Hey PowerShell… Text me if my Domain Admins Group changes

This is why I Love PowerShell… It’s simple, yet functional.

From an Administrative perspective, I think we can all agree that any changes in your Domain Admins group without your knowledge would be of interest to you. If you’re in a large organization with access to enterprise management tools you probably have some widget that fires off a message to you or a group of people in the event a change is detected… or maybe you don’t.

If you’re an admin at a small business and maybe even some medium sized businesses, you may not have access to those enterprise management tools and widgets. Turns out, we can use PowerShell to monitor any group for us and notify us when a change occurs. It’s actually pretty simple.

You can even have PowerShell send you a text message… which is pretty cool.

I’m using the script to keep an eye on my Domain Admins Group but you could easily adapt it to monitor services or processes. You might want to monitor your Exchange Servers Transport service, if it stops for whatever reason send me an email and text message.

First, we must get all the members of the Domain Admins Group and export to an xml file.

This is the script we’ll run on a schedule.

These are the Action arguments for the scheduled task.
-NoLogo -NonInteractive -WindowStyle Hidden -NoProfile -Executionpolicy bypass -file ‘C:\scripts\AD_Audit.ps1’

PowerShell Desired State Configuration (DSC) How-To for Beginners (Push Model)

In this video, I cover only a few very basic PowerShell Desired State Configuration Manager (DSC) concepts.
1. The terminology
2. How to create a Local Configuration Manager (LCM) configuration
3. How to push the LCM configuration to the target node
4. How to create a basic DSC configuration to maintain the MSExchangeTransport service in a running state.
5. How to push the DSC configuration to the target.
And
6. How to detect and correct drift from the desired configuration state.
Using the Push model of DSC is good for organizations that don’t have access to server resources to install the DSC feature on a server. It’s also good for administrators that don’t have access to enterprise management tools such as the use of Group Policy or SCCM among many others.
The next video will cover standing up a DSC Pull Server and making the process a little more dynamic.

Enjoy!

 

Create an HTML report of Active Directory Forest Information with PowerShell

The intent of this script is to quickly get some basic information about an Active Directory infrastructure. I have used it when I’m doing some work on an environment I’m not familiar with, it gives you a quick look at what you’re dealing with without a whole lot of effort. I originally used Zachary Loeber’s script that you can find in the Microsoft Script Center (https://gallery.technet.microsoft.com/office/Active-Directory-Audit-7754a877). His script is much more detailed and gives you a lot more information that mine does, it was just overkill for what I needed.

NOTE: I tested this code exclusively on a domain with Windows Server 2012 R2 and Windows Server 2016 Domain Controllers with PowerShell V5 and V5.1

All I’ve done here is take the basic concepts behind Zachary’s script and simplified it a bit. My script will display the following information:

  • Forest Information
    • Forest Root Domain
    • Forest Functional Level
    • Domains in the forest
    • AD Recycle BIN status
  • Domain Information
    • Domain Functional Level
    • NETBIOS name
  • FSMO Roles
    • Domain Naming Master
    • Schema Master
    • PDC Emulator
    • RID Maste
    • Infrastructure Master
  • Domain Controller Information
    • Domain
    • Forest
    • Computer Name
    • IP Address
    • Global Catalog
    • Read Only
    • Operating System
    • Operating System Version
    • Site
  • DNS Information
    • Primary Zones
    • NS Records
    • MX Records
    • Forwards
    • Scavenging Enabled
    • Aging Enabled
  • DHCP Information
    • Computer Name
    • IP Address
  • Site Information
    • Site Names
    • Intersite Links
    • Name
    • Site Included
    • Site Cost
    • Site Replication Frequency
  • GPO Information
    • Domain Name
    • Display Name
    • Creation Time
    • Modification Time
  • Privileged Account Information
    • Enterprise Admin Group Members
    • Domain Admin Group Members
    • Schema Admin Group Members
    • Accounts that Passwords Never Expire
  • Exchange Information
    • Organization Management Group Members
    • Exchange Server

Feel free to take the code and make it your own.

