Windows Defender
# check the status of defender
Get-MpComputerStatusAppLocker
An application whitelist solution to prevent malware and unapproved software to run. It gives administrator control over which applications and files users can run, providing granular control over executables, scripts, Windows installer files, DLLs, packages apps, and packed app installers.
Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollectionsConstrained Language Mode
Locks down many of the features needed to use Powershell effectively, such as blocking COM objects, only allowing. NEt types, etc.
$ExecutionContext.SessionState.LanguageModeLAPS
Local Administrator Password Solution (LAPS) used to randomize and rotate local administrator passwords on Windows hosts and prevent lateral movement. The LAPSToolkit allows us to view the many functions related to LAPS.
# show groups delegated to read LAPS passwords
Find-LAPSDelegatedGroupsUsers with “All Extended Rights” can read LAPS passwords and may be less protected than users in delegated groups.
# check for users with All Extended Rights
Find-AdmPwdExtendedRights
# search for computer have LAPS enabled
Get-LAPSComputers