p0w3rsh3ll / netcease Goto Github PK

Has anybody tried to audit failed requests? I'm thinking of a tweak like this so that the cmdlet takes a user-specified SDDL and that the default SDDL audits for failure.

`
Function Set-NetSessionEnumPermission {
[CmdletBinding(SupportsShouldProcess,ConfirmImpact='High')]

Param(
[Parameter(Mandatory = $false)] [string] $SDDL = "O:SYG:SYD:(A;;FA;;;S-1-5-3)(A;;FA;;;IU)(A;;FA;;;SU)(A;;CCDCRPSDRCWDWO;;;BA)(A;;CCDCRPSDRCWDWO;;;PU)(A;;CCDCRPSDRCWDWO;;;SO)S:(AU;FA;GA;;;WD)"

)
`