PSSYSAdm.psm1
|
#Region '.\Classes\Class_Computer.ps1' 0 class COMPUTER { computer () { } static [Boolean] TestIfComputerExist([System.String]$ComputerName) { try { Get-ADComputer -Identity $ComputerName -ErrorAction Stop -Verbose:$false return $true } catch { return $false } } static [Boolean] TestIfComputerIsAlive ([System.String]$ComputerName) { if (Test-Connection -BufferSize 32 -Count 1 -ComputerName $ComputerName -Quiet) { return $true } else { return $false } } } #EndRegion '.\Classes\Class_Computer.ps1' 33 #Region '.\Private\Send-Mail.ps1' 0 function Send-Mail { [CmdletBinding()] param ( [Parameter(Mandatory = $true)] [System.String]$SmtpServer, [Parameter(Mandatory = $true)] [System.String]$Sender, [Parameter(Mandatory = $true)] [System.String[]]$Recipient, [Parameter()] [System.String[]]$CC, [Parameter()] [System.String[]]$BCC, [Parameter()] [System.String]$Subject, [Parameter()] [System.String]$TextBody, [Parameter()] [System.String]$Htmlbody, [Parameter()] [System.String]$Attachement ) begin { } process { $From = [MimeKit.MailboxAddress]$Sender; if ($Recipient) { $RecipientList = [MimeKit.InternetAddressList]::new(); foreach ($R in $Recipient) { $RecipientList.Add([MimeKit.InternetAddress]$R); } } if ($CC) { $CCList = [MimeKit.InternetAddressList]::new(); foreach ($C in $CC) { $CCList.Add([MimeKit.InternetAddress]$C); } } if ($BCC) { $BCCList = [MimeKit.InternetAddressList]::new(); foreach ($B in $BCC) { $BCCList.Add([MimeKit.InternetAddress]$B); } } if ($Attachement) { $AttachementList = [MimeKit.InternetAddressList]::new(); foreach ($A in $Attachement) { $AttachementList.Add([MimeKit.InternetAddress]$A); } } $Parameters = @{ "SMTPServer" = $SMTPServer "From" = $From "RecipientList" = $RecipientList "CCList" = $CCList "BCCList" = $BCCList "Subject" = $Subject "TextBody" = $TextBody "HTMLBody" = $HTMLBody "AttachmentList" = $AttachmentList } Send-MailKitMessage @Parameters } end { } } #EndRegion '.\Private\Send-Mail.ps1' 96 #Region '.\Public\Disable-CompromisedUser.ps1' 0 function Disable-CompromisedUser { <# .SYNOPSIS Disable compromised user .DESCRIPTION In case of compromission from some users, you can rapidly disable this users. You can pass to parameter : - a nominative list of user - a file with a nominative list of users (one user by line) - an OU to disable all users Check example for more details (get-help Disable-CompromisedUser -Examples) A log file is create in your temp directory ($env:temp) .PARAMETER Identity One or more user(s) to disable .PARAMETER FileName File with a list of users to disable. txt with one name by line .PARAMETER OU One or more OU(s) in which we want to disable all users .PARAMETER Check Only check if the users passed in parameter, whatever the way (Identity, Filename or OU), are disable .EXAMPLE Disable-CompromisedUser -Identity "User1" Disable the user account : User1 .EXAMPLE Disable-CompromisedUser -Identity "User1" -Check Check if user account User1 is disable .EXAMPLE Disable-CompromisedUser -Identity "User1","User2","User3" Disable users account : User1, User2 and User3 .EXAMPLE Disable-CompromisedUser -Identity "User1","User2","User3" -Check Check if users account User1, User2 and User3 are disable .EXAMPLE Disable-CompromisedUser -FileName "c:\temp\CompromisedUser.txt" File template CompromisedUser.txt : User1 User2 User3 Disable users account : User1, User2 and User3 .EXAMPLE Disable-CompromisedUser -FileName "c:\temp\CompromisedUser.txt" -Check File template CompromisedUser.txt : User1 User2 User3 Check if users