Add Privileged User Groups

[rebelinux]

Microsoft recommends that Enterprise Admins and Schema Admins contain no members and that Domain Admins contain no more than five members.

Table design:

Domain Admins (1 members)

Name	SamAccountName	Password Last Changed	Password Never Expires	Account Enabled
Administrator	Administrator	6/10/2018	True	True

Enterprise Admins

Schema Admins

Health Check recommendation:

Unless an account is doing specific tasks needing those highly elevated permissions, every account should be removed from Enterprise Admins (EA) and Schema Admins (SA). Domain Admins should be reviewed, and all disabled accounts removed. Also, membership in Domain Admins should be thoroughly reviewed as membership to that group can be a potential security issue.

Health Check Rules:

if ($HealthCheck.Jobs.Status) {
    $OutObj | Where-Object { $_.'Password Last Changed ' -lt '30 days' } | Set-Style -Style Critical -Property 'Password Last Changed '
    $OutObj | Where-Object { $_.'Password Never Expires' -eq 'True' } | Set-Style -Style Warning -Property 'Password Never Expires'
    $OutObj | Where-Object { $_.'Account Enabled' -eq 'False' } | Set-Style -Style Warning -Property 'Account Enabled'
}