Below is the function I’ve written to, check a file for audit permissions, and if it isnt met it then attempts to add them.
It seems to work ok except when say…c:\test needs failure with full control audited and later change permissions set to success. Each audit just overwrites all other audits. I thought changing
$ACL.setAuditRule($AccessRule)
to
$ACL.addAuditRule($AccessRule)
But it still just removes all audits and sets the audits to what was just passed to it, instead of adding the additional audits.
function test-audit($path, $user, $flags, $audit, $notes, $section)
{
if(test-path $path)
{
#full control = DeleteSubdirectoriesAndFiles, Modify, ChangePermissions, TakeOwnership
if(((get-acl $path -audit).audit) | ? {$_.identityreference -eq $user})
{
if((((get-acl $path -Audit).audit) | ? {$_.identityreference -eq $user -and $_.auditflags -like "*"+$flags+"*" -and $_.filesystemrights -eq $audit}))
{
write-host "Audit met"
$mv = "$path has the correct OSR Auditing."
$state = "Passed"
add-content whatever.csv ""
}
else
{
try
{
write-host "try 1"
if(get-item $path)
{
$acl = (Get-Item $path -erroraction stop).GetAccessControl('Access')
}
else
{
$ACL = $path | Get-Acl -Audit -ErrorAction Stop
}
$AccessRule = New-Object System.Security.AccessControl.FileSystemAuditRule($user,$audit,"None","None",$flags)
$ACL.addAuditRule($AccessRule)
$ACL | Set-Acl $path -ErrorAction Stop
write-host "Setting Audit Rules on $path"
$mv = "$path has the correct OSR Auditing."
$state = "Passed"
add-content whatever.csv ""
}
catch
{
write-host "Entered the catch 1"
$mv = $error[0]
$state = "Failed"
write-host "$mv"
add-content whatever.csv ""
}
}
}
else
{
try
{
write-host "try 2"
if(get-item $path)
{
$acl = (Get-Item $path -erroraction stop).GetAccessControl('Access')
}
else
{
$ACL = $path | Get-Acl -Audit -ErrorAction Stop
}
$AccessRule = New-Object System.Security.AccessControl.FileSystemAuditRule($user,$audit,"None","None",$flags)
$ACL.addAuditRule($AccessRule)
$ACL | Set-Acl $path -ErrorAction Stop
write-host "Setting Audit Rules on $path"
$mv = "$path has the correct OSR Auditing."
$state = "Passed"
add-content whatever.csv ""
}
catch
{
write-host "Entered the catch 2"
$mv = $error[0]
$state = "Failed"
write-host "$mv"
add-content whatever.csv ""
}
}
}
else
{
write-host "loop3, file doesnt exist"
$mv = "File or directory does not exist"
$state = "Passed"
add-content whatever.csv ""
}
}
I also noticed I can’t change some files in the windows folder, even as an administrator running powershell with elevated privileges…I CAN make these changes through explorer, but not through powershell
Attempted to perform an unauthorized operation.
PS C:\Users\IBM_ADMIN\Desktop\SCAN> $error[0]
Set-Acl : Attempted to perform an unauthorized operation.
At line:30 char:35
+ $ACL | Set-Acl <<<< $path -ErrorAction Stop
+ CategoryInfo : PermissionDenied: (C:\Windows\System32\winload.exe:String) [Set-Acl], UnauthorizedAccess
Exception
+ FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.SetAclCommand