C02 — Vận hành chương trình GRC

# Policy requirement: MinPasswordLength=14, ComplexityEnabled=True, MaxAge=90 days
$policyRequirements = @{
    MinPasswordLength  = 14
    ComplexityEnabled  = $true
    MaxPasswordAgeDays = 90
    LockoutThreshold   = 5
}

# Lấy default domain password policy
Import-Module ActiveDirectory
$domainPolicy = Get-ADDefaultDomainPasswordPolicy

$policyFindings = @()

# Check MinPasswordLength
$policyFindings += [PSCustomObject]@{
    Control  = "IA-5(1)"
    Check    = "MinPasswordLength"
    Required = $policyRequirements.MinPasswordLength
    Actual   = $domainPolicy.MinPasswordLength
    Status   = if ($domainPolicy.MinPasswordLength -ge $policyRequirements.MinPasswordLength) { "PASS" } else { "FAIL" }
}

# Check Complexity
$policyFindings += [PSCustomObject]@{
    Control  = "IA-5(1)"
    Check    = "ComplexityEnabled"
    Required = $policyRequirements.ComplexityEnabled
    Actual   = $domainPolicy.ComplexityEnabled
    Status   = if ($domainPolicy.ComplexityEnabled -eq $policyRequirements.ComplexityEnabled) { "PASS" } else { "FAIL" }
}

# Check MaxPasswordAge
$maxAgeDays = $domainPolicy.MaxPasswordAge.TotalDays
$policyFindings += [PSCustomObject]@{
    Control  = "IA-5(f)"
    Check    = "MaxPasswordAgeDays"
    Required = $policyRequirements.MaxPasswordAgeDays
    Actual   = $maxAgeDays
    Status   = if ($maxAgeDays -le $policyRequirements.MaxPasswordAgeDays -and $maxAgeDays -gt 0) { "PASS" } else { "FAIL" }
}

$policyFindings | Format-Table -AutoSize

# Lấy users enabled và kiểm tra training attribute (extensionAttribute1 = training date)
$users = Get-ADUser -Filter {Enabled -eq $true} `
    -Properties DisplayName, Department, Mail, extensionAttribute1 |
    Where-Object { $_.DistinguishedName -notlike "*OU=ServiceAccounts*" }

$trainingReport = foreach ($user in $users) {
    $trainingDate = $null
    $status       = "NOT COMPLETED"
    $daysAgo      = $null

    if ($user.extensionAttribute1) {
        $trainingDate = [datetime]::ParseExact($user.extensionAttribute1, "yyyy-MM-dd", $null)
        $daysAgo      = (Get-Date) - $trainingDate
        $status       = if ($daysAgo.Days -le 365) { "CURRENT" } else { "OVERDUE" }
    }

    [PSCustomObject]@{
        Name         = $user.DisplayName
        Department   = $user.Department
        Email        = $user.Mail
        LastTraining = $trainingDate
        DaysAgo      = $daysAgo?.Days
        Status       = $status
    }
}

$trainingReport | Export-Csv "C:\GRC\training-compliance.csv" -NoTypeInformation
$summary = $trainingReport | Group-Object Status | Select-Object Name, Count
Write-Host "Training Compliance Summary:" -ForegroundColor Yellow
$summary | Format-Table