"
131 | $HTMLTableForEmail += "Summary of Access Control List (ACL) Modifications |
"
132 | $HTMLTableForEmail += "| Report created: $(Get-Date -Format "yyyy-MM-dd HH:mm:ss") |
"
133 | if ( $ScriptVariables.SSRSReport -ne '' ) {
134 | $HTMLTableForEmail += "| Link to SSRS report |
"
135 | }
136 | #region Summary table
137 | [int]$TotalModifications = $($ModifiedACLs | Group OpCorrelationID).Count
138 | [int]$TotalACEAdditions = @($($ModifiedACLs | Where Operation -eq 'Added' )).Count
139 | [int]$TotalACERemovals = @($($ModifiedACLs | Where Operation -eq 'Removed' )).Count
140 | [int]$TotalCriticals = @($($ModifiedACLs | where { $_.Access -match "$($ScriptVariables.CriticalPermissions -join '|')" -and $_.Operation -eq 'Added' })).count
141 | $HTMLTableForEmail += "| Total Modifications: | Added ACEs: | Removed ACEs | Potentially Critical events | | $($TotalModifications) | $TotalACEAdditions | $TotalACERemovals | $TotalCriticals |
|
"
142 | #endregion
143 | #region Top Modifier table
144 | $HTMLTableForEmail += "Top 5 modifiers |
"
145 | $HTMLTableForEmail += "| Modified by | Count | "
146 | $Counter = 0
147 | foreach ( $TopModifier in $ModifiedACLs | Group Modifier | Select -First 5 | Sort-Object Count -Descending) {
148 | $color = Get-RowColor $Counter
149 | $HTMLTableForEmail += "| $($TopModifier.Name)$($TopModifier.Group[0].ModifierSAM) | $($TopModifier.Count) |
"
150 | $Counter++
151 | }
152 | $HTMLTableForEmail += "
"
153 | #endregion
154 | #region Modifications table
155 | $HTMLTableForEmail += "List of ACL modifications |
"
156 | $HTMLTableForEmail += "| Timestamp | Modified by | Target Object | Modifications | "
157 | foreach ( $ACL in $ModifiedACLs | Group OpCorrelationId ) {
158 | $Counter++
159 | $color = Get-RowColor $Counter
160 | $ACLMeta = $ACL.Group[0]
161 | $HTMLTableForEmail += "| $($ACLMeta.Timestamp) | $($ACLMeta.Modifier)$($ACLMeta.ModifierSAM) | $($ACLMeta.TargetType):$($ACLMeta.TargetObject) | "
162 | foreach ( $ACE in $ACL.Group ) {
163 | $textcolor = $ScriptVariables.Colors.$($ACE.Operation)
164 | if ( $ACE.Access -match "$($ScriptVariables.CriticalPermissions -join '|')" -and $ACE.Operation -eq 'Added' ) {
165 | $CriticalEvent = "class=`"Critical`""
166 | $Access = "$($ACE.Access)"
167 | }
168 | else {
169 | $CriticalEvent = $null
170 | $Access = $ACE.Access
171 | }
172 | $HTMLTableForEmail += "| $($ACE.SDDLType) | $($ACE.Operation) | | Type | $($ACE.Type) | | Principal | $($ACE.Principal) | | Access | $($Access) | | Applies to | $($ACE.AppliesTo) |
"
173 | }
174 | $HTMLTableForEmail += "$($ACL.Group[0].OpCorrelationId)"
175 | }
176 | #endregion
177 | $HTMLTableForEmail += " |
|
"
178 | #endregion Main table
179 |
180 | #region SEND NOTIFICATION VIA EMAIL
181 | $mail = New-Object System.Net.Mail.MailMessage -Property @{
182 | From = $ScriptVariables.MailFrom
183 | Subject = $ScriptVariables.MailSubject
184 | Body = $HTMLTableForEmail
185 | IsBodyHtml = $true
186 | }
187 | $mail.To.Add($ScriptVariables.MailTo)
188 | $SMTPClient = New-Object -TypeName System.Net.Mail.SmtpClient( $ScriptVariables.SMTPServer )
189 | $SMTPClient.Send( $Mail )
190 | #endregion
191 | }
--------------------------------------------------------------------------------
/Active Directory/Get-BlockedInheritanceUsers.ps1:
--------------------------------------------------------------------------------
1 | $Containers = @()
2 | $UserStatuses = @()
3 |
4 | "Reading OU List ..."
5 | $Containers = Get-ADOrganizationalUnit -Filter * -Properties * | sort canonicalname | select distinguishedname, canonicalname
6 |
7 | "Reading Container List ..."
