evotecit / testimo Goto Github PK

Testimo is a PowerShell module for running health checks for Active Directory against a bunch of different tests

License: MIT License

PowerShell 100.00%

powershell active-directory tests hacktoberfest

testimo's Introduction

Testimo - PowerShell Module

Testimo is a PowerShell Module to help with basic/more advanced testing of Active Directory and maybe in future other types of servers. Testimo is an alpha product and as such things do change. It's goal is to be fully automated solution where one can run the command and get results without executing 50 little functions.

If you're new to Testimo you should read this blog post!

Note: At present this module is not supported in PowerShell Core/PowerShell 7. This is because the Testimo module depends on other Microsoft moodules that are also not supported in PowerShell 7, including GroupPolicy and ServerManager. There is an issue tracking this compatibiity which you can follow: #110.

Things to know:

✅ Configuration hash is not written in stone and can change rapidly as Testimo gets tested
✅ Ideas are VERY welcome
✅ There's a big mess in files/function names - I'm still testing things out creating some random names, will be cleaned up later on
✅ There are lots of details missing for tests, and some things may not work as you want - please report issues or if you know how, fix them
✅ I don't know EVERYTHING - I'm very open to help with making Testimo more robust, detailed and easy to use
✅ This module works great in Windows PowerShell!

Known Issues / By Design

Requirements for Sources work differently then for Tests
- For Sources when Requirements are not met Testimo skips it totally from output
- For Tests when Requirements are not met Testimo marks it as skipped

Installation

Install-Module -Name Testimo -AllowClobber -Force

Force and AllowClobber aren't really nessecary but they do skip errors in case some appear.

Updates

Update-Module -Name Testimo

Alternatively, rerunnng Install-Module with force will trigger reinstallation or update

Install-Module -Name Testimo -AllowClobber -Force

That's it. Whenever there's new version you simply run the command and you can enjoy it. Remember, that you may need to close, reopen PowerShell session if you have already used module before updating it.

The important thing is if something works for you on production, keep using it till you test the new version on a test computer. I do changes that may not be big, but big enough that auto-update will break your code. For example, small rename to a parameter and your code stops working! Be responsible!

Usage

With output to screen and HTML

Invoke-Testimo

Generate all tests but display content only in PowerShell

Invoke-Testimo -HideHTML

Please keep in mind that there is currently known issue that running all tests while works correctly generated HTML is very very slow when switching Tabs. It's advised to run seperate tests which will generate smaller file which will be more responsive

Invoke-Testimo -Source 'ForestOptionalFeatures','DomainWellKnownFolders','ForestSubnets' -Online -ReportPath $PSScriptRoot\Reports\TestimoSummary.html -AlwaysShowSteps

There are also other parameters available With option to be able to process output - for example to email

Invoke-Testimo -ReturnResults

Using Invoke-Testimo with non-default configuration

Following configuration allows you to:

Edit default TestImo configuration with some other values
Exclude one of the domains
Return Results for future processing
Limit sources to only 4 types (you could also limit that via Hashtable but this way is quicker for Adhoc enabling/disabling)

Import-Module Testimo

$OutputOrderedDictionary = Get-TestimoConfiguration
$OutputOrderedDictionary.ForestOptionalFeatures.Tests.RecycleBinEnabled.Enable = $false
$OutputOrderedDictionary.ForestOptionalFeatures.Tests.LapsAvailable.Enable = $true
$OutputOrderedDictionary.ForestOptionalFeatures.Tests.LapsAvailable.Parameters.ExpectedValue = $false

$Sources = @(
    'ForestFSMORoles'
    'ForestOptionalFeatures'
    'ForestBackup'
    'ForestOrphanedAdmins'
    'DomainPasswordComplexity'
    'DomainKerberosAccountAge'
    'DomainDNSScavengingForPrimaryDNSServer'
    'DCWindowsUpdates'
)

$TestResults = Invoke-Testimo -PassThru -ExcludeDomains 'ad.evotec.pl' -Sources $Sources -Configuration $OutputOrderedDictionary
$TestResults | Format-Table -AutoSize *

Be sure to checkout Examples section for more How-To.

