![\"\"](\"https:\/\/www.phillips321.co.uk\/wp-content\/uploads\/2018\/04\/powershell-1030x770-150x150.png\")
<\/a>So I’ve started doing a few active directory audits recently and noticed that I’m repeating myself over and over again.<\/p>\n<\/a>So I’ve started doing a few active directory audits recently and noticed that I’m repeating myself over and over again.<\/p>\n
As such I’ve decided to write as much of this up as possible in a powershell script to make my life easier. I chose powershell for two reasons; 1. I need to learn powershell, 2. I don’t want to drop an exe on a remote box.<\/p>\n
This script doesn’t do everything, there’s still stuff to add, so recommend me things!<\/p>\n
It currently does the following:<\/p>\n
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 <\/div><\/td> PS<\/span> Microsoft.PowerShell.Core\\FileSystem::\\\\tsclient\\Desktop><\/span> \\\\tsclient\\Desktop\\AdAudit.ps1 \n _____ ____ _____ _ _ _ \n|<\/span> _ |<\/span> \\ |<\/span> _ |<\/span>_ _ _|<\/span> |<\/span>_|<\/span> |<\/span>_ \n|<\/span> |<\/span> |<\/span> |<\/span> |<\/span> |<\/span> |<\/span> |<\/span> . |<\/span> |<\/span> _|<\/span> \n|<\/span>__|<\/span>__|<\/span>____\/<\/span> |<\/span>__|<\/span>__|<\/span>___|<\/span>___|<\/span>_|<\/span>_|<\/span> \nv1.0 by phillips321 \n \n[<\/span>*<\/span>]<\/span> Script start time 04\/<\/span>19<\/span>\/<\/span>2018<\/span> 19<\/span>:29<\/span>:01 \n[<\/span>+<\/span>]<\/span> Outputting to \\\\tsclient\\Desktop\\2008R2X64SP1 \n[<\/span>*<\/span>]<\/span> Password Policy Findings \n [<\/span>!<\/span>]<\/span> Password Complexity not enabled \n [<\/span>!<\/span>]<\/span> Lockout threshold is less than 5<\/span>,<\/span> currently set<\/span> to 0<\/span> \n [<\/span>!<\/span>]<\/span> Minimum password length is less than 14<\/span>,<\/span> currently set<\/span> to 7<\/span> \n [<\/span>!<\/span>]<\/span> Passwords do<\/span> not expire \n [<\/span>!<\/span>]<\/span> Passwords history<\/span> is less than 12<\/span>,<\/span> currently set<\/span> to 0<\/span> \n [<\/span>!<\/span>]<\/span> 4<\/span> accounts with passwords older than 90days,<\/span> see accounts_with_old_passwords.txt \n[<\/span>*<\/span>]<\/span> Looking for<\/span> accounts that dont expire \n [<\/span>!<\/span>]<\/span> There are 4<\/span> accounts that don't expire, see accounts_passdontexpire.txt \n[*] Looking for inactive\/disabled accounts \n [!] 1 inactive user accounts(180days), see accounts_inactive.txt \n [!] 2 disabled user accounts, see accounts_disabled.txt \n[*] Looking for server 2003\/XP machines connected to domain \n[*] AD Findings \n [!] Domain users can add 10 devices to the domain! \n [!] SMBv1 is not disabled \n[*] Domain Trust Findings \n [!] Bidirectyional trust with domain test.local! \n[*] GPO Findings \n [+] GPO Report saved to GPOReport.html \n [+] Inhertied GPOs saved to ous_inheritedGPOs.txt \n[*] Trying to find SysVOL xml files containg cpassword... \n [!] cpassword found in file, copying to output folder \n \\\\FRUIT.COM\\SYSVOL\\fruit.com\\Policies\\{039AF941-42BE-4D56-A479-A284E3494670}\\User\\Preferences\\ \nDrives\\Drives.xml \n [!] cpassword found in file, copying to output folder \n \\\\FRUIT.COM\\SYSVOL\\fruit.com\\Policies\\{750D5660-5AB3-4A33-A776-6F10657A6662}\\Machine\\Preferenc \nes\\ScheduledTasks\\ScheduledTasks.xml \n[*] Trying to save NTDS.dit, please wait... \n [+] NTDS.dit, SYSTEM & SAM saved to output folder \n [+] Use secretsdump.py -system registry\/SYSTEM -ntds Active\\ Directory\/ntds.dit LOCAL -outputfile \ncustomer \n[*] Script end time 04\/19\/2018 19:29:34<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n And finally the link to the code: github.com\/phillips321\/adaudit<\/a> So I’ve started doing a few active directory audits recently and noticed that I’m repeating myself over and over again. As such I’ve decided to write as much of this up as possible in a powershell script to make my life easier. I chose powershell for two reasons; 1. I need to learn powershell, 2. […]<\/p>\n","protected":false},"author":1,"featured_media":1413,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[482,481,484,483,485,487,486,415],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1412"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=1412"}],"version-history":[{"count":5,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1412\/revisions"}],"predecessor-version":[{"id":1416,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1412\/revisions\/1416"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media\/1413"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=1412"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=1412"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=1412"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} |
![<\/p>\n","protected":false},"excerpt":{"rendered":"So I’ve started doing a few active directory audits recently and noticed that I’m repeating myself over and over again. As such I’ve decided to write as much of this up as possible in a powershell script to make my life easier. I chose powershell for two reasons; 1. I need to learn powershell, 2. […]<\/p>\n","protected":false},"author":1,"featured_media":1413,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[482,481,484,483,485,487,486,415],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1412"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=1412"}],"version-history":[{"count":5,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1412\/revisions"}],"predecessor-version":[{"id":1416,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1412\/revisions\/1416"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media\/1413"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=1412"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=1412"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=1412"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}](\"https:\/\/www.phillips321.co.uk\/wp-content\/uploads\/2018\/04\/powershell-1030x770.png\"){kind=link}