l0ss / grouper Goto Github PK

Hey there,

Thanks for this tool, I'm really excited about it but, at the same time, not entirely sure how to interpret some of the results. I ran this against a company's GPO XML export (using level 3) and the results were:

Get-GPOUserRights - All Policy
##############################

Name                           Value
----                           -----
Right                          SeMachineAccountPrivilege
Members                        NT AUTHORITY\Authenticated Users

I believe this interprets as "any authenticated user can join computers to the domain" - is that right? It would be awesome to have some context around the findings, like a default blurb of "Hey, this setting sometimes means X so you should check Y and Z."

Side note: I'm happy to provide such a blurb if that would be helpful. And also, this is the only time I've run Grouper so maybe the other findings have more verbose info in them?

Issue: There is a false positive which occurs if the ClearTextPassword setting is defined but the SettingBoolean is set to false. In this configuration, there is no value to this information for an attacker, and I believe it can be safely ignored.

Output:

Get-GPOAccountSettings - All Policy
###################################
SettingBoolean                 false
Name                           ClearTextPassword
Type                           Password

Thanks for releasing this, it looks like there are some errors with displaying the banner though:

Hi guys. Just noticed this script. Looks good.

Started writing myself something but only just seen this!

Might be worth having a read through my code and pulling in some of my lines and I’ll kill my repo?
https://github.com/phillips321/adaudit

FYI mines completely online.

Cheers and good work!

I couldn't do the Import-Module command. I generated the report on my AD Server and I tested on my own computer. It appeared the following error:

The specified module 'grouper.ps1' was not loaded because no valid module file was found in any module directory.
Line: 1 Character:14

• CategoryInfo : ResourceUnavailable: grouper.ps1:String [Import-Module], FileNotFoundException
• FullQualifiedErrorId : Modules_ModuleNotFound,Microsoft.PoweShell.Commands.ImportModuleCommand

My system: Windows 7 Pro x64

I also tested the importing on the AD Server Powershell Terminal and I got the same error. The only difference was that:
...
Line: 1 Character:1
...

My AD Server system: Windows Server 2012 R2 Standard