From d9f58b5f5992331c025f05cf5718a747db7e366b Mon Sep 17 00:00:00 2001 From: rattuscz Date: Mon, 28 May 2018 18:47:30 +0200 Subject: [PATCH 1/3] Powershell 2.0 compatibility Analytics part still does not work ConvertFrom-Json not in ps2 --- AdfsEventsModule.psm1 | 50 +++++++++++++++++++++++++++++++------------ 1 file changed, 36 insertions(+), 14 deletions(-) diff --git a/AdfsEventsModule.psm1 b/AdfsEventsModule.psm1 index 6d5c0af..9fa6105 100644 --- a/AdfsEventsModule.psm1 +++ b/AdfsEventsModule.psm1 @@ -488,30 +488,29 @@ function MakeQuery # $instanceIdsToQuery = @{} - foreach ( $Event in $Result ) + foreach ( $Event in $Result | Where { $null -ne $_ } ) { # Copy over all properties so they remain accessible when remote session terminates $Properties = @() foreach ( $Property in $Event.Properties ) { - $Properties += $Property.value + $Properties += $Property.Value } - $Event | Add-Member RemoteProperties $Properties + $Event | Add-Member -Name RemoteProperties -Value $Properties -MemberType NoteProperty if ( $Event.ActivityId ) { # We have an Activity ID, set the CorrelationID field for consistency - $Event | Add-Member CorrelationID $Event.ActivityId.Guid + $Event | Add-Member -Name CorrelationID -Value $Event.ActivityId.Guid -MemberType NoteProperty } # If we didn't have an ActivityId, try to extract one manually if ( (-not $Event.ActivityId) -and $Event.Properties.count -gt 0 ) { - $guidRef = [ref] [System.Guid]::NewGuid() - if ( [System.Guid]::TryParse( $Event.Properties[1].Value, $guidRef ) ) + if ( IsValidGUID( $Event.Properties[1].Value) ) { - $Event | Add-Member CorrelationID $Event.Properties[1].Value + $Event | Add-Member -Name CorrelationID -Value $Event.Properties[1].Value -MemberType NoteProperty } } @@ -561,9 +560,9 @@ function MakeQuery $Properties += $Property.value } - $instanceEvent | Add-Member RemoteProperties $Properties - $instanceEvent | Add-Member AdfsInstanceId $instanceEvent.Properties[0].Value - $instanceEvent | Add-Member CorrelationID $correlationID + $instanceEvent | Add-Member -Name RemoteProperties -Value $Properties -MemberType NoteProperty + $instanceEvent | Add-Member -Name AdfsInstanceId -Value $instanceEvent.Properties[0].Value -MemberType NoteProperty + $instanceEvent | Add-Member -Name CorrelationID -Value $correlationID -MemberType NoteProperty $Result += $instanceEvent } @@ -780,8 +779,32 @@ function NewObjectFromTemplate return $Template | ConvertFrom-Json } +# ---------------------------------------------------- +# +# Helper Functions - GUID for PS2.0 compatibility +# +# ---------------------------------------------------- + +function IsValidGUID +{ + param( + [parameter(Mandatory=$true)] + [string] $Guid + ) + # Current PS has "TryParse" method + if ( $null -ne [System.Guid].GetMethod("TryParse") ) { + $guidRef = [ref] [System.Guid]::NewGuid() + return [System.Guid]::TryParse( $Guid, $guidRef ) + } + try { + $tmp = New-Object System.Guid($Guid) + return $true + } catch [Exception] { + return $false + } +} @@ -1194,7 +1217,7 @@ function Process-EventsForAnalysis } # If this event signals a timeline event, generate it - if ( $event.Id -in $script:CONST_TIMELINE_AUDITS) + if ( $script:CONST_TIMELINE_AUDITS -contains $event.Id ) { $allTimeline += Generate-TimelineEvent -event $event } @@ -1438,7 +1461,7 @@ function Get-ADFSEvents [string]$FilePath, [parameter(Mandatory=$false, ValueFromPipeline=$True, ValueFromPipelineByPropertyName=$True)] - [PSCredential]$Credential + [System.Management.Automation.PSCredential]$Credential ) # TODO: Add warning if environment is not Win2016 @@ -1478,8 +1501,7 @@ function Get-ADFSEvents } # Validate Correlation ID is a valid GUID - $guidRef = [ref] [System.Guid]::NewGuid() - if ( (!