Skip to content

Add service account type reporting #81

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
PrzemyslawKlys merged 1 commit into from
May 6, 2026
Merged

Add service account type reporting #81

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions Private/Configuration.ServiceAccounts.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,13 +21,14 @@

New-HTMLTab -Name $Domain {
New-HTMLTable -DataTable $Script:Reporting['ServiceAccounts']['Data'][$Domain] -Filtering {
New-HTMLTableCondition -Name 'UsesDESEncryption' -ComparisonType bool -Operator eq -Value $true -BackgroundColor Red
New-HTMLTableCondition -Name 'UsesRC4Encryption' -ComparisonType bool -Operator eq -Value $true -BackgroundColor Salmon
New-HTMLTableCondition -Name 'UsesDomainEncryptionDefaults' -ComparisonType bool -Operator eq -Value $true -BackgroundColor LightYellow
New-HTMLTableCondition -Name 'ServiceAccountType' -ComparisonType string -Operator like -Value '*dMSA*' -BackgroundColor LightBlue
New-HTMLTableCondition -Name 'SupportsDESEncryption' -ComparisonType bool -Operator eq -Value $true -BackgroundColor Red
New-HTMLTableCondition -Name 'SupportsRC4Encryption' -ComparisonType bool -Operator eq -Value $true -BackgroundColor Salmon
New-HTMLTableCondition -Name 'FallsBackToDomainEncryptionDefaults' -ComparisonType bool -Operator eq -Value $true -BackgroundColor LightYellow
New-HTMLTableConditionGroup -Conditions {
New-HTMLTableCondition -Name 'UsesAESKeys' -ComparisonType bool -Operator eq -Value $false
New-HTMLTableCondition -Name 'UsesDomainEncryptionDefaults' -ComparisonType bool -Operator eq -Value $false
} -BackgroundColor LightPink -HighlightHeaders SupportedEncryptionTypes, UsesAESKeys
New-HTMLTableCondition -Name 'SupportsAESKeys' -ComparisonType bool -Operator eq -Value $false
New-HTMLTableCondition -Name 'FallsBackToDomainEncryptionDefaults' -ComparisonType bool -Operator eq -Value $false
} -BackgroundColor LightPink -HighlightHeaders SupportedEncryptionTypes, SupportsAESKeys
}
}
}
Expand Down
12 changes: 6 additions & 6 deletions Private/Configuration.WinADComputer.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,13 +188,13 @@
New-HTMLTableCondition -Name 'Enabled' -ComparisonType string -Operator eq -Value $True
New-HTMLTableCondition -Name 'PasswordNotRequired' -ComparisonType string -Operator eq -Value $True
} -BackgroundColor Red -HighlightHeaders Name, SamAccountName, Enabled, PasswordNotRequired
New-HTMLTableCondition -Name 'UsesDESEncryption' -ComparisonType bool -Operator eq -Value $true -BackgroundColor Red
New-HTMLTableCondition -Name 'UsesRC4Encryption' -ComparisonType bool -Operator eq -Value $true -BackgroundColor Salmon
New-HTMLTableCondition -Name 'UsesDomainEncryptionDefaults' -ComparisonType bool -Operator eq -Value $true -BackgroundColor LightYellow
New-HTMLTableCondition -Name 'SupportsDESEncryption' -ComparisonType bool -Operator eq -Value $true -BackgroundColor Red
