Powershell – infiniteloop.io

Active Directory UserAccountControl Details

Posted on October 17, 2019October 17, 2019 The LooperPosted in Active Directory, Powershell

Reference: https://support.microsoft.com/en-us/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties

Server 2019 Domain Controller Replication – Unlucky Timing

Posted on April 4, 2019April 5, 2019 The LooperPosted in Active Directory, Powershell, Windows Server

Take a domain running multiple versions of Windows domain controllers across multiple AD sites and replicating just fine, add Server 2019 as a DC to the mix, and what do you get? Say it with me now “DCs mostly replicating just fine but KCC re-evaluated connections and one DC is now spamming event 1645 and […]

Domain Controller Granular Event Log Delegation

Posted on March 23, 2019March 30, 2019 The LooperPosted in Active Directory, Microsoft, Powershell

So you’ve combed through 7 year old TechNet forum posts, cursed the limitations of Event Log Readers group when trying to use Get-WinEvent, and then tried to decipher SDDL to no avail. A treatment for all those woes:

function Add-EventLogAccess {
    [cmdletbinding(supportsshouldprocess=$true)]
    param(
      [ValidateScript({Get-ADObject -ld "(samaccountname=$_)"})]
      [string]$Identity,
      [ValidateSet('Application','Security','System')]
      [string]$LogName,
      [ValidateSet('RO','RW')]
      [string]$Permission
    )

  try{
    #get original permissions in SDDL format
    $origValue = ((wevtutil.exe gl $LogName | ? {$_ -match '^channelAccess'}) -split ': ')[-1].trim()

    #create new SDDL syntax
    switch($Permission){
      'RO' {$PermissionHex = '0x1'}
      'RW' {$PermissionHex = '0x3'}
    }
    
    $ADsid = (Get-ADObject -ld "(samaccountname=$Identity)" -prop ObjectSid).ObjectSid.Value
    if($origValue -match $ADsid){write-host "$ADsid already set in SDDL, manual inspection required`nCurrent Value: $origValue" -f yellow; return}
    
    $newValue = "$origValue(A;;$PermissionHex;;;$ADsid)”
    write-host "CustomSD original value:  $origValue"
    write-host "CustomSD new value:  $newValue"
    
    $Path = "HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\$logName"
      
    if($PSCmdlet.ShouldProcess("$logname log with value $newValue","Set-ItemProperty")){
      #NOTE removing customSD allows channelaccess to return to default, verified with wevutil.exe gl $LogName
      Set-ItemProperty -Path $path -Name 'CustomSD' -Value $newValue -Type string -ErrorAction Stop -Force 

      $regACL = Get-Acl $Path
      if($regacl.Access | ? {$_.identityreference -like "*$Identity" -and $_.RegistryRights -eq 'ReadKey' -and $_.AccessControlType -eq 'Allow'}){
        write-host "`n$Identity already has ability to read $Path" -f Yellow
      }
      else{
        write-host "`nAdd $Identity permission to $path" -f Green
        $rule = New-Object System.Security.AccessControl.RegistryAccessRule($Identity,'ReadKey','ContainerInherit,ObjectInherit','None','Allow')
        $regACL.AddAccessRule($rule)
        Set-Acl -AclObject $regACL -Path $regACL.Path -ErrorAction Stop
      }
    }
  } 
  catch{
    throw $_
  }

}

Add-EventLogAccess -Identity 'MY_AD_GROUP' -LogName Security -Permission RO

function Add-EventLogAccess {

[cmdletbinding(supportsshouldprocess=$true)]

param(

[ValidateScript({Get-ADObject -ld "(samaccountname=$_)"})]

[string]$Identity,

[ValidateSet('Application','Security','System')]

[string]$LogName,

[ValidateSet('RO','RW')]

[string]$Permission

)

try{

#get original permissions in SDDL format

$origValue = ((wevtutil.exe gl $LogName | ? {$_ -match '^channelAccess'}) -split ': ')[-1].trim()

#create new SDDL syntax

switch($Permission){

'RO' {$PermissionHex = '0x1'}

'RW' {$PermissionHex = '0x3'}

}

$ADsid = (Get-ADObject -ld "(samaccountname=$Identity)" -prop ObjectSid).ObjectSid.Value

if($origValue -match $ADsid){write-host "$ADsid already set in SDDL, manual inspection required`nCurrent Value: $origValue" -f yellow; return}

