333 lines
16 KiB
PowerShell
333 lines
16 KiB
PowerShell
# ============================================================================
|
|
# Entra Connect G1 Pre-flight AD Audit - CS-SERVER
|
|
# ----------------------------------------------------------------------------
|
|
# Purpose: collect everything needed to assess Entra Connect sync risk before
|
|
# install. Strictly READ-ONLY. No writes, no renames, no state changes.
|
|
#
|
|
# Maps to Wave 0.5 Gate G1 in docs/cloud/user-account-rollout-plan.md.
|
|
# Output is analyzed against the risk register at
|
|
# docs/migration/entra-connect-risk-register-2026-04-22.md.
|
|
# ============================================================================
|
|
|
|
$ErrorActionPreference = 'Continue'
|
|
Import-Module ActiveDirectory -ErrorAction Stop
|
|
|
|
function Section($n) {
|
|
Write-Output ''
|
|
Write-Output ('=' * 76)
|
|
Write-Output "== $n"
|
|
Write-Output ('=' * 76)
|
|
}
|
|
|
|
function Note($m) { Write-Output " $m" }
|
|
|
|
Write-Output "G1 AD Audit - $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss zzz')"
|
|
Write-Output "Host: $env:COMPUTERNAME"
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '1. Forest / Domain / Schema'
|
|
# ----------------------------------------------------------------------------
|
|
$forest = Get-ADForest
|
|
$domain = Get-ADDomain
|
|
Write-Output "Forest FQDN: $($forest.Name)"
|
|
Write-Output "Forest mode: $($forest.ForestMode)"
|
|
Write-Output "Domain mode: $($domain.DomainMode)"
|
|
Write-Output "Domain DN: $($domain.DistinguishedName)"
|
|
Write-Output "NetBIOS: $($domain.NetBIOSName)"
|
|
Write-Output "UPN suffixes (forest):"
|
|
foreach ($s in $forest.UPNSuffixes) { Write-Output " - $s" }
|
|
if ($forest.UPNSuffixes.Count -eq 0) { Write-Output ' (none configured beyond default cascades.local)' }
|
|
|
|
$schema = Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion
|
|
Write-Output "Schema objectVersion: $($schema.objectVersion)"
|
|
Write-Output ''
|
|
Write-Output 'FSMO roles:'
|
|
Write-Output " Schema Master: $($forest.SchemaMaster)"
|
|
Write-Output " Domain Naming Master: $($forest.DomainNamingMaster)"
|
|
Write-Output " PDC Emulator: $($domain.PDCEmulator)"
|
|
Write-Output " RID Master: $($domain.RIDMaster)"
|
|
Write-Output " Infrastructure Master: $($domain.InfrastructureMaster)"
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '2. OU structure'
|
|
# ----------------------------------------------------------------------------
|
|
$ous = Get-ADOrganizationalUnit -Filter *
|
|
Write-Output "Total OUs: $($ous.Count)"
|
|
Write-Output ''
|
|
foreach ($ou in $ous | Sort-Object DistinguishedName) {
|
|
$uc = (Get-ADUser -Filter * -SearchBase $ou.DistinguishedName -SearchScope OneLevel | Measure-Object).Count
|
|
$gc = (Get-ADGroup -Filter * -SearchBase $ou.DistinguishedName -SearchScope OneLevel | Measure-Object).Count
|
|
$cc = (Get-ADComputer -Filter * -SearchBase $ou.DistinguishedName -SearchScope OneLevel | Measure-Object).Count
|
|
Write-Output (" {0,-80} users={1} groups={2} computers={3}" -f $ou.DistinguishedName, $uc, $gc, $cc)
|
|
}
|
|
|
|
# Users in CN=Users (default container, not an OU)
|
|
$defaultUsersDN = "CN=Users,$($domain.DistinguishedName)"
|
|
$usersInDefault = Get-ADUser -Filter * -SearchBase $defaultUsersDN -SearchScope OneLevel
|
|
Write-Output ''
|
|
Write-Output "Users in default CN=Users container (not ideal — should be in an OU for sync scope):"
|
|
Write-Output " Count: $($usersInDefault.Count)"
|
|
foreach ($u in $usersInDefault) {
|
|
Write-Output " - $($u.SamAccountName) ($($u.Name))"
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '3. All AD users - identity attributes for sync match'
|
|
# ----------------------------------------------------------------------------
|
|
$users = Get-ADUser -Filter * -Properties `
|
|
SamAccountName, UserPrincipalName, DisplayName, GivenName, Surname, `
|
|
Mail, proxyAddresses, Enabled, PasswordLastSet, PasswordNeverExpires, `
