Invoke-ScriptSentry.ps1

function Invoke-ScriptSentry{
<#
.SYNOPSIS
ScriptSentry finds misconfigured and dangerous logon scripts.

.DESCRIPTION
ScriptSentry searches the NETLOGON share & Group Policy to
    1) identify plaintext credentials in logon scripts
    2) identify admins that have logon script set
    3) identify scripts and shares that may have dangerous permissions

.EXAMPLE
Invoke-ScriptSentry

.EXAMPLE
Invoke-ScriptSentry | Out-File c:\temp\ScriptSentry.txt

.EXAMPLE
Invoke-ScriptSentry -SaveOutput $true

.EXAMPLE
Invoke-ScriptSentry -SaveOutput $true -OutputDirectory c:\ScriptSentry

#>
[CmdletBinding(DefaultParameterSetName = 'Default')]
Param(
    [boolean]$SaveOutput = $false,
    [string]$OutputDirectory = '',

    [Management.Automation.PSCredential]
    [Management.Automation.CredentialAttribute()]
    $Credential = [Management.Automation.PSCredential]::Empty,

    [Parameter(Mandatory = $true, ParameterSetName = 'Server')]
    [string]$Server,

    [Parameter(Mandatory = $true, ParameterSetName = 'Server')]
    [string]$Domain
)

function Get-ScriptSentryForestDomains {
    [CmdletBinding()]
    param()

    $forest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
    $forest.Domains
}
function Get-ScriptSentryDomain {
    [OutputType([System.DirectoryServices.ActiveDirectory.Domain])]
    [CmdletBinding()]
    Param(
        [Parameter(Position = 0, ValueFromPipeline = $True)]
        [ValidateNotNullOrEmpty()]
        [String]
        $Domain,

        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty
    )

    PROCESS {
        if ($PSBoundParameters['Credential']) {

            Write-Verbose '[Get-ScriptSentryDomain] Using alternate credentials for Get-ScriptSentryDomain'

            if ($PSBoundParameters['Domain']) {
                $TargetDomain = $Domain
            }
            else {
                # if no domain is supplied, extract the logon domain from the PSCredential passed
                $TargetDomain = $Credential.GetNetworkCredential().Domain
                Write-Verbose "[Get-ScriptSentryDomain] Extracted domain '$TargetDomain' from -Credential"
            }

            $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $TargetDomain, $Credential.UserName, $Credential.GetNetworkCredential().Password)

            try {
                [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext)
            }
            catch {
                Write-Verbose "[Get-ScriptSentryDomain] The specified domain '$TargetDomain' does not exist, could not be contacted, there isn't an existing trust, or the specified credentials are invalid: $_"
            }
        }
        elseif ($PSBoundParameters['Domain']) {
            $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $Domain)
            try {
                [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext)
            }
            catch {
                Write-Verbose "[Get-ScriptSentryDomain] The specified domain '$Domain' does not exist, could not be contacted, or there isn't an existing trust : $_"
            }
        }
        else {
            try {
                [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
            }
            catch {
                Write-Verbose "[Get-ScriptSentryDomain] Error retrieving the current domain: $_"
            }
        }
    }
}
function Get-ScriptSentryDomainSearcher {
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')]
    [OutputType('System.DirectoryServices.DirectorySearcher')]
    [CmdletBinding()]
    Param(
        [Parameter(ValueFromPipeline = $True)]
        [ValidateNotNullOrEmpty()]
        [String]
        $Domain,

        [ValidateNotNullOrEmpty()]
        [Alias('Filter')]
        [String]
        $LDAPFilter,

        [ValidateNotNullOrEmpty()]
        [String[]]
        $Properties,

        [ValidateNotNullOrEmpty()]
        [Alias('ADSPath')]
        [String]
        $SearchBase,

        [ValidateNotNullOrEmpty()]
        [String]
        $SearchBasePrefix,

        [ValidateNotNullOrEmpty()]
        [Alias('DomainController')]
        [String]
        $Server,

        [ValidateSet('Base', 'OneLevel', 'Subtree')]
        [String]
        $SearchScope = 'Subtree',

        [ValidateRange(1, 10000)]
        [Int]
        $ResultPageSize = 200,

        [ValidateRange(1, 10000)]
        [Int]
        $ServerTimeLimit = 120,

        [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]
        [String]
        $SecurityMasks,

        [Switch]
        $Tombstone,

        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty
    )

    PROCESS {
        if ($PSBoundParameters['Domain']) {
            $TargetDomain = $Domain

            if ($ENV:USERDNSDOMAIN -and ($ENV:USERDNSDOMAIN.Trim() -ne '')) {
                # see if we can grab the user DNS logon domain from environment variables
                $UserDomain = $ENV:USERDNSDOMAIN
                if ($ENV:LOGONSERVER -and ($ENV:LOGONSERVER.Trim() -ne '') -and $UserDomain) {
                    $BindServer = "$($ENV:LOGONSERVER -replace '\\','').$UserDomain"
                }
            }
        }
        elseif ($PSBoundParameters['Credential']) {
            # if not -Domain is specified, but -Credential is, try to retrieve the current domain name with Get-ScriptSentryDomain
            $DomainObject = Get-ScriptSentryDomain -Credential $Credential
            $BindServer = ($DomainObject.PdcRoleOwner).Name
            $TargetDomain = $DomainObject.Name
        }
        elseif ($ENV:USERDNSDOMAIN -and ($ENV:USERDNSDOMAIN.Trim() -ne '')) {
            # see if we can grab the user DNS logon domain from environment variables
            $TargetDomain = $ENV:USERDNSDOMAIN
            if ($ENV:LOGONSERVER -and ($ENV:LOGONSERVER.Trim() -ne '') -and $TargetDomain) {
                $BindServer = "$($ENV:LOGONSERVER -replace '\\','').$TargetDomain"
            }
        }
        else {
            # otherwise, resort to Get-ScriptSentryDomain to retrieve the current domain object
            write-verbose "Get-ScriptSentryDomain"
            $DomainObject = Get-ScriptSentryDomain
            $BindServer = ($DomainObject.PdcRoleOwner).Name
            $TargetDomain = $DomainObject.Name
        }

        if ($PSBoundParameters['Server']) {
            # if there's not a specified server to bind to, try to pull a logon server from ENV variables
            $BindServer = $Server
        }

        $SearchString = 'LDAP://'

        if ($BindServer -and ($BindServer.Trim() -ne '')) {
            $SearchString += $BindServer
            if ($TargetDomain) {
                $SearchString += '/'
            }
        }

        if ($PSBoundParameters['SearchBasePrefix']) {
            $SearchString += $SearchBasePrefix + ','
        }

        if ($PSBoundParameters['SearchBase']) {
            if ($SearchBase -Match '^GC://') {
                # if we're searching the global catalog, get the path in the right format
                $DN = $SearchBase.ToUpper().Trim('/')
                $SearchString = ''
            }
            else {
                if ($SearchBase -match '^LDAP://') {
                    if ($SearchBase -match "LDAP://.+/.+") {
                        $SearchString = ''
                        $DN = $SearchBase
                    }
                    else {
                        $DN = $SearchBase.SubString(7)
                    }
                }
                else {
                    $DN = $SearchBase
                }
            }
        }
        else {
            # transform the target domain name into a distinguishedName if an ADS search base is not specified
            if ($TargetDomain -and ($TargetDomain.Trim() -ne '')) {
                $DN = "DC=$($TargetDomain.Replace('.', ',DC='))"
            }
        }

        $SearchString += $DN
        Write-Verbose "[Get-ScriptSentryDomainSearcher] search base: $SearchString"

        if ($Credential -ne [Management.Automation.PSCredential]::Empty) {
            Write-Verbose "[Get-ScriptSentryDomainSearcher] Using alternate credentials for LDAP connection"
            # bind to the inital search object using alternate credentials
            $DomainObject = New-Object DirectoryServices.DirectoryEntry($SearchString, $Credential.UserName, $Credential.GetNetworkCredential().Password)
            $Searcher = New-Object System.DirectoryServices.DirectorySearcher($DomainObject)
        }
        else {
            # bind to the inital object using the current credentials
            $Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$SearchString)
        }

        $Searcher.PageSize = $ResultPageSize
        $Searcher.SearchScope = $SearchScope
        $Searcher.CacheResults = $False
        $Searcher.ReferralChasing = [System.DirectoryServices.ReferralChasingOption]::All

        if ($PSBoundParameters['ServerTimeLimit']) {
            $Searcher.ServerTimeLimit = $ServerTimeLimit
        }

        if ($PSBoundParameters['Tombstone']) {
            $Searcher.Tombstone = $True
        }

        if ($PSBoundParameters['LDAPFilter']) {
            $Searcher.filter = $LDAPFilter
        }

        if ($PSBoundParameters['SecurityMasks']) {
            $Searcher.SecurityMasks = Switch ($SecurityMasks) {
                'Dacl' { [System.DirectoryServices.SecurityMasks]::Dacl }
                'Group' { [System.DirectoryServices.SecurityMasks]::Group }
                'None' { [System.DirectoryServices.SecurityMasks]::None }
                'Owner' { [System.DirectoryServices.SecurityMasks]::Owner }
                'Sacl' { [System.DirectoryServices.SecurityMasks]::Sacl }
            }
        }

        if ($PSBoundParameters['Properties']) {
            # handle an array of properties to load w/ the possibility of comma-separated strings
            $PropertiesToLoad = $Properties| ForEach-Object { $_.Split(',') }
            $Null = $Searcher.PropertiesToLoad.AddRange(($PropertiesToLoad))
        }

