forked from michalkoczwara/aggressor_scripts_collection
-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy pathInvoke-DACheck.ps1
86 lines (78 loc) · 2.44 KB
/
Invoke-DACheck.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
function Invoke-DACheck {
<#
.SYNOPSIS
Checks to see if current user is in DA Groups and if he is returns a specfic string alerting user that they are DA for Automated purposes.
.PARAMETER Initial
Enables a share Anyone can Read/Write to.
#>
[cmdletbinding()]
param(
[Parameter(Position=0,ValueFromPipeline=$true)]
[String[]]
$Initial
)
process {
$User = Get-User
$DomainAdmins = Get-DomainAdmins
foreach($DomainUser in $DomainAdmins)
{
if($User -eq $DomainUser)
{
If($Initial)
{
write-output "[!] Found-DA-User: $User"
}
Else
{
write-output "[!] Currently DA Context"
}
}
}
}
}
function Get-DomainAdmins {
<#
.SYNOPSIS
Montiotrs the current DA accounts and alerts the desired admin if a change where to take place whithin the group.
.PARAMETER CheckRate
Pass me a command in a Variable.
.PARAMETER EmailAdress
Pass me a command in a Variable.
#>
[CmdletBinding()]
param(
[Parameter(ValueFromPipeline=$True)]
[string]$Command
)
process
{
$Ver = $PSVersionTable.PSVersion
If ($Ver.Major -gt 4)
{
$DAobj = Get-ADGroupMember -Identity ‘Domain Admins’
return $DAobj.name
}
Else
{
$Recurse = $true
Add-Type -AssemblyName System.DirectoryServices.AccountManagement
$ct = [System.DirectoryServices.AccountManagement.ContextType]::Domain
$group=[System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity($ct,'Domain Admins')
$Obj = $group.GetMembers($Recurse) | select SamAccountName
$DAUsers = foreach($x in $group.GetMembers($Recurse)){$x.SamAccountName}
return $DAUsers
}
}
}
function Get-User {
<#
.SYNOPSIS
Montiotrs the current DA accounts and alerts the desired admin if a change where to take place whithin the group.
#>
process {
$User = [Security.Principal.WindowsIdentity]::GetCurrent().Name
$User = $User.trimstart([Environment]::UserDomainName)
$User = $User.trimstart("\")
return $User
}
}