search

EvotecIT / GPOZaurr

Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.
844 stars 79 forks source link

Empty OU detection doesn't acknowledge AD printers #39

Closed SirMikeDouglas closed 1 year ago

SirMikeDouglas commented 1 year ago

The OU scan appears to only see Users, Computers and Groups when giving the recommendation to delete an "empty" OU. Manually going through the list I noticed a couple of our recommended OUs to delete were well populated with printer objects.

PrzemyslawKlys commented 1 year ago

It's doing a bit more. 

Get-ADObject -LDAPFilter "(|(ObjectClass=user)(ObjectClass=contact)(ObjectClass=computer)(ObjectClass=group)(objectClass=inetOrgPerson))"

Would you be able to test proper ADObject filter as I don't have printers in my domain.

SirMikeDouglas commented 1 year ago

I can definitely test. What all do you need me to do? Just add a (ObjectClass=printer) in that?

From: Przemysław Kłys @.> Sent: Friday, January 27, 2023 10:31 AM To: EvotecIT/GPOZaurr @.> Cc: SirMikeDouglas @.>; Author @.> Subject: Re: [EvotecIT/GPOZaurr] Empty OU detection doesn't acknowledge AD printers (Issue #39)

It's doing a bit more.

Get-ADObject -LDAPFilter "(|(ObjectClass=user)(ObjectClass=contact)(ObjectClass=computer)(ObjectClass=group)(objectClass=inetOrgPerson))"

Would you be able to test proper ADObject filter as I don't have printers in my domain.

— Reply to this email directly, view it on GitHub https://github.com/EvotecIT/GPOZaurr/issues/39#issuecomment-1406740305 , or unsubscribe https://github.com/notifications/unsubscribe-auth/ANBNU24XF76JOHUSIV5DFD3WUPZ4JANCNFSM6AAAAAAUI4GJBM . You are receiving this because you authored the thread. https://github.com/notifications/beacon/ANBNU23JF77NXE4LWVKMCVTWUPZ4JA5CNFSM6AAAAAAUI4GJBOWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTST3ETVC.gif Message ID: @. @.> >

PrzemyslawKlys commented 1 year ago

Ye, pretty much - if that is the printer object that you see. If it returns them including others - we should be good.

SirMikeDouglas commented 1 year ago

OK, will do. I forwarded the email to my work and will test on Monday.

From: Przemysław Kłys @.> Sent: Saturday, January 28, 2023 9:08 AM To: EvotecIT/GPOZaurr @.> Cc: SirMikeDouglas @.>; Author @.> Subject: Re: [EvotecIT/GPOZaurr] Empty OU detection doesn't acknowledge AD printers (Issue #39)

Ye, pretty much - if that is the printer object that you see. If it returns them including others - we should be good.

— Reply to this email directly, view it on GitHub https://github.com/EvotecIT/GPOZaurr/issues/39#issuecomment-1407417700 , or unsubscribe https://github.com/notifications/unsubscribe-auth/ANBNU24XFROVLP4MYU7JX7TWUUY4DANCNFSM6AAAAAAUI4GJBM . You are receiving this because you authored the thread. https://github.com/notifications/beacon/ANBNU22QBVOVYQSHQEJFLU3WUUY4DA5CNFSM6AAAAAAUI4GJBOWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTST4N6WI.gif Message ID: @. @.> >

SirMikeDouglas commented 1 year ago

Looks like it has to be PrintQueue not Printer.

(ObjectClass=PrintQueue)

From: Przemysław Kłys @.> Sent: Saturday, January 28, 2023 9:08 AM To: EvotecIT/GPOZaurr @.> Cc: SirMikeDouglas @.>; Author @.> Subject: Re: [EvotecIT/GPOZaurr] Empty OU detection doesn't acknowledge AD printers (Issue #39)

Ye, pretty much - if that is the printer object that you see. If it returns them including others - we should be good.

— Reply to this email directly, view it on GitHub https://github.com/EvotecIT/GPOZaurr/issues/39#issuecomment-1407417700 , or unsubscribe https://github.com/notifications/unsubscribe-auth/ANBNU24XFROVLP4MYU7JX7TWUUY4DANCNFSM6AAAAAAUI4GJBM . You are receiving this because you authored the thread. https://github.com/notifications/beacon/ANBNU22QBVOVYQSHQEJFLU3WUUY4DA5CNFSM6AAAAAAUI4GJBOWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTST4N6WI.gif Message ID: @. @.> >

Karl-WE commented 1 year ago

Having no printers is a good idea for less headache. But seriously you can install use any Windows Server share a printer and right click publish them to AD. Not sure if a printing role is needed (eventually it is)

SirMikeDouglas commented 1 year ago

I agree but I inherited this and I have to work with what I have. By the way, kudos on a job extremely well done. I’m loving GPOZaurr as it has found lots of things from previous admins that have done so many things I never would have. This has gone from a simple audit to a daily project and many Change Requests for corrective actions. Thank You

From: Karl Wester-Ebbinghaus @.> Sent: Saturday, February 18, 2023 7:26 AM To: EvotecIT/GPOZaurr @.> Cc: SirMikeDouglas @.>; Author @.> Subject: Re: [EvotecIT/GPOZaurr] Empty OU detection doesn't acknowledge AD printers (Issue #39)

Having no printers is a good idea for less headache. But seriously you can install use any Windows Server share a printer and right click publish them to AD. Not sure if a printing role is needed (eventually it is)

— Reply to this email directly, view it on GitHub https://github.com/EvotecIT/GPOZaurr/issues/39#issuecomment-1435669307 , or unsubscribe https://github.com/notifications/unsubscribe-auth/ANBNU24UN66RLYKQOA5Z4MDWYDEVPANCNFSM6AAAAAAUI4GJBM . You are receiving this because you authored the thread. https://github.com/notifications/beacon/ANBNU22USEYTAV3V4PXLOD3WYDEVPA5CNFSM6AAAAAAUI4GJBOWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTSVSKJTW.gif Message ID: @. @.> >

Karl-WE commented 1 year ago

I believe when publishing printers to AD they are all located in one specific OU.

Can one elaborate why it should be feasible to move these Auto generated print queue objects around to other User OUs?

@PrzemyslawKlys have my comment been helpful for you how to create AD printer objects?

PrzemyslawKlys commented 1 year ago

I don't think it's about moving (while you may need that for an answer), but a script marked OU as empty when objects were inside. This is wrong and should be now fixed.

As for creating Printer objects, I don't think I need them in my AD ;)