Scheduled Email Reports of at Risk Users

Configuration Management

Create a file called configuration.txt. There will be 2 entries in this file:

1. Number of days for which the logs will be evaluated

2. The automated execution time of the string

   1. If the execution time is 1:12 PM , it will indicate that the script will be automatically run at 1:12 PM everyday.

Write a PowerShell script called Configuration.ps1.

This script will provide a menu with 3 options.

• Option 1: Show configuration (configuration should be displayed as pscustomobject) • Option 2: Change configuration o This option will ask the user for new configuration and replace the old configuration with new • Option 3: Exit (to exit the menu)

Input Filtering:

• Display proper messages to users

• Menu should not except any input other than 1, 2, or 3.

• The days should be taken only as digits.

• The execution time should only be taken in the format digit:digitdigit AM/PM

Script Functions: • readConfiguration • changeConfiguration • configurationMenu

Full Configuration Menu Script!

SYS-320-Automating-and-Scripting/week7/configuration.ps1 at main · Hsanokklis/SYS-320-Automating-and-ScriptingGitHub

Powershell Email

• Keep the same configuration.txt file that we used above

• Use the following link to create an app password -->

  • https://security.google.com/settings/security/apppasswords

• It will then generate you a password; take a picture of it or put it in a password manager so you don't loose it

Create a script called Email.ps1

Have a function called SendAlertEmail in this script file that will take 1 parameter called $Body.

function SendAlertEmail($Body){

$From = "[e-mail]"
$To = "[e-mail]"
$Subject = "Suspicious Activity"

$Password = "xxxx xxxx xxxx xxxx" | ConvertTo-SecureString -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $From, $Password

Send-MailMessage -From $From -To $To -Subject $Subject -Body $Body -SmtpServer "smtp.gmail.com" `
-port 587 -UseSsl -Credential $Credential

}

SendAlertEmail "Body of email"

Email in Inbox

Scheduler

Create a script file called Scheduler.ps1.

#---------------------------------------------------------------------------------------------------------------
# function ChooseTimeToRun 
# Description: This function checks if a task named "myTask" already exists, if it does, it will call 
# DisableAutoRun to remote it. It will then create a new schuled task that runs daily, at a specifed time. 
# It is also configured to only run when there is a network connection
#---------------------------------------------------------------------------------------------------------------
function ChooseTimeToRun($Time){

$scheduledTasks = Get-ScheduledTask | Where-Object { $_.TaskName -ilike "myTask" }

#checks to see if task already exists
if($scheduledTasks -ne $null){
    Write-Host "the task already exists." | Out-String
    DisableAutoRun #removes existing task
}

Write-Host "Creating new task." | Out-String

$action = New-ScheduledTaskAction -Execute "powershell.exe" `
          -argument "-File "C:\Users\champuser\SYS-320-Automating-and-Scripting\week7\main.ps1""

$trigger = New-ScheduledTaskTrigger -Daily -At $Time #task tiggers daily 
$principal = New-ScheduledTaskPrincipal -UserId 'champuser' -RunLevel Highest #run unders highest privledges 
$settings = New-ScheduledTaskSettingsSet -RunOnlyIfNetworkAvailable -WakeToRun #only runs if there is a network connection
$task = New-ScheduledTask -Action $action -Principal $principal -Trigger $trigger -Settings $settings

Register-ScheduledTask 'myTask' -InputObject $task

Get-ScheduledTask | Where-Object { $_.TaskName -ilike "myTask"}
}

#-----------------------------------------------------------------------------------------------
#function DisableAutoRun
# Description: This function is called on by ChooseTimeToRun to delete a task if it already 
# exists. 
#-----------------------------------------------------------------------------------------------

function DisableAutoRun(){ 

$scheduledTasks = Get-ScheduledTask | Where-Object { $_.TaskName -ilike "myTask"}

if($scheduledTasks -ne $null){
    Write-Host "Unregistering the task." | Out-String
    Unregister-ScheduledTask -TaskName 'myTask' -Confirm:$false
}
else{
    Write-Host "The task is not registered." | Out-String
}
}

Putting it all Together

Create a script file called main.ps1. Use dot notation to include the script files Email.ps1, Scheduler.ps1, Configuration.ps1, and Event-Logs.ps1 (from last week). In main.ps1:

Output of Task Creation

Scheduled Email Working!

Final Scripts

SYS-320-Automating-and-Scripting/week7 at main · Hsanokklis/SYS-320-Automating-and-ScriptingGitHub