PowerShell.com
Library » Snippet Library » Security » Slideshow

Security Slideshow

  1. ####################### 
  2.  
  3. #Appscanner V0.10 
  4. #Author Adam Liquorish 
  5.  
  6. #Creation Date 08/11/11 
  7.  
  8. #Change log: 
  9.  
  10. #    14/11/11 Removed unrequired step 
  11.  
  12. #    02/12/11 Created input choice for domain.local,cached rather than auto determine 
  13.  
  14. #    02/12/11 Added all supported filetypes for applockers ".bat",".cmd",".dll",".exe",".js",".msi",".msp","ocx",".psq",".vbs" 
  15.  
  16. #    09/12/11 Implemented try/catch to capture file not found or access denied errors for outputting files 
  17.  
  18. # 
  19.  
  20. #Syntax 
  21.  
  22. #appscanner -path <path> -user <user> -applockerpolicy <local/path> -outputpath <path> -userstatus <domain,local,cached> -logdirectory <path> 
  23.  
  24. #     
  25.  
  26. #Example 
  27.  
  28. #appscanner -path "C:\Program Files" -user "adam" -applockerpolicy "local" -outputpath "c:\temp\output.html" -userstatus "local" -logdirectory "c:\temp\" 
  29.  
  30. ####################### 
  31.  
  32.    
  33.  
  34. ######Define Parameters 
  35.  
  36. param( 
  37.  
  38. [Parameter(Mandatory=$true, 
  39.  
  40.     HelpMessage="Enter Path to be processed.")] 
  41.  
  42.     [ValidateNotNullOrEmpty()] 
  43.  
  44.     [string]$path, 
  45.  
  46. [Parameter(Mandatory=$true, 
  47.  
  48.     HelpMessage="Enter User to be processed, as either builtin\<user> or <domain>\<user>.")] 
  49.  
  50.     [ValidateNotNullOrEmpty()] 
  51.  
  52.     [string]$user=$(Read-Host -prompt "User"), 
  53.  
  54. #Uncomment when in production version. 
  55.  
  56. [Parameter(Mandatory=$true, 
  57.  
  58.     HelpMessage="Enter Applocker XML to be utilised ie c:\applocker.xml, or type local to use effective policy for workstation")] 
  59.  
  60.     [ValidateNotNullOrEmpty()] 
  61.  
  62.     [string]$applockerpolicy=$(Read-Host -prompt "Path to applocker policy xml file, or type local to use effective policy for workstation"), 
  63.  
  64. [Parameter(Mandatory=$true, 
  65.  
  66.     HelpMessage="Enter Path for ouput ie c:\Temp\output.html.")] 
  67.  
  68.     [ValidateNotNullOrEmpty()] 
  69.  
  70.     [string]$outputpath=$(Read-Host -prompt "Path for Output"), 
  71.  
  72. [Parameter(Mandatory=$true, 
  73.  
  74.     HelpMessage="Is the user a Domain/Local/Cached User.[Domain,Local,Cached]")] 
  75.  
  76.     [ValidateNotNullOrEmpty()] 
  77.  
  78.     [ValidateSet("Domain","Local","Cached")] 
  79.  
  80.     [string]$UserStatus=$(Read-Host -prompt "Is the user a Domain/Local/Cached User.[Domain,Local,Cached]"), 
  81.  
  82. [Parameter(Mandatory=$true, 
  83.  
  84.     HelpMessage="Enter Log Directory for ouput ie c:\Temp\")] 
  85.  
  86.     [ValidateNotNullOrEmpty()] 
  87.  
  88.     [string]$logdirectory=$(Read-Host -prompt "Log Directory") 
  89.  
  90. ) 
  91.  
  92. ######END DEFINE PARAMETERS    
  93.  
  94. ######Define Logger 
  95.  
  96. $logfilename="$(get-date -format yyyy-MM-dd-hh-mm-ss).txt"  
  97.  
