-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathNew-ADAssetReport.ps1
7428 lines (6978 loc) · 617 KB
/
New-ADAssetReport.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<#
.SYNOPSIS
Creates HTML reports of an active directory forest and its domains.
Zachary Loeber
THIS CODE IS MADE AVAILABLE AS IS, WITHOUT WARRANTY OF ANY KIND. THE ENTIRE
RISK OF THE USE OR THE RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE USER.
Version 1.7 - 02/13/2014
.DESCRIPTION
Creates HTML reports of an active direcotry forest and its domains.
The following information is reported upon:
FOREST REPORT
* Forest Information
Forest Summary
- Name/Functional Level
- Domain/Site/DC/GC/Exchange/Lync/Pool counts
Forest Features
- Tombstone Lifetime
- Recycle Bin Enabled
- Lync AD Container
- Lync Version
- Exchange Version
Site Summary
- Site/Subnet/Link/Connection counts
- Sites without site connections count
- Sites without ISTG count
- Sites without subnets count
- Sites wihtout servers count
Exchange Servers
- Organization
- Administrative Group
- Name
- Roles
- Site
- Serial
- Product ID
Lync Elements
- Function (Server/Pool)
- Type (Internal/Edge/Backend/Pool)
- FQDN
Registered DHCP Servers
- Name
- Creation Date
Registered NPS Servers
- Dopmain
- Name
- Type
* Site Information
Site Summary
- Name
- Location
- Domains
- DCs
- Subnets
Site Details
- Name
- Options
- ISTG
- Links
- Bridgeheads
- Adjacencies
Site Subnets
- Subnet
- Site Name
- Location
Site Connections
- Enabled
- Options
- From
- To
Site Links
- Name
- Replication Interval
- Sites
- Change Notification Enabled
* Domain Information
Domains
- Name
- NetBIOS
- Functional Level
- Forest Root
- RIDs Issued
- RIDs Remaining
Domain Password Policies
- Name
- NetBIOS
- Lockout Threshold
- Pass History Length
- Max Pass Age
- Min Pass Age
- Min Pass Length
Domain Controllers
- Domain
- Site
- Name
- OS
- Time
- IP
- GC
- FSMO Roles
Domain Trusts
- Domain
- Trusted Domain
- Direction
- Attributes
- Trust Type
- Created
- Modified
Domain DFS Shares
- Domain
- Name
- DN
- Remote Server
Domain DFSR Shares
- Domain
- Name
- Content
- Remote Servers
Domain Integrated DNS Zones
- Domain
- Partition
- Name
- Record Count
- Created
- Changed
Domain GPOs
- Domain
- Name
- Created
- Changed
Domain Registered Printers
- Domain
- Name
- Server Name
- Share Name
- Location
- Driver Name
Domain Registered SCCM Servers
- Domain
- Name
- Site Code
- Version
- Default MP
- Device MP
Domain Registered SCCM Sites
- Domain
- Name
- Site Code
- Roaming Boundries
DOMAIN REPORT
* Domain Statistics
User Account Statistics 1
- Total User Accounts
- Enabled
- Disabled
- Locked
- Password Does Not Expire
- Password Must Change
Account Statistics (count) 2
- Password Not Required
- Dial-in Enabled
- Control Access With NPS
- Unconstrained Delegation
- Not Trusted For Delegation
- No Pre-Auth Required
- Group Statistics
Total Groups
- Built-in
- Universal Security
- Universal Distribution
- Global Security
- Global Distribution
- Domain Local Security
- Domain Local Distribution
Privileged Group Statistics
- Default Priv Group Name
- Current Group Name (if it were changed)
- Member Count
Privileged Group Membership for the following groups:
- Enterprise Admins
- Schema Admins
- Domain Admins
- Administrators
- Cert Publishers
- Account Operators
- Server Operators
- Backup Operators
- Print Operators
Account information for the prior groups:
- Logon ID
- Name
- Password Age (Days)
- Last Logon Date
- Password Does Not Expire
- Password Reversable
- Password Not Required
IMPORTANT NOTE: The script requires powershell 3.0 as well as .Net 3.5 for Linq to be
able to highlight HTML cells.
.PARAMETER ReportFormat
One of three report formats to use; HTML, Excel, and Custom. The first two are precanned options,
the last requires custom code further on in the script.
HTML - This is the default option. Saves the report locally.
Excel - This can be used to spit out all the report elements to excel, each section in its own
workbook.
Custom - You will need to supply your own mix of parameters later in the code to use this.
.PARAMETER ReportType
Which reports will you be generating?
Forest - Generate forest discovery report.
Domain - Generate per domain privileged user reports.
ForestAndDomain - Default value. Generate both reports.
.PARAMETER ExportAllUsers
When processing the domain information gathering, also export all users with normalized attributes to a CSV.
.PARAMETER ExportPrivilegedUsers
When processing the domain information gathering, also export all privileged users with normalized attributes to a CSV.
.PARAMETER ExportGraphvizDefinitionFiles
When processing the forest information gathering, also create export graphviz diagram definition files.
