group permission control via GPO

利用GPO管理用戶端群組設定
1:于電腦物件所在之OU下新增一GPO以利管理

2:于Computer Configuration -> Windows Settings -> Security Settings -> Restricted Groups 新增物件

3-1:新增原則(修改群組物件屬性) ie:替換本機local admin群組成員 -> 新增群組(以用戶端群組為命名方式) -> 將欲套用之成員加入群組

3-1:新增原則(修改群組物件屬性) ie:替換本機Administrators群組成員 -> 新增群組(以網域群組為命民方式) -> 將網域成員加入該群組

forwarding through ssh tunnel

架構解說:
A <-B-> C
B端點為bridge~~可以連通A與C~~
預設狀態A與C不可互通~~
是故我們要建立tunnel~~讓資料可以直接在AC對傳~~而非暫存至B然後再轉送到C

1: 于端點建立tunnel: issue# ssh -T username@B -L local_port:C:port_number_of_c
說明:當資料送到local的local_port後,他其實是傳到C指定的port去
2: 透過scp進行資料傳送: issue# scp -P local_port file account_on_c@localhost
透過rsync的ssh option: issue# rsync -avz -e "ssh -p local_port" file account_on_c@localhost

注意:原本要送到遠端server的部分需改為localhost~~因為我們要利用建立好的通道幫你送資料~~

x11forwarding

利用既有SSH通道傳送X畫面

ssh -X -v username@server

監控FS存取狀態

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colShare = objWMIService.ExecNotificationQuery("Select * From __InstanceCreationEvent Within 10 Where TargetInstance ISA 'Win32_ServerConnection'")

Do While True
Set objShare = colShare.NextEvent
If Right(objShare.TargetInstance.ShareName,1) <> "$" Then
Wscript.echo objShare.TargetInstance.ShareName
Wscript.echo objShare.TargetInstance.ComputerName
Wscript.echo objShare.TargetInstance.UserName
Wscript.echo objShare.TargetInstance.NumberOfFiles
Wscript.echo objShare.TargetInstance.ActiveTime
End If
'ShareName
'ComputerName
'UserName
'上述三者為pk,當比對不到資料時進行DUMP
Loop

重整user本機群組

可以在AD上透過此script來達成修改本機群組的需求

Set WshShell = WScript.CreateObject("WScript.Shell")
HostName = WshShell.ExpandEnvironmentStrings("%COMPUTERNAME%")
set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
Set oADsSysInfo = CreateObject("ADSystemInfo")

'get domain dns name
'Set GroupSetup = objWMIService.ExecQuery("select Domain from Win32_ComputerSystem where PartOfDomain = True")
'For Each objGroupSetup in GroupSetup
' LocalDomain = objGroupSetup.Domain
'Next

'convert domain from dns name
'If Trim(LocalDomain) <> "" Then
' RegKey = """HKLM\Software\Microsoft\Windows nt\CurrentVersion\Winlogon\DomainCache""|find/I """ & LocalDomain & """"
' Result = WshShell.Exec("%ComSpec% /c reg query " & RegKey ).StdOut.ReadAll
' For Each tmp in Split(Result,vbCrLf)
' If Trim(tmp) <> "" Then
' Data = Split(Tmp,vbTab)
' If UCASE(data(2)) = UCASE(LocalDomain) Then
' Domain = UCase(Trim(data(0)))
' End If
' ENd If
' Next
'End If
Domain = oADsSysInfo.DomainShortName


set colGroup = objWMIService.ExecQuery("select * from Win32_Group where ((SID = 'S-1-5-32-544') and (Domain = '" & HostName & "')) or ((SID like 'S-1-5-%-512') and (Domain = '" & Domain & "'))")
For Each objGroup in colGroup
If UCase(objGroup.Domain) = UCase(HostName) Then
LocalAdminGroup = objGroup.name
Else
DomainAdminGroup = objGroup.name
End If
next


set colAccount = objWMIService.ExecQuery("select * from Win32_UserAccount where SID like 'S-1-5-%-500' and Domain = '" & HostName &"'")
For Each objAccount In colAccount
LocalAdminUser = objAccount.name
next


'remove account from local administrators
' Set objGroup = GetObject("WinNT://" & HostName & "/" & LocalAdminGroup)
' Set memberlist = objGroup.members
' For Each member In memberlist
' Tmp = Split(member.Parent,"/")
' If UCase(Tmp(UBound(Tmp))) = UCase(HostName) Then 'local account
' If UCase(member.Name) <> UCase(LocalAdminUser) Then
' objGroup.Remove(member.AdsPath)
' End If
' Else 'Domain Account
' If UCASE(member.AdsPath) <> UCASE("WinNT://" & Domain & "/" & DomainAdminGroup) Then ' Keep domain admins in the local administrators group
' objGroup.Remove(member.AdsPath)
' End If
' End IF
' next

'change local admin password
' set objUser = GetObject("WinNT://" & HostName & "/" & LocalAdminUser)
' objUser.SetPassword("Password")

windows預設分享權限設置

機碼位置
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\DefaultSecurity
此內容會被經過編碼,導致無法直接進行修改
可以透過tweakui將預設值修改完成後,匯出重新整入系統
注意:因為此為HKLM等級機碼,非一般user即可套用,此時可採用GPO的開機指令碼,亦或是利用autohotkey來作patch

exchange使用空間監控通知

If Weekday(Date) <2 OR Weekday(Date)>6 Then
Wscript.Quit
End If

ExChangeServer = "kido.idv.tw"
ExtremeSize = 50*1024

Set objService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & ExChangeServer & "\root\MicrosoftExchangeV2")

Set colSettings = objService.ExecQuery("Select * from Exchange_Mailbox")
On Error Resume Next
For Each obj in colSettings
If Instr(UCase(obj.MailboxDisplayName),"(NTCTX)") And CLng(obj.Size) > CLng(ExtremeSize) Then
Result = Result & "" & vbCrLf &_
"" & obj.MailboxDisplayName & "" & vbCrLf &_
"" & obj.Size & "" & vbCrLf &_
"" & obj.TotalItems & "" & vbCrLf &_
""
End If
Next
If Result <> "" Then
Mail "Mailbox healthy check!",RebuildMsg(Result)
End If
Function RebuildMsg(msg)
msg = "" &_
"" & vbCrLf &_
"" & vbCrLf &_
"" & vbCrLf &_
"" & vbCrLf &_
"" &_
msg
msg = msg & "

" & "Emp Name" & "

" & "Mail Size (KB)" & "

" & "Mail Count" & "

"
RebuildMsg = msg
End Function

Sub Mail(Subject,Content)
MailFrom = "kido@kido.idv.tw"
MailTo = "kido@kido.idv.tw"
If Len(Content) = 0 Then
Exit Sub
End If
Set objEmail = CreateObject("CDO.Message")
objEmail.From = MailFrom
objEmail.To = MailTo
objEmail.Cc = MailCC
objEmail.Subject = Subject
objEmail.HTMLBody = Content
objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = ExChangeServer
objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
objEmail.Configuration.Fields.Update
objEmail.Send
End Sub

除此方法外~~上可利用powershell來作~~功能相同~~都是利用WMI去截取Exchange的值