8 | $Containers += Get-ADObject -SearchBase (Get-ADDomain).distinguishedname -SearchScope OneLevel -LDAPFilter '(objectClass=container)' -Properties * | sort canonicalname | select distinguishedname, canonicalname
9 |
10 | foreach($Cntr in $Containers)
11 | {
12 | "Evaluating - " + $Cntr.distinguishedname + " ..."
13 |
14 | $UserStatuses += Get-ADUser -Filter * -SearchBase $Cntr.distinguishedname -SearchScope OneLevel -Properties * | where {($_.nTSecurityDescriptor.AreAccessRulesProtected -eq $true) -and ($_.enabled -eq $true)} | select @{n='OU';e={$Cntr.distinguishedname}}, displayname, userprincipalname,samAccountName, @{n='Inheritance Broken';e={$_.nTSecurityDescriptor.AreAccessRulesProtected}}
15 | }
16 |
17 | $UserStatuses | export-csv -path C:\temp\UsersWithInheritanceBroken.csv
--------------------------------------------------------------------------------
/Active Directory/Get-DeletedObjects.ps1:
--------------------------------------------------------------------------------
1 | $date = New-Object System.DateTime(2017,2,20)
2 | $Users = get-adobject -filter {(createTimeStamp -gt $date) -and (deleted -eq $True)} -IncludeDeletedObjects -properties *
3 | Clear-Host
4 | samAccountName
5 | ForEach ( $User in $Users ) {
6 | If ( $User.objectClass -eq "groupPolicyContainer" ) { "$($User.DisplayName)`n$($User.objectClass)`n$($User.Modified)`n" ; Continue }
7 | "$($User."msDS-LastKnownRDN")`n$($User.objectClass)`n$($User.Modified)`n"
8 | }
--------------------------------------------------------------------------------
/Active Directory/Remove-ADObjectFromACL/Remove-ADObjectFromACL.ps1:
--------------------------------------------------------------------------------
1 | ## This script removes an objects access in a specified ACL
2 | ##
3 | ## Logs can be found in .\Logs folder
4 | ##
5 | ## Version 1.0.0 - First release // 2020-11-05
6 | ## Version 1.0.1 - Changed the parameter IdentityReference to array with corresponding funcitonality // 2020-11-06
7 | ## Version 1.0.2 - Added functionality so only objects with one or more matching IdentityReferences will be added to $ADObjects // 2020-11-06
8 |
9 | #region Variables and functions
10 | $ScriptVariables = @{
11 | ScriptFolder = "C:\Scripts\Remove-ADObjectFromACL"
12 | Threshold = 1
13 | SearchBase = "OU=Domain Computers,DC=domain,DC=local"
14 | IdentityReferences = @('BUILTIN\Account Operators','BUILTIN\Print Operators')
15 | }
16 |
17 | Set-Location $ScriptVariables.ScriptFolder -ErrorAction SilentlyContinue
18 | $logsFolder = Join-Path $ScriptVariables.ScriptFolder "Logs"
19 |
20 | function Remove-ADObjectFromACL {
21 | <#
22 | .SYNOPSIS
23 | Removes an entire object from a specified Access Control List (ACL)
24 |
25 | .DESCRIPTION
26 | Removes an entire object from a specified ACL
27 |
28 | .PARAMETER IdentityReference
29 | Specify the IdentityReference (array) that will be removed from the target object
30 |
31 | .PARAMETER TargetDN
32 | Specify the DistinguishedName of one object that should get the IdentityReference(s) removed from the ACL
33 |
34 | .EXAMPLE
35 | Remove-ADObjectFromACL -IdentityReference "BUILTIN\Print Operators" -TargetDN "CN=TestComputer,DC=domain,DC=local"
36 | Removes 'BUILTIN\Print Operators' from the ACL of 'TestComputer'
37 |
38 | .EXAMPLE
39 | Remove-ADObjectFromACL -IdentityReference "BUILTIN\Print Operators","BUILTIN\Account Operators" -TargetDN "CN=TestComputer,DC=domain,DC=local"
40 | Removes 'BUILTIN\Print Operators' and 'BUILTIN\Account Operators' from the ACL of 'TestComputer'
41 |
42 | .FUNCTIONALITY
43 | ACL Management
44 | #>
45 |
46 | param(
47 | [parameter(mandatory=$true)][ValidateNotNullOrEmpty()]
