os/windows

os/windows

Planned PowerShell scripts for Windows security audits. Mirrors the structure of os/linux/.

Open architectural decision: scripts can target local accounts only (Get-LocalUser), Active Directory (Get-ADUser), or both. This affects cmdlet choices across most scripts below and should be settled before implementation.

Planned Scripts

local_admins.ps1

List members of the local Administrators group via Get-LocalGroupMember.

passwords.ps1

Dump local password policy via net accounts. If domain-joined, also pull Get-ADDefaultDomainPasswordPolicy (min length, max age, lockout threshold, history).

audit_policy.ps1

Read the Windows audit policy via auditpol /get /category:*. Flag whether logon, account management, and privilege use events are being logged.

rdp_settings.ps1

Check if RDP is enabled, whether NLA is required, and which users/groups hold "Allow log on through Remote Desktop Services" rights.

inactive_users.ps1

List local user accounts with last logon date. Flag accounts inactive past a configurable threshold (e.g., 90 days).

ad_admins.ps1

If domain-joined: list members of Domain Admins, Enterprise Admins, and Schema Admins. AD equivalent of ../../../applications/github/github_admins.py.

scheduled_tasks.ps1

List scheduled tasks running as SYSTEM or with stored credentials. Windows analog of a cron audit.