Skip to content

Instantly share code, notes, and snippets.

@IISResetMe
Last active January 11, 2022 10:53
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save IISResetMe/f8e6fa1bc5037c0b01e0a288b4a566ff to your computer and use it in GitHub Desktop.
Save IISResetMe/f8e6fa1bc5037c0b01e0a288b4a566ff to your computer and use it in GitHub Desktop.
Poor man's audit policy parser
#Requires -Version 5
# Define AuditSetting enum
[System.Flags()]
enum AuditSetting {
None = 0
Success = 1
Failure = 2
All = 3
}
function Get-AuditPolicy
{
[CmdletBinding(DefaultParameterSetName = 'Category')]
param(
[Parameter(Mandatory = $false, ParameterSetName = 'Category')]
[ValidateNotNullOrEmpty()]
[Alias('Name')]
[string[]]$Category = '*',
[Parameter(Mandatory = $false, ParameterSetName = 'Subcategory')]
[ValidateNotNullOrEmpty()]
[string[]]$Subcategory
)
# Prepare auditpol arguments
$auditPolArgs = @("/get")
if($PSCmdlet.ParameterSetName -eq 'Category'){
$auditPolArgs += "/category:$($Category -join ',')"
}
else {
$auditPolArgs += "/subcategory:$($Subcategory -join ',')"
}
# Parse `auditpol` output
& 'auditpol' $auditPolArgs |?{$_.Trim()}|Select -Skip 2|%{
# No indentation? We've got a super-category name
if($_ -match '^\w'){
$CategoryName = $_.Trim()
}
else{
# Split the subcategory name from the setting
$SubcategoryName,$Setting = $_.Trim() -split '\s{2,}'
# Return customobject with appropriately structured audit settings
[pscustomobject]@{
Category = $CategoryName
SubCategory = $SubcategoryName
Setting = $(
$val = [AuditSetting]::None
switch -regex ($Setting){
'Success' {
$val += [AuditSetting]::Success
}
'Failure' {
$val += [AuditSetting]::Failure
}
}
$val
)
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment