Src/Public/Invoke-AsBuiltReport.Microsoft.AD.ps1

function Invoke-AsBuiltReport.Microsoft.AD {
    <#
    .SYNOPSIS
        PowerShell script to document the configuration of Microsoft AD in Word/HTML/Text formats
    .DESCRIPTION
        Documents the configuration of Microsoft AD in Word/HTML/Text formats using PScribo.
    .NOTES
        Version: 0.7.13
        Author: Jonathan Colon
        Twitter: @jcolonfzenpr
        Github: rebelinux
        Credits: Iain Brighton (@iainbrighton) - PScribo module
 
    .LINK
        https://github.com/AsBuiltReport/AsBuiltReport.Microsoft.AD
    #>


    # Do not remove or add to these parameters
    param (
        [String[]] $Target,
        [PSCredential] $Credential
    )

    Write-PScriboMessage -IsWarning "Please refer to the AsBuiltReport.Microsoft.AD github website for more detailed information about this project."
    Write-PScriboMessage -IsWarning "Do not forget to update your report configuration file after each new release."
    Write-PScriboMessage -IsWarning "Documentation: https://github.com/AsBuiltReport/AsBuiltReport.Microsoft.AD"
    Write-PScriboMessage -IsWarning "Issues or bug reporting: https://github.com/AsBuiltReport/AsBuiltReport.Microsoft.AD/issues"

    Try {
        $InstalledVersion = Get-Module -ListAvailable -Name AsBuiltReport.Microsoft.AD -ErrorAction SilentlyContinue | Sort-Object -Property Version -Descending | Select-Object -First 1 -ExpandProperty Version

        if ($InstalledVersion) {
            Write-PScriboMessage -IsWarning "AsBuiltReport.Microsoft.AD $($InstalledVersion.ToString()) is currently installed."
            $LatestVersion = Find-Module -Name AsBuiltReport.Microsoft.AD -Repository PSGallery -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Version
            if ($LatestVersion -gt $InstalledVersion) {
                Write-PScriboMessage -IsWarning "AsBuiltReport.Microsoft.AD $($LatestVersion.ToString()) is available."
                Write-PScriboMessage -IsWarning "Run 'Update-Module -Name AsBuiltReport.Microsoft.AD -Force' to install the latest version."
            }
        }
    } Catch {
            Write-PscriboMessage -IsWarning $_.Exception.Message
        }

    $currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())

    if (-not $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {

        throw "The requested operation requires elevation: Run PowerShell console as administrator"
    }


    #Validate Required Modules and Features
    $OSType = (Get-ComputerInfo).OsProductType
    if ($OSType -eq 'WorkStation') {
        Get-RequiredFeature -Name 'Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0' -OSType $OSType
        Get-RequiredFeature -Name 'Rsat.CertificateServices.Tools~~~~0.0.1.0' -OSType $OSType
        Get-RequiredFeature -Name 'Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0' -OSType $OSType
        Get-RequiredFeature -Name 'Rsat.Dns.Tools~~~~0.0.1.0' -OSType $OSType
    }
    if ($OSType -eq 'Server' -or $OSType -eq 'DomainController') {
        Get-RequiredFeature -Name RSAT-AD-PowerShell -OSType $OSType
        Get-RequiredFeature -Name RSAT-ADCS -OSType $OSType
        Get-RequiredFeature -Name RSAT-ADCS-mgmt -OSType $OSType
        Get-RequiredFeature -Name RSAT-DNS-Server -OSType $OSType
        Get-RequiredFeature -Name GPMC -OSType $OSType
    }

    Get-RequiredModule -Name PSPKI -Version '3.7.2'


    # Import Report Configuration
    $Global:Report = $ReportConfig.Report
    $Global:InfoLevel = $ReportConfig.InfoLevel
    $Global:Options = $ReportConfig.Options

    # Used to set values to TitleCase where required
    $TextInfo = (Get-Culture).TextInfo

    #---------------------------------------------------------------------------------------------#
    # Connection Section #
    #---------------------------------------------------------------------------------------------#
    foreach ($System in $Target) {

