ADAuditTasks

Convert-NmapXMLToCSV [-InputXml] <String> [[-AttachmentFolderPath] <String>] [<CommonParameters>]

Make sure the input Nmap XML file is properly formatted and contains the necessary information for the conversion to work correctly.

EXAMPLE 1

Convert-NmapXMLToCSV -InputXml "C:\path\to\nmap.xml" -AttachmentFolderPath "C:\path\to\output"
This example will convert the contents of "C:\path\to\nmap.xml" into a CSV file and save it in "C:\path\to\output".

Get-ADActiveUserAudit [[-Enabled] <Boolean>] [[-DaysInactive] <Int32>] [[-AttachmentFolderPath] <String>] [[-Report]] [<CommonParameters>]

Outputs to C:\temp\ADActiveUserAudit by default. For help type: help Get-ADActiveUserAudit -ShowWindow

EXAMPLE 1

Get-ADActiveUserAudit

EXAMPLE 2

Get-ADActiveUserAudit -Report -Verbose

EXAMPLE 3

Get-ADActiveUserAudit -Enabled $false -DaysInactive 30 -AttachmentFolderPath "C:\temp\MyNewFolderName" -Report -Verbose

Get-ADHostAudit [-HostType] <String> [[-DaystoConsiderAHostInactive] <Int32>] [[-Report]] [[-AttachmentFolderPath] <String>] [-Enabled <Boolean>] [<CommonParameters>]

Get-ADHostAudit [-OSType] <String> [[-DaystoConsiderAHostInactive] <Int32>] [[-Report]] [[-AttachmentFolderPath] <String>] [-Enabled <Boolean>] [<CommonParameters>]

By default, output is saved to C:\temp\ADHostAudit. For more information, type: Get-Help Get-ADHostAudit -ShowWindow

EXAMPLE 1

Get-ADHostAudit -HostType WindowsServers -Report -Verbose

EXAMPLE 2

Get-ADHostAudit -HostType WindowsWorkstations -Report -Verbose

EXAMPLE 3

Get-ADHostAudit -HostType "Non-Windows" -Report -Verbose

EXAMPLE 4

Get-ADHostAudit -OSType "2008" -DirPath "C:\Temp\" -Report -Verbose

Get-ADUserLogonAudit [-SamAccountName] <Object> [<CommonParameters>]

This function is designed to be run on the primary domain controller, but it can be run on any domain controller in the environment. It requires the Active Directory PowerShell module and appropriate permissions to read user account data. The function may take some time to complete if the Active Directory environment is large or the domain controllers are geographically distributed.

EXAMPLE 1

Get-ADUserLogonAudit -SamAccountName "jdoe"
Retrieves the most recent LastLogon timestamp for the user account with the SamAccountName
"jdoe" from all domain controllers in the Active Directory environment.

Get-ADUserPrivilegeAudit [[-AttachmentFolderPath] <String>] [[-Report]] [<CommonParameters>]

This function requires the ActiveDirectory module and the desktop version of Powershell. Import-Module ADAuditTasks -UseWindowsPowershell in powershell core.

EXAMPLE 1

Get-ADUserPrivilegeAudit -Verbose
Gets the reports as three separate objects. To instantiate variables with the objects, provide three objects on the left side of the assignment:
Example: $a,$b,$c = Get-ADUserPrivilegeAudit -Verbose
The objects will be populated with privileged groups, AD extended rights, and possible service accounts, respectively.

EXAMPLE 2

Get-ADUserPrivilegeAudit -Report -Verbose
Returns three reports to the default folder, C:\temp\ADUserPrivilegeAudit, in a single zip file.

Get-ADUserWildCardAudit [[-Enabled] <Boolean>] [[-DaysInactive] <Int32>] -WildCardIdentifier <String> [[-AttachmentFolderPath] <String>] [[-Report]] [<CommonParameters>]

This function requires the ActiveDirectory module.

EXAMPLE 1

Get-ADUserWildCardAudit -WildCardIdentifier "svc" -Report -Verbose

Get-HostTag [-PhysicalOrVirtual] <String> [-Prefix] <String> [-SystemOS] <String> [-DeviceFunction] <String> [[-HostCount] <Int32>] [<CommonParameters>]

Additional information about the function, usage tips, etc.

EXAMPLE 1

Get-HostTag -PhysicalOrVirtual Physical -Prefix "CSN" -SystemOS 'Windows Server' -DeviceFunction 'Application Server' -HostCount 5
    CSN-PWSVAPP001
    CSN-PWSVAPP002
    CSN-PWSVAPP003
    CSN-PWSVAPP004
    CSN-PWSVAPP005

Get-NetworkAudit [[-Ports] <Int32[]>] [-LocalSubnets] [[-ThrottleLimit] <Int32>] [-NoHops] [-AddService] [-Report] [-ScanOnPingFail] [-WhatIf] [-Confirm] [<CommonParameters>]

Get-NetworkAudit [[-Ports] <Int32[]>] [-Computers] <String[]> [[-ThrottleLimit] <Int32>] [-NoHops] [-AddService] [-Report] [-ScanOnPingFail] [-WhatIf] [-Confirm] [<CommonParameters>]

EXAMPLE 1

Get-NetworkAudit -Report
Generates a report of the network audit results in the C:\temp folder.

