☰

修改 Query-InsecureLDAPBinds.ps1

tag-icon • tag-icon windows powershell
修改 Query-InsecureLDAPBinds.ps1

试图弄清楚如何添加此脚本在

https://github.com/russelltomkins/Active-Directory/blob/master/Query-InsecureLDAPBinds.ps1

我尝试在 $user 的行下添加各种变体$Time = $eventXML.event.System.TimeCreatedSystemTime，但没有任何成功，而且我不确定如何添加此信息。我还在 $Row.User = $User 下添加了以下内容

$Row.Time = $Time





 # Prepare Variables
    Param (
            [parameter(Mandatory=$false,Position=0)][String]$ComputerName = "localhost",
            [parameter(Mandatory=$false,Position=1)][Int]$Hours = 24)

    # Create an Array to hold our returnedvValues
    $InsecureLDAPBinds = @()

    # Grab the appropriate event entries
    $Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{Logname='Directory Service';Id=2889; StartTime=(get-date).AddHours("-$Hours")}

    # Loop through each event and output the 
    ForEach ($Event in $Events) { 
        $eventXML = [xml]$Event.ToXml()

        # Build Our Values
        $Client = ($eventXML.event.EventData.Data[0])
        $IPAddress = $Client.SubString(0,$Client.LastIndexOf(":")) #Accomodates for IPV6 Addresses
        $Port = $Client.SubString($Client.LastIndexOf(":")+1) #Accomodates for IPV6 Addresses
        $User = $eventXML.event.EventData.Data[1]
        Switch ($eventXML.event.EventData.Data[2])
            {
            0 {$BindType = "Unsigned"}
            1 {$BindType = "Simple"}
            }

        # Add Them To a Row in our Array
        $Row = "" | select IPAddress,Port,User,BindType
        $Row.IPAddress = $IPAddress
        $Row.Port = $Port
        $Row.User = $User
        $Row.BindType = $BindType

        # Add the row to our Array
        $InsecureLDAPBinds += $Row
    }
    # Dump it all out to a CSV.
    Write-Host $InsecureLDAPBinds.Count "records saved to .\InsecureLDAPBinds.csv for Domain Controller" $ComputerName
    $InsecureLDAPBinds | Export-CSV -NoTypeInformation .\InsecureLDAPBinds.csv

答案1

您可以在事件本身中获取它，而无需解析 XML：

$Time = $Event.TimeCreated

相关内容