$All -and !$ByTime) -and ($CorrelationID.length -eq 0 -or ![System.Guid]::TryParse( $CorrelationID, $guidRef )) ){ + if ( (!$All -and !$ByTime) -and ($CorrelationID.length -eq 0 -or !(IsValidGUID($CorrelationID))) ){ Write-Error "Invalid Correlation ID. Please provide a valid GUID." Break } From 17af6e7a1824ddacb81c32b319159daeb4a58bbe Mon Sep 17 00:00:00 2001 From: rattuscz Date: Mon, 11 Jun 2018 13:01:38 +0200 Subject: [PATCH 2/3] Must pass also IsValidGUID function inside remotely run block --- AdfsEventsModule.psm1 | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/AdfsEventsModule.psm1 b/AdfsEventsModule.psm1 index 9fa6105..71ae3c0 100644 --- a/AdfsEventsModule.psm1 +++ b/AdfsEventsModule.psm1 @@ -436,7 +436,7 @@ function MakeQuery ) # Get-WinEvent is performed through a remote powershell session to avoid firewall issues that arise from simply passing a computer name to Get-WinEvent - Invoke-Command -Session $Session -ArgumentList $Query, $Log, $script:CONST_ADFS_AUDIT, $script:CONST_AUDITS_TO_AGGREGATE, $script:CONST_AUDITS_LINKED, $IncludeLinkedInstances, $ByTime, $Start, $End, $FilePath -ScriptBlock { + Invoke-Command -Session $Session -ArgumentList $Query, $Log, $script:CONST_ADFS_AUDIT, $script:CONST_AUDITS_TO_AGGREGATE, $script:CONST_AUDITS_LINKED, $IncludeLinkedInstances, $ByTime, $Start, $End, $FilePath, ${function:IsValidGUID} -ScriptBlock { param( [string]$Query, [string]$Log, @@ -447,7 +447,8 @@ function MakeQuery [bool]$ByTime, [DateTime]$Start, [DateTime]$End, - [string]$FilePath) + [string]$FilePath, + [ScriptBlock] $IsValidGUIDfc) # # Perform Get-WinEvent call to collect logs @@ -508,7 +509,7 @@ function MakeQuery # If we didn't have an ActivityId, try to extract one manually if ( (-not $Event.ActivityId) -and $Event.Properties.count -gt 0 ) { - if ( IsValidGUID( $Event.Properties[1].Value) ) + if ( $IsValidGUIDfc.Invoke( $Event.Properties[1].Value) ) { $Event | Add-Member -Name CorrelationID -Value $Event.Properties[1].Value -MemberType NoteProperty } From ae8bc29b9c54bd049b16207248157dbbaec3a027 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20V=C3=ADtek?= Date: Mon, 9 Jul 2018 14:52:11 +0200 Subject: [PATCH 3/3] Correct IsValidGUID function param to Invoke-Command --- AdfsEventsModule.psm1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AdfsEventsModule.psm1 b/AdfsEventsModule.psm1 index 71ae3c0..09299d8 100644 --- a/AdfsEventsModule.psm1 +++ b/AdfsEventsModule.psm1 @@ -436,7 +436,7 @@ function MakeQuery ) # Get-WinEvent is performed through a remote powershell session to avoid firewall issues that arise from simply passing a computer name to Get-WinEvent - Invoke-Command -Session $Session -ArgumentList $Query, $Log, $script:CONST_ADFS_AUDIT, $script:CONST_AUDITS_TO_AGGREGATE, $script:CONST_AUDITS_LINKED, $IncludeLinkedInstances, $ByTime, $Start, $End, $FilePath, ${function:IsValidGUID} -ScriptBlock { + Invoke-Command -Session $Session -ArgumentList $Query, $Log, $script:CONST_ADFS_AUDIT, $script:CONST_AUDITS_TO_AGGREGATE, $script:CONST_AUDITS_LINKED, $IncludeLinkedInstances, $ByTime, $Start, $End, $FilePath, ${function:IsValidGUID}.ScriptBlock -ScriptBlock { param( [string]$Query, [string]$Log,