Compare commits

..

47 Commits

Author SHA1 Message Date
Przemysław Kłys c8c537e1f2 Fix PowerShell Gallery preview badge (include prereleases) 2026-02-14 21:34:10 +01:00
Przemysław Kłys 95789953a8 fix: 🐛 update copyright year and module versions
* Updated copyright year from 2024 to 2025.
* Incremented `ModuleVersion` from `1.1.9` to `1.1.10`.
* Updated dependencies' module versions:
  - `PSWriteColor` from `1.0.1` to `1.0.3`
  - `PSSharedGoods` from `0.0.301` to `0.0.312`
  - `ADEssentials` from `0.0.226` to `0.0.267`
* Refactored `Foreach` to `foreach` for consistency in `GPOZaurr.psm1`.
2025-12-05 08:45:58 +01:00
Przemysław Kłys 927ae5cd15 fix: 🐛 correct typo in 'Blocked Inhertiance' to 'Blocked Inheritance'
* Updated comments in `Example-36-FindBlockedInheritance.ps1` for clarity.
* Fixed spelling error in `Invoke.GPOZaurrBlockedInheritance.ps1`.
2025-12-04 08:33:11 +01:00
Przemyslaw Klys 26ecff620c fix typo 2025-08-16 08:15:09 +02:00
Przemysław Kłys 4358edfd8f Merge pull request #73 from ehmiiz/Invoke-GPOZaurrContent-docs-update
Update Invoke-GPOZaurrContent documentation and add new example
2025-02-19 17:38:38 +01:00
elarsson 31c7e9d817 Update Invoke-GPOZaurrContent documentation and add new example
- Enhance documentation for Invoke-GPOZaurrContent cmdlet with detailed parameter descriptions
- Add comprehensive parameter explanations and default values
- Include a new example demonstrating GPO retrieval by name with JSON conversion
- Update parameter set to include GPOName and GPOGUID parameters
2025-02-18 15:06:53 +01:00
Przemyslaw Klys 6718b35aaf Comment out self-import in module build configuration 2024-12-02 23:01:46 +01:00
Przemyslaw Klys 808af75ab9 Update module dependencies and version numbers 2024-12-02 22:57:14 +01:00
Przemyslaw Klys 6745e547a4 Update changelog 2024-12-02 22:54:24 +01:00
Przemyslaw Klys 642c4844a5 Add default file path handling for HTML report generation, fixes #58 2024-12-02 22:53:34 +01:00
Przemyslaw Klys cd72f79f85 Update changelog 2024-11-20 22:00:49 +01:00
Przemyslaw Klys 8d32cb443e Bump version 2024-11-20 21:50:57 +01:00
Przemyslaw Klys 4f4fddddae Add support for RestrcitedGroups #68 2024-11-20 21:50:02 +01:00
Przemyslaw Klys a374433922 Update changelog 2024-11-20 20:54:25 +01:00
Przemyslaw Klys 96a5e0789e update 2024-11-20 20:53:10 +01:00
Przemyslaw Klys f37887c8bf Bump 2024-11-20 20:40:22 +01:00
Przemyslaw Klys 497438dc1e Try to add some reporting for #67 2024-11-20 20:35:46 +01:00
Przemyslaw Klys 503b82ca02 Update gpo example 2024-10-17 22:30:54 +02:00
Przemyslaw Klys 790b3b97e0 update example 2024-10-17 22:30:41 +02:00
Przemyslaw Klys 07a8c77763 Update changelog 2024-10-17 19:48:27 +02:00
Przemyslaw Klys 9dfc4d01c3 Bump 2024-10-17 19:45:36 +02:00
Przemyslaw Klys a59a418e98 Update changelog 2024-10-17 19:42:28 +02:00
Przemyslaw Klys 5a1f7da921 Merge branch 'master' of https://github.com/EvotecIT/GPOZaurr 2024-10-17 19:36:27 +02:00
Przemyslaw Klys 8bdb157330 Update text 2024-10-17 19:36:20 +02:00
Przemyslaw Klys 096c6354d7 Add evotec 2024-10-17 19:36:04 +02:00
Przemyslaw Klys a3427496e9 Add scrollx 2024-10-17 19:35:53 +02:00
Przemyslaw Klys 9fb76d701f Add size 2024-10-17 19:34:54 +02:00
Przemyslaw Klys 7b4d31781c Add size 2024-10-17 19:34:45 +02:00
Przemyslaw Klys 21bcf2c3a6 Improve conditions 2024-10-17 19:34:16 +02:00
Przemyslaw Klys 46947e0ee9 Improve output to html 2024-10-17 19:34:06 +02:00
Przemyslaw Klys 12d4dfc634 Optimize output 2024-10-17 19:33:48 +02:00
Przemyslaw Klys 44be1f8d97 Add more conditions 2024-10-17 19:33:41 +02:00
Przemyslaw Klys 864d2cd516 Added scrollx 2024-10-17 19:33:00 +02:00
Przemyslaw Klys 0db67a6d70 Add file size 2024-10-17 19:30:15 +02:00
Przemysław Kłys 189401d62b Merge pull request #64 from SamErde/master 2024-09-30 22:04:19 +02:00
Sam Erde 212f59dd38 Merge branch 'EvotecIT:master' into master 2024-09-30 14:24:24 -04:00
Sam Erde 7b80dc2d8e Update Invoke.GPOZaurrMissingFiles.ps1
Fix typo. Small grammatical improvements in punctuation and readability.
2024-09-30 14:23:48 -04:00
Przemysław Kłys 5afa032042 Merge pull request #63 from SamErde/grammar-patch-1
Update Invoke.GPOZaurrDuplicate.ps1
2024-09-30 19:59:16 +02:00
Sam Erde 00b8586edc Update Invoke.GPOZaurrDuplicate.ps1
Minor grammatical fixes to summary text.
2024-09-30 13:56:36 -04:00
Przemyslaw Klys 08b07de729 Merge branch 'master' of https://github.com/EvotecIT/GPOZaurr 2024-08-24 11:01:10 +02:00
Przemyslaw Klys 3b04efcbc8 Commit examples 2024-08-24 11:01:02 +02:00
Przemysław Kłys 051544f353 Merge pull request #60 from davidmwilliams/patch-1
Minor typo correction "incosistent" -> "inconsistent"
2024-08-21 07:56:49 +02:00
Przemysław Kłys 307dec14df Merge pull request #61 from davidmwilliams/patch-2
Fixed typo "Unfortunetly" -> "Unfortunately"
2024-08-21 07:56:35 +02:00
David M Williams 9ec8f5128b Fixed typo "Unfortunetly" -> "Unfortunately" 2024-08-21 12:32:12 +10:00
David M Williams 7b68b12b02 Minor typo correction "incosistent" -> "inconsistent" 2024-08-21 12:21:46 +10:00
Przemyslaw Klys 029225a65c Update changelog 2024-07-06 09:08:34 +02:00
Przemyslaw Klys ae2a0bd84c Bump versions 2024-07-06 09:06:37 +02:00
47 changed files with 592 additions and 323 deletions
+3 -4
View File
@@ -1,7 +1,5 @@
Clear-Host
Import-Module "PSPublishModule" -Force
Invoke-ModuleBuild -ModuleName 'GPOZaurr' {
# Usual defaults as per standard module
$Manifest = @{
@@ -29,7 +27,8 @@ Invoke-ModuleBuild -ModuleName 'GPOZaurr' {
}
New-ConfigurationManifest @Manifest
New-ConfigurationModule -Type RequiredModule -Name 'PSWriteColor', 'PSSharedGoods', 'ADEssentials', 'PSWriteHTML' -Guid Auto -Version Latest
New-ConfigurationModule -Type RequiredModule -Name 'PSWriteColor', 'PSSharedGoods', 'ADEssentials' -Guid Auto -Version Latest
New-ConfigurationModule -Type RequiredModule -Name "PSWriteHTML" -Guid Auto -Version "1.27.0"
#New-ConfigurationModule -Type ExternalModule -Name 'Microsoft.PowerShell.Utility', 'Microsoft.PowerShell.Management','Microsoft.PowerShell.Security'
New-ConfigurationModule -Type ApprovedModule -Name 'PSSharedGoods', 'PSWriteColor', 'Connectimo', 'PSUnifi', 'PSWebToolbox', 'PSMyPassword', 'ADEssentials'
@@ -211,7 +210,7 @@ Invoke-ModuleBuild -ModuleName 'GPOZaurr' {
# configuration for documentation, at the same time it enables documentation processing
New-ConfigurationDocumentation -Enable:$false -StartClean -UpdateWhenNew -PathReadme 'Docs\Readme.md' -Path 'Docs'
New-ConfigurationImportModule -ImportSelf
#New-ConfigurationImportModule -ImportSelf
New-ConfigurationBuild -Enable:$true -SignModule -MergeModuleOnBuild -MergeFunctionsFromApprovedModules -CertificateThumbprint '483292C9E317AA13B07BB7A96AE9D1A5ED9E7703'
+36
View File
@@ -1,5 +1,41 @@
# GPOZaurr Release History
## 1.1.9 - 2024.12.02
- Fixes `Invoke-GPOZaurr` when using SplitReports without path [#58](https://github.com/EvotecIT/GPOZaurr/issues/58)
## 1.1.8 - 2024.11.20
### What's new
- Added `RestrictedGroups` to GroupAnalysis
**Full Changelog**: https://github.com/EvotecIT/GPOZaurr/compare/v1.1.7...v1.1.8
## 1.1.7 - 2024.11.20
### What's Changed
- Added some additional logging to track down issue
## 1.1.6 - 2024.10.17
### What's Changed
* Improve HTML reports with `ScrollX`
* Improve HTML reports by hiding some unnesecary columns
* Added `SizeMB` and `Size` to reports around files/GPOs which could help analyze performance issues
* Other minor HTML fixes
* Fixed typo "Unfortunetly" -> "Unfortunately" by @davidmwilliams in https://github.com/EvotecIT/GPOZaurr/pull/61
* Minor typo correction "incosistent" -> "inconsistent" by @davidmwilliams in https://github.com/EvotecIT/GPOZaurr/pull/60
* Update Invoke.GPOZaurrDuplicate.ps1 by @SamErde in https://github.com/EvotecIT/GPOZaurr/pull/63
* Fix typo and grammar by @SamErde in https://github.com/EvotecIT/GPOZaurr/pull/64
### New Contributors
* @davidmwilliams made their first contribution in https://github.com/EvotecIT/GPOZaurr/pull/61
* @SamErde made their first contribution in https://github.com/EvotecIT/GPOZaurr/pull/63
**Full Changelog**: https://github.com/EvotecIT/GPOZaurr/compare/v1.1.5...v1.1.6
## 1.1.5 - 2024.07.06
* Added or improved help on all functions. by @neztach in https://github.com/EvotecIT/GPOZaurr/pull/56
### New Contributors
* @neztach made their first contribution in https://github.com/EvotecIT/GPOZaurr/pull/56
## 1.1.4 - 2024.06.11
- Small improvements & fixes
+221 -166
View File
@@ -8,7 +8,7 @@ schema: 2.0.0
# Invoke-GPOZaurrContent
## SYNOPSIS
{{ Fill in the Synopsis }}
Invokes GPOZaurrContent function to retrieve Group Policy Objects information.
