Bump version

Build/Manage-Module.ps1

@@ -1,7 +1,5 @@
 Clear-Host
 
-Import-Module "PSPublishModule" -Force
-
 Invoke-ModuleBuild -ModuleName 'GPOZaurr' {
     # Usual defaults as per standard module
     $Manifest = @{

CHANGELOG.MD

@@ -1,5 +1,9 @@
 # GPOZaurr Release History
 
+## 1.1.7 - 2024.11.20
+### What's Changed
+- Added some additional logging to track down issue
+
 ## 1.1.6 - 2024.10.17
 ### What's Changed
 * Improve HTML reports with `ScrollX`

GPOZaurr.psd1

@@ -8,7 +8,7 @@
     Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.'
     FunctionsToExport    = @('Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Clear-GPOZaurrSysvolDFSR', 'ConvertFrom-CSExtension', 'Export-GPOZaurrContent', 'Find-CSExtension', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrBroken', 'Get-GPOZaurrBrokenLink', 'Get-GPOZaurrDictionary', 'Get-GPOZaurrDuplicateObject', 'Get-GPOZaurrFiles', 'Get-GPOZaurrFilesPolicyDefinition', 'Get-GPOZaurrFolders', 'Get-GPOZaurrInheritance', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrMissingFiles', 'Get-GPOZaurrNetLogon', 'Get-GPOZaurrOrganizationalUnit', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionAnalysis', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrPermissionIssue', 'Get-GPOZaurrPermissionRoot', 'Get-GPOZaurrPermissionSummary', 'Get-GPOZaurrRedirect', 'Get-GPOZaurrSysvolDFSR', 'Get-GPOZaurrUpdates', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurr', 'Invoke-GPOZaurrContent', 'Invoke-GPOZaurrPermission', 'Invoke-GPOZaurrSupport', 'New-GPOZaurrWMI', 'Optimize-GPOZaurr', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrBroken', 'Remove-GPOZaurrDuplicateObject', 'Remove-GPOZaurrFolders', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrLinkEmptyOU', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrBrokenLink', 'Repair-GPOZaurrNetLogonOwner', 'Repair-GPOZaurrPermission', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner', 'Set-GPOZaurrStatus', 'Skip-GroupPolicy')
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '1.1.6'
+    ModuleVersion        = '1.1.8'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
@@ -24,11 +24,11 @@
         }, @{
             Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
             ModuleName    = 'PSSharedGoods'
-            ModuleVersion = '0.0.297'
+            ModuleVersion = '0.0.300'
         }, @{
             Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
             ModuleName    = 'ADEssentials'
-            ModuleVersion = '0.0.221'
+            ModuleVersion = '0.0.226'
         }, @{
             Guid          = 'a7bdf640-f5cb-4acf-9de0-365b322d245c'
             ModuleName    = 'PSWriteHTML'