account User1, User2 and User3 are disable .EXAMPLE Disable-CompromisedUser -OU "OU=OU1,DC=contoso,DC=com" Disable all users present in OU1 .EXAMPLE Disable-CompromisedUser -OU "OU=OU1,DC=contoso,DC=com" -Check Check if all users present in OU1 are disable .EXAMPLE Disable-CompromisedUser -OU "OU=OU1,DC=contoso,DC=com","OU=OU2,DC=contoso,DC=com" Disable all users present in OU1 and OU2 .EXAMPLE Disable-CompromisedUser -OU "OU=OU1,DC=contoso,DC=com","OU=OU2,DC=contoso,DC=com" -check Check if all users present in OU1 and OU2 are disable .NOTES General notes #> [CmdletBinding(DefaultParameterSetName = "ByUser")] param ( [Parameter( ParameterSetName = "ByUser", HelpMessage = 'One or more user(s) to disable' )] [System.String[]]$Identity, [Parameter( ParameterSetName = "ByFileName", HelpMessage = 'File with a list of users to disable. txt with one name by line' )] [System.String]$FileName, [Parameter( ParameterSetName = "ByOu", HelpMessage = 'One or more OU(s) in which we want to disable all users' )] [System.String[]]$OU, [Parameter( HelpMessage = 'Only check if the users passed in parameter, whatever the way (Identity, Filename or OU), are disable' )] [Switch]$Check ) begin { $paramSetPSFLoggingProvider = @{ Name = 'logfile' InstanceName = 'Disable-CompromisedUser' FilePath = "$($env:temp)\Disable-CompromisedUser-%Date% %hour%%minute%.csv" Enabled = $true Wait = $true } Set-PSFLoggingProvider @paramSetPSFLoggingProvider Write-PSFMessage -Message "Retrieve AD User Account" -Level Verbose -Target MAIN $Users = @() switch ($PSCmdlet.ParameterSetName) { ByUser { Write-PSFMessage -Message "Retrieve AD User Account by user list" -Level Verbose -Target BYUSER foreach ($User in $Identity) { try { $Users += Get-ADUser -Identity $User -Properties SamAccountName,DisplayName,Enabled -ErrorAction Continue | Select-Object SamAccountName,DisplayName,Enabled Write-PSFMessage -Message "User $($User) found" -Level Verbose -Target BYUSER } catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException] { Write-PSFMessage -Message "User $($User) not found" -Level Verbose -Target BYUSER } } } ByFileName { Write-PSFMessage -Message "Retrieve AD User Account by filename" -Level Verbose -Target BYFILENAME foreach ($User in (Get-Content -Path $FileName)) { try { $Users += Get-ADUser -Identity $User -Properties SamAccountName,DisplayName,Enabled -ErrorAction Continue | Select-Object SamAccountName,DisplayName,Enabled Write-PSFMessage -Message "User $($User) found" -Level Verbose -Target BYFILENAME } catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException] { Write-PSFMessage -Message "User $($User) not found" -Level Verbose -Target BYFILENAME } } } ByOu { Write-PSFMessage -Message "Retrieve AD User Account by OU list" -Level Verbose -Target BYOU foreach ($Organ in $OU) { Write-PSFMessage -Message "Retrieve all users from OU $($Organ)" -Level Verbose -Target BYOU $Users += Get-ADUser -Filter * -SearchBase $Organ -Properties SamAccountName,DisplayName,Enabled | Select-Object SamAccountName,DisplayName,Enabled } } } Write-PSFMessage -Message "$($Users.Count) AD user account found" -Level Verbose -Target MAIN } process { foreach ($user in $Users) { if ($Check) { Write-PSFMessage -Message "Check state for user $( $User.SamAccountName)" -Level Verbose -Target MAIN if ($user.Enabled -eq "True") { Write-PSFMessage -Message "user $($User.SamAccountName) is enabled" -Level Verbose -Target MAIN } else { Write-PSFMessage -Message "user $($User.SamAccountName) is disabled" -Level Verbose -Target MAIN } } else { Disable-ADAccount -Identity $user.SamAccountName -WhatIf -Confirm:$false Write-PSFMessage -Message "Disabling $($User.SamAccountName) AD account" -Level Verbose -Target MAIN } } } end { Wait-PSFMessage } } #EndRegion '.