## SYNTAX
@@ -17,92 +17,45 @@ schema: 2.0.0
Invoke-GPOZaurrContent [-Forest <String>] [-ExcludeDomains <String[]>] [-IncludeDomains <String[]>]
[-ExtendedForestInformation <IDictionary>] [-Type <String[]>] [-Splitter <String>] [-FullObjects]
[-OutputType <String[]>] [-OutputPath <String>] [-Open] [-Online] [-CategoriesOnly] [-SingleObject]
[-SkipNormalize] [-SkipCleanup] [-Extended] [<CommonParameters>]
[-SkipNormalize] [-SkipCleanup] [-Extended] [-GPOName <String[]>] [-GPOGUID <String[]>]
[-ProgressAction <ActionPreference>] [<CommonParameters>]
```
### Local
```
Invoke-GPOZaurrContent [-GPOPath <String>] [-Type <String[]>] [-Splitter <String>] [-FullObjects]
[-OutputType <String[]>] [-OutputPath <String>] [-Open] [-Online] [-CategoriesOnly] [-SingleObject]
[-SkipNormalize] [-SkipCleanup] [-Extended] [<CommonParameters>]
[-SkipNormalize] [-SkipCleanup] [-Extended] [-ProgressAction <ActionPreference>] [<CommonParameters>]
```
## DESCRIPTION
{{ Fill in the Description }}
This function retrieves Group Policy Objects information based on the specified parameters.
It can search for GPOs in a forest, exclude specific domains, include specific domains, and provide extended forest information.
## EXAMPLES
### Example 1
```powershell
PS C:\> {{ Add example code here }}
### EXAMPLE 1
```
Invoke-GPOZaurrContent -Forest "Contoso" -IncludeDomains "Domain1", "Domain2" -Type "Security" -OutputType "HTML" -OutputPath "C:\Reports\GPOReport.html"
Retrieves security-related Group Policy Objects information for the specified domains and saves the output as an HTML file.
```
{{ Add example description here }}
### EXAMPLE 2
```
Invoke-GPOZaurrContent -GPOPath "CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=Contoso,DC=com" -Type "All" -OutputType "Object"
Retrieves all information for a specific Group Policy Object and outputs the result as an object.
```
### EXAMPLE 3
```
Invoke-GPOZaurrContent -GPOName "Group Policy Test" -SingleObject | ConvertTo-Json -Depth 3
Quickly view GPO settings by name in JSON format for easy inspection.
```
## PARAMETERS
### -CategoriesOnly
{{ Fill CategoriesOnly Description }}
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```
### -ExcludeDomains
{{ Fill ExcludeDomains Description }}
```yaml
Type: String[]
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```
### -Extended
{{ Fill Extended Description }}
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```
### -ExtendedForestInformation
{{ Fill ExtendedForestInformation Description }}
```yaml
Type: IDictionary
Parameter Sets: Default
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```
### -Forest
{{ Fill Forest Description }}
Specifies the forest name to search for Group Policy Objects.
```yaml
Type: String
@@ -116,27 +69,12 @@ Accept pipeline input: False
Accept wildcard characters: False
```
### -FullObjects
{{ Fill FullObjects Description }}
### -ExcludeDomains
Specifies an array of domains to exclude from the search.
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```
### -GPOPath
{{ Fill GPOPath Description }}
```yaml
Type: String
Parameter Sets: Local
Type: String[]
Parameter Sets: Default
Aliases:
Required: False
@@ -147,7 +85,7 @@ Accept wildcard characters: False
```
### -IncludeDomains
{{ Fill IncludeDomains Description }}
Specifies an array of domains to include in the search.
```yaml
Type: String[]
@@ -161,12 +99,12 @@ Accept pipeline input: False
Accept wildcard characters: False
```
### -Online
{{ Fill Online Description }}
### -ExtendedForestInformation
Specifies additional information about the forest.
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Type: IDictionary
Parameter Sets: Default
Aliases:
Required: False
@@ -176,27 +114,12 @@ Accept pipeline input: False
Accept wildcard characters: False
```
### -Open
{{ Fill Open Description }}
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```
### -OutputPath
{{ Fill OutputPath Description }}
### -GPOPath
Specifies the path to a specific Group Policy Object.
```yaml
Type: String
Parameter Sets: (All)
Parameter Sets: Local
Aliases:
Required: False
@@ -206,59 +129,13 @@ Accept pipeline input: False
Accept wildcard characters: False
```
### -OutputType
{{ Fill OutputType Description }}
### -Type
Specifies the type of information to retrieve.
```yaml
Type: String[]
Parameter Sets: (All)
Aliases:
Accepted values: HTML, Object
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```
### -SingleObject
{{ Fill SingleObject Description }}
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```
### -SkipCleanup
{{ Fill SkipCleanup Description }}
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```
### -SkipNormalize
{{ Fill SkipNormalize Description }}
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
@@ -268,7 +145,52 @@ Accept wildcard characters: False
```
### -Splitter
{{ Fill Splitter Description }}
Specifies the delimiter to use for splitting information.
```yaml
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: [System.Environment]::NewLine
Accept pipeline input: False
Accept wildcard characters: False
```
### -FullObjects
Indicates whether to retrieve full objects.
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```
### -OutputType
Specifies the type of output (HTML or Object).
```yaml
Type: String[]
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: Object
Accept pipeline input: False
Accept wildcard characters: False
```
### -OutputPath
Specifies the path to save the output.
```yaml
Type: String
@@ -282,12 +204,133 @@ Accept pipeline input: False
Accept wildcard characters: False
```
### -Type
{{ Fill Type Description }}
### -Open
Indicates whether to open the output after retrieval.
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```
### -Online
Indicates whether to retrieve information online.
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```
### -CategoriesOnly
Indicates whether to retrieve only categories.
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```
### -SingleObject
When enabled, returns a single consolidated object per GPO rather than multiple objects for each setting. For example, with drive mappings, instead of returning separate objects for each mapped drive in a GPO, it will return one object containing all drive mappings for that GPO. This affects how the data is structured in the output reports.
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```
### -SkipNormalize
Indicates whether to skip normalization.
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```
### -SkipCleanup
Indicates whether to skip cleanup of the output hashtable. When enabled, empty values in the output hashtable are preserved rather than being removed via Remove-EmptyValue. This parameter affects the final processing step before returning GPO analysis results.
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```
### -Extended
When enabled, returns the complete output hashtable containing all GPO analysis data, including both the processed reports and raw categories. By default, only the processed reports are returned. This parameter is useful for debugging or when you need access to the underlying data structure.
```yaml
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```
### -GPOName
Specifies the name of the Group Policy Object to retrieve. The alias of this parameter is `Name`.
```yaml
Type: String[]
Parameter Sets: (All)
Parameter Sets: Default
Aliases: Name
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```
### -GPOGUID
Specifies one or more Group Policy Object GUIDs to retrieve. This parameter allows you to target specific GPOs by their unique identifier rather than display name.
```yaml
Type: String[]
Parameter Sets: Default
Aliases:
Required: False
@@ -297,16 +340,28 @@ Accept pipeline input: False
Accept wildcard characters: False
```
### -ProgressAction
Specifies the action to take when progress is reported.
```yaml
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```
### CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
## INPUTS
### None
## OUTPUTS
### System.Object
## NOTES
## RELATED LINKS
+1 -1
View File
@@ -3,5 +3,5 @@
#$GPOS = Get-GPOZaurr -GPOName 'TEST | Office Configuration'
#$GPOS | Format-Table -AutoSize *
$GPOS = Get-GPOZaurr -GPOName 'New Group Policy Object3'
$GPOS = Get-GPOZaurr -GPOName 'TEST | EmptyWITHGPF'
