Gouvernance et délégation des GPO¶

# Create delegation groups for GPO governance
New-ADGroup -Name "GRP-GPO-Creators"     -GroupScope Global -GroupCategory Security `
    -Description "Members can create new GPOs in GPMC"
New-ADGroup -Name "GRP-GPO-Approvers"   -GroupScope Global -GroupCategory Security `
    -Description "Full control over GPOs — production approval gate"
New-ADGroup -Name "GRP-GPO-Linkers"     -GroupScope Global -GroupCategory Security `
    -Description "Can link GPOs to designated OUs"
New-ADGroup -Name "GRP-Equipe-PDT"      -GroupScope Global -GroupCategory Security `
    -Description "Workstation team — editor on workstation GPOs only"
New-ADGroup -Name "GRP-Equipe-Serveurs" -GroupScope Global -GroupCategory Security `
    -Description "Server team — editor on server GPOs only"

# Grant GPO creation rights to the infrastructure team
Add-ADGroupMember -Identity "Group Policy Creator Owners" `
    -Members "GRP-GPO-Creators"

# Remove CREATOR OWNER from a GPO immediately after creation
# Run this right after New-GPO or after any new GPO is created via GPMC
$gpoName = "APP-Edge-ConfigEntreprise"

Set-GPPermissions -Name $gpoName `
    -TargetName "CREATOR OWNER" `
    -TargetType Group `
    -PermissionLevel None

# Wrapper function for GPO creation with automatic CREATOR OWNER cleanup
function New-ManagedGPO {
    param(
        [Parameter(Mandatory)] [string] $Name,
        [Parameter(Mandatory)] [string] $Comment,
        [string] $Domain = $env:USERDNSDOMAIN
    )

    # Create the GPO
    $gpo = New-GPO -Name $Name -Domain $Domain -Comment $Comment

    # Wait for AD replication before modifying permissions
    Start-Sleep -Seconds 2

    # Remove CREATOR OWNER — mandatory governance step
    Set-GPPermissions -Guid $gpo.Id `
        -TargetName "CREATOR OWNER" `
        -TargetType Group `
        -PermissionLevel None

    # Grant Full Control to the approvers group
    Set-GPPermissions -Guid $gpo.Id `
        -TargetName "GRP-GPO-Approvers" `
        -TargetType Group `
        -PermissionLevel GpoEditDeleteModifySecurity

    Write-Host "GPO created and secured: $Name" -ForegroundColor Green
    return $gpo
}

# Usage
New-ManagedGPO -Name "APP-Teams-ConfigEntreprise" `
               -Comment "Teams : configuration enterprise. Créé: 2026-04-05."

# Grant edit rights to the workstation team on their specific GPO
Set-GPPermissions -Name "APP-Edge-ConfigEntreprise" `
    -TargetName "GRP-Equipe-PDT" `
    -TargetType Group `
    -PermissionLevel GpoEdit

# Grant GpoEdit to a team on all GPOs matching a naming pattern
$team  = "GRP-Equipe-PDT"
$pattern = "APP-*"      # All application GPOs belong to this team

Get-GPO -All | Where-Object { $_.DisplayName -like $pattern } | ForEach-Object {
    Set-GPPermissions -Guid $_.Id `
        -TargetName $team `
        -TargetType Group `
        -PermissionLevel GpoEdit
    Write-Host "Edit granted on: $($_.DisplayName)"
}

# Revoke all permissions for a specific trustee on a specific GPO
Set-GPPermissions -Name "APP-Edge-ConfigEntreprise" `
    -TargetName "GRP-Prestataire-Externe" `
    -TargetType Group `
    -PermissionLevel None

# Delegate GPO linking permission on a specific OU
# The gPLink attribute GUID is fixed across all Windows AD schemas
Import-Module ActiveDirectory

$ouDN    = "OU=Postes-Standard,DC=contoso,DC=local"
$group   = "GRP-GPO-Linkers"

# Retrieve current ACL from the OU object
$ou      = Get-ADOrganizationalUnit -Identity $ouDN
$acl     = Get-Acl -Path "AD:\$($ou.DistinguishedName)"

