silverhack / voyeur Goto Github PK

silverhack,

I was trying to run this script today and export to excel. I was met with:

"Exception getting "Item": "Invalid index. (Exception from HRESULT: 0x8002000B (DISP_E_BADINDEX))"

I've been reading about the error online and see some solutions talking about $var.workbook.add() vs. $var.worksheet.add(), but I'm unsure where it's failing.

I took a stab at it and commented out lines 33-36 and the scripts appears to have run successfully and produced a pretty excel file for me. It looks like those lines were attempting to delete the extra two worksheets that usually get created with a new Excel file. I don't know if it changed in Excel 2013 or if the environment I'm in has anything in place to limit the number of worksheets in a newly created workbook.

I don't know if this is something you'd want to add an if-statement to in order to determine the Office version before attempting to delete the excess sheets.

Thanks for the tool though. I'm looking forward to really reading through the script to learn more about how you're pulling this information.

-Chris

Hello,

if anyone experienced program code execution issues while using "-ExportACL" switch, i suggest "Plugins\ACL.ps1" file code changes:

Change following line:
---cut-----------------------------------------------
"Risk" = (Get-Icon $acl.ActiveDirectoryRights)
"Risk" = (Get-Icon $acl.ActiveDirectoryRights).ToString()
"AppliesTo" = [String]$AppliesTo
---cut-----------------------------------------------

to following code (basically comment the line of code):
---cut-----------------------------------------------
"Risk" = (Get-Icon $acl.ActiveDirectoryRights)
#"Risk" = (Get-Icon $acl.ActiveDirectoryRights).ToString()
"AppliesTo" = [String]$AppliesTo
---cut-----------------------------------------------

In any case big thank you to the author of the voyeur!

When running the tool and exporting to excel I am only seeing a single column (in this case, "whenChanged") I have tried the following:

• default config setting, as well as
• defining custom filters

Not sure what the culprit could be here, thoughts?

There is possible XML search function problem due to "-ErrorAction Stop" in GPP plugin (Plugins\GppPasswords.ps1).
Suggest change following code:
---cut-----------------------------------------
$AllFiles = Get-ChildItem "\$DomainName\SYSVOL" -Recurse -ErrorAction Stop -Include 'Groups.xml','Services.xml','ScheduledTasks.xml','DataSources.xml','Drives.xml'
---cut-----------------------------------------

to following code:
---cut-----------------------------------------
$AllFiles = Get-ChildItem "\$DomainName\SYSVOL" -Recurse -ErrorAction Continue -Include 'Groups.xml','Services.xml','ScheduledTasks.xml','DataSources.xml','Drives.xml'
---cut-----------------------------------------

There is mistype in "Plugins\GppPasswords.ps1", which leads to not-functioning main GPP process.
Suggest change following code:
---cut-----------------------------------------------
Write-Host ("{0}: {1}" -f "Group Policy task ID $bgRunspaceID", "Retrieve potential files with Username:passwords from $DomainName")`
-ForegroundColor Magenta
---cut-----------------------------------------------

to following code:
---cut-----------------------------------------------
Write-Host ("{0}: {1}" -f "Group Policy task ID $bgRunspaceID", "Retrieve potential files with **Username:passwords from $DomainName") -ForegroundColor Magenta
---cut-----------------------------------------------

When running the script against a DC known to have multiple groups.xml files with one or more cpassword values populated the script is consistently returning "WARNING: No group policy preferences found on Domain...."

In the event that the script is still targetting the wrong DC I've tried:

• hardcoding the IP address of the DC
• flushing DNS til the nslookup for matches the IP of a known target
• rerunning the script with different variables modified in GppPasswords.ps1

Initial thoughts are that the script is running into issues crawling the policies so I tried setting the "-errorAction" flag to something other than "Error" but still no luck.

This is being run from a non-domain joined machine using the "-AlternateCredentials" flag
Let me know what other information I can provide