$GPOS | Format-Table -AutoSize *
+10 -1
View File
@@ -2,7 +2,16 @@
# This gets the same thing as earlier examples
# with a difference where one entry per gpo and all settings for that GPO is stored under settings property.
$Output = Invoke-GPOZaurrContent -Verbose #-SingleObject -Verbose
#$Output = Invoke-GPOZaurrContent -Verbose #-SingleObject -Verbose
#$Output | Format-Table
$Output = Invoke-GPOZaurrContent -Verbose -GPOName 'Default Domain Policy'
$Output | Format-Table
Invoke-GPOZaurr -Type GPOAnalysis -GPOName 'Default Domain Policy' -Verbose
return
$Output.Reports.RegistrySettings | Format-Table *
$Output.Reports.RegistrySettings[0].Settings | Format-Table *
+3 -2
View File
@@ -1,4 +1,5 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
$Files = Get-GPOZaurrFiles -Limited -Signature
$Files | ConvertTo-Excel -OpenWorkBook -FilePath $Env:USERPROFILE\Desktop\GPOTesting.xlsx -ExcelWorkSheetName 'GPO Output' -AutoFilter -AutoFit -FreezeTopRowFirstColumn
$Files = Get-GPOZaurrFiles -Type All -Verbose
#$Files | ConvertTo-Excel -OpenWorkBook -FilePath $Env:USERPROFILE\Desktop\GPOTesting.xlsx -ExcelWorkSheetName 'GPO Output' -AutoFilter -AutoFit -FreezeTopRowFirstColumn
$Files | Format-Table
@@ -4,7 +4,7 @@
#$Objects = Get-GPOZaurrInheritance
#$Objects | Format-Table
# Get same output DN, CanonicalName, BlockInheritance (True/False) + Users/Computers + UsersCount/ComputerCount for those with Blocked Inhertiance
# Get same output DN, CanonicalName, BlockInheritance (True/False) + Users/Computers + UsersCount/ComputerCount for those with Blocked Inheritance
# This is so you can have a list what machines are affected
$ExcludedOU = @(
# Works on OU/
+24 -13
View File
@@ -1,19 +1,30 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
Invoke-GPOZaurr -Type GPOOrganizationalUnit -Online -FilePath $PSScriptRoot\Reports\GPOZaurr.html
# # Shows how to use exclusions for GPOList (different way)
# Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Type GPOList -Online -Exclusions {
# Skip-GroupPolicy -Name 'de14_usr_std'
# Skip-GroupPolicy -Name 'ALL | Enable RDP' -DomaiName 'ad.evotec.xyz'
# '01446204-d2b5-4c9a-a539-5d0f64f27fbc'
# '{01cef2e1-ea5c-4c4a-bd43-94d89d8a7810}'
# }
# Shows how to use exclusions (supported only in GPOBlockedInheritance)
Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Type GPOBlockedInheritance -Online -Exclusions @(
'OU=Test,OU=ITR02,DC=ad,DC=evotec,DC=xyz'
)
# Invoke-GPOZaurr -Type GPOOrganizationalUnit -Online -FilePath $PSScriptRoot\Reports\GPOZaurr.html
# different approach to query multiple reports or just one
Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -PassThru -Type GPOConsistency, GPOList, GPODuplicates, GPOBroken, GPOOwners, NetLogonOwners, GPOPermissionsRead, GPOPermissionsAdministrative,GPOPermissionsUnknown
# # Shows how to use exclusions (supported only in GPOBlockedInheritance)
# Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Type GPOBlockedInheritance -Online -Exclusions @(
# 'OU=Test,OU=ITR02,DC=ad,DC=evotec,DC=xyz'
# )
Invoke-GPOZaurr -Type GPOOwners -Online -FilePath $PSScriptRoot\Reports\GPOZaurr.html
# # different approach to query multiple reports or just one
# Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -PassThru -Type GPOConsistency, GPOList, GPODuplicates, GPOBroken, GPOOwners, NetLogonOwners, GPOPermissionsRead, GPOPermissionsAdministrative, GPOPermissionsUnknown
# Shows how to use exclusions for GPOList (different way)
Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Type GPOList -Online -Exclusions {
Skip-GroupPolicy -Name 'de14_usr_std'
Skip-GroupPolicy -Name 'ALL | Enable RDP' -DomaiName 'ad.evotec.xyz'
}
#Invoke-GPOZaurr -Type GPOOwners,GPOConsistency -Online -FilePath $PSScriptRoot\Reports\GPOZaurr.html
#Invoke-GPOZaurr -Type GPOOwners -Online -FilePath $PSScriptRoot\Reports\GPOZaurr.html
##Invoke-GPOZaurr -Type GPOOwners,GPOConsistency -Online -FilePath $PSScriptRoot\Reports\GPOZaurr.html -SplitReports
#invoke-gpozaurr -Type GPOOrganizationalUnit
#Invoke-GPOZaurr -Online -FilePath $PSScriptRoot\Reports\GPOZaurr.html -Type GPOAnalysis #-SplitReports -Forest test.evotec.pl
Invoke-GPOZaurr -FilePath $PSScriptRoot\Reports\GPOZaurr.html # -Verbose #-Type GPOBlockedInheritance -Forest 'ad.evotec.xyz'
+16
View File
@@ -0,0 +1,16 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
#Save-GPOZaurrFiles -GPOPath $Env:USERPROFILE\Desktop\TestF
#Get-GPOZaurr -GPOPath "$Env:USERPROFILE\Desktop\TestF" | Sort-Object -Property DisplayName | Where-Object { $_.EMpty -eq $true } | Format-Table *
return
$GPO = Get-GPOZaurr -GPOName 'ALL | Allow use of biometrics'
$GPO | Format-List *
#$GPO.Count
#$GPO | Where-Object { $_.Empty -eq $true } | Format-Table *
#($GPO | Where-Object { $_.Empty -eq $true }).Count
#$GPO | Where-Object { $_.DisplayName -like "*TEST*" } | Format-Table *
+1 -4
View File
@@ -3,12 +3,9 @@
$Output = Invoke-GPOZaurrContent -Verbose -GPOName 'Default Domain Policy'
$Output | Format-Table
<#
# You need PSWriteOffice for that
foreach ($Key in $Output.Keys) {
$Output[$Key] | Export-OfficeExcel -FilePath $Env:USERPROFILE\Desktop\GPOAnalysis.xlsx -WorkSheetName $Key
}
Invoke-GPOZaurr -Type GPOAnalysis -GPOName 'ALL | Allow use of biometrics', 'ALL | Enable RDP' -GPOGUID '{31B2F340-016D-11D2-945F-00C04FB984F9}' -IncludeDomains 'ad.evotec.xyz' -Verbose
#>
Invoke-GPOZaurr -Type GPOAnalysis -GPOName 'ALL | Allow use of biometrics', 'ALL | Enable RDP' -GPOGUID '{31B2F340-016D-11D2-945F-00C04FB984F9}' -IncludeDomains 'ad.evotec.xyz' -Verbose
+4
View File
@@ -0,0 +1,4 @@
Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
Get-GPOZaurrDuplicateObject -Verbose
+1 -1
View File
@@ -3097,7 +3097,7 @@ Import-Module GPOZaurr -Force</pre><div class="defaultText"><span>Using force ma
"When executed it will take a while to generate all data and provide you with new report depending on size of environment."
"Once confirmed that data is still showing issues and requires fixing please proceed with next step."
</span></div><div class="defaultText"><span>Alternatively if you prefer working with console you can run: </span></div><pre data-enlighter-language="powershell">$GPOOutput = Get-GPOZaurrPermissionConsistency
$GPOOutput | Format-Table # do your actions as desired</pre><div class="defaultText"><span>It provides same data as you see in table above just doesn't prettify it for you.</span></div></div><div style="padding:0px" id="WizardStep-0tiejcyn" class="tab-pane flexElement" role="tabpanel"><div class="defaultText"><span>Following command when executed fixes inconsistent permissions.</span></div><div class="defaultText"><span style="color:#000000;font-weight:normal">Make sure when running it for the first time to run it with </span><span style="color:#ff0000;font-weight:bold">WhatIf</span><span style="color:#000000;font-weight:normal"> parameter as shown below to prevent accidental removal.</span></div><div class="defaultText"><span>Make sure to fill in TargetDomain to match your Domain Admin permission account</span></div><pre data-enlighter-language="powershell">Repair-GPOZaurrPermissionConsistency -IncludeDomains "TargetDomain" -Verbose -WhatIf</pre><div class="defaultText"><span>After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. Once happy with results please follow with command: </span></div><pre data-enlighter-language="powershell">Repair-GPOZaurrPermissionConsistency -LimitProcessing 2 -IncludeDomains "TargetDomain"</pre><div class="defaultText"><span>This command when executed repairs only first X inconsistent permissions. Use LimitProcessing parameter to prevent mass fixing and increase the counter when no errors occur. </span><span>Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly. </span></div><div class="defaultText"><span>If there's nothing else to be fixed, we can skip to next step step</span></div></div><div style="padding:0px" id="WizardStep-rj10lm2s" class="tab-pane flexElement" role="tabpanel"><div class="defaultText"><span>Unfortunetly this step is manual until automation is developed. </span></div><div class="defaultText"><span>If there are inconsistent permissions found inside GPO one has to fix them manually by going into SYSVOL and making sure inheritance is enabled, and that permissions are consistent across all files.</span></div></div><div style="padding:0px" id="WizardStep-xg65antb" class="tab-pane flexElement" role="tabpanel"><div class="defaultText"><span>Once cleanup task was executed properly, we need to verify that report now shows no problems.</span></div><pre data-enlighter-language="powershell">Invoke-GPOZaurr -FilePath $Env:UserProfile\Desktop\GPOZaurrPermissionsInconsistentAfter.html -Verbose -Type GPOConsistency</pre><div class="defaultText"><span style="color:#4d1a7f">If everything is healthy in the report you're done! Enjoy rest of the day!</span></div></div></div><script> $(document).ready(function(){
$GPOOutput | Format-Table # do your actions as desired</pre><div class="defaultText"><span>It provides same data as you see in table above just doesn't prettify it for you.</span></div></div><div style="padding:0px" id="WizardStep-0tiejcyn" class="tab-pane flexElement" role="tabpanel"><div class="defaultText"><span>Following command when executed fixes inconsistent permissions.</span></div><div class="defaultText"><span style="color:#000000;font-weight:normal">Make sure when running it for the first time to run it with </span><span style="color:#ff0000;font-weight:bold">WhatIf</span><span style="color:#000000;font-weight:normal"> parameter as shown below to prevent accidental removal.</span></div><div class="defaultText"><span>Make sure to fill in TargetDomain to match your Domain Admin permission account</span></div><pre data-enlighter-language="powershell">Repair-GPOZaurrPermissionConsistency -IncludeDomains "TargetDomain" -Verbose -WhatIf</pre><div class="defaultText"><span>After execution please make sure there are no errors, make sure to review provided output, and confirm that what is about to be deleted matches expected data. Once happy with results please follow with command: </span></div><pre data-enlighter-language="powershell">Repair-GPOZaurrPermissionConsistency -LimitProcessing 2 -IncludeDomains "TargetDomain"</pre><div class="defaultText"><span>This command when executed repairs only first X inconsistent permissions. Use LimitProcessing parameter to prevent mass fixing and increase the counter when no errors occur. </span><span>Repeat step above as much as needed increasing LimitProcessing count till there's nothing left. In case of any issues please review and action accordingly. </span></div><div class="defaultText"><span>If there's nothing else to be fixed, we can skip to next step step</span></div></div><div style="padding:0px" id="WizardStep-rj10lm2s" class="tab-pane flexElement" role="tabpanel"><div class="defaultText"><span>Unfortunately this step is manual until automation is developed. </span></div><div class="defaultText"><span>If there are inconsistent permissions found inside GPO one has to fix them manually by going into SYSVOL and making sure inheritance is enabled, and that permissions are consistent across all files.</span></div></div><div style="padding:0px" id="WizardStep-xg65antb" class="tab-pane flexElement" role="tabpanel"><div class="defaultText"><span>Once cleanup task was executed properly, we need to verify that report now shows no problems.</span></div><pre data-enlighter-language="powershell">Invoke-GPOZaurr -FilePath $Env:UserProfile\Desktop\GPOZaurrPermissionsInconsistentAfter.html -Verbose -Type GPOConsistency</pre><div class="defaultText"><span style="color:#4d1a7f">If everything is healthy in the report you're done! Enjoy rest of the day!</span></div></div></div><script> $(document).ready(function(){
// SmartWizard initialize
$('#TabPanel-fbsgNINg').smartWizard({
"autoAdjustHeight": false,
+7 -6
View File
@@ -4,35 +4,36 @@
CmdletsToExport = @()
CompanyName = 'Evotec'
CompatiblePSEditions = @('Desktop')
Copyright = '(c) 2011 - 2024 Przemyslaw Klys @ Evotec. All rights reserved.'
