Skip to content

WIP - add security audit and secure delete. Linting and adding standard script Comment headers #133

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
silversword411 merged 4 commits into from
Apr 4, 2023
Merged

WIP - add security audit and secure delete. Linting and adding standard script Comment headers #133

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bcca763
security audit script
silversword411 Mar 26, 2023
7926dc6
script comments
silversword411 Mar 28, 2023
2880b1f
wip add secure delete folder script
silversword411 Mar 28, 2023
c333a05
fix formatting
silversword411 Mar 28, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 36 additions & 5 deletions scripts/Win_AD_Check_And_Enable_AD_Recycle_Bin.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,17 +1,48 @@
#Please only run on a domain controller
#This script will first check if there are any AD Recycle Bin scopes set up - if there are no scopes it is assumed recycle bin feature is not enabled for the domain
#The script then pulls the domain that the machine running the script is on - queries the domain for the Infrastructure Master and then will attempt to enable the feature
<#
.SYNOPSIS
This script enables Active Directory Recycle Bin feature for the current domain.

.DESCRIPTION
Only run on a domain controller. This script checks whether the Recycle Bin feature is enabled for the current domain in Active Directory.

.PARAMETER adRecycleBinScope
The scope of the Recycle Bin feature to check. This parameter is obtained by running the Get-ADOptionalFeature cmdlet.

.PARAMETER ADDomain
The name of the Active Directory domain to check. This parameter is obtained by running the Get-ADDomain cmdlet.

.PARAMETER ADInfraMaster
The name of the infrastructure master for the domain. This parameter is obtained by running the Get-ADDomain cmdlet.

.OUTPUTS
This script does not output any objects.

.EXAMPLE
PS C:> .\Enable-ADRecycleBin.ps1

bash
Copy code
This example runs the script to enable the Recycle Bin feature for the current domain in Active Directory.
.EXAMPLE
PS C:> .\Enable-ADRecycleBin.ps1 -ADDomain "contoso.com"

bash
Copy code
This example runs the script to enable the Recycle Bin feature for the "contoso.com" domain in Active Directory.
.NOTES
Version: 1.0
#>

$adRecycleBinScope = Get-ADOptionalFeature -Identity 'Recycle Bin Feature' | Select -ExpandProperty EnabledScopes
$ADDomain = Get-ADDomain | Select -ExpandProperty Forest
$ADInfraMaster = Get-ADDomain | Select-Object InfrastructureMaster

if ($adRecycleBinScope -eq $null){
if ($adRecycleBinScope -eq $null) {
Write-Host "Recycle Bin Disabled"
Write-Host "Attempting to enable AD Recycle Bin"
Enable-ADOptionalFeature -Identity 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target $ADDomain -Server $ADInfraMaster.InfrastructureMaster -Confirm:$false
Write-Host "AD Recycle Bin enabled for domain $($ADDomain)"
}
else{
else {
Write-Host "Recycle Bin already Enabled For: $($ADDomain)`n Scope: $($adRecycleBinScope)"
}
250 changes: 129 additions & 121 deletions scripts/Win_AD_Hudu_ADDS_Documentation.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,27 +1,33 @@
<#
.Synopsis
Automatically document ADDS configuration
.DESCRIPTION
Automatically document ADDS configuration. Submits generated documentation to your Hudu instance and associates it with the Company provided by ClientName. Requires Global Keystore variables for HuduBaseDomain and HuduApiKey.
.INPUTS
-ClientName {{client.name}}
-HuduBaseDomain {{global.HuduBaseDomain}}
-HuduApiKey {{global.HuduApiKey}}
.NOTES
v1.0
Based on https://github.com/lwhitelock/HuduAutomation/blob/main/CyberdrainRewrite/Hudu-ADDS-Documentation.ps1
.COMPONENT
Hudu Documentation
.ROLE
Documentation
.SYNOPSIS
Collects information about Active Directory and uploads it to Hudu
.DESCRIPTION
It retrieves Forest information, Site information, FSMO roles, UPN Suffixes, Default Password Policies, Domain Admins, and User count. Submits generated documentation to your Hudu instance and associates it with the Company provided by ClientName. Requires Global Keystore variables for HuduBaseDomain and HuduApiKey.
.PARAMETER ClientName
The name of the client in Hudu
-ClientName {{client.name}}
.PARAMETER HuduBaseDomain
The base domain of your Hudu instance without a trailing slash
-HuduBaseDomain {{global.HuduBaseDomain}}
.PARAMETER HuduApiKey
A valid Hudu API Key from your Hudu instance
-HuduApiKey {{global.HuduApiKey}}
.COMPONENT
Hudu Documentation
.ROLE
Documentation
.NOTES
v1.0 6/13/2021 Zak
Based on https://github.com/lwhitelock/HuduAutomation/blob/main/CyberdrainRewrite/Hudu-ADDS-Documentation.ps1
#>

