } -FontSize 10pt
+        New-HTMLText -Text 'Following domains require actions (permissions required):' -FontSize 10pt -FontWeight bold
+        New-HTMLList -Type Unordered {
+            foreach ($Domain in $Script:Reporting['GPOPermissions']['Variables']['CouldNotReadPerDomain'].Keys) {
+                New-HTMLListItem -Text @(
+                    "$Domain requires ",
+                    $Script:Reporting['GPOPermissions']['Variables']['CouldNotReadPerDomain'][$Domain],
+                    " changes out of ",
+                    $Script:Reporting['GPOPermissions']['Variables']['TotalPerDomain'][$Domain],
+                    "."
+                ) -FontWeight normal, bold, normal
+            }
+        } -FontSize 10pt
+
+        New-HTMLText -FontSize 10pt -Text "Second Assesment results " -FontWeight bold
         New-HTMLList -Type Unordered {
             New-HTMLListItem -Text 'Group Policies requiring Authenticated Users with GpoRead permission: ', $Script:Reporting['GPOPermissions']['Variables']['WillFixAuthenticatedUsers'] -FontWeight normal, bold
             New-HTMLListItem -Text "Group Policies which don't require changes: ", $Script:Reporting['GPOPermissions']['Variables']['WillNotTouchAuthenticatedUsers'] -FontWeight normal, bold
@@ -229,6 +290,7 @@
                 New-HTMLChart {
                     New-ChartBarOptions -Type barStacked
                     New-ChartLegend -Name 'Yes', 'No' -Color SpringGreen, Salmon
+                    New-ChartBar -Name 'Visible Permissions' -Value $Script:Reporting['GPOPermissions']['Variables']['Read'], $Script:Reporting['GPOPermissions']['Variables']['CouldNotRead']
                     New-ChartBar -Name 'Overall Permissions' -Value $Script:Reporting['GPOPermissions']['Variables']['WillNotFix'], $Script:Reporting['GPOPermissions']['Variables']['WillFix']
                     New-ChartBar -Name 'Administrative Permissions' -Value $Script:Reporting['GPOPermissions']['Variables']['WillNotTouchAdministrative'], $Script:Reporting['GPOPermissions']['Variables']['WillFixAdministrative']
                     New-ChartBar -Name 'Authenticated Users Permissions' -Value $Script:Reporting['GPOPermissions']['Variables']['WillNotTouchAdministrative'], $Script:Reporting['GPOPermissions']['Variables']['WillFixAuthenticatedUsers']
@@ -237,6 +299,11 @@
                 } -Title 'Group Policy Permissions' -TitleAlignment center
             }
         }
+        New-HTMLSection -Name 'Group Policy Visibility Analysis' {
+            New-HTMLTable -DataTable $Script:Reporting['GPOPermissions']['Data'].PermissionsIssues -Filtering {
+                New-HTMLTableCondition -Name 'PermissionIssue' -Value $true -BackgroundColor Salmon -ComparisonType string -Row
+            } -PagingOptions 7, 15, 30, 45, 60 -DefaultSortColumn PermissionIssue -DefaultSortOrder Descending
+        }
         New-HTMLSection -Name 'Group Policy Permissions Analysis' {
             New-HTMLContainer {
                 New-HTMLText -Text 'Explanation to table columns:' -FontSize 10pt

Private/Invoke.GPOZaurrPermissionsRead.ps1

@@ -6,7 +6,7 @@
     Execute    = {
         [ordered] @{
             Permissions = Get-GPOZaurrPermission -Type AuthenticatedUsers -ReturnSecurityWhenNoData -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
-            Issues      = Get-GPOZaurrPermissionIssue
+            Issues      = Get-GPOZaurrPermissionIssue -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
         }
     }
     Processing = {
@@ -93,7 +93,7 @@
         } -FontStyle italic -FontSize 10pt -FontWeight bold -LineBreak
         New-HTMLText -FontSize 10pt -Text @(
             "There are two parts to this assesment. Reading all Group Policies Permissions that account ",
-            $($Env:USERNAME.ToUpper()),
+            "$($Env:USERDOMAIN)\$($Env:USERNAME.ToUpper())",
             " has permissions to read and provide detailed assesment about permissions. ",
             "Second assesment checks for permissions that this account is not able to read at all, and therefore it has no visibility about permissions set on it. "
             "We just were able to detect the problem, but hopefully higher level account (Domain Admin) should be able to provide full assesment. "

README.md

@@ -57,7 +57,11 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
-- 0.0.99 - 13.10.2020
+- 0.0.100 - 21.12.2020
+  - [x] Improved `Invoke-GPOZaurr`
+    - [x] Type `GPOPermissionsRead`
+    - [x] Type `GPOPermissions`
+- 0.0.99 - 13.12.2020
   - [x] Improved `Invoke-GPOZaurr`
     - [x] Type `GPOList` - require GPO to be 7 days old for deletion to be proposed
     - [x] Type `GPOPermissions` - one stop for permissions