Copyright = '(c) 2011 - 2025 Przemyslaw Klys @ Evotec. All rights reserved.'
Description = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
FunctionsToExport = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Export-GPOZaurrContent', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrBrokenLink', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrMissingFiles', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOrganizationalUnit', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionAnalysis', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrRedirect', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrUpdates', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrLinkEmptyOU', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrBrokenLink', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermission', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Set-GPOZaurrStatus', 'Skip-GroupPolicy')
GUID = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
ModuleVersion = '1.1.4'
ModuleVersion = '1.1.10'
PowerShellVersion = '5.1'
PrivateData = @{
PSData = @{
ExternalModuleDependencies = @('CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility', 'Microsoft.PowerShell.Security')
ProjectUri = 'https://github.com/EvotecIT/GPOZaurr'
RequireLicenseAcceptance = $false
Tags = @('Windows', 'ActiveDirectory', 'GPO', 'GroupPolicy')
}
}
RequiredModules = @(@{
Guid = '0b0ba5c5-ec85-4c2b-a718-874e55a8bc3f'
ModuleName = 'PSWriteColor'
ModuleVersion = '1.0.1'
ModuleVersion = '1.0.3'
}, @{
Guid = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
ModuleName = 'PSSharedGoods'
ModuleVersion = '0.0.291'
ModuleVersion = '0.0.312'
}, @{
Guid = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
ModuleName = 'ADEssentials'
ModuleVersion = '0.0.213'
ModuleVersion = '0.0.267'
}, @{
Guid = 'a7bdf640-f5cb-4acf-9de0-365b322d245c'
ModuleName = 'PSWriteHTML'
ModuleVersion = '1.19.0'
ModuleVersion = '1.27.0'
}, 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility', 'Microsoft.PowerShell.Security')
RootModule = 'GPOZaurr.psm1'
}
+4 -4
View File
@@ -13,7 +13,7 @@ if ($AssemblyFolders.BaseName -contains 'Standard') {
}
}
$FoundErrors = @(
Foreach ($Import in @($Assembly)) {
foreach ($Import in @($Assembly)) {
try {
Add-Type -Path $Import.Fullname -ErrorAction Stop
} catch [System.Reflection.ReflectionTypeLoadException] {
@@ -35,10 +35,10 @@ $FoundErrors = @(
}
}
#Dot source the files
Foreach ($Import in @($Private + $Public)) {
Try {
foreach ($Import in @($Private + $Public)) {
try {
. $Import.Fullname
} Catch {
} catch {
Write-Error -Message "Failed to import functions from $($import.Fullname): $_"
$true
}
+77
View File
@@ -0,0 +1,77 @@
function ConvertTo-XMLRestrictedGroups {
[cmdletBinding()]
param(
[PSCustomObject] $GPO,
[switch] $SingleObject
)
if ($SingleObject) {
$CreateGPO = [ordered]@{
DisplayName = $GPO.DisplayName
DomainName = $GPO.DomainName
GUID = $GPO.GUID
GpoType = $GPO.GpoType
#GpoCategory = $GPOEntry.GpoCategory
#GpoSettings = $GPOEntry.GpoSettings
Count = 0
Settings = $null
}
[Array] $CreateGPO['Settings'] = foreach ($Script in $GPO.DataSet) {
$Members = foreach ($Member in $Group.Member) {
if ($($Member.SID.'#text')) {
"$($Member.Name.'#text') ($($Member.SID.'#text'))"
} else {
$Member.Name.'#text'
}
}
$MemberOf = foreach ($Member in $Group.MemberOf) {
if ($($Member.SID.'#text')) {
"$($Member.Name.'#text') ($($Member.SID.'#text'))"
} else {
$Member.Name.'#text'
}
}
[PSCustomObject]@{
GroupName = $Group.GroupName.Name
GroupSID = $Group.GroupName.SID.'#text'
Members = $Members -join ', '
MembersOf = $MemberOf -join ', '
}
}
$CreateGPO['DataCount'] = $CreateGPO['Settings'].Count
$CreateGPO['Linked'] = $GPO.Linked
$CreateGPO['LinksCount'] = $GPO.LinksCount
$CreateGPO['Links'] = $GPO.Links
[PSCustomObject] $CreateGPO
} else {
foreach ($Group in $GPO.DataSet) {
$Members = foreach ($Member in $Group.Member) {
if ($($Member.SID.'#text')) {
"$($Member.Name.'#text') ($($Member.SID.'#text'))"
} else {
$Member.Name.'#text'
}
}
$MemberOf = foreach ($Member in $Group.MemberOf) {
if ($($Member.SID.'#text')) {
"$($Member.Name.'#text') ($($Member.SID.'#text'))"
} else {
$Member.Name.'#text'
}
}
$CreateGPO = [ordered]@{
DisplayName = $GPO.DisplayName
DomainName = $GPO.DomainName
GUID = $GPO.GUID
GpoType = $GPO.GpoType
GroupName = $Group.GroupName.Name.'#text'
GroupSID = $Group.GroupName.SID.'#text'
Members = $Members -join ', '
MembersOf = $MemberOf -join ', '
}
$CreateGPO['Linked'] = $GPO.Linked
$CreateGPO['LinksCount'] = $GPO.LinksCount
$CreateGPO['Links'] = $GPO.Links
[PSCustomObject] $CreateGPO
}
}
}
+56 -52
View File
@@ -220,12 +220,14 @@
# if there are any, then we can't say that GPO is empty, and they are not visible in the XML
$GPFFile = $false
$FilesCount = 0
$TotalSize = 0
Get-ChildItem -LiteralPath $SysvolGpoPath -Recurse -ErrorAction SilentlyContinue -File | ForEach-Object {
if ($_.Extension -eq '.gpf') {
#Write-Warning -Message "Get-XMLGPO - GPO [$DisplayName/$DomainName] has no data in XML, but it contains GPF files. Excluding from empty GPO list."
$GPFFile = $true
}
$FilesCount++
$TotalSize += $_.Length
}
if ($ComputerSettingsAvailable -eq $false -and $UserSettingsAvailable -eq $false -and $GPFFile -eq $false) {
@@ -352,56 +354,58 @@
}
} else {
$GPOOutput = [PsCustomObject] @{
'DisplayName' = $XMLContent.GPO.Name
'DomainName' = $XMLContent.GPO.Identifier.Domain.'#text'
'GUID' = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
'Days' = (New-TimeSpan -Start ([DateTime] $XMLContent.GPO.ModifiedTime) -End (Get-Date)).Days
'Empty' = $Empty
'Linked' = $Linked
'Enabled' = $EnabledBool
'Optimized' = $Optimized
'Problem' = $Problem
'ApplyPermission' = $null
'Exclude' = $Exclude
'Description' = $GPO.Description
'ComputerPolicies' = $XMLContent.GPO.Computer.ExtensionData.Name -join ", "
'UserPolicies' = $XMLContent.GPO.User.ExtensionData.Name -join ", "
'FilesCount' = $FilesCount
'LinksCount' = $LinksTotalCount
'LinksEnabledCount' = $LinksEnabledCount
'LinksDisabledCount' = $LinksDisabledCount
'EnabledDetails' = $Enabled
'ComputerProblem' = $ComputerProblem
'ComputerOptimized' = $ComputerOptimized
'UserProblem' = $UserProblem
'UserOptimized' = $UserOptimized
'ComputerSettingsAvailable' = $ComputerSettingsAvailable
'UserSettingsAvailable' = $UserSettingsAvailable
'DisplayName' = $XMLContent.GPO.Name
'DomainName' = $XMLContent.GPO.Identifier.Domain.'#text'
'GUID' = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
'Days' = (New-TimeSpan -Start ([DateTime] $XMLContent.GPO.ModifiedTime) -End (Get-Date)).Days
'Empty' = $Empty
'Linked' = $Linked
'Enabled' = $EnabledBool
'Optimized' = $Optimized
'Problem' = $Problem
'ApplyPermission' = $null
'Exclude' = $Exclude
'SizeMB' = [Math]::Round($TotalSize / 1MB, 2)
'Size' = $TotalSize
'Description' = $GPO.Description
'ComputerPolicies' = $XMLContent.GPO.Computer.ExtensionData.Name -join ", "
'UserPolicies' = $XMLContent.GPO.User.ExtensionData.Name -join ", "
'FilesCount' = $FilesCount
'LinksCount' = $LinksTotalCount
'LinksEnabledCount' = $LinksEnabledCount
'LinksDisabledCount' = $LinksDisabledCount
'EnabledDetails' = $Enabled
'ComputerProblem' = $ComputerProblem
'ComputerOptimized' = $ComputerOptimized
'UserProblem' = $UserProblem
'UserOptimized' = $UserOptimized
'ComputerSettingsAvailable' = $ComputerSettingsAvailable
'UserSettingsAvailable' = $UserSettingsAvailable
#'ComputerSettingsAvailableReal' = $ComputerSettingsAvailableReal
#'UserSettingsAvailableReal' = $UserSettingsAvailableReal
'ComputerSettingsTypes' = $OutputComputer.Name -join ", "
'UserSettingsTypes' = $OutputUser.Name -join ", "
'ComputerEnabled' = $ComputerEnabled
'UserEnabled' = $UserEnabled
'ComputerSettingsStatus' = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
'ComputerSetttingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false }
'ComputerSettings' = $XMLContent.GPO.Computer.ExtensionData.Extension
'UserSettingsStatus' = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
'UserSettingsVersionIdentical' = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
'UserSettings' = $XMLContent.GPO.User.ExtensionData.Extension
'NoSettings' = $NoSettings