param (
[string] $ClientName,
[string] $HuduBaseDomain,
[string] $HuduApiKey
[Parameter(Mandatory = $true)][string] $ClientName,
[Parameter(Mandatory = $true)][string] $HuduBaseDomain,
[Parameter(Mandatory = $true)][string] $HuduApiKey
)


if (!$ClientName) {
write-output "Must provide -ClientName with a valid value that is identical to the name of a Company that exists in your Hudu instance. This should be the {{client.name}} value. `n"
$ErrorCount += 1
Expand All @@ -36,7 +42,7 @@ if (!$HuduApiKey) {
}

if (!$ErrorCount -eq 0) {
exit 1
exit 1
}
#####################################################################
#
Expand All @@ -52,11 +58,12 @@ Write-Host "Connecting to $HuduBaseDomain"

#Get the Hudu API Module if not installed
if (Get-Module -ListAvailable -Name HuduAPI) {
Import-Module HuduAPI
} else {
Install-Module HuduAPI -Force
Import-Module HuduAPI
}
Import-Module HuduAPI
}
else {
Install-Module HuduAPI -Force
Import-Module HuduAPI
}

#Set Hudu logon information
New-HuduAPIKey $HuduAPIKey
Expand All @@ -81,23 +88,23 @@ function Get-WinADForestInformation {
}

$Data.UPNSuffixes = Invoke-Command -ScriptBlock {
$UPNSuffixList = [PSCustomObject] @{
"Primary UPN" = $ForestInformation.RootDomain
"UPN Suffixes" = $ForestInformation.UPNSuffixes -join ","
}
$UPNSuffixList = [PSCustomObject] @{
"Primary UPN" = $ForestInformation.RootDomain
"UPN Suffixes" = $ForestInformation.UPNSuffixes -join ","
}
return $UPNSuffixList
}

$Data.GlobalCatalogs = $ForestInformation.GlobalCatalogs
$Data.SPNSuffixes = $ForestInformation.SPNSuffixes

$Data.Sites = Invoke-Command -ScriptBlock {
$Sites = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().Sites
$Sites = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().Sites
$SiteData = foreach ($Site in $Sites) {
[PSCustomObject] @{
[PSCustomObject] @{
"Site Name" = $site.Name
"Subnets" = ($site.Subnets) -join ", "
"Servers" = ($Site.Servers) -join ", "
"Servers" = ($Site.Servers) -join ", "
}
}
Return $SiteData
Expand Down Expand Up @@ -190,7 +197,7 @@ $SiteNice = $TableHeader + ($SiteRawInfo -replace $TableStyling) + $Whitespace
$OptionalRawFeatures = new-object PSCustomObject -property $RawAD.OptionalFeatures | convertto-html -Fragment | Select-Object -Skip 1
$OptionalNice = $TableHeader + ($OptionalRawFeatures -replace $TableStyling) + $Whitespace

$UPNRawFeatures = $RawAD.UPNSuffixes | convertto-html -Fragment -as list| Select-Object -Skip 1
$UPNRawFeatures = $RawAD.UPNSuffixes | convertto-html -Fragment -as list | Select-Object -Skip 1
$UPNNice = $TableHeader + ($UPNRawFeatures -replace $TableStyling) + $Whitespace

$DCRawFeatures = $RawAD.GlobalCatalogs | ForEach-Object { Add-Member -InputObject $_ -Type NoteProperty -Name "Domain Controller" -Value $_; $_ } | convertto-html -Fragment | Select-Object -Skip 1
Expand Down Expand Up @@ -221,107 +228,108 @@ There are <b> $AdminUsers </b> Domain Administrator users<br>

# Setup the fields for the Asset
$AssetFields = @{
'domain_name' = $RawAD.ForestName
'forest_summary' = $ForestNice
'site_summary' = $SiteNice
'domain_controllers' = $DCNice
'fsmo_roles' = $FSMONice
'optional_features' = $OptionalNice
'upn_suffixes' = $UPNNice
'default_password_policies' = $passwordpolicyNice
'domain_admins' = $adminsnice
'user_count' = $Users
}
'domain_name' = $RawAD.ForestName
'forest_summary' = $ForestNice
'site_summary' = $SiteNice
'domain_controllers' = $DCNice
'fsmo_roles' = $FSMONice
'optional_features' = $OptionalNice
'upn_suffixes' = $UPNNice
'default_password_policies' = $passwordpolicyNice
'domain_admins' = $adminsnice
'user_count' = $Users
}

