ScriptSentry finds misconfigured and dangerous logon scripts.
https://offsec.blog/hidden-menace-how-to-identify-misconfigured-and-dangerous-logon-scripts/
# Run ScriptSentry and display results on the console IEX(Invoke-WebRequest 'https://raw.githubusercontent.com/techspence/ScriptSentry/main/Invoke-ScriptSentry.ps1') Invoke-ScriptSentry # Run ScriptSentry and save output to a text file IEX(Invoke-WebRequest 'https://raw.githubusercontent.com/techspence/ScriptSentry/main/Invoke-ScriptSentry.ps1') Invoke-ScriptSentry | Out-File c:\temp\ScriptSentry.txt # Run ScriptSentry and save results to ScriptSentryResults.csv in the current directory IEX(Invoke-WebRequest 'https://raw.githubusercontent.com/techspence/ScriptSentry/main/Invoke-ScriptSentry.ps1') Invoke-ScriptSentry -SaveOutput $true # Save results to a specific directory Invoke-ScriptSentry -SaveOutput $true -OutputDirectory C:\Temp\ScriptSentry # Use alternate credentials for LDAP queries $Credential = Get-Credential Invoke-ScriptSentry -Credential $Credential # Query a specific domain controller and domain Invoke-ScriptSentry -Server DC01.contoso.com -Domain contoso.com # Query a specific domain controller with alternate credentials Invoke-ScriptSentry -Server DC01.contoso.com -Domain contoso.com -Credential $Credential
-Server and -Domain must be used together. -Credential applies to LDAP queries; SYSVOL, NETLOGON, and other UNC paths are accessed as the user running PowerShell.
########## Plaintext credentials ##########
Misconfiguration Description Details
---------------- ----------- -------
LSM-Creds Plaintext credentials within a logon script \\contoso.com\sysvol\contoso.com\scripts\logon.bat - net use Z: \\FS01\Tools /user:CONTOSO\svc.deploy [REDACTED]
########## Unsafe UNC folder permissions ##########
Misconfiguration Description Details
---------------- ----------- -------
LSM-Access-1 Unsafe UNC folder permissions CONTOSO\Domain Users with Modify on \\FS01\Tools
########## Unsafe UNC file permissions ##########
Misconfiguration Description Details
---------------- ----------- -------
LSM-Access-2 Unsafe UNC file permissions CONTOSO\Domain Users with Modify on \\FS01\Tools\startup.ps1
########## Unsafe NETLOGON/SYSVOL permissions ##########
Misconfiguration Description Details
---------------- ----------- -------
LSM-Access-3 Unsafe NETLOGON/SYSVOL permissions CONTOSO\Domain Users with Modify on \\contoso.com\NETLOGON
########## Unsafe logon script permissions ##########
Misconfiguration Description Details
---------------- ----------- -------
LSM-Access-4 Unsafe logon script permissions CONTOSO\Domain Users with Modify on \\contoso.com\sysvol\contoso.com\scripts\logon.bat
########## Unsafe GPO logon script permissions ##########
Misconfiguration Description Details
---------------- ----------- -------
LSM-Access-5 Unsafe GPO logon script permissions CONTOSO\Domain Users with Modify on \\contoso.com\NETLOGON\logon.bat
########## Admins with logonscripts ##########
Misconfiguration Description Details
---------------- ----------- -------
LSM-Admins-1 Admins with logonscripts CN=Administrator,CN=Users,DC=contoso,DC=com - logon.bat
########## Nonexistent Shares ##########
Misconfiguration Description Details
---------------- ----------- -------
LSM-Shares Non-existent shares \\OLD-FS01\Legacy mapped in \\contoso.com\sysvol\contoso.com\scripts\logon.bat
########## Admins with logonscripts mapped from nonexistent share ##########
Misconfiguration Description Details
---------------- ----------- -------
LSM-Admins-2 Admins with logonscripts mapped from nonexistent share CN=Administrator,CN=Users,DC=contoso,DC=com - logon.bat mapping \\OLD-FS01\Legacy