        $Searcher
    }
}
function Get-ScriptSentryDomainGroupMember {
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')]
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')]
    [OutputType('ScriptSentry.GroupMember')]
    [CmdletBinding(DefaultParameterSetName = 'None')]
    Param(
        [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]
        [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]
        [String[]]
        $Identity,

        [ValidateNotNullOrEmpty()]
        [String]
        $Domain,

        [Parameter(ParameterSetName = 'ManualRecurse')]
        [Switch]
        $Recurse,

        [Parameter(ParameterSetName = 'RecurseUsingMatchingRule')]
        [Switch]
        $RecurseUsingMatchingRule,

        [ValidateNotNullOrEmpty()]
        [Alias('Filter')]
        [String]
        $LDAPFilter,

        [ValidateNotNullOrEmpty()]
        [Alias('ADSPath')]
        [String]
        $SearchBase,

        [ValidateNotNullOrEmpty()]
        [Alias('DomainController')]
        [String]
        $Server,

        [ValidateSet('Base', 'OneLevel', 'Subtree')]
        [String]
        $SearchScope = 'Subtree',

        [ValidateRange(1, 10000)]
        [Int]
        $ResultPageSize = 200,

        [ValidateRange(1, 10000)]
        [Int]
        $ServerTimeLimit,

        [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]
        [String]
        $SecurityMasks,

        [Switch]
        $Tombstone,

        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty
    )

    BEGIN {
        $SearcherArguments = @{
            'Properties' = 'member,samaccountname,distinguishedname'
        }
        if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }
        if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter }
        if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }
        if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }
        if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }
        if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }
        if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }
        if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }
        if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }

        $ADNameArguments = @{}
        if ($PSBoundParameters['Domain']) { $ADNameArguments['Domain'] = $Domain }
        if ($PSBoundParameters['Server']) { $ADNameArguments['Server'] = $Server }
        if ($PSBoundParameters['Credential']) { $ADNameArguments['Credential'] = $Credential }
    }

    PROCESS {
        $GroupSearcher = Get-ScriptSentryDomainSearcher @SearcherArguments
        if ($GroupSearcher) {
            if ($PSBoundParameters['RecurseUsingMatchingRule']) {
                $SearcherArguments['Identity'] = $Identity
                $SearcherArguments['Raw'] = $True
                $Group = Get-DomainGroup @SearcherArguments

                if (-not $Group) {
                    Write-Warning "[Get-ScriptSentryDomainGroupMember] Error searching for group with identity: $Identity"
                }
                else {
                    $GroupFoundName = $Group.properties.item('samaccountname')[0]
                    $GroupFoundDN = $Group.properties.item('distinguishedname')[0]

                    if ($PSBoundParameters['Domain']) {
                        $GroupFoundDomain = $Domain
                    }
                    else {
                        # if a domain isn't passed, try to extract it from the found group distinguished name
                        if ($GroupFoundDN) {
                            $GroupFoundDomain = $GroupFoundDN.SubString($GroupFoundDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'
                        }
                    }
                    Write-Verbose "[Get-ScriptSentryDomainGroupMember] Using LDAP matching rule to recurse on '$GroupFoundDN', only user accounts will be returned."
                    $GroupSearcher.filter = "(&(samAccountType=805306368)(memberof:1.2.840.113556.1.4.1941:=$GroupFoundDN))"
                    $GroupSearcher.PropertiesToLoad.AddRange(('distinguishedName'))
                    $Members = $GroupSearcher.FindAll() | ForEach-Object {$_.Properties.distinguishedname[0]}
                }
                $Null = $SearcherArguments.Remove('Raw')
            }
            else {
                $IdentityFilter = ''
                $Filter = ''
                $Identity | Where-Object {$_} | ForEach-Object {
                    $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')
                    if ($IdentityInstance -match '^S-1-') {
                        $IdentityFilter += "(objectsid=$IdentityInstance)"
                    }
                    elseif ($IdentityInstance -match '^CN=') {
                        $IdentityFilter += "(distinguishedname=$IdentityInstance)"
                        if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {
                            # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname
                            #   and rebuild the domain searcher
                            $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'
                            Write-Verbose "[Get-ScriptSentryDomainGroupMember] Extracted domain '$IdentityDomain' from '$IdentityInstance'"
                            $SearcherArguments['Domain'] = $IdentityDomain
                            $GroupSearcher = Get-ScriptSentryDomainSearcher @SearcherArguments
                            if (-not $GroupSearcher) {
                                Write-Warning "[Get-ScriptSentryDomainGroupMember] Unable to retrieve domain searcher for '$IdentityDomain'"
                            }
                        }
                    }
                    elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') {
                        $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join ''
                        $IdentityFilter += "(objectguid=$GuidByteString)"
                    }
                    elseif ($IdentityInstance.Contains('\')) {
                        $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical
                        if ($ConvertedIdentityInstance) {
                            $GroupDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/'))
                            $GroupName = $IdentityInstance.Split('\')[1]
                            $IdentityFilter += "(samAccountName=$GroupName)"
                            $SearcherArguments['Domain'] = $GroupDomain
                            Write-Verbose "[Get-ScriptSentryDomainGroupMember] Extracted domain '$GroupDomain' from '$IdentityInstance'"
                            $GroupSearcher = Get-ScriptSentryDomainSearcher @SearcherArguments
                        }
                    }
                    else {
                        $IdentityFilter += "(samAccountName=$IdentityInstance)"
                    }
                }

                if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {
                    $Filter += "(|$IdentityFilter)"
                }

                if ($PSBoundParameters['LDAPFilter']) {
                    Write-Verbose "[Get-ScriptSentryDomainGroupMember] Using additional LDAP filter: $LDAPFilter"
                    $Filter += "$LDAPFilter"
                }

                $GroupSearcher.filter = "(&(objectCategory=group)$Filter)"
                Write-Verbose "[Get-ScriptSentryDomainGroupMember] Get-ScriptSentryDomainGroupMember filter string: $($GroupSearcher.filter)"
                try {
                    $Result = $GroupSearcher.FindOne()
                }
                catch {
                    Write-Warning "[Get-ScriptSentryDomainGroupMember] Error searching for group with identity '$Identity': $_"
                    $Members = @()
                }

                $GroupFoundName = ''
                $GroupFoundDN = ''

                if ($Result) {
                    $Members = $Result.properties.item('member')

                    if ($Members.count -eq 0) {
                        # ranged searching, thanks @meatballs__ !
                        $Finished = $False
                        $Bottom = 0
                        $Top = 0

                        while (-not $Finished) {
                            $Top = $Bottom + 1499
                            $MemberRange="member;range=$Bottom-$Top"
                            $Bottom += 1500
                            $Null = $GroupSearcher.PropertiesToLoad.Clear()
                            $Null = $GroupSearcher.PropertiesToLoad.Add("$MemberRange")
                            $Null = $GroupSearcher.PropertiesToLoad.Add('samaccountname')
                            $Null = $GroupSearcher.PropertiesToLoad.Add('distinguishedname')

                            try {
                                $Result = $GroupSearcher.FindOne()
                                $RangedProperty = $Result.Properties.PropertyNames -like "member;range=*"
                                $Members += $Result.Properties.item($RangedProperty)
                                $GroupFoundName = $Result.properties.item('samaccountname')[0]
                                $GroupFoundDN = $Result.properties.item('distinguishedname')[0]

                                if ($Members.count -eq 0) {
                                    $Finished = $True
                                }
                            }
                            catch [System.Management.Automation.MethodInvocationException] {
                                $Finished = $True
                            }
                        }
                    }
                    else {
                        $GroupFoundName = $Result.properties.item('samaccountname')[0]
                        $GroupFoundDN = $Result.properties.item('distinguishedname')[0]
                        $Members += $Result.Properties.item($RangedProperty)
                    }

                    if ($PSBoundParameters['Domain']) {
                        $GroupFoundDomain = $Domain
                    }
                    else {
                        # if a domain isn't passed, try to extract it from the found group distinguished name
                        if ($GroupFoundDN) {
                            $GroupFoundDomain = $GroupFoundDN.SubString($GroupFoundDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'
                        }
                    }
                }
            }