# Checking if the FlexibleAsset exists. If not, create a new one.
$Layout = Get-HuduAssetLayouts -name $HuduAssetLayoutName

if (!$Layout) {

$AssetLayoutFields = @(
@{
label = 'Domain Name'
field_type = 'Text'
show_in_list = 'true'
position = 1
},
@{
label = 'Forest Summary'
field_type = 'RichText'
show_in_list = 'false'
position = 2
},
@{
label = 'Site Summary'
field_type = 'RichText'
show_in_list = 'false'
position = 3
},
@{
label = 'Domain Controllers'
field_type = 'RichText'
show_in_list = 'false'
position = 4
},
@{
label = 'FSMO Roles'
field_type = 'RichText'
show_in_list = 'false'
position = 5
},
@{
label = 'Optional Features'
field_type = 'RichText'
show_in_list = 'false'
position = 6
},
@{
label = 'UPN Suffixes'
field_type = 'RichText'
show_in_list = 'false'
position = 7
},
@{
label = 'Default Password Policies'
field_type = 'RichText'
show_in_list = 'false'
position = 8
},
@{
label = 'Domain Admins'
field_type = 'RichText'
show_in_list = 'false'
position = 9
},
@{
label = 'User Count'
field_type = 'RichText'
show_in_list = 'false'
position = 10
}
)
$AssetLayoutFields = @(
@{
label = 'Domain Name'
field_type = 'Text'
show_in_list = 'true'
position = 1
},
@{
label = 'Forest Summary'
field_type = 'RichText'
show_in_list = 'false'
position = 2
},
@{
label = 'Site Summary'
field_type = 'RichText'
show_in_list = 'false'
position = 3
},
@{
label = 'Domain Controllers'
field_type = 'RichText'
show_in_list = 'false'
position = 4
},
@{
label = 'FSMO Roles'
field_type = 'RichText'
show_in_list = 'false'
position = 5
},
@{
label = 'Optional Features'
field_type = 'RichText'
show_in_list = 'false'
position = 6
},
@{
label = 'UPN Suffixes'
field_type = 'RichText'
show_in_list = 'false'
position = 7
},
@{
label = 'Default Password Policies'
field_type = 'RichText'
show_in_list = 'false'
position = 8
},
@{
label = 'Domain Admins'
field_type = 'RichText'
show_in_list = 'false'
position = 9
},
@{
label = 'User Count'
field_type = 'RichText'
show_in_list = 'false'
position = 10
}
)

Write-Host "Creating New Asset Layout"
$NewLayout = New-HuduAssetLayout -name $HuduAssetLayoutName -icon "fas fa-sitemap" -color "#00adef" -icon_color "#000000" -include_passwords $false -include_photos $false -include_comments $false -include_files $false -fields $AssetLayoutFields
$Layout = Get-HuduAssetLayouts -name $HuduAssetLayoutName
Write-Host "Creating New Asset Layout"
$NewLayout = New-HuduAssetLayout -name $HuduAssetLayoutName -icon "fas fa-sitemap" -color "#00adef" -icon_color "#000000" -include_passwords $false -include_photos $false -include_comments $false -include_files $false -fields $AssetLayoutFields
$Layout = Get-HuduAssetLayouts -name $HuduAssetLayoutName
}


$Company = Get-HuduCompanies -name $ClientName
if ($company) {
#Upload data to Hudu
$Asset = Get-HuduAssets -name $RawAD.ForestName -companyid $company.id -assetlayoutid $layout.id
#Upload data to Hudu
$Asset = Get-HuduAssets -name $RawAD.ForestName -companyid $company.id -assetlayoutid $layout.id

#If the Asset does not exist, we edit the body to be in the form of a new asset, if not, we just upload.
if (!$Asset) {
Write-Host "New Asset Created"
$Asset = New-HuduAsset -name $RawAD.ForestName -company_id $company.id -asset_layout_id $layout.id -fields $AssetFields
}
else {
Write-Host "Asset has been Updated"
$Asset = Set-HuduAsset -asset_id $Asset.id -name $RawAD.ForestName -company_id $company.id -asset_layout_id $layout.id -fields $AssetFields
}
#If the Asset does not exist, we edit the body to be in the form of a new asset, if not, we just upload.
if (!$Asset) {
Write-Host "New Asset Created"
$Asset = New-HuduAsset -name $RawAD.ForestName -company_id $company.id -asset_layout_id $layout.id -fields $AssetFields
}
else {
Write-Host "Asset has been Updated"
$Asset = Set-HuduAsset -asset_id $Asset.id -name $RawAD.ForestName -company_id $company.id -asset_layout_id $layout.id -fields $AssetFields
}

} else {
Write-Host "$ClientName was not found in Hudu"
}
else {
Write-Host "$ClientName was not found in Hudu"
}
Loading