.PARAMETER SaveData
Save data to an xml file for later report processing.
.PARAMETER LoadData
Load data for report processing (skips information gathering).
.PARAMETER DataFile
XML file base name used for domain and forest load/save data (without a path!). This will automatically be prefixed with domain_ or forest_.
.PARAMETER PromptForInput
By default global variables are used (which can be found shortly after the parameters section).
If PromptForInput is set then the report variables will be prompted for at the console.
.EXAMPLE
Generate the HTML report using the predefined global variables and preselected html reports.
Show verbose status updates (HIGHLY RECOMMENDED!!)
.\Get-ADAssetReport.ps1 -Verbose
.EXAMPLE
Generate the Excel report, prompt for report variables. Be verbose.
.\Get-ADAssetReport.ps1 -PromptForInput -ReportFormat 'Excel' -Verbose
.EXAMPLE
Generate the HTML report, prompt for report variables.
.\Get-ADAssetReport.ps1 -PromptForInput
.EXAMPLE
Gather forest related information. Create graphviz diagram source files. Save all data collected for later report generation.
.\Get-ADAssetReport.ps1 -ReportType Forest -ExportGraphvizDefinitionFiles -SaveData
.EXAMPLE
Load previously saved xml forest data and generate the HTML report.
.\Get-ADAssetReport.ps1 -LoadData -ReportType Forest
.NOTES
Author: Zachary Loeber
Version History:
1.7 - 02/13/2014
- New save/load functionality! With a switch you can export all collected data
to xml for later report processing.
- Fixed domain user priveleged report to show lastlogontimestamp as 'never' in html
report
- Added change notification attribute to site link report section
- Small modification to Format-HTMLTable function to catch errors when processing empty tables
- Slight code clean up
- Fixed issue with domain report count of passwords set to never expire.
1.6.1 - 01/15/2014
- Removed superfluous skipdomainreport and skipforestreport paramenters
- Swapped out Colorize-Table with Format-HTMLTable. This means pretty HTML
reports on older systems where the Linq assemblies are not available.
- Minor fixes.
1.6 - 01/10/2014
- Added registered NPS devices
- Added registered DHCP devices
- Added domain registered print devices
- Added SCCM servers and sites
- Added wrapper parameters to entire script with some most used options for directly
running the script from a powershell prompt.
- Added ability to prompt for input for all major global variables.
- Fixed verbose calling for priv groups and users
- Updated lastlogontimestamp for user export normalization to show never logged in instead
of a date from the 1600's.
- Added date translation for account expiration in account normalization.
- Updated ad gathering functions to account for inability to connect to domain and silently exit.
- Slight rearrangement of report sections.
1.5 - 11/26/2013
- Added the parameter ForceAnonymous along with the code to force anonymous authentication when
sending email reports
1.4 - 11/21/2013
- Fixed site connections destiniation server output flaw
- Fixed errors occuring when subnets have no sites
- Fixed a number of other errors and bugs related to my prior addition of Get-ADPathName.
- Fixed issues where phantom domains exist in topology
1.3 - 11/14/2013
- Fixed DC count issue
- Some formatting changes
- Added detection for newer versions of exchange schemas
- Changed logic for exchange role detection for 2013 to provide accurate results
- Fixed linq issues when running on windows 2012 servers
- Stopped using builtin -split for ldap paths in favor of a custom function called Get-ADPathName
- Added function for resolving msRTCSIP-PrimaryHomeServer to the user's lync pool name in the CSV
export of all users
- More changes to the base functions (more error handling and such)
1.2 - 11/10/2013
- Added site summary section
- Fixed some code for when no subnets/sites are returned.
- Fixed site options section (I think)
- Changed 'AllowEmptyReport' Section element to saner name of 'ShowSectionEvenWithNoData'
- Commented out write-verbose statements for the report generation portions
- Added timer in the forest data collection routine (as it was taking way too long to process), found
pulling all properties in the Search-AD function was a real drag so I manually defined all the properties
to gather where needed. Should speed things up considerably.
- Fixed recycle bin detection
- Prettied up the DC report section to better show FSMO roles and GCs
- Changed the trusts attribute detection to be an enumeration instead
- Mild changes to the base report generation functions.
- Added Exchange Federations section
1.1 - 11/02/2013
- Added domain level reporting
- Added AD Integrated Zone information to forest reports
- Added GPO information to forest reports
- Fixed a ton of Powershell V2 related issues
1.0 - 10/15/2013
- Initial release of forest level report
.LINK
http://www.the-little-things.net
#>
[CmdletBinding()]
param (
[Parameter(HelpMessage='Format of report(s) to generate. Defaults to HTML.')]
[ValidateSet('HTML','Excel','Custom')]
[String]
$ReportFormat='HTML',
[Parameter(HelpMessage='Types of report(s) to generate. Defaults to ForestAndDomain.')]
