<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# PowerShell Security Scripts — API Reference

## secedit

```powershell
# Export local security policy
secedit /export /cfg C:\temp\secpol.cfg /quiet

# Analyze against a template
secedit /analyze /db C:\temp\secedit.sdb /cfg C:\temp\baseline.inf

# Configure from template
secedit /configure /db C:\temp\secedit.sdb /cfg C:\temp\baseline.inf /overwrite
```

## ActiveDirectory Module

```powershell
# Get stale users
Get-ADUser -Filter {LastLogonDate -lt $cutoff -and Enabled -eq $true} -Properties LastLogonDate

# Domain Admins membership
Get-ADGroupMember -Identity "Domain Admins" -Recursive | Get-ADUser -Properties LastLogonDate

# Service accounts with passwords never expiring
Get-ADUser -Filter {PasswordNeverExpires -eq $true -and Enabled -eq $true} -Properties PasswordNeverExpires

# Computers not logged in for 90 days
Get-ADComputer -Filter {LastLogonDate -lt $cutoff} -Properties LastLogonDate
```

## Get-WinEvent

```powershell
# Failed logons (4625)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)}

# Privilege escalation (4672)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672}

# Service installations (7045)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045}

# PowerShell script block logging (4104)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104}
```

## WinRM Remoting

```powershell
# Enable remoting
Enable-PSRemoting -Force

# Remote session
$session = New-PSSession -ComputerName Server01 -Credential (Get-Credential)
Invoke-Command -Session $session -ScriptBlock { Get-Process }
Remove-PSSession $session

# Invoke on multiple hosts
Invoke-Command -ComputerName Server01,Server02 -ScriptBlock { Get-Service | Where-Object Status -eq Running }
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Audit completed, no policy violations |
| 1 | Findings detected (stale accounts, policy drift) |
| 2 | Runtime error or access denied |
