Active Directory PowerShell模块收集AD信息

﹏ヽ暗。殇╰゛Y 2024-04-07 11:00 69阅读 0赞

### **0x00 前言简介** ###

Microsoft为Windows Server 2008 R2(以及更高版本)提供了多个Active Directory PowerShell cmdlet，这大大简化了以前需要将涉及到的ADSI冗长代码行放在一起的任务。

在Windows客户端上，需要安装[远程服务器管理工具(RSAT)][RSAT]并确保已安装Active Directory PowerShell模块。而在Windows服务器(2008 R2或更高版本)上的 PowerShell控制台(作为管理员)中运行如下命令：Import-Module ServerManager ; Add-WindowsFeature RSAT-AD-PowerShell。

![c3422fee94e9d0f9697531c58adb3148.jpeg][]

### 0x01 AD的目录预览 ###

AD PowerShell cmdlet和以下方式执行效果一样：

Import-module activeDirectory

$UserID = “JoeUser”

Get-ADUser $UserID –property \*

需要值得注意的是使用PowerShell v3版本以及高版本，你无需运行第一行命令，因为PowerShell的将识别必要的模块和自动加载它。一旦加载了Active Directory PowerShell模块，就可以像浏览文件系统那样浏览AD。命令如下：

Ps> Import-module activeDirectory

Ps>dir ad:

Ps>set-location ad:

Ps >set-location “dc=lab,dc=adsecurity,dc=org”

Ps>dir

![d4cfd049d3ec8ba5fc51c2cd35bf46da.gif][]

### 0x02 查找有用的命令(Cmdlet) ###

**1.基本的模块和统计**

发现可用的PowerShell模块：Get-Module -ListAvailable

在PowerShell模块中发现cmdlet：Get-Command -module ActiveDirectory

PowerShell AD模块的Cmdlet个数：

(Get-Command -module ActiveDirectory).count

*  Windows Server 2008 R2: 76 cmdlets
 *  Windows Server 2012: 135 cmdlets
 *  Windows Server 2012 R2: 147 cmdlets
 *  Windows Server 2016: 147 cmdlets

WINDOWS SERVER 2008 R2主要的cmdlets：

• Get/Set-ADForest

• Get/Set-ADDomain

• Get/Set-ADDomainController

• Get/Set-ADUser

• Get/Set-ADComputer

• Get/Set-ADGroup

• Get/Set-ADGroupMember

• Get/Set-ADObject

• Get/Set-ADOrganizationalUnit

• Enable-ADOptionalFeature

• Disable/Enable-ADAccount

• Move-ADDirectoryServerOperationMasterRole

• New-ADUser

• New-ADComputer

• New-ADGroup

• New-ADObject

• New-ADOrganizationalUnit

WINDOWS SERVER 2012含以版本一些新的cmdlets:

• \*-ADResourcePropertyListMember

• \*-ADAuthenticationPolicy

• \*-ADAuthenticationPolicySilo

• \*-ADCentralAccessPolicy

• \*-ADCentralAccessRule

• \*-ADResourceProperty

• \*-ADResourcePropertyList

• \*-ADResourcePropertyValueType

• \*-ADDCCloneConfigFile

• \*-ADReplicationAttributeMetadata

• \*-ADReplicationConnection

• \*-ADReplicationFailure

• \*-ADReplicationPartnerMetadata

• \*-ADReplicationQueueOperation

• \*-ADReplicationSite

• \*-ADReplicationSiteLink

• \*-ADReplicationSiteLinkBridge

• \*-ADReplicationSubnet

• \*-ADReplicationUpToDatenessVectorTable

• Sync-ADObject

**2.发现全局目录 GLOBAL CATALOGS (GCS)**

• Forest GCs(森林全局目录)：

import-module ActiveDirectory

$ADForest = Get-ADForest

$ADForestGlobalCatalogs = $ADForest.GlobalCatalogs

• Domain DCs that are GCs(以域DCS的全局目录)：

import-module ActiveDirectory

$DCsNotGCs = Get-ADDomainController -filter \{ IsGlobalCatalog -eq $True\}

• Domain DCs that are not GCs(以非域DCS的全局目录)：

import-module ActiveDirectory

$DCsNotGCs = Get-ADDomainController -filter \{ IsGlobalCatalog -eq $False \}

**3.查找Active Directory灵活单主机操作(FSMO)角色**

活动目录模块：

(GET-ADForest).SchemaMaster

(GET-ADForest).DomainNamingMaster

(GET-ADDomain).InfrastructureMaster

(GET-ADDomain).PDCEmulator

(GET-ADDomain).RIDMaster

.NET调用：

•Get the Current Domain:  
\[System.DirectoryServices.ActiveDirectory.Domain\]::GetCurrentDomain().Name

