This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
$Publishers = wevtutil ep | |
# Mååånga fel, antagligen pga. att inte eventet är dokumenterat OK hos provider | |
$ErrorActionPreference = "SilentlyContinue" # Shh sh sh | |
$AllEventData = Foreach($Publisher in $Publishers){ | |
[XML]$Events = wevtutil gp $Publisher /ge /gm:true /f:xml | |
$Events.provider.events.event | Foreach { | |
[PSCustomObject]@{ | |
event_id = $_.value |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
event_id | potential_criticality | event_summary | |
---|---|---|---|
4618 | High | A monitored security event pattern has occurred. | |
4649 | High | A replay attack was detected. May be a harmless false positive due to misconfiguration error. | |
4719 | High | System audit policy was changed. | |
4765 | High | SID History was added to an account. | |
4766 | High | An attempt to add SID History to an account failed. | |
4794 | High | An attempt was made to set the Directory Services Restore Mode. | |
4897 | High | Role separation enabled: | |
4964 | High | Special groups have been assigned to a new logon. | |
5124 | High | A security setting was updated on the OCSP Responder Service |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Function Add-OpsGenieUser { | |
[cmdletbinding()] | |
param( | |
[parameter(mandatory)] | |
[string]$UserName, | |
[parameter(mandatory)] | |
[string]$FullName, | |
[parameter(mandatory)] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
param( | |
# User = ClientId Pass = Secret | |
[parameter(Mandatory)] | |
[PSCredential]$Credential, | |
[parameter(Mandatory)] | |
$TenantName | |
[parameter(Mandatory)] | |
$GelfServer |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
$PRTGUrl = "http://prtg.contoso.com:5050/" | |
################################# | |
# Functions | |
################################# | |
function New-PRTGResult { | |
param( | |
[string]$Channel, | |
[string]$Value, | |
[string]$Float, |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<# | |
Author: Alex Asplund | |
Description: | |
Will perform a series of health checks on AD. | |
Designed to be ran on a Domain Controller as a Domain Admin | |
Uses WSMAN, LDAP, RPC etc to speak to other DomainControllers. | |
#> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Function New-AdhcResult { | |
[cmdletbinding()] | |
param( | |
# Source of the result. The computer that was tested | |
[parameter(ValueFromPipelineByPropertyName)] | |
[string]$Source = $env:COMPUTERNAME, | |
# Name of the test | |
[parameter(Mandatory,ValueFromPipelineByPropertyName)] | |
[string]$TestName, |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Class AdhcResult { | |
[string]$Source | |
[string]$TestName | |
[bool]$Pass | |
$Was | |
$ShouldBe | |
[string]$Category | |
[string]$Message | |
$Data | |
[string[]]$Tags |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<# | |
.Synopsis | |
Kopierar en användare | |
.DESCRIPTION | |
Kopierar en användare med hjälp av en hashtable för mappning av attributer. | |
Hashtable ska vara enligt format @{>SourceUserAttribute> = <New-ADUser parametername>} | |
Exempel: | |
$Hashtable = @{ | |
mail = 'EmailAddress' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<# | |
.SYNOPSIS | |
Pulls Azure Identity Risk logs and sends them to a gelf-server through TCP. | |
.DESCRIPTION | |
Pulls Azure Identity Risk logs and sends them to a gelf-server. | |
Requires the PSGelf module (Install-Module -Name PSGELF). | |
AppCredentials should be supplied as Credential object with AppID as username and AppKey as password. | |
.EXAMPLE | |
PS C:\> .\Script.ps1 -AppCredential $Credential -TenantName mytenant.onmicrosoft.com -GelfServer gelf.domain.com -GelfPort <portnumber> | |
Explanation of what the example does |
NewerOlder