thumbscrw/PSWinFW
1
0
Fork 0
mirror of https://github.com/Thumbscrew/PSWinFW.git synced 2025-01-18 17:45:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #17 from Thumbscrew/dev

Browse Source 
Merge for 0.4
This commit is contained in:
James 2020-01-06 15:15:34 +00:00 committed by GitHub
commit f1b2e5caf6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 161 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
public/Get-PSFirewallLog.ps1
View File

@ -1,4 +1,45 @@
function Get-PSFirewallLog {
<#
.SYNOPSIS
Retrieves Windows Firewall log events and returns them as a table.
.DESCRIPTION
Retrieves Windows Firewall log events and returns them as a table. Log path can be directly specified or automatically determined based on local or remote registry settings.
.EXAMPLE
Get-PSFirewallLog -Path C:\Windows\system32\logfiles\firewall\pfirewall.log -Tail 1000
Get last 1000 Windows Firewall log lines at a specific path.
.EXAMPLE
Get-PSFirewallLog -LogDirectory C:\Windows\system32\logfiles\firewall\ -LogFileName domainfw.log
Get Windows Firewall log by specifying the log directory and filename separately.
.EXAMPLE
Get-PSFirewallLog -LogProfile Domain
Get Windows Firewall log by retrieving the path automatically from the registry on the local machine.
.EXAMPLE
Get-PSFirewallLog -LogProfile Public -ComputerName MyRemoteComputer -Verbose
Get Windows Firewall log on a remote computer using the Remote Registry service to get the log path.
.EXAMPLE
Get-PSFirewallLog -LogProfile Public -ComputerName MyRemoteComputer -InferPath
Get Windows Firewall log on a remote computer using the path configured in the local machine's registry (converted to a UNC path).
#>
[CmdletBinding(DefaultParameterSetName = 'direct')]
param (
# Path to firewall log. Defaults to $ENV:SystemRoot\system32\LogFiles\Firewall\pfirewall.log if parameter not supplied.
@ -36,7 +77,12 @@ function Get-PSFirewallLog {
# Follow the log
[Parameter(Mandatory = $false)]
[switch]
$Wait
$Wait,
# Use local machine's registry setting to infer remote machine's log path
[Parameter(Mandatory = $false, ParameterSetName = 'remote')]
[switch]
$InferPath
)
begin {
@ -44,7 +90,13 @@ function Get-PSFirewallLog {
$Path = Get-PSFirewallLogPath -LogProfile $LogProfile -Verbose:$VerbosePreference
}
elseif($PSCmdlet.ParameterSetName -eq 'remote') {
$Path = Get-PSFirewallLogPath -LogProfile $LogProfile -ComputerName $ComputerName -Verbose:$VerbosePreference
$lpc = "Get-PSFirewallLogPath -LogProfile $LogProfile -ComputerName $ComputerName"
if($InferPath) {
$lpc += " -InferPath"
}
$Path = Invoke-Expression $lpc -Verbose:$VerbosePreference
}
}

