100 days to secure your environment webinar series: Week 10

Week 10: Security audits

This week’s session was packed with even more actionable strategies to help harden your environment.

What we covered in week 10:

• Audit domain accounts  
• Audit and set fine-grained password policies  
• Enable Group Policy auditing  
• Disable mDNS
• Enable LDAP signing requirements

Copy the PowerShell Scripts

#Get all users
Import-Module ActiveDirectory
 
Get-ADUser -Filter * -Properties LastLogonTimeStamp, MemberOf |
Select-Object Name, SamAccountName,
    @{Name="LastLogonDate";Expression={[DateTime]::FromFileTime($_.LastLogonTimeStamp)}},
    @{Name="Groups";Expression={
        ($_.MemberOf | ForEach-Object {
            ($_ -split ',')[0] -replace '^CN='
        }) -join '; '
    }} |
Sort-Object LastLogonDate

‍

#Get Domain admins
Import-Module ActiveDirectory
 
# Get members of the Domain Admins group
Get-ADGroupMember -Identity "Domain Admins" -Recursive |
Where-Object { $_.objectClass -eq "user" } |
ForEach-Object {
    Get-ADUser $_ -Properties LastLogonTimeStamp, MemberOf
} |
Select-Object Name, SamAccountName,
    @{Name="LastLogonDate";Expression={[DateTime]::FromFileTime($_.LastLogonTimeStamp)}},
    @{Name="Groups";Expression={
        ($_.MemberOf | ForEach-Object {
            ($_ -split ',')[0] -replace '^CN='
        }) -join '; '
    }} |
Sort-Object LastLogonDate

‍

#See which users do not have a fine-grained password policy
Import-Module ActiveDirectory
 
# Get all users
$allUsers = Get-ADUser -Filter * -Properties msDS-ResultantPSO
 
# Filter users with no PSO applied
$excludedUsers = $allUsers | Where-Object { -not $_.'msDS-ResultantPSO' }
 
$excludedUsers | Select-Object Name, SamAccountName

A quick note

This webinar series is designed to be as technology-agnostic as possible. You don’t need ThreatLocker to participate, but it certainly helps.

If you want to follow along more easily, we’d be happy to help you get started with a ThreatLocker agent. Just book a demo to chat with a ThreatLocker Solutions Engineer and get a 30-day free trial to the entire ThreatLocker platform.

Stay on track

Download the week 10 checklist on this page to keep up with key tasks and harden your environment step by step.

Missed previous weeks? 

You can get caught up here.

‍