🔐 Security Audit Tools

PowerShell scripts for auditing Windows security configurations, local administrator memberships, and compliance with security best practices.

These tools help identify privilege escalation risks, insecure local group configurations, and non-compliant administrative access across Windows systems.

---

📋 Table of Contents

• Overview
• Scripts
• Features
• Usage
• Output
• Object Model
• CSV Export
• Use Cases
• Notes
• License
• Author

---

📋 Overview

Security auditing is a critical part of Windows infrastructure and Active Directory environments.

This toolkit helps administrators:

• Identify privileged accounts on local systems
• Detect risky group memberships (e.g., Domain Admins in local Administrators)
• Find disabled or stale administrative accounts
• Generate compliance-ready audit reports (CSV)
• Support security hardening and least privilege enforcement

---

📜 Scripts

🔍 Get-LocalAdminAudit.ps1

Performs a comprehensive audit of local Administrators group membership across one or multiple Windows systems.

---

✨ Features

• Lists all members of the local Administrators group

• Distinguishes between local users, domain users, and groups

• Detects high-risk configurations:

  • Domain Admins in local Administrators
  • Disabled accounts with administrative rights
  • Built-in Administrator usage

• Identifies stale or inactive accounts (where available)

• Supports multi-computer remote auditing

• Exports results to CSV for compliance reporting

• Returns structured PowerShell objects for automation

---

🚀 Usage

🔹 Audit local machine

.\Get-LocalAdminAudit.ps1

---

🔹 Audit multiple servers

.\Get-LocalAdminAudit.ps1 -ComputerName "SERVER01","SERVER02"

---

🔹 Export results to CSV

.\Get-LocalAdminAudit.ps1 -ComputerName "SERVER01","SERVER02" -ExportPath "C:\Audit\admins.csv"

---

📊 Output

The script produces three types of output:

• Console output (interactive review)
• Structured PowerShell objects (automation)
• CSV export (compliance / SIEM ingestion)

---

🔹 Console output example

========================================
 Local Administrators Security Audit
 Author: Vlad Gorin | sysadmintips.ru
========================================

Auditing: SERVER01
----------------------------------------
✓ Found 5 local administrator(s)

⚠ DOMAIN\Domain Admins [Group] - Domain Admins as local admins (security risk)
⚠ LegacyUser [User] - Disabled account in admin group
✓ Administrator [User]
ℹ BUILTIN\Administrator [User] - Built-in Administrator account

---

🧩 Object Model

The script returns structured PowerShell objects for automation:

$results = .\Get-LocalAdminAudit.ps1
$results | Format-Table

🔹 Object schema

• Computer
• Timestamp
• AccountName
• AccountType
• Description
• Disabled
• LastLogin
• RiskLevel

---

🔹 Example object

Computer     : SERVER01
AccountName  : DOMAIN\Domain Admins
AccountType  : Group
Disabled     : False
LastLogin    : N/A
RiskLevel    : Domain Admins as local admins (security risk)

---

📦 CSV Export

When -ExportPath is specified, results are exported in flat compliance format:

Computer,Timestamp,AccountName,AccountType,Description,Disabled,LastLogin,RiskLevel

---

🧠 Use Cases

• Local privilege escalation risk detection
• Active Directory security auditing
• Server hardening validation
• Compliance reporting automation
• Enterprise identity security reviews
• Least privilege enforcement validation

---

🔗 Notes

• Requires administrative privileges on target systems
• Supports PowerShell Remoting (WinRM)
• Compatible with Windows Server 2012+
• Works with PowerShell 5.1 and PowerShell 7+

---

📄 License

MIT License

---

👤 Author

Vlad Gorin