            ForEach ($Member in $Members) {
                if ($Recurse -and $UseMatchingRule) {
                    $Properties = $_.Properties
                }
                else {
                    $ObjectSearcherArguments = $SearcherArguments.Clone()
                    $ObjectSearcherArguments['Identity'] = $Member
                    $ObjectSearcherArguments['Raw'] = $True
                    $ObjectSearcherArguments['Properties'] = 'distinguishedname,cn,samaccountname,objectsid,objectclass'
                    $Object = Get-ScriptSentryDomainObject @ObjectSearcherArguments
                    $Properties = $Object.Properties
                }

                if ($Properties) {
                    $GroupMember = New-Object PSObject
                    $GroupMember | Add-Member Noteproperty 'GroupDomain' $GroupFoundDomain
                    $GroupMember | Add-Member Noteproperty 'GroupName' $GroupFoundName
                    $GroupMember | Add-Member Noteproperty 'GroupDistinguishedName' $GroupFoundDN

                    if ($Properties.objectsid) {
                        $MemberSID = ((New-Object System.Security.Principal.SecurityIdentifier $Properties.objectsid[0], 0).Value)
                    }
                    else {
                        $MemberSID = $Null
                    }

                    try {
                        $MemberDN = $Properties.distinguishedname[0]
                        if ($MemberDN -match 'ForeignSecurityPrincipals|S-1-5-21') {
                            try {
                                if (-not $MemberSID) {
                                    $MemberSID = $Properties.cn[0]
                                }
                                $MemberSimpleName = Convert-ADName -Identity $MemberSID -OutputType 'DomainSimple' @ADNameArguments

                                if ($MemberSimpleName) {
                                    $MemberDomain = $MemberSimpleName.Split('@')[1]
                                }
                                else {
                                    Write-Warning "[Get-ScriptSentryDomainGroupMember] Error converting $MemberDN"
                                    $MemberDomain = $Null
                                }
                            }
                            catch {
                                Write-Warning "[Get-ScriptSentryDomainGroupMember] Error converting $MemberDN"
                                $MemberDomain = $Null
                            }
                        }
                        else {
                            # extract the FQDN from the Distinguished Name
                            $MemberDomain = $MemberDN.SubString($MemberDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'
                        }
                    }
                    catch {
                        $MemberDN = $Null
                        $MemberDomain = $Null
                    }

                    if ($Properties.samaccountname) {
                        # forest users have the samAccountName set
                        $MemberName = $Properties.samaccountname[0]
                    }
                    else {
                        # external trust users have a SID, so convert it
                        try {
                            $MemberName = ConvertFrom-SID -ObjectSID $Properties.cn[0] @ADNameArguments
                        }
                        catch {
                            # if there's a problem contacting the domain to resolve the SID
                            $MemberName = $Properties.cn[0]
                        }
                    }

                    if ($Properties.objectclass -match 'computer') {
                        $MemberObjectClass = 'computer'
                    }
                    elseif ($Properties.objectclass -match 'group') {
                        $MemberObjectClass = 'group'
                    }
                    elseif ($Properties.objectclass -match 'user') {
                        $MemberObjectClass = 'user'
                    }
                    else {
                        $MemberObjectClass = $Null
                    }
                    $GroupMember | Add-Member Noteproperty 'MemberDomain' $MemberDomain
                    $GroupMember | Add-Member Noteproperty 'MemberName' $MemberName
                    $GroupMember | Add-Member Noteproperty 'MemberDistinguishedName' $MemberDN
                    $GroupMember | Add-Member Noteproperty 'MemberObjectClass' $MemberObjectClass
                    $GroupMember | Add-Member Noteproperty 'MemberSID' $MemberSID
                    $GroupMember.PSObject.TypeNames.Insert(0, 'ScriptSentry.GroupMember')
                    $GroupMember

                    # if we're doing manual recursion
                    if ($PSBoundParameters['Recurse'] -and $MemberDN -and ($MemberObjectClass -match 'group')) {
                        Write-Verbose "[Get-ScriptSentryDomainGroupMember] Manually recursing on group: $MemberDN"
                        $SearcherArguments['Identity'] = $MemberDN
                        $Null = $SearcherArguments.Remove('Properties')
                        Get-ScriptSentryDomainGroupMember @SearcherArguments
                    }
                }
            }
            $GroupSearcher.dispose()
        }
    }
}
function Get-ScriptSentryDomainUser {
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')]
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')]
    [OutputType('ScriptSentry.User')]
    [OutputType('ScriptSentry.User.Raw')]
    [CmdletBinding(DefaultParameterSetName = 'AllowDelegation')]
    Param(
            [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]
            [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]
            [String[]]
            $Identity,

            [Switch]
            $SPN,

            [Switch]
            $AdminCount,

            [Parameter(ParameterSetName = 'AllowDelegation')]
            [Switch]
            $AllowDelegation,

            [Parameter(ParameterSetName = 'DisallowDelegation')]
            [Switch]
            $DisallowDelegation,

            [Switch]
            $TrustedToAuth,

            [Alias('KerberosPreauthNotRequired', 'NoPreauth')]
            [Switch]
            $PreauthNotRequired,

            [ValidateNotNullOrEmpty()]
            [String]
            $Domain,

            [ValidateNotNullOrEmpty()]
            [Alias('Filter')]
            [String]
            $LDAPFilter,

            [ValidateNotNullOrEmpty()]
            [String[]]
            $Properties,

            [ValidateNotNullOrEmpty()]
            [Alias('ADSPath')]
            [String]
            $SearchBase,

            [ValidateNotNullOrEmpty()]
            [Alias('DomainController')]
            [String]
            $Server,

            [ValidateSet('Base', 'OneLevel', 'Subtree')]
            [String]
            $SearchScope = 'Subtree',

            [ValidateRange(1, 10000)]
            [Int]
            $ResultPageSize = 200,

            [ValidateRange(1, 10000)]
            [Int]
            $ServerTimeLimit,

            [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]
            [String]
            $SecurityMasks,

            [Switch]
            $Tombstone,

            [Alias('ReturnOne')]
            [Switch]
            $FindOne,

            [Management.Automation.PSCredential]
            [Management.Automation.CredentialAttribute()]
            $Credential = [Management.Automation.PSCredential]::Empty,

            [Switch]
            $Raw
        )
    BEGIN {
            $SearcherArguments = @{}
            if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }
            if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }
            if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }
            if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }
            if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }
            if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }
            if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }
            if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }
            if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }
            if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }
            $UserSearcher = Get-ScriptSentryDomainSearcher @SearcherArguments
        }

    PROCESS {
            if ($UserSearcher) {
                $IdentityFilter = ''
                $Filter = ''
                $Identity | Where-Object {$_} | ForEach-Object {
                    $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')
                    if ($IdentityInstance -match '^S-1-') {
                        $IdentityFilter += "(objectsid=$IdentityInstance)"
                    }
                    elseif ($IdentityInstance -match '^CN=') {
                        $IdentityFilter += "(distinguishedname=$IdentityInstance)"
                        if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {
                            # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname
                            #   and rebuild the domain searcher
                            $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'
                            Write-Verbose "[Get-ScriptSentryDomainUser] Extracted domain '$IdentityDomain' from '$IdentityInstance'"
                            $SearcherArguments['Domain'] = $IdentityDomain
                            $UserSearcher = Get-ScriptSentryDomainSearcher @SearcherArguments
                            if (-not $UserSearcher) {
                                Write-Warning "[Get-ScriptSentryDomainUser] Unable to retrieve domain searcher for '$IdentityDomain'"
                            }
                        }
                    }
                    elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') {
                        $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join ''
                        $IdentityFilter += "(objectguid=$GuidByteString)"
                    }
                    elseif ($IdentityInstance.Contains('\')) {
                        $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical
                        if ($ConvertedIdentityInstance) {
                            $UserDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/'))
                            $UserName = $IdentityInstance.Split('\')[1]
                            $IdentityFilter += "(samAccountName=$UserName)"
                            $SearcherArguments['Domain'] = $UserDomain
                            Write-Verbose "[Get-ScriptSentryDomainUser] Extracted domain '$UserDomain' from '$IdentityInstance'"
                            $UserSearcher = Get-ScriptSentryDomainSearcher @SearcherArguments
                        }
                    }
                    else {
                        $IdentityFilter += "(samAccountName=$IdentityInstance)"
                    }
                }

                if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {
                    $Filter += "(|$IdentityFilter)"
                }

                if ($PSBoundParameters['SPN']) {
                    Write-Verbose '[Get-ScriptSentryDomainUser] Searching for non-null service principal names'
                    $Filter += '(servicePrincipalName=*)'
                }
                if ($PSBoundParameters['AllowDelegation']) {
                    Write-Verbose '[Get-ScriptSentryDomainUser] Searching for users who can be delegated'
                    # negation of "Accounts that are sensitive and not trusted for delegation"
                    $Filter += '(!(userAccountControl:1.2.840.113556.1.4.803:=1048574))'
                }
                if ($PSBoundParameters['DisallowDelegation']) {
                    Write-Verbose '[Get-ScriptSentryDomainUser] Searching for users who are sensitive and not trusted for delegation'
                    $Filter += '(userAccountControl:1.2.840.113556.1.4.803:=1048574)'
                }
                if ($PSBoundParameters['AdminCount']) {
                    Write-Verbose '[Get-ScriptSentryDomainUser] Searching for adminCount=1'
                    $Filter += '(admincount=1)'
                }
                if ($PSBoundParameters['TrustedToAuth']) {
                    Write-Verbose '[Get-ScriptSentryDomainUser] Searching for users that are trusted to authenticate for other principals'
                    $Filter += '(msds-allowedtodelegateto=*)'
                }
                if ($PSBoundParameters['PreauthNotRequired']) {
                    Write-Verbose '[Get-ScriptSentryDomainUser] Searching for user accounts that do not require kerberos preauthenticate'
                    $Filter += '(userAccountControl:1.2.840.113556.1.4.803:=4194304)'
                }
                if ($PSBoundParameters['LDAPFilter']) {
                    Write-Verbose "[Get-ScriptSentryDomainUser] Using additional LDAP filter: $LDAPFilter"
                    $Filter += "$LDAPFilter"
                }

