a
This commit is contained in:
@@ -0,0 +1,875 @@
|
||||
# Common
|
||||
function ConvertTo-NTAccountUser {
|
||||
[CmdletBinding()]
|
||||
[OutputType([hashtable])]
|
||||
Param(
|
||||
[Parameter(Mandatory = $true, ValueFromPipeline = $true)]
|
||||
[string] $Name
|
||||
)
|
||||
|
||||
process {
|
||||
try {
|
||||
# Convert Domaingroups to german
|
||||
$language = Get-UICulture
|
||||
if ($language.Name -match "de-DE"){
|
||||
if ($name -eq "Enterprise Admins"){
|
||||
$name = "Organisations-Admins"
|
||||
}
|
||||
elseif ($name -eq "Domain Admins"){
|
||||
$name = "Domänen-Admins"
|
||||
}
|
||||
}
|
||||
|
||||
# Convert friendlynames to SID
|
||||
$map = @{
|
||||
"Administrators" = "S-1-5-32-544"
|
||||
"Guests" = "S-1-5-32-546"
|
||||
"Local account" = "S-1-5-113"
|
||||
"Local Service" = "S-1-5-19"
|
||||
"Network Service" = "S-1-5-20"
|
||||
"NT AUTHORITY\Authenticated Users" = "S-1-5-11"
|
||||
"Remote Desktop Users" = "S-1-5-32-555"
|
||||
"Service" = "S-1-5-6"
|
||||
"Users" = "S-1-5-32-545"
|
||||
"NT VIRTUAL MACHINE\Virtual Machines" = "S-1-5-83-0"
|
||||
}
|
||||
|
||||
if ($map.ContainsKey($name)) {
|
||||
$name = $map[$name]
|
||||
}
|
||||
|
||||
# Identity doesn't exist on when Hyper-V isn't installed
|
||||
if ($Name -eq "S-1-5-83-0" -and
|
||||
(Get-WindowsOptionalFeature -Online -FeatureName "Microsoft-Hyper-V").State -ne "Enabled") {
|
||||
return $null
|
||||
}
|
||||
|
||||
Write-Verbose "[ConvertTo-NTAccountUser] Converting identity '$Name' to NTAccount"
|
||||
if ($Name -match "^(S-[0-9-]{3,})") {
|
||||
$sidAccount = [System.Security.Principal.SecurityIdentifier]$Name
|
||||
}
|
||||
else {
|
||||
$sidAccount = ([System.Security.Principal.NTAccount]$Name).Translate([System.Security.Principal.SecurityIdentifier])
|
||||
}
|
||||
return @{
|
||||
Account = $sidAccount.Translate([System.Security.Principal.NTAccount])
|
||||
Sid = $sidAccount.Value
|
||||
}
|
||||
}
|
||||
catch {
|
||||
return @{
|
||||
Account = "Orphaned Account"
|
||||
Sid = $Name
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Tests
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-143"
|
||||
Task = "Ensure 'Manage auditing and security log' is set to 'Administrators'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeSecurityPrivilege"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-32-544"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeSecurityPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeSecurityPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-144"
|
||||
Task = "Ensure 'Restore files and directories' is set to 'Administrators'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeRestorePrivilege"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-32-544"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeRestorePrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeRestorePrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-145"
|
||||
Task = "Ensure 'Take ownership of files or other objects' is set to 'Administrators'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeTakeOwnershipPrivilege"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-32-544"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeTakeOwnershipPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeTakeOwnershipPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-146"
|
||||
Task = "Ensure 'Back up files and directories' is set to 'Administrators'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeBackupPrivilege"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-32-544"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeBackupPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeBackupPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-147"
|
||||
Task = "Ensure 'Deny log on through Remote Desktop Services' to include 'Local account'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeDenyRemoteInteractiveLogonRight"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-113"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeDenyRemoteInteractiveLogonRight' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeDenyRemoteInteractiveLogonRight' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-148"
|
||||
Task = "Ensure 'Create permanent shared objects' is set to 'No One'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeCreatePermanentPrivilege"]
|
||||
$identityAccounts = @(
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeCreatePermanentPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeCreatePermanentPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-149"
|
||||
Task = "Ensure 'Perform volume maintenance tasks' is set to 'Administrators'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeManageVolumePrivilege"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-32-544"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeManageVolumePrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeManageVolumePrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-150"
|
||||
Task = "Ensure 'Load and unload device drivers' is set to 'Administrators'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeLoadDriverPrivilege"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-32-544"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeLoadDriverPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeLoadDriverPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-151"
|
||||
Task = "Ensure 'SeLockMemoryPrivilege' is set to 'No One'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeLockMemoryPrivilege"]
|
||||
$identityAccounts = @(
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeLockMemoryPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeLockMemoryPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-152"
|
||||
Task = "Ensure 'Deny access to this computer from the network' is set to 'Local account'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeDenyNetworkLogonRight"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-113"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeDenyNetworkLogonRight' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeDenyNetworkLogonRight' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-153"
|
||||
Task = "Ensure 'Access this computer from the network' is set to 'Administrators, Remote Desktop Users'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeNetworkLogonRight"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-32-544"
