Skip to content

Commit 893c8f3

Browse files
FriedrichWeinmannFriedrichWeinmann
authored
Merge pull request #100 from ActiveDirectoryManagementFramework/development
218
2 parents 602324a + bd41c83 commit 893c8f3

17 files changed

+260
-142
lines changed

‎DomainManagement/DomainManagement.psd1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
RootModule = 'DomainManagement.psm1'
44

55
# Version number of this module.
6-
ModuleVersion = '1.9.210'
6+
ModuleVersion = '1.9.218'
77

88
# ID used to uniquely identify this module
99
GUID = '0a405382-ebc2-445b-8325-541535810193'

‎DomainManagement/changelog.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,16 @@
11
# Changelog
22

3+
## 1.9.218 (2025-05-28)
4+
5+
- Upd: Organizational Units - added ability to define GP inheritance blocking. Defaults to NOT block.
6+
- Upd: Users - added ability to specify custom attributes/properties for users.
7+
- Upd: AccessRules - added configuration property showing what context it comes from.
8+
- Upd: AccessRules - will ignore Group Policy AD Objects - they are governed by the GP Permissions component
9+
- Fix: AccessRules - objects that have no default permission generate an empty restore result
10+
- Fix: GroupPolicy - Reports wrong Policyname when failing to read GPO tracking file
11+
- Fix: GroupPolicy - Fails with the wrong error when the GPO no longer has a matching directory in SYSVOL.
12+
- Fix: GroupMemberships - Cannot unregister group memberships assigned based on categories.
13+
314
## 1.9.210 (2024-12-13)
415

516
- Upd: Content Mode - added ability to exclude individual Components from constrained Content Mode

‎DomainManagement/functions/AccessRule/Register-DMAccessRule.ps1‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,11 @@
6262
By default, Test-DMAccessRule will generate a "FixConfig" result for accessrules that have been explicitly defined but are also part of the Schema Default permissions.
6363
If this setting is enabled, this result object is suppressed.
6464
65+
.PARAMETER ContextName
66+
The name of the context defining the setting.
67+
This allows determining the configuration set that provided this setting.
68+
Used by the ADMF, available to any other configuration management solution.
69+
6570
.EXAMPLE
6671
PS C:\> Register-DMAccessRule -ObjectCategory DomainControllers -Identity '%DomainName%\Domain Admins' -ActiveDirectoryRights GenericAll
6772
@@ -111,7 +116,10 @@
111116
$Present = 'true',
112117

113118
[bool]
114-
$NoFixConfig = $false
119+
$NoFixConfig = $false,
120+
121+
[string]
122+
$ContextName = '<Undefined>'
115123
)
116124

117125
process {
@@ -130,6 +138,7 @@
130138
Optional = $Optional
131139
Present = $Present
132140
NoFixConfig = $NoFixConfig
141+
ContextName = $ContextName
133142
}
134143
}
135144
'Category' {
@@ -146,6 +155,7 @@
146155
Optional = $Optional
147156
Present = $Present
148157
NoFixConfig = $NoFixConfig
158+
ContextName = $ContextName
149159
}
150160
}
151161
}

‎DomainManagement/functions/AccessRule/Test-DMAccessRule.ps1‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,9 @@
193193
# Prevent duplicate processing
194194
if ($processed[$foundADObject.DistinguishedName]) { continue }
195195
$processed[$foundADObject.DistinguishedName] = $true
196+
197+
# Skip GPOs, as those are handled within the GP Permissions Component
198+
if ($foundADObject.DistinguishedName -match 'CN={[^,]+},CN=Policies,CN=System,') { continue }
196199

197200
# Skip items that were defined in configuration, they were already processed
198201
if ($foundADObject.DistinguishedName -in $resolvedConfiguredObjects) { continue }

‎DomainManagement/functions/gplinks/Register-DMGPLink.ps1‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,11 @@
5050
.PARAMETER Present
5151
Whether the link should be present at all.
5252
Relevant in additive mode, to retain the capability to delete undesired links.
53+
54+
.PARAMETER ContextName
55+
The name of the context defining the setting.
56+
This allows determining the configuration set that provided this setting.
57+
Used by the ADMF, available to any other configuration management solution.
5358
5459
.EXAMPLE
5560
PS C:\> Get-Content $configPath | ConvertFrom-Json | Write-Output | Register-DMGPLink
@@ -91,7 +96,10 @@
9196

