phillips321 / adaudit

Powershell script to do domain auditing automation
https://www.phillips321.co.uk
370 stars 101 forks source link

Added Get-PrivelegedGroupMembership and Get-GPOEnum #6

Closed KennyMacCormik closed 5 years ago

KennyMacCormik commented 5 years ago

Complete list of changes:

  1. Get-DCEval
    • Compares DCs for the same OS level, OS version level, hotfix level, service pack level
    • List sites without Global Catalog
    • Checks whether one DC holds all FSMO roles
    • Checks if DES or RC4 available on DCs for Kerberos
  2. Get-PrivelegedGroupMembership
    • Alerts is Schema Admins not empty and dumps to file
    • Alerts is Enterprise Admins not empty and dumps to file
    • Dumps Domain Admins to file
  3. Get-GPOEnum
    • Loops all domain GPOs
    • Finds GPO that allow group to join PCs to the domain and writes that groups
    • Looking for GPOs that disables NTLM, enables NTLM audit and allows NTLM auth exceptions
    • Looking for GPO that controls Kerberos Encryption algorithm
  4. Get-DefaultDomainControllersPolicy
    • Enumerates excessive permission set (basically ensures noone except for BUILTIN\Administrators and NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS has permissions to logon, batch logon, backup, install drivers, etc.)
phillips321 commented 5 years ago

Thanks for the PR