$newValue = "$origValue(A;;$PermissionHex;;;$ADsid)”

write-host "CustomSD original value: $origValue"

write-host "CustomSD new value: $newValue"

$Path = "HKLM:\SYSTEM\CurrentControlSet\Services\Eventlog\$logName"

if($PSCmdlet.ShouldProcess("$logname log with value $newValue","Set-ItemProperty")){

#NOTE removing customSD allows channelaccess to return to default, verified with wevutil.exe gl $LogName

Set-ItemProperty -Path $path -Name 'CustomSD' -Value $newValue -Type string -ErrorAction Stop -Force

$regACL = Get-Acl $Path

if($regacl.Access | ? {$_.identityreference -like "*$Identity" -and $_.RegistryRights -eq 'ReadKey' -and $_.AccessControlType -eq 'Allow'}){

write-host "`n$Identity already has ability to read $Path" -f Yellow

}

else{

write-host "`nAdd $Identity permission to $path" -f Green

$rule = New-Object System.Security.AccessControl.RegistryAccessRule($Identity,'ReadKey','ContainerInherit,ObjectInherit','None','Allow')

$regACL.AddAccessRule($rule)

Set-Acl -AclObject $regACL -Path $regACL.Path -ErrorAction Stop

}

catch{

throw $_

}

Add-EventLogAccess -Identity 'MY_AD_GROUP' -LogName Security -Permission RO

The basic gist here is that the CustomSD registry value will contain your new permissions and […]

Windows 10 Remote Server Administration Tools

Posted on December 9, 2018March 30, 2019 The LooperPosted in Microsoft, Powershell

So the shiny and new Windows 10 v1809 has RSAT available as features on demand you can install simply using Add-WindowsCapability. Great! Unfortunately for me somewhere along the line my Windows 10 system, which had the 1803 RSAT tools installed, obtained standard Windows updates and the RSAT options were removed from Windows Features menu. I […]

VMware PowerCLI 10 Setup

Posted on August 9, 2018 The LooperPosted in Powershell, VMware

I found that the latest version of PowerCLI 10 ran fine in 32-bit mode but VS Code, Powershell ISE, or Powershell console in 64-bit mode were unable to load the module. I would get the following errors when trying to import the newly installed module: Could not load file or assembly ‘log4net, Version=1.2.10.0, Culture=neutral, PublicKeyToken=692fbea5521e1304’ […]

Search for Details on Installed Software with Powershell

Posted on October 7, 2017October 13, 2017 The LooperPosted in Microsoft, Powershell

Anyone that has ever queried for installed software knows that win32_Product is annoyingly slow. There are plenty of solutions out there to pull in all installed software, then filter, then act but I wanted something lightweight and could drill down to my target in a single function. The script below doesn’t validate that targetAttribute name is […]

Calculate Exchange & O365 Mailbox Size with Regex

Posted on September 7, 2017September 14, 2017 The LooperPosted in Office 365, Powershell

While Get-MailboxStatistics can quickly show total mailbox size the format is terrible and calculated on the fly resulting in something like this: I used to throw multiple split commands at it to get the byte count, and while that worked, it was ugly. I’ve been on a regex kick recently and simplified the solution a […]

Powershell Dynamic Menu from Object Array

Posted on July 19, 2017May 29, 2019 The LooperPosted in Active Directory, Powershell

Ya know what grinds my gears? Getting a CSV of employees without a unique key column – no samaccountname, UPN, email, DistinguishedName, SID – nothing. Sometimes you’ll even get supplied with a column of <firstname><space><lastname> using 3rd party information that doesn’t mesh with AD info either. Nice. The function below can be used with an […]

O365 License Discovery and Management

Posted on June 24, 2017July 5, 2017 The LooperPosted in Office 365, Powershell

If you’ve ever had the pleasure of working with the built-in O365 cmdlets for viewing and modifying licenses you’ve probably come across: Set-MsolUserLicense : Unable to assign this license because it is invalid. Use the Get-MsolAccountSku cmdlet to retrieve a list of valid licenses. In every instance I ran across this “error” it was because […]

VMware PowerCLI – Report Cisco Discovery Protocol Details

Posted on June 8, 2017June 8, 2017 The LooperPosted in Powershell, VMware

For those that have more than 10 physical NICs on your hosts you may find existing CDP scripts lack a little when trying to sort by hostname and then NIC vmnic0 vmnic1 vmnic11 vmnic12 vmnic2 . . vmnicN Nothing like a little regex and built-in padding to get everything in order. Pass a vmhost host object […]