Update changelog

Improved the PowerShell script to account for special '.gpf' files when evaluating whether a Group Policy Object (GPO) is empty. Previously, GPOs containing only these files were incorrectly marked as empty since they weren't visible in the XML output. This update ensures that GPOs with '.gpf' files are recognized as non-empty. Additionally, the script now includes the SYSVOL path and the count of files within each GPO in its summary output, aiding in thorough GPO analysis.

This enhancement resolves issues with incomplete policy reporting and assists administrators in scenarios where Citrix or other applications rely on .gpf files for storing their settings.

Refs: #49

Build/Manage-Module.ps1

@@ -6,7 +6,7 @@ Invoke-ModuleBuild -ModuleName 'GPOZaurr' {
     # Usual defaults as per standard module
     $Manifest = @{
         # Version number of this module.
-        ModuleVersion        = '1.X.0'
+        ModuleVersion        = '1.1.X'
         # Supported PSEditions
         CompatiblePSEditions = @('Desktop')
         # ID used to uniquely identify this module
@@ -29,9 +29,9 @@ Invoke-ModuleBuild -ModuleName 'GPOZaurr' {
     }
     New-ConfigurationManifest @Manifest
 
-    New-ConfigurationModule -Type RequiredModule -Name 'PSWriteColor', 'PSSharedGoods', 'ADEssentials' -Guid Auto -Version Latest
+    New-ConfigurationModule -Type RequiredModule -Name 'PSWriteColor', 'PSSharedGoods', 'ADEssentials', 'PSWriteHTML' -Guid Auto -Version Latest
     #New-ConfigurationModule -Type ExternalModule -Name 'Microsoft.PowerShell.Utility', 'Microsoft.PowerShell.Management','Microsoft.PowerShell.Security'
-    New-ConfigurationModule -Type ApprovedModule -Name 'PSWriteColor', 'Connectimo', 'PSUnifi', 'PSWebToolbox', 'PSMyPassword'
+    New-ConfigurationModule -Type ApprovedModule -Name 'PSSharedGoods', 'PSWriteColor', 'Connectimo', 'PSUnifi', 'PSWebToolbox', 'PSMyPassword', 'ADEssentials'
 
     New-ConfigurationModule -Type ExternalModule -Name @(
         "CimCmdlets"
@@ -44,9 +44,14 @@ Invoke-ModuleBuild -ModuleName 'GPOZaurr' {
         # this are builtin into PowerShell, so not critical
         'powershellget'
         'GroupPolicy'
+        'ScheduledTasks'
         'ActiveDirectory'
+        'Microsoft.WSMan.Management'
+        'NetConnection'
+        'NetSecurity'
+        'NetTCPIP'
     ) -IgnoreFunctionName @(
-
+        'Select-Unique'
     )
 
     New-ConfigurationCommand -ModuleName 'ActiveDirectory' -CommandName @(
@@ -213,7 +218,7 @@ Invoke-ModuleBuild -ModuleName 'GPOZaurr' {
     # New-ConfigurationTest -TestsPath "$PSScriptRoot\..\Tests" -Enable
 
     New-ConfigurationArtefact -Type Unpacked -Enable -Path "$PSScriptRoot\..\Artefacts\Unpacked" -AddRequiredModules
-    New-ConfigurationArtefact -Type Packed -Enable -Path "$PSScriptRoot\..\Artefacts\Packed" -ArtefactName '<ModuleName>.v<ModuleVersion>.zip'
+    New-ConfigurationArtefact -Type Packed -Enable -Path "$PSScriptRoot\..\Artefacts\Packed" -ArtefactName '<ModuleName>.v<ModuleVersion>.zip' -AddRequiredModules
 
     # options for publishing to github/psgallery
     #New-ConfigurationPublish -Type PowerShellGallery -FilePath 'C:\Support\Important\PowerShellGalleryAPI.txt' -Enabled:$true