  98. $logfile=$logdirectory+$logfilename 
  99.  
  100. if ($host.name -match 'ise') 
  101.  
  102. { 
  103.  
  104.     write-host "Warning: Running in Windows Powershell ISE, Transcript logging will not be running" -foregroundcolor red 
  105.  
  106.     $null 
  107.  
  108. } 
  109.  
  110. else 
  111.  
  112. { 
  113.  
  114.     write-host "Running in Powershell Console, Transcript logging will now start" -foregroundcolor blue 
  115.  
  116.     try{ 
  117.  
  118.         start-transcript -path $logfile 
  119.  
  120.     } 
  121.  
  122.     #catch for if path not found 
  123.  
  124.     catch [System.IO.DirectoryNotFoundException]{ 
  125.  
  126.         write-host "Critical: Parent Path to save $logfile not found." -foregroundcolor red 
  127.  
  128.         read-host "Press enter to exit" 
  129.  
  130.     } 
  131.  
  132.     #catch for path access denied 
  133.  
  134.     catch [System.Management.Automation.RuntimeException]{ 
  135.  
  136.         write-host "Critical: Write access to $logfile is denied unable to save log file." -foregroundcolor red 
  137.  
  138.         read-host "Press enter key to exit" 
  139.  
  140.     } 
  141.  
  142. } 
  143.  
  144. ###### END Logger 
  145.  
  146. ######Define Variables 
  147.  
  148. $ticksymbol=[char]10004 
  149.  
  150. $errorsymbol=[char]10008 
  151.  
  152. $asterisksymbol=[char]10033 
  153.  
  154. $dict=@{} 
  155.  
  156. $t=$null 
  157.  
  158. $hashtable=$null 
  159.  
  160. $u=$null 
  161.  
  162. $Pathvalid=test-path $path 
  163.  
  164. $Pathvalidpolicy=test-path $applockerpolicy 
  165.  
  166. $direct=$null 
  167.  
  168. $inherited=$null 
  169.  
  170.  
  171.  
  172. ######END DEFINE VARIABLEs 
  173.  
  174.  
  175.  
  176. ######Define HTML Output 
  177.  
  178. $a="<style>" 
  179.  
  180. $a=$a +"TABLE{border-width: 1px;border-style: solid;border-color: black;border-collapse: collapse;}" 
  181.  
  182. $a=$a +"TH{border-width: 1px;padding: 0px;border-style: solid;border-color: black;background-color:thistle}" 
  183.  
  184. $a=$a +"TD{border-width: 1px;padding: 0px;border-style: solid;border-color: black;}" 
  185.  
  186. $a=$a +"</style>" 
  187.  
  188. $header= "<h1>List of Processed Files</h1>" 
  189.  
  190. ######END DEFINE HTML OUTPUT 
  191.  
  192. ######Testing Privileges 
  193.  
  194. #$currentprincipal=new-object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()) 
  195.  
  196. #& { 
  197.  
  198. #    if ($currentprincipal.isinrole( [Security.principal.windowsbuiltinrole]::Administrator)) 
  199.  
  200. #    { 
  201.  
  202. #        write-host "$ticksymbol Running with administrative privilages" -foregroundcolor blue 
  203.  
  204. #    } 
  205.  
  206. #    else 
  207.  
  208. #    { 
  209.  
  210. #        write-host "$errorsymbol Script is currently not running with administrative privileges, please run as admin" -foregroundcolor red 
  211.  
  212. #        read-host "Press enter to exit" -foregroundcolor red 
  213.  
  214. #        exit 
  215.  
  216. #    } 
  217.  
  218. #  } 
  219.  
  220. ######END TESTING PRIV 
  221.  
  222. ######Importing Required Modules 
  223.  
  224. try 
  225.  
  226. { 
  227.  
  228.     if((get-wmiobject -cl win32_operatingsystem).version -gt "6") 
  229.  
  230.     { 
  231.  
  232.         write-host "$ticksymbol Win Vista or higher detected, Importing Applocker Module" -foregroundcolor blue 
  233.  
  234.         if((get-module -listavailable|foreach-object {$_.name}) -contains "applocker") 
  235.  
  236.         { 
  237.  
  238.             import-module applocker 
  239.  
  240.             write-host "Successfully imported applocker module" -foregroundcolor blue 
  241.  
  242.         } 
  243.  
  244.         else 
  245.  
  246.         { 
  247.  
  248.             write-host "Critical: Applocker module cannot be found try logging in as administrator" -foregroundcolor red 
  249.  
  250.             read-host "Press enter to quit" 
  251.  
  252.             exit 
  253.  
  254.         } 
  255.  
  256.     } 
  257.  
  258.     else 
  259.  
  260.     { 
  261.  
  262.         "Critical: $errorsymbol Exiting....An operating system lower that Windows Vista has been detected.  Script can only be run on Vista or higher." 
  263.  
  264.         read-host "Press Enter key to exit" 
  265.  
  266.         Exit 
  267.  
  268.     } 
  269.  
  270. } 
  271.  
  272. catch 
  273.  
  274. { 
  275.  
  276.     write-host "Critical: Error encountered loading applocker module" -foregroundcolor red 
  277.  
  278.     read-host "Press Enter key to exit" 
  279.  
  280.     Exit 
  281.  
  282. } 
  283.  
  284.  
  285.  
  286.  
  287.  
  288. ######END IMPORT MODULES 
  289.  
  290.  
  291.  
  292.  
  293.  
  294. ######MAIN 
  295.  
  296.  
  297.  
  298. if ($Pathvalid -eq "True") 
  299.  
  300. #If Path Valid 
  301.  
  302.     { 
  303.  
  304.     if ($applockerpolicy -eq "local") 
  305.  
  306.     #Output effective local applied applocker policy 
  307.  
  308.     { 
  309.  
  310.         #Determine whether an applocker policy is in effect on workstation 
  311.  
  312.         if((get-applockerpolicy -effective -xml ) -like "*Rule*") 
  313.  
  314.         { 
  315.  
  316.             write-host "$ticksymbol A valid Applocker Policy is currently applied to this workstation" -foregroundcolor blue 
  317.  
  318.             write-host "Warning: A path is required to save local applied applocker policy for usage" -foregroundcolor red 
  319.  
  320.             $applockerpolicy=read-host "Enter path, ie c:\temp\applockerpolicy.xml"  
  321.  
  322.             write-host "$asterisksymbol Effective applied Applocker Policy for this workstation has been selected, policy will be output to $applockerpolicy" -foregroundcolor blue 
  323.  
  324.             #Effective Applocker policy output 
  325.  
  326.             try{ 
  327.  
  328.                 get-applockerpolicy -effective -xml >$applockerpolicy 
  329.  
  330.             } 
  331.  
  332.             #catch for if path not found 
  333.  
  334.             catch [System.IO.DirectoryNotFoundException]{ 
  335.  
  336.                 write-host "Critical: Parent Path to save $applockerpolicy not found." -foregroundcolor red 
  337.  
  338.                 read-host "Press enter to exit" 
  339.  
  340.             } 
  341.  
  342.             #catch for path access denied 
  343.  
  344.             catch [System.Management.Automation.RuntimeException]{ 
  345.  
  346.                 write-host "Critical: Write access to $applockerpolicy is denied unable to export policy." -foregroundcolor red 
  347.  
  348.                 read-host "Press enter key to exit" 
  349.  
  350.             } 
  351.  
  352.         } 
  353.  
  354.         else 
  355.  
  356.         { 
  357.  
  358.             write-host "Critical: $errorsymbol Exiting....An applocker policy has not been applied to this workstation" -foregroundcolor red 
  359.  
  360.             read-host "Press Enter key to exit" 
  361.  
  362.             exit 
  363.  
  364.         } 
  365.  
  366.          
  367.  