\Public\Disable-CompromisedUser.ps1' 205 #Region '.\Public\Find-UserLockoutsInformation.ps1' 0 Function Find-UserLockoutsInformation { <# .SYNOPSIS Find information about locked user account .DESCRIPTION This fonction search for locked user on PDC Emulator and return the lock source return : User : User1 DomainController : PDCEmulator EventId : 4740 LockoutTimeStamp : 8/3/2023 6:18:12 AM Message : A user account was locked out. LockoutSource : SourceComputer To find the reason use : Get-UserLockoutReason -Computer SourceComputer -Identity User1 .PARAMETER Identity User to check (by default all) .PARAMETER DC Domain controller on which you want to look up information (by default PDC Emulator) .PARAMETER Credential Administrator credential to connect to the DC .EXAMPLE Find-UserLockoutsInformation -Credential (Get-Credential MyAdminAccount) Search information for all locked users in PDC Emulator .EXAMPLE Find-UserLockoutsInformation -Identity User1 -Credential (Get-Credential MyAdminAccount) Search information for user User1 in PDC Emulator .EXAMPLE Find-UserLockoutsInformation -Identity User1 -DC MyDC1 -Credential (Get-Credential MyAdminAccount) Search information for user User1 in specific domain controler MyDC1 .NOTES General notes #> [CmdletBinding( DefaultParameterSetName = 'All' )] param ( [Parameter( ValueFromPipeline = $true, ParameterSetName = 'ByUser' )] [System.String]$Identity, [System.String]$DC = (Get-ADDomain).PDCEmulator, # Specifies the user account credentials to use when performing this task. [Parameter()] [ValidateNotNull()] [System.Management.Automation.PSCredential] [System.Management.Automation.Credential()] $Credential = [System.Management.Automation.PSCredential]::Empty ) Begin { Write-Verbose ('[{0:O}] Searching EventID : 4740 on Server : {1} ' -f (get-date), $DC) $WinEventArguments = @{ ComputerName = $DC FilterHashtable = @{LogName = 'Security'; Id = 4740 } } if ($PSBoundParameters.ContainsKey('Credential')) { $WinEventArguments['Credential'] = $Credential } try { $LockedOutEvents = Get-WinEvent @WinEventArguments -ErrorAction Stop | Sort-Object -Property TimeCreated -Descending } catch { if ($Error[-1].Exception.Message -like "*elevated user rights*") { throw ('[{0:O}] You need an admin account. Please provide with the -Credential parameter' -f (get-date)) } } if ($LockedOutEvents) { Write-Verbose ('[{0:O}] {1} event found' -f (get-date), $LockedOutEvents.Count) } else { throw ('[{0:O}] No event found' -f (get-date)) } } Process { switch ($PSCmdlet.ParameterSetName) { ByUser { Write-Verbose ('[{0:O}] Searching information for user : {1}' -f (get-date), $Identity) $UserInfo = Get-ADUser -Identity $Identity Foreach ($Event in $LockedOutEvents) { If ($Event | Where-Object { $_.Properties[2].value -match $UserInfo.SID.Value }) { $Event | Select-Object -Property @( @{Label = 'User'; Expression = { $_.Properties[0].Value } } @{Label = 'DomainController'; Expression = { $_.MachineName } } @{Label = 'EventId'; Expression = { $_.Id } } @{Label = 'LockoutTimeStamp'; Expression = { $_.TimeCreated } } @{Label = 'Message'; Expression = { $_.Message -split "`r" | Select-Object -First 1 } } @{Label = 'LockoutSource'; Expression = { $_.Properties[1].Value } } ) } } } All { Write-Verbose ('[{0:O}] Searching information for all user(s) ' -f (get-date)) Foreach ($Event in $LockedOutEvents) { $Event | Select-Object -Property @( @{Label = 'User'; Expression = { $_.Properties[0].Value } } @{Label = 'DomainController'; Expression = { $_.MachineName } } @{Label = 'EventId'; Expression = { $_.Id } } @{Label = 'LockoutTimeStamp'; Expression = { $_.TimeCreated } } @{Label = 'Message'; Expression = { $_.Message -split "`r" | Select-Object -First 1 } } @{Label = 'LockoutSource'; Expression = { $_.Properties[1].Value } } ) } } } } End { } } #EndRegion '.