CHANGELOG.MD

@@ -1,5 +1,25 @@
 # GPOZaurr Release History
 
+## 1.1.3 - 2024.04.16
+- Fixes report showing unessecary `WhatIf` [#53](https://github.com/EvotecIT/GPOZaurr/issues/53)
+
+## 1.1.2 - 2024.04.16
+- Fixes `Forest` parameter for GPOAnalysis [#54](https://github.com/EvotecIT/GPOZaurr/issues/54)
+
+## 1.1.1 - 2024.02.07
+- Force specific DC for `Invoke-GPOZaurrContent`
+- Update to Duplicate Object detection for error handling [#52](https://github.com/EvotecIT/GPOZaurr/issues/52)
+
+## 1.1.0 - 2024.04.02
+- Improve `Invoke-GPOZaurr` - by adding `GPOName` and `GPOGUID` parameters, providing ability to analyse single/multiple GPOs
+  - Those parameters are only applicable to `GPOAnalysis`,`GPOBrokenPartially` for now (need to be expanded further)
+- Improve `Invoke-GPOZaurrContent` by allowing `GPOName` and `GPOGUID` parameters, providing ability to analyse single/multiple GPOs
+- Small verbose message improvement for `Export-GPOZaurrContent`
+- Added `Get-GPOZaurrMissingFiles` to detect missing files for GPOs
+- Added `Invoke-GPOZaurr` - type `GPOBrokenPartially` to detect missing files for GPOs
+- Improve detection of empty GPOs by including check for GPF files
+- Added `FilesCount` to `Get-GPOZaurr` to detect number of files in GPO
+
 ## 1.0.0 - 2023.09.17
 - `Get-GPOZaurrUpdates` fix small typo
 - `Get-GPOZaurrAD` improve performance a bit

Examples/Example-56-AnalyseGPOs.ps1

@@ -0,0 +1,14 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Output = Invoke-GPOZaurrContent -Verbose -GPOName 'Default Domain Policy'
+$Output | Format-Table
+
+<#
+# You need PSWriteOffice for that
+foreach ($Key in $Output.Keys) {
+    $Output[$Key] | Export-OfficeExcel -FilePath $Env:USERPROFILE\Desktop\GPOAnalysis.xlsx -WorkSheetName $Key
+}
+
+Invoke-GPOZaurr -Type GPOAnalysis -GPOName 'ALL | Allow use of biometrics', 'ALL | Enable RDP' -GPOGUID '{31B2F340-016D-11D2-945F-00C04FB984F9}' -IncludeDomains 'ad.evotec.xyz' -Verbose
+
+#>

Examples/Example-57-FindGPOWithMissingFiles.ps1

@@ -0,0 +1,10 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# search by guid or name for specific GPOs
+#Get-GPOZaurrMissingFiles -GPOGUID '{2F326111-C21B-4892-B7BC-9BDCB201FFCC}' | Format-Table
+
+# search for all GPOs with missing files
+#Get-GPOZaurrMissingFiles -BrokenOnly | Format-Table
+
+# search for all GPOs with missing files for everythin
+Invoke-GPOZaurr -Type GPOBrokenPartially #, GPOBroken, GPOBrokenLink

GPOZaurr.psd1

@@ -4,11 +4,11 @@
     CmdletsToExport      = @()
     CompanyName          = 'Evotec'
     CompatiblePSEditions = @('Desktop')
-    Copyright            = '(c) 2011 - 2023 Przemyslaw Klys @ Evotec. All rights reserved.'
+    Copyright            = '(c) 2011 - 2024 Przemyslaw Klys @ Evotec. All rights reserved.'
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
-    FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Export-GPOZaurrContent', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrBrokenLink', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOrganizationalUnit', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionAnalysis', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrRedirect', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrUpdates', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrLinkEmptyOU', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrBrokenLink', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermission', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Set-GPOZaurrStatus', 'Skip-GroupPolicy')
+    FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Export-GPOZaurrContent', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrBrokenLink', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrMissingFiles', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOrganizationalUnit', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionAnalysis', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrRedirect', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrUpdates', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrLinkEmptyOU', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrBrokenLink', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermission', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Set-GPOZaurrStatus', 'Skip-GroupPolicy')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '1.0.0'
+    ModuleVersion        = '1.1.3'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -24,11 +24,15 @@
         }, @{
             Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
             ModuleName    = 'PSSharedGoods'
-            ModuleVersion = '0.0.266'
+            ModuleVersion = '0.0.286'
         }, @{
             Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
             ModuleName    = 'ADEssentials'
-            ModuleVersion = '0.0.165'
+            ModuleVersion = '0.0.191'
+        }, @{
+            Guid          = 'a7bdf640-f5cb-4acf-9de0-365b322d245c'
+            ModuleName    = 'PSWriteHTML'
+            ModuleVersion = '1.17.0'
         }, 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility', 'Microsoft.PowerShell.Security')
     RootModule           = 'GPOZaurr.psm1'
 }