Changing default configuration

Testimo comes with preset rules that may not apply to your environment. You may want to change some things like disabling some tests or changing some values (to an extent). There are 3 ways to do it. Depending on how you want to save/edit/pass configuration to TestIMO - I leave it up to you.

Straight to FILE/JSON

Get-TestimoConfiguration -FilePath $PSScriptRoot\Configuration\TestimoConfiguration.json

Straight to JSON

Get-TestimoConfiguration -AsJson

Output to Hashtable so you can edit it freely and keep in ps1

$OutputOrderedDictionary = Get-TestimoConfiguration
$OutputOrderedDictionary.ForestOptionalFeatures.Tests.RecycleBinEnabled.Enable = $false
$OutputOrderedDictionary.ForestOptionalFeatures.Tests.LapsAvailable.Enable = $true
$OutputOrderedDictionary.ForestOptionalFeatures.Tests.LapsAvailable.Parameters.ExpectedValue = $false

Comments

Keep in mind not all tests apply to each environment. I'm adding those to be flexible and be able to test things as needed. Each of those tests will need additional description and recommendation, most likely with links and steps to fix. Some of the tests are very basic and will need feedback, work on making it a robust test. Nothing is written in stone for now. Things can change day by day.

Things to consider

Criticality of Tests - some tests are critical, some are less critical, some are informative only
Recommended, Default, Sane - not all tests are equal or make sense in all conditions

Tests are based on:

Active Directory CheckList
AD Health & Checkup
Some tests I've defined myself
Feel free to submit your own ideas either via Issues or direct PR.

Type	Name	Area	Description
Forest	Backup	Backup	Verify `last backup time should be [less than X days]`
Forest	Replication	Connectivity	Verify each `DC in replication site can [reach other replication members]`
Forest	Replication using Repadmin	Connectivity	Verify each `DC in replication site can [reach other replication members]`
Forest	Optional Features	Features	Verify Optional Feature `Recycle Bin should be [Enabled]`
Forest	Optional Features	Features	Verify Optional Feature `Privileged Access Management Feature should be [Enabled]`
Forest	Optional Features	Features	Verify Optional Feature `Laps should be enabled [Configured]`
Forest	Sites Verification	Sites	Verify each `site has at least [one subnet configured]`
Forest	Sites Verification	Sites	Verify each `site has at least [one domain controller configured]`
Forest	Site Links	Site Links	Verify each `site link is automatic`
Forest	Site Links	Site Links	Verify each `site link uses notifications`
Forest	Site Links	Site Links	Verify each `site link does not use notifications`
Forest	Roles	Connectivity	Verify each `FSMO holder is [reachable]`
Forest	Orphaned/Empty Admins	Security	Verify `there are no Orphaned Admins (users/groups/computers)`
Forest	Tombstone Lifetime	Features	Verify `Tombstone lifetime is greater or equal 180 days`
Domain	Roles	Connectivity	Verify each `FSMO holder is [reachable]`
Domain	Password Complexity Requirements	Password	Verify Password `Complexity Policy should be [Enabled]`
Domain	Password Complexity Requirements	Password	Verify Password `Length should be [greater than X]`
Domain	Password Complexity Requirements	Password	Verify Password `Threshold should be [greater than X]`
Domain	Password Complexity Requirements	Password	Verify Password `Lockout Duration should be [greater than X minutes]`
Domain	Password Complexity Requirements	Password	Verify Password `Lockout Observation Window should be [greater than X minutes]`
Domain	Password Complexity Requirements	Password	Verify Password `Minimum Age should be [greater than X]`
Domain	Password Complexity Requirements	Password	Verify Password `History Count should be [greater than X]`
Domain	Password Complexity Requirements	Password	Verify Password `Reversible Encryption should be [Disabled]`
Domain	Trust Availability	Connectivity	Verify each `Trust status is OK`
Domain	Trust Unconstrained TGTDelegation	Security	Verify each `Trust TGTDelegation is set to True`
Domain	Kerberos Account Age	Security	Verify `Kerberos Last Password Change Should be less than 180 days`
Domain	Groups: Account Operators	Security	Verify `Group is empty`
Domain	Groups: Schema Admins	Security	Verify `Group is empty`
Domain	User: Administrator	Security	Verify `Last Password Change should be less than 360 days or account disabled`
Domain	DNS Forwarders	DNS	Verify `DNS Forwarders are identical on all DNS nodes`
Domain	DNS Scavenging - Primary DNS Server	DNS	Verify `DNS Scavenging is set to [X days]`
Domain	DNS Scavenging - Primary DNS Server	DNS	Verify `DNS Scavenging State is set to True`
Domain	DNS Scavenging - Primary DNS Server	DNS	Verify `DNS Scavenging Time is less than [X days]`
Domain	DNS Zone Aging	DNS	Verify `DNS Zone Aging is set`
Domain	DNS Zones Forest 0ADEL	Configuration/DNS	Verify `owner is not 0ADEL`
Domain	DNS Zones Domain 0ADEL	Configuration/DNS	Verify `owner is not 0ADEL`
Domain	Well known folder - UsersContainer	WellKnownFolders	Verify `folder is not at it's defaults.`
Domain	Well known folder - ComputersContainer	WellKnownFolders	Verify `folder is not at it's defaults.`
Domain	Well known folder - DomainControllersContainer	WellKnownFolders	Verify `folder is at it's defaults.`
Domain	Well known folder - DeletedObjectsContainer	WellKnownFolders	Verify `folder is at it's defaults.`
Domain	Well known folder - SystemsContainer	WellKnownFolders	Verify `folder is at it's defaults.`
Domain	Well known folder - LostAndFoundContainer	WellKnownFolders	Verify `folder is at it's defaults.`
Domain	Well known folder - QuotasContainer	WellKnownFolders	Verify `folder is at it's defaults.`
Domain	Well known folder - ForeignSecurityPrincipalsContainer	WellKnownFolders	Verify `folder is at it's defaults.`
Domain	Orphaned Foreign Security Principals	Cleanup	Verify `there are no orphaned FSP objects.`
Domain	Orphaned/Empty Organizational Units	Cleanup	Verify `there are no orphaned Organizational Units`
Domain	Group Policy Missing Permissions	Configuration	Verify `Authenticated Users/Domain Computers are on each and every Group Policy`
Domain	DFSR Sysvol	Configuration	Verify `SYSVOL is DFSR`
Domain	NTDS Parameters	Configuration	Verify `Domain Controller is writable (DSA Not Writable)`
Domain Controller	Information	Configuration	Verify `Is enabled`
Domain Controller	Information	Configuration	Verify `Is global catalog`
Domain Controller	Service Status	Services	Verify all `{Services} are [running]`
Domain Controller	Service Status	Services	Verify all `{Services} are set to [automatic startup]`
Domain Controller	Service Status (Print Spooler)	Security	Verify `Print Spooler Service is set to disabled`
Domain Controller	Service Status (Print Spooler)	Security	Verify `Print Spooler Service is stopped`
Domain Controller	Ping Connectivity	Connectivity	Verify `DC is [reachable]`
Domain Controller	Ports	Connectivity	Verify `Following ports 53, 88, 135, 139, 389, 445, 464, 636, 3268, 3269, 9389 are open`
Domain Controller	RDP Ports	Connectivity	Verify `Following ports 3389 (RDP) is open`
Domain Controller	RDP Security	Connectivity	Verify `NLA is enabled`
Domain Controller	LDAP Connectivity	Connectivity	Verify all `{LDAP Ports} are open]`
Domain Controller	LDAP Connectivity	Connectivity	Verify all `{LDAP SSL Ports} are open]`
Domain Controller	Windows Firewall	Connectivity	Verify `windows firewall is enabled` for all network cards
Domain Controller	Windows Remote Management	Connectivity	Verify `Windows Remote Management identification requests are managed`
Domain Controller	Resolves internal DNS queries	DNS	Verify `DNS on DC [resolves Internal DNS]`
Domain Controller	Resolves external DNS queries	DNS	Verify `DNS on DC [resolves External DNS]`
Domain Controller	Name servers for primary domain zone	DNS	Verify `DNS Name servers for primary zone are identical`
Domain Controller	Responds to PowerShell Queries	PowerShell	Verify DC `responds to PowerShell queries`
Domain Controller	TimeSettings	Time	Verify `PDC should [sync time to external source]`
Domain Controller	TimeSettings	Time	Verify `Non-PDC should [sync time to PDC emulator]`
Domain Controller	TimeSettings	Time	Verify `Virtualized DCs should [sync to hypervisor during boot time only]`
Domain Controller	Time Synchronization Internal	Time	Verify `Time Synchronization Difference to PDC [less than X seconds]`
Domain Controller	Time Synchronization External	Time	Verify `Time Synchronization Difference to pool.ntp.org [less than X seconds]`
Domain Controller	Disk Free	Computer	Verify `OS partition Free space is [at least X %]`
Domain Controller	Disk Free	Computer	Verify `NTDS partition Free space is [at least X %]`
Domain Controller	Operating System	Computer	Verify `Windows Operating system is Windows 2012 or higher`
Domain Controller	Windows Updates	Computer	Verify `Last patch was installed less than 60 days ago`
Domain Controller	SMB Protocols	Security	Verify `SMB v1 protocol is disabled`
Domain Controller	SMB Protocols	Security	Verify `SMB v2 protocol is enabled`
Domain Controller	SMB Shares	Security	Verify `default SMB shares NETLOGON/SYSVOL are visible`
Domain Controller	DFSR AutoRecovery	Security	Verify `DFSR AutoRecovery is enabled`
Domain Controller	Windows Roles and Features	Security	Verify `Windows Features for AD/DNS/File Services are enabled`

Dependencies

PowerShell 5.1 - I know, bummer right?
RSAT if run externally from Windows 10 machine

When you use the Install-Module option what happens in the backgrouns is that Windows will use PowershellGallery (hosted by Microsoft) to download Testimo and any dependencies this module needs. As it stands all dependencies except one (DSInternals) are my other PowerShell Modules. Why I am using it this way? Because I don't want to write multiple times the same code over and over.

In Testimo I'm using internal functions from some of the modules without any real documentation.

Portability

There are times where you may want to use Testimo in Portable way. Following function when executed will download all modules to given path and load them for you. Following blog post shows the way. It was written specifically for Testimo.

Initialize-ModulePortable -Name 'Testimo' -Path "$PSScriptRoot\TestimoPortable" -Download

After that,, you can use Invoke-Testimo as you normally would. You can also skip Download parameter if you already downloaded all the modules before. This function is also available as part of PSSharedGoods module.

Removal

In case you decide that Testimo is not for you, you can easily clean it up. Unfortunetly since Testimo uses all those dependencies as mentioned above you will have to remove all those modules one by one. Additionally if you have been using Testimo and you update it using Update-Module command and other modules got updated as well, it's possible there will be more then 1 version of said modules. Keep in mind that if you already use some of my modules some of the stuff may be already there and needed for different modules. Be careful when removing PowerShellModules.

Option 1

Finding where modules are stored (Get-Module -ListAvailable Testimo).ModuleBase
Manually deleting all folders Testimo, and other dependant modules

Option 2

Run Uninstall-Module

$Modules = @('Testimo', 'PSWinDocumentation.AD','PSWinDocumentation.DNS','ADEssentials', 'PSSharedGoods','PSWriteColor', 'Connectimo', 'DSInternals','Emailimo','PSWriteHTML' )
foreach ($Module in $Modules) {
    Uninstall-Module $Module -Force -AllVersions
}

Due to multiple versions per each module you may need to rerun this couple of times to remove all those mdoules in case there are some problems.

testimo's People

Contributors

Stargazers

Watchers

testimo's Issues

Monitoring Active Directory for Signs of Compromise

Link: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/monitoring-active-directory-for-signs-of-compromise

Changes to trust points between forests.

Srv.sys should be set to start on demand

Title:
Srv.sys should be set to start on demand

Severity
Warning

Date:
31.05.2018 22:33:35

Category:
Configuration

Problem:
Srv.sys is not set to start on demand.

Impact:
Client computers will not be able to access file shares and other Server Message Block (SMB)-based network services on this computer.

Resolution
Set Srv.sys to start on demand.

http://go.microsoft.com/fwlink/?LinkId=246875

Verify Privileged Groups contains only desired members

Records, to be scavenged, are aged out, and other DNS record checks.

Testing a policy backup and restore to validate.

Make Testimo portable

Right now you have to either build stuff from GitHub or install the module and its dependencies from PowerShellGallery. In some cases, it would be useful to have a single .zip file with all the content.

Expand on the build process to download all published dependencies along with module and create one package you can simply import and run on-demand even on external systems (provided those have PowerShell 5.1 and RSAT.

DNS entries in _msdcs zone point to all DCs

AsynchronousCredits should have the recommended value

Title:
AsynchronousCredits should have the recommended value

Severity
Warning

Date:
31.05.2018 22:33:35

Category:
Configuration

Problem:
AsynchronousCredits doesn't have the recommended value on this server.

Impact:
SMB not in a default configuration, which could lead to less than optimal behavior.

Resolution
Set AsynchronousCredits to the recommended value, 64.

http://go.microsoft.com/fwlink/?LinkId=246899

AdminSDHolder protection being rolled due to SDPROP

Cross-Forest Keberberos delegation

https://concurrency.com/blog/april-2019/changes-to-cross-forest-kerberos-delegation .
https://support.microsoft.com/en-us/help/4490425/updates-to-tgt-delegation-across-incoming-trusts-in-windows-server

Verify at least one DHCP is authorized in domain

0ADEL - Orphaned fSMORoleOwner entry for DomainDnsZones

Portable - Modules do not import correctly

Running .\Testimo.ps1 did not load all of the Modules.

To resolve this issue I had to run from the directory with the files:

Get-ChildItem -Recurse *.psm1 | ForEach-Object {import-module $_.FullName}

Then import this one manually: Import-Module .\PSWriteColor.psd

Then run this again:
Get-ChildItem -Recurse *.psm1 | sort-object -Descending | ForEach-Object {import-module $_.FullName}

Then I could run:
Invoke-Testimo -ReturnResults

Group / User naming convention

Non canonical ACEs on ACLs checks

Validating all four LDAP ports.

Spooler Service

Spooler Service is STOPPED [Fail]
Spooler Service START TYPE is DISABLED [Fail]

These should be Pass or Informative. Disabling the print spooler on a DC is for hardening purposes.

Check for existance of a command before running tests

if (Get-Command 'repadmin') {
	Do-Test 1
	Do-Test 2
	Do-Test 3
	Do-Test 4
	Do-Test 5
	Do-Test 6
	}
else {
	Write-Error -Message "Can't find repadmin, tests 1-6 for replication status are skipped"
	}

ShowErrorsOnly / Quiet switches

All OUs in this domain should be protected from accidental deletion

Title:
All OUs in this domain should be protected from accidental deletion

Severity
Warning

Date:
31.05.2018 22:33:26

Category:
Configuration

Problem:
Some organizational units (OUs) in this domain are not protected from accidental deletion.

Impact:
If all OUs in your Active Directory domains are not protected from accidental deletion, your Active Directory environment can experience disruptions that might be caused by accidental bulk deletion of objects.

Resolution
Make sure that all OUs in this domain are protected from accidental deletion.

http://go.microsoft.com/fwlink/?LinkId=142204

Group / Users naming problems

Utilizations of SIDHistory, shadow principals, etc.

Smb2CreditsMin should have the recommended value

Title:
Smb2CreditsMin should have the recommended value

Severity
Warning

Date:
31.05.2018 22:33:35

Category:
Configuration

Problem:
Smb2CreditsMin doesn't have the recommended value on this server.