|
|
PasswordNotRequired, LockedOut, whenCreated, whenChanged, `
|
|
Department, Title, Office, Description, lastLogonTimestamp, `
|
|
mS-DS-ConsistencyGuid, objectGUID, DistinguishedName
|
|
|
|
Write-Output "Total users: $($users.Count)"
|
|
Write-Output "Enabled: $($users | Where-Object Enabled -eq $true | Measure-Object | Select-Object -ExpandProperty Count)"
|
|
Write-Output "Disabled: $($users | Where-Object Enabled -eq $false | Measure-Object | Select-Object -ExpandProperty Count)"
|
|
Write-Output ''
|
|
|
|
Write-Output 'Per-user identity dump (focus: anything that affects soft-match):'
|
|
Write-Output ''
|
|
Write-Output 'SAM | UPN | Mail | ProxyAddrs | PwdLastSet | PwdNeverExp | Enabled | OU'
|
|
Write-Output '---'
|
|
foreach ($u in $users | Sort-Object SamAccountName) {
|
|
$ou = $u.DistinguishedName -replace '^CN=[^,]+,', ''
|
|
$ou = $ou -replace ",DC=cascades,DC=local$", ''
|
|
$px = if ($u.proxyAddresses) { ($u.proxyAddresses -join ';') } else { '' }
|
|
$pls = if ($u.PasswordLastSet) { $u.PasswordLastSet.ToString('yyyy-MM-dd') } else { 'NULL' }
|
|
Write-Output ("{0} | {1} | {2} | {3} | {4} | {5} | {6} | {7}" -f `
|
|
$u.SamAccountName, $u.UserPrincipalName, $u.Mail, $px, $pls, $u.PasswordNeverExpires, $u.Enabled, $ou)
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '4. Soft-match risk scan - accounts likely to duplicate in Entra'
|
|
# ----------------------------------------------------------------------------
|
|
Write-Output '--- Users with NO proxyAddresses and NO mail (soft-match engine has nothing to work with):'
|
|
foreach ($u in $users) {
|
|
if (-not $u.Mail -and -not $u.proxyAddresses -and $u.Enabled) {
|
|
Write-Output " - $($u.SamAccountName) (UPN: $($u.UserPrincipalName))"
|
|
}
|
|
}
|
|
|
|
Write-Output ''
|
|
Write-Output '--- Users whose UPN suffix is NOT cascadestucson.com (will mismatch M365 target unless renamed):'
|
|
foreach ($u in $users) {
|
|
if ($u.Enabled -and $u.UserPrincipalName -and $u.UserPrincipalName -notmatch '@cascadestucson\.com$') {
|
|
Write-Output " - $($u.SamAccountName) UPN=$($u.UserPrincipalName)"
|
|
}
|
|
}
|
|
|
|
Write-Output ''
|
|
Write-Output '--- Users whose SAM does not match their UPN prefix (name mismatch candidates):'
|
|
foreach ($u in $users) {
|
|
if ($u.Enabled -and $u.UserPrincipalName) {
|
|
$upnPrefix = $u.UserPrincipalName -replace '@.*$', ''
|
|
if ($u.SamAccountName -ne $upnPrefix) {
|
|
Write-Output " - SAM='$($u.SamAccountName)' UPN='$($u.UserPrincipalName)'"
|
|
}
|
|
}
|
|
}
|
|
|
|
Write-Output ''
|
|
Write-Output '--- Users with DisplayName different from Given+Surname (may cause display oddities post-sync):'
|
|
foreach ($u in $users) {
|
|
if ($u.Enabled -and $u.GivenName -and $u.Surname) {
|
|
$expected = "$($u.GivenName) $($u.Surname)"
|
|
if ($u.DisplayName -and $u.DisplayName -ne $expected) {
|
|
Write-Output " - SAM=$($u.SamAccountName) display='$($u.DisplayName)' expected='$expected'"
|
|
}
|
|
}
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '5. Password hygiene (affects whether sync-derived sign-in will work)'
|
|
# ----------------------------------------------------------------------------
|
|
Write-Output '--- Enabled users with null PasswordLastSet (never set a password):'
|
|
foreach ($u in $users) {
|
|
if ($u.Enabled -and -not $u.PasswordLastSet) {
|
|
Write-Output " - $($u.SamAccountName) whenCreated=$($u.whenCreated.ToString('yyyy-MM-dd'))"
|
|
}
|
|
}
|
|
|
|
Write-Output ''
|
|
Write-Output '--- Users with PasswordNotRequired=True:'
|
|
foreach ($u in $users) {
|
|
if ($u.PasswordNotRequired) {
|
|
Write-Output " - $($u.SamAccountName) enabled=$($u.Enabled)"
|
|
}
|
|
}
|
|
|
|
Write-Output ''
|
|
Write-Output '--- Users with PasswordNeverExpires=True:'
|
|
foreach ($u in $users) {
|
|
if ($u.PasswordNeverExpires -and $u.Enabled) {
|
|
Write-Output " - $($u.SamAccountName) PwdLastSet=$($u.PasswordLastSet) Description='$($u.Description)'"
|