                # build the LDAP filter for the dynamic UAC filter value
                $UACFilter | Where-Object {$_} | ForEach-Object {
                    if ($_ -match 'NOT_.*') {
                        $UACField = $_.Substring(4)
                        $UACValue = [Int]($UACEnum::$UACField)
                        $Filter += "(!(userAccountControl:1.2.840.113556.1.4.803:=$UACValue))"
                    }
                    else {
                        $UACValue = [Int]($UACEnum::$_)
                        $Filter += "(userAccountControl:1.2.840.113556.1.4.803:=$UACValue)"
                    }
                }

                $UserSearcher.filter = "(&(samAccountType=805306368)$Filter)"
                Write-Verbose "[Get-ScriptSentryDomainUser] filter string: $($UserSearcher.filter)"

                if ($PSBoundParameters['FindOne']) { $Results = $UserSearcher.FindOne() }
                else { $Results = $UserSearcher.FindAll() }
                $Results | Where-Object {$_} | ForEach-Object {
                    if ($PSBoundParameters['Raw']) {
                        # return raw result objects
                        $User = $_
                        $User.PSObject.TypeNames.Insert(0, 'ScriptSentry.User.Raw')
                    }
                    else {
                        $User = Convert-LDAPProperty -Properties $_.Properties
                        $User.PSObject.TypeNames.Insert(0, 'ScriptSentry.User')
                    }
                    $User
                }
                if ($Results) {
                    try { $Results.dispose() }
                    catch {
                        Write-Verbose "[Get-ScriptSentryDomainUser] Error disposing of the Results object: $_"
                    }
                }
                $UserSearcher.dispose()
            }
        }
}
function Get-ScriptSentryDomainObject {
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')]
    [OutputType('ScriptSentry.ADObject')]
    [OutputType('ScriptSentry.ADObject.Raw')]
    [CmdletBinding()]
    Param(
        [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]
        [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]
        [String[]]
        $Identity,

        [ValidateNotNullOrEmpty()]
        [String]
        $Domain,

        [ValidateNotNullOrEmpty()]
        [Alias('Filter')]
        [String]
        $LDAPFilter,

        [ValidateNotNullOrEmpty()]
        [String[]]
        $Properties,

        [ValidateNotNullOrEmpty()]
        [Alias('ADSPath')]
        [String]
        $SearchBase,

        [ValidateNotNullOrEmpty()]
        [Alias('DomainController')]
        [String]
        $Server,

        [ValidateSet('Base', 'OneLevel', 'Subtree')]
        [String]
        $SearchScope = 'Subtree',

        [ValidateRange(1, 10000)]
        [Int]
        $ResultPageSize = 200,

        [ValidateRange(1, 10000)]
        [Int]
        $ServerTimeLimit,

        [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]
        [String]
        $SecurityMasks,

        [Switch]
        $Tombstone,

        [Alias('ReturnOne')]
        [Switch]
        $FindOne,

        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty,

        [Switch]
        $Raw
    )

    BEGIN {
        $SearcherArguments = @{}
        if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }
        if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }
        if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }
        if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }
        if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }
        if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }
        if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }
        if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }
        if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }
        if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }
        $ObjectSearcher = Get-ScriptSentryDomainSearcher @SearcherArguments
    }

    PROCESS {
        if ($ObjectSearcher) {
            $IdentityFilter = ''
            $Filter = ''
            $Identity | Where-Object {$_} | ForEach-Object {
                $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')
                if ($IdentityInstance -match '^S-1-') {
                    $IdentityFilter += "(objectsid=$IdentityInstance)"
                }
                elseif ($IdentityInstance -match '^(CN|OU|DC)=') {
                    $IdentityFilter += "(distinguishedname=$IdentityInstance)"
                    if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {
                        # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname
                        #   and rebuild the domain searcher
                        $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'
                        Write-Verbose "[Get-ScriptSentryDomainObject] Extracted domain '$IdentityDomain' from '$IdentityInstance'"
                        $SearcherArguments['Domain'] = $IdentityDomain
                        $ObjectSearcher = Get-ScriptSentryDomainSearcher @SearcherArguments
                        if (-not $ObjectSearcher) {
                            Write-Warning "[Get-ScriptSentryDomainObject] Unable to retrieve domain searcher for '$IdentityDomain'"
                        }
                    }
                }
                elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') {
                    $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join ''
                    $IdentityFilter += "(objectguid=$GuidByteString)"
                }
                elseif ($IdentityInstance.Contains('\')) {
                    $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical
                    if ($ConvertedIdentityInstance) {
                        $ObjectDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/'))
                        $ObjectName = $IdentityInstance.Split('\')[1]
                        $IdentityFilter += "(samAccountName=$ObjectName)"
                        $SearcherArguments['Domain'] = $ObjectDomain
                        Write-Verbose "[Get-ScriptSentryDomainObject] Extracted domain '$ObjectDomain' from '$IdentityInstance'"
                        $ObjectSearcher = Get-ScriptSentryDomainSearcher @SearcherArguments
                    }
                }
                elseif ($IdentityInstance.Contains('.')) {
                    $IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance)(dnshostname=$IdentityInstance))"
                }
                else {
                    $IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance)(displayname=$IdentityInstance))"
                }
            }
            if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {
                $Filter += "(|$IdentityFilter)"
            }

            if ($PSBoundParameters['LDAPFilter']) {
                Write-Verbose "[Get-ScriptSentryDomainObject] Using additional LDAP filter: $LDAPFilter"
                $Filter += "$LDAPFilter"
            }

            # build the LDAP filter for the dynamic UAC filter value
            $UACFilter | Where-Object {$_} | ForEach-Object {
                if ($_ -match 'NOT_.*') {
                    $UACField = $_.Substring(4)
                    $UACValue = [Int]($UACEnum::$UACField)
                    $Filter += "(!(userAccountControl:1.2.840.113556.1.4.803:=$UACValue))"
                }
                else {
                    $UACValue = [Int]($UACEnum::$_)
                    $Filter += "(userAccountControl:1.2.840.113556.1.4.803:=$UACValue)"
                }
            }

            if ($Filter -and $Filter -ne '') {
                $ObjectSearcher.filter = "(&$Filter)"
            }
            Write-Verbose "[Get-ScriptSentryDomainObject] Get-ScriptSentryDomainObject filter string: $($ObjectSearcher.filter)"

            if ($PSBoundParameters['FindOne']) { $Results = $ObjectSearcher.FindOne() }
            else { $Results = $ObjectSearcher.FindAll() }
            $Results | Where-Object {$_} | ForEach-Object {
                if ($PSBoundParameters['Raw']) {
                    # return raw result objects
                    $Object = $_
                    $Object.PSObject.TypeNames.Insert(0, 'ScriptSentry.ADObject.Raw')
                }
                else {
                    $Object = Convert-LDAPProperty -Properties $_.Properties
                    $Object.PSObject.TypeNames.Insert(0, 'ScriptSentry.ADObject')
                }
                $Object
            }
            if ($Results) {
                try { $Results.dispose() }
                catch {
                    Write-Verbose "[Get-ScriptSentryDomainObject] Error disposing of the Results object: $_"
                }
            }
            $ObjectSearcher.dispose()
        }
    }
}
function Get-LogonScripts {
    [CmdletBinding()]
    param(
        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty,

        [string]
        $Domain,

        [string]
        $Server
    )