  368.     } 
  369.  
  370.     elseif ($Pathvalidpolicy -eq "True") 
  371.  
  372.     { 
  373.  
  374.          write-host "$ticksymbol Valid XML file supplied for Applocker Policy" -foregroundcolor blue 
  375.  
  376.     } 
  377.  
  378.     else 
  379.  
  380.     { 
  381.  
  382.         write-host "Critical: $errorsymbol Exiting....Invalid path for applocker policy xml file, File Doesn't exist!" -foreground red 
  383.  
  384.         read-host "Press Enter key to exit" 
  385.  
  386.         exit 
  387.  
  388.     }   
  389.  
  390.     #Stage 1 Find group membership for user 
  391.  
  392.     $starttime=get-date 
  393.  
  394.     "Stage 1 of 7, Enumerating Groups User is a member of, including inherited groups" 
  395.  
  396.     #Load .Net Assembler 
  397.  
  398.     add-type -AssemblyName System.DirectoryServices.AccountManagement 
  399.  
  400.     $domain = (Get-wmiobject Win32_ComputerSystem).Domain 
  401.  
  402.     $ping=new-object system.net.networkinformation.ping 
  403.  
  404.      
  405.  
  406.     #Function for finding group membership for only local or domain not a cached user!!!  
  407.  
  408.     function groupfind   
  409.  
  410.     { 
  411.  
  412.         #Create objects to filter based on group name and ContextType--Domain or Machine 
  413.  
  414.         $principal = new-object System.DirectoryServices.AccountManagement.PrincipalContext $ctype,$domain 
  415.  
  416.         $idtype = [System.DirectoryServices.AccountManagement.IdentityType]::SamAccountName 
  417.  
  418.         $groupPrincipal = [System.DirectoryServices.AccountManagement.UserPrincipal]::FindByIdentity($principal, $idtype, $user) 
  419.  
  420.         #Recursively find what groups the user is a member of 
  421.  
  422.         #Also assigns groups found to a global variable called groupout 
  423.  
  424.         set-variable -name groupout -value $groupprincipal.GetAuthorizationGroups() -scope global 
  425.  
  426.     } 
  427.  
  428.     #END FUNCTION 
  429.  
  430.      
  431.  
  432.     #Determine if workstation is part of a domain or just local. 
  433.  
  434.     If($userstatus -eq "Domain") 
  435.  
  436.     { 
  437.  
  438.         try { 
  439.  
  440.             $domainName = [System.DirectoryServices.ActiveDirectory.Domain]::GetComputerDomain() | select -ExpandProperty Name 
  441.  
  442.             $isDomain = $domainName -match $domain 
  443.  
  444.             $domain =$domainname 
  445.  
  446.             write-host "Workstation is part of a domain" -foregroundcolor blue 
  447.  
  448.             #Determine if domain controller is contactable if not contactable treat workstation as local and use local account information 
  449.  
  450.             if ($ping.send(([System.DirectoryServices.ActiveDirectory.Domain]::GetComputerDomain()).pdcroleowner.name).status -eq "Success") 
  451.  
  452.             { 
  453.  
  454.                 $ctype = [System.DirectoryServices.AccountManagement.ContextType]::Domain 
  455.  
  456.                 write-host "Successfully contacted Domain controller, using Domain account information." -foregroundcolor blue 
  457.  
  458.                 #calls function groupfind 
  459.  
  460.                 groupfind 
  461.  
  462.             } 
  463.  
  464.             else 
  465.  
  466.             { 
  467.  
  468.                 write-host "Critical: Domain Controller not contactable!" -foregroundcolor red 
  469.  
  470.                 read-host "Press Enter key to exit" 
  471.  
  472.                 exit 
  473.  
  474.             } 
  475.  
  476.         } 
  477.  
  478.         catch { 
  479.  
  480.             write-host "Critical: Computer is not part of a domain" -foregroundcolor red 
  481.  
  482.             read-host "Press Enter key to exit" 
  483.  