Private/Get-XMLGPO.ps1

@@ -12,6 +12,8 @@
         [System.Collections.IDictionary] $LinksSummaryCache
     )
 
+    $SysvolGpoPath = "\\$($GPO.DomainName)\SYSVOL\$($GPO.DomainName)\Policies\{$($GPO.ID)}"
+
     $DisplayName = $XMLContent.GPO.Name
     $DomainName = $XMLContent.GPO.Identifier.Domain.'#text'
 
@@ -166,7 +168,20 @@
         [bool] $UserSettingsAvailable = if ($OutputUser.Count -gt 0) { $true } else { $false }
     }
 
-    if ($ComputerSettingsAvailable -eq $false -and $UserSettingsAvailable -eq $false) {
+    # Check if there are any GPF files in the GPO
+    # those are special files that are used to store settings for some applications (maily Citrix?)
+    # if there are any, then we can't say that GPO is empty, and they are not visible in the XML
+    $GPFFile = $false
+    $FilesCount = 0
+    Get-ChildItem -LiteralPath $SysvolGpoPath -Recurse -ErrorAction SilentlyContinue -File | ForEach-Object {
+        if ($_.Extension -eq '.gpf') {
+            #Write-Warning -Message "Get-XMLGPO - GPO [$DisplayName/$DomainName] has no data in XML, but it contains GPF files. Excluding from empty GPO list."
+            $GPFFile = $true
+        }
+        $FilesCount++
+    }
+
+    if ($ComputerSettingsAvailable -eq $false -and $UserSettingsAvailable -eq $false -and $GPFFile -eq $false) {
         $Empty = $true
     } else {
         $Empty = $false
@@ -257,6 +272,7 @@
             'Inherited'            = $false
             'Permissions'          = 'Owner'
             'GPODistinguishedName' = $GPO.Path
+            'GPOSysvolPath'        = $SysvolGpoPath
         }
         $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
             if ($_) {
@@ -285,6 +301,7 @@
             'OwnerSID'             = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
             'OwnerType'            = $OwnerType
             'GPODistinguishedName' = $GPO.Path
+            'GPOSysvolPath'        = $SysvolGpoPath
         }
     } else {
         $GPOOutput = [PsCustomObject] @{
@@ -302,6 +319,7 @@
             'Description'                       = $GPO.Description
             'ComputerPolicies'                  = $XMLContent.GPO.Computer.ExtensionData.Name -join ", "
             'UserPolicies'                      = $XMLContent.GPO.User.ExtensionData.Name -join ", "
+            'FilesCount'                        = $FilesCount
             'LinksCount'                        = $LinksTotalCount
             'LinksEnabledCount'                 = $LinksEnabledCount
             'LinksDisabledCount'                = $LinksDisabledCount
@@ -331,6 +349,7 @@
             'WMIFilter'                         = $GPO.WmiFilter.name
             'WMIFilterDescription'              = $GPO.WmiFilter.Description
             'GPODistinguishedName'              = $GPO.Path
+            'GPOSysvolPath'                     = $SysvolGpoPath
             'SDDL'                              = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
             'Owner'                             = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
             'OwnerSID'                          = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'

Private/Invoke.GPOZaurrAnalysis.ps1

@@ -4,7 +4,7 @@
     ActionRequired = $null
     Data           = $null
     Execute        = {
-        Invoke-GPOZaurrContent -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
+        Invoke-GPOZaurrContent -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -GPOName $GPOName -GPOGUID $GPOGUID
     }
     Processing     = {
 