9297
[Parameter(ValueFromPipelineByPropertyName = $true)]
9398
[bool]
94-
$Present = $true
99+
$Present = $true,
100+
101+
[string]
102+
$ContextName = '<Undefined>'
95103
)
96104

97105
process {
@@ -109,6 +117,7 @@
109117
State = $State
110118
ProcessingMode = $ProcessingMode
111119
Present = $Present
120+
ContextName = $ContextName
112121
}
113122
}
114123
'Filter' {
@@ -124,6 +133,7 @@
124133
State = $State
125134
ProcessingMode = $ProcessingMode
126135
Present = $Present
136+
ContextName = $ContextName
127137
}
128138
}
129139
}

‎DomainManagement/functions/groupmemberships/Register-DMGroupMembership.ps1‎

Lines changed: 71 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
function Register-DMGroupMembership {
2-
<#
2+
<#
33
.SYNOPSIS
44
Registers a group membership assignment as desired state.
55
@@ -56,83 +56,84 @@
5656
Imports all defined groupmemberships from the targeted json configuration file.
5757
#>
5858

59-
[CmdletBinding(DefaultParameterSetName = 'Entry')]
60-
param (
61-
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Entry')]
62-
[string]
63-
$Name,
59+
[CmdletBinding(DefaultParameterSetName = 'Entry')]
60+
param (
61+
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Entry')]
62+
[string]
63+
$Name,
6464

65-
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Entry')]
66-
[string]
67-
$Domain,
65+
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Entry')]
66+
[string]
67+
$Domain,
6868

69-
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Entry')]
70-
[ValidateSet('User', 'Group', 'foreignSecurityPrincipal', 'Computer', 'msDS-GroupManagedServiceAccount')]
71-
[string]
72-
$ItemType,
69+
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Entry')]
70+
[ValidateSet('User', 'Group', 'foreignSecurityPrincipal', 'Computer', 'msDS-GroupManagedServiceAccount')]
71+
[string]
72+
$ItemType,
7373

74-
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Category')]
75-
[string]
76-
$ObjectCategory,
74+
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Category')]
75+
[string]
76+
$ObjectCategory,
7777

78-
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Entry')]
79-
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Category')]
80-
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Empty')]
81-
[string]
82-
$Group,
78+
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Entry')]
79+
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Category')]
80+
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Empty')]
81+
[string]
82+
$Group,
8383

84-
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Empty')]
85-
[bool]
86-
$Empty,
84+
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Empty')]
85+
[bool]
86+
$Empty,
8787

88-
[Parameter(ValueFromPipelineByPropertyName = $true)]
89-
[ValidateSet('Default', 'MayBeMember', 'MemberIfExists', 'MayBeMemberIfExists')]
90-
[string]
91-
$Mode = 'Default',
88+
[Parameter(ValueFromPipelineByPropertyName = $true)]
89+
[ValidateSet('Default', 'MayBeMember', 'MemberIfExists', 'MayBeMemberIfExists')]
90+
[string]
91+
$Mode = 'Default',
9292

93-
[Parameter(ValueFromPipelineByPropertyName = $true)]
94-
[ValidateSet('Constrained', 'Additive')]
95-
[string]
96-
$GroupProcessingMode,
93+
[Parameter(ValueFromPipelineByPropertyName = $true)]
94+
[ValidateSet('Constrained', 'Additive')]
95+
[string]
96+
$GroupProcessingMode,
9797

98-
[string]
99-
$ContextName = '<Undefined>'
100-
)
98+
[string]
99+
$ContextName = '<Undefined>'
100+
)
101101

