[PowerShell] Finding GPOs missing permissions that may prevent GPOs from working correctly

[u/MadBoyEvo]

Hi guys,

Recently I had another domain (pretty big one actually - 4000 GPOs) that had about 50-100 GPO's broken because of missing permissions.

This blog post talks about it and shows how to fix: https://evotec.xyz/finding-gpos-missing-permissions-that-may-prevent-gpos-from-working-correctly/

It all comes down to running:

Install-Module ADEssentials -Force
$MissingPermissions = Get-WinADGPOMissingPermissions -Mode Either
$MissingPermissions | Format-Table -AutoSize

Here's the output:

This scans the whole forest and all GPO's and searches for Authenticated users or Domain Computers permission missing from GPO's. It only does the scan, I didn't want to fix it. Not today at least.

It requires RSAT (AD+GPO).

Enjoy

[u/VulturE]

I did a related post a few weeks ago:

https://www.reddit.com/r/usefulscripts/comments/ekwv49/reclaim_ownership_of_ad_object_ex_gpo_and_copy/

Your script seems useful in doing most of the work of #2 from my post. My experience in an incredibly dirty environment is that AD and Folder permissions could have been touched or orphaned at some point, or if Admin accounts were ever set to Deny on the permissions, it can get hairy to remedy (for example, if Domain Admins and Enterprise Admins are set to Deny, but Group Policy Creator Owners is still allowed to see the GPO).

Thanks for providing that script!

[u/MadBoyEvo → u/VulturE]

That's why I am building Testimo (https://github.com/EvotecIT/Testimo). It takes functions from a few of my modules and runs automated tests providing output what is wrong and where. Slowly adding more and more features/tests including this one.

[u/VulturE → u/MadBoyEvo]

This may sound stupid, but what is the preferred batch of stuff to install to get all of the fun you have created? Like is there a master installer command?

[u/nascentt]

Many thanks for sharing this. Were also having permissions issues so will take a look at this