48 | [array]$IdentityReference,
49 | [parameter(mandatory=$true)][ValidateNotNullOrEmpty()]
50 | [string]$TargetDN
51 | )
52 |
53 | try {
54 | Import-Module ActiveDirectory -ErrorAction Stop
55 | }
56 | catch {
57 | Write-Error $_.Exception.Message
58 | break
59 | }
60 |
61 | $TargetDistinguishedName = [ADSI]("LDAP://$TargetDN")
62 | if ( $TargetDistinguishedName.distinguishedName ) {
63 | $CurrentACEinACL = @()
64 | $GetCurrentACEinACL = @()
65 | $IdentitiesFound = @()
66 | foreach ( $identity in $IdentityReference ) {
67 | [array]$GetCurrentACEinACL = $(Get-Acl -Path "AD:$($TargetDistinguishedName.distinguishedName)" ).Access | Where { $_.IdentityReference -eq "$Identity" -and $_.IsInherited -eq $false}
68 | if ( $GetCurrentACEinACL.Count -gt 0 ) {
69 | Write-Log "Found $($GetCurrentACEinACL.Count) ACE(s) for `'$Identity`' to remove from `'$($TargetDistinguishedName.distinguishedName)`'"
70 | $IdentitiesFound += $Identity
71 | [array]$CurrentACEinACL += $GetCurrentACEinACL
72 | }
73 | }
74 | if ( $CurrentACEinACL.Count -gt 0 ) {
75 | foreach ( $RemoveACE in $CurrentACEinACL ) {
76 | [void]$TargetDistinguishedName.PSBase.ObjectSecurity.RemoveAccessRule($RemoveACE)
77 | }
78 | try {
79 | $TargetDistinguishedName.PSBase.CommitChanges()
80 | Write-Log "Successfully removed ACE(s) for `'$($IdentitiesFound -join "`',`'")`' from `'$($TargetDistinguishedName.distinguishedName)`'"
81 | }
82 | catch {
83 | Write-Log "Failed to remove ACE(s) for `'$($IdentitiesFound -join "`',`'")`' from `'$($TargetDistinguishedName.distinguishedName)`', error: $($_.Exception.Message)"
84 | }
85 | }
86 | }
87 | else {
88 | Write-Warning "The object `'$TargetDN`' could not be found in Active Directory"
89 | }
90 | }
91 |
92 | Function Write-Log {
93 | param([Parameter(Mandatory=$true, Position=0)][string]$Message)
94 | $logdate = (Get-Date -format "yyyy-MM-dd")
95 | $logtime = (Get-Date -format "yyyy-MM-dd HH:mm:ss") + " >>"
96 | $logfile = "Logfile_" + $logdate + ".log"
97 | $logfilepath = Join-Path $logsFolder $logfile
98 | if( (test-path $logfilepath) ) {
99 | "$logtime $Message" | Out-File -Append $logfilepath -Encoding utf8
100 | Write-Verbose "$logtime $Message" -Verbose
101 | }
102 | else {
103 | Write-Verbose "$logtime $Message" -Verbose
104 | }
105 | }
106 | #endregion
107 |
108 | if ( !$ADObjects ) {
109 | $ADObjects = @()
110 | $TempADObjects = Get-ADComputer -Filter * -SearchBase $ScriptVariables.SearchBase -properties ntSecurityDescriptor | Select Name, distinguishedName, ntSecurityDescriptor
111 | foreach ( $ADObject in $TempADObjects ) {
112 | foreach ( $Identity in $ScriptVariables.IdentityReferences ) {
113 | if ( $ADObject.distinguishedName -notin $ADObjects ) {
114 | if ( $identity -in $ADObject.ntSecurityDescriptor.Access.IdentityReference ) {
115 | $ADObjects += ($ADObject).DistinguishedName
116 | }
117 | }
118 | }
119 | }
120 | }
121 |
122 | foreach ( $ADObject in $ADObjects | Select -First $ScriptVariables.Threshold ) {
123 | Remove-ADObjectFromACL -TargetDN $ADObject -IdentityReference $ScriptVariables.IdentityReferences
124 | }
125 |
126 | # Run below to see specific IdentityReferences for an object
127 | # ($(Get-Acl -Path "AD:$($ADObject)" ).Access | Where { $_.IsInherited -eq $false}).IdentityReference | Select -Unique | Sort
128 |
--------------------------------------------------------------------------------
/Active Directory/SecBaselinePrep/Get-RegData_For_SecBaseline.ps1:
--------------------------------------------------------------------------------
1 | $content = get-content C:\temp\SecBaselinesToCompare.csv | convertfrom-csv -Delimiter ';' | where RegPath -ne $null
2 | $ServerOU = "