Private/Invoke.GPOZaurrMissingFiles.ps1

@@ -0,0 +1,115 @@
+$GPOZaurrMissingFiles = [ordered] @{
+    Name       = 'Group Policies with missing files'
+    Enabled    = $true
+    Action     = $null
+    Data       = $null
+    Execute    = {
+        Get-GPOZaurrMissingFiles -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -GPOName $GPOName -GPOGUID $GPOGUID | Sort-Object -Property ErrorCount -Descending
+    }
+    Processing = {
+        foreach ($GPO in  $Script:Reporting['GPOBrokenPartially']['Data']) {
+            if ($GPO.ErrorCount -gt 0) {
+                $Script:Reporting['GPOBrokenPartially']['Variables']['RequireFixing']++
+            }
+        }
+        if ($Script:Reporting['GPOBrokenPartially']['Variables']['RequireFixing'] -gt 0) {
+            $Script:Reporting['GPOBrokenPartially']['ActionRequired'] = $true
+        } else {
+            $Script:Reporting['GPOBrokenPartially']['ActionRequired'] = $false
+        }
+    }
+    Variables  = @{
+        RequireFixing = 0
+    }
+    Overview   = {
+
+    }
+    Resources  = @(
+
+    )
+    Summary    = {
+        New-HTMLText -FontSize 10pt -TextBlock {
+            "Group Policies can become broken for various reasons. One of the common reasons is when GPOs are created and then deleted without being properly removed from Active Directory. "
+            "In other cases it can be due to replication issues, or simply due to corruption. "
+            "This can lead to GPOs not being applied as expected, or not being applied at all. "
+            "If random files are missing from GPOs it's important to fix them to ensure that GPOs are applied as expected. "
+            "This report provides you with list of GPOs that have missing files. "
+            "Usually once files are missing it's best to restore them from backup (if available) or remove given section completly. "
+            "It's not possible to restore missing files from Active Directory directly or manually. "
+        } -LineBreak
+        New-HTMLText -Text 'As it stands currently there are ', $Script:Reporting['GPOBrokenPartially']['Variables']['RequireFixing'], ' error requring fixing. ' -FontSize 10pt -FontWeight normal, bold, normal
+    }
+    Solution   = {
+        New-HTMLSection -Invisible {
+            New-HTMLPanel {
+                & $Script:GPOConfiguration['GPOBrokenPartially']['Summary']
+            }
+            New-HTMLPanel {
+                New-HTMLChart {
+                    New-ChartLegend -Names 'Bad' -Color Salmon
+                    New-ChartBar -Name 'Missing Files' -Value $Script:Reporting['GPOBrokenPartially']['Variables']['RequireFixing']
+                } -Title 'Group Policies with Missing Files' -TitleAlignment center
+            }
+        }
+        New-HTMLSection -Name 'Group Policy Missing Files' {
+            New-HTMLTable -DataTable $Script:Reporting['GPOBrokenPartially']['Data'] -Filtering {
+                New-HTMLTableCondition -Name 'ErrorCount' -Value 0 -BackgroundColor LightGreen -ComparisonType number -FailBackgroundColor Salmon -HighlightHeaders 'ErrorCount', 'ErrorCategory', 'ErrorDetails'
+            } -PagingOptions 10, 20, 30, 40, 50
+        }
+        if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
+            New-HTMLSection -Name 'Steps to fix - Remove duplicate (CNF) objects' {
+                New-HTMLContainer {
+                    New-HTMLSpanStyle -FontSize 10pt {
+                        New-HTMLWizard {
+                            New-HTMLWizardStep -Name 'Prepare environment' {
+                                New-HTMLText -Text "To be able to execute actions in automated way please install required modules. Those modules will be installed straight from Microsoft PowerShell Gallery."
+                                New-HTMLCodeBlock -Code {
+                                    Install-Module GPOZaurr -Force
+                                    Import-Module GPOZaurr -Force
+                                } -Style powershell
+                                New-HTMLText -Text "Using force makes sure newest version is downloaded from PowerShellGallery regardless of what is currently installed. Once installed you're ready for next step."
+                            }
+                            New-HTMLWizardStep -Name 'Prepare report' {
+                                New-HTMLText -Text "Depending when this report was run you may want to prepare new report before proceeding fixing duplicate GPO objects. To generate new report please use:"
+                                New-HTMLCodeBlock -Code {
+                                    Invoke-GPOZaurr -FilePath $Env:UserProfile\Desktop\GPOZaurrMissingFilesBefore.html -Verbose -Type GPOMissingFiles
+                                }
+                                New-HTMLText -TextBlock {
+                                    "When executed it will take a while to generate all data and provide you with new report depending on size of environment. "
+                                    "Once confirmed that data is still showing issues and requires fixing please proceed with next step. "
+                                }
+                                New-HTMLText -Text "Alternatively if you prefer working with console you can run: "
+                                New-HTMLCodeBlock -Code {
+                                    $GPOOutput = Get-GPOZaurrMissingFiles -BrokenOnly
+                                    $GPOOutput | Format-Table # do your actions as desired
+                                }
+                                New-HTMLText -Text "It provides same data as you see in table above just doesn't prettify it for you."
+                            }
+                            New-HTMLWizardStep -Name 'Remove Broken objects' {
+                                New-HTMLText -Text "There is no automated way to fix missing files. You need to manually fix them. "
+                                New-HTMLText -Text "You can do so by restoring files from backup or removing section completly. "
+                            }
+                            New-HTMLWizardStep -Name 'Verification report' {
+                                New-HTMLText -TextBlock {
+                                    "Once cleanup task was executed properly, we need to verify that report now shows no problems."
+                                }
+                                New-HTMLCodeBlock -Code {
+                                    Invoke-GPOZaurr -FilePath $Env:UserProfile\Desktop\GPOZaurrMissingFilesAfter.html -Verbose -Type GPOMissingFiles
+                                }
+                                New-HTMLText -Text "If everything is healthy in the report you're done! Enjoy rest of the day!" -Color BlueDiamond
+                            }
+                        } -RemoveDoneStepOnNavigateBack -Theme arrows -ToolbarButtonPosition center -EnableAllAnchors
+                    }
+                }
+            }
+        }
+        if ($Script:Reporting['GPOBrokenPartially']['WarningsAndErrors']) {
+            New-HTMLSection -Name 'Warnings & Errors to Review' {
+                New-HTMLTable -DataTable $Script:Reporting['GPOZaurrMissingFiles']['WarningsAndErrors'] -Filtering {
+                    New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
+                    New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
+                }
+            }
+        }
+    }
+}