        Try {
            Write-PScriboMessage "Connecting to Domain Controller Server '$System'."
            $script:TempPssSession = New-PSSession $System -Credential $Credential -Authentication $Options.PSDefaultAuthentication -ErrorAction Stop
            $script:TempCIMSession = New-CIMSession $System -Credential $Credential -Authentication $Options.PSDefaultAuthentication -ErrorAction Stop
            $script:ADSystem = Invoke-Command -Session $TempPssSession { Get-ADForest -ErrorAction Stop}
        } Catch {
            throw "Unable to connect to the Domain Controller: $System"
        }

        $script:ForestInfo =  $ADSystem.RootDomain.toUpper()
        [array]$RootDomains = $ADSystem.RootDomain
        [array]$ChildDomains = $ADSystem.Domains | Where-Object {$_ -ne $RootDomains}
        [string]$OrderedDomains = $RootDomains + $ChildDomains

        #---------------------------------------------------------------------------------------------#
        # Forest Section #
        #---------------------------------------------------------------------------------------------#
        Section -Style Heading1 "$($ForestInfo.toUpper())" {
            Paragraph "The following section provides a summary of the Active Directory Infrastructure configuration for $($ForestInfo)."
            BlankLine
            Write-PScriboMessage "Forest InfoLevel set at $($InfoLevel.Forest)."
            if ($InfoLevel.Forest -ge 1) {
                try {
                    Section -Style Heading2 "Forest Configuration."  {
                        if ($Options.ShowDefinitionInfo) {
                            Paragraph "The Active Directory framework that holds the objects can be viewed at a number of levels. The forest, tree, and domain are the logical divisions in an Active Directory network. At the top of the structure is the forest. A forest is a collection of trees that share a common global catalog, directory schema, logical structure, and directory configuration. The forest represents the security boundary within which users, computers, groups, and other objects are accessible."
                            BlankLine
                        }
                        if (!$Options.ShowDefinitionInfo) {
                            Paragraph "The following section provides a summary of the Active Directory Forest Information."
                            BlankLine
                        }
                        try {
                            Get-AbrADForest
                        }
                        catch {
                            Write-PscriboMessage -IsWarning $_.Exception.Message
                        }
                        try {
                            Get-AbrADSite
                        }
                        catch {
                            Write-PscriboMessage -IsWarning $_.Exception.Message
                        }
                    }
                }
                catch {
                    Write-PscriboMessage -IsWarning "Error: Unable to retreive Forest: $ForestInfo information."
                    Write-PscriboMessage -IsWarning $_.Exception.Message
                }
            }
            #---------------------------------------------------------------------------------------------#
            # Domain Section #
            #---------------------------------------------------------------------------------------------#

            if ($InfoLevel.Domain -ge 1) {
                Section -Style Heading2 "AD Domain Configuration" {
                    if ($Options.ShowDefinitionInfo) {
                        Paragraph "An Active Directory domain is a collection of objects within a Microsoft Active Directory network. An object can be a single user or a group or it can be a hardware component, such as a computer or printer.Each domain holds a database containing object identity information. Active Directory domains can be identified using a DNS name, which can be the same as an organization's public domain name, a sub-domain or an alternate version (which may end in .local)."
                        BlankLine
                    }
                    if (!$Options.ShowDefinitionInfo) {
                        Paragraph "The following section provides a summary of the Active Directory Domain Information."
                        BlankLine
                    }

                    foreach ($Domain in $OrderedDomains.split(" ")) {
                        if ($Domain) {
                            # Define Filter option for Domain variable
                            if ($Options.Include.Domains) {
                                $DomainFilterOption = $Domain -in $Options.Include.Domains