102-
process {
103-
if (-not $script:groupMemberShips[$Group]) {
104-
$script:groupMemberShips[$Group] = @{ }
105-
}
106-
if ($Name) {
107-
$script:groupMemberShips[$Group]["$($ItemType):$($Name)"] = [PSCustomObject]@{
108-
PSTypeName = 'DomainManagement.GroupMembership'
109-
Name = $Name
110-
Domain = $Domain
111-
ItemType = $ItemType
112-
Group = $Group
113-
Mode = $Mode
114-
ContextName = $ContextName
115-
}
116-
}
117-
elseif ($ObjectCategory) {
118-
$script:groupMemberShips[$Group]["ObjectCategory:$($ObjectCategory)"] = [PSCustomObject]@{
119-
PSTypeName = 'DomainManagement.GroupMembership'
120-
Category = $ObjectCategory
121-
Group = $Group
122-
Mode = $Mode
123-
ContextName = $ContextName
124-
}
125-
}
126-
elseif ($Empty) {
127-
$script:groupMemberShips[$Group] = @{ }
128-
}
102+
process {
103+
if (-not $script:groupMemberShips[$Group]) {
104+
$script:groupMemberShips[$Group] = @{ }
105+
}
106+
if ($Name) {
107+
$script:groupMemberShips[$Group]["$($ItemType):$($Name)"] = [PSCustomObject]@{
108+
PSTypeName = 'DomainManagement.GroupMembership'
109+
Name = $Name
110+
Domain = $Domain
111+
ItemType = $ItemType
112+
Group = $Group
113+
Mode = $Mode
114+
ContextName = $ContextName
115+
}
116+
}
117+
elseif ($ObjectCategory) {
118+
$script:groupMemberShips[$Group]["ObjectCategory:$($ObjectCategory)"] = [PSCustomObject]@{
119+
PSTypeName = 'DomainManagement.GroupMembership'
120+
Category = $ObjectCategory
121+
Group = $Group
122+
Mode = $Mode
123+
ContextName = $ContextName
124+
}
125+
}
126+
elseif ($Empty) {
127+
$script:groupMemberShips[$Group] = @{ }
128+
}
129129

130-
if ($GroupProcessingMode) {
131-
$script:groupMemberShips[$Group]['__Configuration'] = [PSCustomObject]@{
132-
PSTypeName = 'DomainManagement.GroupMembership.Configuration'
133-
ProcessingMode = $GroupProcessingMode
134-
Group = $Group
135-
}
136-
}
137-
}
130+
if ($GroupProcessingMode) {
131+
$script:groupMemberShips[$Group]['__Configuration'] = [PSCustomObject]@{
132+
PSTypeName = 'DomainManagement.GroupMembership.Configuration'
133+
ProcessingMode = $GroupProcessingMode
134+
Group = $Group
135+
ContextName = $ContextName
136+
}
137+
}
138+
}
138139
}

‎DomainManagement/functions/groupmemberships/Unregister-DMGroupMembership.ps1‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@
1212
1313
.PARAMETER ItemType
1414
The type of object the identity being granted group membership is.
15+
16+
.PARAMETER Category
17+
The Object Category that defines the members.
1518
1619
.PARAMETER Group
1720
The group being granted membership in.
@@ -35,8 +38,13 @@
3538
[string]
3639
$ItemType,
3740

41+
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Category')]
42+
[string]
43+
$Category,
44+
3845
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Processing')]
3946
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Identity')]
47+
[Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'Category')]
4048
[string]
4149
$Group,
4250

@@ -59,6 +67,10 @@
5967
$null = $script:groupMemberShips.Remove($Group)
6068
return
6169
}
70+
if ($Category) {
71+
$null = $script:groupMemberShips.Remove("ObjectCategory:$Category")
72+
return
73+
}
6274
if (-not $script:groupMemberShips[$Group]["$($ItemType):$($Name)"]) { return }
6375
$null = $script:groupMemberShips[$Group].Remove("$($ItemType):$($Name)")
6476
if (-not $script:groupMemberShips[$Group].Count) {

‎DomainManagement/functions/grouppolicies/Test-DMGroupPolicy.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@
8181
}
8282
# Resolve-PolicyRevision updates the content of $groupPolicy without producing output
8383
try { Resolve-PolicyRevision -Policy $groupPolicy -Session $session }
84-
catch { Write-PSFMessage -Level Warning -String 'Test-DMGroupPolicy.PolicyRevision.Lookup.Failed' -StringValues $allPolicies.DisplayName -ErrorRecord $_ -EnableException $EnableException.ToBool() }
84+
catch { Write-PSFMessage -Level Warning -String 'Test-DMGroupPolicy.PolicyRevision.Lookup.Failed' -StringValues $groupPolicy.DisplayName -ErrorRecord $_ -EnableException $EnableException.ToBool() }
8585
}
8686
$desiredHash = @{ }
8787
$policyHash = @{ }

0 commit comments

Comments
 (0)