|
}
|
|
}
|
|
|
|
Write-Output ''
|
|
Write-Output '--- Currently locked-out accounts:'
|
|
foreach ($u in $users) {
|
|
if ($u.LockedOut) {
|
|
Write-Output " - $($u.SamAccountName) enabled=$($u.Enabled)"
|
|
}
|
|
}
|
|
|
|
$krbtgt = Get-ADUser krbtgt -Properties PasswordLastSet
|
|
$krbtgtAge = if ($krbtgt.PasswordLastSet) { ((Get-Date) - $krbtgt.PasswordLastSet).Days } else { '?' }
|
|
Write-Output ''
|
|
Write-Output "krbtgt password last set: $($krbtgt.PasswordLastSet) (age: $krbtgtAge days)"
|
|
Write-Output ' (best practice: rotate every 180 days; > 180 is a known audit finding)'
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '6. Role-based / shared accounts (should NOT sync)'
|
|
# ----------------------------------------------------------------------------
|
|
$roleLike = @('Receptionist','receptionist','Culinary','saleshare','directoryshare','Front Desk',
|
|
'frontdesk','Accounting','accounting','Nurse','nurse','mcnurse','memcarenurse',
|
|
'Security','security','HR','hr','medtech','Memcare')
|
|
Write-Output 'Accounts whose SamAccountName looks role-based (should be EXCLUDED from sync scope):'
|
|
foreach ($u in $users) {
|
|
foreach ($pattern in $roleLike) {
|
|
if ($u.SamAccountName -eq $pattern -or $u.SamAccountName -ieq $pattern) {
|
|
Write-Output " - $($u.SamAccountName) enabled=$($u.Enabled) OU=$($u.DistinguishedName)"
|
|
break
|
|
}
|
|
}
|
|
}
|
|
|
|
Write-Output ''
|
|
Write-Output 'Service / built-in accounts (context - usually excluded from sync):'
|
|
$builtin = @('Administrator','krbtgt','Guest','localadmin','sysadmin','QBDataServiceUser34','howard')
|
|
foreach ($u in $users) {
|
|
if ($u.SamAccountName -in $builtin) {
|
|
Write-Output " - $($u.SamAccountName) enabled=$($u.Enabled)"
|
|
}
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '7. Likely-departed accounts still enabled (HIPAA termination risk)'
|
|
# ----------------------------------------------------------------------------
|
|
# Accounts enabled but no logon activity in >= 90 days are candidate departures
|
|
$cutoff = (Get-Date).AddDays(-90)
|
|
Write-Output "Enabled accounts with no logon activity in 90+ days:"
|
|
foreach ($u in $users | Sort-Object lastLogonTimestamp) {
|
|
if ($u.Enabled -and $u.SamAccountName -notin $builtin) {
|
|
$ll = if ($u.lastLogonTimestamp) { [DateTime]::FromFileTime($u.lastLogonTimestamp) } else { $null }
|
|
if (-not $ll -or $ll -lt $cutoff) {
|
|
$llStr = if ($ll) { $ll.ToString('yyyy-MM-dd') } else { 'never' }
|
|
Write-Output " - $($u.SamAccountName) lastLogon=$llStr"
|
|
}
|
|
}
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '8. AD groups inventory'
|
|
# ----------------------------------------------------------------------------
|
|
$groups = Get-ADGroup -Filter * -Properties Members,Description,whenCreated,GroupScope,GroupCategory
|
|
Write-Output "Total groups: $($groups.Count)"
|
|
Write-Output ''
|
|
Write-Output 'Group name | Scope | Category | Members | Created | Description'
|
|
Write-Output '---'
|
|
foreach ($g in $groups | Sort-Object Name) {
|
|
$mc = if ($g.Members) { $g.Members.Count } else { 0 }
|
|
Write-Output ("{0} | {1} | {2} | {3} | {4} | {5}" -f `
|
|
$g.SamAccountName, $g.GroupScope, $g.GroupCategory, $mc, `
|
|
$g.whenCreated.ToString('yyyy-MM-dd'), ($g.Description -replace '\r?\n',' '))
|
|
}
|
|
|
|
Write-Output ''
|
|
Write-Output 'Security groups our rollout plan assumes (checking existence):'
|
|
$needed = @(
|
|
'SG-External-Signin-Allowed','SG-Caregivers','SG-FrontDesk','SG-CourtesyPatrol',
|
|
'SG-Drivers','SG-Management-RW','SG-Sales-RW','SG-Culinary-RW','SG-IT-RW',
|
|
'SG-Receptionist-RW','SG-Directory-RW','SG-Server-RW','SG-Chat-RW','SG-Office-PHI-External',
|
|
'SG-Office-PHI-Internal','SG-CA-BreakGlass'
|
|
)
|
|
foreach ($n in $needed) {
|
|
try {
|
|
$g = Get-ADGroup -Identity $n -ErrorAction Stop
|
|
Write-Output " [EXISTS] $n"
|
|
} catch {
|
|
Write-Output " [MISSING] $n (needs creation)"
|
|
}
