RootDC-GPO-Cleaner.ps1

<# 
.SYNOPSIS
  RootDC-GPO-Cleaner — audit and optional remediation for GPO hygiene at scale.

.REQUIREMENTS
  - Windows PowerShell 5.1+ or PowerShell 7 with WindowsCompatibility
  - RSAT: ActiveDirectory, GroupPolicy modules
  - Domain auth with read access to Sysvol/AD and GPO ACLs

.USAGE
  # Audit only
  .\RootDC-GPO-Cleaner.ps1 -ExportPath C:\Reports -CountryFilter FRA,POL,ESP

  # Audit + generate remediation script (no changes now)
  .\RootDC-GPO-Cleaner.ps1 -ExportPath C:\Reports -CountryFilter FRA -GenerateRemediation

.NOTES
  Conventions enforced (from RootDC.io):
   - Only process GPOs whose DisplayName starts with a country trigram: ^([A-Z]{3})_
   - Allowed baseline trustees (delegation):
       Authenticated Users (Read only is tolerated)
       Domain Admins
       Enterprise Admins
       Enterprise Domain Controllers
       SYSTEM
       XXX_GS_T1_*              # country-scoped Tier1 groups
       GG_GPO_XXX_*             # central GPO admin groups per country
       GRP_GL_Admin_<CountryFull>  # optional naming
   - Column “Country” is populated with the trigram. No “UNK”.

#>

[CmdletBinding()]
param(
  [Parameter(Mandatory=$true)]
  [ValidateNotNullOrEmpty()]
  [string] $ExportPath,

  # Process only these country trigrams. If empty, process all matching ^[A-Z]{3}_.
  [string[]] $CountryFilter = @(),

  # If set, write a remediation script that can fix delegations and disable stale GPOs.
  [switch] $GenerateRemediation
)

# -------------------- Guardrails --------------------
$ErrorActionPreference = 'Stop'
Set-StrictMode -Version Latest

function Test-Module {
  param([string]$Name)
  if (-not (Get-Module -ListAvailable -Name $Name)) {
    throw "Module '$Name' not found. Install RSAT component containing $Name."
  }
}

Test-Module -Name ActiveDirectory
Test-Module -Name GroupPolicy

Import-Module ActiveDirectory -ErrorAction Stop
Import-Module GroupPolicy -ErrorAction Stop

# Ensure export path
$null = New-Item -ItemType Directory -Path $ExportPath -Force

# -------------------- Helpers --------------------
function Get-CountryFromName {
  param([string]$DisplayName)
  $m = [regex]::Match($DisplayName, '^(?<cc>[A-Z]{3})_')
  if ($m.Success) { return $m.Groups['cc'].Value } else { return $null }
}

# Allowed patterns. Country placeholder ‘XXX’ replaced with actual trigram.
$BaselineAllowed = @(
  '^SYSTEM$',
  '^Domain Admins$',
  '^Enterprise Admins$',
  '^Enterprise Domain Controllers$',
  '^Authenticated Users$'              # Read-only tolerated
)

# Patterns that include the country trigram
$CountryAllowed = @(
  '^XXX_GS_T1_.*$',
  '^GG_GPO_XXX_.*$',
  '^GRP_GL_Admin_.*$'                  # free-form country full name group
)

# Map effective permission names that imply more than Read
# Get-GPPermissions returns: GpoRead, GpoApply, GpoEdit, GpoEditDeleteModifySecurity
$WriteLike = @('GpoEdit','GpoEditDeleteModifySecurity')

# -------------------- Data shells --------------------
$Audit = New-Object System.Collections.Generic.List[object]
$DelegFindings = New-Object System.Collections.Generic.List[object]
$LinkIssues = New-Object System.Collections.Generic.List[object]

# Collect all GPOs quickly
$allGpos = Get-GPO -All

# Optionally narrow by country prefix
if ($CountryFilter.Count -gt 0) {
  $allGpos = $allGpos | Where-Object {
    $cc = Get-CountryFromName $_.DisplayName
    $cc -and ($CountryFilter -contains $cc)
  }
} else {
  $allGpos = $allGpos | Where-Object { Get-CountryFromName $_.DisplayName }
}

# Preload WMI filters to resolve object names fast
$wmiFiltersById = @{}
try {
  foreach ($wf in Get-GPWmiFilter) { $wmiFiltersById[$wf.Id] = $wf }
} catch { } # not fatal

