[SOLVED] Windows Audit Policy/Registry Key Command Check To Only Apply On Domain Controllers

Windows Audit Policy/Registry Key Command Check To Only Apply On Domain Controllers

I am trying to craft a command that would run against all of my Windows machines to check if the "Audit Distribution Group Management" audit policy setting is set to "Success and Failure". I would only like to apply this check to Domain Controller servers and for any other server type to echo out something like "NoCheckRequired", is this possible?

I tried to create an if-else statement on PowerShell for this, but it was not successful.

Solution

I tried to use the "wmic.exe ComputerSystem get DomainRole" command to find out the type of machine, values 4 / 5 mean DC server from my understanding, and using an IF statement, I tried to match those values and check if the group policy audit settings were set and for any other values returned other than 4 / 5

wmic.exe ComputerSystem get DomainRole outputs the property name on a separate line before outputting the actual value, so comparing to the number 4 (as an example) will not work.

Instead, use the Get-CimInstance cmdlet:

$CS = Get-CimInstance Win32_ComputerSystem

if($CS.DomainRole -in 4,5){
    # We're on a Domain Controller
}
elseif($CS.DomainRole -in 1,3) {
    # We're on a Domain member
}
else {
    # We're on a workgroup machine
}