Private/ConvertTo-XMLRestrictedGroups.ps1

@@ -0,0 +1,77 @@
+function ConvertTo-XMLRestrictedGroups {
+    [cmdletBinding()]
+    param(
+        [PSCustomObject] $GPO,
+        [switch] $SingleObject
+    )
+    if ($SingleObject) {
+        $CreateGPO = [ordered]@{
+            DisplayName = $GPO.DisplayName
+            DomainName  = $GPO.DomainName
+            GUID        = $GPO.GUID
+            GpoType     = $GPO.GpoType
+            #GpoCategory = $GPOEntry.GpoCategory
+            #GpoSettings = $GPOEntry.GpoSettings
+            Count       = 0
+            Settings    = $null
+        }
+        [Array] $CreateGPO['Settings'] = foreach ($Script in $GPO.DataSet) {
+            $Members = foreach ($Member in $Group.Member) {
+                if ($($Member.SID.'#text')) {
+                    "$($Member.Name.'#text') ($($Member.SID.'#text'))"
+                } else {
+                    $Member.Name.'#text'
+                }
+            }
+            $MemberOf = foreach ($Member in $Group.MemberOf) {
+                if ($($Member.SID.'#text')) {
+                    "$($Member.Name.'#text') ($($Member.SID.'#text'))"
+                } else {
+                    $Member.Name.'#text'
+                }
+            }
+            [PSCustomObject]@{
+                GroupName = $Group.GroupName.Name
+                GroupSID  = $Group.GroupName.SID.'#text'
+                Members   = $Members -join ', '
+                MembersOf = $MemberOf -join ', '
+            }
+        }
+        $CreateGPO['DataCount'] = $CreateGPO['Settings'].Count
+        $CreateGPO['Linked'] = $GPO.Linked
+        $CreateGPO['LinksCount'] = $GPO.LinksCount
+        $CreateGPO['Links'] = $GPO.Links
+        [PSCustomObject] $CreateGPO
+    } else {
+        foreach ($Group in $GPO.DataSet) {
+            $Members = foreach ($Member in $Group.Member) {
+                if ($($Member.SID.'#text')) {
+                    "$($Member.Name.'#text') ($($Member.SID.'#text'))"
+                } else {
+                    $Member.Name.'#text'
+                }
+            }
+            $MemberOf = foreach ($Member in $Group.MemberOf) {
+                if ($($Member.SID.'#text')) {
+                    "$($Member.Name.'#text') ($($Member.SID.'#text'))"
+                } else {
+                    $Member.Name.'#text'
+                }
+            }
+            $CreateGPO = [ordered]@{
+                DisplayName = $GPO.DisplayName
+                DomainName  = $GPO.DomainName
+                GUID        = $GPO.GUID
+                GpoType     = $GPO.GpoType
+                GroupName   = $Group.GroupName.Name.'#text'
+                GroupSID    = $Group.GroupName.SID.'#text'
+                Members     = $Members -join ', '
+                MembersOf   = $MemberOf -join ', '
+            }
+            $CreateGPO['Linked'] = $GPO.Linked
+            $CreateGPO['LinksCount'] = $GPO.LinksCount
+            $CreateGPO['Links'] = $GPO.Links
+            [PSCustomObject] $CreateGPO
+        }
+    }
+}

Private/Script.GPODictionary.ps1

@@ -380,7 +380,7 @@
             ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'FSLogix' -SingleObject
         }
     }
-    Firefox                                    = @{
+    Firefox                                         = @{
         Types      = @(
             @{
                 Category = 'RegistrySettings'
@@ -974,6 +974,21 @@
             ConvertTo-XMLGenericPolicy -GPO $GPO -Category 'Windows Components/Remote Desktop Services*' -SingleObject
         }
     }
+    RestrictedGroups                                = @{
+        Types      = @(
+            @{
+                Category = 'SecuritySettings'
+                Settings = 'RestrictedGroups'
+            }
+        )
+        GPOPath    = 'Policies -> Windows Settings -> Security Settings -> Restricted Groups'
+        Code       = {
+            ConvertTo-XMLRestrictedGroups -GPO $GPO
+        }
+        CodeSingle = {
+            ConvertTo-XMLRestrictedGroups -GPO $GPO -SingleObject
+        }
+    }
     RSSFeeds                                        = @{
         Types      = @(
             @{

Public/Get-GPOZaurrOrganizationalUnit.ps1

@@ -51,7 +51,7 @@
     foreach ($Domain in $ForestInformation.Domains) {
         Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain)"
         $CountTop = 0
-        $TopOrganizationalUnits = Get-ADOrganizationalUnit -Filter * -Properties LinkedGroupPolicyObjects, DistinguishedName, ntSecurityDescriptor -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0] -SearchScope OneLevel
+        [Array] $TopOrganizationalUnits = Get-ADOrganizationalUnit -Filter * -Properties LinkedGroupPolicyObjects, DistinguishedName, ntSecurityDescriptor -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0] -SearchScope OneLevel
         foreach ($TopOU in $TopOrganizationalUnits) {
             $CountTop++
             Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain) / $($TOPOU.DistinguishedName) [$CountTop/$($TopOrganizationalUnits.Count)]"
@@ -75,7 +75,7 @@
             }
 