    # Get the current domain name from the environment
    # $currentDomain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
    if ($Domain) {
        $Domains = $Domain
    } else {
        $Domains = Get-ScriptSentryForestDomains
    }

    foreach ($Domain in $Domains) {
        $DomainName = if ($Domain -is [string]) { $Domain } else { $Domain.Name }
        # $SysvolScripts = '\\' + (Get-ADDomain).DNSRoot + '\sysvol\' + (Get-ADDomain).DNSRoot + '\scripts'
        if ($Server) {
            $SysvolScripts = "\\$Server\sysvol\$DomainName\scripts"
        } else {
            $SysvolScripts = "\\$DomainName\sysvol\$DomainName\scripts"
        }
        $ExtensionList = '.bat|.vbs|.ps1|.cmd|.kix'
        $LogonScripts = try {
            Get-ChildItem -LiteralPath $SysvolScripts -Recurse -File -ErrorAction Stop |
                Where-Object { $_.Extension -match $ExtensionList }
        } catch {}
        Write-Verbose "[+] Logon scripts:"
        $LogonScripts | ForEach-Object {
            Write-Verbose -Message "$($_.fullName)"
        }
        $LogonScripts | Sort-Object -Unique
    }
}
function Get-GPOLogonScripts {
    [CmdletBinding()]
    param(
        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty,

        [string]
        $Domain,

        [string]
        $Server
    )

    # Get the current domain name from the environment
    # $currentDomain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
    if ($Domain) {
        $Domains = $Domain
    } else {
        $Domains = Get-ScriptSentryForestDomains
    }

    foreach ($Domain in $Domains) {
        $DomainName = if ($Domain -is [string]) { $Domain } else { $Domain.Name }
        if ($Server) {
            $Policies = Get-ChildItem "\\$Server\SYSVOL\$DomainName\POLICIES\" -ErrorAction SilentlyContinue
        } else {
            $Policies = Get-ChildItem "\\$DomainName\SysVol\$DomainName\Policies" -ErrorAction SilentlyContinue
        }
        $Policies | ForEach-Object {
            $GPOLogonScripts = Get-Content -Path "$($_.FullName)\User\Scripts\scripts.ini" -ErrorAction SilentlyContinue | Select-String -Pattern "\\\\.*\.\w+" | ForEach-Object { $_.Matches.Value }
            Write-Verbose "[+] GPO Logon scripts:"
            $GPOLogonScripts | ForEach-Object {
                Write-Verbose -Message "$($_.fullName)"
            }
            if ($GPOLogonScripts) {
                Get-Item -Path $GPOLogonScripts | Sort-Object -Unique
            }
        }
    }
}
function Get-NetlogonSysvol {
    [CmdletBinding()]
    param(
        [string]
        $Domain,

        [string]
        $Server
    )

    if ($Domain) {
        $Domains = $Domain
    } else {
        $Domains = Get-ScriptSentryForestDomains
    }
    foreach ($Domain in $Domains){
        $DomainName = if ($Domain -is [string]) { $Domain } else { $Domain.Name }
        if ($Server) {
            "\\$Server\NETLOGON"
            "\\$Server\SYSVOL"
        } else {
            "\\$DomainName\NETLOGON"
            "\\$DomainName\SYSVOL"
        }
    }
}
function Get-Art($Version) {
"
 _______  _______  _______ _________ _______ _________ _______  _______  _       _________ _______
(  ____ \(  ____ \(  ____ )\__   __/(  ____ )\__   __/(  ____ \(  ____ \( (    /|\__   __/(  ____ )|\     /|
| (    \/| (    \/| (    )|   ) (   | (    )|   ) (   | (    \/| (    \/|  \  ( |   ) (   | (    )|( \   / )
| (_____ | |      | (____)|   | |   | (____)|   | |   | (_____ | (__    |   \ | |   | |   | (____)| \ (_) /
(_____  )| |      |     __)   | |   |  _____)   | |   (_____  )|  __)   | (\ \) |   | |   |     __)  \   /
      ) || |      | (\ (      | |   | (         | |         ) || (      | | \   |   | |   | (\ (      ) (
/\____) || (____/\| ) \ \_____) (___| )         | |   /\____) || (____/\| )  \  |   | |   | ) \ \__   | |
\_______)(_______/|/   \__/\_______/|/          )_(   \_______)(_______/|/    )_)   )_(   |/   \__/   \_/
                              by: Spencer Alessi @techspence
                                          v$Version
                                      __,_______
                                     / __.==---/ * * * * * *
                                    / (-'
                                    `-'
                           Setting phasers to stun, please wait..
"
}
function Convert-LDAPProperty {
<#
.SYNOPSIS

Helper that converts specific LDAP property result fields and outputs
a custom psobject.

Author: Will Schroeder (@harmj0y)
License: BSD 3-Clause
Required Dependencies: None

.DESCRIPTION

Converts a set of raw LDAP properties results from ADSI/LDAP searches
into a proper PSObject. Used by several of the Get-ScriptSentryDomain* function.

.PARAMETER Properties

Properties object to extract out LDAP fields for display.

.OUTPUTS

System.Management.Automation.PSCustomObject

A custom PSObject with LDAP hashtable properties translated.
#>

    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')]
    [OutputType('System.Management.Automation.PSCustomObject')]
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory = $True, ValueFromPipeline = $True)]
        [ValidateNotNullOrEmpty()]
        $Properties
    )

    PROCESS {
        $ObjectProperties = @{}

        $Properties.PropertyNames | ForEach-Object {
            if ($_ -ne 'adspath') {
                if (($_ -eq 'objectsid') -or ($_ -eq 'sidhistory')) {
                    # convert all listed sids (i.e. if multiple are listed in sidHistory)
                    #$ObjectProperties[$_] = $Properties[$_] | ForEach-Object { (New-Object System.Security.Principal.SecurityIdentifier($_, 0)).Value }
                }
                        elseif ($_ -eq 'grouptype') {
                #$ObjectProperties[$_] = $Properties[$_][0] -as $GroupTypeEnum
            }
                        elseif ($_ -eq 'samaccounttype') {
                #$ObjectProperties[$_] = $Properties[$_][0] -as $SamAccountTypeEnum
            }
                            elseif ($_ -eq 'objectguid') {
                # convert the GUID to a string
                #$ObjectProperties[$_] = (New-Object Guid (,$Properties[$_][0])).Guid
            }
                        elseif ($_ -eq 'useraccountcontrol') {
                #$ObjectProperties[$_] = $Properties[$_][0] -as $UACEnum
            }
                                                                            elseif ($_ -eq 'ntsecuritydescriptor') {
                # $ObjectProperties[$_] = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Properties[$_][0], 0
                $Descriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Properties[$_][0], 0
                if ($Descriptor.Owner) {
                    $ObjectProperties['Owner'] = $Descriptor.Owner
                }
                if ($Descriptor.Group) {
                    $ObjectProperties['Group'] = $Descriptor.Group
                }
                if ($Descriptor.DiscretionaryAcl) {
                    $ObjectProperties['DiscretionaryAcl'] = $Descriptor.DiscretionaryAcl
                }
                if ($Descriptor.SystemAcl) {
                    $ObjectProperties['SystemAcl'] = $Descriptor.SystemAcl
                }
            }
                                            elseif ($_ -eq 'accountexpires') {
                if ($Properties[$_][0] -gt [DateTime]::MaxValue.Ticks) {
                    $ObjectProperties[$_] = "NEVER"
                }
                else {
                    $ObjectProperties[$_] = [datetime]::fromfiletime($Properties[$_][0])
                }
            }
                                                                    elseif ( ($_ -eq 'lastlogon') -or ($_ -eq 'lastlogontimestamp') -or ($_ -eq 'pwdlastset') -or ($_ -eq 'lastlogoff') -or ($_ -eq 'badPasswordTime') ) {
                # convert timestamps
                if ($Properties[$_][0] -is [System.MarshalByRefObject]) {
                    # if we have a System.__ComObject
                    $Temp = $Properties[$_][0]
                    [Int32]$High = $Temp.GetType().InvokeMember('HighPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null)
                    [Int32]$Low  = $Temp.GetType().InvokeMember('LowPart',  [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null)
                    $ObjectProperties[$_] = ([datetime]::FromFileTime([Int64]("0x{0:x8}{1:x8}" -f $High, $Low)))
                }
                else {
                    # otherwise just a string
                    $ObjectProperties[$_] = ([datetime]::FromFileTime(($Properties[$_][0])))
                }
            }
                                                                    elseif ($Properties[$_][0] -is [System.MarshalByRefObject]) {
                # try to convert misc com objects
                $Prop = $Properties[$_]
                try {
                    $Temp = $Prop[$_][0]
                    [Int32]$High = $Temp.GetType().InvokeMember('HighPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null)
                    [Int32]$Low  = $Temp.GetType().InvokeMember('LowPart',  [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null)
                    $ObjectProperties[$_] = [Int64]("0x{0:x8}{1:x8}" -f $High, $Low)
                }
                catch {
                    Write-Verbose "[Convert-LDAPProperty] error: $_"
                    $ObjectProperties[$_] = $Prop[$_]
                }
            }
                        elseif ($Properties[$_].count -eq 1) {
                $ObjectProperties[$_] = $Properties[$_][0]
            }
                        else {
                $ObjectProperties[$_] = $Properties[$_]
            }
            }
        }
                try {
        New-Object -TypeName PSObject -Property $ObjectProperties
    }
                catch {
        Write-Warning "[Convert-LDAPProperty] Error parsing LDAP properties : $_"
    }
    }
}
function Find-AdminLogonScripts {
    [CmdletBinding()]
    param (
        [array]$AdminUsers,
        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty
    )
    # Enabled user accounts
    Foreach ($Admin in $AdminUsers) {
        $UserArguments = @{ Identity = $Admin.MemberName }
        if ($Credential -ne [Management.Automation.PSCredential]::Empty) {
            $UserArguments.Credential = $Credential
        }
        $AdminLogonScripts = Get-ScriptSentryDomainUser @UserArguments | Where-Object { $null -ne $_.scriptPath }

