From f25ace130c6c402d5c0edf04a398aa94aed64c2b Mon Sep 17 00:00:00 2001 From: Przemyslaw Klys Date: Thu, 30 Jul 2020 22:55:58 +0200 Subject: [PATCH] Audit update to to advanced events --- Private/ConvertTo-XMLAudit.ps1 | 120 ++++++++++++++++++++++++++------- 1 file changed, 97 insertions(+), 23 deletions(-) diff --git a/Private/ConvertTo-XMLAudit.ps1 b/Private/ConvertTo-XMLAudit.ps1 index 6aa5734..7059495 100644 --- a/Private/ConvertTo-XMLAudit.ps1 +++ b/Private/ConvertTo-XMLAudit.ps1 @@ -4,36 +4,110 @@ [PSCustomObject] $GPO, [switch] $FullObject ) + $SettingType = @{ + '0' = 'No Auditing' + '1' = 'Success' + '2' = 'Failure' + '3' = 'Success, Failure' + } $CreateGPO = [ordered]@{ - DisplayName = $GPO.DisplayName - DomainName = $GPO.DomainName - GUID = $GPO.GUID - GpoType = $GPO.GpoType + DisplayName = $GPO.DisplayName + DomainName = $GPO.DomainName + GUID = $GPO.GUID + GpoType = $GPO.GpoType #GpoCategory = $GPOEntry.GpoCategory #GpoSettings = $GPOEntry.GpoSettings - AuditAccountLogon = 'No auditing' - AuditAccountManage = 'No auditing' - AuditDSAccess = 'No auditing' - AuditLogonEvents = 'No auditing' - AuditObjectAccess = 'No auditing' - AuditPolicyChange = 'No auditing' - AuditPrivilegeUse = 'No auditing' - AuditProcessTracking = 'No auditing' - AuditSystemEvents = 'No auditing' + AuditAccountLogon = 'Not configured' + AuditAccountManage = 'Not configured' + AuditDSAccess = 'Not configured' + AuditLogonEvents = 'Not configured' + AuditObjectAccess = 'Not configured' + AuditPolicyChange = 'Not configured' + AuditPrivilegeUse = 'Not configured' + AuditProcessTracking = 'Not configured' + AuditSystemEvents = 'Not configured' + # Advanced Policies + AuditAccountLockout = 'Not configured' + AuditApplicationGenerated = 'Not configured' + AuditApplicationGroupManagement = 'Not configured' + AuditAuditPolicyChange = 'Not configured' + AuditAuthenticationPolicyChange = 'Not configured' + AuditAuthorizationPolicyChange = 'Not configured' + AuditCentralAccessPolicyStaging = 'Not configured' + AuditCertificationServices = 'Not configured' + AuditComputerAccountManagement = 'Not configured' + AuditCredentialValidation = 'Not configured' + AuditDetailedDirectoryServiceReplication = 'Not configured' + AuditDetailedFileShare = 'Not configured' + AuditDirectoryServiceAccess = 'Not configured' + AuditDirectoryServiceChanges = 'Not configured' + AuditDirectoryServiceReplication = 'Not configured' + AuditDistributionGroupManagement = 'Not configured' + AuditDPAPIActivity = 'Not configured' + AuditFileShare = 'Not configured' + AuditFileSystem = 'Not configured' + AuditFilteringPlatformConnection = 'Not configured' + AuditFilteringPlatformPacketDrop = 'Not configured' + AuditFilteringPlatformPolicyChange = 'Not configured' + AuditGroupMembership = 'Not configured' + AuditHandleManipulation = 'Not configured' + AuditIPsecDriver = 'Not configured' + AuditIPsecExtendedMode = 'Not configured' + AuditIPsecMainMode = 'Not configured' + AuditIPsecQuickMode = 'Not configured' + AuditKerberosAuthenticationService = 'Not configured' + AuditKerberosServiceTicketOperations = 'Not configured' + AuditKernelObject = 'Not configured' + AuditLogoff = 'Not configured' + AuditLogon = 'Not configured' + AuditMPSSVCRuleLevelPolicyChange = 'Not configured' + AuditNetworkPolicyServer = 'Not configured' + AuditNonSensitivePrivilegeUse = 'Not configured' + AuditOtherAccountLogonEvents = 'Not configured' + AuditOtherAccountManagementEvents = 'Not configured' + AuditOtherLogonLogoffEvents = 'Not configured' + AuditOtherObjectAccessEvents = 'Not configured' + AuditOtherPolicyChangeEvents = 'Not configured' + AuditOtherPrivilegeUseEvents = 'Not configured' + AuditOtherSystemEvents = 'Not configured' + AuditPNPActivity = 'Not configured' + AuditProcessCreation = 'Not configured' + AuditProcessTermination = 'Not configured' + AuditRegistry = 'Not configured' + AuditRemovableStorage = 'Not configured' + AuditRPCEvents = 'Not configured' + AuditSAM = 'Not configured' + AuditSecurityGroupManagement = 'Not configured' + AuditSecurityStateChange = 'Not configured' + AuditSecuritySystemExtension = 'Not configured' + AuditSensitivePrivilegeUse = 'Not configured' + AuditSpecialLogon = 'Not configured' + AuditSystemIntegrity = 'Not configured' + AuditUserDeviceClaims = 'Not configured' + AuditUserAccountManagement = 'Not configured' } foreach ($GPOEntry in $GPO.DataSet) { - $SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null }; - $FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null }; - if ($SuccessAttempts -and $FailureAttempts) { - $Setting = 'Success, Failure' - } elseif ($SuccessAttempts) { - $Setting = 'Success' - } elseif ($FailureAttempts) { - $Setting = 'Failure' + if ($GPOEntry.PolicyTarget) { + # Category = 'AuditSettings', Settings = 'AuditSetting' + $Category = $GPOEntry.SubcategoryName -replace ' ', '' -replace '-', '' -replace '/', '' + if ($CreateGPO["$($Category)"]) { + $CreateGPO["$($Category)"] = $SettingType["$($GPOEntry.SettingValue)"] + } } else { - $Setting = 'No auditing' + # Category = 'SecuritySettings', Settings = 'Audit' + $SuccessAttempts = try { [bool]::Parse($GPOEntry.SuccessAttempts) } catch { $null }; + $FailureAttempts = try { [bool]::Parse($GPOEntry.FailureAttempts) } catch { $null }; + if ($SuccessAttempts -and $FailureAttempts) { + $Setting = 'Success, Failure' + } elseif ($SuccessAttempts) { + $Setting = 'Success' + } elseif ($FailureAttempts) { + $Setting = 'Failure' + } else { + $Setting = 'Not configured' + } + $CreateGPO["$($GPOEntry.Name)"] = $Setting } - $CreateGPO["$($GPOEntry.Name)"] = $Setting } $CreateGPO['Linked'] = $GPO.Linked $CreateGPO['LinksCount'] = $GPO.LinksCount