'CreationTime' = [DateTime] $XMLContent.GPO.CreatedTime
'ModificationTime' = [DateTime] $XMLContent.GPO.ModifiedTime
'ReadTime' = [DateTime] $XMLContent.GPO.ReadTime
'WMIFilter' = $GPO.WmiFilter.name
'WMIFilterDescription' = $GPO.WmiFilter.Description
'GPODistinguishedName' = $GPO.Path
'GPOSysvolPath' = $SysvolGpoPath
'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
'Owner' = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
'OwnerSID' = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
'OwnerType' = $OwnerType
'ACL' = @(
'ComputerSettingsTypes' = $OutputComputer.Name -join ", "
'UserSettingsTypes' = $OutputUser.Name -join ", "
'ComputerEnabled' = $ComputerEnabled
'UserEnabled' = $UserEnabled
'ComputerSettingsStatus' = if ($XMLContent.GPO.Computer.VersionDirectory -eq 0 -and $XMLContent.GPO.Computer.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
'ComputerSettingsVersionIdentical' = if ($XMLContent.GPO.Computer.VersionDirectory -eq $XMLContent.GPO.Computer.VersionSysvol) { $true } else { $false }
'ComputerSettings' = $XMLContent.GPO.Computer.ExtensionData.Extension
'UserSettingsStatus' = if ($XMLContent.GPO.User.VersionDirectory -eq 0 -and $XMLContent.GPO.User.VersionSysvol -eq 0) { "NeverModified" } else { "Modified" }
'UserSettingsVersionIdentical' = if ($XMLContent.GPO.User.VersionDirectory -eq $XMLContent.GPO.User.VersionSysvol) { $true } else { $false }
'UserSettings' = $XMLContent.GPO.User.ExtensionData.Extension
'NoSettings' = $NoSettings
'CreationTime' = [DateTime] $XMLContent.GPO.CreatedTime
'ModificationTime' = [DateTime] $XMLContent.GPO.ModifiedTime
'ReadTime' = [DateTime] $XMLContent.GPO.ReadTime
'WMIFilter' = $GPO.WmiFilter.name
'WMIFilterDescription' = $GPO.WmiFilter.Description
'GPODistinguishedName' = $GPO.Path
'GPOSysvolPath' = $SysvolGpoPath
'SDDL' = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
'Owner' = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
'OwnerSID' = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
'OwnerType' = $OwnerType
'ACL' = @(
[PsCustomObject] @{
'Name' = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
'Sid' = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
@@ -421,10 +425,10 @@
}
}
)
'Auditing' = if ($XMLContent.GPO.SecurityDescriptor.AuditingPresent.'#text' -eq 'true') { $true } else { $false }
'Links' = $Links
'LinksObjects' = $LinksObjects
'GPOObject' = $GPO
'Auditing' = if ($XMLContent.GPO.SecurityDescriptor.AuditingPresent.'#text' -eq 'true') { $true } else { $false }
'Links' = $Links
'LinksObjects' = $LinksObjects
'GPOObject' = $GPO
}
if ($GPOOutput.ACL) {
$GPOOutput.ApplyPermission = $false
+1 -1
View File
@@ -18,7 +18,7 @@
Solution = {
foreach ($Key in $Script:Reporting['GPOAnalysis']['Data'].Keys) {
New-HTMLTab -Name $Key {
New-HTMLTable -DataTable $Script:Reporting['GPOAnalysis']['Data'][$Key] -Filtering -Title $Key
New-HTMLTable -DataTable $Script:Reporting['GPOAnalysis']['Data'][$Key] -Filtering -Title $Key -ScrollX
}
}
if ($Script:Reporting['GPOAnalysis']['WarningsAndErrors']) {
@@ -1,5 +1,5 @@
$GPOZaurrBlockedInheritance = [ordered] @{
Name = 'Group Policy Blocked Inhertiance'
Name = 'Group Policy Blocked Inheritance'
Enabled = $true
ActionRequired = $null
Data = $null
@@ -80,7 +80,7 @@
"As GPOs can be inherited by default, they can also be blocked, if required using the Block Inheritance. "
"If the Block Inheritance setting is enabled, the inheritance of group policy setting is blocked. "
"This setting is mostly used when the OU contains users or computers that require different settings than what is applied to the domain level. "
"Unfortunetly blocking inheritance can have serious security consequences. "
"Unfortunately blocking inheritance can have serious security consequences. "
)
New-HTMLText -Text @(
'As it stands currently there are ',
@@ -154,14 +154,14 @@
New-TableCondition -Name 'ComputersCount' -Value 0
} -BackgroundColor Salmon -FailBackgroundColor Amber -HighlightHeaders 'UsersCount', 'ComputersCount'
New-TableColumnOption -Hidden $true -ColumnIndex 8
} -PagingOptions 5, 10, 20, 30, 40, 50 -ExcludeProperty GroupPolicies
} -PagingOptions 5, 10, 20, 30, 40, 50 -ExcludeProperty GroupPolicies -ScrollX
}
New-HTMLSection -Name 'Group Policies affecting objects in Organizational Units with Blocked Inheritance' {
New-HTMLTable -DataTable $Script:Reporting['GPOBlockedInheritance']['Data'].GroupPolicies -Filtering {
New-TableCondition -Name 'Enabled' -Value $true -BackgroundColor SpringGreen -FailBackgroundColor Salmon
New-TableCondition -Name 'Enforced' -Value $true -BackgroundColor Amber -FailBackgroundColor AirForceBlue
New-TableCondition -Name 'LinkedDirectly' -Value $true -BackgroundColor Amber -FailBackgroundColor AirForceBlue
} -PagingOptions 5, 10, 20, 30, 40, 50 -DataTableID 'TableWithGroupPoliciesBlockedInheritance'
} -PagingOptions 5, 10, 20, 30, 40, 50 -DataTableID 'TableWithGroupPoliciesBlockedInheritance' -ScrollX
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix - Organizational Units with Group Policy Blocked Inheritance' {
+1 -1
View File
@@ -76,7 +76,7 @@ $GPOZaurrBrokenLink = [ordered] @{
New-HTMLSection -Name 'Group Policy Broken Links' {
New-HTMLTable -DataTable $Script:Reporting['GPOBrokenLink']['Data'] -Filtering {
} -PagingOptions 10, 20, 30, 40, 50
} -PagingOptions 7, 15, 30, 45, 60 -ScrollX
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to remove Broken Links' {
+4 -4
View File
@@ -40,7 +40,7 @@
New-HTMLListItem -Text 'Inconsistent top level permissions: ', $Script:Reporting['GPOConsistency']['Variables']['Inconsistent'] -FontWeight normal, bold
New-HTMLListItem -Text "Inconsistent inherited permissions: ", $Script:Reporting['GPOConsistency']['Variables']['InconsistentInside'] -FontWeight normal, bold
} -FontSize 10pt
New-HTMLText -FontSize 10pt -Text 'Having incosistent permissions on AD in comparison to those on SYSVOL can lead to uncontrolled ability to modify them.'
New-HTMLText -FontSize 10pt -Text 'Having inconsistent permissions on AD in comparison to those on SYSVOL can lead to uncontrolled ability to modify them.'
New-HTMLChart {
New-ChartLegend -Names 'Bad', 'Good' -Color PaleGreen, Salmon
New-ChartBarOptions -Type barStacked
@@ -66,7 +66,7 @@
New-HTMLListItem -Text 'Inconsistent top level permissions: ', $Script:Reporting['GPOConsistency']['Variables']['Inconsistent'] -FontWeight normal, bold
New-HTMLListItem -Text "Inconsistent inherited permissions: ", $Script:Reporting['GPOConsistency']['Variables']['InconsistentInside'] -FontWeight normal, bold
} -FontSize 10pt
New-HTMLText -FontSize 10pt -Text 'Having incosistent permissions on AD in comparison to those on SYSVOL can lead to uncontrolled ability to modify them. Please notice that if ', `
New-HTMLText -FontSize 10pt -Text 'Having inconsistent permissions on AD in comparison to those on SYSVOL can lead to uncontrolled ability to modify them. Please notice that if ', `
' Not available ', 'is visible in the table you should first fix related, more pressing issue, before fixing permissions inconsistency.' -FontWeight normal, bold, normal
}
Solution = {
@@ -91,7 +91,7 @@
New-HTMLTableCondition -Name 'ACLConsistentInside' -Value $true -BackgroundColor PaleGreen -TextTransform capitalize -ComparisonType string
New-HTMLTableCondition -Name 'ACLConsistent' -Value 'Not available' -BackgroundColor Crimson -ComparisonType string
New-HTMLTableCondition -Name 'ACLConsistentInside' -Value 'Not available' -BackgroundColor Crimson -ComparisonType string
} -PagingOptions 10, 20, 30, 40, 50
} -PagingOptions 7, 15, 30, 45, 60 -ScrollX -ExcludeProperty 'UserVersion', 'ComputerVersion', 'WmiFilter', 'ACLConsistentInsideDetails'
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix - Permissions Consistency' {
@@ -145,7 +145,7 @@
}
New-HTMLWizardStep -Name 'Fix inconsistent downlevel permissions' {
New-HTMLText -Text @(
"Unfortunetly this step is manual until automation is developed. "
"Unfortunately this step is manual until automation is developed. "
"If there are inconsistent permissions found inside GPO one has to fix them manually by going into SYSVOL and making sure inheritance is enabled, and that permissions are consistent across all files."
