# encoding: ascii
# api: powershell
# title: AD-PromiscDetect
# description: Promiscuous Mode Check
# version: 1.1
# type: script
# license: CC0
# x-poshcode-id: 1417
# x-archived: 2009-10-26T15:25:55
#
# queries Active Directory for all computer objects then checks if the computers’ NICs are in promiscuous mode.
#
<#================================================================================================
  NAME:                 	AD-PromiscDetect.ps1
  AUTHOR:			Marty J. Piccinich
  DATE CREATED: 		9/15/2009
  VERSION:  	          1.1
  HISTORY:         		1.0 9/15/2009 - Created
			1.1 10/23/2009 - Added comment header
  PARAMETERS: None
  
  DESCRIPTION:
    Queries Active Directory (currently logged into) for all computer objects,
    pings the computer first, then queries WMI. The MSNdis_CurrentPackFilter class
    in the root\WMI namespace is used. Next, the NdisCurrentPacketFilter property to
    see if the NDIS_PACKET_TYPE_PROMISCUOUS bit (0x00000020) is set. This determines
    if the NIC is is promiscuous mode.

  REQUIREMENTS:
    Proper rights to query WMI\Root on the remote computers is necessary.

  NOTES:
    For more details, see the blog post:
    http://praetorianprefect.com/archives/2009/09/whos-being-promiscuous-in-your-active-directory/
    Credit to Harlan Carvey who provided information on NdisCurrentPacketFilter in his blog.
	
  IMPORTANT:
	You have a royalty-free right to use, modify, reproduce, and
	distribute this script file in any way you find useful, provided that
	you agree that the creator, owner above has no warranty, obligations,
	or liability for such use.
================================================================================================#> 
$ErrorActionPreference = "SilentlyContinue" 

$PingTest = New-Object System.Net.NetworkInformation.Ping
$Filter = "(&(ObjectCategory=computer))"
$Searcher = New-Object System.DirectoryServices.DirectorySearcher($Filter)
ForEach ($comp in $Searcher.Findall()) {
	$strComputer = $comp.properties.item("Name")
	write-host "Checking: $strComputer"
	if ($PingTest.Send($strComputer).Status -eq "Success") {			
		$colComputer = get-wmiObject -class "MSNdis_CurrentPacketFilter" -namespace "root\WMI" -comp $strComputer
		if ($colComputer -eq $null) {
			write-host "Couldn't connect to WMI" }
		else {
			foreach ($comp in $colcomputer) {
				$val = $comp.NdisCurrentPacketFilter
				if ($val -band 0x00000020) {
					$inst = $comp.InstanceName
					write-host "Interface: $inst"
					write-host "The packetfilter value is above range" -foregroundcolor red -backgroundcolor yellow
				}
			}
		} 
	}
	else { write-host "Could not ping, machine not queried." }
}