Private/Invoke.GPOZaurrOrganizationalUnit.ps1

@@ -209,13 +209,13 @@
                                 } -LineBreak
                                 New-HTMLText -Text 'Once happy with results please follow with command (this will start removal process): ' -LineBreak -FontWeight bold
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurrLinkEmptyOU -WhatIf -LimitProcessing 2 -Verbose
+                                    Remove-GPOZaurrLinkEmptyOU -LimitProcessing 2 -Verbose
                                 }
                                 New-HTMLText -TextBlock {
                                     "Alternatively for multi-domain scenario, if you have limited Domain Admin credentials to a single domain please use following command: "
                                 }
                                 New-HTMLCodeBlock -Code {
-                                    Remove-GPOZaurrLinkEmptyOU -WhatIf -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
+                                    Remove-GPOZaurrLinkEmptyOU -LimitProcessing 2 -Verbose -IncludeDomains 'YourDomainYouHavePermissionsFor'
                                 }
                                 New-HTMLText -TextBlock {
                                     "This command when executed deletes only first X broken GPOs. Use LimitProcessing parameter to prevent mass delete and increase the counter when no errors occur. "

Private/Script.GPOConfiguration.ps1

@@ -1,6 +1,7 @@
 $Script:GPOConfiguration = [ordered] @{
     GPOBroken                    = $GPOZaurrOrphans
     GPOBrokenLink                = $GPOZaurrBrokenLink
+    GPOBrokenPartially           = $GPOZaurrMissingFiles
     GPOOwners                    = $GPOZaurrOwners
     GPOConsistency               = $GPOZaurrConsistency
     GPODuplicates                = $GPOZaurrDuplicates