\Public\Find-UserLockoutsInformation.ps1' 134 #Region '.\Public\Get-RemoteRDPSession.ps1' 0 function Get-RemoteRDPSession { <# .SYNOPSIS Retrieve RDP session .DESCRIPTION This function retrive all rdp session on a remote computer. Result il like : UserName : UserName SessionName : SessionName ID : SessionID State : SessionState IdleTime : SessionIdleTime LogonTime : SessionLogonType .PARAMETER ComputerName The remote computer on which you want RDP sessions .PARAMETER Credential An account with the necessary privileges to connect to the remote computer .EXAMPLE Get-RemoteRDPSessions -ComputerName Server1 -Credential MyAdmAccount .NOTES General notes #> param ( [Parameter(ValueFromPipeline = $true)] [string]$ComputerName, # Specifies the user account credentials to use when performing this task. [Parameter()] [ValidateNotNull()] [System.Management.Automation.PSCredential] [System.Management.Automation.Credential()] $Credential = [System.Management.Automation.PSCredential]::Empty ) begin { } process { if ([COMPUTER]::TestIfComputerExist($ComputerName) -and [COMPUTER]::TestIfComputerIsAlive($ComputerName)) { $QueryArguments = @{ ComputerName = $ComputerName } if ($PSBoundParameters.ContainsKey('Credential')) { $QueryArguments['Credential'] = $Credential } $query = Invoke-Command @QueryArguments -ScriptBlock { quser } if ($query -match 'No User exists for ') { Write-Output "No active RDP sessions found on $ComputerName." return } $sessions = $query | Select-Object -Skip 1 | ForEach-Object { $parts = $_.Trim() -split '\s+' [PSCustomObject]@{ ComputerName = $ComputerName UserName = $parts[0] SessionName = $parts[1] ID = $parts[2] State = $parts[3] IdleTime = if ($parts.Count -ge 6) { $parts[5] } else { 'N/A' } LogonTime = if ($parts.Count -ge 5) { "$($parts[4]) $([DateTime]::Now.ToShortDateString())" } else { 'N/A' } } } } else { Write-Error ('[{0:O}] Computer {1} not found or not alive ' -f (get-date), $ComputerName) } } end { return $sessions } } #EndRegion '.\Public\Get-RemoteRDPSession.ps1' 102 #Region '.\Public\Get-UserLockoutReason.ps1' 0 function Get-UserLockoutReason { <# .SYNOPSIS Search user lockout reason .DESCRIPTION You can search the reason of locked user on a specific computer To find the source you can use : Find-UserLockoutsInformation -Identity User1 -DC MyDC1 -Credential (Get-Credential MyAdminAccount) .PARAMETER Computer User lockout source computer .PARAMETER Identity Name of the user for whom we are looking for the source of the lock .PARAMETER Credential Administrator credential to connect to the computer .EXAMPLE Get-UserLockoutReason -Computer ComputerSource -Identity User1 -Credential (Get-Credential MyAdminAccount) .NOTES General notes #> [CmdletBinding( DefaultParameterSetName = 'All' )] [OutputType([System.Object[]])] param ( [System.String]$Computer, [Parameter( ValueFromPipeline = $true, ParameterSetName = 'ByUser' )] [System.String]$Identity, # Specifies the user account credentials to use when performing this