                            } else {
                                $DomainFilterOption = $Domain -notin $Options.Exclude.Domains
                            }
                            try {
                                if (( $DomainFilterOption ) -and (Invoke-Command -Session $TempPssSession {Get-ADDomain -Identity $using:Domain})) {
                                    Section -Style Heading3 "$($Domain.ToString().ToUpper())" {
                                        Paragraph "The following section provides a summary of the Active Directory Domain Information."
                                        BlankLine
                                        Get-AbrADDomain -Domain $Domain
                                        Get-AbrADFSMO -Domain $Domain
                                        Get-AbrADTrust -Domain $Domain
                                        Get-AbrADDomainObject -Domain $Domain
                                        if ($HealthCheck.Domain.Backup -or $HealthCheck.Domain.DFS -or $HealthCheck.Domain.SPN -or $HealthCheck.Domain.Security -or $HealthCheck.Domain.DuplicateObject) {
                                            Section -Style Heading4 'Health Checks' {
                                                Get-AbrADDomainLastBackup -Domain $Domain
                                                Get-AbrADDFSHealth -Domain $Domain
                                                if ($Domain -like $ADSystem.RootDomain) {
                                                    Get-AbrADDuplicateSPN -Domain $ADSystem.RootDomain
                                                }
                                                Get-AbrADSecurityAssessment -Domain $Domain
                                                Get-AbrADKerberosAudit -Domain $Domain
                                                Get-AbrADDuplicateObject -Domain $Domain
                                            }
                                        }
                                        Section -Style Heading4 'Domain Controllers' {
                                            if ($Options.ShowDefinitionInfo) {
                                                Paragraph "A domain controller (DC) is a server computer that responds to security authentication requests within a computer network domain. It is a network server that is responsible for allowing host access to domain resources. It authenticates users, stores user account information and enforces security policy for a domain."
                                                BlankLine
                                            }
                                            if (!$Options.ShowDefinitionInfo) {
                                                Paragraph "The following section provides a summary of the Active Directory Domain Controllers."
                                                BlankLine
                                            }
                                            $DCs = Invoke-Command -Session $TempPssSession {Get-ADDomain -Identity $using:Domain | Select-Object -ExpandProperty ReplicaDirectoryServers | Where-Object { $_ -notin ($using:Options).Exclude.DCs}}