|
||||
"S-1-5-32-555"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeNetworkLogonRight' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeNetworkLogonRight' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-154"
|
||||
Task = "Ensure 'Impersonate a client after authentication' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE' [IIS Role NOT installed]"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeImpersonatePrivilege"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-19"
|
||||
"S-1-5-20"
|
||||
"S-1-5-32-544"
|
||||
"S-1-5-6"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeImpersonatePrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeImpersonatePrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-155"
|
||||
Task = "Ensure 'Create a token object' is set to 'No One'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeCreateTokenPrivilege"]
|
||||
$identityAccounts = @(
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeCreateTokenPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeCreateTokenPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-156"
|
||||
Task = "Ensure 'Create global objects' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeCreateGlobalPrivilege"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-19"
|
||||
"S-1-5-20"
|
||||
"S-1-5-32-544"
|
||||
"S-1-5-6"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeCreateGlobalPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeCreateGlobalPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-157"
|
||||
Task = "Ensure 'Modify firmware environment values' is set to 'Administrators'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeSystemEnvironmentPrivilege"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-32-544"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeSystemEnvironmentPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeSystemEnvironmentPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-158"
|
||||
Task = "The Create a pagefile user right must only be assigned to the Administrators group."
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeCreatePagefilePrivilege"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-32-544"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeCreatePagefilePrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeCreatePagefilePrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-159"
|
||||
Task = "Ensure 'Allow log on locally' is set to 'Administrators, Users'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeInteractiveLogonRight"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-32-544"
|
||||
"S-1-5-32-545"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeInteractiveLogonRight' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeInteractiveLogonRight' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-160"
|
||||
Task = "Ensure 'Force shutdown from a remote system' is set to 'Administrators'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeRemoteShutdownPrivilege"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-32-544"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeRemoteShutdownPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeRemoteShutdownPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-161"
|
||||
Task = "Ensure 'Debug programs' is set to 'Administrators'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeDebugPrivilege"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-32-544"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeDebugPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeDebugPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-162"
|
||||
Task = "Ensure 'Access Credential Manager as a trusted caller' is set to 'No One'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeTrustedCredManAccessPrivilege"]
|
||||
$identityAccounts = @(
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeTrustedCredManAccessPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeTrustedCredManAccessPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-163"
|
||||
Task = "Ensure 'Profile single process' is set to 'Administrators'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeProfileSingleProcessPrivilege"]
|
||||
$identityAccounts = @(
|
||||
"S-1-5-32-544"
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeProfileSingleProcessPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeProfileSingleProcessPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-164"
|
||||
Task = "Ensure 'Act as part of the operating system' is set to 'No One'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeTcbPrivilege"]
|
||||
$identityAccounts = @(
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeTcbPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeTcbPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
[AuditTest] @{
|
||||
Id = "UserRight-165"
|
||||
Task = "Ensure 'Enable computer and user accounts to be trusted for delegation' is set to 'No One'"
|
||||
Test = {
|
||||
$securityPolicy = Get-AuditResource "WindowsSecurityPolicy"
|
||||
$currentUserRights = $securityPolicy["Privilege Rights"]["SeEnableDelegationPrivilege"]
|
||||
$identityAccounts = @(
|
||||
) | ConvertTo-NTAccountUser | Where-Object { $null -ne $_ }
|
||||
|
||||
$unexpectedUsers = $currentUserRights.Account | Where-Object { $_ -notin $identityAccounts.Account }
|
||||
$missingUsers = $identityAccounts.Account | Where-Object { $_ -notin $currentUserRights.Account }
|
||||
|
||||
if (($unexpectedUsers.Count -gt 0) -or ($missingUsers.Count -gt 0)) {
|
||||
$messages = @()
|
||||
if ($unexpectedUsers.Count -gt 0) {
|
||||
$messages += "The user right 'SeEnableDelegationPrivilege' contains following unexpected users: " + ($unexpectedUsers -join ", ")
|
||||
}
|
||||
if ($missingUsers.Count -gt 0) {
|
||||
$messages += "The user 'SeEnableDelegationPrivilege' setting does not contain the following users: " + ($missingUsers -join ", ")
|
||||
}
|
||||
$message = $messages -join [System.Environment]::NewLine
|
||||
|
||||
return @{
|
||||
Status = "False"
|
||||
Message = $message
|
||||
}
|
||||
}
|
||||
|
||||
return @{
|
||||
Status = "True"
|
||||
Message = "Compliant"
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user