\[System.DirectoryServices.ActiveDirectory.Domain\]::GetComputerDomain().Name  
• Get the Computer’s Site:\[System.DirectoryServices.ActiveDirectory.ActiveDirectorySite\]::GetComputerSite()  
• List All Domain Controllers in a Domain:\[System.DirectoryServices.ActiveDirectory.Domain\]::GetCurrentDomain().DomainControllers  
• Get Active Directory Domain Mode:\[System.DirectoryServices.ActiveDirectory.Domain\]::GetCurrentDomain().DomainMode  
• List Active Directory FSMOs:(\[System.DirectoryServices.ActiveDirectory.Forest\]::GetCurrentForest()).SchemaRoleOwner

(\[System.DirectoryServices.ActiveDirectory.Forest\]::GetCurrentForest()).NamingRoleOwner

(\[System.DirectoryServices.ActiveDirectory.Domain\]::GetCurrentDomain()).InfrastructureRoleOwner

(\[System.DirectoryServices.ActiveDirectory.Domain\]::GetCurrentDomain()).PdcRoleOwner

(\[System.DirectoryServices.ActiveDirectory.Domain\]::GetCurrentDomain()).RidRoleOwner

•Get Active Directory Forest Name:

\[System.DirectoryServices.ActiveDirectory.Forest\]::GetCurrentForest().Name

• Get a List of Sites in the Active Directory Forest:

\[array\] $ADSites = \[System.DirectoryServices.ActiveDirectory.Forest\]::GetCurrentForest().Sites

• Get Active Directory Forest Domains:

\[System.DirectoryServices.ActiveDirectory.Forest\]::GetCurrentForest().Domains

• Get Active Directory Forest Global Catalogs:

\[System.DirectoryServices.ActiveDirectory.Forest\]::GetCurrentForest().GlobalCatalogs

• Get Active Directory Forest Mode:

\[System.DirectoryServices.ActiveDirectory.Forest\]::GetCurrentForest().ForestMode

• Get Active Directory Forest Root Domain:

\[System.DirectoryServices.ActiveDirectory.Forest\]::GetCurrentForest().RootDomain

**4.FSMO角色从一个DC移动到另一个DC**

get-command -module activedirectory -noun \*Master\*

•Moving FSMO Roles:

Move-ADDirectoryServerOperationMasterRole -Identity $DCName -OperationMasterRole RIDMaster

Move-ADDirectoryServerOperationMasterRole -Identity $DCName -

OperationMasterRole DomainNamingMaster

Move-ADDirectoryServerOperationMasterRole -Identity $DCName -OperationMasterRole PDCEmulato

•Seizing FSMO Roles:

Move-ADDirectoryServerOperationMasterRole -Identity $DCName -OperationMasterRole PDCEmulator –FORCE

### 0x03 Active Directory PowerShell模块Cmdlet示例 ###

**1.Get-RootDSE**

获取有关LDAP服务器(域控制器)的信息并显示其内容，结果中有一些有趣的信息，比如DC运行的操作系统信息。

![dfe8f63bf608e53c669ebb127b98a0fd.gif][]

**2.Get-ADForest**

提供有关运行该命令计算机所在的Active Directory森林信息。

![a0df2b463c6863b6ea2464c704a6e125.gif][]

**3.Get-ADDomain**

提供有关当前所在域的信息

![f8f463a8b6c65b1341ab705b0cc004f5.gif][]

**4.Get-ADDomainController**

提供特定于域控制器的计算机信息，通过cmdlet命令，可轻松查找到特定站点中的所有DC或运行OS版本信息。

![748f7433df56a793be1ca70d0f0cc953.gif][]

**5.Get-ADComputer**

提供了关于AD中大多数计算机对象的信息，使用“-Prop \*”参数运行的命令可以显示所有标准属性信息。

![08638d1088a1162d48a91e2274f0912a.gif][]

**6. AD计算机的统计**

$Time = (Measure-Command \`

\{\[array\] $AllComputers = Get-ADComputer -filter \* -properties

Name,CanonicalName,Enabled,passwordLastSet,SAMAccountName,LastLogonTimeSt

amp,DistinguishedName,OperatingSystem \}).TotalMinutes

$AllComputersCount = $AllComputers.Count

Write-Output “There were $AllComputersCount Computers discovered in

$DomainDNS in $Time minutes… \`r “

**7.Get-ADUser**

提供了想要了解有关AD用户的大部分内容信息，使用“-Prop \*”参数运行的命令可以显示所有标准属性信息。

![2f55d28d9a19c4b4fade306ea6eef23e.gif][]