# -------------------- Main loop --------------------
Write-Verbose "Evaluating $($allGpos.Count) GPOs..."

foreach ($g in $allGpos) {
  $cc = Get-CountryFromName $g.DisplayName
  if (-not $cc) { continue } # enforced rule

  # Grab XML once and reuse
  $xmlPath = Join-Path $env:TEMP ("gpo_{0}.xml" -f $g.Id)
  Get-GPOReport -Guid $g.Id -ReportType Xml -Path $xmlPath
  [xml]$gx = Get-Content -LiteralPath $xmlPath -Encoding UTF8

  # Determine emptiness by checking for any settings extensions
  $hasUserExt  = $gx.GPO.User.ExtensionData.Extension -ne $null
  $hasCompExt  = $gx.GPO.Computer.ExtensionData.Extension -ne $null
  $isEmpty     = -not ($hasUserExt -or $hasCompExt)

  # Links
  $links = @()
  if ($gx.GPO.LinksTo) {
    $links = @($gx.GPO.LinksTo | ForEach-Object {
      [pscustomobject]@{
        Target = $_.SOMPath
        Enabled = [bool]$_.Enabled
        NoOverride = [bool]$_.NoOverride
        Order = [int]$_.Order
      }
    })
  }
  $isUnlinked = ($links.Count -eq 0)

  # WMI filter
  $wmi = $null
  if ($gx.GPO.FilterName -and $gx.GPO.FilterId) {
    $wmi = [pscustomobject]@{
      Id   = $gx.GPO.FilterId
      Name = $gx.GPO.FilterName
    }
  }

  # Delegation and security filtering
  $perms = Get-GPPermissions -Guid $g.Id -All
  # Build set of Security Filtering subjects (Apply Group Policy permission)
  $securityFiltering = $perms | Where-Object { $_.Permission -eq 'GpoApply' } | Select-Object -ExpandProperty Trustee | Sort-Object -Unique

  # Evaluate unexpected trustees
  $unexpected = New-Object System.Collections.Generic.List[string]

  # Build allowed regexes for this country
  $allowed = @()
  $allowed += $BaselineAllowed
  foreach ($p in $CountryAllowed) {
    $allowed += ($p -replace 'XXX', [regex]::Escape($cc))
  }

  foreach ($p in $perms) {
    $name = $p.Trustee
    $perm = $p.Permission

    # Unresolved SIDs are exposed as raw SID strings sometimes
    $isSid = $false
    try { $null = New-Object System.Security.Principal.SecurityIdentifier($name); $isSid = $true } catch { $isSid = $false }

    $isAllowedByPattern = $false
    foreach ($rx in $allowed) {
      if ($name -match $rx) { $isAllowedByPattern = $true; break }
    }

    $isReadOnly = ($perm -eq 'GpoRead' -or $perm -eq 'GpoApply')
    $isWriteLike = $WriteLike -contains $perm

    # Rule: read-only entries are tolerated ONLY if they are part of Security Filtering or baseline patterns.
    $readIsOk =
      ($perm -eq 'GpoRead' -and ($name -eq 'Authenticated Users' -or $isAllowedByPattern)) -or
      ($perm -eq 'GpoApply' -and ($securityFiltering -contains $name))

    $violation = $false
    if (-not $isAllowedByPattern) {
      if ($isWriteLike) { $violation = $true }
      elseif (-not $readIsOk) { $violation = $true }
    }

    if ($violation) {
      $unexpected.Add($name)
      $DelegFindings.Add([pscustomobject]@{
        GpoName           = $g.DisplayName
        Country           = $cc
        GpoId             = $g.Id
        Trustee           = $name
        Permission        = $perm
        InSecurityFilter  = ($securityFiltering -contains $name)
        Note              = $(if ($isSid) { 'Unresolved SID or external principal' } else { 'Non-standard principal' })
      })
    }
  }

  # Disabled halves
  $disabledState = switch ($g.GpoStatus) {
    'AllSettingsEnabled'        { 'Enabled' }
    'UserSettingsDisabled'      { 'UserDisabled' }
    'ComputerSettingsDisabled'  { 'ComputerDisabled' }
    'AllSettingsDisabled'       { 'Disabled' }
    default { $g.GpoStatus }
  }