<#

.DESCRIPTION
	*** THIS SCRIPT IS PROVIDED WITHOUT WARRANTY, USE AT YOUR OWN RISK ***
    
    Forest Information
        - Forest Root Domain
        - Forest Functional Level
        - Domains in the forest
        - AD Recycle BIN status
    Domain Information
        - Domain Functional Level
        - NETBIOS name
    FSMO Roles
        - Domain Naming Master
        - Schema Master
        - PDC Emulator
        - RID Master
        - Infrastructure Master
    Domain Controller Information
        - Domain
        - Forest
        - Computer Name
        - IP Address
        - Global Catalog
        - Read Only
        - Operating System
        - Operating System Version
        - Site
    DNS Information
        - Primary Zones
        - NS Records
        - MX Records
        - Forwards
        - Scavenging Enabled
        - Aging Enabled
    DHCP Information
        - Computer Name
        - IP Address
    Site Information
        - Site Names
        - Intersite Links
            - Name
            - Site Included
            - Site Cost
            - Site Replication Frequency
    GPO Information
        - Domain Name
        - Display Name
        - Creation Time
        - Modification Time
    Privileged Account Information
        - Enterprise Admin Group Members
        - Domain Admin Group Members
        - Schema Admin Group Members
        - Accounts that Passwords Never Expire
    Exchange Information
        - Organization Management Group Members
        - Exchange Server 

.NOTES
	File Name: Get-ForestInfo.ps1
	Author: David Hall
	Contact Info: 
		Website: www.signalwarrant.com
		Twitter: @signalwarrant
		Facebook: facebook.com/signalwarrant/
		Google +: plus.google.com/113307879414407675617
		YouTube Subscribe link: https://www.youtube.com/c/SignalWarrant1?sub_confirmation=1
	Requires: 
        Proper permissions to execute the script in the forest
        Execute the script from a Domain Controller, or the preferred
        method, on a client with the RSAT installed
	Tested: Windows Server 2012 R2, Windows Server 2016, Windows 10, PowerShell v3-5 

.PARAMETER(s)
    None
		 
.EXAMPLE
    Get-ForestInfo.ps1

Inspired by: 
    Zachary Loeber's script 
    https://gallery.technet.microsoft.com/office/Active-Directory-Audit-7754a877

#>

#region Variables

######################################
# Variables
######################################
# Get the date for the filename 
$date = (Get-Date -Format d_MMMM_yyyy).toString()
# Where to ouput the html file
$filePATH = "$env:userprofile\Desktop\"
# Define the filename
$fileNAME = 'AD_Info_' + $date + '.html'
$File = $filePATH + $fileNAME

$forestInfo = Get-ADForest
$AllDomains = (Get-ADForest).Domains
$domainInfo = Get-ADDomain
$PDCEmulator = (Get-ADDomain).PDCEmulator
$DNSRoot = $domainInfo.dnsroot
$ADsiteLinks = Get-ADReplicationSiteLink -Filter *
#endregion

#region Forest Info

######################################
# Forest Information
######################################
# Forest Root Domain  
  $RootDomain = $forestInfo.RootDomain
# Forest Functional Level
  $ForestMode = $forestInfo.ForestMode
# Forest Domains
  $Domains = ($forestInfo | 
             Select-Object -ExpandProperty Domains) -join ' | '
# AD Recycle BIN Status
$ADRecycleBIN = Get-ADOptionalFeature -filter {Name -eq 'Recycle Bin Feature'} | 
              Select-Object -ExpandProperty EnabledScopes

  If (!$ADRecycleBIN){
      $ADRecycleBIN = 'Disabled'
  } else {
      $ADRecycleBIN = 'Enabled'
  }   