        # "`n[!] Admins found with logon scripts"
        $AdminLogonScripts | Foreach-object {
            <# $Results = [ordered] @{
                Type = 'AdminLogonScript'
                User = $_.distinguishedname
                LogonScript = $_.scriptpath
            }#>
            $Results = [ordered] @{
                Misconfiguration = 'LSM-Admins-1'
                Description = "Admins with logonscripts"
                Details = "$($_.distinguishedname) - $($_.scriptpath)"
            }

            [pscustomobject] $Results
        }
    }
}
function Find-LogonScriptCredentials {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        [array]$LogonScripts,
        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty
    )
    foreach ($script in $LogonScripts) {
        # Write-Verbose -Message "Checking $($Script.FullName) for credentials.."
        $Credentials = Get-Content -Path $script.FullName -ErrorAction SilentlyContinue | Select-String -Pattern "/u[\w]*:","-AsPlainText" -AllMatches
        if ($Credentials) {
            # "`n[!] CREDENTIALS FOUND!"
            $Credentials | ForEach-Object {
                <#$Results = [ordered] @{
                    Type = 'Credentials'
                    File = $script.FullName
                    Credential = $_
                }#>
                $Results = [ordered] @{
                    Misconfiguration = 'LSM-Creds'
                    Description = "Plaintext credentials within a logon script"
                    Details = "$($script.FullName) - $_"
                }
                [pscustomobject] $Results | Sort-Object -Unique
            }
        }
    }
}
function Find-UNCScripts {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        [array]$LogonScripts,
        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty
    )

    $ExcludedMatches = "copy|&|/command|%WINDIR%|-i|\*"
    $UNCFiles = @()
    [Array] $UNCFiles = foreach ($script in $LogonScripts) {
        $MatchingUNCFiles = Get-Content $script.FullName -ErrorAction SilentlyContinue |
            Select-String -AllMatches -Pattern '\\\\[\w.\-]+\\[^\s"'']+?\.[A-Za-z0-9]{1,10}(?=[\s"'']|$)' |
            ForEach-Object { $_.Matches.Value }
        $MatchingUNCFiles | Foreach-object {
            if ($_ -match $ExcludedMatches) {
                # don't collect
            } else {
                $_
            }
        }
    }
    Write-Verbose "[+] UNC scripts:"
    $UNCFiles | ForEach-Object {
        Write-Verbose -Message "$_"
    }

    $UNCFiles | Sort-Object -Unique
}
function Find-MappedDrives {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        [array]$LogonScripts,
        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty
    )

    $Shares = @()
    [Array] $Shares = foreach ($script in $LogonScripts) {
        Get-Content $script.FullName -ErrorAction SilentlyContinue |
            Select-String -Pattern 'net\s+use|New-SmbMapping|MapNetworkDrive' |
            ForEach-Object {
                [regex]::Matches($_.Line, '\\\\[\w.\-]+\\[\w$_.\-]+') |
                    ForEach-Object Value
            }
    }

    Write-Verbose "[+] Mapped drives:"
    $Shares | Sort-Object -Unique | ForEach-Object {
        Write-Verbose -Message "$_"
    }

    $Shares | Sort-Object -Unique
}
function Find-NonexistentShares {
    [CmdletBinding()]
    param (
        [array]$LogonScripts,
        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty
    )
    $LogonScriptShares = @()
    [Array] $LogonScriptShares = foreach ($script in $LogonScripts) {
        $temp = Get-Content $script.FullName -ErrorAction SilentlyContinue | Select-String -Pattern '.*net use.*','New-SmbMapping','.MapNetworkDrive' | ForEach-Object { $_.Matches.Value }
        $temp = $temp | Select-String -Pattern '\\\\[\w\.\-]+\\[\w\-_\\.]+' | ForEach-Object { $_.Matches.Value }
        $temp | ForEach-Object {
            $ServerList = [ordered] @{
                Server = (($_ -split '\\') | Where-Object {$_ -ne ""})[0]
                Share = $_
                Script = $Script.FullName
            }
            [pscustomobject] $ServerList
        }
    }

    $LogonScriptShares = $LogonScriptShares | Sort-Object -Property Server -Unique

    $NonExistentShares = @()
    [Array] $NonExistentShares = foreach ($LogonScriptShare in $LogonScriptShares) {
        $ServerWithoutDNS = $null
        try {
            $DNSEntry = [System.Net.DNS]::GetHostByName($LogonScriptShare.Server)
        } catch {
            $ServerWithoutDNS = $LogonScriptShare
        }
        if ($ServerWithoutDNS) {
            $Results = [ordered] @{
                Misconfiguration = 'LSM-Shares'
                Description = "Non-existent shares"
                Details = "$($ServerWithoutDNS.Share) mapped in $($ServerWithoutDNS.Script)"
            }
            [pscustomobject] $Results
        }
    }
    $NonExistentShares
}
function Find-AdminsNonexistentShares {
    [CmdletBinding()]
    param (
        [array]$NonExistentShares,
        [array]$AdminUsers,
        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty
    )
    $AdminLogonScripts = Find-AdminLogonScripts -AdminUsers $AdminUsers -Credential $Credential
    # $Share = ($NonExistentShares.Details | Select-String '\\\\[\w\.\-]+\\[\w\-_\\.]+').Matches.Value
    # $ShareScript = (($NonExistentShares.Details | Select-String "\s.*$").Matches.Value).Replace('mapped in ','').TrimStart() | Sort-Object -Unique
    $AdminsNonexistentShares = @()
    [Array] $AdminsNonexistentShares = foreach ($Admin in $AdminLogonScripts) {
        $AdminDN = (($Admin.Details | Select-String "(CN=.*)\s").Matches.Value).Trim(' - ')
        $LogonScript = (($Admin.Details | Select-String "\s-\s.*$").Matches.Value).Trim(' - ')
        foreach ($Share in $NonExistentShares) {
            if ($Share.Details -match $LogonScript) {
                $SharePath = ($Share.Details | Select-String '\\\\[\w\.\-]+\\[\w\-_\\.]+').Matches.Value
                $Results = [ordered] @{
                    Misconfiguration = 'LSM-Admins-2'
                    Description = "Admins with logon scripts mapped from nonexistent share"
                    Details = "$AdminDN - $LogonScript mapping $SharePath"
                }
                [pscustomobject] $Results
            }
        }
    }

    $AdminsNonexistentShares
}
function Find-UnsafeUNCPermissions {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        [array]$UNCScripts,
        [Parameter(Mandatory = $true)]
        [array]$SafeUsersList,
        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty
    )

    $UnsafeRights = 'FullControl|Modify|Write'
    $SafeUsers = $SafeUsersList
    foreach ($script in $UNCScripts){
        if ([string]::IsNullOrWhiteSpace([string]$script)) {
            continue
        }
        if (-not (Test-Path -LiteralPath $script -ErrorAction SilentlyContinue)) {
            Write-Verbose "Path does not exist or is not accessible: '$script'"
            continue
        }
        # Write-Host $script
        # "Checking $script for unsafe permissions.."
        try {
            $ACL = (Get-Acl -LiteralPath $script -ErrorAction Stop).Access
        }
        catch {
            Write-Verbose "Unable to read permissions for '$script': $($_.Exception.Message)"
            continue
        }
        foreach ($entry in $ACL) {
            if ($entry.FileSystemRights -match $UnsafeRights `
                -and $entry.AccessControlType -eq "Allow" `
                -and $entry.IdentityReference -notmatch $SafeUsers
                ){
                if ($script -match 'NETLOGON|SYSVOL') {
                    $Type = 'UnsafeNetlogonSysvol'
                    <#$Results = [ordered] @{
                        Type = $Type
                        Folder = $script
                        User = $entry.IdentityReference.Value
                        Rights = $entry.FileSystemRights
                    }#>
                    $Folder = $script
                    $User = $entry.IdentityReference.Value
                    $Rights = $entry.FileSystemRights
                    $Results = [ordered] @{
                        Misconfiguration = 'LSM-Access-3'
                        Description = "Unsafe NETLOGON/SYSVOL permissions"
                        Details = "$User with $Rights on $Folder"
                    }
                    [pscustomobject] $Results | Sort-Object -Unique
                }
                    elseif ($script -match '\.') {
                    $Type = 'UnsafeUNCFilePermission'
                    <#$Results = [ordered] @{
                        Type = $Type
                        File = $script
                        User = $entry.IdentityReference.Value
                        Rights = $entry.FileSystemRights
                    }#>
                    $File = $script
                    $User = $entry.IdentityReference.Value
                    $Rights = $entry.FileSystemRights
                    $Results = [ordered] @{
                        Misconfiguration = 'LSM-Access-2'
                        Description = "Unsafe UNC file permissions"
                        Details = "$User with $Rights on $File"
                    }
                    [pscustomobject] $Results | Sort-Object -Unique
                } else {
                    $Type = 'UnsafeUNCFolderPermission'
                    <#$Results = [ordered] @{
                        Type = $Type
                        Folder = $script
                        User = $entry.IdentityReference.Value
                        Rights = $entry.FileSystemRights
                    }#>
                    $Folder = $script
                    $User = $entry.IdentityReference.Value
                    $Rights = $entry.FileSystemRights
                    $Results = [ordered] @{
                        Misconfiguration = 'LSM-Access-1'
                        Description = "Unsafe UNC folder permissions"
                        Details = "$User with $Rights on $Folder"
                    }
                    [pscustomobject] $Results | Sort-Object -Unique
                }
            }
        }
    }
}
function Find-UnsafeLogonScriptPermissions {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        [array]$LogonScripts,
        [Parameter(Mandatory = $true)]
        [array]$SafeUsersList,
        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty
    )

