The powershell-sysadmin from devynspencer

powershell-sysadmin's Introduction

Oh, Hello 👋

🔭 I’m currently working on building APIs to help me keep track of everything.
🌱 I’m currently learning Flask.
👯 I’m looking to collaborate on anything!
💬 Ask me about PowerShell - I've written tools for everything under then sun.
⚡ Fun fact: Wish I had a fun fact.

powershell-sysadmin's People

Contributors

Stargazers

Watchers

powershell-sysadmin's Issues

Support configuration data from multiple files

Schedule email report of accounts with no recent logon activity

Add function to get usage of a printer profile on a print server

Event logs or whatever internal database

Add functions for managing DFS namespaces

Shared logging interface and destination

Email xyz wrapper

Add functions for performance monitor activities

Exporting performance monitor configurations
Exporting performance data
Stopping/starting collection of performance data

Add function wrapping email export process

Single dashboard for monitoring script executions

Scheduled / recurring tasks

Probably should be in new repo

Document configuration data schema

Assemble report of emails sent containing “Schedule mm/dd/yyyy” in the last month

Add function for verifying correct permissions applied to DFS root & subdirectories

Add function for setting baseline permissions on data volumes

Add function for creating shortcut to print share

Or handle it literally any other way

Scheduler interface

Wrappers for common utilities

RAM Map -- /accepteula
Process Explorer
Process Monitor

Report of baseline certificates on all hosts

Validate directory permissions or Varonis xyz via api

Add functions for managing file shares

Add functions for managing scheduled tasks

Add function to validate names of file share access groups

# Determine groups created in error
Get-ADGroup -Filter { Name -like "FS - Transfer*" } -Properties Created, Modified, Description, Members | select @{n="CorrectName";e={$_.Name -like "FS - Transfer * & *"}}, Name, SamAccountName, @{n="MemberCount";e={$_.Members.Count}}, Description | ? { !$_.CorrectName } | ft

# Remove the groups
Get-ADGroup -Filter { Name -like "FS - Transfer*" } -Properties Created, Modified, Description, Members | select @{n="CorrectName";e={$_.Name -like "FS - Transfer * & *"}}, Name, SamAccountName, @{n="MemberCount";e={$_.Members.Count}}, Description | ? { !$_.CorrectName } | % { Remove-ADGroup $_.SamAccountName -Confirm:$false }

# Verify remaining groups
Get-ADGroup -Filter { Name -like "FS - Transfer*" } -Properties Created, Modified, Description, Members | select @{n="CorrectName";e={$_.Name -like "FS - Transfer * & *"}}, Name, SamAccountName, @{n="MemberCount";e={$_.Members.Count}}, Description | ft

Add functions for creating security groups

Include opinionated defaults for Description, ManagedBy and similar properties.

Compare active directory accounts against a schema

Name format (either title case for both or LASTNAME FirstName
Display name
Description - not null and contains specific criteria
Title - either formatted a specific way or matching a value from a set list of job titles
Manager - not null
Office - matches a site from site list
DistinguishedName - ou is correct based on site or account type
SamAccountName - lowercase

Add function to Enable/Disable/Search netlogon debug logs for user logons

Example logs from the post look like:

03/29 09:52:57 [LOGON] [5076] MYDOMAIN: SamLogon: Transitive Network logon of (null)\VMWARE from  (via MYADMINPC) Entered
03/29 09:52:57 [LOGON] [5076] MYDOMAIN: SamLogon: Transitive Network logon of (null)\VMWARE from  (via MYADMINPC) Returns 0xC0000064
03/29 09:52:57 [LOGON] [5076] MYDOMAIN: SamLogon: Transitive Network logon of (null)\PRAXIS from  (via MYADMINPC) Entered
03/29 09:52:57 [LOGON] [5076] MYDOMAIN: SamLogon: Transitive Network logon of (null)\PRAXIS from  (via MYADMINPC) Returns 0xC0000064
03/29 09:53:01 [LOGON] [5076] MYDOMAIN: SamLogon: Transitive Network logon of (null)\NAS from  (via MYADMINPC) Entered
03/29 09:53:01 [LOGON] [5076] MYDOMAIN: SamLogon: Transitive Network logon of (null)\NAS from  (via MYADMINPC) Returns 0xC0000064
03/29 09:53:01 [LOGON] [2136] MYDOMAIN: SamLogon: Transitive Network logon of (null)\VEEAMSERVER from  (via MYADMINPC) Entered
03/29 09:53:01 [LOGON] [2136] MYDOMAIN: SamLogon: Transitive Network logon of (null)\VEEAMSERVER from  (via MYADMINPC) Returns 0xC0000064
03/29 09:53:10 [LOGON] [4796] MYDOMAIN: SamLogon: Transitive Network logon of (null)\LENOVO from  (via MYADMINPC) Entered

These could potentially identify a lockout source when the 4740 event is missing a caller computer name.

https://community.spiceworks.com/topic/2201424-ad-event-4740-without-calling-computername