增强 PowerShell 脚本以在 AsBuiltReport Framework 中查询 GPO 上的端口

Question

I got the current script (from this answer ) which I want to improve.

The script should retrieve the desired ports if they are enabled and allowed within the inbound direction. Filters for Action/Enabled/Direction work perfectly but I still need that the filters for the Local ports will retrieve only unique results within the defined ports but still show other ports as well.

Additional question:

1. how do I add the IP of the machine to the query?
2. I would like to use AsBuiltReport to publish the results. How does it do?
3. I would like to trigger it remotely I do it through invoke command but if there is a best practice for this I would like to be aware of that.
4. How can I have only the relevant ports I mentioned and not anything else?

`

Get-NetFirewallRule -Action Allow -Enabled True -Direction Inbound | 
  Where-Object { 
    $portFilter = $PSItem | Get-NetFirewallPortFilter | Select-Object -Unique
    $portFilter.LocalPort -match '^(80|135|139|445|5985|5986)$' -or 
      ($portFilter.LocalPort -ge 49152 -and $portFilter.LocalPort -le 65535)} |
      Format-Table Name,Profile,
Enabled,
Direction,
Action,
@{Name='Protocol';Expression={($PSItem | Get-NetFirewallPortFilter).Protocol}},
@{ Name='LocalPort'; Expression={$portFilter.LocalPort | Select-Object -Unique}},
@{Name='RemotePort';Expression={($PSItem | Get-NetFirewallPortFilter).RemotePort}}

`

Thanks

I put the Select-Object -Unique before the filters to get only unique results.

I put -match before the relevant ports and conditions for the range port.

I expect the query to result unique values with the coming ports Ports 80 or 135 or 139 or 445 or 5985 or 5986 or range between 49152 and 65535

Answer 1

Here's how I would do it. Takes about 8 seconds. With invoke-command, pscomputername has the hostname, and there's also a runspaceid. -pv is pipelinevariable. I have to put get.netfirewallrule inside % or foreach-object so it runs for every instance of the port info.

Annoying how localport can be an object array or a string with dashes or a word like 'Any'. Filtering them numerically is problemmatic.

LocalPort                    type
---------                    ----
546                          System.String
{554, 8554-8558}             System.Object[]
5000-5020                    System.String
{554, 8554, 8555, 8556...}   System.Object[]
{80, 443}                    System.Object[]
Any                          System.String
IPHTTPSIn                    System.String
PlayToDiscovery              System.String
RPC                          System.String
RPCEPMap                     System.String
Teredo                       System.String

1024-65535
5000-5020
8554-8558
7200-17210

invoke-command localhost { Get-NetFirewallPortFilter | 
  ? {
  80 -in $_.localport -or
  135 -in $_.localport -or
  139 -in $_.localport -or
  445 -in $_.localport -or
  5985 -in $_.localport -or
  5986 -in $_.localport -or
  $(if($_.localport -as 'int') { ([int]$_.LocalPort -ge 49152 -and
    [int]$_.LocalPort -le 65535) } )
  } -pv port | 
  % { $_ | Get-NetFirewallRule } |
  ? { $_.action -eq 'allow' -and $_.enabled -eq $true -and
  $_.direction -eq 'inbound' } | 
  select Name,Profile,Enabled,Direction,Action,
  @{n='Protocol';e={$port.Protocol}},
  @{n='Localport';e={$port.Localport}},
  @{n='Remoteport';e={$port.Remoteport}} } | ft -a


Name                          Profile         Enabled Direction Action Protocol Localport Remoteport PSComputerName RunspaceId
----                          -------         ------- --------- ------ -------- --------- ---------- -------------- ----------
WINRM-HTTP-In-TCP-NoScope     Domain, Private True    Inbound   Allow  TCP      5985      Any        localhost      8366c72c-e868-4e50-adb5-85c4deea3583
WINRM-HTTP-In-TCP             Public          True    Inbound   Allow  TCP      5985      Any        localhost      8366c72c-e868-4e50-adb5-85c4deea3583
IIS-WebServerRole-HTTP-In-TCP Any             True    Inbound   Allow  TCP      80        Any        localhost      8366c72c-e868-4e50-adb5-85c4deea3583