"Please keep in mind that it's possible inconsistent downlevel permissions fix will not be required once the top level fix is applied. "
"Rerun report to find out if you've just fixed top-level permissions. "
+3 -3
View File
@@ -29,7 +29,7 @@
"CNF objects, Conflict objects or Duplicate Objects are created in Active Directory when there is simultaneous creation of an AD object under the same container "
"on two separate Domain Controllers near about the same time or before the replication occurs. "
"This results in a conflict and the same is exhibited by a CNF (Duplicate) object. "
"While it doesn't nessecary has a huge impact on Active Directory it's important to keep Active Directory in proper, healthy state. "
"While it doesn't nessecarily have a huge impact on Active Directory, it's important to keep Active Directory in proper, healthy state. "
}
New-HTMLText -Text 'As it stands currently there are ', $Script:Reporting['GPODuplicates']['Data'].Count, ' CNF (Duplicate) Group Policy objects to be deleted.' -FontSize 10pt -FontWeight normal, bold, normal
}
@@ -48,7 +48,7 @@
New-HTMLSection -Name 'Group Policy CNF (Duplicate) Objects' {
New-HTMLTable -DataTable $Script:Reporting['GPODuplicates']['Data'] -Filtering {
} -PagingOptions 10, 20, 30, 40, 50
} -PagingOptions 7, 15, 30, 45, 60 -ScrollX
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix - Remove duplicate (CNF) objects' {
@@ -120,4 +120,4 @@
}
}
}
}
}
+6 -1
View File
@@ -16,7 +16,12 @@
}
Solution = {
New-HTMLTable -DataTable $Script:Reporting['GPOFiles']['Data'] -Filtering
New-HTMLTable -DataTable $Script:Reporting['GPOFiles']['Data'] -Filtering -ScrollX -PagingOptions 7, 15, 30, 45, 60 {
New-HTMLTableCondition -Name 'SuggestedAction' -Value 'Requires verification' -BackgroundColor YellowOrange -ComparisonType string
New-HTMLTableCondition -Name 'SuggestedAction' -Value 'Consider deleting' -BackgroundColor Salmon -ComparisonType string
New-HTMLTableCondition -Name 'SuggestedAction' -Value 'GPO requires cleanup' -BackgroundColor RedRobin -ComparisonType string
New-HTMLTableCondition -Name 'SuggestedAction' -Value 'Skip assesment' -BackgroundColor LightGreen -ComparisonType string
}
if ($Script:Reporting['GPOFiles']['WarningsAndErrors']) {
New-HTMLSection -Name 'Warnings & Errors to Review' {
New-HTMLTable -DataTable $Script:Reporting['GPOFiles']['WarningsAndErrors'] -Filtering {
+11 -11
View File
@@ -1,12 +1,12 @@
$GPOZaurrGPORedirects = [ordered] @{
Name = 'Group Policies With Redirected SYSVOL'
Enabled = $false
ActionRequired = $null
Data = $null
Execute = {
Name = 'Group Policies With Redirected SYSVOL'
Enabled = $false
ActionRequired = $null
Data = $null
Execute = {
Get-GPOZaurrRedirect -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains
}
Processing = {
Processing = {
foreach ($GPO in $Script:Reporting['GPORedirect']['Data']) {
$Script:Reporting['GPORedirect']['Variables']['GPOTotal']++
if ($GPO.IsCorrect -eq $true) {
@@ -21,15 +21,15 @@
$Script:Reporting['GPORedirect']['ActionRequired'] = $false
}
}
Variables = @{
Variables = @{
GPOTotal = 0
GPOIsCorrect = 0
GPOIsNotCorrect = 0
}
Overview = {
Overview = {
}
Summary = {
Summary = {
New-HTMLText -TextBlock {
"Group Policies are stored in Active Directory and SYSVOL. SYSVOL is a folder shared by the domain controllers to hold its logon scripts, "
"group policy data, and other domain-wide data which needs to be available anywhere there is a domain controller. "
@@ -49,7 +49,7 @@
"If you notice any GPO with redirect, you should investigate it. "
} -FontSize 10pt -LineBreak
}
Solution = {
Solution = {
New-HTMLSection -Invisible {
New-HTMLPanel {
& $Script:GPOConfiguration['GPORedirect']['Summary']
@@ -65,7 +65,7 @@
New-HTMLSection -Name 'Group Policies showing redirects (if any)' {
New-HTMLTable -DataTable $Script:Reporting['GPORedirect']['Data'] -Filtering {
New-HTMLTableCondition -Name 'IsCorrect' -Value $false -BackgroundColor Salmon -ComparisonType bool -FailBackgroundColor MintGreen -HighlightHeaders 'IsCorrect', 'Path', 'ExpectedPath'
}
} -ScrollX -PagingOptions 7, 15, 30, 45, 60
}
if ($Script:Reporting['GPORedirect']['WarningsAndErrors']) {
New-HTMLSection -Name 'Warnings & Errors to Review' {
+1 -1
View File
@@ -68,7 +68,7 @@
New-HTMLTableCondition -Name 'LinksCount' -Value 0 -ComparisonType number
New-HTMLTableCondition -Name 'LinksEnabledCount' -Value 0 -ComparisonType number
} -BackgroundColor Salmon -FailBackgroundColor Goldenrod -Logic OR -HighlightHeaders 'LinksCount', 'LinksEnabledCount', 'DisplayName', 'DomainName'
}
} -ScrollX -PagingOptions 7, 15, 30, 45, 60
}
if ($Script:Reporting['GPOUpdates']['WarningsAndErrors']) {
New-HTMLSection -Name 'Warnings & Errors to Review' {
+3 -1
View File
@@ -16,7 +16,9 @@ $GPOZaurrLinks = [ordered] @{
}
Solution = {
New-HTMLTable -DataTable $Script:Reporting['GPOLinks']['Data'] -Filtering
New-HTMLTable -DataTable $Script:Reporting['GPOLinks']['Data'] -Filtering -ScrollX -PagingOptions 7, 15, 30, 45, 60 -ExcludeProperty 'LinksObjects' {
New-HTMLTableCondition -Name 'Linked' -Value 'True' -BackgroundColor PaleGreen -ComparisonType string -FailBackgroundColor Salmon
}
if ($Script:Reporting['GPOLinks']['WarningsAndErrors']) {
New-HTMLSection -Name 'Warnings & Errors to Review' {
New-HTMLTable -DataTable $Script:Reporting['GPOLinks']['WarningsAndErrors'] -Filtering {
+1 -1
View File
@@ -388,7 +388,7 @@
New-HTMLTableCondition -Name 'UserProblem' -Value $false -BackgroundColor SpringGreen -ComparisonType string
New-HTMLTableCondition -Name 'ComputerOptimized' -Value $true -BackgroundColor SpringGreen -ComparisonType string
New-HTMLTableCondition -Name 'UserOptimized' -Value $true -BackgroundColor SpringGreen -TextTransform capitalize -ComparisonType string
} -PagingOptions 10, 20, 30, 40, 50
} -PagingOptions 7, 15, 30, 45, 60 -ScrollX -ExcludeProperty 'LinksObjects', 'GPOObject', 'ACL', 'Size'
}
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
+5 -5
View File
@@ -30,11 +30,11 @@
Summary = {
New-HTMLText -FontSize 10pt -TextBlock {
"Group Policies can become broken for various reasons. One of the common reasons is when GPOs are created and then deleted without being properly removed from Active Directory. "
"In other cases it can be due to replication issues, or simply due to corruption. "
"In other cases, it can be due to replication issues, or simply due to corruption. "
"This can lead to GPOs not being applied as expected, or not being applied at all. "
"If random files are missing from GPOs it's important to fix them to ensure that GPOs are applied as expected. "
"If random files are missing from GPOs, it's important to fix them to ensure that GPOs are applied as expected. "
"This report provides you with list of GPOs that have missing files. "
"Usually once files are missing it's best to restore them from backup (if available) or remove given section completly. "
"Once files are missing, it's usually best to restore them from backup (if available) or remove the given section completely. "
"It's not possible to restore missing files from Active Directory directly or manually. "
} -LineBreak
New-HTMLText -Text 'As it stands currently there are ', $Script:Reporting['GPOBrokenPartially']['Variables']['RequireFixing'], ' error requring fixing. ' -FontSize 10pt -FontWeight normal, bold, normal
@@ -54,7 +54,7 @@
New-HTMLSection -Name 'Group Policy Missing Files' {
New-HTMLTable -DataTable $Script:Reporting['GPOBrokenPartially']['Data'] -Filtering {
New-HTMLTableCondition -Name 'ErrorCount' -Value 0 -BackgroundColor LightGreen -ComparisonType number -FailBackgroundColor Salmon -HighlightHeaders 'ErrorCount', 'ErrorCategory', 'ErrorDetails'
} -PagingOptions 10, 20, 30, 40, 50
} -PagingOptions 7, 15, 30, 45, 60 -ScrollX
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix - Remove duplicate (CNF) objects' {
@@ -112,4 +112,4 @@
}
}
}
}
}
+1 -1
View File
@@ -135,7 +135,7 @@
New-HTMLTableCondition -Name 'OwnerType' -Value "WellKnownAdministrative" -BackgroundColor LightGreen -ComparisonType string -Operator eq
New-HTMLTableCondition -Name 'Status' -Value "OK" -BackgroundColor LightGreen -ComparisonType string -Operator eq
New-HTMLTableCondition -Name 'Status' -Value "OK" -BackgroundColor Salmon -ComparisonType string -Operator ne
}
} -ScrollX -PagingOptions 7, 15, 30, 45, 60
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix NetLogon Owners ' {
@@ -146,7 +146,7 @@
New-HTMLTableCondition -Name 'Status' -Value "Review permission required" -BackgroundColor PaleGoldenrod -ComparisonType string -Operator eq
New-HTMLTableCondition -Name 'Status' -Value "Removal permission required" -BackgroundColor Salmon -ComparisonType string -Operator eq -Row
New-HTMLTableCondition -Name 'Status' -Value "OK" -BackgroundColor LightGreen -ComparisonType string -Operator eq
}
} -ScrollX -PagingOptions 7, 15, 30, 45, 60
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix NetLogon Permissions ' {
@@ -133,6 +133,7 @@
}
}
New-HTMLSection -Name 'Group Policy Organizational Units' {
# Not adding ScrollX to hide Objects, as it can get quite big
New-HTMLTable -DataTable $Script:Reporting['GPOOrganizationalUnit']['Data'] -Filtering {
New-TableHeader -ResponsiveOperations none -Names 'GPONames', 'Objects'
New-HTMLTableCondition -Name 'Status' -ComparisonType string -Value 'Unlink GPO, Delete OU' -BackgroundColor Salmon -Row