**8. AD用户的统计**

import-Module ActiveDirectory

$DomainDNS = \[System.DirectoryServices.ActiveDirectory.Domain\]::GetCurrentDomain().Name

\[array\]$AllUsers = Get-ADUser -filter \* -properties

Name,DistinguishedName,Enabled,LastLogonDate,LastLogonTimeStamp,LockedOut,msExchHom

eServerName,SAMAccountName

$AllUsersCount = $AllUsers.Count

Write-Output “There were $AllUsersCount user objects discovered in $ADDomainDNSRoot … “

\[array\] $DisabledUsers = $AllUsers | Where-Object \{ $\_.Enabled -eq $False \}

$DisabledUsersCount = $DisabledUsers.Count

\[array\] $EnabledUsers = $AllUsers | Where-Object \{ $\_.Enabled -eq $True \}

$EnabledUsersCount = $EnabledUsers.Count

Write-Output “There are $EnabledUsersCount Enabled users and there are $DisabledUsersCount

Disabled users in $DomainDNS “

**9.Get-ADGroup**

提供有关AD组的信息，运行如下命令可查找所有安全组：  
Get-ADGroup -Filter \{GroupCategory -eq ‘Security\}

![ed36bff5c79377ca54d276e72e77bcd6.gif][]

**10.Get-ADGroupMember**

枚举并返回组成员信息，使用”-Recursive”参数可包括嵌套组的所有成员。  
Get-ADGroupMember ‘Administrators’ -Recursive

![2c3b53ac017cac17db548b6125cdc2a2.gif][]

**11.查找非活动计算机**

以下示例查找非活动(旧版本)计算机和用户：在过去10天内未更改其密码的帐户。请注意，这是一个测试示例。对于实际的生产环境，将此建议更改为计算机的60到90天，用户的180到365天的策略。

![d9118b18422a780a1fd5b601f88b23d7.gif][]

**12.查找非活动用户**

![79f334c97f8fae30cb5995835da3b614.gif][]

**13.枚举域信任**

![2610ddeaea6666fd25206a6967438a10.gif][]

**14.获取活动目录的实施日期**

![ac2567101f146344a73bf2acff6246ac.jpeg][]

**15.获取AD密码策略**

![069d46f7383d2316d1b211ce76611ccb.jpeg][]

**16.获取AD站点信息**请注意Windows 2012模块中包含站点的cmdlet([Get-ADReplicationSite][] \*)。

![b48e0812f117c3a55b6d3df4159dc30e.gif][]

**17. 获得tombstonelifetime信息**

![1d14e0b703c048985832e84091beef0e.jpeg][]

**18.AD的回收信息**

Requires Forest Functional Mode = Windows Server 2008 R2

• Enable the Recycle Bin (as Enterprise Admin)

Enable-ADOptionalFeature –Identity ‘CN=Recycle Bin Feature,CN=Optional Features,CN=Directory

Service,CN=Windows NT,CN=Services,CN=Configuration,DC=DOMAIN,DC=COM’ –Scope

ForestOrConfigurationSet –Target ‘DOMAIN.COM’

• Find all Deleted Users

$DeletedUsers = Get-ADObject -SearchBase “CN=Deleted Objects,DC=DOMAIN,DC=COM” -Filter

\{ObjectClass -eq “user”\} -IncludeDeletedObjects -Properties lastKnownParent

• Restore all Deleted Users

$DeletedUsers | Restore-ADObject

• Restore users deleted on a specific date

$ChangeDate = Get-Date (“1/1/2015″)

Get-ADObject -Filter \{ (whenChanged -eq $changeDate) -and (isDeleted -eq $true) -and (name -ne

“Deleted Objects”) -and (ObjectClass -eq “user”) \} -IncludeDeletedObjects -Properties \* | RestoreADObject

**19.DOMAIN RID STATS(域 rid 统计)**

![ed9b332d1f9c3387befe26548a1e0082.jpeg][]

**20.备份域GPO**请注意，这需要安装组策略PowerShell模块，该模块与Active Directory模块分开。

![730d945e97692e2060c2dba2be86d5d6.gif][]

**21.查找AD Kerberos服务帐户**

![5b40e2635510cb437ca0a9b0fe89d94c.gif][]

**22. 服务账号脚本**

![6c9b8cc598b54687057d7da9aa1b62aa.jpeg][]

[https://github.com/PyroTek3/PowerShell-AD-Recon/blob/master/Find-PSServiceAccounts][https_github.com_PyroTek3_PowerShell-AD-Recon_blob_master_Find-PSServiceAccounts]