# Forest Information Output Object 
$ForestOutputObj  = New-Object -TypeName PSObject
  $ForestOutputObj | Add-Member -MemberType NoteProperty -Name ForestRootDomain -Value $RootDomain
  $ForestOutputObj | Add-Member -MemberType NoteProperty -Name ForestFunctionalLevel -Value $ForestMode
  $ForestOutputObj | Add-Member -MemberType NoteProperty -Name ForestDomains -Value $Domains
  $ForestOutputObj | Add-Member -MemberType NoteProperty -Name ADRecycleBIN -Value $ADRecycleBIN
  $ForestOutputObjHTML = $ForestOutputObj | ConvertTo-Html
#endregion

#region Domain Info

######################################
# Domain Information
######################################
# Get the Domain Functional Level 
$DomainMode = ($DNSRoot | foreach { Get-ADDomain -Identity $_ }  | 
              Select-Object -ExpandProperty DomainMode) -join ' | '
# Get the Domain NetBIOS Name
$NetBIOSName = $domainInfo.netBIOSName

# Domain Information Output Object 
$DomainOutputObj  = New-Object -TypeName PSObject
  $DomainOutputObj | Add-Member -MemberType NoteProperty -Name ForestFunctionalLevel -Value $DomainMode
  $DomainOutputObj | Add-Member -MemberType NoteProperty -Name NetBIOS_Name -Value $NetBIOSName
  $DomainOutputObjHTML = $DomainOutputObj | ConvertTo-Html
#endregion

#region FSMO Info

######################################
# FSMO Role Information
######################################
# Forest FSMO Roles
$ForestFSMO = $forestInfo | Select-Object -Property DomainNamingMaster,SchemaMaster | 
              ConvertTo-Html -Fragment
# Domain FSMO Roles
$DomainFSMO = $DNSRoot | foreach { Get-ADDomain -Identity $_ }  | 
              Select-Object -Property PDCEmulator,RIDMaster,InfrastructureMaster | 
              ConvertTo-Html -Fragment
#endregion

#region DC Info

######################################
# Domain Controllers Information
######################################
# Domain Controller Information
$DCs = Get-ADDomainController -Filter * | 
        Select-Object -Property Domain,Forest,Name,IPv4Address,IsGlobalCatalog,IsReadOnly,OperatingSystem,OperatingSystemVersion,Site
$DCOutputObjHTML = $DCs | ConvertTo-Html 
#endregion

#region DNS Info

######################################
# DNS Information
######################################
# Primary Zone Information
$PrimaryZones =  (Get-DnsServerZone -ComputerName $PDCEmulator | 
              Where-Object {$_.IsReverseLookupZone -eq $False} | 
              Select-Object -ExpandProperty ZoneName) -join '<br/>'
# NS records
$NSRecords =  (Resolve-DnsName -Name $DNSRoot -type ns | 
              Where-Object {$_.QueryType -eq 'NS'} | 
              Select-Object -ExpandProperty Server) -join '<br/>'
# MX Records
$MXRecords =  (Resolve-DnsName -Name $DNSRoot -type MX | 
              Where-Object {$_.QueryType -eq 'MX'} | 
              Select-Object -ExpandProperty Exchange) -join '<br/>'
# Forwarders
$DNSForwarders = (Get-DnsServerForwarder -ComputerName $PDCEmulator | 
              Select-Object -ExpandProperty IPAddress) -join '<br/>'
# Scavenging (Returns True or False)
$DNSScavenging = (Get-DnsServerScavenging -ComputerName $PDCEmulator).scavengingState
# Aging (Returns True or False)
$DNSAging = (Get-DnsServerZoneAging -Name $DNSRoot -ComputerName $PDCEmulator).AgingEnabled
#endregion

#region DHCP Info

######################################
# DHCP Information
######################################
$DHCP = Get-WindowsFeature -name DHCP | 
        Where-Object {$_.Installed -eq $True}