Get-QuickPing [-IPRange] <Array> [[-TTL] <Int32>] [[-BufferSize] <Int32>] [[-Count] <Int32>] [<CommonParameters>]

EXAMPLE 1

Get-QuickPing -IPRange 192.168.1.1
Performs a quick ping on the IP address 192.168.1.1 with a TTL of 128 and returns an
array of IP addresses that responded to the ping and an array of IP addresses that
failed to respond.

EXAMPLE 2

Get-QuickPing -IPRange "192.168.1.1", "192.168.1.2", "192.168.1.3"
Performs a quick ping on the IP addresses 192.168.1.1, 192.168.1.2, and 192.168.1.3 with
a TTL of 128 and returns an array of IP addresses that responded to the ping and an array
of IP addresses that failed to respond.

Get-WebCertAudit [-Url] <String[]> [<CommonParameters>]

This function requires access to the target web server over port 443 (HTTPS).

EXAMPLE 1

Get-WebCert -Url "https://www.example.com"
This example retrieves the certificate information for the web server at https://www.example.com.

Join-CSVFile [-CSVFilePaths] <String[]> [[-AttachmentFolderPath] <String>] [<CommonParameters>]

Make sure the input CSV files have the same headers and formatting for the function to work properly.

EXAMPLE 1

Join-CSVFiles -CSVFilePaths @("C:\path\to\csv1.csv", "C:\path\to\csv2.csv") -AttachmentFolderPath "C:\path\to\output.csv"

Merge-ADAuditZip [[-FilePaths] <String[]>] [[-MaxFileSize] <Int32>] [[-OutputFolder] <String>] [-OpenDirectory] [<CommonParameters>]

This function will split the output file into multiple parts if the maximum file size is exceeded. If the size exceeds the limit, a new ZIP file will be created with an incremental number added to the file name. This function may or may not work with various types of input.

EXAMPLE 1

$workstations = Get-ADHostAudit -HostType WindowsWorkstations -Report
$servers = Get-ADHostAudit -HostType WindowsServers -Report
$nonWindows = Get-ADHostAudit -HostType "Non-Windows" -Report
Merge-ADAuditZip -FilePaths $workstations, $servers, $nonWindows

EXAMPLE 2

Merge-ADAuditZip -FilePaths C:\AuditReports\Report1.csv,C:\AuditReports\Report2.csv -MaxFileSize 50MB -OutputFolder C:\MergedReports -OpenDirectory

Merge-NmapToADHostAudit -ADAuditCsv <String> -NmapCsv <String> [[-AttachmentFolderPath] <String>] [<CommonParameters>]

Make sure the input CSV files have the correct headers and formatting for the function to work properly.

EXAMPLE 1

Merge-NmapToADHostAudit -ADAuditCsv "C:\path\to\ADAudit.csv" -NmapCsv "C:\path\to\NmapAudit.csv" -AttachmentFolderPath "C:\path\to\output"

Send-AuditEmail -AttachmentFiles <String[]> [-SMTPServer <String>] [-Port <Int32>] [-UserName <String>] [-SSL] [-From <String>] [-To <String>] [-Subject <String>] [-Body <String>] [-Pass <SecureString>] [<CommonParameters>]

Send-AuditEmail -AttachmentFiles <String[]> [-SMTPServer <String>] [-Port <Int32>] [-UserName <String>] [-SSL] [-From <String>] [-To <String>] [-Subject <String>] [-Body <String>] -Function <String> -FunctionApp <String> -Token <String> -CertificateThumbprint <String> [<CommonParameters>]

EXAMPLE 1

Send-AuditEmail -SMTPServer "smtp.office365.com" -Port 587 -UserName "Username@contoso.com" `
-From "Username@contoso.com" -To "user@anothercompany.com" -Pass (Read-Host -AsSecureString) -AttachmentFiles "$(Get-ADActiveUserAudit -Report)" -SSL

EXAMPLE 2

Send-AuditEmail -SMTPServer "smtp.office365.com" -Port 587 -UserName "Username@contoso.com" `
-From "Username@contoso.com" -To "user@anothercompany.com" -AttachmentFiles "$(Get-ADActiveUserAudit -Report)" -FunctionApp "MyVaultFunctionApp" `
-Function "MyClientSpecificFunction" -Token "ABCDEF123456" -SSL

Submit-FTPUpload [[-FTPUserName] <String>] [[-Password] <SecureString>] [[-FTPHostName] <String>] [[-Protocol] <String>] [[-FTPSecure] <String>] [[-SshHostKeyFingerprint] <String[]>] [[-LocalFilePath] <String[]>] [[-RemoteFTPPath] <String>] [<CommonParameters>]

This function requires the WinSCP PowerShell module.

EXAMPLE 1

Submit-FTPUpload -FTPUserName "username" -Password $Password -FTPHostName "ftp.example.com" -Protocol "Sftp" -FTPSecure "None" -SshHostKeyFingerprint "00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff" -LocalFilePath "C:\temp\file.txt" -RemoteFTPPath "/folder"