    $UnsafeRights = 'FullControl|Modify|Write'
    $SafeUsers = $SafeUsersList
    foreach ($script in $LogonScripts){
        # Write-Verbose -Message "Checking $($script.FullName) for unsafe permissions.."
        $ACL = try { (Get-Acl $script.FullName -ErrorAction SilentlyContinue).Access } catch{}
        foreach ($entry in $ACL) {
            if ($entry.FileSystemRights -match $UnsafeRights `
                -and $entry.AccessControlType -eq "Allow" `
                -and $entry.IdentityReference -notmatch $SafeUsers
                ){
                <#$Results = [ordered] @{
                    Type = 'UnsafeLogonScriptPermission'
                    File = $script.FullName
                    User = $entry.IdentityReference.Value
                    Rights = $entry.FileSystemRights
                }#>
                $User = $entry.IdentityReference.Value
                $Rights = $entry.FileSystemRights
                $Results = [ordered] @{
                    Misconfiguration = 'LSM-Access-4'
                    Description = "Unsafe logon script permissions"
                    Details = "$User with $Rights on $($script.FullName)"
                }
                [pscustomobject] $Results | Sort-Object -Unique
            }
        }
    }
}
function Find-UnsafeGPOLogonScriptPermissions {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        [array]$GPOLogonScripts,
        [Parameter(Mandatory = $true)]
        [array]$SafeUsersList,
        [Management.Automation.PSCredential]
        [Management.Automation.CredentialAttribute()]
        $Credential = [Management.Automation.PSCredential]::Empty
    )

    $UnsafeRights = 'FullControl|Modify|Write'
    $SafeUsers = $SafeUsersList
    foreach ($script in $GPOLogonScripts){
        # Write-Verbose -Message "Checking $($script.FullName) for unsafe permissions.."
        $ACL = (Get-Acl $script.FullName -ErrorAction SilentlyContinue).Access
        foreach ($entry in $ACL) {
            if ($entry.FileSystemRights -match $UnsafeRights `
                -and $entry.AccessControlType -eq "Allow" `
                -and $entry.IdentityReference -notmatch $SafeUsers
                ){
                <#$Results = [ordered] @{
                    Type = 'UnsafeGPOLogonScriptPermission'
                    File = $script.FullName
                    User = $entry.IdentityReference.Value
                    Rights = $entry.FileSystemRights
                }#>
                $User = $entry.IdentityReference.Value
                $Rights = $entry.FileSystemRights
                $Results = [ordered] @{
                    Misconfiguration = 'LSM-Access-5'
                    Description = "Unsafe GPO logon script permissions"
                    Details = "$User with $Rights on $($script.FullName)"
                }
                [pscustomobject] $Results | Sort-Object -Unique
            }
        }
    }
}
function Show-Results {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        [array]$Results
    )

    $IssueTable = @{
        'LSM-Creds'      = 'Plaintext credentials'
        'LSM-Shares'     = 'Nonexistent Shares'
        'LSM-Access-1'   = 'Unsafe UNC folder permissions'
        'LSM-Access-2'   = 'Unsafe UNC file permissions'
        'LSM-Access-3'   = 'Unsafe NETLOGON/SYSVOL permissions'
        'LSM-Access-4'   = 'Unsafe logon script permissions'
        'LSM-Access-5'   = 'Unsafe GPO logon script permissions'
        'LSM-Admins-1'   = 'Admins with logonscripts'
        'LSM-Admins-2'   = 'Admins with logonscripts mapped from nonexistent share'
    }

    if ($null -ne $Results) {
        $UniqueResults = $Results.Misconfiguration | Sort-Object -Unique
        Write-Host "########## $($IssueTable[$UniqueResults]) ##########"
        # $Results | Format-List
        $Results | Format-Table -Wrap
    }
}

Get-Art -Version '0.10-2026'

$SafeUsers = 'NT AUTHORITY\\SYSTEM|Administrator|NT SERVICE\\TrustedInstaller|Domain Admins|Server Operators|Enterprise Admins|CREATOR OWNER'
$AdminGroups = @("Account Operators", "Administrators", "Backup Operators", "Cryptographic Operators", "Distributed COM Users", "Domain Admins", "Domain Controllers", "Enterprise Admins", "Print Operators", "Schema Admins", "Server Operators")

$TargetArguments = @{}
$CredentialArguments = @{}
$LocationArguments = @{}

if ($Credential.UserName) {
    Write-Host "[i] Credentials detected. Running ScriptSentry as: $($Credential.UserName)"
    $TargetArguments.Credential = $Credential
    $CredentialArguments.Credential = $Credential
}

if ($PSBoundParameters.ContainsKey('Server')) {
    $TargetArguments.Server = $Server
    $TargetArguments.Domain = $Domain
    $LocationArguments.Server = $Server
    $LocationArguments.Domain = $Domain
}

$AdminUsers = $AdminGroups | ForEach-Object {
    $GroupArguments = @{ Identity = $_; Recurse = $true }
    foreach ($Name in $TargetArguments.Keys) {
        $GroupArguments[$Name] = $TargetArguments[$Name]
    }
    Get-ScriptSentryDomainGroupMember @GroupArguments | Where-Object { $_.MemberObjectClass -eq 'user' }
} | Sort-Object -Property MemberName -Unique
$AdminUsers | ForEach-Object { $SafeUsers = $SafeUsers + '|' + $_.MemberName }

$LogonScripts = Get-LogonScripts @TargetArguments
$GPOLogonScripts = Get-GPOLogonScripts @TargetArguments

if ($LogonScripts) {
    $UNCScripts = Find-UNCScripts -LogonScripts $LogonScripts @CredentialArguments
    $MappedDrives = Find-MappedDrives -LogonScripts $LogonScripts @CredentialArguments
    $NonExistentShares = Find-NonexistentShares -LogonScripts $LogonScripts @CredentialArguments
    $AdminsNonExistentShares = Find-AdminsNonexistentShares -NonExistentShares $NonExistentShares -AdminUsers $AdminUsers @CredentialArguments
    $UnsafeLogonScripts = Find-UnsafeLogonScriptPermissions -LogonScripts $LogonScripts -SafeUsersList $SafeUsers @CredentialArguments
    $Credentials = Find-LogonScriptCredentials -LogonScripts $LogonScripts @CredentialArguments
} else {
    Write-Host "[i] No logon scripts found!`n" -ForegroundColor Cyan
}

if ($UNCScripts) {
    $UnsafeUNCPermissions = Find-UnsafeUNCPermissions -UNCScripts $UNCScripts -SafeUsersList $SafeUsers @CredentialArguments
} else {
    Write-Host "[i] No direct UNC file references found!`n" -ForegroundColor Cyan
}

if ($MappedDrives) {
    $UnsafeMappedDrives = Find-UnsafeUNCPermissions -UNCScripts $MappedDrives -SafeUsersList $SafeUsers @CredentialArguments
} else {
    Write-Host "[i] No mapped drives found!`n" -ForegroundColor Cyan
}

$NetlogonSysvol = Get-NetlogonSysvol @LocationArguments
$UnsafeNetlogonSysvol = Find-UnsafeUNCPermissions -UNCScripts $NetlogonSysvol -SafeUsersList $SafeUsers @CredentialArguments

if ($GPOLogonScripts) {
    $UnsafeGPOLogonScripts = Find-UnsafeGPOLogonScriptPermissions -GPOLogonScripts $GPOLogonScripts -SafeUsersList $SafeUsers @CredentialArguments
} else {
    Write-Host "[i] No GPO logon scripts found!`n" -ForegroundColor Cyan
}