If($DHCP){
  $DHCPServers =  Get-DhcpServerInDC

  $DHCPOutputObj  = New-Object -TypeName PSObject
  $DHCPOutputObj | Add-Member -MemberType NoteProperty -Name Name -Value $DHCPServers.DNSName
  $DHCPOutputObj | Add-Member -MemberType NoteProperty -Name IPAddress -Value $DHCPServers.IPAddress
  $DHCPOutputObjHTML = $DHCPOutputObj | ConvertTo-Html
} Else {
  $DHCPServers =  'No DHCP Found'
    
  $DHCPOutputObj  = New-Object -TypeName PSObject
  $DHCPOutputObj | Add-Member -MemberType NoteProperty -Name -- -Value $DHCPServers
  $DHCPOutputObjHTML = $DHCPOutputObj | ConvertTo-Html
}
#endregion

#region Site Info

######################################
# Site Information
######################################
# All Forest Sites
$Sites = ($forestInfo | 
         Select-Object -ExpandProperty Sites) -join '<br/>'

 # Inter-Site Transport
  ####### Need a foreachloop for each sites info
  $SiteLinkNames = $ADSiteLinks.Name
  $SitesInlcuded = ($ADSiteLinks | Select-Object -ExpandProperty SitesIncluded) -join ' | '
  $SiteCost = ($ADSiteLinks | Select-Object -ExpandProperty Cost) -join '<br/>'
  $SiteReplicationFreq = ($ADSiteLinks | Select-Object -ExpandProperty ReplicationFrequencyInMinutes) -join '<br/>' 
  
  # Create a custom object from the values above and convert it to an html table
  $SiteLinkObj  = New-Object -TypeName PSObject
  $SiteLinkObj | Add-Member -MemberType NoteProperty -Name SiteName -Value $SiteLinkNames
  $SiteLinkObj | Add-Member -MemberType NoteProperty -Name SitesIncluded -Value $SitesInlcuded
  $SiteLinkObj | Add-Member -MemberType NoteProperty -Name SiteCost -Value $SiteCost
  $SiteLinkObj | Add-Member -MemberType NoteProperty -Name SiteReplicationFreq -Value $SiteReplicationFreq
  $SiteLinkObjHTML = $SiteLinkObj | ConvertTo-Html
#endregion

#region GPO Info

######################################
# GPO Information
######################################
$DomainGPOs = Get-GPO -all | Select-Object -Property DomainName,DisplayName,CreationTime,ModificationTime
$GPOInfo = $DomainGPOs | ConvertTo-Html 
#endregion

#region Priviledged Account Info 

######################################
# Priviledged Account Information
######################################
# Priviledge Group Membership
  $DomainAdmins = (Get-ADGroupMember -Identity 'Domain Admins' | Select-Object -ExpandProperty SamAccountName) -join '<br/>'
  $EnterpriseAdmins = (Get-ADGroupMember -Identity 'Enterprise Admins'  | Select-Object -ExpandProperty SamAccountName) -join '<br/>'
  $SchemaAdmins = (Get-ADGroupMember -Identity 'Schema Admins'  | Select-Object -ExpandProperty SamAccountName) -join '<br/>'
#endregion

#region Exchange Info

######################################
# Exchange Information
######################################
# Get all Org Management Users
  $OrgManagement = (Get-ADGroupMember -Identity 'Organization Management' | Select-Object -ExpandProperty SamAccountName) -join '<br/>'
# Get all Exchange Servers
  $ExchangeSVRs = (Get-ADGroupMember -Identity 'Exchange Servers' | Select-Object -ExpandProperty SamAccountName) -join '<br/>'
#endregion

#region User Info

######################################
# User Information
######################################
# Users with Passwords set to never expire
  $NeverExpire = (Get-ADUser -Filter {PasswordNeverExpires -eq $true} | Select-Object -ExpandProperty SamAccountName) -join '<br/>'
#endregion

