githubEdit

Enumerating Security Controls

Command
Description

Get-MpComputerStatus

PowerShell cmd-let used to check the status of Windows Defender Anti-Virus from a Windows-based host.

Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections

PowerShell cmd-let used to view AppLocker policies from a Windows-based host.

$ExecutionContext.SessionState.LanguageMode

PowerShell script used to discover the PowerShell Language Mode being used on a Windows-based host. Performed from a Windows-based host.

Find-LAPSDelegatedGroups

A LAPSToolkit function that discovers LAPS Delegated Groups from a Windows-based host.

Find-AdmPwdExtendedRights

A LAPSTookit function that checks the rights on each computer with LAPS enabled for any groups with read access and users with All Extended Rights. Performed from a Windows-based host.

Get-LAPSComputers

A LAPSToolkit function that searches for computers that have LAPS enabled, discover password expiration and can discover randomized passwords. Performed from a Windows-based host.

Last updated