GPOZaurr/Public/Repair-GPOZaurrPermission.ps1

function Repair-GPOZaurrPermission {
    <#
    .SYNOPSIS
    Repairs permissions for Group Policy Objects (GPOs) based on specified criteria.

    .DESCRIPTION
    The Repair-GPOZaurrPermission function repairs permissions for GPOs based on the specified criteria. It analyzes the permissions of GPOs and adds necessary permissions if they are missing.

    .PARAMETER Type
    Specifies the type of permissions to repair. Valid values are 'AuthenticatedUsers', 'Unknown', 'System', 'Administrative', and 'All'.

    .PARAMETER Forest
    Specifies the forest name to analyze GPO permissions.

    .PARAMETER ExcludeDomains
    Specifies an array of domains to exclude from the analysis.

    .PARAMETER IncludeDomains
    Specifies an array of domains to include in the analysis.

    .PARAMETER ExtendedForestInformation
    Specifies additional information about the forest.

    .PARAMETER LimitProcessing
    Specifies the maximum number of GPOs to process.

    .EXAMPLE
    Repair-GPOZaurrPermission -Type 'All' -Forest 'ContosoForest' -IncludeDomains @('Domain1', 'Domain2') -ExcludeDomains @('Domain3') -ExtendedForestInformation $info -LimitProcessing 100
    Repairs permissions for all types of users in the 'ContosoForest' forest, including only 'Domain1' and 'Domain2' while excluding 'Domain3', with extended forest information and processing a maximum of 100 GPOs.

    #>
    [cmdletBinding(SupportsShouldProcess)]
    param(
        [Parameter(Mandatory)][ValidateSet('AuthenticatedUsers', 'Unknown', 'System', 'Administrative', 'All')][string[]] $Type,

        [alias('ForestName')][string] $Forest,
        [string[]] $ExcludeDomains,
        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
        [System.Collections.IDictionary] $ExtendedForestInformation,

        [int] $LimitProcessing = [int32]::MaxValue
    )
    Get-GPOZaurrPermissionAnalysis -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains | Where-Object {
        $RequiresProcessing = $false
        if ($_.Status -eq $false) {
            if ($Type -contains 'System' -or $Type -contains 'All') {
                if ($_.System -eq $false) {
                    $RequiresProcessing = $true
                }
            }
            if ($Type -contains 'Administrative' -or $Type -contains 'All') {
                if ($_.Administrative -eq $false) {
                    $RequiresProcessing = $true
                }
            }
            if ($Type -contains 'AuthenticatedUsers' -or $Type -contains 'All') {
                if ($_.AuthenticatedUsers -eq $false) {
                    $RequiresProcessing = $true
                }
            }
            if ($Type -contains 'Unknown' -or $Type -contains 'All') {
                if ($_.Unknown -eq $true) {
                    $RequiresProcessing = $true
                }
            }
            if ($RequiresProcessing -eq $true) {
                $_
            }
        }
    } | Select-Object -First $LimitProcessing | ForEach-Object {
        $GPO = $_
        if ($GPO.Status -eq $false) {
            if ($GPO.System -eq $false) {
                Add-GPOZaurrPermission -Type WellKnownAdministrative -PermissionType GpoEditDeleteModifySecurity -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName
            }
            if ($GPO.Administrative -eq $false) {
                Add-GPOZaurrPermission -Type Administrative -PermissionType GpoEditDeleteModifySecurity -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName
            }
            if ($GPO.AuthenticatedUsers -eq $false) {
                Add-GPOZaurrPermission -Type AuthenticatedUsers -PermissionType GpoRead -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName
            }
            if ($GPO.Unknown -eq $true) {
                Remove-GPOZaurrPermission -Type Unknown -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName
            }
        }
    }
}