  484.             exit 
  485.  
  486.         } 
  487.  
  488.     } 
  489.  
  490.     elseif($userstatus -eq "Local") 
  491.  
  492.     { 
  493.  
  494.     #Build list of local users 
  495.  
  496.     $computername="$env:computername" 
  497.  
  498.     $computer=[ADSI]"WinNT://$computername,computer" 
  499.  
  500.     $localuserlist=$computer.psbase.children|where-object {$_.psbase.schemaclassname -eq 'user'} 
  501.  
  502.     $localuserlistfilt=foreach($useritem in $localuserlist){$useritem.name} 
  503.  
  504.         #Check queried user against list to see whether user is local 
  505.  
  506.         if($localuserlistfilt -contains $user) 
  507.  
  508.         { 
  509.  
  510.             write-host "Verified user is a part of local SAM database" -foregroundcolor blue 
  511.  
  512.             $domain=(Get-wmiobject Win32_ComputerSystem).Name 
  513.  
  514.             $ctype = [System.DirectoryServices.AccountManagement.ContextType]::Machine 
  515.  
  516.             #Calls function groupfind 
  517.  
  518.             groupfind 
  519.  
  520.         } 
  521.  
  522.         else 
  523.  
  524.         { 
  525.  
  526.             write-host "Critical: User is not a local user" -foregroundcolor red 
  527.  
  528.             read-host "Press Enter key to exit" 
  529.  
  530.             exit 
  531.  
  532.         } 
  533.  
  534.     } 
  535.  
  536.     elseif($userstatus -eq "Cached") 
  537.  
  538.     { 
  539.  
  540.         try { 
  541.  
  542.         #Build list of local users 
  543.  
  544.         $computername="$env:computername" 
  545.  
  546.         $computer=[ADSI]"WinNT://$computername,computer" 
  547.  
  548.         $localuserlist=$computer.psbase.children|where-object {$_.psbase.schemaclassname -eq 'user'} 
  549.  
  550.         $localuserlistfilt=foreach($useritem in $localuserlist){$useritem.name} 
  551.  
  552.             #Check queried user against list to see whether user is local 
  553.  
  554.             if($localuserlistfilt -contains $user) 
  555.  
  556.             { 
  557.  
  558.                 write-host "Critical: User is a part of local SAM database, therefore user is not cached." -foregroundcolor red 
  559.  
  560.                 read-host "Press Enter key to exit" 
  561.  
  562.                 exit 
  563.  
  564.             } 
  565.  
  566.             else 
  567.  
  568.             { 
  569.  
  570.                 #Check queried user matches logged on user" 
  571.  
  572.                if((gwmi win32_computersystem).username -like "*$user") 
  573.  
  574.                 { 
  575.  
  576.                     write-host "Verified user is a cached user" -foregroundcolor blue 
  577.  
  578.                     $groupout=[system.security.principal.windowsidentity]::getcurrent().groups|foreach-object {$_.translate([system.security.principal.ntaccount])} 
  579.  
  580.                 } 
  581.  
  582.                 else 
  583.  
  584.                 { 
  585.  
  586.                     write-host "Critical: Logged on user doesn't match queried user, therefore User is not a cached user" -foregroundcolor red 
  587.  
  588.                     read-host "Press Enter key to exit" 
  589.  
  590.                     exit 
  591.  
  592.                 } 
  593.  
  594.             }                     
  595.  
  596.         } 
  597.  
  598.         catch { 
  599.  
  600.             write-host "Critical: User is not cached" -foregroundcolor red 
  601.  
  602.             read-host "Press Enter key to exit" 
  603.  
  604.             exit 
  605.  
  606.         } 
  607.  
  608.     } 
  609.  
  610.     else 
  611.  
  612.     { 
  613.  
  614.         write-host "Critical: Please use Local,Domain or Cached" -foregroundcolor red 
  615.  
  616.         read-host "Press Enter key to exit" 
  617.  