task. [Parameter()] [ValidateNotNull()] [System.Management.Automation.PSCredential] [System.Management.Automation.Credential()] $Credential = [System.Management.Automation.PSCredential]::Empty ) begin { $LogonInfo = Import-PSFPowerShellDataFile -Path $PSScriptRoot/PSSYSAdm.psd1 Write-Verbose ('[{0:O}] Searching EventID : 4625 on Computer : {1} ' -f (get-date), $Computer) $WinEventArguments = @{ ComputerName = $Computer FilterHashtable = @{LogName = 'Security'; Id = 4625 } } if ($PSBoundParameters.ContainsKey('Credential')) { $WinEventArguments['Credential'] = $Credential } $lockoutEvents = $null Write-Verbose ('[{0:O}] Test if computer : {1} is alive ' -f (get-date), $Computer) if (Test-Connection -ComputerName $Computer -Quiet -Count 2) { try { $lockoutEvents = Get-WinEvent @WinEventArguments -ErrorAction Stop } catch { if ($_.Exception.Message -match "No events were found that match the specified selection criteria") { Write-Verbose ('[{0:O}] No logs found' -f (get-date)) } if ($Error[-1].Exception.Message -like "*elevated user rights*") { throw ('[{0:O}] You need an admin account. Please provide with the -Credential parameter' -f (get-date)) } } } else { throw ('[{0:O}] computer {1} is not alive' -f (get-date), $Computer) } if ($lockoutEvents) { Write-Verbose ('[{0:O}] {1} event found' -f (get-date), $lockoutEvents.Count) } else { throw ('[{0:O}] No event found' -f (get-date)) } } process { switch ($PSCmdlet.ParameterSetName) { All { Write-Verbose ('[{0:O}] Searching information for all user(s) ' -f (get-date)) Foreach ($Event in $lockoutEvents) { $eventXML = [xml]$event.ToXml() $Event | Select-Object -Property @( @{label = 'LockedUserName' ; Expression = {$eventXML.Event.EventData.Data[5].'#text'}} @{label = 'LogonType' ; Expression = {$LogonInfo.PrivateData.LogonType."$($eventXML.Event.EventData.Data[10].'#text')"}} @{label = 'LogonProcessName' ; Expression = {$eventXML.Event.EventData.Data[11].'#text'}} @{label = 'ProcessName' ; Expression = {$eventXML.Event.EventData.Data[18].'#text'}} @{label = 'FailureReason' ; Expression = {$LogonInfo.PrivateData.FailureReason."$($eventXML.Event.EventData.Data[8].'#text')"}} @{label = 'FailureStatus' ; Expression = {$LogonInfo.PrivateData.FailureType."$($eventXML.Event.EventData.Data[7].'#text')"}} @{label = 'FailureSubStatus' ; Expression = {$LogonInfo.PrivateData.FailureType."$($eventXML.Event.EventData.Data[9].'#text')"}} ) } } ByUser { Write-Verbose ('[{0:O}] Searching information for user : {1}' -f (get-date), $Identity) Foreach ($Event in $lockoutEvents) { $eventXML = [xml]$event.ToXml() If ($Event | Where-Object { $eventXML.Event.EventData.Data[5].'#text' -match $Identity }) { $Event | Select-Object -Property @( @{label = 'LockedUserName' ; Expression = {$eventXML.Event.EventData.Data[5].'#text'}} @{label = 'LogonType' ; Expression = {$LogonInfo.PrivateData.LogonType."$($eventXML.Event.EventData.Data[10].'#text')"}} @{label = 'LogonProcessName' ; Expression = {$eventXML.Event.EventData.Data[11].'#text'}} @{label = 'ProcessName' ; Expression = {$eventXML.Event.EventData.Data[18].'#text'}} @{label = 'FailureReason' ; Expression = {$LogonInfo.PrivateData.FailureReason."$($eventXML.Event.EventData.Data[8].'#text')"}} @{label = 'FailureStatus' ; Expression = {$LogonInfo.PrivateData.FailureType."$($eventXML.Event.EventData.Data[7].'#text')"}} @{label = 'FailureSubStatus' ; Expression = {$LogonInfo.PrivateData.FailureType."$($eventXML.Event.EventData.Data[9].'#text')"}} ) } } } } } end { } } #EndRegion '.\Public\Get-UserLockoutReason.ps1' 147 |