使用SPNS在AD中发现服务：SQl

![eb1bc7acc8654172f4612e571a379f36.jpeg][]

列出SQL服务：

![39afd98c318bc42a58c8c185f481bf35.jpeg][]

[https://github.com/PyroTek3/PowerShell-AD-Recon/blob/master/Discover-PSMSSQLServers][https_github.com_PyroTek3_PowerShell-AD-Recon_blob_master_Discover-PSMSSQLServers]

**23.列出域控制器**Get-ADDomainController-filter \* | \`select hostname，IPv4Address，IsGlobalCatalog，IsReadOnly，OperatingSystem | \`format-table -auto

![1af5cdfdd3dd24b78d78de7cd85415e4.gif][]24.DOMAIN CONTROLLERS DISCOVERY(域控制器的发现)

• Discover PDCe in domain(发现域的PDCe)  
Get-ADDomainController –Discover –ForceDiscover –Service “PrimaryDC” –  
DomainName “lab.adsecurity.org”  
• Discover DCs in a Site(发现站点的DCs)  
Get-ADDomainController –Discover –Site “HQ”  
• Find all Read-Only Domain Controllers that are GCs(查找所有作为GCs的只读域控制器)  
Get-ADDomainController –filter \`  
\{ (isGlobalCatalog –eq $True) –AND (isReadOnly –eq $True) \}

**25.AD数据库完整性检查**

Write-Output "Checking the NTDS database for errors (semantic database

analysis) \`r "

Stop-Service ntds -force

$NTDSdbChecker = ntdsutil "activate instance ntds" "semantic database

analysis" "verbose on" "Go" q q

Start-Service ntds

Write-Output "Results of Active Directory database integrity check: \`r "

$NTDSdbChecker

**26.Get-ADReplicationPartnerMetadata**

Windows Server 2012及更高版本，此命令用于显示目标DC复制伙伴的复制元数据

![1a9a27fb632d1b2fdd1cc95b8575229b.gif][]

**27.Get-ADReplicationPartnerFailure**

提供有关DC复制失败状态的信息，此命令显示AD复制错误的描述，CMDLETS (2012)

![660756cc7b8330cb1eb9c4d5457c910d.gif][]

**28.Get-ADReplicationUptodatenessVectorTable**

跟踪域控制器之间的复制状态，CMDLETS (2012)

![3d957f746c608a8f9cba514dd364f0f1.gif][]

**29.AD Web服务(ADWS)**

需要在目标DC上运行AD Web服务(ADWS)(TCP 9389)

Get-ADDomainController –Discover –Service “ADWS”

**30.REPADMIN(目录复制工具) VS. POWERSHELL**

<table> 
 <tbody> 
 <tr> 
 <td> REPADMIN </td> 
 <td> PowerShell </td> 
 </tr> 
 <tr> 
 <td>&nbsp;</td> 
 <td> 2012 Cmdlets </td> 
 </tr> 
 <tr> 
 <td> /FailCache </td> 
 <td> Get-ADReplicationFailure </td> 
 </tr> 
 <tr> 
 <td> /Queue </td> 
 <td> Get-ADReplicationQueueOperation </td> 
 </tr> 
 <tr> 
 <td> /ReplSingleObj </td> 
 <td> Sync-ADObject </td> 
 </tr> 
 <tr> 
 <td> /ShowConn </td> 
 <td> Get-ADReplicationConnection </td> 
 </tr> 
 <tr> 
 <td> /ShowObjMeta </td> 
 <td> Get-ADReplicationAttributeMetadata </td> 
 </tr> 
 <tr> 
 <td> /ShowRepl /ReplSum </td> 
 <td> Get-ADReplicationPartnerMetadata </td> 
 </tr> 
 <tr> 
 <td> /ShowUTDVec </td> 
 <td> Get-ADReplicationUpToDatenessVectorTable </td> 
 </tr> 
 <tr> 
 <td> /SiteOptions </td> 
 <td> Set-ADReplicationSite </td> 
 </tr> 
 <tr> 
 <td>&nbsp;</td> 
 <td> 2008 R2 Cmdlets </td> 
 </tr> 
 <tr> 
 <td> /ShowAttr </td> 
 <td> Get-ADObject </td> 
 </tr> 
 <tr> 
 <td> /SetAttr </td> 
 <td> Set-ADObject </td> 
 </tr> 
 <tr> 
 <td> /PRP </td> 
 <td> Get-ADDomainControllerPasswordReplicationPolicy </td> 
 </tr> 
 <tr> 
 <td> Add-ADDomainControllerPasswordReplicationPolicy </td> 
 <td>&nbsp;</td> 
 </tr> 
 <tr> 
 <td> Remove-ADDomainControllerPasswordReplicationPolicy </td> 
 <td>&nbsp;</td> 
 </tr> 
 <tr> 
 <td> Get-ADAccountResultantPasswordReplicationPolicy </td> 
 <td>&nbsp;</td> 
 </tr> 
 <tr> 
 <td> Get-ADDomainControllerPasswordReplicationPolicyUsage </td> 
 <td>&nbsp;</td> 
 </tr> 
 </tbody> 
</table>

