JimSycurity

#requires -version 5.1
#requires -module GroupPolicy,ActiveDirectory

Function Get-GPLink {
<#
.Synopsis
Get Group Policy Object links
.Description
This command will display the links to existing Group Policy objects. You can filter for enabled or disabled links. The default user domain is queried although you can specify an alternate domain and/or a specific domain controller. There is no provision for alternate credentials.

JimSycurity

# Here's the DefaultSecurityDescriptor for objects of class User:
# This is defined by the AD Schema.
D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)(A;;RPLCLORC;;;PS)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a56-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;RPWP;77B5B886-944A-11d1-AEBD-00
00F80367C1;;PS)(OA;;RPWP;E45795B2-9455-11d1-AEBD-0000F80367C1;;PS)(OA;;RPWP;E45795B3-9455-11d1-AEBD-0000F80367C1;;PS)(OA;;RP;037088f8-0ae1-11d2-b422-00a0c968f939;;RS)(OA;;RP;4c164200-20c0-11d0-a768-00aa006e0529;;RS)(OA;;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;;RS)(A;;RC;;;AU)(OA;;RP;59ba2f42-79a2-11d0-9020-00c
04fc2d3cf;;AU)(OA;;RP;77B5B886-944A-11d1-AEBD-0000F80367C1;;AU)(OA;;RP;E45795B3-9455-11d1-AEBD-0000F80367C1;;AU)(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)(OA;;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;;RS)(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa0

JimSycurity

# Dump AD Schema and then filter on defaultSecurityDescriptor (would be more efficient to filter left)
Import-Module ActiveDirectory
$schemapath = (Get-ADRootDSE).schemanamingContext
$Schema = get-adobject -Filter * -SearchBase $schemapath -Properties *
$DefaultCO = $Schema | Where-Object {$_.defaultSecurityDescriptor -match ';CO\)'}

# Display Option 1
$DefaultCO | Select-Object -Property Name, defaultSecurityDescriptor | ft -AutoSize

JimSycurity

## Gather raw attributes for AD Trusted Domain Objects
$TDOs = @()
[array]$TDOs = Get-ADObject -SearchBase (Get-ADRootDSE).defaultNamingContext -LDAPFilter '(trustType=*)' -Properties *

## Essential Attributes of a Trusted Domain Object: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/c9efe39c-f5f9-43e9-9479-941c20d0e590