  618.         exit 
  619.  
  620.     } 
  621.  
  622.      
  623.  
  624.  
  625.  
  626.      
  627.  
  628.     "Stage 1 of 7, Finished Scanning Group Membership" 
  629.  
  630.     "Stage 1 of 7, Outputting Group Membership hierarchy" 
  631.  
  632.     #Add user to variable 
  633.  
  634.     $groupfilter=@($user) 
  635.  
  636.     #Filter group properties down to name string 
  637.  
  638.     $groupfilter+=foreach($groupname in $groupout){$groupname.name} 
  639.  
  640.     #Determine direct membership 
  641.  
  642.     $domaincut=$domain -match "\w+[A-Za-z0-9-]+" 
  643.  
  644.     $domaincutvalue=$matches.values 
  645.  
  646.     $query="ASSOCIATORS OF {Win32_Account.Name='$user',Domain='$domaincutvalue'} WHERE ResultRole=GroupComponent ResultClass=Win32_Account" 
  647.  
  648.     $directmembership=get-wmiobject -query $query 
  649.  
  650.     $directmembershipresults=foreach($directmember in $directmembership){$directmember.name} 
  651.  
  652.     $directmembershipresultsfiltered=$directmembershipresults|select-object -unique 
  653.  
  654.      
  655.  
  656.     "#####################################################" 
  657.  
  658.     write-host "#Green is for the username," -foregroundcolor darkgreen -nonewline; write-host "Red is for direct group membership," -foregroundcolor red -nonewline; write-host "Blue is for the inherited group membership" -foregroundcolor blue 
  659.  
  660.     "#User $user group structure looks like the following;" 
  661.  
  662.     foreach ($group in $groupfilter){ 
  663.  
  664.         if($directmembershipresultsfiltered -contains $group){ 
  665.  
  666.             $direct+=@($group)} 
  667.  
  668.         elseif($group -eq $user){ 
  669.  
  670.             $null} 
  671.  
  672.         else{$inherited+=@($group)} 
  673.  
  674.       } 
  675.  
  676.     #Display user 
  677.  
  678.     write-host "-$user" -foregroundcolor darkgreen 
  679.  
  680.     #Display direct membership 
  681.  
  682.     foreach($member in $direct){ 
  683.  
  684.         write-host "->$member" -foregroundcolor red 
  685.  
  686.         } 
  687.  
  688.     foreach($member in $inherited){ 
  689.  
  690.         write-host "-->$member" -foregroundcolor blue 
  691.  
  692.         } 
  693.  
  694.     "#####################################################" 
  695.  
  696.     "Stage 1 of 7 Complete" 
  697.  
  698.     #End Stage 1 
  699.  
  700.      
  701.  
  702.     #Stage 2 Recurse found items to variable 
  703.  
  704.     $count=0 
  705.  
  706.     "Stage 2 of 7 $path is populating a variable " 
  707.  
  708.     Get-Childitem $path -recurse -outvariable objects|where-object{write-progress "Stage 2 of 7 Recursing items to variable, Examining $($_.fullname)...." "Found  $count items";"$($_.fullname)"}|foreach-object {$count++} 
  709.  
  710.     "Stage 2 of 7 $path has been populated into a variable" 
  711.  
  712.     #End Stage 2 
  713.  
  714.      
  715.  
  716.     #Stage 3 FILTERACL 
  717.  
  718.     "Stage 3 of 7 Processing ACL on files to index" 
  719.  
  720.      $max=$objects.length 
  721.  
  722.      #filter variable 
  723.  
  724.      $filteracl ={$groupfilter -like $_.IdentityReference.value.split("\")[1] -and ($_.FileSystemRights -band 131241 -or $_.FileSystemRights -band 278)} 
  725.  
  726.      #Filter and add to new property 
  727.  
  728.      foreach ($i in $objects) 
  729.  
  730.        { 
  731.  
  732.             $dict[$i.fullname]=@{user="";Permission=""}  
  733.  
