113 lines
4.2 KiB
PowerShell
113 lines
4.2 KiB
PowerShell
# ------------------------------------------------------------------
|
|
# 0. Load modules (they are usually loaded by default, but be safe)
|
|
# ------------------------------------------------------------------
|
|
|
|
Import-Module GroupPolicy -ErrorAction Stop
|
|
Import-Module ActiveDirectory -ErrorAction Stop
|
|
$TargetOU = "OU=NA,OU=Manufacturing,OU=Tesla Systems,DC=teslamotors,DC=com"
|
|
$OutputFile = "C:\Users\matanderson\gpo.yaml"
|
|
# Add-Content -Path $OutputFile -Value $line
|
|
if (Test-Path $OutputFile) {
|
|
Remove-Item -Path $OutputFile -Force
|
|
}
|
|
|
|
# ------------------------------------------------------------------
|
|
# 1. Grab every OU under $TargetOU (including $TargetOU itself)
|
|
# ------------------------------------------------------------------
|
|
|
|
Write-Output "Enumerating OUs under '$TargetOU' ..."
|
|
Add-Content -Path $OutputFile -Value "---"
|
|
Add-Content -Path $OutputFile -Value "- root_ou: $TargetOU"
|
|
$ouObjects = Get-ADObject `
|
|
-Filter 'ObjectClass -eq "organizationalUnit"' `
|
|
-SearchBase $TargetOU `
|
|
-SearchScope Subtree `
|
|
-Properties gPLink
|
|
|
|
# Also grab the target OU itself (in case it is linked directly)
|
|
$targetOUObj = Get-ADObject `
|
|
-Identity $TargetOU `
|
|
-Properties gPLink
|
|
if ($targetOUObj) {
|
|
$ouObjects += $targetOUObj
|
|
}
|
|
|
|
# ------------------------------------------------------------------
|
|
# 2. Build a hashtable: GPO_GUID => list of OU DNs it is linked to
|
|
# This is entirely opaque voodoo, i have no idea what's going on
|
|
# ------------------------------------------------------------------
|
|
|
|
$gpoLinks = @{}
|
|
|
|
foreach ($ou in $ouObjects) {
|
|
if ($ou.gPLink) {
|
|
foreach ($link in ($ou.gPLink -split ';')) {
|
|
$linkTrim = $link.Trim('[', ']')
|
|
if ($linkTrim -match '\{(?<guid>[0-9a-fA-F-]+)\}') {
|
|
$guid = $Matches.guid
|
|
if (-not $gpoLinks.ContainsKey($guid)) {
|
|
$gpoLinks[$guid] = @()
|
|
}
|
|
$gpoLinks[$guid] += $ou.DistinguishedName
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if (-not $gpoLinks.Count) {
|
|
Write-Host "No GPOs linked under the searched OU tree." -ForegroundColor Yellow
|
|
exit
|
|
}
|
|
|
|
Write-Host "Found $($gpoLinks.Count) distinct GPO(s) linked in the OU tree."
|
|
Add-Content -Path $OutputFile -Value " gpo_links: $($gpoLinks.Count)"
|
|
|
|
# ----------------------------------------------------
|
|
# 3. For each GPO, get an XML report and pull RestrictedGroup nodes
|
|
# ----------------------------------------------------
|
|
|
|
Add-Content -Path $OutputFile -Value " configured_gpos:"
|
|
foreach ($gpoGuid in $gpoLinks.Keys) {
|
|
try {
|
|
$gpo = Get-GPO -Guid $gpoGuid -ErrorAction Stop
|
|
}
|
|
catch {
|
|
Write-Warning "Unable to retrieve GPO $gpoGuid - skipping."
|
|
continue
|
|
}
|
|
Write-Host "GPO: $($gpo.DisplayName)"
|
|
Add-Content -Path $OutputFile -Value " $($gpo.DisplayName):"
|
|
|
|
# Pull the XML report
|
|
try {
|
|
$xmlString = Get-GPOReport -Guid $gpoGuid -ReportType Xml -ErrorAction Stop
|
|
}
|
|
catch {
|
|
Write-Warning "Unable to generate XML report for $($gpo.DisplayName)."
|
|
continue
|
|
}
|
|
|
|
$xml = [xml]$xmlString
|
|
|
|
$ns = New-Object System.Xml.XmlNamespaceManager ($xml.NameTable)
|
|
$ns.AddNamespace('m', 'http://www.microsoft.com/GroupPolicy/Settings') # default namespace
|
|
$ns.AddNamespace('q1', 'http://www.microsoft.com/GroupPolicy/Settings/Security')
|
|
$ns.AddNamespace('t', 'http://www.microsoft.com/GroupPolicy/Types')
|
|
$ns.AddNamespace('xsi','http://www.w3.org/2001/XMLSchema-instance')
|
|
|
|
# Find every <q1:RestrictedGroups> element
|
|
$restrictedGroups = $xml.SelectNodes('//q1:RestrictedGroups', $ns)
|
|
|
|
# Loop and build the string
|
|
foreach ($rg in $restrictedGroups) {
|
|
$adGroupName = ($rg.SelectSingleNode('q1:GroupName/t:Name', $ns)).InnerText
|
|
$localGroupName = ($rg.SelectSingleNode('q1:Memberof/t:Name', $ns)).InnerText
|
|
$plainAD_Groupname = ($adGroupName -split '\\')[-1]
|
|
Write-Output "AD Group: $adGroupName - Local Group: $localGroupName"
|
|
Add-Content -Path $OutputFile -Value " - ad_group: $plainAD_Groupname"
|
|
Add-Content -Path $OutputFile -Value " local_group: $localGroupName"
|
|
}
|
|
Add-Content -Path $OutputFile -Value ""
|
|
}
|
|
Add-Content -Path $OutputFile -Value "..."
|