[ValidateSet('Forest','Domain','ForestAndDomain','Custom')]
[String]
$ReportType='ForestAndDomain',
[Parameter(HelpMessage='CSV Export of all users.(Only applies to Domain account report)')]
[switch]
$ExportAllUsers,
[Parameter(HelpMessage='CSV Export of all priviledged users. (Only applies to Domain account report)')]
[switch]
$ExportPrivilegedUsers,
[Parameter(HelpMessage='Export graphviz definition files for diagram generation.(Only applies to Forest report)')]
[switch]
$ExportGraphvizDefinitionFiles,
[Parameter(HelpMessage='Save all gathered data.')]
[switch]
$SaveData,
[Parameter(HelpMessage='Load previously saved data.')]
[switch]
$LoadData,
[Parameter(HelpMessage='Data file used when saving or loading data.')]
[String]
$DataFile='SaveData.xml',
[Parameter(HelpMessage='Prompt for report variables.')]
[switch]
$PromptForInput
)
#region Custom Static Variables
# Forest level diagram reports can be enabled here. You can also just enable the source file
# generation for input into dot.exe or the graphviz gui at another workstation.
$AD_CreateDiagramSourceFiles = $ExportGraphvizDefinitionFiles
$AD_CreateDiagrams = $false
$Graphviz_Path = ''
# Added this in as it can be useful to have a list of all users with their
# AD properties sometimes (to massage for input into other scripts among other things)
$EXPORTTOCSV_ALLUSERS = $ExportAllUsers
$EXPORTTOCSV_PRIVUSERS = $ExportPrivilegedUsers
# Used if calling script from command line
$Verbosity = ($PSBoundParameters['Verbose'] -eq $true)
If ($PromptForInput)
{
$yes = New-Object System.Management.Automation.Host.ChoiceDescription "&Yes",""
$no = New-Object System.Management.Automation.Host.ChoiceDescription "&No",""
$choices = [System.Management.Automation.Host.ChoiceDescription[]]($yes,$no)
$result = $Host.UI.PromptForChoice("Create Diagram Source Files?","Do you want to create diagram source txt files for later processing?",$choices,1)
$AD_CreateDiagramSourceFiles = ($result -ne $true)
$result = $Host.UI.PromptForChoice("Create Diagrams (requires graphviz binaries)?","Do you want to create diagrams with graphviz?",$choices,1)
$AD_CreateDiagrams = ($result -ne $true)
if ($AD_CreateDiagrams)
{
$Graphviz_Path = Read-Host "Enter your graphviz binary path if needed (if already in the environment path just press enter):"
}
$result = $Host.UI.PromptForChoice("Export All Users?","Do you want to export a CSV of all user data?",$choices,1)
$EXPORTTOCSV_ALLUSERS = ($result -ne $true)
$result = $Host.UI.PromptForChoice("Export All Privileged Users?","Do you want to export a CSV of all privileged user data?",$choices,1)
$EXPORTTOCSV_PRIVUSERS = ($result -ne $true)
$result = $Host.UI.PromptForChoice("Verbose?","Do you want verbose output?",$choices,0)
$Verbosity = ($result -ne $true)
}
# If you are color coding the domain reports this will control password age colorization
$AD_PwdAgeWarn = 60
$AD_PwdAgeAlert = 90
$AD_PwdAgeHealthy = 60
# A list of user attributes to normalize across all users.
# When an attribute doesn't exist (a non-mailbox enabled
# account for instance), it will be added with a $null value.
# These will all be exported if $EXPORTTOCSV_USERS is $true
$UserAttribs = @(
'cn',
'displayName',
'givenName',
'sn',
'name',
'sAMAccountName',
'sAMAccountType',
'whenChanged',
'whenCreated',
'pwdLastSet',
'admincount',
'accountExpires',
'badPasswordTime',
'badPwdCount',
'lastLogon',
'lastLogoff',
'logonCount',
'useraccountcontrol',
'lastlogontimestamp',
'homeMDB',
'homeMTA',
'mail',
'proxyAddresses',
'mailNickname',
#'legacyExchangeDN',
#'showInAddressBook',
'msexchalobjectversion',
#'msexchdelegatelistbl', # Could be interesting for a seperate report
'msexchhomeservername',
'msexchrecipientdisplaytype',
'msexchrecipienttypedetails',
'msexchumdtmfmap',
'msexchuseraccountcontrol',
'msexchuserculture',
'msexchversion',
'msexchwhenmailboxcreated',
'msnpallowdialin',
'msRTCSIP-PrimaryHomeServer',
'msRTCSIP-PrimaryUserAddress',
'msRTCSIP-UserEnabled',
'msRTCSIP-Line',
'msRTCSIP-FederationEnabled',
'msRTCSIP-InternetAccessEnabled'
)
# These are what we will attempt to report upon later on as 'privileged' groups
$AD_PrivilegedGroups = @(
'Enterprise Admins',
'Schema Admins',
'Domain Admins',
'Administrators',
'Cert Publishers',
'Account Operators',
'Server Operators',
'Backup Operators',
'Print Operators'
)
$Attrib_User_MSExchangeVersion = @{
# $null = Exchange 2003 and earlier
'4535486012416' = '2007'
'44220983382016' = '2010'
}