New-HTMLTableCondition -Name 'SupportsRC4Encryption' -ComparisonType bool -Operator eq -Value $true -BackgroundColor Salmon
New-HTMLTableCondition -Name 'FallsBackToDomainEncryptionDefaults' -ComparisonType bool -Operator eq -Value $true -BackgroundColor LightYellow
New-HTMLTableConditionGroup -Conditions {
New-HTMLTableCondition -Name 'UsesAESKeys' -ComparisonType bool -Operator eq -Value $false
New-HTMLTableCondition -Name 'UsesDomainEncryptionDefaults' -ComparisonType bool -Operator eq -Value $false
} -BackgroundColor LightPink -HighlightHeaders SupportedEncryptionTypes, UsesAESKeys
New-HTMLTableCondition -Name 'SupportsAESKeys' -ComparisonType bool -Operator eq -Value $false
New-HTMLTableCondition -Name 'FallsBackToDomainEncryptionDefaults' -ComparisonType bool -Operator eq -Value $false
} -BackgroundColor LightPink -HighlightHeaders SupportedEncryptionTypes, SupportsAESKeys
} -ScrollX
}
}
Expand Down
12 changes: 6 additions & 6 deletions Private/Configuration.WinADUser.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,13 +164,13 @@
New-HTMLTableCondition -Name 'Enabled' -ComparisonType string -Operator eq -Value $True
New-HTMLTableCondition -Name 'PasswordNotRequired' -ComparisonType string -Operator eq -Value $True
} -BackgroundColor Red -HighlightHeaders Name, SamAccountName, Enabled, PasswordNotRequired
New-HTMLTableCondition -Name 'UsesDESEncryption' -ComparisonType bool -Operator eq -Value $true -BackgroundColor Red
New-HTMLTableCondition -Name 'UsesRC4Encryption' -ComparisonType bool -Operator eq -Value $true -BackgroundColor Salmon
New-HTMLTableCondition -Name 'UsesDomainEncryptionDefaults' -ComparisonType bool -Operator eq -Value $true -BackgroundColor LightYellow
New-HTMLTableCondition -Name 'SupportsDESEncryption' -ComparisonType bool -Operator eq -Value $true -BackgroundColor Red
New-HTMLTableCondition -Name 'SupportsRC4Encryption' -ComparisonType bool -Operator eq -Value $true -BackgroundColor Salmon
New-HTMLTableCondition -Name 'FallsBackToDomainEncryptionDefaults' -ComparisonType bool -Operator eq -Value $true -BackgroundColor LightYellow
New-HTMLTableConditionGroup -Conditions {
New-HTMLTableCondition -Name 'UsesAESKeys' -ComparisonType bool -Operator eq -Value $false
New-HTMLTableCondition -Name 'UsesDomainEncryptionDefaults' -ComparisonType bool -Operator eq -Value $false
} -BackgroundColor LightPink -HighlightHeaders SupportedEncryptionTypes, UsesAESKeys
New-HTMLTableCondition -Name 'SupportsAESKeys' -ComparisonType bool -Operator eq -Value $false
New-HTMLTableCondition -Name 'FallsBackToDomainEncryptionDefaults' -ComparisonType bool -Operator eq -Value $false
} -BackgroundColor LightPink -HighlightHeaders SupportedEncryptionTypes, SupportsAESKeys
} -ScrollX
}
}
Expand Down
25 changes: 25 additions & 0 deletions Private/ConvertTo-WinADServiceAccountType.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
function ConvertTo-WinADServiceAccountType {
[cmdletBinding()]
param(
[AllowNull()][string] $ObjectClass
)