166
public/Get-PSFirewallLogPath.ps1
View File

@ -1,4 +1,33 @@
function Get-PSFirewallLogPath {
<#
.SYNOPSIS
Retrieves Windows Firewall log path for a given Profile.
.DESCRIPTION
Retrieves Windows Firewall log path for a local or remote machine for given Profile.
.EXAMPLE
Get-PSFirewallLogPath -LogProfile Domain
Retrieves path of the specified profile's log from the local machine.
.EXAMPLE
Get-PSFirewallLogPath -LogProfile Private -ComputerName MyRemoteComputer
Retrieves path of the specified profile's log from a remote machine using the Remote Regsitry service.
.EXAMPLE
Get-PSFirewallLogPath -LogProfile Domain -ComputerName MyRemoteComputer -InferPath
Retrieves path of the specified profile's log from a remote machine using registry settings configured on the local machine.
#>
param(
# Log Profile to retrieve path for
[Parameter(Mandatory = $true)]
@ -9,75 +38,92 @@ function Get-PSFirewallLogPath {
# Remote Host to retrieve from
[Parameter(Mandatory = $false, ParameterSetName = 'remote')]
[string]
$ComputerName
$ComputerName,
# Use local machine's registry setting to infer remote machine's log path
[Parameter(Mandatory = $false, ParameterSetName = 'remote')]
[switch]
$InferPath
)
process {
$serviceName = "RemoteRegistry"
if($PSCmdlet.ParameterSetName -eq 'remote') {
$startTypeChanged = $false
$statusChanged = $false
Write-Verbose "Retrieving path from registry on host $ComputerName."
$remoteRegistry = Get-Service -ComputerName $ComputerName -Name $serviceName
if($remoteRegistry.StartType -eq "Disabled") {
Write-Verbose "$serviceName service is Disabled. Attempting to change to Manual startup."
Set-Service -StartupType "Manual" -Name $serviceName -ComputerName $ComputerName
$modifiedRemoteRegistry = Get-Service -Name $serviceName -ComputerName $ComputerName
if($InferPath) {
# Get local registry key entry
$localPath = [Environment]::ExpandEnvironmentVariables((Get-ItemProperty -Path ("HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\{0}Profile\Logging" -f $LogProfile) -Name "LogFilePath").LogFilePath)
if($modifiedRemoteRegistry.StartType -ne "Manual") {
Write-Warning "Unable to change startup of $serviceName on host $ComputerName."
return $null
}
else {
Write-Verbose "$serviceName startup changed to Manual."
$startTypeChanged = $true
if($null -eq $localPath) {
$defaultPath = "$ENV:SystemRoot\system32\LogFiles\Firewall\pfirewall.log"
Write-Warning "Path for $LogProfile firewall log not defined in registry. Assuming default path of $defaultPath"
$localPath = $defaultPath
}
}
else {
$serviceName = "RemoteRegistry"
$startTypeChanged = $false
$statusChanged = $false
if($remoteRegistry.Status -ne "Running") {
Write-Verbose "$serviceName service is not running. Attempting to start."
Set-Service -Status "Running" -Name $serviceName -ComputerName $ComputerName
$modifiedRemoteRegistry = Get-Service -Name $serviceName -ComputerName $ComputerName
if($modifiedRemoteRegistry.Status -eq "Stopped") {
Write-Warning "Unable to start $serviceName service on host $ComputerName."
return $null
}
else {
Write-Verbose "$serviceName service started OK."
$statusChanged = $true
}
}
$reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $ComputerName)
$regKey = $reg.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\{0}Profile\Logging" -f $LogProfile)
$localPath = [Environment]::ExpandEnvironmentVariables($RegKey.GetValue("LogFilePath"))
# Set Remote Registry back the way we found it if we had to change it
if($statusChanged) {
Write-Verbose ("Reverting status of $serviceName Service to {0}." -f $remoteRegistry.Status)
# Set-Service -Name $serviceName -ComputerName $ComputerName -Status $remoteRegistry.Status
# Need to use Invoke-Command as Set-Service won't stop a service that has dependencies
Invoke-Command -ComputerName $ComputerName -ScriptBlock { Stop-Service -Name "RemoteRegistry" }
Write-Verbose "Retrieving path from registry on host $ComputerName."
$remoteRegistry = Get-Service -ComputerName $ComputerName -Name $serviceName
# Verify that service has been restored to its original state.
$revertedRemoteRegistry = Get-Service -Name $serviceName -ComputerName $ComputerName
if($remoteRegistry.Status -ne $revertedRemoteRegistry.Status) {
Write-Warning "Failed to revert $serviceName status to $($remoteRegistry.Status)!"
}
}
if($remoteRegistry.StartType -eq "Disabled") {
Write-Verbose "$serviceName service is Disabled. Attempting to change to Manual startup."
Set-Service -StartupType "Manual" -Name $serviceName -ComputerName $ComputerName
$modifiedRemoteRegistry = Get-Service -Name $serviceName -ComputerName $ComputerName
if($startTypeChanged) {
Write-Verbose ("Reverting Startup of $serviceName Service to {0}." -f $remoteRegistry.StartType)
Set-Service -Name $serviceName -ComputerName $ComputerName -StartupType $remoteRegistry.StartType
# Verify that service has been restored to its original state.
if($remoteRegistry.StartType -ne $revertedRemoteRegistry.StartType) {
Write-Warning "Failed to revert startup type of $serviceName to $($remoteRegistry.StartType)!"
if($modifiedRemoteRegistry.StartType -ne "Manual") {
Write-Warning "Unable to change startup of $serviceName on host $ComputerName."
return $null
}
else {
Write-Verbose "$serviceName startup changed to Manual."
$startTypeChanged = $true
}
}
if($remoteRegistry.Status -ne "Running") {
Write-Verbose "$serviceName service is not running. Attempting to start."
Set-Service -Status "Running" -Name $serviceName -ComputerName $ComputerName
$modifiedRemoteRegistry = Get-Service -Name $serviceName -ComputerName $ComputerName
if($modifiedRemoteRegistry.Status -eq "Stopped") {
Write-Warning "Unable to start $serviceName service on host $ComputerName."
return $null
}
else {
Write-Verbose "$serviceName service started OK."
$statusChanged = $true
}
}
$reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $ComputerName)
$regKey = $reg.OpenSubKey("SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\{0}Profile\Logging" -f $LogProfile)
$localPath = [Environment]::ExpandEnvironmentVariables($RegKey.GetValue("LogFilePath"))
# Set Remote Registry back the way we found it if we had to change it
if($statusChanged) {
Write-Verbose ("Reverting status of $serviceName Service to {0}." -f $remoteRegistry.Status)
# Set-Service -Name $serviceName -ComputerName $ComputerName -Status $remoteRegistry.Status
# Need to use Invoke-Command as Set-Service won't stop a service that has dependencies
Invoke-Command -ComputerName $ComputerName -ScriptBlock { Stop-Service -Name "RemoteRegistry" }
# Verify that service has been restored to its original state.
$revertedRemoteRegistry = Get-Service -Name $serviceName -ComputerName $ComputerName
if($remoteRegistry.Status -ne $revertedRemoteRegistry.Status) {
Write-Warning "Failed to revert $serviceName status to $($remoteRegistry.Status)!"
}
}
if($startTypeChanged) {
Write-Verbose ("Reverting Startup of $serviceName Service to {0}." -f $remoteRegistry.StartType)
Set-Service -Name $serviceName -ComputerName $ComputerName -StartupType $remoteRegistry.StartType
# Verify that service has been restored to its original state.
if($remoteRegistry.StartType -ne $revertedRemoteRegistry.StartType) {
Write-Warning "Failed to revert startup type of $serviceName to $($remoteRegistry.StartType)!"
}
}
}
@ -91,7 +137,9 @@ function Get-PSFirewallLogPath {
$path = [Environment]::ExpandEnvironmentVariables((Get-ItemProperty -Path ("HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\{0}Profile\Logging" -f $LogProfile) -Name "LogFilePath").LogFilePath)
if($null -eq $path) {
$path = "$ENV:SystemRoot\system32\LogFiles\Firewall\pfirewall.log"
$defaultPath = "$ENV:SystemRoot\system32\LogFiles\Firewall\pfirewall.log"
Write-Warning "Path for $LogProfile firewall log not defined in registry. Assuming default path of $defaultPath"
$path = $defaultPath
}
return $path