Skip to content

Instantly share code, notes, and snippets.

@OmerMicrosoft
Last active July 3, 2023 18:23
  • Star 0 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
Star You must be signed in to star a gist
Save OmerMicrosoft/4eda2010c5810dc0e54225cc400211fd to your computer and use it in GitHub Desktop.
Find Group Policies with Missing Permissions
#Find Group Policies with Missing Permissions
Function Get-GPMissingPermissionsGPOs
{
$MissingPermissionsGPOArray = New-Object System.Collections.ArrayList
$GPOs = Get-GPO -all
foreach ($GPO in $GPOs) {
If ($GPO.User.Enabled) {
$GPOPermissionForAuthUsers = Get-GPPermission -Guid $GPO.Id -All | select -ExpandProperty Trustee | ? {$_.Name -eq "Authenticated Users"}
$GPOPermissionForDomainComputers = Get-GPPermission -Guid $GPO.Id -All | select -ExpandProperty Trustee | ? {$_.Name -eq "Domain Computers"}
If (!$GPOPermissionForAuthUsers -and !$GPOPermissionForDomainComputers) {
$MissingPermissionsGPOArray.Add($GPO)| Out-Null
}
}
}
If ($MissingPermissionsGPOArray.Count -ne 0) {
Write-Warning "The following Group Policy Objects do not grant any permissions to the 'Authenticated Users' or 'Domain Computers' groups:"
foreach ($GPOWithMissingPermissions in $MissingPermissionsGPOArray) {
Write-Host "'$($GPOWithMissingPermissions.DisplayName)'"
}
}
Else {
Write-Host "All Group Policy Objects grant required permissions. No issues were found." -ForegroundColor Green
}
}
@g-karpov
Copy link

For using in localized versions (non English) use SIDs:

$AuthenticatedUsersSID = "S-1-5-11"
$DomainComputersSID = [string](Get-ADDomain).DomainSID+'-515'

$GPOPermissionForAuthUsers = Get-GPPermission -Guid $GPO.Id -All | select -ExpandProperty Trustee | ? {$_.SID -eq $AuthenticatedUsersSID}
$GPOPermissionForDomainComputers = Get-GPPermission -Guid $GPO.Id -All | select -ExpandProperty Trustee | ? {$_.SID -eq $DomainComputersSID}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment