gsadmin/GPOZaurr
1
0
Fork 0
mirror of https://github.com/EvotecIT/GPOZaurr.git synced 2026-08-08 01:43:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Audit update to to advanced events

Browse Source
This commit is contained in:
Przemyslaw Klys
2020-07-30 22:55:58 +02:00
parent 8b17f9e3a2
commit f25ace130c
1 changed files with 97 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Private/ConvertTo-XMLAudit.ps1
+97 -23
View File
@@ -4,36 +4,110 @@
[PSCustomObject] $GPO,
[switch] $FullObject
)
$SettingType = @{
'0' = 'No Auditing'
'1' = 'Success'
'2' = 'Failure'
'3' = 'Success, Failure'
}
$CreateGPO = [ordered]@{
DisplayName = $GPO.DisplayName
DomainName = $GPO.DomainName
GUID = $GPO.GUID
GpoType = $GPO.GpoType
DisplayName = $GPO.DisplayName
DomainName = $GPO.DomainName
GUID = $GPO.GUID
GpoType = $GPO.GpoType
#GpoCategory = $GPOEntry.GpoCategory
#GpoSettings = $GPOEntry.GpoSettings
AuditAccountLogon = 'No auditing'
AuditAccountManage = 'No auditing'
AuditDSAccess = 'No auditing'
AuditLogonEvents = 'No auditing'
AuditObjectAccess = 'No auditing'
AuditPolicyChange = 'No auditing'
AuditPrivilegeUse = 'No auditing'
AuditProcessTracking = 'No auditing'
AuditSystemEvents = 'No auditing'
AuditAccountLogon = 'Not configured'
AuditAccountManage = 'Not configured'
AuditDSAccess = 'Not configured'
AuditLogonEvents = 'Not configured'
AuditObjectAccess = 'Not configured'
AuditPolicyChange = 'Not configured'
AuditPrivilegeUse = 'Not configured'
AuditProcessTracking = 'Not configured'
AuditSystemEvents = 'Not configured'
# Advanced Policies
AuditAccountLockout = 'Not configured'
AuditApplicationGenerated = 'Not configured'
AuditApplicationGroupManagement = 'Not configured'
AuditAuditPolicyChange = 'Not configured'
AuditAuthenticationPolicyChange = 'Not configured'
AuditAuthorizationPolicyChange = 'Not configured'
AuditCentralAccessPolicyStaging = 'Not configured'
AuditCertificationServices = 'Not configured'
AuditComputerAccountManagement = 'Not configured'
AuditCredentialValidation = 'Not configured'
AuditDetailedDirectoryServiceReplication = 'Not configured'
AuditDetailedFileShare = 'Not configured'
AuditDirectoryServiceAccess = 'Not configured'
AuditDirectoryServiceChanges = 'Not configured'
AuditDirectoryServiceReplication = 'Not configured'
AuditDistributionGroupManagement = 'Not configured'
AuditDPAPIActivity = 'Not configured'
AuditFileShare = 'Not configured'
AuditFileSystem = 'Not configured'
AuditFilteringPlatformConnection = 'Not configured'
AuditFilteringPlatformPacketDrop = 'Not configured'
AuditFilteringPlatformPolicyChange = 'Not configured'
AuditGroupMembership = 'Not configured'
AuditHandleManipulation = 'Not configured'
AuditIPsecDriver = 'Not configured'
AuditIPsecExtendedMode = 'Not configured'
AuditIPsecMainMode = 'Not configured'
AuditIPsecQuickMode = 'Not configured'
AuditKerberosAuthenticationService = 'Not configured'
AuditKerberosServiceTicketOperations = 'Not configured'
AuditKernelObject = 'Not configured'
AuditLogoff = 'Not configured'
AuditLogon = 'Not configured'
AuditMPSSVCRuleLevelPolicyChange = 'Not configured'
AuditNetworkPolicyServer = 'Not configured'
AuditNonSensitivePrivilegeUse = 'Not configured'
AuditOtherAccountLogonEvents = 'Not configured'
AuditOtherAccountManagementEvents = 'Not configured'
AuditOtherLogonLogoffEvents = 'Not configured'
AuditOtherObjectAccessEvents = 'Not configured'
AuditOtherPolicyChangeEvents = 'Not configured'
AuditOtherPrivilegeUseEvents = 'Not configured'
AuditOtherSystemEvents = 'Not configured'
AuditPNPActivity = 'Not configured'
AuditProcessCreation = 'Not configured'
AuditProcessTermination = 'Not configured'
AuditRegistry = 'Not configured'
AuditRemovableStorage = 'Not configured'
AuditRPCEvents = 'Not configured'
AuditSAM = 'Not configured'
AuditSecurityGroupManagement = 'Not configured'
AuditSecurityStateChange = 'Not configured'
AuditSecuritySystemExtension = 'Not configured'
AuditSensitivePrivilegeUse = 'Not configured'
AuditSpecialLogon = 'Not configured'
AuditSystemIntegrity = 'Not configured'
AuditUserDeviceClaims = 'Not configured'
AuditUserAccountManagement = 'Not configured'
}
foreach ($GPOEntry in $GPO.DataSet) {
$SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null };
$FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null };
if ($SuccessAttempts -and $FailureAttempts) {
$Setting = 'Success, Failure'
} elseif ($SuccessAttempts) {
$Setting = 'Success'
} elseif ($FailureAttempts) {
$Setting = 'Failure'
if ($GPOEntry.PolicyTarget) {
# Category = 'AuditSettings', Settings = 'AuditSetting'
$Category = $GPOEntry.SubcategoryName -replace ' ', '' -replace '-', '' -replace '/', ''
if ($CreateGPO["$($Category)"]) {
$CreateGPO["$($Category)"] = $SettingType["$($GPOEntry.SettingValue)"]
}
} else {
$Setting = 'No auditing'
# Category = 'SecuritySettings', Settings = 'Audit'
$SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null };
$FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null };
if ($SuccessAttempts -and $FailureAttempts) {
$Setting = 'Success, Failure'
} elseif ($SuccessAttempts) {
$Setting = 'Success'
} elseif ($FailureAttempts) {
$Setting = 'Failure'
} else {
$Setting = 'Not configured'
}
$CreateGPO["$($GPOEntry.Name)"] = $Setting
}
$CreateGPO["$($GPOEntry.Name)"] = $Setting
}
$CreateGPO['Linked'] = $GPO.Linked
$CreateGPO['LinksCount'] = $GPO.LinksCount