# http://msdn.microsoft.com/en-us/library/cc223546(v=prot.20).aspx
Add-Type -TypeDefinition @"
[System.Flags]
public enum nTDSSiteConnectionSettingsFlags {
IS_GENERATED = 0x00000001,
TWOWAY_SYNC = 0x00000002,
OVERRIDE_NOTIFY_DEFAULT = 0x00000004,
USE_NOTIFY = 0x00000008,
DISABLE_INTERSITE_COMPRESSION = 0x00000010,
OPT_USER_OWNED_SCHEDULE = 0x00000020
}
[System.Flags]
public enum MSExchCurrentServerRolesFlags {
NONE = 0x00000001,
MAILBOX = 0x00000002,
CLIENT_ACCESS = 0x00000004,
UM = 0x00000010,
HUB_TRANSPORT = 0x00000020,
EDGE_TRANSPORT = 0x00000040
}
[System.Flags]
public enum nTDSSiteSettingsFlags {
IS_AUTO_TOPOLOGY_DISABLED = 0x00000001,
IS_TOPL_CLEANUP_DISABLED = 0x00000002,
IS_TOPL_MIN_HOPS_DISABLED = 0x00000004,
IS_TOPL_DETECT_STALE_DISABLED = 0x00000008,
IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED = 0x00000010,
IS_GROUP_CACHING_ENABLED = 0x00000020,
FORCE_KCC_WHISTLER_BEHAVIOR = 0x00000040,
FORCE_KCC_W2K_ELECTION = 0x00000080,
IS_RAND_BH_SELECTION_DISABLED = 0x00000100,
IS_SCHEDULE_HASHING_ENABLED = 0x00000200,
IS_REDUNDANT_SERVER_TOPOLOGY_ENABLED = 0x00000400
}
[System.Flags]
public enum MSTrustAttributeFlags {
NON_TRANSITIVE = 0x00000001,
UPLEVEL_ONLY = 0x00000002,
QUARANTINED_DOMAIN = 0x00000004,
FOREST_TRANSITIVE = 0x00000008,
CROSS_ORGANIZATION = 0x00000010,
WITHIN_FOREST = 0x00000020,
TREAT_AS_EXTERNAL = 0x00000040,
USES_RC4_ENCRYPTION = 0x00000080
}
"@
#Schema constants
$SchemaHashExchange =
@{
4397='Exchange Server 2000 RTM'
4406='Exchange Server 2000 SP3'
6870='Exchange Server 2003 RTM'
6936='Exchange Server 2003 SP3'
10628='Exchange Server 2007 RTM'
10637='Exchange Server 2007 RTM'
11116='Exchange 2007 SP1'
14622='Exchange 2007 SP2 or Exchange 2010 RTM'
14625='Exchange 2007 SP3'
14726='Exchange 2010 SP1'
14732='Exchange 2010 SP2'
14734='Exchange 2010 SP3'
15137='Exchange 2013 RTM'
15254='Exchange 2013 CU1'
15281='Exchange 2013 CU2'
15283='Exchange 2013 CU3'
}
$SchemaHashLync =
@{
1006="LCS 2005"
1007="OCS 2007 R1"
1008="OCS 2007 R2"
1100="Lync Server 2010"
1150="Lync Server 2013"
}
# AD DC capabilities list (http://www.ldapexplorer.com/en/manual/103010700-connection-rootdse.htm)
# - Primarily used to determine if a DC is RODC or not (Const LDAP_CAP_ACTIVE_DIRECTORY_PARTIAL_SECRETS_OID = "1.2.840.113556.1.4.1920")
$AD_Capabilities = @{
'1.2.840.113556.1.4.319' = 'Paged results'
'1.2.840.113556.1.4.417' = 'Show deleted objects'
'1.2.840.113556.1.4.473' = 'Sort results'
'1.2.840.113556.1.4.474' = 'Sort results response'
'1.2.840.113556.1.4.521' = 'Cross domain move'
'1.2.840.113556.1.4.528' = 'Server notification'
'1.2.840.113556.1.4.529' = 'Extended DN'
'1.2.840.113556.1.4.619' = 'Lazy commit'
'1.2.840.113556.1.4.800' = 'Active Directory >= Windows 2000'
'1.2.840.113556.1.4.801' = 'SD flags'
'1.2.840.113556.1.4.805' = 'Tree delete'
'1.2.840.113556.1.4.906' = 'Microsoft large integer'
'1.2.840.113556.1.4.1302' = 'Microsoft OID used with DEN Attributes'
'1.2.840.113556.1.4.1338' = 'Verify name'
'1.2.840.113556.1.4.1339' = 'Domain scope'
'1.2.840.113556.1.4.1340' = 'Search options'
'1.2.840.113556.1.4.1341' = 'RODC DCPROMO'
'1.2.840.113556.1.4.1413' = 'Permissive Modify'
'1.2.840.113556.1.4.1670' = 'Active Directory (v5.1)>= Windows 2003'
'1.2.840.113556.1.4.1781' = 'Microsoft LDAP fast bind extended request'
'1.2.840.113556.1.4.1791' = 'NTLM Signing and Sealing'
'1.2.840.113556.1.4.1851' = 'ADAM / AD LDS Supported'
'1.2.840.113556.1.4.1852' = 'Quota Control'
'1.2.840.113556.1.4.1880' = 'ADAM Digest'
# '1.2.840.113556.1.4.1852' = 'Shutdown Notify'
'1.2.840.113556.1.4.1920' = 'Partial Secrets'
'1.2.840.113556.1.4.1935' = 'Active Directory (v6.0) >= Windows 2008'
'1.2.840.113556.1.4.1947' = 'Force Update'
'1.2.840.113556.1.4.1948' = 'Range Retrieval No Error'
'1.2.840.113556.1.4.2026' = 'Input DN'
'1.2.840.113556.1.4.2064' = 'Show Recycled'
'1.2.840.113556.1.4.2065' = 'Show Deactivated Link'
'1.2.840.113556.1.4.2080' = 'Active Directory (v6.1) >= Windows 2008 R2'
}
# Forest Report comments
$Comment_ForestDomainDCs =
@'
<tr>
<th class="sectioncolumngrouping" colspan=6>Server Information</th>
<th class="sectioncolumngrouping" colspan=6>Roles</th>
</tr>
'@
# Domain Report comments
$Comment_PrivGroup_EnterpriseAdmins =
@'
A group that exists only at the forest level of domains. The group is authorized to make forest-wide changes in Active Directory, such as adding child domains. By default, the only member of the group is the Administrator account for the forest root domain.