Public/Export-GPOZaurrContent.ps1

@@ -33,7 +33,7 @@
             $GPOs = Get-GPO -All -Domain $Domain
             foreach ($GPO in $GPOS) {
                 $Count++
-                Write-Verbose -Message "Export-GPOZaurr - Exporting ($Count / $($GPOs.Count)) - $($GPO.DisplayName) to $ReportTypeF"
+                Write-Verbose -Message "Export-GPOZaurr - Exporting ($Count / $($GPOs.Count)) - $($GPO.DisplayName) to $ReportType"
                 $Name = "$($GPO.DomainName)_$($GPO.Id)_$($GPO.DisplayName).xml".Replace(" ", "_").Replace("|", "_")
                 $FullName = [io.path]::Combine($GPOOutput, $Name)
                 Get-GPOReport -Guid $GPO.Id -Domain $GPO.DomainName -ReportType $ReportType -Path $FullName

Public/Get-GPOZaurrAD.ps1

@@ -63,7 +63,7 @@
                     $Splat['Filter'] = -join ($Splat['Filter'], ' -and ((WhenChanged -ge $DateFrom -and WhenChanged -le $DateTo) -or (WhenCreated -ge $DateFrom -and WhenCreated -le $DateTo))')
                 } elseif ($DateProperty -eq 'WhenChanged' -or $DateProperty -eq 'WhenCreated') {
                     $Property = $DateProperty[0]
-                    $Splat['Filter'] = -join ($Splat['Filter'], ' -and ($Property -ge $DateFrom -and $Property -le $DateTo)')
+                    $Splat['Filter'] = -join ($Splat['Filter'], " -and ($Property -ge $DateFrom -and $Property -le $DateTo)")
                 } else {
                     Write-Warning -Message "Get-GPOZaurrAD - DateProperty parameter is empty. Provide name and try again."
                     continue
@@ -75,7 +75,7 @@
                     $Splat['Filter'] = -join ($Splat['Filter'], ' -and ((WhenChanged -ge $DateFrom -and WhenChanged -le $DateTo) -or (WhenCreated -ge $DateFrom -and WhenCreated -le $DateTo))')
                 } elseif ($DateProperty -eq 'WhenChanged' -or $DateProperty -eq 'WhenCreated') {
                     $Property = $DateProperty[0]
-                    $Splat['Filter'] = -join ($Splat['Filter'], ' -and ($Property -ge $DateFrom -and $Property -le $DateTo)')
+                    $Splat['Filter'] = -join ($Splat['Filter'], " -and ($Property -ge $DateFrom -and $Property -le $DateTo)")
                 } else {
                     Write-Warning -Message "Get-GPOZaurrAD - DateProperty parameter is empty. Provide name and try again."
                     continue

Public/Get-GPOZaurrMissingFiles.ps1

@@ -0,0 +1,52 @@
+function Get-GPOZaurrMissingFiles {
+    [cmdletBinding()]
+    param(
+        [Parameter()][alias('ForestName')][string] $Forest,
+        [Parameter()][string[]] $ExcludeDomains,
+        [Parameter()][alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [Parameter()][System.Collections.IDictionary] $ExtendedForestInformation,
+        [Parameter()][Alias('Name')][string[]] $GPOName,
+        [Parameter()][string[]] $GPOGUID,
+        [switch] $BrokenOnly
+    )
+    Write-Verbose "Get-GPOZaurrMissingFiles - Query AD for GPOs"
+    if ($GPOName -or $GPOGUID) {
+        [Array] $GPOs = @(
+            foreach ($Name in $GPOName) {
+                Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOName $Name
+            }
+            foreach ($GUID in $GPOGUID) {
+                Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOGuid $GUID
+            }
+        )
+    } else {
+        [Array] $GPOs = Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    }
+    $Count = 0
+    foreach ($GPO in $GPOS) {
+        $Count++
+        Write-Verbose -Message "Get-GPOZaurrMissingFiles - Processing ($Count / $($GPOs.Count)) - $($GPO.DisplayName)"
+        #$Name = "$($GPO.DomainName)_$($GPO.Id)_$($GPO.DisplayName).xml".Replace(" ", "_").Replace("|", "_")
+
+        [xml] $GPOOutput = Get-GPOReport -Guid $GPO.GUID -Domain $GPO.DomainName -ReportType Xml
+        [Array] $ErrorsFound = foreach ($Type in @('User', 'Computer')) {
+            foreach ($Extension in $GPOOutput.GPO.$Type.ExtensionData) {
+                if ($Extension.Error) {
+                    Write-Warning -Message "Get-GPOZaurrMissingFiles - $($GPO.DisplayName) - $($Extension.Name) - $($Extension.Error.Details)"
+                    [ordered] @{ Category = $Extension.Name; Error = $Extension.Error.Details }
+                }
+            }
+        }
+        if ($BrokenOnly -and $ErrorsFound.Count -eq 0) {
+            continue
+        }
+        [PSCustomObject] @{
+            GPOName       = $GPO.DisplayName
+            GPOGuid       = $GPO.GUID
+            DomainName    = $GPO.DomainName
+            ErrorCount    = $ErrorsFound.Count
+            ErrorCategory = $ErrorsFound.Category
+            ErrorDetails  = $ErrorsFound.Error
+        }
+    }
+}