switch ($ObjectClass) {
'msDS-ManagedServiceAccount' {
'Standalone Managed Service Account (sMSA/MSA)'
}
'msDS-GroupManagedServiceAccount' {
'Group Managed Service Account (gMSA)'
}
'msDS-DelegatedManagedServiceAccount' {
'Delegated Managed Service Account (dMSA)'
}
default {
if ($ObjectClass) {
$ObjectClass
} else {
'Unknown'
}
}
}
}
32 changes: 16 additions & 16 deletions Private/ConvertTo-WinADSupportedEncryptionTypes.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@ function ConvertTo-WinADSupportedEncryptionTypes {
ValueState = 'Not configured'
Types = [string[]] @()
TypesText = 'Not configured (uses KDC/domain defaults)'
UsesDomainDefaults = $true
UsesAESKeys = $false
UsesRC4Encryption = $false
UsesDESEncryption = $false
FallsBackToDomainDefaults = $true
SupportsAESKeys = $false
SupportsRC4Encryption = $false
SupportsDESEncryption = $false
EnforcesAESSessionKeys = $false
}
}
Expand All @@ -30,10 +30,10 @@ function ConvertTo-WinADSupportedEncryptionTypes {
ValueState = 'Invalid'
Types = [string[]] @()
TypesText = "Invalid value: $Value"
UsesDomainDefaults = $false
UsesAESKeys = $false
UsesRC4Encryption = $false
UsesDESEncryption = $false
FallsBackToDomainDefaults = $false
SupportsAESKeys = $false
SupportsRC4Encryption = $false
SupportsDESEncryption = $false
EnforcesAESSessionKeys = $false
}
}
Expand All @@ -44,10 +44,10 @@ function ConvertTo-WinADSupportedEncryptionTypes {
ValueState = 'Configured as 0'
Types = [string[]] @()
TypesText = 'Configured as 0 (uses KDC/domain defaults)'
UsesDomainDefaults = $true
UsesAESKeys = $false
UsesRC4Encryption = $false
UsesDESEncryption = $false
FallsBackToDomainDefaults = $true
SupportsAESKeys = $false
SupportsRC4Encryption = $false
SupportsDESEncryption = $false
EnforcesAESSessionKeys = $false
}
}
Expand Down Expand Up @@ -76,10 +76,10 @@ function ConvertTo-WinADSupportedEncryptionTypes {
ValueState = 'Configured'
Types = $Types
TypesText = if ($Types.Count -gt 0) { $Types -join ', ' } else { 'None' }
UsesDomainDefaults = $false
UsesAESKeys = $Types -contains 'AES128-CTS-HMAC-SHA1-96' -or $Types -contains 'AES256-CTS-HMAC-SHA1-96'
UsesRC4Encryption = $Types -contains 'RC4-HMAC'
UsesDESEncryption = $Types -contains 'DES-CBC-CRC' -or $Types -contains 'DES-CBC-MD5'
FallsBackToDomainDefaults = $false
SupportsAESKeys = $Types -contains 'AES128-CTS-HMAC-SHA1-96' -or $Types -contains 'AES256-CTS-HMAC-SHA1-96'
SupportsRC4Encryption = $Types -contains 'RC4-HMAC'
SupportsDESEncryption = $Types -contains 'DES-CBC-CRC' -or $Types -contains 'DES-CBC-MD5'
EnforcesAESSessionKeys = $Types -contains 'AES256-CTS-HMAC-SHA1-96-SK'
}
}
16 changes: 16 additions & 0 deletions Private/Test-WinADSchemaAttribute.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
function Test-WinADSchemaAttribute {
[cmdletBinding()]
param(
[Parameter(Mandatory)][string] $Name,
[string] $Server
)

