Skip to content

Commit 519331d

Browse files
SamErdeSamErde
committed
PSSA
1 parent c76f609 commit 519331d

File tree

4 files changed

+46
-39
lines changed

4 files changed

+46
-39
lines changed

Active Directory/AD Groups/Get-GroupFspMembers.ps1 renamed to Active Directory/AD Groups/Get-GroupFspMember.ps1

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
function Get-GroupFspMembers {
1+
function Get-GroupFspMember {
22
<#
33
.SYNOPSIS
44
Check Active Directory groups for members that are foreign security principals from other domains or forests.
@@ -18,12 +18,12 @@ function Get-GroupFspMembers {
1818
$GroupsWithForeignMembers = New-Object System.Collections.Generic.List[System.Object]
1919

2020
foreach ($group in $Groups) {
21-
$FspMembers = $group.members | Where-Object { $_ -like "CN=S-1-*" -and $_ -notlike "$DomainSID*" }
21+
$FspMembers = $group.members | Where-Object { $_ -like 'CN=S-1-*' -and $_ -notlike "$DomainSID*" }
2222
if ($FspMembers.count -ne 0) {
2323
$tempgroup = New-Object -TypeName PSObject
24-
$tempgroup | Add-Member -MemberType NoteProperty -Name 'GroupDN' -Value $group.distinguishedName
25-
$tempgroup | Add-Member -MemberType NoteProperty -Name 'Description' -Value $group.Description
26-
$tempgroup | Add-Member -MemberType NoteProperty -Name 'FspMembers' -Value ($FspMembers -join (', '))
24+
$tempgroup | Add-Member -MemberType NoteProperty -Name 'GroupDN' -Value $group.distinguishedName
25+
$tempgroup | Add-Member -MemberType NoteProperty -Name 'Description' -Value $group.Description
26+
$tempgroup | Add-Member -MemberType NoteProperty -Name 'FspMembers' -Value ($FspMembers -join (', '))
2727
$GroupsWithForeignMembers.Add($tempgroup)
2828
}
2929
}

Active Directory/AD Groups/Get-UnusedGroups.ps1 renamed to Active Directory/AD Groups/Get-UnusedGroup.ps1

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
Import-Module ActiveDirectory
22

3-
function Get-UnusedGroups {
3+
function Get-UnusedGroup {
44
[CmdletBinding()]
55
Param(
66
[Parameter(Mandatory = $True)]
77
[string]$SearchBase
8-
)
8+
)
99

1010
Get-ADGroup -Filter * -Properties members, isCriticalSystemObject -SearchBase $SearchBase | Where-Object {
1111
($_.members.count -eq 0 `

‎Active Directory/AD Users/Test-IsMemberOfProtectedUsers.ps1‎

Lines changed: 31 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -47,36 +47,43 @@ function Test-IsMemberOfProtectedUsers {
4747
$User
4848
)
4949

50-
Import-Module ActiveDirectory
51-
52-
# Use the currently logged in user if none is specified
53-
# Get the user from Active Directory
54-
if (-not($User)) {
55-
# These two are different types. Fixed by referencing $CheckUser.SID later, but should fix here by using one type.
56-
$CurrentUser = ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name).Split('\')[-1]
57-
$CheckUser = Get-ADUser $CurrentUser -Properties primaryGroupID
58-
} else {
59-
$CheckUser = Get-ADUser $User -Properties primaryGroupID
50+
begin {
51+
Import-Module ActiveDirectory
6052
}
6153