@@ -141,7 +142,7 @@
New-HTMLTableCondition -Name 'Status' -ComparisonType string -Value 'OK' -BackgroundColor LightGreen -Row
New-HTMLTableCondition -Name 'Status' -ComparisonType string -Value 'Excluded' -BackgroundColor DeepSkyBlue -Row
New-HTMLTableCondition -Name 'Status' -ComparisonType string -Value 'Excluded, Default OU' -BackgroundColor DeepSkyBlue -Row
} -PagingOptions 10, 20, 30, 40, 50 -ExcludeProperty GPO
} -PagingOptions 7, 15, 30, 45, 60 -ExcludeProperty GPO
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix Group Organizational Units' {
@@ -257,7 +258,7 @@
New-HTMLTable -DataTable $Script:Reporting['GPOOrganizationalUnit']['WarningsAndErrors'] -Filtering {
New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
} -PagingOptions 10, 20, 30, 40, 50
} -PagingOptions 7, 15, 30, 45, 60
}
}
}
+2 -1
View File
@@ -128,7 +128,8 @@
New-HTMLTableCondition -Name 'Status' -Value "Not available on SYSVOL" -BackgroundColor LightCoral -ComparisonType string
New-HTMLTableCondition -Name 'Status' -Value "ObjectClass issue" -BackgroundColor MediumOrchid -ComparisonType string
New-HTMLTableCondition -Name 'Status' -Value "Permissions issue" -BackgroundColor MediumVioletRed -ComparisonType string -Color White
} -PagingOptions 10, 20, 30, 40, 50
New-HTMLTableCondition -Name 'Status' -Value "Exists" -BackgroundColor LightGreen -ComparisonType string
} -PagingOptions 7, 15, 30, 45, 60 -ScrollX
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix - Not available on SYSVOL / Active Directory / ObjectClass issue' {
+2 -2
View File
@@ -184,7 +184,7 @@
#New-HTMLTableCondition -Name 'Status' -Value 'Administrative, Inconsistent, Approved' -BackgroundColor Salmon -ComparisonType string -Row
# New-HTMLTableCondition -Name 'Status' -Value 'NotAdministrative, Inconsistent, Approved' -BackgroundColor Salmon -ComparisonType string -Row
} -PagingOptions 10, 20, 30, 40, 50
} -PagingOptions 7, 15, 30, 45, 60 -ScrollX
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix Group Policy Owners' {
@@ -307,7 +307,7 @@
New-HTMLTable -DataTable $Script:Reporting['GPOOwners']['WarningsAndErrors'] -Filtering {
New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
} -PagingOptions 10, 20, 30, 40, 50
} -PagingOptions 7, 15, 30, 45, 60
}
}
}
+1 -1
View File
@@ -16,7 +16,7 @@
}
Solution = {
New-HTMLTable -DataTable $Script:Reporting['GPOPassword']['Data'] -Filtering
New-HTMLTable -DataTable $Script:Reporting['GPOPassword']['Data'] -Filtering -ScrollX -PagingOptions 7, 15, 30, 45, 60
if ($Script:Reporting['GPOPassword']['WarningsAndErrors']) {
New-HTMLSection -Name 'Warnings & Errors to Review' {
@@ -99,7 +99,7 @@
New-HTMLSection -Name 'Group Policy Administrative Users Analysis' {
New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsAdministrative']['Data'].PermissionsAnalysis -Filtering {
# New-HTMLTableCondition -Name 'Permission' -Value '' -BackgroundColor Salmon -ComparisonType string -Row
} -PagingOptions 7, 15, 30, 45, 60
} -PagingOptions 7, 15, 30, 45, 60 -ScrollX
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix Group Policy Administrative Users' {
@@ -202,7 +202,7 @@
New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsAdministrative']['WarningsAndErrors'] -Filtering {
New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
} -PagingOptions 10, 20, 30, 40, 50
} -PagingOptions 7, 15, 30, 45, 60
}
}
}
@@ -185,7 +185,7 @@
} -FontSize 10pt
New-HTMLText -FontSize 10pt -Text @(
"Unfortunetly it's not as simple as it sounds. While checking for permissions mostly works fine, it's possible a Group Policy has totally removed account permissions from being able to asses any of it. ",
"Unfortunately it's not as simple as it sounds. While checking for permissions mostly works fine, it's possible a Group Policy has totally removed account permissions from being able to asses any of it. ",
"The account we're using "
"$($Env:USERDOMAIN)\$($Env:USERNAME.ToUpper())",
" may simply not have enough permisions to properly asses permissions for a GPO. "
@@ -265,7 +265,7 @@
New-HTMLText -Text "Fourth problem relates to UNKNOWN SID" -FontSize 10pt -FontWeight bold -TextDecoration underline -Alignment center
New-HTMLText -FontSize 10pt -TextBlock {
"Sometimes groups or users are deleted in Active Directory and unfortunetly their permissions are not cleaned automatically. "
"Sometimes groups or users are deleted in Active Directory and Unfortunately their permissions are not cleaned automatically. "
"Those are left in-place and stay there forever until removed. "
} -LineBreak
@@ -309,7 +309,7 @@
New-HTMLSection -Name 'Group Policy Visibility Analysis' {
New-HTMLTable -DataTable $Script:Reporting['GPOPermissions']['Data'].PermissionsIssues -Filtering {
New-HTMLTableCondition -Name 'PermissionIssue' -Value $true -BackgroundColor Salmon -ComparisonType string -Row
} -PagingOptions 7, 15, 30, 45, 60 -DefaultSortColumn PermissionIssue -DefaultSortOrder Descending
} -PagingOptions 7, 15, 30, 45, 60 -DefaultSortColumn PermissionIssue -DefaultSortOrder Descending -ScrollX
}
New-HTMLSection -Name 'Group Policy Permissions Analysis' {
New-HTMLContainer {
@@ -344,7 +344,7 @@
New-HTMLTableCondition -Name 'EnterpriseAdmins' -Value 'True' -BackgroundColor Salmon -ComparisonType string -Operator ne
New-TableEvent -TableID 'GPOPermissionsAll' -SourceColumnName 'GUID' -TargetColumnID 1 # TargetColumnID 1 eq GUID on the other table
} -PagingOptions 7, 15, 30, 45, 60
} -PagingOptions 7, 15, 30, 45, 60 -ScrollX
}
}
New-HTMLSection -Name 'All Permissions' {
@@ -355,7 +355,7 @@
New-HTMLTableCondition -Name 'Permission' -Value 'GpoApply' -BackgroundColor Orange -ComparisonType string
New-HTMLTableCondition -Name 'Permission' -Value 'GpoRead' -BackgroundColor MediumSpringGreen -ComparisonType string -Operator eq
New-HTMLTableCondition -Name 'PrincipalSidType' -Value 'Unknown' -BackgroundColor Salmon -ComparisonType string -Operator eq
} -PagingOptions 7, 15, 30, 45, 60 -DataTableID 'GPOPermissionsAll'
} -PagingOptions 7, 15, 30, 45, 60 -DataTableID 'GPOPermissionsAll' -ScrollX -ExcludeProperty 'GPOSecurity', 'GPOSecurityPermissionItem', 'GPOObject'
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix Group Policy Administrative Users' {
+3 -3
View File
@@ -151,12 +151,12 @@
New-HTMLSection -Name 'Group Policy Authenticated Users Analysis' {
New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsRead']['Data'].Permissions -Filtering {
New-HTMLTableCondition -Name 'Permission' -Value '' -BackgroundColor Salmon -ComparisonType string -Row
} -PagingOptions 7, 15, 30, 45, 60
} -PagingOptions 7, 15, 30, 45, 60 -ScrollX
}
New-HTMLSection -Name 'Group Policy Issues Assesment' {
New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsRead']['Data'].Issues -Filtering {
New-HTMLTableCondition -Name 'PermissionIssue' -Value $true -BackgroundColor Salmon -ComparisonType string -Row
} -PagingOptions 7, 15, 30, 45, 60 -DefaultSortColumn PermissionIssue -DefaultSortOrder Descending
} -PagingOptions 7, 15, 30, 45, 60 -DefaultSortColumn PermissionIssue -DefaultSortOrder Descending -ScrollX
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix Group Policy Authenticated Users' {
@@ -259,7 +259,7 @@
New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsRead']['WarningsAndErrors'] -Filtering {
New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
} -PagingOptions 10, 20, 30, 40, 50
} -PagingOptions 7, 15, 30, 45, 60
}
}
}
+1 -1
View File
@@ -16,7 +16,7 @@
}
Solution = {
New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsRoot']['Data'] -Filtering
New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsRoot']['Data'] -Filtering -PagingOptions 7, 15, 30, 45, 60 -ScrollX
if ($Script:Reporting['GPOPermissionsRoot']['WarningsAndErrors']) {
New-HTMLSection -Name 'Warnings & Errors to Review' {
New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsRoot']['WarningsAndErrors'] -Filtering {
@@ -71,7 +71,7 @@
New-HTMLSection -Name 'Group Policy Unknown Permissions Analysis' {
New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsUnknown']['Data'] -Filtering {
New-HTMLTableCondition -Name 'Permission' -Value '' -BackgroundColor Salmon -ComparisonType string -Row
} -PagingOptions 7, 15, 30, 45, 60
} -PagingOptions 7, 15, 30, 45, 60 -ScrollX
}
if ($Script:Reporting['Settings']['HideSteps'] -eq $false) {
New-HTMLSection -Name 'Steps to fix Group Policy Unknown Permissions' {
@@ -174,7 +174,7 @@
New-HTMLTable -DataTable $Script:Reporting['GPOPermissionsUnknown']['WarningsAndErrors'] -Filtering {
New-HTMLTableCondition -Name 'Type' -Value 'Warning' -BackgroundColor SandyBrown -ComparisonType string -Row
New-HTMLTableCondition -Name 'Type' -Value 'Error' -BackgroundColor Salmon -ComparisonType string -Row
} -PagingOptions 10, 20, 30, 40, 50
} -PagingOptions 7, 15, 30, 45, 60
}
}
}
+15 -1
View File
@@ -14,9 +14,23 @@
}
Overview = {
}
Summary = {
New-HTMLText -TextBlock {
"This report shows legacy ADM files in SYSVOL. These files are no longer used and can be safely removed. "
"Before 'adm' files were replaced by 'admx' files, they were stored in the SYSVOL share, directly per each GPO. "
"This report will help you identify and remove these files. "
}
}
Solution = {
New-HTMLTable -DataTable $Script:Reporting['SysVolLegacyFiles']['Data'] -Filtering
New-HTMLSection -Invisible {
New-HTMLPanel {