'@
$Comment_PrivGroup_SchemaAdmins =
@'
A group that exists only at the forest level of domains. The group is authorized to make schema changes in Active Directory. By default, the only member of the group is the Administrator account for the forest root domain. No other accounts should be in this group unless schema upgrades are being done.
'@
$Comment_PrivGroup_DomainAdmins =
@'
Members are authorized to administer the domain. By default, the Domain Admins group is a member of the Administrators group on all computers that have joined a domain, including the domain controllers. Domain Admins is the default owner of any object that is created in the domain's Active Directory by any member of the group. If members of the group create other objects, such as files, the default owner is the Administrators group.
'@
$Comment_PrivGroup_Administrators =
@'
After the initial installation of the operating system, the only member of the group is the Administrator account. When a computer joins a domain, the Domain Admins group is added to the Administrators group. When a server becomes a domain controller, the Enterprise Admins group also is added to the Administrators group. The Administrators group has built-in capabilities that give its members full control over the system. The group is the default owner of any object that is created by a member of the group.
'@
$Comment_PrivGroup_AccountOperators =
@'
Exists only on domain controllers. By default, the group has no members. By default, Account Operators have permission to create, modify, and delete accounts for users, groups, and computers in all containers and organizational units (OUs) of Active Directory except the Builtin container and the Domain Controllers OU. Account Operators do not have permission to modify the Administrators and Domain Admins groups, nor do they have permission to modify the accounts for members of those groups.
'@
$Comment_PrivGroup_ServerOperators =
@'
Exists only on domain controllers. By default, the group has no members. Server Operators can log on to a server interactively; create and delete network shares; start and stop services; back up and restore files; format the hard disk of the computer; and shut down the computer.
'@
$Comment_PrivGroup_BackupOperators =
@'
By default, the group has no members. Backup Operators can back up and restore all files on a computer, regardless of the permissions that protect those files. Backup Operators also can log on to the computer and shut it down.
'@
$Comment_PrivGroup_PrintOperators =
@'
Exists only on domain controllers. By default, the only member is the Domain Users group. Print Operators can manage printers and document queues.
'@
$Comment_PrivGroup_CertPublishers =
@'
Exists only on domain controllers. By default, the only member is the Domain Users group. Print Operators can manage printers and document queues.
