search

EvotecIT / Testimo

Testimo is a PowerShell module for running health checks for Active Directory against a bunch of different tests
MIT License
539 stars 58 forks source link

3 issues left #153

Open SUBnet192 opened 2 years ago

SUBnet192 commented 2 years ago

image

GPO Permission Consistency is fine (according to the GPMC sync test) Files on SYSVOL are not Orphaned (should be fine as well, I don't see anything orphaned) Netlogon Owner: fails, no idea why.

Everything else is now green (in my test lab) - I'm documenting what needs to be fixed for each issue and automating the resolution of these issues. At the same time, I'm going through and helping you find issues with code. Is there a better way to submit questions than submitting an Issue? I know I could ask you on Reddit as well but at least here it's centralized.

PrzemyslawKlys commented 2 years ago

Use:

  1. Invoke-GPOZaurr -Type GPOConsistency - you will see it's not consistent. Default deployed forest starts inconsistent :) and GPMC Test - oh well
  2. To be honest just run Invoke-GPOZaurr without anything and you will see

For both 2 nd 3 I need more data to be able to tell if there's something wrong. Probably from GPOZaurr, not testimo, as those commands take input from GPOZaurr.

SUBnet192 commented 2 years ago

Running GPOZaurr by itself, will see what I get. Everything was fine last time I checked...

  1. GPO Consistency says every single GPO isn't consistent. Consistent with what exactly? :)
  2. Netlogon owners and permissions is blank

image

PrzemyslawKlys commented 2 years ago

I guess you have 0 files - and hence the error. I need to update the test. I expected at least 1 file.

For GPOCosistency - the consistency is checked between AD and SYSVOL. They are supposed to match. Same goes for consistency for files inside the GPO on sysvol - it should match with top-level permissions.

image

SUBnet192 commented 2 years ago

Oh! Ok, I'll create something in Netlogon and rerun. That would make sense ;) And yes you'll have cases where net logon is empty... Rare but happens ;)

Permissions are fine for the Consistency, I guess there's something between AD and SYSVOL. I'll investigate and report. Thank you!