如何从 Powershell 中的 Get-GPOReport 解析 XML？

Question

我正在尝试从 Get-GPOReport 生成的 XML 报告中获取驱动器盘符和安装位置，并将它们放在散列 table.

中

为了获得 XML 我正在尝试从我运行

那里获取信息

[xml]$gporeport = Get-GPOReport -name "somegpo" -ReportType xml

结果如下XML

<?xml version="1.0" encoding="utf-16"?>
<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{466FD23F-3D4C-4908-859D-8A02EE9874B1}</Identifier>
    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">example.com</Domain>
  </Identifier>
  <Name>GPO_Drive_Map</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2019-03-15T18:51:30</CreatedTime>
  <ModifiedTime>2019-06-26T20:30:42</ModifiedTime>
  <ReadTime>2020-09-08T20:03:51.6746055Z</ReadTime>
  <SecurityDescriptor>
    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:</SDDL>
    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"></SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">example.com\Domain Admins</Name>
    </Owner>
    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"></SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">example\Domain Admins</Name>
    </Group>
    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"></SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"></SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"></SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">example.com\Domain Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"></SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"></SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">example.com\group</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit Settings</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types"></SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">example.com\Enterprise Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>2</VersionDirectory>
    <VersionSysvol>2</VersionSysvol>
    <Enabled>true</Enabled>
  </Computer>
  <User>
    <VersionDirectory>20</VersionDirectory>
    <VersionSysvol>20</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/DriveMaps" xsi:type="q1:DriveMapSettings">
        <q1:DriveMapSettings clsid="{Some-SID}">
          <q1:Drive clsid="{another_sid}" name="F:" status="F:" image="2" changed="2019-03-15 19:08:41" uid="{anothersid}" bypassErrors="1">
            <q1:GPOSettingOrder>1</q1:GPOSettingOrder>
            <q1:Properties action="U" thisDrive="NOCHANGE" allDrives="NOCHANGE" userName="" path="\fs.example.com\data" label="LABEL" persistent="1" useLetter="1" letter="F" />
            <q1:Filters />
          </q1:Drive>
          <q1:Drive clsid="{another_sid}" name="V:" status="V:" image="2" changed="2019-03-15 19:10:08" uid="{another_sid}">
            <q1:GPOSettingOrder>2</q1:GPOSettingOrder>
            <q1:Properties action="U" thisDrive="NOCHANGE" allDrives="NOCHANGE" userName="" path="\fs.example.com\users\%username%" label="example.com\%username%" persistent="1" useLetter="1" letter="V" />
            <q1:Filters />
          </q1:Drive>
        </q1:DriveMapSettings>
      </Extension>
      <Name>Drive Maps</Name>
    </ExtensionData>
  </User>
  <LinksTo>
    <SOMName>Name</SOMName>
    <SOMPath>example.com/Level1/Level2</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>false</NoOverride>
  </LinksTo>
</GPO>

我试图使用 $gporeport.GPO.User.ExtensionData.Extension.ChildNodes 获取信息，但我不知道如何进入驱动器部分并获取驱动器号和安装位置。

Answer 1

PowerShell 的 built-in XML 适配器应该能够通过本地名称解析 q1:Drive 节点，即：

$driveNodes = $gporeport.GPO.User.ExtensionData.Extension.DriveMapSettings.Drive

对于嵌套 Properties 节点上的属性值，使用计算属性：

$driveNodes |Select name,@{Name='Path';Expression={$_.Properties.path}},@{Name='Label';Expression={$_.Properties.label}}

如何从 Powershell 中的 Get-GPOReport 解析 XML？

How can I parse XML from Get-GPOReport in Powershell?

xml

powershell

gpo