'@
#endregion Custom Static Variables
#region Global Options and Variables
# Change this to allow for more or less result properties to span horizontally
# anything equal to or above this threshold will get displayed vertically instead.
# (NOTE: This only applies to sections set to be dynamic in html reports)
$HorizontalThreshold = 10
$currdir = ''
if ($MyInvocation.MyCommand.Path) {
$currdir = Split-Path $MyInvocation.MyCommand.Path
} else {
$currdir = $pwd -replace '^\S+::',''
}
#endregion Global Options and Variables
#region System Report Section Processing Definitions
$ADForestReportPreProcessing =
@'
Get-ADForestReportInformation @VerboseDebug `
-ReportContainer $ReportContainer `
-SortedRpts $SortedReports
'@
$ADDomainReportPreProcessing =
@'
Get-ADDomainReportInformation @VerboseDebug `
-ReportContainer $ReportContainer `
-SortedRpts $SortedReports
'@
$LyncElements_Postprocessing =
@'
$temp = Format-HTMLTable $Table -Column 'Type' -ColumnValue 'Internal' -Attr 'class' -AttrValue 'healthy'
$temp = Format-HTMLTable $temp -Column 'Type' -ColumnValue 'Backend' -Attr 'class' -AttrValue 'healthy'
$temp = Format-HTMLTable $temp -Column 'Type' -ColumnValue 'Pool' -Attr 'class' -AttrValue 'warn'
Format-HTMLTable $temp -Column 'Type' -ColumnValue 'Edge' -Attr 'class' -AttrValue 'alert'
'@
$ForestDomainDNSZones_Postprocessing =
@'
[scriptblock]$scriptblock = {[string]$args[0] -match [string]$args[1]}
$temp = Format-HTMLTable $Table -Scriptblock $scriptblock -Column 'Name' -ColumnValue 'CNF:' -Attr 'class' -AttrValue 'warn'
Format-HTMLTable $temp -Scriptblock $scriptblock -Column 'Name' -ColumnValue 'InProgress' -Attr 'class' -AttrValue 'warn'
'@
$ForestSiteConnections_Postprocessing =
@'
$temp = Format-HTMLTable $Table -Column 'Enabled' -ColumnValue 'True' -Attr 'class' -AttrValue 'healthy'
Format-HTMLTable $temp -Column 'Enabled' -ColumnValue 'False' -Attr 'class' -AttrValue 'alert'
'@
$ForestDomainDCs_Postprocessing =
@'
$temp = Format-HTMLTable $Table -Column 'GC' -ColumnValue 'True' -Attr 'class' -AttrValue 'healthy'
$temp = Format-HTMLTable $temp -Column 'GC' -ColumnValue 'False' -Attr 'class' -AttrValue 'alert'
$temp = Format-HTMLTable $temp -Column 'Infra' -ColumnValue 'True' -Attr 'class' -AttrValue 'healthy'
$temp = Format-HTMLTable $temp -Column 'Infra' -ColumnValue 'False' -Attr 'class' -AttrValue 'alert'
$temp = Format-HTMLTable $temp -Column 'Naming' -ColumnValue 'True' -Attr 'class' -AttrValue 'healthy'
$temp = Format-HTMLTable $temp -Column 'Naming' -ColumnValue 'False' -Attr 'class' -AttrValue 'alert'
$temp = Format-HTMLTable $temp -Column 'Schema' -ColumnValue 'True' -Attr 'class' -AttrValue 'healthy'
$temp = Format-HTMLTable $temp -Column 'Schema' -ColumnValue 'False' -Attr 'class' -AttrValue 'alert'
$temp = Format-HTMLTable $temp -Column 'RID' -ColumnValue 'True' -Attr 'class' -AttrValue 'healthy'
$temp = Format-HTMLTable $temp -Column 'RID' -ColumnValue 'False' -Attr 'class' -AttrValue 'alert'
$temp = Format-HTMLTable $temp -Column 'PDC' -ColumnValue 'True' -Attr 'class' -AttrValue 'healthy'
Format-HTMLTable $temp -Column 'PDC' -ColumnValue 'False' -Attr 'class' -AttrValue 'alert'
'@
$ADPrivUser_Postprocessing =
@'
[scriptblock]$scriptblock = {[int]$args[0] -ge [int]$args[1]}
[scriptblock]$scriptblockhealthy = {[int]$args[0] -lt [int]$args[1]}
$temp = Format-HTMLTable $Table -Column 'No Pwd Expiry' -ColumnValue 'True' -Attr 'class' -AttrValue 'warn'
$temp = Format-HTMLTable $temp -Column 'No Pwd Expiry' -ColumnValue 'False' -Attr 'class' -AttrValue 'healthy'
$temp = Format-HTMLTable $temp -Column 'Pwd Reversable' -ColumnValue 'True' -Attr 'class' -AttrValue 'alert'
$temp = Format-HTMLTable $temp -Column 'Pwd Reversable' -ColumnValue 'False' -Attr 'class' -AttrValue 'healthy'
$temp = Format-HTMLTable $temp -Column 'Pwd Not Req.' -ColumnValue 'True' -Attr 'class' -AttrValue 'warn'
$temp = Format-HTMLTable $temp -Column 'Pwd Not Req.' -ColumnValue 'False' -Attr 'class' -AttrValue 'healthy'
$temp = Format-HTMLTable $temp -Scriptblock $scriptblockhealthy -Column 'Pwd Age (Days)' -ColumnValue $AD_PwdAgeHealthy -Attr 'class' -AttrValue 'healthy'
$temp = Format-HTMLTable $temp -Scriptblock $scriptblock -Column 'Pwd Age (Days)' -ColumnValue $AD_PwdAgeWarn -Attr 'class' -AttrValue 'warn'
Format-HTMLTable $temp -Scriptblock $scriptblock -Column 'Pwd Age (Days)' -ColumnValue $AD_PwdAgeAlert -Attr 'class' -AttrValue 'alert'
'@
#endregion Report Section Processing Definitions
#region Report Structure Definitions
<#
Configuration
TOC - Possibly used in the future to create a table of contents
PreProcessing - Scriptblock to to information gathering
SkipSectionBreaks - Allows total bypassing of sections of type
'SectionBreak' in reports
ReportTypes - List all possible report types. The first one listed
here will be the default used if none are specified
when generating the report.
