파워쉘 설치 방법2 & 감사실패 4625 auditpol /get /category:* /r

[동우]

https://www.nuget.org/packages/Microsoft.PowerShell.Security/
https://fsprojects.github.io/Paket/paket-add.html
https://github.com/fsprojects/Paket/releases   

https://nugetmusthaves.com/Package/Microsoft.PowerShell.Security

아래의 것들로 절대로 못해서 이렇게 해서 설치 하였다 

ㅋㅋ

paket add Microsoft.PowerShell.Security --version 7.3.3

한방에 성공.. 만든 분 천재 ㅋㅋ

---

Find-Module > d:\txt.txt 

# 모듈 찾는 명령어 파워쉘 프로그램 찾기

Get-Content d:\txt.txt -Encoding Default | Out-File -Encoding UTF8 d:\txtE.txt
findstr /c:"Microsoft.PowerShell." d:\txtE.txt > d:\testout.txt

# 드럽게 어렵게 등록 했는대 없구나 ㅋㅋㅋㅋ 욕나옴 이산이 아닌가벼 할멈 

https://learn.microsoft.com/ko-kr/powershell/module/powershellget/register-psrepository?view=powershell-7.3 

https://www.powershellgallery.com/packages/SCInstall/0.2.8/Content/SCInstall.ps1

$PSGalleryModuleName = 'PowerShellGet'
$PSGalleryRepositoryUrl = 'https://www.powershellgallery.com/api/v2/'
$PSGalleryRepositoryName = 'PSGallery'

# Install NuGet package repository
Install-PackageProvider "NuGet" -MinimumVersion 2.8 -Force | Out-Null

# Install PowerShell Gallery repository
$PSGallery = Get-PSRepository $PSGalleryRepositoryName -ErrorAction SilentlyContinue
If ($null -eq $PSGallery) {
Register-PSRepository -Name $PSGalleryRepositoryName -SourceLocation $PSGalleryRepositoryUrl -InstallationPolicy "Trusted" | Out-Null
}

# Install Sitecore Installation Framework
$SIF = Get-Module $SitecoreModuleName -ListAvailable
If ($null -eq $SIF) {
Install-Module $SitecoreModuleName -Repository $PSGalleryRepositoryName -Force | Out-Null
}

---

Install-Module -Name SitecoreInstallFramework

2.txt

1.00KB

$PSGalleryModuleName = 'PowerShellGet'
$PSGalleryRepositoryUrl = 'https://www.powershellgallery.com/api/v2/'
$PSGalleryRepositoryName = 'PSGallery'

# Install PowerShell Gallery repository
$PSGallery = Get-PSRepository $PSGalleryRepositoryName -ErrorAction SilentlyContinue
If ($null -eq $PSGallery) {
    Register-PSRepository -Name $PSGalleryRepositoryName -SourceLocation $PSGalleryRepositoryUrl -InstallationPolicy "Trusted" `
    -SourceLocation https://www.powershellgallery.com/api/v2/ `
    -PublishLocation https://www.powershellgallery.com/api/v2/package/ `
    -ScriptSourceLocation https://www.powershellgallery.com/api/v2/items/psscript/ `
    -ScriptPublishLocation https://www.powershellgallery.com/api/v2/package/ | Out-Null
}

# Install Sitecore Installation Framework
$SitecoreModuleName = 'SitecoreInstallFramework'
$SIF = Get-Module $SitecoreModuleName -ListAvailable
If ($null -eq $SIF) {
    Install-Module $SitecoreModuleName -Repository $PSGalleryRepositoryName -Force | Out-Null
}

---

REM 변종 ㅋㅋ 한대 모르겠다 이상하게 될수 있음 

REG ADD "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "PSGallery" /t REG_SZ /d "https://www.powershellgallery.com/api/v2/" /f

Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope LocalMachine

---

https://www.ultimatewindowssecurity.com/securitylog/book/page.aspx?spid=chapter2 

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-list

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpac/77878370-0712-47cd-997d-b07053429f6d

auditpol /get /category:*

auditpol /get /category:* /r 

REM 이렇게 하면 모두 볼수 있네요 GUID 형태로 GUID는 한글과 영문 상관 없으니 ㅎㅎ 좋아요

4.txt

5.28KB

auditpol /set /subcategory:"{0CCE9215-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable
auditpol /set /subcategory:"{0CCE9216-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable
auditpol /set /subcategory:"{0CCE9217-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable
auditpol /set /subcategory:"{0CCE921B-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable
auditpol /set /subcategory:"{0CCE921C-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable
auditpol /set /subcategory:"{0CCE9243-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable
auditpol /set /subcategory:"{0CCE9220-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable

REM 된다 ㅎㅎb

auditpol /set /subcategory:"네트워크 정책 서버" /success:enable /failure:enable
auditpol /set /subcategory:"특수 로그온" /success:enable /failure:enable
auditpol /set /subcategory:"로그온" /success:enable /failure:enable
auditpol /set /subcategory:"로그오프" /success:enable /failure:enable
auditpol /set /subcategory:"기타 로그온/로그오프 이벤트" /success:enable /failure:enable
auditpol /set /subcategory:"계정 잠금" /success:enable /failure:enable
auditpol /set /subcategory:"SAM" /success:enable /failure:enable

auditpol /get /subcategory:"네트워크 정책 서버"

auditpol /get /subcategory:"네트워크 정책 서버" /r

감사 제대로 작동 하고 있는지 확인 하기

https://ikcoo.tistory.com/225   

하나씩 등록 해야 하는 군요 ㅎㅎ 모두 검색 하는 건 없내요.

auditpol /get /subcategory:"{0CCE9215-69AE-11D9-BED3-505054503030}"
auditpol /get /subcategory:"{0CCE9216-69AE-11D9-BED3-505054503030}"
auditpol /get /subcategory:"{0CCE9217-69AE-11D9-BED3-505054503030}"
auditpol /get /subcategory:"{0CCE921B-69AE-11D9-BED3-505054503030}"
auditpol /get /subcategory:"{0CCE921C-69AE-11D9-BED3-505054503030}"
auditpol /get /subcategory:"{0CCE9243-69AE-11D9-BED3-505054503030}"
auditpol /get /subcategory:"{0CCE9220-69AE-11D9-BED3-505054503030}"

확인 하나 하나 등록 해야 한다. gpedit.msc에는 등록 된걸 확인 할수 없네요. 

[동우]

https://learn.microsoft.com/en-us/powershell/secmgmt/install?view=secmgmtopenps-1.0