1
- <#
1
+ <#
2
2
. DESCRIPTION
3
3
Script Attempts to communicate with Active Directory and all Windows Computers in the Domain
4
4
Pull SourceIPs from all computers in the domain, compares to Local DNS Server to identify rogue devices in network.
5
5
6
- . PARAMETER NAME
7
- No Parameters, but control Functions by commenting or uncommenting Functions under $TASKS (See example Task/Function)
8
-
9
6
. OUTPUTS
10
- Report found under $logPath below, Setup Networkshare for \\SERVERNAME\SHARE\ COD-Logs\DOMAINNAME \DATETIME
7
+ Report found under $logPath below, default is c:\ COD-Logs\COMPUTERNAME \DATETIME
11
8
12
9
. EXAMPLE
13
- Option 1
14
- 1. Command Prompt (Admin) "powershell -Executionpolicy Bypass -File PATH\FILENAME.ps1"
10
+ 1. PowerShell 5.1 Command Prompt (Admin)
11
+ "powershell -Executionpolicy Bypass -File PATH\FILENAME.ps1"
12
+ 2. Powershell 7.2.1 Command Prompt (Admin)
13
+ "pwsh -Executionpolicy Bypass -File PATH\FILENAME.ps1"
15
14
16
15
. NOTES
17
- Author Perk
18
- Last Update 12/31/21
16
+ Author Perkins
17
+ Last Update 1/7/22
18
+ Updated 1/7/22 Tested and Validated PowerShell 5.1 and 7.2.1
19
19
20
- Powershell 5.1 or higher
20
+ Powershell 5 or higher
21
21
Run as Administrator
22
22
23
23
. FUNCTIONALITY
24
24
PowerShell Language
25
25
Active Directory
26
26
27
27
. Link
28
- https://github.com/COD-Team
29
- YouTube Channel with this Video https://www.youtube.com/channel/UCWtXSYvBXU6YqzqBqNcH_Kw
30
-
28
+ https://github.com/COD-Team
29
+ YouTube Video https://youtu.be/4LSMP0gj1IQ
30
+
31
31
Thanks to Twan van Beers - Across my Lab I noticed that two computers were not functioning as intented
32
32
All the firewall settings were in place, but there were no logs.
33
33
https://neroblanco.co.uk/2017/03/windows-firewall-not-writing-logfiles/
@@ -59,7 +59,10 @@ if ($env:computername -eq $env:userdomain)
59
59
}
60
60
61
61
# Get Domain Name, Creates a DomainName Folder to Store Reports
62
- $DomainName = (Get-WmiObject win32_computersystem).domain
62
+ # Added 1/7/21 Powershell 7.2.1 Compatibility Get-WmiObject not compatible with Powershell 7.2.1
63
+ # $DomainName = (Get-WmiObject win32_computersystem).domain
64
+ $DomainName = (Get-CimInstance Win32_ComputerSystem).Domain
65
+
63
66
64
67
# Get Computer Name
65
68
$ComputerName = $env: computername
@@ -74,17 +77,24 @@ $logpath = "\\DC2016\SHARES\COD-Logs\$DomainName\$(get-date -format "yyyyMMdd-hh
74
77
# Counter for Write-Progress
75
78
$Counter = 0
76
79
80
+ # Added 1/7/21 PowerShell 7.2.1 Compatibility for Out-File not printing escape characters
81
+ if ($PSVersionTable.PSVersion.major -ge 7 ) {$PSStyle.OutputRendering = ' PlainText' }
82
+
77
83
# Logfile where all the results are dumped
78
84
$OutputFile = " $logpath \Firewall.log"
79
85
86
+ $FirewallLogFile = ' C:\Windows\system32\LogFiles\Firewall\pfirewall.log'
87
+ $DNSServer = @ (' 172.16.32.201' , ' 172.16.33.31' )
88
+ # $DNSServer = "172.16.32.201"
89
+ $JobSleep = 2
90
+
80
91
# Sets Header information for the Reports
81
92
Write-Output " [INFO] Running $PSCommandPath " | Out-File - Append $OutputFile
82
93
Write-Output (Get-Date ) | Out-File - Append $OutputFile
83
94
Write-Output " POWERSHELL COD ASSESSMENT SCRIPT RESULTS" | Out-File - Append $OutputFile
84
95
Write-Output " Executed Script from $ComputerName on Domain $DomainName " | Out-File - Append $OutputFile
85
96
Write-Output " ------------------------------------------------------------------------------------------------------------------------" | Out-File - Append $OutputFile
86
97
87
-
88
98
# $DomainControllers = (Get-ADDomainController | Select-Object Name)
89
99
$DomainControllers = (Get-ADForest ).Domains | ForEach-Object {Get-ADDomain - Identity $_ | Select-Object - ExpandProperty ReplicaDirectoryServers}
90
100
@@ -140,10 +150,6 @@ $GetOnline = Invoke-command –ComputerName $DomainComputers.Name -ErrorAction S
140
150
$Online | Out-File - Append $OutputFile
141
151
}
142
152
143
- $FirewallLogFile = ' C:\Windows\system32\LogFiles\Firewall\pfirewall.log'
144
- $DNSServer = @ (' 172.16.32.201' , ' 172.16.33.31' )
145
- # $DNSServer = "172.16.32.201"
146
- $JobSleep = 2
147
153
148
154
# ##################################################################################################################################################################
149
155
Function GetFirewallLog
@@ -275,4 +281,4 @@ Foreach ($Task in $Tasks)
275
281
Add-Content - Path $OutputFile - Value (Get-Date )
276
282
Write-Host " "
277
283
Write-Host - fore green " Results saved to: $OutputFile "
278
- write-Host - fore green " Script Completed"
284
+ write-Host - fore green " Script Completed"
0 commit comments