Assets - A list of assets which will be reported upon. These are keys in hashes of data
broken down by section. In a self contained asset report this will get
populated by the PreProcessing information gathering script. Usually
this starts out empty and gets automatically filled.
PostProcessingEnabled - Usually this is true. Currently postprocessing for my scripts
rely heavily on a custom function called Format-HTMLTable which,
in turn, relies on at least .Net 3.5 sp2 being available for
Linq assemblies. This is done to try and remove the need for
custom modules. If you get a bunch of errors about linq not being
available you can simply skip post processing by setting this to
be false.
#>
$ADForestReport = @{
'Configuration' = @{
'TOC' = $true
'PreProcessing' = $ADForestReportPreProcessing
'SkipSectionBreaks' = $false
'ReportTypes' = @('FullDocumentation','ExcelExport')
'Assets' = @()
'PostProcessingEnabled' = $true
}
'Sections' = @{
'Break_ForestInformation' = @{
'Enabled' = $true
'ShowSectionEvenWithNoData' = $true
'Order' = 0
'AllData' = @{}
'Title' = 'Forest Information'
'Type' = 'SectionBreak'
'ReportTypes' = @{
'ExcelExport' = $false
'FullDocumentation' = @{
'ContainerType' = 'full'
'SectionOverride' = $false
'TableType' = 'Horizontal'
'Properties' = $true
}
}
}
'ForestSummary' = @{
'Enabled' = $true
'ShowSectionEvenWithNoData' = $true
'Order' = 1
'AllData' = @{}
'Title' = 'Forest Summary'
'Type' = 'Section'
'Comment' = $false
'ReportTypes' = @{
'ExcelExport' = @{
'ContainerType' = 'Half'
'SectionOverride' = $false
'TableType' = 'Vertical'
'Properties' =
@{n='Name';e={$_.ForestName}},
@{n='Functional Level';e={$_.ForestFunctionalLevel}},
@{n='Domain Naming Master';e={$_.DomainNamingMaster}},
@{n='Schema Master';e={$_.SchemaMaster}},
@{n='Domain Count';e={($_.Domains).Count}},
@{n='DC Server Count';e={$_.DomainControllersCount}},
@{n='GC Server Count';e={($_.GlobalCatalogs).Count}},
@{n='Exchange Server Count';e={$_.ExchangeServerCount}},
@{n='Lync Server Count';e={$_.LyncServerCount}},
@{n='Lync Pool Count';e={$_.LyncPoolCount}}
}
'FullDocumentation' = @{
'ContainerType' = 'Half'
'SectionOverride' = $false
'TableType' = 'Vertical'
'Properties' =
@{n='Name';e={$_.ForestName}},
@{n='Functional Level';e={$_.ForestFunctionalLevel}},
@{n='Domain Naming Master';e={$_.DomainNamingMaster}},
@{n='Schema Master';e={$_.SchemaMaster}},
@{n='Domain Count';e={($_.Domains).Count}},
@{n='Site Count';e={($_.Sites).Count}},
@{n='DC Server Count';e={$_.DomainControllersCount}},
@{n='GC Server Count';e={($_.GlobalCatalogs).Count}},
@{n='Exchange Server Count';e={$_.ExchangeServerCount}},
@{n='Lync Server Count';e={$_.LyncServerCount}},
@{n='Lync Pool Count';e={$_.LyncPoolCount}}
}
}
}
'SiteSummary' = @{
'Enabled' = $true
'ShowSectionEvenWithNoData' = $true
'Order' = 2
'AllData' = @{}
'Title' = 'Site Summary'
'Type' = 'Section'
'Comment' = $false
'ReportTypes' = @{
'ExcelExport' = @{
'ContainerType' = 'Half'
'SectionOverride' = $false
'TableType' = 'Vertical'
'Properties' =
@{n='Site Count';e={$_.SiteCount}},
@{n='Site Subnet Count';e={$_.SiteSubnetCount}},
@{n='Site Link Count';e={$_.SiteLinkCount}},
@{n='Site Connection Count';e={$_.SiteConnectionCount}},
@{n='Sites Without Site Connections';e={$_.SitesWithotuSiteConnections}},
@{n='Sites Without ISTG';e={$_.SitesWithoutISTG}},
@{n='Sites Without Subnets';e={$_.SitesWithoutSubnets}},
@{n='Sites Without Servers';e={$_.SitesWithoutServers}}
}
'FullDocumentation' = @{
'ContainerType' = 'Half'
'SectionOverride' = $false
'TableType' = 'Vertical'
'Properties' =
@{n='Site Count';e={$_.SiteCount}},
@{n='Site Subnet Count';e={$_.SiteSubnetCount}},
@{n='Site Link Count';e={$_.SiteLinkCount}},
@{n='Site Connection Count';e={$_.SiteConnectionCount}},