Impact:
SMB not in a default configuration, which could lead to less than optimal behavior.

Resolution
Set Smb2CreditsMin to the recommended value, 128.

http://go.microsoft.com/fwlink/?LinkId=246941

Well-Known SID alterations for various object types, sensitive membership counts, changes generating event codes to these.

SPN consistency (Duplicate SPN)

setspn.exe -X

Smb2CreditsMax should have the recommended value

Title:
Smb2CreditsMax should have the recommended value

Severity
Warning

Date:
31.05.2018 22:33:35

Category:
Configuration

Problem:
Smb2CreditsMax doesn't have the recommended value on this server.

Impact:
SMB not in a default configuration, which could lead to less than optimal behavior.

Resolution
Set Smb2CreditsMax to the recommended value, 2048.

http://go.microsoft.com/fwlink/?LinkId=246940

Save results to EventLog for other monitoring software to pick it up

Get-TimeSetttings ignore Policies Entries

Good Day,
First great job on the tool. It helped us identify some things we need to look at in our environment.
2 Comments about the Time settings check.

The Get-TimeSetttings command seems to ignore entries in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\W32time
We use a group policy with WMI filter for PDC to configure our NTP time server, but report does not pick up the changed values.

2nd is the TimeSynchronizationExternal check always checks pool.ntp.org which may be blocked by environments that don't allow internet access from their DCs. This is probably a more local config issue.

Verify Privileged Users permissions are set to defaults

DNS Reverse Lookup zones are configured for all site subnets

Taking various DCDIAG reports and checking for bad results.

Is Global Catalog

Some of the common global catalog usage scenarios are as follows:

Forest-wide searches
User logon
Universal group membership caching
Exchange address book lookups

Orphaned SID checks

Time Settings [Fail] [Index operation failed; the array index evaluated to null.]

When running the Time Settings tests against the primary DC in our domain I get the error message:

Time Settings [Fail] [Index operation failed; the array index evaluated to null.]

I found that, under the covers, the command "Get-PSRegistry -ComputerName $_ -RegistryPath "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" is being executed, which, in my case produces the following output:

ServiceDllUnloadOnStop : 1
ServiceMain : SvchostEntry_W32Time
NtpServer : 0.us.pool.ntp.org 1.us.pool.ntp.org 2.us.pool.ntp.org 3.us.pool.ntp.org
Type : NTP
ServiceDll : C:\Windows\system32\w32time.dll
ComputerName : dc1

In reviewing the PS code, I'm not sure what the intention is by splitting the $TimeParameters.NtpServer list into the $NtpServers array, and then iterating over that array to split it again? In my case, this definitely doesn't work, and it seems there should be a check of the $NtpServers list before attempting the latter operation.

Any help would be greatly appreciated!
Thanks

DurableHandleV2TimeoutInSeconds should have the recommended value

Title:
DurableHandleV2TimeoutInSeconds should have the recommended value

Severity
Warning

Date:
31.05.2018 22:33:35

Category:
Configuration

Problem:
DurableHandleV2TimeoutInSeconds doesn't have the recommended value on this server.

Impact:
SMB not in a default configuration, which could lead to less than optimal behavior.

Resolution
Set DurableHandleV2TimeoutInSeconds to the recommended value, 30.

http://go.microsoft.com/fwlink/?LinkId=246908

Replay and other automated attack detections.

Bitlocker allows storing recovery key in AD should be [Configured]

AutoDisconnectTimeout should have the recommended value

Title:
AutoDisconnectTimeout should have the recommended value

Severity
Warning

Date:
31.05.2018 22:33:35

Category:
Configuration

Problem:
AutoDisconnectTimeout doesn't have the recommended value on this server.

Impact:
SMB not in a default configuration, which could lead to less than optimal behavior.

Resolution
Set AutoDisconnectTimeout to the recommended value, 0.

http://go.microsoft.com/fwlink/?LinkId=246907

PKI container changes, system center changes, exchange changes, etc. General system container health.

CachedOpenLimit should have the recommended value

Title:
CachedOpenLimit should have the recommended value

Severity
Warning

Date:
31.05.2018 22:33:35

Category:
Configuration

Problem:
CachedOpenLimit doesn't have the recommended value on this server.

Impact:
SMB not in a default configuration, which could lead to less than optimal behavior.

Resolution
Set CachedOpenLimit to the recommended value, 5.

http://go.microsoft.com/fwlink/?LinkId=246902

More charts with Summary

Something similar to this on summary page

Loading configuration from a path to a json doesn't work

When loading a configuration file, as a path, it will always give the same error:
> Invoke-Testimo -Configuration "C:\Temp\testmio.json" [t][Forest] Loading configuratio failed. Skipping. [Informative] [Not JSON/Hashtable or syntax is incorrect.] [t][Forest] Using configuration provided by user [Informative] [Configuration loaded from ]

This is because in the "Import-TestimoConfiguration" function you reference to "$Object" two times where it should be "$Configuration":

} elseif ($Object -is [string]) { if (Test-Path -LiteralPath $Object) { $Option = 'File' $FileContent = Get-Content -LiteralPath $Configuration }

Should be:

} elseif ($Configuration-is [string]) { if (Test-Path -LiteralPath $Configuration) { $Option = 'File' $FileContent = Get-Content -LiteralPath $Configuration }

Potentially overly extended inheritance, inheritance of "all" versus specific objects where appropriate.

DNS: DNS servers on Ethernet should include the loopback address, but not as the first entry

Title:
DNS: DNS servers on Ethernet should include the loopback address, but not as the first entry.

Severity
Error

Date:
31.05.2018 22:33:13

Category:
Configuration

Problem:
The network adapter Ethernet does not list the local server as a DNS server; or it is configured as the first DNS server on this adapter.

Impact:
If the loopback IP address is the first entry in the list of DNS servers, Active Directory might be unable to find its replication partners.

Resolution
Configure adapter settings to add the loopback IP address to the list of DNS servers on all active interfaces, but not as the first server in the list.

http://go.microsoft.com/fwlink/?LinkId=188760

Disabling Print Spooler not recommended

According to MS, it's not recommended to disable Print Spooler on a DC because this is responsible for removing stale printer objects from AD.

https://docs.microsoft.com/en-us/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#print-spooler

The technet article in the Comments of that page doesn't exist anymore but it can be found via wayback machine.

Looks like you should have it enabled on at least 1 DC in each site.

Looking for duplicate replications on forest and domain zones.

Short file name creation should be disabled

Title:
Short file name creation should be disabled

Severity
Warning

Date:
31.05.2018 22:33:35

Category:
Configuration

Problem:
In addition to the normal file names, the server is creating short, eight-character file names with a three-character file extension (8.3 file names) for all files.

Impact:
Creating short file names in addition to the normal, long file names can significantly decrease file server performance.

Resolution
Disable short file name creation unless short file names are required by legacy applications.

http://go.microsoft.com/fwlink/?LinkId=165013

Checking port 139 on a domain controller

Per the documentation, one of the tests is checking port 139 on a domain controller. That's NetBIOS session port. NetBIOS over TCP/IP is severely outdated and presence of the open port indicates likely misconfiguration.

Proposing to remove check for this port from a positive test. Consider converting to negative/misconfiguration indicator. I can prepare PR if needed.

AdminCount orphans.

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.

evotecit / testimo Goto Github PK

testimo's Introduction

Testimo - PowerShell Module

Known Issues / By Design

Installation

Updates

Usage

Using Invoke-Testimo with non-default configuration

Changing default configuration

Straight to FILE/JSON

Straight to JSON

Output to Hashtable so you can edit it freely and keep in ps1

Comments

Things to consider

Dependencies

Portability

Removal

Option 1

Option 2

testimo's People

Contributors

Stargazers

Watchers

Forkers

testimo's Issues

Recommend Projects

Recommend Topics

Recommend Org