  734.             $t++ 
  735.  
  736.             $i.GetAccessControl().Access |Where $filteracl|foreach {$dict.($i.Fullname).User+=($_.IdentityReference,",");$dict.($i.Fullname).Permission=$_.FileSystemRights}  
  737.  
  738.             Write-Progress -activity "Stage 3 of 7 Processing File Permissions to index" -status "$t of $max" -PercentComplete (($t/$objects.count)*100) -CurrentOperation $i.fullname  
  739.  
  740.        } 
  741.  
  742.      
  743.  
  744.     "Stage 3 of 7 Complete" 
  745.  
  746.     #END STAGE 3 
  747.  
  748.      
  749.  
  750.     #Stage 4 Remove Duplicate identities 
  751.  
  752.     "Stage 4 of 7 Removing duplicate identities" 
  753.  
  754.     #Zeroise write-progress counter 
  755.  
  756.     $t=$null 
  757.  
  758.     #Remove duplicate identities due to listing of inherited groups in ACL 
  759.  
  760.       foreach ($i in $objects) 
  761.  
  762.     { 
  763.  
  764.         $t++ 
  765.  
  766.         $identarray=$dict[$i.fullname].user;$dict[$i.fullname].user=$null;$splitidentarray=$identarray -split ",";$uniqueidentarray=$splitidentarray|sort-object -unique;$uniqueidentarray -join ","|foreach {$dict.($i.fullname).User+=($_)} 
  767.  
  768.         Write-Progress -activity "Stage 4 of 7 Removing Username/Group Duplicates" -status "$t of $max" -PercentComplete (($t/$objects.count)*100) -CurrentOperation $i.fullname  
  769.  
  770.     } 
  771.  
  772.     "Stage 4 of 7 Complete" 
  773.  
  774.     #END STAGE 4 
  775.  
  776.  
  777.  
  778.     #Stage 5 APPLOCKER 
  779.  
  780.     "Stage 5 of 7 Processing Applocker policy on files" 
  781.  
  782.     #Applocker file extensions list 
  783.  
  784.     $Applockerfileextlist=".bat",".cmd",".dll",".exe",".js",".msi",".msp","ocx",".psq",".vbs" 
  785.  
  786.     $userpol=$objects|where {$Applockerfileextlist -contains $_.Extension}|convert-path|test-applockerpolicy $applockerpolicy -User $user 
  787.  
  788.     $userobjpol = $userpol|select-object PolicyDecision,FilePath,MatchingRule 
  789.  
  790.     $userobjpolcount=0 
  791.  
  792.     $userobjpol|foreach { 
  793.  
  794.         $userobjpolcount++ 
  795.  
  796.         $dict[$_.FilePath] += @{ PolicyDecision = $_.PolicyDecision;MatchingRule= $_.MatchingRule} 
  797.  
  798.         Write-progress -activity "Stage 5 of 7 Processing AppLockers results:" -status "$userobjpolcount of $($userobjpol.count)" -PercentComplete (($userobjpolcount/$userobjpol.count)*100) -CurrentOperation $_ 
  799.  
  800.     } 
  801.  
  802.     "Stage 5 of 7 Complete" 
  803.  
  804.     #END STAGE 5 
  805.  
  806.  
  807.  
  808.     #Stage 6 
  809.  
  810.     "Stage 6 0f 7 Preparing format of results for html Report" 
  811.  
  812.     $max2=$dict.count 
  813.  
  814.     $hashtable=foreach($j in $dict.keys){ 
  815.  
  816.         $u++ 
  817.  
  818.         New-Object -TypeName PSObject -Property @{Path=$j 
  819.  
  820.         User=$dict.$j.user 
  821.  
  822.         Permission=$dict.$j.Permission 
  823.  
  824.         MatchingRule=$dict.$j.MatchingRule 
  825.  
  826.         PolicyDecision=$dict.$j.PolicyDecision 
  827.  