& $Script:GPOConfiguration['SysVolLegacyFiles']['Summary']
}
}
New-HTMLSection -Name "Legacy ADM Files in SYSVOL" {
New-HTMLTable -DataTable $Script:Reporting['SysVolLegacyFiles']['Data'] -Filtering -PagingOptions 7, 15, 30, 45, 60 -ScrollX
}
if ($Script:Reporting['SysVolLegacyFiles']['WarningsAndErrors']) {
New-HTMLSection -Name 'Warnings & Errors to Review' {
New-HTMLTable -DataTable $Script:Reporting['SysVolLegacyFiles']['WarningsAndErrors'] -Filtering {
+1 -1
View File
@@ -49,7 +49,7 @@
# or if current report is given and it matches the current report type which works for split reprots
if ($Script:GPOConfiguration[$T].Enabled -eq $true -and ((-not $CurrentReport) -or ($CurrentReport -and $CurrentReport -eq $T))) {
Write-Color -Text '[i]', '[HTML ] ', "Generating HTML report ($FilePath) for $T with split reports" -Color Yellow, DarkGray, Yellow
New-HTML -Author 'Przemysław Kłys' -TitleText 'GPOZaurr Report' {
New-HTML -Author 'Przemysław Kłys @ Evotec' -TitleText 'GPOZaurr Report' {
New-HTMLTabStyle -BorderRadius 0px -TextTransform capitalize -BackgroundColorActive SlateGrey
New-HTMLSectionStyle -BorderRadius 0px -HeaderBackGroundColor Grey -RemoveShadow
New-HTMLPanelStyle -BorderRadius 0px
+16 -1
View File
@@ -380,7 +380,7 @@
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'FSLogix' -SingleObject
}
}
Firefox = @{
Firefox = @{
Types = @(
@{
Category = 'RegistrySettings'
@@ -974,6 +974,21 @@
ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Remote Desktop Services*' -SingleObject
}
}
RestrictedGroups = @{
Types = @(
@{
Category = 'SecuritySettings'
Settings = 'RestrictedGroups'
}
)
GPOPath = 'Policies -> Windows Settings -> Security Settings -> Restricted Groups'
Code = {
ConvertTo-XMLRestrictedGroups -GPO $GPO
}
CodeSingle = {
ConvertTo-XMLRestrictedGroups -GPO $GPO -SingleObject
}
}
RSSFeeds = @{
Types = @(
@{
+4
View File
@@ -329,6 +329,8 @@
SuggestedActionComment = $SuggestedActionComment
BelongsToGPO = $BelongsToGPO
GPODisplayName = $GPODisplayName
SizeMB = [math]::Round(($_.Length / 1MB), 2)
Size = $_.Length
Attributes = $_.Attributes
CreationTime = $_.CreationTime
LastAccessTime = $_.LastAccessTime
@@ -340,6 +342,8 @@
$MetaData['SuggestedActionComment'] = $SuggestedActionComment
$MetaData['BelongsToGPO'] = $BelongsToGPO
$MetaData['GPODisplayName'] = $GPODisplayName
$MetaData['SizeMB'] = [math]::Round(($_.Length / 1MB), 2)
$MetaData['Size'] = $_.Length
}
if ($Signature) {
try {
+4
View File
@@ -87,6 +87,7 @@
LastAccessTime = $File.LastAccessTime
LastWriteTime = $File.LastWriteTime
Attributes = $File.Attributes
SizeMB = [math]::Round(($File.Length / 1MB), 2)
AccessControlType = 'Allow' # : Allow
Principal = $IdentityOwner.Name # : BUILTIN\Administrators
PrincipalSid = $IdentityOwner.SID
@@ -95,6 +96,7 @@
FileSystemRights = 'Owner' # : FullControl
IsInherited = $false
FullNameOnSysVol = $File.FullName.Replace($Path, $PathOnSysvol)
Size = $File.Length
}
}
$FilePermission = Get-FilePermissions -Path $File.FullName -ACLS $ACL -Verbose:$false
@@ -137,6 +139,7 @@
LastAccessTime = $File.LastAccessTime
LastWriteTime = $File.LastWriteTime
Attributes = $File.Attributes
SizeMB = [math]::Round(($File.Length / 1MB), 2)
AccessControlType = $Perm.AccessControlType # : Allow
Principal = $Identity.Name # : BUILTIN\Administrators
PrincipalSid = $Identity.SID
@@ -145,6 +148,7 @@
FileSystemRights = $Perm.FileSystemRights # : FullControl
IsInherited = $Perm.IsInherited # : True
FullNameOnSysVol = $File.FullName.Replace($Path, $PathOnSysvol)
Size = $File.Length
}
}
+8 -3
View File
@@ -51,7 +51,7 @@
foreach ($Domain in $ForestInformation.Domains) {
Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain)"
$CountTop = 0
$TopOrganizationalUnits = Get-ADOrganizationalUnit -Filter * -Properties LinkedGroupPolicyObjects, DistinguishedName, ntSecurityDescriptor -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0] -SearchScope OneLevel
[Array] $TopOrganizationalUnits = Get-ADOrganizationalUnit -Filter * -Properties LinkedGroupPolicyObjects, DistinguishedName, ntSecurityDescriptor -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0] -SearchScope OneLevel
foreach ($TopOU in $TopOrganizationalUnits) {
$CountTop++
Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain) / $($TOPOU.DistinguishedName) [$CountTop/$($TopOrganizationalUnits.Count)]"
@@ -75,7 +75,7 @@
}
# cache children OUs
$OUs = Get-ADOrganizationalUnit -SearchScope Subtree -SearchBase $TopOU.DistinguishedName -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0] -Properties LinkedGroupPolicyObjects, DistinguishedName -Filter *
[Array] $OUs = Get-ADOrganizationalUnit -SearchScope Subtree -SearchBase $TopOU.DistinguishedName -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0] -Properties LinkedGroupPolicyObjects, DistinguishedName -Filter *
Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain) / $($TOPOU.DistinguishedName) [$CountTop/$($TopOrganizationalUnits.Count)], found $($OUs.Count) OU's to process."
foreach ($OU in $OUs) {
if (-not $CachedOu[$OU.DistinguishedName]) {
@@ -103,8 +103,13 @@
Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain) / $($TOPOU.DistinguishedName) [$CountTop/$($TopOrganizationalUnits.Count)], found $($ObjectsInOu.Count) objects to process."
foreach ($Object in $ObjectsInOu) {
$Place = ConvertFrom-DistinguishedName -ToOrganizationalUnit -DistinguishedName $Object.DistinguishedName
$AllOUs = ConvertFrom-DistinguishedName -ToMultipleOrganizationalUnit -IncludeParent -DistinguishedName $Place
[Array] $AllOUs = ConvertFrom-DistinguishedName -ToMultipleOrganizationalUnit -IncludeParent -DistinguishedName $Place
foreach ($OU in $AllOUs) {
if (-not $CachedOu[$OU]) {
Write-Warning "Get-GPOZaurrOrganizationalUnit - Object $($Object.DistinguishedName) is in OU $($OU) but it's not in cache. This should not happen. Please report this issue."
Write-Warning "Get-GPOZaurrOrganizationalUnit - Debug information: Place: $($Place), AllOUs: $($AllOUs.Count)"
continue
}
if ($OU -eq $Place) {
$CachedOu[$OU]['Objects'][$Object.DistinguishedName] = $Object
$CachedOu[$OU]['ObjectsClasses'][$Object.ObjectClass] = ''
+4 -4
View File
@@ -126,6 +126,10 @@
}
}
if (-not $FilePath) {
$FilePath = Get-FileName -Extension 'html' -Temporary -Name "GpoZaurr"
}
# Build data
foreach ($T in $Script:GPOConfiguration.Keys) {
if ($Script:GPOConfiguration[$T].Enabled -eq $true) {
@@ -201,10 +205,6 @@
if (-not $SplitReports) {
# Generate pretty HTML
$TimeLogHTML = Start-TimeLog
if (-not $FilePath) {
$FilePath = Get-FileName -Extension 'html' -Temporary
}
New-HTMLReportAll -FilePath $FilePath -Online:$Online -HideHTML:$HideHTML -Type $Type
$TimeLogEndHTML = Stop-TimeLog -Time $TimeLogHTML -Option OneLiner
+11 -3
View File
@@ -59,6 +59,10 @@
Invoke-GPOZaurrContent -GPOPath "CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=Contoso,DC=com" -Type "All" -OutputType "Object"
Retrieves all information for a specific Group Policy Object and outputs the result as an object.
.EXAMPLE
Invoke-GPOZaurrContent -GPOName "Group Policy Test" -SingleObject | ConvertTo-Json -Depth 3
Quickly view GPO settings by name in JSON format for easy inspection.
#>
[alias('Find-GPO')]
[cmdletBinding(DefaultParameterSetName = 'Default')]
@@ -156,13 +160,17 @@
Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOName $Name
}
foreach ($GUID in $GPOGUID) {
Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOGUID $GUID
Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOGuid $GUID
}
)
} else {
Write-Verbose "Invoke-GPOZaurrContent - Query AD for GPOs"
[Array] $GPOs = Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
}
if ($GPOs.Count -eq 0) {
Write-Warning "Invoke-GPOZaurrContent - No GPOs found. Exiting."
return
}
# This caches single reports.
$TemporaryCachedSingleReports = [ordered] @{}
$TemporaryCachedSingleReports['ReportsSingle'] = [ordered] @{}
@@ -171,7 +179,7 @@
$Output['Reports'] = [ordered] @{}
$Output['CategoriesFull'] = [ordered] @{}
$ForestInformation = Get-WinADForestDetails -PreferWritable -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
$ForestInformation = Get-WinADForestDetails -PreferWritable -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
Write-Verbose "Invoke-GPOZaurrContent - Loading GPO Report to Categories"
$CountGPO = 0
@@ -328,7 +336,7 @@
foreach ($Key in $Output.Reports.Keys) {
New-HTMLTab -Name $Key {
Write-Verbose "Invoke-GPOZaurrContent - Generating HTML Table for $Key"
New-HTMLTable -DataTable $Output.Reports[$Key] -Filtering -Title $Key
New-HTMLTable -DataTable $Output.Reports[$Key] -Filtering -Title $Key -PagingOptions 7, 15, 30, 45, 60 -ScrollX
}
}
} -FilePath $OutputPath -ShowHTML:$Open -Online:$Online
+1 -1
View File
@@ -1,6 +1,6 @@
<p align="center">
<a href="https://www.powershellgallery.com/packages/GPOZaurr"><img src="https://img.shields.io/powershellgallery/v/GPOZaurr.svg"></a>
<a href="https://www.powershellgallery.com/packages/GPOZaurr"><img src="https://img.shields.io/powershellgallery/vpre/GPOZaurr.svg?label=powershell%20gallery%20preview&colorB=yellow"></a>
<a href="https://www.powershellgallery.com/packages/GPOZaurr"><img src="https://img.shields.io/powershellgallery/v/GPOZaurr.svg?label=powershell%20gallery%20preview&colorB=yellow&include_prereleases"></a>
<a href="https://github.com/EvotecIT/GPOZaurr"><img src="https://img.shields.io/github/license/EvotecIT/GPOZaurr.svg"></a>
</p>