try {
$RootDSE = Get-ADRootDSE -Server $Server -ErrorAction Stop
$Attribute = Get-ADObject -LDAPFilter "(&(objectClass=attributeSchema)(lDAPDisplayName=$Name))" -SearchBase $RootDSE.SchemaNamingContext -Server $Server -ErrorAction Stop
$null -ne $Attribute
} catch {
Write-Verbose -Message "Test-WinADSchemaAttribute - Failed to query schema attribute '$Name' using server '$Server'. Error: $($_.Exception.Message)"
$false
}
}
16 changes: 8 additions & 8 deletions Public/Get-WinADComputers.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,10 +158,10 @@
'msDS-SupportedEncryptionTypes' = $SupportedEncryption.RawValue
SupportedEncryptionTypesState = $SupportedEncryption.ValueState
SupportedEncryptionTypes = $SupportedEncryption.TypesText
UsesDomainEncryptionDefaults = $SupportedEncryption.UsesDomainDefaults
UsesAESKeys = $SupportedEncryption.UsesAESKeys
UsesRC4Encryption = $SupportedEncryption.UsesRC4Encryption
UsesDESEncryption = $SupportedEncryption.UsesDESEncryption
FallsBackToDomainEncryptionDefaults = $SupportedEncryption.FallsBackToDomainDefaults
SupportsAESKeys = $SupportedEncryption.SupportsAESKeys
SupportsRC4Encryption = $SupportedEncryption.SupportsRC4Encryption
SupportsDESEncryption = $SupportedEncryption.SupportsDESEncryption
EnforcesAESSessionKeys = $SupportedEncryption.EnforcesAESSessionKeys
msDSSupportedEncryptionTypes = $SupportedEncryption.Types
}
Expand Down Expand Up @@ -198,10 +198,10 @@
'msDS-SupportedEncryptionTypes' = $SupportedEncryption.RawValue
SupportedEncryptionTypesState = $SupportedEncryption.ValueState
SupportedEncryptionTypes = $SupportedEncryption.TypesText
UsesDomainEncryptionDefaults = $SupportedEncryption.UsesDomainDefaults
UsesAESKeys = $SupportedEncryption.UsesAESKeys
UsesRC4Encryption = $SupportedEncryption.UsesRC4Encryption
UsesDESEncryption = $SupportedEncryption.UsesDESEncryption
FallsBackToDomainEncryptionDefaults = $SupportedEncryption.FallsBackToDomainDefaults
SupportsAESKeys = $SupportedEncryption.SupportsAESKeys
SupportsRC4Encryption = $SupportedEncryption.SupportsRC4Encryption
SupportsDESEncryption = $SupportedEncryption.SupportsDESEncryption
EnforcesAESSessionKeys = $SupportedEncryption.EnforcesAESSessionKeys
msDSSupportedEncryptionTypes = $SupportedEncryption.Types
}
Expand Down
30 changes: 25 additions & 5 deletions Public/Get-WinADServiceAccount.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,20 @@
'msDS-ManagedPasswordInterval', 'msDS-GroupMSAMembership', 'ManagedPasswordIntervalInDays', 'msDS-RevealedDSAs', 'servicePrincipalName'
#'msDS-ManagedPasswordId', 'msDS-ManagedPasswordPreviousId'
)
$Accounts = Get-ADServiceAccount -Filter "*" -Server $QueryServer -Properties $Properties
$DmsaProperties = @(
'msDS-DelegatedMSAState', 'msDS-ManagedAccountPrecededByLink', 'msDS-SupersededAccountState', 'msDS-SupersededManagedServiceAccountLink', 'msDS-SupersededServiceAccountState'
)
$QueryProperties = if (Test-WinADSchemaAttribute -Name 'msDS-DelegatedMSAState' -Server $QueryServer) {
@($Properties + $DmsaProperties)
} else {
$Properties
}
try {
$Accounts = Get-ADServiceAccount -Filter "*" -Server $QueryServer -Properties $QueryProperties -ErrorAction Stop
} catch {
Write-Warning -Message "Get-WinADServiceAccount - Failed to query dMSA properties from $Domain using $($QueryServer). Retrying without dMSA-only properties. Error: $($_.Exception.Message)"
$Accounts = Get-ADServiceAccount -Filter "*" -Server $QueryServer -Properties $Properties
}
$Output[$Domain] = foreach ($Account in $Accounts) {
#$Account