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '9. Computers (for sync scope decision)'
|
|
# ----------------------------------------------------------------------------
|
|
$computers = Get-ADComputer -Filter * -Properties OperatingSystem,Enabled,lastLogonTimestamp
|
|
Write-Output "Total computer accounts: $($computers.Count)"
|
|
Write-Output "Enabled: $(($computers | Where-Object Enabled -eq $true).Count)"
|
|
Write-Output "Disabled: $(($computers | Where-Object Enabled -eq $false).Count)"
|
|
Write-Output ''
|
|
Write-Output 'Computer | OS | Enabled | LastLogon'
|
|
Write-Output '---'
|
|
foreach ($c in $computers | Sort-Object Name) {
|
|
$ll = if ($c.lastLogonTimestamp) { [DateTime]::FromFileTime($c.lastLogonTimestamp).ToString('yyyy-MM-dd') } else { 'never' }
|
|
Write-Output ("{0} | {1} | {2} | {3}" -f $c.Name, $c.OperatingSystem, $c.Enabled, $ll)
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '10. Existing Entra Connect / MSOL account check'
|
|
# ----------------------------------------------------------------------------
|
|
# Entra Connect creates MSOL_<hex> service accounts in AD. If any exist from a
|
|
# prior install attempt, soft-match will behave unpredictably.
|
|
$msol = Get-ADUser -Filter 'SamAccountName -like "MSOL_*"' -ErrorAction SilentlyContinue
|
|
if ($msol) {
|
|
Write-Output 'EXISTING MSOL accounts found (indicates prior Connect attempt or residue):'
|
|
foreach ($m in $msol) {
|
|
Write-Output " - $($m.SamAccountName) enabled=$($m.Enabled)"
|
|
}
|
|
} else {
|
|
Write-Output '[OK] No MSOL_* accounts in AD (clean install target)'
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '11. Recycle Bin + deleted objects'
|
|
# ----------------------------------------------------------------------------
|
|
$rb = Get-ADOptionalFeature 'Recycle Bin Feature'
|
|
Write-Output "AD Recycle Bin enabled: $([bool]$rb.EnabledScopes)"
|
|
|
|
$deleted = Get-ADObject -Filter 'isDeleted -eq $true' -IncludeDeletedObjects -ResultSetSize 10 -Properties whenCreated,lastKnownParent
|
|
if ($deleted) {
|
|
Write-Output "Deleted objects (sample of 10):"
|
|
foreach ($d in $deleted) {
|
|
Write-Output " - $($d.Name) deletedFrom='$($d.lastKnownParent)'"
|
|
}
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '12. DNS / DC connectivity (sync path)'
|
|
# ----------------------------------------------------------------------------
|
|
Write-Output '--- Key outbound hostnames (already verified clean in readiness check, re-verify):'
|
|
foreach ($h in 'login.microsoftonline.com','login.windows.net','adminwebservice.microsoftonline.com') {
|
|
try {
|
|
$r = Resolve-DnsName $h -Type A -ErrorAction Stop
|
|
Write-Output " [OK] $h -> $($r[0].IPAddress)"
|
|
} catch {
|
|
Write-Output " [FAIL] $h -> $($_.Exception.Message)"
|
|
}
|
|
}
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '13. DC health quick recheck'
|
|
# ----------------------------------------------------------------------------
|
|
# dcdiag already validated tonight but re-check in case the reboot shook anything
|
|
dcdiag /test:services /test:replications /test:fsmocheck /test:advertising /q 2>&1 |
|
|
Where-Object { $_ -match 'failed|warning|error' } |
|
|
ForEach-Object { Write-Output " $_" }
|
|
Write-Output '(Any entries above mean a dcdiag warning/failure; otherwise silent = all pass.)'
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section '14. NTP time sync (re-verify)'
|
|
# ----------------------------------------------------------------------------
|
|
$tsource = (w32tm /query /source 2>&1) -join ' '
|
|
$tdrift = (w32tm /query /status 2>&1 | Select-String 'Last Successful Sync Time|ReferenceId|Stratum').ToString()
|
|
Write-Output "Source: $tsource"
|
|
Write-Output $tdrift
|
|
|
|
# ----------------------------------------------------------------------------
|
|
Section 'Done'
|
|
# ----------------------------------------------------------------------------
|
|
Write-Output "Completed at $(Get-Date)"
|