# Build the ACE: WriteProperty on gPLink attribute
$identity  = (Get-ADGroup $group).SID
$adRight   = [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty
$type      = [System.Security.AccessControl.AccessControlType]::Allow
$gplinkGuid = New-Object Guid "f30e3bc1-9ff0-11d1-b603-0000f80367c1"  # gPLink schema GUID

$ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule `
    $identity, $adRight, $type, $gplinkGuid

$acl.AddAccessRule($ace)
Set-Acl -Path "AD:\$($ou.DistinguishedName)" -AclObject $acl

Write-Host "GPO linking delegated on $ouDN to $group" -ForegroundColor Green

# Verify that gPLink write permission is correctly set on the OU
$ouDN  = "OU=Postes-Standard,DC=contoso,DC=local"
$acl   = Get-Acl -Path "AD:\$ouDN"

$acl.Access | Where-Object {
    $_.ObjectType -eq [Guid]"f30e3bc1-9ff0-11d1-b603-0000f80367c1"
} | Select-Object IdentityReference, ActiveDirectoryRights, AccessControlType

# Delegate GPO linking on all OUs directly under Postes-de-travail
$parentOU = "OU=Postes-de-travail,DC=contoso,DC=local"
$group    = "GRP-GPO-Linkers"
$identity = (Get-ADGroup $group).SID
$adRight  = [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty
$type     = [System.Security.AccessControl.AccessControlType]::Allow
$gplinkGuid = New-Object Guid "f30e3bc1-9ff0-11d1-b603-0000f80367c1"

Get-ADOrganizationalUnit -SearchBase $parentOU -SearchScope OneLevel -Filter * |
    ForEach-Object {
        $acl = Get-Acl -Path "AD:\$($_.DistinguishedName)"
        $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule `
            $identity, $adRight, $type, $gplinkGuid
        $acl.AddAccessRule($ace)
        Set-Acl -Path "AD:\$($_.DistinguishedName)" -AclObject $acl
        Write-Host "Delegated: $($_.DistinguishedName)"
    }

# Full GPO permissions audit — exports all trustees and permission levels
Get-GPO -All | ForEach-Object {
    $gpoName = $_.DisplayName
    Get-GPPermissions -Guid $_.Id -All | ForEach-Object {
        [PSCustomObject]@{
            GPO        = $gpoName
            Trustee    = $_.Trustee.Name
            TrusteeType = $_.Trustee.SidType
            Permission = $_.Permission
            Inherited  = $_.Inherited
        }
    }
} | Export-Csv "C:\Temp\gpo-permissions-audit.csv" -NoTypeInformation -Encoding UTF8

Write-Host "Audit exported: C:\Temp\gpo-permissions-audit.csv" -ForegroundColor Green

# Find GPOs where non-admin groups have Edit or higher permissions
$adminGroups = @(
    "Domain Admins",
    "Enterprise Admins",
    "SYSTEM",
    "GRP-GPO-Approvers"   # adjust to your environment
)

Get-GPO -All | ForEach-Object {
    $gpoName = $_.DisplayName
    Get-GPPermissions -Guid $_.Id -All |
        Where-Object {
            $_.Permission -in @("GpoEdit", "GpoEditDeleteModifySecurity") -and
            $_.Trustee.Name -notin $adminGroups
        } |
        ForEach-Object {
            [PSCustomObject]@{
                GPO      = $gpoName
                Trustee  = $_.Trustee.Name
                Level    = $_.Permission
                Flag     = "REVIEW REQUIRED"
            }
        }
} | Sort-Object GPO | Format-Table -AutoSize

# Find all GPOs where CREATOR OWNER still has explicit permissions
$creatorOwnerGPOs = Get-GPO -All | ForEach-Object {
    $perms = Get-GPPermissions -Guid $_.Id -All -ErrorAction SilentlyContinue
    $co    = $perms | Where-Object { $_.Trustee.Name -eq "CREATOR OWNER" }
    if ($co) {
        [PSCustomObject]@{
            GPO        = $_.DisplayName
            GUID       = $_.Id
            Permission = $co.Permission
            Created    = $_.CreationTime.ToString("yyyy-MM-dd")
            Modified   = $_.ModificationTime.ToString("yyyy-MM-dd")
        }
    }
}

