audit-labs/audit-tools

 1# os/windows
 2
 3> Planned PowerShell scripts for Windows security audits. Mirrors the structure of `os/linux/`.
 4>
 5> Open architectural decision: scripts can target local accounts only (`Get-LocalUser`),
 6> Active Directory (`Get-ADUser`), or both. This affects cmdlet choices across most scripts
 7> below and should be settled before implementation.
 8
 9## Planned Scripts
10
11### `local_admins.ps1`
12List members of the local Administrators group via `Get-LocalGroupMember`.
13
14### `passwords.ps1`
15Dump local password policy via `net accounts`. If domain-joined, also pull
16`Get-ADDefaultDomainPasswordPolicy` (min length, max age, lockout threshold, history).
17
18### `audit_policy.ps1`
19Read the Windows audit policy via `auditpol /get /category:*`. Flag whether logon,
20account management, and privilege use events are being logged.
21
22### `rdp_settings.ps1`
23Check if RDP is enabled, whether NLA is required, and which users/groups hold
24"Allow log on through Remote Desktop Services" rights.
25
26### `inactive_users.ps1`
27List local user accounts with last logon date. Flag accounts inactive past a
28configurable threshold (e.g., 90 days).
29
30### `ad_admins.ps1`
31If domain-joined: list members of Domain Admins, Enterprise Admins, and Schema Admins.
32AD equivalent of `../../../applications/github/github_admins.py`.
33
34### `scheduled_tasks.ps1`
35List scheduled tasks running as SYSTEM or with stored credentials.
36Windows analog of a cron audit.