                                            if ($DCs) {

                                                Get-AbrADDomainController -Domain $Domain -Dcs $DCs

                                                if ($InfoLevel.Domain -ge 2) {
                                                    Section -Style Heading5 "Roles" {
                                                        Paragraph "The following section provides a summary of installed role & features on $Domain DCs."
                                                        foreach ($DC in $DCs){
                                                            $DCStatus = Test-Connection -ComputerName $DC -Quiet -Count 1
                                                            if ($DCStatus -eq $false) {
                                                                Write-PScriboMessage -IsWarning "Unable to connect to $DC. Removing it from the $Domain report"
                                                            }
                                                            if (($DC -notin $Options.Exclude.DCs) -and $DCStatus) {
                                                                Get-AbrADDCRoleFeature -DC $DC
                                                            }
                                                        }
                                                    }
                                                }
                                                if ($HealthCheck.DomainController.Diagnostic) {
                                                    try {
                                                        Section -Style Heading5 'DC Diagnostic' {
                                                            Paragraph "The following section provides a summary of the Active Directory DC Diagnostic."
                                                            BlankLine
                                                            foreach ($DC in $DCs){
                                                                if (($DC -notin $Options.Exclude.DCs) -and (Test-Connection -ComputerName $DC -Quiet -Count 1)) {
                                                                    Get-AbrADDCDiag -Domain $Domain -DC $DC
                                                                }
                                                            }
                                                        }
                                                    }
                                                    catch {
                                                        Write-PscriboMessage -IsWarning "Error: Connecting to remote server $DC failed: WinRM cannot complete the operation. ('DCDiag Information)"
                                                        Write-PscriboMessage -IsWarning $_.Exception.Message
                                                        continue
                                                    }
                                                }
                                                try {
                                                    Section -Style Heading5 "Infrastructure Services Status" {
                                                        Paragraph "The following section provides a summary of the Domain Controller Infrastructure services status."
                                                        foreach ($DC in $DCs){
                                                            if (($DC -notin $Options.Exclude.DCs) -and (Test-Connection -ComputerName $DC -Quiet -Count 1)) {
                                                                Get-AbrADInfrastructureService -DC $DC
                                                            }
                                                        }
                                                    }
                                                }
                                                catch {
                                                    Write-PscriboMessage -IsWarning "Error: Connecting to remote server $DC failed: WinRM cannot complete the operation. (ADInfrastructureService)"
                                                    Write-PscriboMessage -IsWarning $_.Exception.Message
                                                    continue
                                                }
                                            }
                                            Get-AbrADSiteReplication -Domain $Domain
                                            Get-AbrADGPO -Domain $Domain
                                            Get-AbrADOU -Domain $Domain
                                        }
                                    }
                                } else {
                                    Write-PScriboMessage "$($Domain) disabled in Exclude.Domain variable"
                                }
                            }
                            catch {
                                Write-PscriboMessage -IsWarning "$($_.Exception.Message) (Active Directory Domain)"
                                continue
                            }
                        }
                    }
                }
            }
            #---------------------------------------------------------------------------------------------#
            # DNS Section #
            #---------------------------------------------------------------------------------------------#
            if ($InfoLevel.DNS -ge 1) {
                Section -Style Heading2 "DNS Configuration" {
                    if ($Options.ShowDefinitionInfo) {
                        Paragraph "The Domain Name System (DNS) is a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. It associates various information with domain names assigned to each of the participating entities. Most prominently, it translates more readily memorized domain names to the numerical IP addresses needed for locating and identifying computer services and devices with the underlying network protocols."
                        BlankLine
                    }
                    if (!$Options.ShowDefinitionInfo) {
                        Paragraph "The following section provides a summary of the Active Directory DNS Infrastructure Information."
                        BlankLine
                    }
                    foreach ($Domain in $OrderedDomains.split(" ")) {
                        if ($Domain) {
                            try {
                                # Define Filter option for Domain variable
                                if ($Options.Include.Domains) {
                                    $DomainFilterOption = $Domain -in $Options.Include.Domains

                                } else {
                                    $DomainFilterOption = $Domain -notin $Options.Exclude.Domains
                                }
                                if (( $DomainFilterOption ) -and (Invoke-Command -Session $TempPssSession {Get-ADDomain $using:Domain -ErrorAction Stop})) {
                                    Section -Style Heading3 "$($Domain.ToString().ToUpper())" {
                                        Paragraph "The following section provides a configuration summary of the DNS service."
                                        BlankLine
                                        Get-AbrADDNSInfrastructure -Domain $Domain
                                        $DCs = Invoke-Command -Session $TempPssSession {Get-ADDomain $using:Domain | Select-Object -ExpandProperty ReplicaDirectoryServers | Where-Object { $_ -notin ($using:Options).Exclude.DCs}}
                                        foreach ($DC in $DCs){
                                            if (Test-Connection -ComputerName $DC -Quiet -Count 1) {
                                                $DCPssSession = New-PSSession $DC -Credential $Credential -Authentication $Options.PSDefaultAuthentication
                                                Get-AbrADDNSZone -Domain $Domain -DC $DC
                                            }
                                            if ($DCPssSession) {
                                                Remove-PSSession -Session $DCPssSession
                                            }
                                        }
                                    }
                                } else {
                                    Write-PScriboMessage "$($Domain) disabled in Exclude.Domain variable"
                                }
                            }
                            catch {
                                Write-PscriboMessage -IsWarning "$($_.Exception.Message) (Domain Name System Information)"
                                continue
                            }
                        }
                    }
                }
            }

            #---------------------------------------------------------------------------------------------#
            # Certificate Authority Section #
            #---------------------------------------------------------------------------------------------#
            if ($InfoLevel.CA -ge 1) {
                try {
                    $CurrentMachineADDomain = Get-ComputerADDomain -ErrorAction SilentlyContinue
                } catch {
                    Write-PscriboMessage -IsWarning 'Unable to determine current AD Domain'
                    Write-PscriboMessage -IsWarning $_.Exception.Message