  828.     } 
  829.  
  830.     Write-Progress -activity "Stage 6 of 7 Processing Dictionary to properties" -status "$u of $max2" -PercentComplete (($u/$max2)*100) -CurrentOperation $_} 
  831.  
  832.     "Stage 6 of 7 Complete, $u files scanned of $max for Applocker scan" 
  833.  
  834.     #END STAGE 6 
  835.  
  836.     #####END MAIN  
  837.  
  838.     #####RESULTS 
  839.  
  840.     #OUTPUT RESULTS TO FILE 
  841.  
  842.     "Stage 7 of 7 Outputting to file $outputpath" 
  843.  
  844.     try{ 
  845.  
  846.         $hashtable|sort-object Path|ConvertTo-Html -head $header -title "ACL List" -body $a|Set-Content $outputpath 
  847.  
  848.     } 
  849.  
  850.     #catch for if path not found 
  851.  
  852.     catch [System.IO.DirectoryNotFoundException]{ 
  853.  
  854.         write-host "Critical: Parent Path to save $outputpath not found." -foregroundcolor red 
  855.  
  856.         read-host "Press enter to exit" 
  857.  
  858.     } 
  859.  
  860.     #catch for path access denied 
  861.  
  862.     catch [System.Management.Automation.RuntimeException]{ 
  863.  
  864.         write-host "Critical: Write access to $outputpath is denied unable to export results." -foregroundcolor red 
  865.  
  866.         read-host "Press enter key to exit" 
  867.  
  868.     } 
  869.  
  870.     #Display results 
  871.  
  872.     $endtime=get-date 
  873.  
  874.     $totaltime=$endtime-$starttime 
  875.  
  876.     $totaltimehours=$totaltime.hours 
  877.  
  878.     $totaltimeminutes=$totaltime.minutes 
  879.  
  880.     $outputsize=get-item "$outputpath"|foreach {echo($_.length/1mb).tostring("0.00 MB")} 
  881.  
  882.     "Stage 7 of 7, Scanned $max files of $path is complete in $totaltimehours hours and $totaltimeminutes minutes, $outputpath is $outputsize." 
  883.  
  884.     #####END RESULTS 
  885.  
  886.     #####Zeroise variables and unrequired files 
  887.  
  888.     #Stop Logging 
  889.  
  890.     if ($host.name -match 'ise') 
  891.  
  892.     { 
  893.  
  894.         $null 
  895.  
  896.     } 
  897.  
  898.     else 
  899.  
  900.     { 
  901.  
  902.         "Running Log output to $logfile" 
  903.  
  904.         stop-transcript >$null 
  905.  
  906.     } 
  907.  
  908.     #Prompt delete applocker policy 
  909.  
  910.     $delete=read-host -prompt "Would you like the Applocker policy file $applockerpolicy deleted,YES/NO" 
  911.  
  912.     if($delete -eq "yes") 
  913.  
  914.     { 
  915.  
  916.         del $applockerpolicy 
  917.  
  918.     } 
  919.  
  920.     else 
  921.  
  922.     { 
  923.  
  924.         write-host "Warning: $asterisksymbol You chose not to delete file $applockerpolicy, Application will now exit....." -foregroundcolor red 
  925.  
  926.         read-host "Press Enter key to exit" 
  927.  
  928.     } 
  929.  
  930. } 
  931.  
  932.      
  933.  
  934. #If Path invalid 
  935.  
  936. else 
  937.  
  938. { 
  939.  
  940.     write-host "Critical: $errorsymbol Exiting...Invalid path supplied for processing" -foregroundcolor red 
  941.  
  942.     read-host "Press Enter key to exit" 
  943.  
  944.     exit 
  945.  
  946. } 
 
Loading...
View all files
Concentrated Tech NSoftware Dell Compellent Sponsored by Idera and Concentrated Tech and NSoftware and Dell Compellent
Copyright 2011 PowerShell.com. All rights reserved.