Invoke-SpnAuditEngine

Business value: This cmdlet is used to run one or more audit providers against a target computer, ensuring that the configuration meets the required standards for security and compliance.

• Who uses this:
  • IT administrators responsible for maintaining the security posture of their organization’s computers.
  • Compliance officers who need to ensure that the organization’s systems meet regulatory requirements.
  • Security teams who want to identify potential vulnerabilities in their systems.
• Risks: If not properly configured, audit providers can cause system instability or incorrect results.
• When a manager cares:
  • When the organization is undergoing a security audit and needs to demonstrate compliance with industry standards.
  • When there are changes to the IT infrastructure that require re-audit of existing systems.

Day-to-day use:

1. To run one or more audit providers against a target computer, use the Invoke-SpnAuditEngine cmdlet. The command should be in the following format: Invoke-SpnAuditEngine -ProviderId <provider_name> -TargetComputer <computer_name>
2. You can also pipe provider names to the cmdlet: Get-Content -Path 'providers.txt' | Invoke-SpnAuditEngine -TargetComputer <computer_name>
3. Use Invoke-SpnLifecycle cmdlet in combination with -PassThru parameter if you need more control over the audit process.

# Example 1:
Invoke-SpnAuditEngine -ProviderId AD.RDP,AD.SMB -TargetComputer srv01

# Example 2:
'AD.RDP','AD.SMB' | Invoke-SpnAuditEngine -TargetComputer srv01

# Using Invoke-SpnLifecycle with -PassThru parameter
Invoke-SpnLifecycle -ProviderId AD.RDP -TargetComputer srv01 -PassThru

Watchpoints:

• Make sure to update the list of providers if new ones are added.
• Be cautious when piping large lists of provider names to avoid overwhelming the system.

This cmdlet runs one or more audit providers against a target computer, ensuring that the configuration meets the required standards for security and compliance. It’s like sending your IT team on a scavenger hunt to identify potential vulnerabilities in your systems.

Simple steps:

1. Identify the providers you want to run (e.g., AD.RDP, AD.SMB).
2. Specify the target computer where you want to run these providers.
3. Use the Invoke-SpnAuditEngine cmdlet with the provider names and target computer as arguments.

When stuck:

• Check that your provider list is up-to-date and includes only implemented providers (Status = Implemented).
• Consult the documentation for specific error messages or code examples.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

Data handling: * The cmdlet collects and stores audit results from each provider. * These results are stored in memory until all providers have finished running.

Data transit: * Results are not transmitted over the network; they are stored locally on the target computer.

Data at rest: * Audit results are stored in SpnAuditResult[] objects, which can be accessed via the pipeline or written to a file using Export-Csv.

Audit trail: * Each provider’s audit results are stored separately and can be accessed individually. * The cmdlet logs errors and warnings to the console.

Compliance requirements: * Ensure that all providers used have implemented status (Status = Implemented). * Regularly update provider lists to reflect changes in your IT infrastructure.