#region HTML Output

######################################
# HTML Output
######################################
$Create_HTML_doc = "<!DOCTYPE html>
  <head>
  <title>Active Directory Information</title>
  <style>

  BODY{
    font-family: Arial, Verdana;
    background-color:#D8D8D8;
  }
  TABLE{
    border=1; 
    border-color:black; 
    border-width:1px; 
    border-style:solid;
    border-collapse: collapse; 
    empty-cells:show
  }
  TH{
    font-size: 15px;
    border-width:1px; 
    padding:5px; 
    border-style:solid; 
    font-weight:bold; 
    text-align:left;
    border-color:black;
    background-color:#ffffff;
    empty-cells:show
  }
  TD{
    font-size: 12px;
    color:black; 
    colspan=1; 
    border-width:1px; 
    padding:5px; 
    font-weight:normal; 
    border-style:solid;
    border-color:black;
    background-color:#ffffff;
    vertical-align: top;
    empty-cells:show
  }
  h1{
    font-size: 35px;
  }
  h2{
    font-size: 30px;
    text-decoration: underline;
    
  }
  h3{
    font-size: 15px;
  }
  </style>
  </head>
  <h1> Active Directory Information for :  $DNSRoot </h1>

  <h2> Forest Information </h2> 
  $ForestOutputObjHTML
  <br/>

  <h2> Domain Information </h2> 
  $DomainOutputObjHTML
  <br/>

  <h2> FSMO Information </h2> 
  <table>
  <tr>
    <td><h3>Forest FSMO Roles</h3></td>
    <td><h3>Domain FSMO Roles</h3></td>
  </tr>
  <tr>
    <td>$ForestFSMO</td>
    <td>$DomainFSMO</td>
  </tr>
  </table>

  <h2> Domain Controller Information </h2>
  $DCOutputObjHTML
  <br/>

  <h2> DNS Information </h2>
  <table>
  <tr>
    <td><h3>Primary Zones</h3></td>
    <td><h3>NS Records</h3></td>
    <td><h3>MX Records</h3></td>
    <td><h3>Forwarders</h3></td>
    <td><h3>Scavenging Enabled?</h3></td>
    <td><h3>Aging Enabled?</h3></td>
  </tr>
  <tr>
    <td>$PrimaryZones</td>
    <td>$NSRecords</td>
    <td>$MXRecords</td>
    <td>$DNSForwarders</td>
    <td>$DNSScavenging</td>
    <td>$DNSAging</td>
  </tr>
  </table>

  <h2> DHCP Information </h2> 
  $DHCPOutputObjHTML

  <h2> AD Site Information </h2>
  <table>
  <tr>
    <td><h3>Forest Wide Sites</h3></td>
    <td><h3>Site Links</h3></td>
  </tr>
  <tr>
    <td>$Sites</td>
    <td>$SiteLinkObjHTML</td>
  </tr>
  </table>

  <h2> GPO Information </h2> 
  $GPOInfo

  <h2>Priviledged Accounts</h2>
  <table>
  <tr>
    <td><h3>Enterprise Admin Group Members</h3></td>
    <td><h3>Domain Admin Group Members</h3></td>
    <td><h3>Schema Admin Group Members</h3></td>
    <td><h3>Password Never Expire</h3></td>
  </tr>
  <tr>
    <td>$EnterpriseAdmins</td>
    <td>$DomainAdmins</td>
    <td>$SchemaAdmins</td>
    <td>$NeverExpire</td>
  </tr>
  </table>

  <h2>Exchange Information</h2>
  <table>
  <tr>
    <td><h3>Organization Management Group Members</h3></td>
    <td><h3>Exchange Servers</h3></td>
  </tr>
  <tr>
    <td>$OrgManagement</td>
    <td>$ExchangeSVRs</td>
  </tr>
  </table>
"
$Create_HTML_doc > $File
#endregion

# This is optional, it just opens the html file after the script runs
Invoke-Item -Path $File