[RSAT]: https://www.microsoft.com/en-us/download/details.aspx?id=45520
[c3422fee94e9d0f9697531c58adb3148.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/5f0cfcfeb5ee4a1f997f1c92daf8dcab.jpeg
[d4cfd049d3ec8ba5fc51c2cd35bf46da.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/1a853053b0034374a008cf284f0bc7cb.gif
[dfe8f63bf608e53c669ebb127b98a0fd.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/69347f876ae04a2ca0786cfd960612da.gif
[a0df2b463c6863b6ea2464c704a6e125.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/26a274f77a6a49e69b163e4a594d24bd.gif
[f8f463a8b6c65b1341ab705b0cc004f5.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/2a6ee6a88b9e4b8cb079e48b1b61fa01.gif
[748f7433df56a793be1ca70d0f0cc953.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9f258d1102894716ba4403bb7ce35cef.gif
[08638d1088a1162d48a91e2274f0912a.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/97e09c08d5394bc5b68611a98a21a94c.gif
[2f55d28d9a19c4b4fade306ea6eef23e.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/744772dd3a144a57b834b64cb1e80307.gif
[ed36bff5c79377ca54d276e72e77bcd6.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/72844ba844c741bf91893fc287336bfd.gif
[2c3b53ac017cac17db548b6125cdc2a2.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/5b508afae72b403ebe02b60028a03b9c.gif
[d9118b18422a780a1fd5b601f88b23d7.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/37d0cc73ad984c57802fdf59d81e0903.gif
[79f334c97f8fae30cb5995835da3b614.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/90101d81381944ba8ad56125a986a057.gif
[2610ddeaea6666fd25206a6967438a10.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/fd02813b349446a1812fab7fea1a0163.gif
[ac2567101f146344a73bf2acff6246ac.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e7e6a69c9d494d789f14d473a54323c9.jpeg
[069d46f7383d2316d1b211ce76611ccb.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/00024f5584d94aa591c7c18183fbc984.jpeg
[Get-ADReplicationSite]: https://technet.microsoft.com/en-us/library/hh852269%28v=wps.630%29.aspx
[b48e0812f117c3a55b6d3df4159dc30e.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/66bc2618c3d5441a82112947b1211e39.gif
[1d14e0b703c048985832e84091beef0e.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/af8db43ba07b4dd883eb0d83b1d54cb8.jpeg
[ed9b332d1f9c3387befe26548a1e0082.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/ba94b79b290e47b99a53ffea965aa967.jpeg
[730d945e97692e2060c2dba2be86d5d6.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/6a18c4c2c4004f7aa2d503d5f83c1a3c.gif
[5b40e2635510cb437ca0a9b0fe89d94c.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/2a4085c97b114eb6913116522b657116.gif
[6c9b8cc598b54687057d7da9aa1b62aa.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/489ed59b8df1459e924c3fd5e3cf7a0d.jpeg
[https_github.com_PyroTek3_PowerShell-AD-Recon_blob_master_Find-PSServiceAccounts]: https://github.com/PyroTek3/PowerShell-AD-Recon/blob/master/Find-PSServiceAccounts
[eb1bc7acc8654172f4612e571a379f36.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/fcc2a087707045f09b21510dc55c4fa3.jpeg
[39afd98c318bc42a58c8c185f481bf35.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/019eb5fbd6714b63bb4bf80e4da955d1.jpeg
[https_github.com_PyroTek3_PowerShell-AD-Recon_blob_master_Discover-PSMSSQLServers]: https://github.com/PyroTek3/PowerShell-AD-Recon/blob/master/Discover-PSMSSQLServers
[1af5cdfdd3dd24b78d78de7cd85415e4.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/672703e533aa4931844b8f0aa0cf10f6.gif
[1a9a27fb632d1b2fdd1cc95b8575229b.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c45cd6d5a9e7493ab7d4b493e2419719.gif
[660756cc7b8330cb1eb9c4d5457c910d.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/05f182e81b24420c8a0ce53297b4f92c.gif
[3d957f746c608a8f9cba514dd364f0f1.gif]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/636f60ccdec0442fa39d7f5da264c09b.gif