$creatorOwnerGPOs | Format-Table -AutoSize

Write-Host "`n$($creatorOwnerGPOs.Count) GPO(s) with CREATOR OWNER permissions." -ForegroundColor Yellow

# Remove CREATOR OWNER from all GPOs — run after audit review
Get-GPO -All | ForEach-Object {
    $perms = Get-GPPermissions -Guid $_.Id -All -ErrorAction SilentlyContinue
    if ($perms | Where-Object { $_.Trustee.Name -eq "CREATOR OWNER" }) {
        Set-GPPermissions -Guid $_.Id `
            -TargetName "CREATOR OWNER" `
            -TargetType Group `
            -PermissionLevel None
        Write-Host "Fixed: $($_.DisplayName)" -ForegroundColor Green
    }
}

# List GPOs whose Owner is not a known admin group
$expectedOwners = @("Domain Admins", "Enterprise Admins", "CONTOSO\Infra-Team")

Get-GPO -All | Where-Object { $_.Owner -notin $expectedOwners } |
    Select-Object DisplayName, Owner, CreationTime |
    Sort-Object Owner |
    Format-Table -AutoSize

# Export all GPOs to a folder for Git versioning
# Run this before and after any change as part of your change process
$exportPath = "C:\GPO-Backup\$(Get-Date -Format 'yyyy-MM-dd_HH-mm')"
New-Item -ItemType Directory -Path $exportPath -Force | Out-Null

Get-GPO -All | ForEach-Object {
    $gpoFolder = Join-Path $exportPath $_.DisplayName.Replace(" ", "_")
    Backup-GPO -Guid $_.Id -Path $exportPath | Out-Null
}

Write-Host "GPOs exported to: $exportPath" -ForegroundColor Green
# Commit this folder to Git — change history becomes your audit trail

# Set or update the description on a GPO — minimum viable documentation
Set-GPO -Name "SEC-Postes-Baseline" -Comment "Baseline de securite pour tous les postes de travail.
Cree: 2026-01-15 par J.Dupont (ticket CHG-2026-001).
Lie a: OU=Postes-de-travail.
Modifiee: 2026-04-05 — Ajout desactivation USB autorun (incident INC-2026-042).
Sections actives: Computer uniquement."

# Bulk-check which GPOs have an empty description
Get-GPO -All | Where-Object { [string]::IsNullOrWhiteSpace($_.Description) } |
    Select-Object DisplayName, CreationTime, ModificationTime |
    Sort-Object CreationTime |
    Format-Table -AutoSize

# List all members of Group Policy Creator Owners
Get-ADGroupMember -Identity "Group Policy Creator Owners" -Recursive |
    Select-Object Name, SamAccountName, objectClass |
    Format-Table -AutoSize

# Find all unlinked GPOs older than 30 days
$cutoff = (Get-Date).AddDays(-30)

Get-GPO -All | ForEach-Object {
    $report = [xml](Get-GPOReport -Guid $_.Id -ReportType Xml)
    if (-not $report.GPO.LinksTo -and $_.CreationTime -lt $cutoff) {
        [PSCustomObject]@{
            Name        = $_.DisplayName
            Created     = $_.CreationTime.ToString("yyyy-MM-dd")
            LastModified = $_.ModificationTime.ToString("yyyy-MM-dd")
            DaysOld     = [int]((Get-Date) - $_.CreationTime).TotalDays
        }
    }
} | Sort-Object DaysOld -Descending | Format-Table -AutoSize

# Quick check: find groups with "prestataire" or "externe" in their name having edit rights
Get-GPO -All | ForEach-Object {
    $gpoName = $_.DisplayName
    Get-GPPermissions -Guid $_.Id -All |
        Where-Object {
            $_.Trustee.Name -match "prestataire|externe|vendor|contractor" -and
            $_.Permission -in @("GpoEdit", "GpoEditDeleteModifySecurity")
        } |
        ForEach-Object {
            [PSCustomObject]@{
                GPO     = $gpoName
                Trustee = $_.Trustee.Name
                Level   = $_.Permission
                Action  = "REVOKE IF MISSION ENDED"
            }
        }
} | Format-Table -AutoSize