Week 10: Security audits

This week’s session was packed with even more actionable strategies to help harden your environment.

What we covered in week 10:

• Audit domain accounts  
• Audit and set fine-grained password policies  
• Enable Group Policy auditing  
• Disable mDNS
• Enable LDAP signing requirements

Copy the PowerShell Scripts

#Get all users
Import-Module ActiveDirectory
 
Get-ADUser -Filter * -Properties LastLogonTimeStamp, MemberOf |
Select-Object Name, SamAccountName,
    @{Name="LastLogonDate";Expression={[DateTime]::FromFileTime($_.LastLogonTimeStamp)}},
    @{Name="Groups";Expression={
        ($_.MemberOf | ForEach-Object {
            ($_ -split ',')[0] -replace '^CN='
        }) -join '; '
    }} |
Sort-Object LastLogonDate

‍

#Get Domain admins
Import-Module ActiveDirectory
 
# Get members of the Domain Admins group
Get-ADGroupMember -Identity "Domain Admins" -Recursive |
Where-Object { $_.objectClass -eq "user" } |
ForEach-Object {
    Get-ADUser $_ -Properties LastLogonTimeStamp, MemberOf
} |
Select-Object Name, SamAccountName,
    @{Name="LastLogonDate";Expression={[DateTime]::FromFileTime($_.LastLogonTimeStamp)}},
    @{Name="Groups";Expression={
        ($_.MemberOf | ForEach-Object {
            ($_ -split ',')[0] -replace '^CN='
        }) -join '; '
    }} |
Sort-Object LastLogonDate

‍

#See which users do not have a fine-grained password policy
Import-Module ActiveDirectory
 
# Get all users
$allUsers = Get-ADUser -Filter * -Properties msDS-ResultantPSO
 
# Filter users with no PSO applied
$excludedUsers = $allUsers | Where-Object { -not $_.'msDS-ResultantPSO' }
 
$excludedUsers | Select-Object Name, SamAccountName

‍A quick note

This webinar series is designed to be as technology-agnostic as possible. You don’t need ThreatLocker to participate, but it certainly helps.

If you want to follow along more easily, we’d be happy to help you get started with a ThreatLocker agent. Just book a complimentary, no-obligation 30-minute session with a ThreatLocker Solutions Engineer.

Stay on track

Download the week 10 checklist on this page to keep up with key tasks and harden your environment step by step.

Missed previous weeks? 

You can get caught up here.

‍We’ll see you in the week 11 webinar on Tuesday, July 22, 2025 at 8 a.m. PDT/ 11 a.m. EDT/ 4 p.m. BST!

‍