报告帐户锁定策略设置的 Powershell 脚本？

Question

我有几台外网电脑，不允许安装PS AD模块。

我只想使用 Powershell 报告一些帐户锁定设置，特别是锁定阈值、锁定持续时间以及这台机器是否被锁定。

我在搜索过程中发现的只是使用 Active Directory PS 模块的信息。此外，处理 remoteAccess 的其他参考资料。 都不符合我的需要。

我还查找了与“本地”锁定设置相关的注册表项，但没有找到任何内容（例如，仅引用 remoteaccess maxDenial；而不是本地设置）。

除了启动 gpedit 并查看本地策略之外，我希望有一种方法可以使用 Powershell 来简单地报告当前的本地设置。

无论如何帮助/指针/知识将不胜感激。

Answer 1

从“网络帐户”中发现此信息最终对我有用，并且我能够编写一个快速显示锁定策略信息的脚本。以下是“净账户”的输出：

PS C:\Users\Siduser> net accounts

Force user logoff how long after time expires?:       0
Minimum password age (days):                          1
Maximum password age (days):                          60
Minimum password length:                              14
Length of password history maintained:                24
Lockout threshold:                                    3
Lockout duration (minutes):                           15
Lockout observation window (minutes):                 15
Computer role:                                        WORKSTATION
The command completed successfully.

创建此代码 sn-p 是为了将信息放入变量中：

$lockoutObj = net accounts | Select-string threshold
$lockoutStr = $lockoutObj.ToString()
$lockoutStr -match '\d{1,3}' | out-null
$LO_threshold = $matches[0]

PS C:\Users\Siduser> echo $LO_threshold
3

如果您需要设置锁定阈值，请使用此命令（需要提升权限）：

PS C:\Users\Siduser> net accounts /lockoutthreshold:10
The command completed successfully

PS C:\Users\Siduser> net accounts

Force user logoff how long after time expires?:       0
Minimum password age (days):                          1
Maximum password age (days):                          60
Minimum password length:                              14
Length of password history maintained:                24
Lockout threshold:                                    10
Lockout duration (minutes):                           15
Lockout observation window (minutes):                 15
Computer role:                                        WORKSTATION
The command completed successfully.

Answer 2

啊，受限，那么，你陷入了众所周知的陷阱22。

但是，如果它们不是域的一部分，那么这意味着您或其他人也必须手动进行这些设置。所以，我不确定 AD cmdlet 是如何出现的，因为这些不是加入域的机器，并且设置在本地策略中。

因此，secedit.exe 是您完成这项工作的工具，或者利用 MS powershellgallery.com 中的 PolicyFileEditor 模块和/或其他模块之一。

Find-Module -Name '*policy*' | Format-Table -AutoSize

Version  Name                                          Repository Description                                                                                       
-------  ----                                          ---------- -----------                                                                                       
...
3.0.1    PolicyFileEditor                              PSGallery  Commands and DSC resource for modifying Administrative Templates settings in local GPO registry...
2.10.0.0 SecurityPolicyDsc                             PSGallery  This module is a wrapper around secedit.exe which provides the ability to configure user rights...
...
0.3      GPRegistryPolicy                              PSGallery  Module with cmdlets to work with GP Registry Policy .pol files                                    
0.2      GPRegistryPolicyParser                        PSGallery  Module with parser cmdlets to work with GP Registry Policy .pol files                             
1.1.0    GPRegistryPolicyDsc                           PSGallery  This resource module contains DSC resources used to apply and manage local group policies by mo...
...
1.0.1    GroupPolicyHelper                             PSGallery  Functions that ease your daily Group Policy Work                                                  
1.3.2    Indented.SecurityPolicy                       PSGallery  Security management functions and resources                                                       
...
1.0      ADPolicyAudit                                 PSGallery  Module to review infrastructure password policy 

对于 Secedit.exe，有​​几篇关于这种用例的帖子和使用 'secedit lockout policy' 的快速网络搜索会告诉你这一点。例如，您最终可能会得到this sort of effort。

Clear-Host
$temp = "D:\temp"
$file = "$temp\pol.txt"
#[string] $readableNames

$outHash = @{}

$process = [diagnostics.process]::Start("secedit.exe", "/export /cfg $file /areas securitypolicy")
$process.WaitForExit()

$in = get-content $file

foreach ($line in $in) 
{
    if ($line -like "*password*" -or $line -like "*lockout*" -and $line -notlike "machine\*" -and $line -notlike "require*" ) 
    {
        $policy = $line.substring(0,$line.IndexOf("=") - 1)

        switch ($policy){
        "passwordhistorysize"   {$policy = "Enforce Password Policy"}
        "maximumpasswordage"    {$policy = "Maximum Password Age"}
        "minimumpasswordage"    {$policy = "Minimum Password Age"}
        "minimumpasswordlength" {$policy = "Minimum Password Length"}
        "passwordcomplexity"    {$policy = "Password must meet complexity requirements"}
        "cleartextpassword"     {$policy = "Store Passwords Using Reversible Encryption"}
        "lockoutduration"       {$policy = "Account Lockout Duration"}
        "lockoutbadaccount"     {$policy = "Account Lockout Threshold"}
        "resetlockoutcount"     {$policy = "Reset Account Lockout Counter After"}
        }

        $values = $line.substring($line.IndexOf("=") + 1,$line.Length - ($line.IndexOf("=") + 1))
        #$values =  $values.Trim({}) -split ","

        $outHash.Add($policy,$values) #output edited version
    }
}
$outHash | 
Format-Table -AutoSize