Protecting Windows Environment Using PowerShell #4: Monitoring and auditing Windows security using PowerShell

Monitoring and auditing Windows security is a crucial part of maintaining a secure system. PowerShell is a powerful tool for managing Windows environments, and it can also be used to monitor and audit security events. In this article, we’ll explore some ways that PowerShell can be used to monitor and audit Windows security.

Monitoring Windows Security Events with PowerShell

PowerShell can be used to monitor security events in the Windows event logs. Here’s an example PowerShell script that searches for all failed login attempts in the Security event log:

Get-EventLog -LogName Security -InstanceId 4625 | Select-Object -Property TimeGenerated,Message

This script uses the Get-EventLog cmdlet to retrieve all instances of Event ID 4625 (failed login) from the Security event log. It then uses the Select-Object cmdlet to display the time the event was generated and the event message.

Auditing Windows Security with PowerShell

PowerShell can also be used to audit Windows security by checking system settings and configurations. Here’s an example PowerShell script that checks the status of the Windows Firewall:

$fw = Get-NetFirewallProfile | Where-Object {$_.Name -eq 'Domain'}

if ($fw.Enabled) {
    Write-Host "Windows Firewall is enabled."
} else {
    Write-Host "Windows Firewall is disabled."
}

This script uses the Get-NetFirewallProfile cmdlet to retrieve the status of the Windows Firewall for the Domain profile. It then checks whether the firewall is enabled or disabled and reports the result.

Monitoring and Auditing with Scheduled Tasks

PowerShell can also be used to create scheduled tasks that monitor and audit Windows security events. Here’s an example PowerShell script that creates a scheduled task to run a security audit script every day:

$action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument 'C:\scripts\security-audit.ps1'
$trigger = New-ScheduledTaskTrigger -Daily -At 8am
$settings = New-ScheduledTaskSettingsSet -RunOnlyIfNetworkAvailable -DisallowStartIfOnBatteries
Register-ScheduledTask -TaskName 'Security Audit' -Action $action -Trigger $trigger -Settings $settings

This script uses the New-ScheduledTaskAction, New-ScheduledTaskTrigger, and New-ScheduledTaskSettingsSet cmdlets to create a scheduled task that runs a security audit script every day at 8am. The Register-ScheduledTask cmdlet then registers the task with Windows Task Scheduler.

Advanced Security Auditing with PowerShell

PowerShell can be used to perform more advanced security auditing tasks, such as monitoring file and folder permissions and tracking user activity. Here’s an example PowerShell script that monitors file and folder permissions:

$folders = Get-ChildItem -Path C:\ -Directory -Recurse
foreach ($folder in $folders) {
    $acl = Get-Acl -Path $folder.FullName
    foreach ($ace in $acl.Access) {
        Write-Host "$($folder.FullName): $($ace.IdentityReference) $($ace.FileSystemRights)"
    }
}

This script uses the Get-ChildItem cmdlet to retrieve a list of all directories on the C: drive, and then retrieves the Access Control List (ACL) for each folder. It then displays a list of users and their file system permissions for each folder.

Centralizing Security Auditing with PowerShell

PowerShell can be used to centralize security auditing by collecting and analyzing security event logs from multiple systems. Here’s an example PowerShell script that collects security event logs from multiple computers and writes them to a central location:

$computers = Get-Content -Path 'C:\computers.txt'
foreach ($computer in $computers) {
    $events = Get-WinEvent -ComputerName $computer -LogName Security -MaxEvents 100
    $events | Export-Csv -Path "C:\security-events-$computer.csv" -NoTypeInformation
}

This script uses the Get-Content cmdlet to retrieve a list of computer names from a text file. It then uses the Get-WinEvent cmdlet to retrieve the last 100 security events from the Security event log on each computer and exports them to a CSV file with a unique name for each computer.

Conclusion

PowerShell is a versatile tool for monitoring and auditing Windows security. It can be used to monitor security events, audit system settings, create scheduled tasks, perform advanced security auditing tasks, and centralize security auditing. By leveraging the power of PowerShell, administrators can maintain a secure and well-managed Windows environment.