Expand All @@ -69,11 +82,13 @@
} else {
$PasswordLastChangedDays = $null
}
$ServiceAccountType = ConvertTo-WinADServiceAccountType -ObjectClass $Account.ObjectClass
$SupportedEncryption = ConvertTo-WinADSupportedEncryptionTypes -Value $Account.'msDS-SupportedEncryptionTypes'

[PSCustomObject] @{
Name = $Account.Name
Enabled = $Account.Enabled # : True # : WO_SVC_Delete$
ServiceAccountType = $ServiceAccountType
ObjectClass = $Account.ObjectClass # : msDS-ManagedServiceAccount
CanonicalName = $Account.CanonicalName # : ad.evotec.xyz/Managed Service Accounts/WO_SVC_Delete
DomainName = ConvertFrom-DistinguishedName -ToDomainCN -DistinguishedName $Account.DistinguishedName
Expand All @@ -93,6 +108,11 @@
'msDS-GroupMSAMembershipOwner' = $Account.'msDS-GroupMSAMembership'.Owner
#'msDS-ManagedPasswordPreviousId' = $Account.'msDS-ManagedPasswordPreviousId'

'msDS-DelegatedMSAState' = $Account.'msDS-DelegatedMSAState'
'msDS-ManagedAccountPrecededByLink' = $Account.'msDS-ManagedAccountPrecededByLink'
'msDS-SupersededAccountState' = $Account.'msDS-SupersededAccountState'
'msDS-SupersededManagedServiceAccountLink' = $Account.'msDS-SupersededManagedServiceAccountLink'
'msDS-SupersededServiceAccountState' = $Account.'msDS-SupersededServiceAccountState'
'msDS-RevealedDSAs' = $Account.'msDS-RevealedDSAs'
'servicePrincipalName' = $Account.servicePrincipalName
AccountNotDelegated = $Account.AccountNotDelegated # : False
Expand All @@ -104,10 +124,10 @@
'msDS-SupportedEncryptionTypes' = $SupportedEncryption.RawValue
SupportedEncryptionTypesState = $SupportedEncryption.ValueState
SupportedEncryptionTypes = $SupportedEncryption.TypesText
UsesDomainEncryptionDefaults = $SupportedEncryption.UsesDomainDefaults
UsesAESKeys = $SupportedEncryption.UsesAESKeys
UsesRC4Encryption = $SupportedEncryption.UsesRC4Encryption
UsesDESEncryption = $SupportedEncryption.UsesDESEncryption
FallsBackToDomainEncryptionDefaults = $SupportedEncryption.FallsBackToDomainDefaults
SupportsAESKeys = $SupportedEncryption.SupportsAESKeys
SupportsRC4Encryption = $SupportedEncryption.SupportsRC4Encryption
SupportsDESEncryption = $SupportedEncryption.SupportsDESEncryption
EnforcesAESSessionKeys = $SupportedEncryption.EnforcesAESSessionKeys
msDSSupportedEncryptionTypes = $SupportedEncryption.Types
# 'msDS-User-Account-Control-Computed' = $Account.'msDS-User-Account-Control-Computed' # : 0
Expand Down
6 changes: 3 additions & 3 deletions Public/Get-WinADTrust.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,8 +141,8 @@
#'TrustedPolicy' = $null #$Trust.TrustedPolicy
#'TrustingPolicy' = $null #$Trust.TrustingPolicy
'UplevelOnly' = $TrustObject[$Trust.Details.TargetName].TrustAttributes -contains "UpLevel Only"
'UsesAESKeys' = $TrustObject[$Trust.Details.TargetName].msDSSupportedEncryptionTypes -contains "AES128-CTS-HMAC-SHA1-96" -or $TrustObject[$Trust.Details.TargetName].msDSSupportedEncryptionTypes -contains 'AES256-CTS-HMAC-SHA1-96'
'UsesRC4Encryption' = $TrustObject[$Trust.Details.TargetName].TrustAttributes -contains "Uses RC4 Encryption"
'SupportsAESKeys' = $TrustObject[$Trust.Details.TargetName].msDSSupportedEncryptionTypes -contains "AES128-CTS-HMAC-SHA1-96" -or $TrustObject[$Trust.Details.TargetName].msDSSupportedEncryptionTypes -contains 'AES256-CTS-HMAC-SHA1-96'
'SupportsRC4Encryption' = $TrustObject[$Trust.Details.TargetName].TrustAttributes -contains "Uses RC4 Encryption"
'EncryptionTypes' = $TrustObject[$Trust.Details.TargetName].msDSSupportedEncryptionTypes -join ', '
'TrustSourceDC' = $TrustStatus.TrustSourceDC
'TrustTargetDC' = $TrustStatus.TrustTargetDC
Expand Down Expand Up @@ -173,4 +173,4 @@
}
}
}
}
}
Loading
Loading