Add six-month domain and broker monitoring

2026-09-04 16:57:34 -06:00
parent f2a40f051b
commit dcbf5e87e3
20 changed files with 998 additions and 28 deletions
@@ -0,0 +1,61 @@
+[CmdletBinding(SupportsShouldProcess)]
+param()
+
+$ErrorActionPreference = 'Stop'
+
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$principal = [Security.Principal.WindowsPrincipal]::new($identity)
+if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'Run this script from an elevated Windows PowerShell session.'
+}
+
+# Use invariant audit subcategory GUIDs so this works on English and Spanish
+# installations. Logon, logoff, and other logon/logoff events provide the
+# session identifiers required to correlate usage centrally.
+$auditSubcategories = @(
+    '{0CCE9215-69AE-11D9-BED3-505054503030}', # Logon
+    '{0CCE9216-69AE-11D9-BED3-505054503030}', # Logoff
+    '{0CCE921C-69AE-11D9-BED3-505054503030}'  # Other Logon/Logoff Events
+)
+
+if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Enable SGU session auditing and event forwarding prerequisites')) {
+    foreach ($subcategory in $auditSubcategories) {
+        & auditpol.exe /set "/subcategory:$subcategory" /success:enable /failure:enable | Out-Null
+        if ($LASTEXITCODE -ne 0) {
+            throw "auditpol failed for subcategory $subcategory with exit code $LASTEXITCODE."
+        }
+    }
+
+    # Security events are read by the Windows Event Forwarding plug-in under
+    # NETWORK SERVICE. Resolve both principals by SID for localized Windows.
+    $eventLogReadersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-573')
+    $networkServiceSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-20')
+    $members = @(Get-LocalGroupMember -SID $eventLogReadersSid -ErrorAction SilentlyContinue)
+    $eventLogReaderMembershipChanged = $false
+    if ($members.SID.Value -notcontains $networkServiceSid.Value) {
+        $networkServiceAccount = $networkServiceSid.Translate([Security.Principal.NTAccount]).Value
+        Add-LocalGroupMember -SID $eventLogReadersSid -Member $networkServiceAccount
+        $eventLogReaderMembershipChanged = $true
+    }
+
+    Set-Service WinRM -StartupType Automatic
+    if ((Get-Service WinRM).Status -ne 'Running') {
+        Start-Service WinRM
+    }
+    elseif ($eventLogReaderMembershipChanged) {
+        Restart-Service WinRM -Force
+    }
+
+    & wevtutil.exe set-log Security /maxsize:268435456 /retention:false /autobackup:false
+    if ($LASTEXITCODE -ne 0) {
+        throw "wevtutil failed to configure the local Security log with exit code $LASTEXITCODE."
+    }
+}
+
+[pscustomobject]@{
+    ComputerName = $env:COMPUTERNAME
+    WinRM = (Get-Service WinRM).Status.ToString()
+    SecurityLogMaximumBytes = (Get-WinEvent -ListLog Security).MaximumSizeInBytes
+    AuditSubcategories = $auditSubcategories
+    EventForwardingPolicy = Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager'
+}