  # Build audit row
  $Audit.Add([pscustomobject]@{
    Country            = $cc
    GpoName            = $g.DisplayName
    GpoId              = $g.Id
    Owner              = $gx.GPO.SecurityDescriptor.Owner.Name
    Created            = [datetime]$g.CreationTime
    Modified           = [datetime]$g.ModificationTime
    Status             = $disabledState
    HasUserSettings    = [bool]$hasUserExt
    HasComputerSettings= [bool]$hasCompExt
    IsEmpty            = [bool]$isEmpty
    IsUnlinked         = [bool]$isUnlinked
    WmiFilter          = $(if ($wmi) { $wmi.Name } else { '' })
    LinkCount          = $links.Count
    UnexpectedObjects  = ($unexpected -join '; ')
  })

  # Link issues table for quick triage
  if ($isUnlinked -or $isEmpty) {
    $LinkIssues.Add([pscustomobject]@{
      Country  = $cc
      GpoName  = $g.DisplayName
      GpoId    = $g.Id
      Reason   = @(
        $(if ($isUnlinked) { 'Unlinked' }),
        $(if ($isEmpty)   { 'Empty' })
      ) -join '+'
      Status   = $disabledState
    })
  }
}

# -------------------- Exports --------------------
$ts = Get-Date -Format 'yyyyMMdd_HHmmss'
$pathAudit   = Join-Path $ExportPath "GPO_Audit_$ts.csv"
$pathDeleg   = Join-Path $ExportPath "GPO_DelegationFindings_$ts.csv"
$pathLink    = Join-Path $ExportPath "GPO_LinkIssues_$ts.csv"
$pathRemed   = Join-Path $ExportPath "GPO_Remediation_$ts.ps1"

$Audit        | Sort-Object Country,GpoName       | Export-Csv -NoTypeInformation -Encoding UTF8 -Path $pathAudit
$DelegFindings| Sort-Object Country,GpoName,Trustee| Export-Csv -NoTypeInformation -Encoding UTF8 -Path $pathDeleg
$LinkIssues   | Sort-Object Country,GpoName       | Export-Csv -NoTypeInformation -Encoding UTF8 -Path $pathLink

Write-Host "Reports:" -ForegroundColor Cyan
Write-Host " - $pathAudit"
Write-Host " - $pathDeleg"
Write-Host " - $pathLink"

# -------------------- Optional remediation generator --------------------
if ($GenerateRemediation) {
@"
<# Autogenerated remediation — review before execution.
   - Removes all UnexpectedObjects from each GPO ACL.
   - Disables GPOs that are Empty+Unlinked.
   - Safe by default: -WhatIf on every change. Remove -WhatIf after review.
#>

param([switch]`$Execute)  # when used, removes -WhatIf from calls

Import-Module GroupPolicy

`$audit = Import-Csv '$pathAudit'
`$deleg = Import-Csv '$pathDeleg'

# 1) Fix delegations
`$groupsByGpo = `$deleg | Group-Object GpoId
foreach (`$g in `$groupsByGpo) {
  `$gid = `$g.Name
  `$toRemove = `$g.Group | Select-Object -ExpandProperty Trustee -Unique
  foreach (`$t in `$toRemove) {
    try {
      if (`$Execute) {
        Set-GPPermissions -Guid `$gid -TargetName `$t -TargetType Group -Permission None
      } else {
        Set-GPPermissions -Guid `$gid -TargetName `$t -TargetType Group -Permission None -WhatIf
      }
    } catch {
      # Try as user in case trustee is a user
      try {
        if (`$Execute) {
          Set-GPPermissions -Guid `$gid -TargetName `$t -TargetType User -Permission None
        } else {
          Set-GPPermissions -Guid `$gid -TargetName `$t -TargetType User -Permission None -WhatIf
        }
      } catch {
        Write-Warning "Could not remove trustee [`$t] from GPO [`$gid]: `$($_.Exception.Message)"
      }
    }
  }
}

# 2) Disable empty and unlinked
`$toDisable = `$audit | Where-Object { `$_.IsEmpty -eq 'True' -and `$_.IsUnlinked -eq 'True' -and `$_.Status -ne 'Disabled' }
foreach (`$row in `$toDisable) {
  try {
    if (`$Execute) {
      Set-GPO -Guid `$row.GpoId -Status AllSettingsDisabled
    } else {
      Set-GPO -Guid `$row.GpoId -Status AllSettingsDisabled -WhatIf
    }
  } catch {
    Write-Warning "Could not disable GPO [`$($row.GpoName)]: `$($_.Exception.Message)"
  }
}

Write-Host "Remediation plan complete." -ForegroundColor Green
"@ | Set-Content -Path $pathRemed -Encoding UTF8

Write-Host "Remediation script: $pathRemed"
}

Write-Host "Done." -ForegroundColor Green