Public/Invoke-GPOZaurr.ps1

@@ -75,7 +75,10 @@
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
         [switch] $Online,
-        [switch] $SplitReports
+        [switch] $SplitReports,
+
+        [Alias('Name')][string[]] $GPOName,
+        [Alias('GUID')][string[]] $GPOGUID
     )
     Reset-GPOZaurrStatus # This makes sure types are at it's proper status
 

Public/Invoke-GPOZaurrContent.ps1

@@ -53,7 +53,13 @@
         [Parameter(ParameterSetName = 'Local')]
         [switch] $SkipCleanup,
 
-        [switch] $Extended
+        [switch] $Extended,
+
+        [Parameter(ParameterSetName = 'Default')]
+        [Alias('Name')][string[]] $GPOName,
+
+        [Parameter(ParameterSetName = 'Default')]
+        [string[]] $GPOGUID
     )
     if ($Type.Count -eq 0) {
         $Type = $Script:GPODitionary.Keys
@@ -82,6 +88,16 @@
             Write-Warning "Invoke-GPOZaurrContent - $GPOPath doesn't exists."
             return
         }
+    } elseif ($GPOName -or $GPOGUID) {
+        Write-Verbose "Invoke-GPOZaurrContent - Query AD for GPOs"
+        [Array] $GPOs = @(
+            foreach ($Name in $GPOName) {
+                Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOName $Name
+            }
+            foreach ($GUID in $GPOGUID) {
+                Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOGUID $GUID
+            }
+        )
     } else {
         Write-Verbose "Invoke-GPOZaurrContent - Query AD for GPOs"
         [Array] $GPOs = Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
@@ -94,6 +110,8 @@
     $Output['Reports'] = [ordered] @{}
     $Output['CategoriesFull'] = [ordered] @{}
 
+    $ForestInformation = Get-WinADForestDetails -PreferWritable  -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+
     Write-Verbose "Invoke-GPOZaurrContent - Loading GPO Report to Categories"
     $CountGPO = 0
     [Array] $GPOCategories = foreach ($GPO in $GPOs) {
@@ -102,7 +120,8 @@
         if ($GPOPath) {
             $GPOOutput = $GPO.GPOOutput
         } else {
-            [xml] $GPOOutput = Get-GPOReport -Guid $GPO.GUID -Domain $GPO.DomainName -ReportType Xml
+            $QueryServer = $ForestInformation['QueryServers'][$GPO.DomainName].HostName[0]
+            [xml] $GPOOutput = Get-GPOReport -Guid $GPO.GUID -Domain $GPO.DomainName -ReportType Xml -Server $QueryServer
         }
         Get-GPOCategories -GPO $GPO -GPOOutput $GPOOutput.GPO -Splitter $Splitter -FullObjects:$FullObjects -CachedCategories $Output['CategoriesFull']
     }
@@ -223,7 +242,6 @@
     }
 
     $Output['PoliciesTotal'] = $Output.Reports.Policies.PolicyCategory | Group-Object | Select-Object Name, Count | Sort-Object -Property Name #-Descending
-    #$Output['PoliciesTotal'] = $Output.Reports.Policies.PolicyCategory | Group-Object | Select-Object Name, Count | Sort-Object -Property Count -Descending
 
     if (-not $SkipCleanup) {
         Write-Verbose "Invoke-GPOZaurrContent - Cleaning up output"