add linked GPOs functionality

files/restricted-group-check.ps1

@@ -5,7 +5,7 @@
 Import-Module GroupPolicy -ErrorAction Stop
 Import-Module ActiveDirectory -ErrorAction Stop
 $TargetOU = "OU=NA,OU=Manufacturing,OU=Tesla Systems,DC=teslamotors,DC=com"
-$OutputFile = "C:\Users\matanderson\gpo.yaml"
+$OutputFile = "C:\Users\matanderson\gpo\gpo-update.yaml"
 # Add-Content  -Path $OutputFile -Value $line
 if (Test-Path $OutputFile) {
     Remove-Item -Path $OutputFile -Force  
@@ -34,10 +34,9 @@ if ($targetOUObj) {
 
 # ------------------------------------------------------------------
 # 2. Build a hashtable: GPO_GUID => list of OU DNs it is linked to
-#    This is entirely opaque voodoo, i have no idea what's going on
 # ------------------------------------------------------------------
 
-$gpoLinks = @{}
+$gpoLinks = @{} 
 
 foreach ($ou in $ouObjects) {
     if ($ou.gPLink) {
@@ -59,6 +58,8 @@ if (-not $gpoLinks.Count) {
     exit
 }
 
+
+
 Write-Host "Found $($gpoLinks.Count) distinct GPO(s) linked in the OU tree."
 Add-Content  -Path $OutputFile -Value "  gpo_links: $($gpoLinks.Count)"
 
@@ -66,18 +67,28 @@ Add-Content  -Path $OutputFile -Value "  gpo_links: $($gpoLinks.Count)"
 # 3.  For each GPO, get an XML report and pull RestrictedGroup nodes
 # ----------------------------------------------------
 
+
 Add-Content  -Path $OutputFile -Value "  configured_gpos:"
 foreach ($gpoGuid in $gpoLinks.Keys) {
     try {
         $gpo = Get-GPO -Guid $gpoGuid -ErrorAction Stop
     }
     catch {
-        Write-Warning "Unable to retrieve GPO $gpoGuid - skipping."
+        Write-Warning "Unable to retrieve GPO $gpoGuid – skipping."
         continue
     }
     Write-Host "GPO: $($gpo.DisplayName)"
     Add-Content  -Path $OutputFile -Value "    $($gpo.DisplayName):"
 
+    # -------- Linked OUs ----------
+    $linkedOUs = $gpoLinks[$gpoGuid]
+    Write-Host "Linked OUs:"
+    Add-Content -Path $OutputFile -Value "      Linked_OUs:"
+    foreach ($ouDn in $linkedOUs) {
+        Write-Host "$ouDn"
+        Add-Content -Path $OutputFile -Value "        - $ouDn"
+    }
+
     # Pull the XML report
     try {
         $xmlString = Get-GPOReport -Guid $gpoGuid -ReportType Xml -ErrorAction Stop
@@ -86,9 +97,8 @@ foreach ($gpoGuid in $gpoLinks.Keys) {
         Write-Warning "Unable to generate XML report for $($gpo.DisplayName)."
         continue
     }
-    
     $xml = [xml]$xmlString
-
+    # process the XML data
     $ns = New-Object System.Xml.XmlNamespaceManager ($xml.NameTable)
     $ns.AddNamespace('m',  'http://www.microsoft.com/GroupPolicy/Settings')     # default namespace
     $ns.AddNamespace('q1', 'http://www.microsoft.com/GroupPolicy/Settings/Security')