62-
# Get the Protected Users group by SID instead of by its name to ensure compatibility with any locale or language.
63-
$DomainSID = (Get-ADDomain).DomainSID.Value
64-
$ProtectedUsersSID = "$DomainSID-525"
54+
process {
55+
# Use the currently logged in user if none is specified
56+
# Get the user from Active Directory
57+
if (-not($User)) {
58+
# These two are different types. Fixed by referencing $CheckUser.SID later, but should fix here by using one type.
59+
$CurrentUser = ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name).Split('\')[-1]
60+
$CheckUser = Get-ADUser $CurrentUser -Properties primaryGroupID
61+
} else {
62+
$CheckUser = Get-ADUser $User -Properties primaryGroupID
63+
}
64+
65+
# Get the Protected Users group by SID instead of by its name to ensure compatibility with any locale or language.
66+
$DomainSID = (Get-ADDomain).DomainSID.Value
67+
$ProtectedUsersSID = "$DomainSID-525"
6568

66-
# Get members of the Protected Users group for the current domain. Recuse in case groups are nested in it.
67-
$ProtectedUsers = Get-ADGroupMember -Identity $ProtectedUsersSID -Recursive | Select-Object -Unique
69+
# Get members of the Protected Users group for the current domain. Recuse in case groups are nested in it.
70+
$ProtectedUsers = Get-ADGroupMember -Identity $ProtectedUsersSID -Recursive | Select-Object -Unique
6871

69-
# Check if the current user is in the 'Protected Users' group
70-
if ($ProtectedUsers.SID.Value -contains $CheckUser.SID) {
71-
Write-Verbose "$($CheckUser.Name) ($($CheckUser.DistinguishedName)) is a member of the Protected Users group."
72-
$true
73-
} else {
74-
# Check if the user's PGID (primary group ID) is set to the Protected Users group RID (525).
75-
if ( $CheckUser.primaryGroupID -eq '525' ) {
72+
# Check if the current user is in the 'Protected Users' group
73+
if ($ProtectedUsers.SID.Value -contains $CheckUser.SID) {
74+
Write-Verbose "$($CheckUser.Name) ($($CheckUser.DistinguishedName)) is a member of the Protected Users group."
7675
$true
7776
} else {
78-
Write-Verbose "$($CheckUser.Name) ($($CheckUser.DistinguishedName)) is not a member of the Protected Users group."
79-
$false
77+
# Check if the user's PGID (primary group ID) is set to the Protected Users group RID (525).
78+
if ( $CheckUser.primaryGroupID -eq '525' ) {
79+
$true
80+
} else {
81+
Write-Verbose "$($CheckUser.Name) ($($CheckUser.DistinguishedName)) is not a member of the Protected Users group."
82+
$false
83+
}
8084
}
8185
}
86+
87+
end { }
88+
8289
}

‎Entra/Get-DSReg.ps1‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,19 @@ function Get-DSReg {
44
Convert the output of dsregcmd.exe to a PowerShell object.
55
#>
66
$DSReg = [PSCustomObject]@{}
7-
$DSRegCmdOutput = (dsregcmd /status | Select-String "(^.*?) : (.*$)").Matches.Value
7+
$DSRegCmdOutput = (dsregcmd /status | Select-String '(^.*?) : (.*$)').Matches.Value
88
foreach ($line in $DSRegCmdOutput) {
99
$Detail = $line.Split(':', 2)
10-
$DetailName = ($Detail[0]).Replace(' ','').Replace('-','').Trim()
10+
$DetailName = ($Detail[0]).Replace(' ', '').Replace('-', '').Trim()
1111
$RawValue = ($Detail[1]).Trim()
1212
switch ($RawValue) {
13-
'NO' { $CleanValue = $false }
14-
'YES' { $CleanValue = $true }
15-
'NOT SET' { $CleanValue = $null }
16-
'none' { $CleanValue = $null }
17-
Default { $CleanValue = $RawValue }
13+
'NO' { $CleanValue = $false }
14+
'YES' { $CleanValue = $true }
15+
'NOT SET' { $CleanValue = $null }
16+
'none' { $CleanValue = $null }
17+
Default { $CleanValue = $RawValue }
1818
}
19-
19+
2020
$DSReg | Add-Member -MemberType NoteProperty -Name $DetailName -Value $CleanValue
2121
}
2222

0 commit comments

Comments
 (0)