Контроль дрейфа конфигураций для инфраструктуры и продуктов

version: 1
target_type: windows_powershell

parameters:
  watched_groups:
    - "Domain Admins"
    - "Enterprise Admins"
    - "Schema Admins"
    - "Administrators"
    - "Protected Users"
    - "NyTestSecGroup"
  watched_users:
    - "Administrator"
    - "Test2"

collector:
  transport: powershell
  commands:
    - name: domain_password_policy
      timeout_sec: 60
      requires_modules: ["ActiveDirectory"]
      script: |
        Import-Module ActiveDirectory
        Get-ADDefaultDomainPasswordPolicy |
          Select-Object `
            MinPasswordLength, PasswordHistoryCount, ComplexityEnabled, ReversibleEncryptionEnabled, `
            LockoutThreshold, LockoutDuration, LockoutObservationWindow |
          ForEach-Object { $_ }  # вернуть объект

    - name: privileged_groups_membership
      timeout_sec: 180
      requires_modules: ["ActiveDirectory"]
      script: |
        Import-Module ActiveDirectory
        $groups = @("Domain Admins","Enterprise Admins","Schema Admins","Administrators","Protected Users")
        foreach ($g in $groups) {
          Get-ADGroupMember -Identity $g -Recursive |
            Select-Object @{n="Group";e={$g}}, ObjectClass, SamAccountName, Name, DistinguishedName |
            Sort-Object Group, ObjectClass, SamAccountName, DistinguishedName
        }