[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 155
  • Last Modified:

Windows Network & Server security audit tools or script ?

Hi All,

I'd like to know if there is any Powershell script or software that can be used to test what my DOMAIN\Test-Account can do given certain privilege in my AD domain ?

For example: The AD account is assigned as Local Admin account in domain joined Server A, it can access to server file share ...., Install application, shutdown / restart server, enumerate network share etc..
0
Senior IT System Engineer
Asked:
Senior IT System Engineer
1 Solution
 
btanExec ConsultantCommented:
There is a AD Permissions Reporter that illustrate the AD object (which include that account object)permission @ http://www.cjwdev.co.uk/Software/ADPermissionsReporter/Info.html

Will have suggest the SysInternal tool such as when login using that test account to attempt to run the admin tools and in a way it demonstrate how "accessible" to the resources this account  has been granted @ https://technet.microsoft.com/en-us/sysinternals/bb795534

AccessChk
This tool shows you the accesses the user or group you specify has to files, Registry keys or Windows services.

 AccessEnum
This simple yet powerful security tool shows you who has what access to directories, files and Registry keys on your systems. Use it to find holes in your permissions.

ShareEnum
Scan file shares on your network and view their security settings to close security holes.

there is also powershell script to list out the privileges
Import-Module ActiveDirectory


$Groups = Get-AdGroup -Properties * -Filter * -SearchBase "OU=group,DC=domain,DC=com" 

$Table = @() 

$Record = [ordered]@{ 

"Group Name" = "" 

"Name" = "" 

"Username" = "" 

} 

Foreach ($Group in $Groups) 

{ 

$Arrayofmembers = Get-ADGroupMember -identity $Group | select name,samaccountname 

foreach ($Member in $Arrayofmembers) 

{ 

$Record."Group Name" = $Group.name 

$Record."Name" = $Member.name 

$Record."UserName" = $Member.samaccountname 

$objRecord = New-Object PSObject -property $Record 

$Table += $objrecord 

} 

} 

$Table | export-csv "C:\temp\Groups.csv" -NoTypeInformation´╗┐

Open in new window

https://community.spiceworks.com/topic/282047-how-to-get-list-of-all-effective-rights-permissions-on-active-directory-objects?page=1#entry-5474279
0
 
Senior IT System EngineerIT ProfessionalAuthor Commented:
Thanks !
0

Featured Post

The Growing Need for Data Analysts

As the amount of data rapidly increases in our world, so does the need for qualified data analysts. WGU's MS in Data Analytics and maximize your leadership opportunities as a data engineer, business analyst, information research scientist, and more.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now