GPOZaurr/Public/Repair-GPOZaurrPermissionConsistency.ps1

function Repair-GPOZaurrPermissionConsistency {
    <#
    .SYNOPSIS
    Repairs permission consistency for Group Policy Objects (GPOs) in a specified domain or forest.

    .DESCRIPTION
    The Repair-GPOZaurrPermissionConsistency function repairs permission consistency for GPOs in a specified domain or forest. It checks for inconsistencies in GPO permissions and attempts to make them consistent.

    .PARAMETER GPOName
    Specifies the name of the GPO to repair.

    .PARAMETER GPOGuid
    Specifies the GUID of the GPO to repair.

    .PARAMETER Forest
    Specifies the forest where the GPOs are located.

    .PARAMETER ExcludeDomains
    Specifies an array of domains to exclude from the repair process.

    .PARAMETER IncludeDomains
    Specifies an array of domains to include in the repair process.

    .PARAMETER ExtendedForestInformation
    Specifies additional information about the forest.

    .PARAMETER LimitProcessing
    Specifies the maximum number of GPOs to process.

    .EXAMPLE
    Repair-GPOZaurrPermissionConsistency -GPOName "ExampleGPO" -Forest "example.com"
    Repairs permission consistency for the GPO named "ExampleGPO" in the "example.com" forest.

    .EXAMPLE
    Repair-GPOZaurrPermissionConsistency -GPOGuid "12345678-1234-1234-1234-1234567890AB" -ExcludeDomains @("domain1", "domain2") -LimitProcessing 5
    Repairs permission consistency for the GPO with the specified GUID, excluding domains "domain1" and "domain2", and processing a maximum of 5 GPOs.

    #>
    [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Default')]
    param(
        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,

        [alias('ForestName')][string] $Forest,
        [string[]] $ExcludeDomains,
        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
        [System.Collections.IDictionary] $ExtendedForestInformation,

        [int] $LimitProcessing = [int32]::MaxValue
    )
    $ConsistencySplat = @{
        Forest                    = $Forest
        IncludeDomains            = $IncludeDomains
        ExcludeDomains            = $ExcludeDomains
        ExtendedForestInformation = $ExtendedForestInformation
        Verbose                   = $VerbosePreference
    }
    if ($GPOName) {
        $ConsistencySplat['GPOName'] = $GPOName
    } elseif ($GPOGuid) {
        $ConsistencySplat['GPOGuid'] = $GPOGUiD
    } else {
        $ConsistencySplat['Type'] = 'Inconsistent'
    }

    Get-GPOZaurrPermissionConsistency @ConsistencySplat -IncludeGPOObject | Where-Object {
        if ($_.ACLConsistent -eq $false) {
            $_
        }
    } | Select-Object -First $LimitProcessing | ForEach-Object {
        #Write-Verbose "Repair-GPOZaurrPermissionConsistency - Repairing GPO consistency $($_.DisplayName) from domain: $($_.DomainName)"
        if ($PSCmdlet.ShouldProcess($_.DisplayName, "Reparing GPO permissions consistency in domain $($_.DomainName)")) {
            try {
                $_.IncludeGPOObject.MakeAclConsistent()
            } catch {
                $ErrorMessage = $_.Exception.Message
                Write-Warning "Repair-GPOZaurrPermissionConsistency - Failed to set consistency: $($ErrorMessage)."
            }
        }
    }
}