             # cache children OUs
-            $OUs = Get-ADOrganizationalUnit -SearchScope Subtree -SearchBase $TopOU.DistinguishedName -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0] -Properties LinkedGroupPolicyObjects, DistinguishedName -Filter *
+            [Array] $OUs = Get-ADOrganizationalUnit -SearchScope Subtree -SearchBase $TopOU.DistinguishedName -Server $ForestInformation['QueryServers'][$Domain]['hostname'][0] -Properties LinkedGroupPolicyObjects, DistinguishedName -Filter *
             Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain) / $($TOPOU.DistinguishedName) [$CountTop/$($TopOrganizationalUnits.Count)], found $($OUs.Count) OU's to process."
             foreach ($OU in $OUs) {
                 if (-not $CachedOu[$OU.DistinguishedName]) {
@@ -103,8 +103,13 @@
             Write-Verbose "Get-GPOZaurrOrganizationalUnit - Processing $($Domain) / $($TOPOU.DistinguishedName) [$CountTop/$($TopOrganizationalUnits.Count)], found $($ObjectsInOu.Count) objects to process."
             foreach ($Object in $ObjectsInOu) {
                 $Place = ConvertFrom-DistinguishedName -ToOrganizationalUnit -DistinguishedName $Object.DistinguishedName
-                $AllOUs = ConvertFrom-DistinguishedName -ToMultipleOrganizationalUnit -IncludeParent -DistinguishedName $Place
+                [Array] $AllOUs = ConvertFrom-DistinguishedName -ToMultipleOrganizationalUnit -IncludeParent -DistinguishedName $Place
                 foreach ($OU in $AllOUs) {
+                    if (-not $CachedOu[$OU]) {
+                        Write-Warning "Get-GPOZaurrOrganizationalUnit - Object $($Object.DistinguishedName) is in OU $($OU) but it's not in cache. This should not happen. Please report this issue."
+                        Write-Warning "Get-GPOZaurrOrganizationalUnit - Debug information: Place: $($Place), AllOUs: $($AllOUs.Count)"
+                        continue
+                    }
                     if ($OU -eq $Place) {
                         $CachedOu[$OU]['Objects'][$Object.DistinguishedName] = $Object
                         $CachedOu[$OU]['ObjectsClasses'][$Object.ObjectClass] = ''

Public/Invoke-GPOZaurrContent.ps1

@@ -156,13 +156,17 @@
                 Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOName $Name
             }
             foreach ($GUID in $GPOGUID) {
-                Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOGUID $GUID
+                Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -GPOGuid $GUID
             }
         )
     } else {
         Write-Verbose "Invoke-GPOZaurrContent - Query AD for GPOs"
         [Array] $GPOs = Get-GPOZaurrAD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
     }
+    if ($GPOs.Count -eq 0) {
+        Write-Warning "Invoke-GPOZaurrContent - No GPOs found. Exiting."
+        return
+    }
     # This caches single reports.
     $TemporaryCachedSingleReports = [ordered] @{}
     $TemporaryCachedSingleReports['ReportsSingle'] = [ordered] @{}
@@ -171,7 +175,7 @@
     $Output['Reports'] = [ordered] @{}
     $Output['CategoriesFull'] = [ordered] @{}
 
-    $ForestInformation = Get-WinADForestDetails -PreferWritable  -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    $ForestInformation = Get-WinADForestDetails -PreferWritable -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
 
     Write-Verbose "Invoke-GPOZaurrContent - Loading GPO Report to Categories"
     $CountGPO = 0