@{n='Sites Without Site Connections';e={$_.SitesWithoutSiteConnections}},
@{n='Sites Without ISTG';e={$_.SitesWithoutISTG}},
@{n='Sites Without Subnets';e={$_.SitesWithoutSubnets}},
@{n='Sites Without Servers';e={$_.SitesWithoutServers}}
}
}
}
'ForestFeatures' = @{
'Enabled' = $true
'ShowSectionEvenWithNoData' = $true
'Order' =3
'AllData' = @{}
'Title' = 'Forest Features'
'Type' = 'Section'
'Comment' = $false
'ReportTypes' = @{
'ExcelExport' = @{
'ContainerType' = 'Half'
'SectionOverride' = $false
'TableType' = 'Vertical'
'Properties' =
@{n='Recycle Bin Enabled';e={$_.RecycleBinEnabled}},
@{n='Tombstone Lifetime';e={$_.TombstoneLifetime}},
@{n='Exchange Version';e={$_.ExchangeVersion}},
@{n='Lync Version';e={$_.LyncVersion}},
# @{n='Deleted Object Lifetime';e={$_.DeletedObjectLife}},
# @{n='Total Object Backup Lifetime';e={$_.TotalObjectBackupLife}},
@{n='Lync AD Container';e={$_.LyncADContainer}}
}
'FullDocumentation' = @{
'ContainerType' = 'Half'
'SectionOverride' = $false
'TableType' = 'Vertical'
'Properties' =
@{n='Recycle Bin Enabled';e={$_.RecycleBinEnabled}},
@{n='Tombstone Lifetime';e={$_.TombstoneLifetime}},
@{n='Exchange Version';e={$_.ExchangeVersion}},
@{n='Lync Version';e={$_.LyncVersion}},
# @{n='Deleted Object Lifetime';e={$_.DeletedObjectLife}},
# @{n='Total Object Backup Lifetime';e={$_.TotalObjectBackupLife}},
@{n='Lync AD Container';e={$_.LyncADContainer}}
}
}
}
'ForestLyncInfo' = @{
'Enabled' = $true
'ShowSectionEvenWithNoData' = $false
'Order' = 4
'AllData' = @{}
'Title' = 'Lync Elements'
'Type' = 'Section'
'Comment' = $false
'ReportTypes' = @{
'ExcelExport' = @{
'ContainerType' = 'Half'
'SectionOverride' = $false
'TableType' = 'Horizontal'
'Properties' =
@{n='Function';e={$_.LyncElement}},
@{n='Type';e={$_.LyncElementType}},
@{n='FQDN';e={$_.LyncElementFQDN}}
}
'FullDocumentation' = @{
'ContainerType' = 'Half'
'SectionOverride' = $false
'TableType' = 'Horizontal'
'Properties' =
@{n='Function';e={$_.LyncElement}},
@{n='Type';e={$_.LyncElementType}},
@{n='FQDN';e={$_.LyncElementFQDN}}
}
}
'PostProcessing' = $LyncElements_Postprocessing
}
'ForestExchangeInfo' = @{
'Enabled' = $true
'ShowSectionEvenWithNoData' = $false
'Order' = 5
'AllData' = @{}
'Title' = 'Forest Exchange Servers'
'Type' = 'Section'
'Comment' = $false
'ReportTypes' = @{
'ExcelExport' = @{
'ContainerType' = 'Full'
'SectionOverride' = $false
'TableType' = 'Horizontal'
'Properties' =
@{n='Org';e={$_.Organization}},
@{n='Admin Group';e={$_.AdminGroup}},
@{n='Name';e={$_.Name}},
@{n='Roles';e={$_.Role}},
@{n='Site';e={$_.Site}},
#@{n='Created';e={$_.Created}},
@{n='Serial';e={$_.Serial}},
@{n='Product ID';e={$_.ProductID}}
}
'FullDocumentation' = @{
'ContainerType' = 'Full'
'SectionOverride' = $false
'TableType' = 'Horizontal'
'Properties' =
@{n='Org';e={$_.Organization}},
@{n='Admin Group';e={$_.AdminGroup}},
@{n='Name';e={$_.Name}},
@{n='Roles';e={$_.Role}},
@{n='Site';e={$_.Site}},
#@{n='Created';e={$_.Created}},
@{n='Serial';e={$_.Serial}},
@{n='Product ID';e={$_.ProductID}}
}
}
}
'ForestExchangeFederations' = @{
'Enabled' = $true
'ShowSectionEvenWithNoData' = $false
'Order' = 6
'AllData' = @{}
'Title' = 'Forest Exchange Federations'
'Type' = 'Section'
'Comment' = $false
'ReportTypes' = @{
'ExcelExport' = @{
'ContainerType' = 'Full'
'SectionOverride' = $false
'TableType' = 'Horizontal'
'Properties' =
@{n='Org';e={$_.Organization}},
@{n='Name';e={$_.Name}},
@{n='Enabled';e={$_.Enabled}},
@{n='Domains';e={[string]$_.Domains -replace ' ', "`n`r"}},
@{n='Allowed Actions';e={[string]$_.AllowedActions -replace ' ', "`n`r"}},
@{n='App URI';e={$_.TargetAppURI}},
@{n='Autodiscover EPR';e={$_.TargetAutodiscoverEPR}}
}
'FullDocumentation' = @{
'ContainerType' = 'Full'
'SectionOverride' = $false