0

I am writing a script that will grab the audit settings of all GPOs in my Active Directory forest. I get most of what I need with this:

Get-Gpo -All |
    ForEach-Object {$GPO = $_.DisplayName; Get-Acl -Path ("AD:\" + $_.Path) -Audit |
        Select-Object @{n="GPO";e={$GPO}},PSChildName,AuditToString,Audit,AccessToString,sddl} | 
            select GPO,AuditToString,AccessToString,sddl | 
                Format-list |
                    out-file C:\Users\scott\Desktop\gpo_acl.txt

The output from this looks like this:

GPO           : Server 2019
AuditToString : Everyone Success  
                Everyone Failure  
                Everyone Success  
                Everyone Success  
Sddl          : PAI(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)(A;CI;LCRPLORC;;;ED)

GPO           : Computer Quarantine
AuditToString : Everyone Success  
                Everyone Failure  
                Everyone Success  
                Everyone Success  
Sddl          : PAI(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)(A;CI;LCRPLORC;;;ED)

(I truncated the Sddl output because it would make information public that I didn't want public.) What I'm now trying to accomplish is to make that Sddl output more human readable. I can manually copy the Sddl output into a command like this:

ConvertFrom-SddlString -sddl "PAI(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)(A;CI;LCRPLORC;;;ED)" -type ActiveDirectoryRights |
Select-Object -ExpandProperty DiscretionaryAcl

And it gives me output that looks nicer, like this:

NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS: AccessAllowed (GenericExecute, GenericRead, ListChildren, ListObject, ReadControl, ReadProperty)
NT AUTHORITY\Authenticated Users: AccessAllowed (GenericExecute, GenericRead, ListChildren, ListObject, ReadControl, ReadProperty)
NT AUTHORITY\SYSTEM: AccessAllowed (CreateChild, Delete, DeleteChild, DeleteTree, ExecuteKey, FullControl, GenericExecute, GenericRead, GenericWrite, ListChildren, ListObject, Read, ReadAndExecute, ReadControl, ReadProperty, Self, WriteDacl, WriteKey, WriteOwner, WriteProperty)

I'm trying to get that nicer output within the for-each loop I posted in the beginning. A colleague suggested adding this hashtable at the end of the select-object:

Get-Gpo -All |
    ForEach-Object {$GPO = $_.DisplayName; Get-Acl -Path ("AD:\" + $_.Path) -Audit |
        Select-Object @{n="GPO";e={$GPO}},PSChildName,AuditToString,Audit,AccessToString,sddl @{n="SDDLString";e={ConvertFrom-SddlString($_.sddl)}}} | 
            select GPO,AuditToString,AccessToString,sddl | 
                Format-list |
                    out-file C:\Users\scott\Desktop\gpo_acl.txt

but it prints the name of the object instead of the content. Ideally, I'd like the output to look something like this:

GPO           : Server 2019
AuditToString : Everyone Success  
                Everyone Failure  
                Everyone Success  
                Everyone Success  
Sddl          : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS: AccessAllowed (GenericExecute, GenericRead, ListChildren, ListObject, ReadControl, ReadProperty)
NT AUTHORITY\Authenticated Users: AccessAllowed (GenericExecute, GenericRead, ListChildren, ListObject, ReadControl, ReadProperty)
NT AUTHORITY\SYSTEM: AccessAllowed (CreateChild, Delete, DeleteChild, DeleteTree, ExecuteKey, FullControl, GenericExecute, GenericRead, GenericWrite, ListChildren, ListObject, Read, ReadAndExecute, ReadControl, ReadProperty, Self, WriteDacl, WriteKey, WriteOwner, WriteProperty)

GPO           : Computer Quarantine
AuditToString : Everyone Success  
                Everyone Failure  
                Everyone Success  
                Everyone Success  
Sddl          : NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS: AccessAllowed (GenericExecute, GenericRead, ListChildren, ListObject, ReadControl, ReadProperty)
NT AUTHORITY\Authenticated Users: AccessAllowed (GenericExecute, GenericRead, ListChildren, ListObject, ReadControl, ReadProperty)
NT AUTHORITY\SYSTEM: AccessAllowed (CreateChild, Delete, DeleteChild, DeleteTree, ExecuteKey, FullControl, GenericExecute, GenericRead, GenericWrite, ListChildren, ListObject, Read, ReadAndExecute, ReadControl, ReadProperty, Self, WriteDacl, WriteKey, WriteOwner, WriteProperty)

Any suggestions would be very appreciated.

5
  • You would be best servied by including a specimen of your desired output.
    – Semicolon
    Jan 29, 2021 at 18:03
  • Also, can you double-check the code you posted? I would expect this whole line to throw an error "Select-Object @{n="GPO";e={$GPO}},PSChildName,AuditToString,Audit,AccessToString,sddl} @{n="SDDLString";e=(ConvertFrom-SddlString($_.sddl)}"
    – Semicolon
    Jan 29, 2021 at 18:04
  • Thank you for pointing out my syntax error. Fixed now. My desired output would be the output I currently get, but with the sddl line in human readable form. Something like this: Jan 29, 2021 at 19:01
  • Go back and edit your post
    – Semicolon
    Jan 29, 2021 at 19:05
  • Ok, I edited the original post to add my vision at the end. Jan 29, 2021 at 19:59

1 Answer 1

0

I think this might get you something closer to what you were expecting; I'm sure you can pop back in the Out-File yourself:

Get-Gpo -All |
    ForEach-Object {$GPO = $_.DisplayName; Get-Acl -Path ("AD:\" + $_.Path) -Audit |
        Select-Object -Property `
           @{n="GPO";e={$GPO}}, `
           AuditToString, `
           @{n="SDDLString";e={(ConvertFrom-SddlString -Sddl $_.Sddl).SystemAcl}}
    } | Format-List

Mind the line breaks; they're just here so you don't have to side scroll

1
  • When I run that, it prompts me to supply a value for the SDDL parameter. Hitting enter gives me an error. The output still goes to the outfile and the SDDLString is populated with only information for the Everyone group. Feb 1, 2021 at 12:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .