AD
Automated documentation
Last Backup date
Health Checks
Nested group membership
Directory Trusts
Change tracking
Need to know what’s changed in your AD?
NOTE - Auditing must be enabled:
Configure as GPO deployed over DC’s OU -> Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Configuration
Make sure to not select everything unless you require it. Event Log size often gets quickly out of control. Also, check out what happens with your event logs and configure appropriately.
Available reports:
- Computer changes – Created / Changed – ADComputerCreatedChanged
- Computer changes – Detailed – ADComputerChangesDetailed
- Computer deleted – ADComputerDeleted
- Group changes – ADGroupChanges
- Group changes – Detailed – ADGroupChangesDetailed
- Group changes – Created / Deleted – ADGroupCreateDelete
- Group enumeration – ADGroupEnumeration
- Group membership changes – ADGroupMembershipChanges
- Group policy changes – ADGroupPolicyChanges
- Logs Cleared Other – ADLogsClearedOther
- Logs Cleared Security – ADLogsClearedSecurity
- User changes – ADUserChanges
- User changes detailed – ADUserChangesDetailed
- User lockouts – ADUserLockouts
- User logon – ADUserLogon
- User logon Kerberos – ADUserLogonKerberos
- User status changes – ADUserStatus
- User unlocks – ADUserUnlocked
GPO
GPOZaurr
[…] it’s a tool to eat your Group Policies and tell you what’s wrong with them or give you data for further analysis with zero effort on your side.
Available reports:
- GPOBroken – this report can detect GPOs that are broken. By broken GPOs, I mean those which exist in AD but have no SYSVOL content or vice versa – have SYSVOL content, but there’s no AD metadata. Additionally, it can detect GPO objects that are no longer GroupPolicy objects (how that happens, I’m not able to tell - replication issue, I guess). Then it provides an easy way to fix it using given step by step instructions.
- GPOBrokenLink – this report can detect links that have no matching GPO. For example, if a GPO is deleted, sometimes links to that GPO are not properly removed. This command can detect that and propose a solution.
- GPOOwners – this report focuses on GPO Owners. By design, if Domain Admin creates GPO, the owner of GPO is the domain admins group. This report detects GPOs that are not owned by Domain Admins (in both SYSVOL and AD) and provides a way to fix them.
- GPOConsistency – this report detects inconsistent permissions between Active Directory and SYSVOL, verifying that files/folders inside each GPO match permissions as required. It then provides you an option to fix it.
- GPODuplicates – this report detects GPOs that are CNF, otherwise known as duplicate AD Objects, and provides a way to remove them.
- GPOList – this report summarizes all group policies focusing on detecting Empty, Unlinked, Disabled, No Apply Permissions GPOs. It also can detect GPOs that are not optimized or have potential problems (disabled section, but still settings in it)
- GPOLinks – this report summarizes links showing where the GPO is linked, whether it’s linked to any site, cross-domain, or the status of links.
- GPOPassword – this report should detect passwords stored in GPOs.
- GPOPermissions – this report provides full permissions overview for all GPOs. It detects GPOs missing read permissions for Authenticated Users, GPOs that miss Domain Admins, Enterprise Admins, or SYSTEM permissions. It also detects GPOs that have Unknown permissions available. Finally, it allows you to fix permissions for all those GPOs easily. It’s basically a one-stop for all permission needs.
- GPOPermissionsAdministrative – this report focuses only on detecting missing Domain Admins, Enterprise Admins permissions and allows you to fix those in no time.
- GPOPermissionsRead – similar to an administrative report, but this one focuses on Authenticated Users missing their permissions.
- GPOPermissionsRoot – this report shows all permissions assigned to the root of the group policy container. It allows you to verify who can manage all GPOs quickly.
- GPOPermissionsUnknown – this report focuses on detecting unknown permissions (deleted users) and allows you to remove them painlessly.
- GPOFiles – this report lists all files in the SYSVOL folder (including hidden ones) and tries to make a decent guess whether the file placement based on extension/type makes sense or requires additional verification. This was written to find potential malware or legacy files that can be safely deleted.
- GPOBlockedheritance – this report checks for all Organizational Units with blocked inheritance and verifies the number of users or computers affected.
- GPOAnalysis – this report reads all content of group policies and puts them into 70+ categories. It can show things like GPOs that do Drive Mapping, Bitlocker, Laps, Printers, etc. It’s handy to find dead settings, dead hosts, or settings that no longer make sense.
- NetLogonOwners – this report focuses on detecting NetLogon Owners and a way to fix it to default, secure values. NetLogonPermissions – this report provides an overview and assessment of all permissions on the NetLogon share.
- SysVolLegacyFiles – this report detects SYSVOL Legacy Files (.adm) files.