                }
                if ($CurrentMachineADDomain.Name -in $ADSystem.Domains) {
                    Write-PScriboMessage "Current PC Domain $($CurrentMachineADDomain.Name) is in the Forrest Domain list of $($ADSystem.Name). Enabling Certificate Authority section"
                    try {
                        Write-PScriboMessage "Collecting Certification Authority information from $($System.split(".")[0])"
                        $Global:CAs = Get-CertificationAuthority -Enterprise
                    }
                    catch {
                        Write-PscriboMessage -IsWarning $_.Exception.Message
                    }

                    if ($CAs) {
                        try {
                            Section -Style Heading2 "CA Configuration" {
                                if ($Options.ShowDefinitionInfo) {
                                    Paragraph 'In cryptography, a certificate authority or certification authority (CA) is an entity that issues digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate. This allows others (relying parties) to rely upon signatures or on assertions made about the private key that corresponds to the certified public key. A CA acts as a trusted third party trusted both by the subject (owner) of the certificate and by the party relying upon the certificate. The format of these certificates is specified by the X.509 or EMV standard.'
                                    BlankLine
                                }
                                if (!$Options.ShowDefinitionInfo) {
                                    Paragraph "The following section provides a summary of the Active Directory PKI Infrastructure Information."
                                    BlankLine
                                }
                                try {
                                    Get-AbrADCASummary
                                }
                                catch {
                                    Write-PscriboMessage -IsWarning $_.Exception.Message
                                }
                                if ($InfoLevel.CA -ge 2) {
                                    try {
                                        Get-AbrADCARoot
                                        Get-AbrADCASubordinate
                                    }
                                    catch {
                                        Write-PscriboMessage -IsWarning $_.Exception.Message
                                    }
                                }
                                foreach ($CA in ($CAs | Where-Object {$_.IsAccessible -notlike 'False'}).ComputerName) {
                                    $CAObject = Get-CertificationAuthority -Enterprise -ComputerName $CA
                                    if ($CAObject) {
                                        Section -Style Heading3 "$($CAObject.DisplayName) Details" {
                                            try {
                                                Get-AbrADCASecurity -CA $CAObject
                                            }
                                            catch {
                                                Write-PscriboMessage -IsWarning $_.Exception.Message
                                            }
                                            try {
                                                Get-AbrADCACryptographyConfig -CA $CAObject
                                            }
                                            catch {
                                                Write-PscriboMessage -IsWarning $_.Exception.Message
                                            }
                                            if ($InfoLevel.CA -ge 2) {
                                                try {
                                                    Get-AbrADCAAIA -CA $CAObject
                                                    Get-AbrADCACRLSetting -CA $CAObject
                                                }
                                                catch {
                                                    Write-PscriboMessage -IsWarning $_.Exception.Message
                                                }
                                            }
                                            if ($InfoLevel.CA -ge 2) {
                                                try {
                                                    Get-AbrADCATemplate -CA $CAObject
                                                }
                                                catch {
                                                    Write-PscriboMessage -IsWarning $_.Exception.Message
                                                }
                                            }
                                            try {
                                                Get-AbrADCAKeyRecoveryAgent -CA $CAObject
                                            }
                                            catch {
                                                Write-PscriboMessage -IsWarning $_.Exception.Message
                                            }
                                        }
                                    }
                                }
                            }
                        }
                        catch {
                            Write-PscriboMessage -IsWarning $_.Exception.Message
                            continue
                        }
                    }
                } else {Write-PScriboMessage -IsWarning "Current PC Domain $($CurrentMachineADDomain.Name) is not in the Forrest Domain list of $($ADSystem.Name). Disabling Certificate Authority section"
            }
            }
        }#endregion AD Section
        Write-PscriboMessage "Clearing PowerShell Session $($TempPssSession.Id)"
        Remove-PSSession -Session $TempPssSession
        Write-PscriboMessage "Clearing CIM Session $($TempCIMSession.Id)"
        Remove-CIMSession -CimSession $TempCIMSession
    }#endregion foreach loop
}