$AdminLogonScripts = Find-AdminLogonScripts -AdminUsers $AdminUsers @CredentialArguments

if ($NonExistentShares) {
    # Find Exploitable logon scripts
    # $ExploitableLogonScripts = $NonExistentSharesScripts | Where-Object {$_.Exploitable -eq 'Yes'}
} else {
    Write-Host "[i] No non-existent shares found!`n" -ForegroundColor Cyan
}

# Show all results
if ($Credentials) {Show-Results $Credentials}
if ($UnsafeMappedDrives) {Show-Results $UnsafeMappedDrives}
if ($UnsafeUNCPermissions) {Show-Results $UnsafeUNCPermissions}
if ($UnsafeNetlogonSysvol) {Show-Results $UnsafeNetlogonSysvol}
if ($UnsafeLogonScripts) {Show-Results $UnsafeLogonScripts}
if ($UnsafeGPOLogonScripts) {Show-Results $UnsafeGPOLogonScripts}
if ($NonExistentShares) {Show-Results $NonExistentShares}
if ($AdminLogonScripts) {Show-Results $AdminLogonScripts}
if ($AdminsNonExistentShares) {Show-Results $AdminsNonExistentShares}
# if ($ExploitableLogonScripts) {Show-Results $ExploitableLogonScripts}

if ($SaveOutput) {
    if ($OutputDirectory){
            if ($UnsafeMappedDrives) {
            # Write-Host "[i] Saving UnsafeMappedDrives.csv to the current directory" -ForegroundColor Cyan
            # $UnsafeMappedDrives | Export-CSV -NoTypeInformation UnsafeMappedDrives.csv
            $UnsafeMappedDrives | Export-CSV -NoTypeInformation $OutputDirectory\ScriptSentryResults.csv -Append
        }
        if ($UnsafeLogonScripts) {
            # Write-Host "[i] Saving UnsafeLogonScripts.csv to the current directory" -ForegroundColor Cyan
            # $UnsafeLogonScripts | Export-CSV -NoTypeInformation UnsafeLogonScripts.csv
            $UnsafeLogonScripts | Export-CSV -NoTypeInformation $OutputDirectory\ScriptSentryResults.csv -Append
        }
        if ($UnsafeGPOLogonScripts) {
            # Write-Host "[i] Saving UnsafeGPOLogonScripts.csv to the current directory" -ForegroundColor Cyan
            # $UnsafeGPOLogonScripts | Export-Csv -NoTypeInformation UnsafeGPOLogonScripts.csv
            $UnsafeGPOLogonScripts | Export-Csv -NoTypeInformation $OutputDirectory\ScriptSentryResults.csv -Append
        }
        if ($UnsafeUNCPermissions) {
            # Write-Host "[i] Saving UnsafeUNCPermissions.csv to the current directory" -ForegroundColor Cyan
            # $UnsafeUNCPermissions | Export-CSV -NoTypeInformation UnsafeUNCPermissions.csv
            $UnsafeUNCPermissions | Export-CSV -NoTypeInformation $OutputDirectory\ScriptSentryResults.csv -Append
        }
        if ($UnsafeNetlogonSysvol) {
            # Write-Host "[i] Saving UnsafeNetlogonSysvol.csv to the current directory" -ForegroundColor Cyan
            # $UnsafeNetlogonSysvol | Export-Csv -NoTypeInformation UnsafeNetlogonSysvol.csv
            $UnsafeNetlogonSysvol | Export-Csv -NoTypeInformation $OutputDirectory\ScriptSentryResults.csv -Append
        }
        if ($AdminLogonScripts) {
            # Write-Host "[i] Saving AdminLogonScripts.csv to the current directory" -ForegroundColor Cyan
            # $AdminLogonScripts | Export-CSV -NoTypeInformation AdminLogonScripts.csv
            $AdminLogonScripts | Export-CSV -NoTypeInformation $OutputDirectory\ScriptSentryResults.csv -Append
        }
        if ($Credentials) {
            # Write-Host "[i] Saving Credentials.csv to the current directory" -ForegroundColor Cyan
            # $Credentials | Export-CSV -NoTypeInformation Credentials.csv
            $Credentials | Export-CSV -NoTypeInformation $OutputDirectory\ScriptSentryResults.csv -Append
        }
        if ($NonExistentShares) {
            # Write-Host "[i] Saving NonExistentShares.csv to the current directory" -ForegroundColor Cyan
            # $NonExistentShares | Export-CSV -NoTypeInformation NonExistentShares.csv
            $NonExistentShares | Export-CSV -NoTypeInformation $OutputDirectory\ScriptSentryResults.csv -Append
        }
        if ($ExploitableLogonScripts) {
            # Write-Host "[i] Saving ExploitableLogonScripts.csv to the current directory" -ForegroundColor Cyan
            # $ExploitableLogonScripts | Export-CSV -NoTypeInformation ExploitableLogonScripts.csv
            $ExploitableLogonScripts | Export-CSV -NoTypeInformation $OutputDirectory\ScriptSentryResults.csv -Append
        }

        if ($AdminsNonExistentShares) {
            $AdminsNonExistentShares | Export-CSV -NoTypeInformation $OutputDirectory\ScriptSentryResults.csv -Append
        }
    } else {
        if ($UnsafeMappedDrives) {
            # Write-Host "[i] Saving UnsafeMappedDrives.csv to the current directory" -ForegroundColor Cyan
            # $UnsafeMappedDrives | Export-CSV -NoTypeInformation UnsafeMappedDrives.csv
            $UnsafeMappedDrives | Export-CSV -NoTypeInformation ScriptSentryResults.csv -Append
        }
        if ($UnsafeLogonScripts) {
            # Write-Host "[i] Saving UnsafeLogonScripts.csv to the current directory" -ForegroundColor Cyan
            # $UnsafeLogonScripts | Export-CSV -NoTypeInformation UnsafeLogonScripts.csv
            $UnsafeLogonScripts | Export-CSV -NoTypeInformation ScriptSentryResults.csv -Append
        }
        if ($UnsafeGPOLogonScripts) {
            # Write-Host "[i] Saving UnsafeGPOLogonScripts.csv to the current directory" -ForegroundColor Cyan
            # $UnsafeGPOLogonScripts | Export-Csv -NoTypeInformation UnsafeGPOLogonScripts.csv
            $UnsafeGPOLogonScripts | Export-Csv -NoTypeInformation ScriptSentryResults.csv -Append
        }
        if ($UnsafeUNCPermissions) {
            # Write-Host "[i] Saving UnsafeUNCPermissions.csv to the current directory" -ForegroundColor Cyan
            # $UnsafeUNCPermissions | Export-CSV -NoTypeInformation UnsafeUNCPermissions.csv
            $UnsafeUNCPermissions | Export-CSV -NoTypeInformation ScriptSentryResults.csv -Append
        }
        if ($UnsafeNetlogonSysvol) {
            # Write-Host "[i] Saving UnsafeNetlogonSysvol.csv to the current directory" -ForegroundColor Cyan
            # $UnsafeNetlogonSysvol | Export-Csv -NoTypeInformation UnsafeNetlogonSysvol.csv
            $UnsafeNetlogonSysvol | Export-Csv -NoTypeInformation ScriptSentryResults.csv -Append
        }
        if ($AdminLogonScripts) {
            # Write-Host "[i] Saving AdminLogonScripts.csv to the current directory" -ForegroundColor Cyan
            # $AdminLogonScripts | Export-CSV -NoTypeInformation AdminLogonScripts.csv
            $AdminLogonScripts | Export-CSV -NoTypeInformation ScriptSentryResults.csv -Append
        }
        if ($Credentials) {
            # Write-Host "[i] Saving Credentials.csv to the current directory" -ForegroundColor Cyan
            # $Credentials | Export-CSV -NoTypeInformation Credentials.csv
            $Credentials | Export-CSV -NoTypeInformation ScriptSentryResults.csv -Append
        }
        if ($NonExistentShares) {
            # Write-Host "[i] Saving NonExistentShares.csv to the current directory" -ForegroundColor Cyan
            # $NonExistentShares | Export-CSV -NoTypeInformation NonExistentShares.csv
            $NonExistentShares | Export-CSV -NoTypeInformation ScriptSentryResults.csv -Append
        }
        if ($ExploitableLogonScripts) {
            # Write-Host "[i] Saving ExploitableLogonScripts.csv to the current directory" -ForegroundColor Cyan
            # $ExploitableLogonScripts | Export-CSV -NoTypeInformation ExploitableLogonScripts.csv
            $ExploitableLogonScripts | Export-CSV -NoTypeInformation ScriptSentryResults.csv -Append
        }

        if ($AdminsNonExistentShares) {
            $AdminsNonExistentShares | Export-CSV -NoTypeInformation ScriptSentryResults.csv -Append
        }
    }
    Get-ChildItem -Filter "*.csv" -File
}

}