XDomainControllers-Events.psm1
|
<#
Import-Module XDomainControllers-Events -force ### gcm -Module XDomainControllers-Events Get-Xhunt-Lockout | Export-Csv -Path C:\Temp\Lockoutevent.csv -NoTypeInformation #> Function Get-XhuntNtlm { [CmdletBinding()] Param ( ) $getadcs = [system.directoryservices.activedirectory.domain]::GetCurrentDomain().DomainControllers.Name $ErrorActionPreference = "SilentlyContinue" Write-Verbose "Searching Event ID : 4624 from $env:USERDNSDOMAIN $($getadcs.Count) Domain Controllers............." Invoke-Command -ComputerName $getadcs -ScriptBlock { $query = @" <QueryList> <Query Id="0" Path="Security"> <Select Path="Security">*[System[(EventID=4624)]]</Select> </Query> </QueryList> "@ $x = Get-WinEvent -FilterXml $query -ErrorAction SilentlyContinue | Select-Object -First 100 $xmlString = $x.ToXml() foreach ($item in $xmlString) { #Now get the Object by typecasting the XML String into XMLDocumentObject $xmlObject = [xml]$item $data = New-Object PSCustomObject $xmlObject.Event.EventData.data.ForEach( { $data | Add-Member -MemberType NoteProperty -Name $_.Name -Value $_.'#text' }) $data } } | Select-Object -Property @{Name = "DomainController"; Expression = { $_.PSComputerName } }, AuthenticationPackageName, TargetUserName, IpAddress | Where-Object AuthenticationPackageName -EQ "ntlm" } Function Get-XhuntRC4 { [CmdletBinding()] Param ( ) $getadcs = [system.directoryservices.activedirectory.domain]::GetCurrentDomain().DomainControllers.Name $ErrorActionPreference = "SilentlyContinue" Write-Verbose "Searching Event ID : 4769 from $env:USERDNSDOMAIN $($getadcs.Count) Domain Controllers............." Invoke-Command -ComputerName $getadcs -ScriptBlock { $query = @" <QueryList> <Query Id="0" Path="Security"> <Select Path="Security">*[System[(EventID=4769)]]</Select> </Query> </QueryList> "@ $x = Get-WinEvent -FilterXml $query | Select-Object -First 100 $xmlString = $x.ToXml() foreach ($item in $xmlString) { #Now get the Object by typecasting the XML String into XMLDocumentObject $xmlObject = [xml]$item $data = New-Object PSCustomObject $xmlObject.Event.EventData.data.ForEach( { $data | Add-Member -MemberType NoteProperty -Name $_.Name -Value $_.'#text' }) $data } } | Select-Object -Property @{Name = "DomainController"; Expression = { $_.PSComputerName } }, TargetUserName, @{Name = "KerbType"; Expression = { $_.TicketEncryptionType } } , IpAddress, Status, TicketOptions | Where-Object KerbType -EQ "0x17" } Function Get-XhuntAES { [CmdletBinding()] Param ( ) $getadcs = [system.directoryservices.activedirectory.domain]::GetCurrentDomain().DomainControllers.Name $ErrorActionPreference = "SilentlyContinue" Write-Verbose "Searching Event ID : 4769 from $env:USERDNSDOMAIN $($getadcs.Count) Domain Controllers............." Invoke-Command -ComputerName $getadcs -ScriptBlock { $query = @" <QueryList> <Query Id="0" Path="Security"> <Select Path="Security">*[System[(EventID=4769)]]</Select> </Query> </QueryList> "@ $x = Get-WinEvent -FilterXml $query | Select-Object -First 100 $xmlString = $x.ToXml() foreach ($item in $xmlString) { #Now get the Object by typecasting the XML String into XMLDocumentObject $xmlObject = [xml]$item $data = New-Object PSCustomObject $xmlObject.Event.EventData.data.ForEach( { $data | Add-Member -MemberType NoteProperty -Name $_.Name -Value $_.'#text' }) $data } } | Select-Object -Property @{Name = "DomainController"; Expression = { $_.PSComputerName } }, TargetUserName, @{Name = "KerbType"; Expression = { $_.TicketEncryptionType } } , IpAddress, Status, TicketOptions | Where-Object KerbType -EQ "0x12" } Function Get-XhuntUptime { [CmdletBinding()] Param ( ) $ErrorActionPreference = "Stop" $computername = [system.directoryservices.activedirectory.domain]::GetCurrentDomain().DomainControllers.Name # use DCOM for older systems that do not run with WinRM remoting Write-Verbose "Getting UPTIME from $env:USERDNSDOMAIN $($getadcs.Count) Domain Controllers............." $option = New-CimSessionOption -Protocol Wsman $Uptimeobj = foreach ($c in $computername) { Try { $session = New-CimSession -ComputerName $c -SessionOption $option $bootTime = Get-CimInstance -ClassName Win32_OperatingSystem -CimSession $session | Select-Object -ExpandProperty LastBootupTime $upTime = New-TimeSpan -Start $bootTime $min = [int]$upTime.TotalMinutes $ut = [math]::Round($($min / 60 / 24)) [pscustomobject]@{ DomainController = $c Uptime_Day = $ut } Remove-CimSession -CimSession $session } Catch { $ObjErr = [pscustomobject]@{ DomainController = $c Uptime = "Not Reachable" } $ObjErr | Add-Content C:\temp\DCUptimeErr.txt -Verbose } } $Uptimeobj | Sort-Object Uptime_Day -Descending #Write-Host "Total $($Uptimeobj.count)" } Function Get-XhuntLockout { [CmdletBinding()] Param ( ) $getadcs = [system.directoryservices.activedirectory.domain]::GetCurrentDomain().DomainControllers.Name $ErrorActionPreference = "SilentlyContinue" Write-Verbose "Searching Event ID : 4625 from $env:USERDNSDOMAIN $($getadcs.Count) Domain Controllers............." Invoke-Command -ComputerName $getadcs -ScriptBlock { $query = @" <QueryList> <Query Id="0" Path="Security"> <Select Path="Security">*[System[(EventID=4625)]]</Select> </Query> </QueryList> "@ $x = Get-WinEvent -FilterXml $query | Select-Object -First 100 $xmlString = $x.ToXml() foreach ($item in $xmlString) { #Now get the Object by typecasting the XML String into XMLDocumentObject $xmlObject = [xml]$item $data = New-Object PSCustomObject $xmlObject.Event.EventData.data.ForEach( { $data | Add-Member -MemberType NoteProperty -Name $_.Name -Value $_.'#text' }) $data } } | Select-Object -Property @{Name = "ADC"; Expression = { $_.PSComputerName } }, TargetUserName, IpAddress, Status, FailureReason, SubStatus, LogonType } Function Get-XhuntWUdate { [CmdletBinding()] Param ( ) $getadcs = [system.directoryservices.activedirectory.domain]::GetCurrentDomain().DomainControllers.Name $ErrorActionPreference = "SilentlyContinue" Write-Verbose "Getting last patching date from $env:USERDNSDOMAIN $($getadcs.Count) Domain Controllers............." Invoke-Command -ComputerName $GetADCs -ScriptBlock { Get-HotFix | Select-Object -Last 1 } | Select-Object -Property @{Name = "DomainController"; Expression = { $_.PSComputerName } }, InstalledBy, HotFixID, InstalledOn | Sort-Object InstalledOn } |