Misc/Get-ADGPOPermisisons.ps1 at main · PyroTek3/Misc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
# PowerShell script authored by Sean Metcalf (@PyroTek3)
# 2025-09-03
# Script provided as-is
Param
 (
    $Domain = $env:userdnsdomain
 )

[Array]$DomainGPOArray = Get-GPO -All -Domain $Domain
$DomainGPOOwnerArray = @()
ForEach ($DomainGPOItem in $DomainGPOArray)
 {
    $DomainGPOItem | Add-Member -MemberType NoteProperty -Name Default -Value $False -Force
    IF ( ($DomainGPOItem.Owner -like '*Domain Admins') -OR ($DomainGPOItem.Owner -like '*Enterprise Admins') )
     { $DomainGPOItem | Add-Member -MemberType NoteProperty -Name Default -Value $True -Force }
    ELSE
     { $DomainGPOItem | Add-Member -MemberType NoteProperty -Name Default -Value $False -Force }
     [array]$DomainGPOOwnerArray += $DomainGPOItem
 }

$DomainGPOOwnerArray | Select DisplayName,Owner,id,Default | Format-Table -AutoSize


[Array]$DomainGPOArray = Get-GPO -All -Domain $Domain
$GPOPermissionArray = @()
ForEach ($DomainGPOArrayItem in $DomainGPOArray)
 {
    $GPPermissionArray = @()
    $GPPermissionArray = Get-GPPermissions -Guid $DomainGPOArrayItem.Id -All | Where {$_.Trustee.SidType.ToString() -ne "WellKnownGroup"}
    ForEach ($GPPermissionArrayItem in $GPPermissionArray)
     {
        $GPOPermissionArrayRecord = New-Object PSObject
        $GPOPermissionArrayRecord | Add-Member -MemberType NoteProperty -Name GPOName -Value $DomainGPOArrayItem.DisplayName -Force
        $GPOPermissionArrayRecord | Add-Member -MemberType NoteProperty -Name AccountName -Value $GPPermissionArrayItem.Trustee.Name -Force
        $GPOPermissionArrayRecord | Add-Member -MemberType NoteProperty -Name AccountType -Value $GPPermissionArrayItem.Trustee.SidType.ToString() -Force
        $GPOPermissionArrayRecord | Add-Member -MemberType NoteProperty -Name Permissions -Value $GPPermissionArrayItem.Permission -Force
        IF ( ($GPPermissionArrayItem.Trustee.Name -eq 'Domain Admins') -OR ($GPPermissionArrayItem.Trustee.Name -eq 'Enterprise Admins') )
         { $GPOPermissionArrayRecord | Add-Member -MemberType NoteProperty -Name Default -Value $True -Force }
        ELSE
         { $GPOPermissionArrayRecord | Add-Member -MemberType NoteProperty -Name Default -Value $False -Force }
        $GPOPermissionArray += $GPOPermissionArrayRecord
     }
 }
$GPOPermissionArray | Format-Table -AutoSize