我有几个在其LOCAL组策略下configuration了IPSec的Server 2008 R2域控制器。 这些条目不存在于Windows防火墙或networkingGPO中。 这些政策陈旧而复杂,阻止我们增加新的区议会。
我正在寻找出口/转储的规则,所以我可以简化和testing在一个单独的环境。 我的首选解决scheme将在CMD / PowerShell中。
无论是在“本地”还是“组”策略中,一旦导入服务器就会在本地存储中看到它。 由于这是带有POSHv2的Server 2008 R2,所以我们仅限于使用netsh命令,但是我在PowerShell内部封装了输出,以便可以将对象导出到远程计算机上进行分析。
$OutFile = "$env:temp\IPsecRules.csv" $objects = @() netsh ipsec static show filterlist all level=verbose | Select-String ':' | ForEach-Object { $split = $_.Line.Split(':') $name = $split[0].Trim() $value = $split[1].Trim() switch ($name) { 'Description' {${Description} = $value} 'Store' {${Store} = $value} 'Last Modified' {${Last Modified} = $value} 'GUID' {${GUID} = $value} 'No. of Filters' {${No. of Filters} = $value} 'Mirrored' {${Mirrored} = $value} 'Source IP Address' {${Source IP Address} = $value} 'Source Mask' {${Source Mask} = $value} 'Source DNS Name' {${Source DNS Name} = $value} 'Destination IP Address' {${Destination IP Address} = $value} 'Destination Mask' {${Destination Mask} = $value} 'Destination DNS Name' {${Destination DNS Name} = $value} 'Protocol' {${Protocol} = $value} 'Source Port' {${Source Port} = $value} 'Destination Port' {${Destination Port} = $value} #'FilterList Name' {${FilterList Name} = $value} } If (${Destination Port}) { $object = New-Object psobject -Property @{ 'Description' = ${Description} 'Store' = ${Store} 'Last Modified' = ${Last Modified} 'GUID' = ${GUID} 'No. of Filters' = ${No. of Filters} #'Description' = ${Description} 'Mirrored' = ${Mirrored} 'Source IP Address' = ${Source IP Address} 'Source Mask' = ${Source Mask} 'Source DNS Name' = ${Source DNS Name} 'Destination IP Address' = ${Destination IP Address} 'Destination Mask' = ${Destination Mask} 'Destination DNS Name' = ${Destination DNS Name} 'Protocol' = ${Protocol} 'Source Port' = ${Source Port} 'Destination Port' = ${Destination Port} #'FilterList Name' = ${FilterList Name} } $objects += $object ${Destination Port} = "" } } $objects | Export-Csv -Path "c:\temp\IPsecRules.csv" -NoTypeInformation -Force
编辑:重写脚本以提供更多信息。 只需要详细的filter列表查询。