Invoke-SecurityAudit.ps1

# Local security audit: system, security settings, accounts, and services, exported to CSV/JSON.
# Full write-up: https://www.securityscriptographer.com/2026/06/building-powershell-security-audit.html
# Part of https://github.com/SecurityScriptographer/defensive-toolkit
#
# Run elevated for complete results (BitLocker status and some service details
# need admin). Works on Windows PowerShell 5.1 and PowerShell 7.

[CmdletBinding()]
param(
    [string]$OutputDirectory = "$env:ProgramData\SecurityAudit",
    [ValidateSet('Csv','Json','Both')] [string]$Format = 'Both'
)

$ErrorActionPreference = 'Stop'
$timestamp  = Get-Date -Format 'yyyyMMdd_HHmmss'
$reportPath = Join-Path $OutputDirectory "$env:COMPUTERNAME`_$timestamp"
New-Item -ItemType Directory -Path $OutputDirectory -Force | Out-Null

function Get-SystemSignal {
    $os = Get-CimInstance Win32_OperatingSystem
    $cs = Get-CimInstance Win32_ComputerSystem
    [PSCustomObject]@{
        Hostname   = $env:COMPUTERNAME
        OS         = $os.Caption
        Build      = $os.Version
        LastBoot   = $os.LastBootUpTime
        Domain     = $cs.Domain
        MemoryGB   = [math]::Round($cs.TotalPhysicalMemory/1GB,1)
        UptimeDays = [math]::Round(((Get-Date) - $os.LastBootUpTime).TotalDays,1)
    }
}

function Get-SecuritySignal {
    [PSCustomObject]@{
        FirewallProfiles = (Get-NetFirewallProfile |
            ForEach-Object { "$($_.Name)=$($_.Enabled)" }) -join '; '
        Antivirus  = (Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue).DisplayName -join '; '
        UACEnabled = ((Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System').EnableLUA -eq 1)
        BitLockerC = (Get-BitLockerVolume -MountPoint 'C:' -ErrorAction SilentlyContinue).ProtectionStatus
        PSVersion  = $PSVersionTable.PSVersion.ToString()
    }
}

function Get-AccountSignal {
    [PSCustomObject]@{
        EnabledLocalUsers = (Get-LocalUser | Where-Object Enabled).Name -join '; '
        LocalAdmins       = (Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue).Name -join '; '
        NewestUser        = (Get-LocalUser | Sort-Object { $_.PasswordLastSet } -Descending |
            Select-Object -First 1).Name
    }
}

function Get-ServiceSignal {
    [PSCustomObject]@{
        SuspiciousPaths = (Get-CimInstance Win32_Service |
            Where-Object { $_.PathName -match 'temp|appdata|users\\public' }).Name -join '; '
        AutoStopped = (Get-Service |
            Where-Object { $_.StartType -eq 'Automatic' -and $_.Status -eq 'Stopped' }).Name -join '; '
        ExternalConnections = (Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
            Where-Object { $_.RemoteAddress -notmatch '^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.|^127\.|^::1' } |
            Measure-Object).Count
    }
}

function Invoke-Signal {
    param([scriptblock]$Block, [string]$Name)
    try   { & $Block }
    catch { Write-Warning "$Name failed: $($_.Exception.Message)"
            [PSCustomObject]@{ Error = $_.Exception.Message } }
}

$record = [ordered]@{
    Timestamp = Get-Date
    Host      = $env:COMPUTERNAME
    System    = Invoke-Signal { Get-SystemSignal   } 'System'
    Security  = Invoke-Signal { Get-SecuritySignal } 'Security'
    Accounts  = Invoke-Signal { Get-AccountSignal  } 'Accounts'
    Services  = Invoke-Signal { Get-ServiceSignal  } 'Services'
}

if ($Format -in 'Json','Both') {
    $record | ConvertTo-Json -Depth 5 | Out-File -FilePath "$reportPath.json" -Encoding UTF8
    Write-Host "JSON report: $reportPath.json"
}

if ($Format -in 'Csv','Both') {
    # one flat row per signal group; ListSeparator matches what local Excel expects
    $sep = (Get-Culture).TextInfo.ListSeparator
    foreach ($key in 'System','Security','Accounts','Services') {
        $record[$key] |
            Select-Object * -ExcludeProperty PS* |
            Export-Csv -Path "$reportPath`_$key.csv" -NoTypeInformation -Delimiter $sep
    }
    Write-Host "CSV reports: $reportPath`_<signal>.csv"
}