MapGPOsToOUs.ps1

MapGPOsToOUs.ps1

## Human Readable
$checkGPO = "All"; ## You can also put the displayName of specific GPO here
$optLookup=@{"0"="Not Enforced & Enabled"; "1"="Not Enforced & Not Enabled";"2"="Enforced & Enabled";"3"="Enforced & Not Enabled"};$objMap=@{};$linkMap=@{};Write-Host "# GPO Overview";([ADSISearcher]"(gpLink=*)").FindAll() | %{ $linkedObj = $_;$gpLinks=($_.Properties.gplink[0] -split {$_ -eq '[' -or $_ -eq ']'} | ? {$_}); ForEach($gpLink in $gpLinks){
    $dn,$gpLinkOpt = ($gpLink -Split ';');
    $gpoObj = ([ADSI]"$dn");
    $gpoObjName = $gpoObj.displayName[0];
    $gpoNameAndOpt = "$($gpoObjName) ($($optLookup[$gpLinkOpt]))";
    if($checkGPO -ne "All" -and $gpoObjName -ne $checkGPO){
        Continue
    }
    $loDn = $linkedObj.Properties.distinguishedname[0];
    ## By GPO
    $objNames = If ($linkMap.ContainsKey($gpoNameAndOpt)) { ,$linkMap[$gpoNameAndOpt] } Else { ,@() };
    $objNames += "$($loDn)";
    $linkMap[$gpoNameAndOpt] = $objNames;
    ## By Object
    $gpoNameArr = If ($objMap.ContainsKey($loDn)) { ,$objMap[$loDn] } Else { ,@() };
    $gpoNameArr += "$($gpoObjName) ($($optLookup[$gpLinkOpt]))";
    $objMap[$loDn] = $gpoNameArr;
}}
Write-Output "## By GPO";
$linkMap.Keys | % { Write-Output "`n[*] $($_)"; ForEach($loDn in $linkMap.Item($_)){ Write-Output "  $($loDn)"} };
if($checkGPO -eq "All"){
Write-Output "`n## By OU";
$objMap.Keys | % { Write-Output "`n[*] $($_)"; ForEach($gpoName in $objMap.Item($_)){ Write-Output "  $($gpoName)"} };
}

## Inline
## $checkGPO = "All";$optLookup=@{"0"="Not Enforced & Enabled"; "1"="Not Enforced & Not Enabled";"2"="Enforced & Enabled";"3"="Enforced & Not Enabled"};$objMap=@{};$linkMap=@{};Write-Host "# GPO Overview";([ADSISearcher]"(gpLink=*)").FindAll() | %{ $linkedObj = $_;$gpLinks=($_.Properties.gplink[0] -split {$_ -eq '[' -or $_ -eq ']'} | ? {$_}); ForEach($gpLink in $gpLinks){$dn,$gpLinkOpt = ($gpLink -Split ';');$gpoObj = ([ADSI]"$dn");$gpoObjName = $gpoObj.displayName[0];$gpoNameAndOpt = "$($gpoObjName) ($($optLookup[$gpLinkOpt]))";if($checkGPO -ne "All" -and $gpoObjName -ne $checkGPO){ Continue };$loDn = $linkedObj.Properties.distinguishedname[0];$objNames = If ($linkMap.ContainsKey($gpoNameAndOpt)) { ,$linkMap[$gpoNameAndOpt] } Else { ,@() };$objNames += "$($loDn)";$linkMap[$gpoNameAndOpt] = $objNames;$gpoNameArr = If ($objMap.ContainsKey($loDn)) { ,$objMap[$loDn] } Else { ,@() };$gpoNameArr += "$($gpoObjName) ($($optLookup[$gpLinkOpt]))";$objMap[$loDn] = $gpoNameArr;}};Write-Output "## By GPO";$linkMap.Keys | % { Write-Output "`n[*] $($_)"; ForEach($loDn in $linkMap.Item($_)){ Write-Output "  $($loDn)"} };if($checkGPO -eq "All"){Write-Output "`n## By OU";$objMap.Keys | % { Write-Output "`n[*] $($_)"; ForEach($gpoName in $objMap.Item($_)){ Write-Output "  $($gpoName)"} };}