Skip to content

Commit 77a1fbe

Browse files
johljujohlju
committed
Add new resource SqlServerAuditSpecification
1 parent 795dd0d commit 77a1fbe

12 files changed

+2313
-0
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ For older change log history see the [historic changelog](HISTORIC_CHANGELOG.md)
1111

1212
- SqlServerDsc
1313
- Add new resource SqlServerAudit.
14+
- Add new resource SqlServerAuditSpecification.
1415

1516
### Changed
1617

‎source/DSCResources/DSC_SqlServerAuditSpecification/DSC_SqlServerAuditSpecification.psm1‎

Lines changed: 1426 additions & 0 deletions
Large diffs are not rendered by default.

‎source/DSCResources/DSC_SqlServerAuditSpecification/DSC_SqlServerAuditSpecification.schema.mof‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
[ClassVersion("1.0.0.0"), FriendlyName("SqlServerAuditSpecification")]
2+
class DSC_SqlServerAuditSpecification : OMI_BaseResource
3+
{
4+
[Key, Description("Specifies the host name of the SQL Server on which the instance exist.")] String ServerName;
5+
[Key, Description("Specifies the SQL instance in which the Audit exist.")] String InstanceName;
6+
[Key, Description("Specifies the name of the SQL audit specification to be added or removed.")] String Name;
7+
[Write, Description("Specifies if the audit specification should be enabled. Defaults to $false")] Boolean Enabled;
8+
[Write, Description("Specifies the audit to be used as storage.")] String AuditName;
9+
[Write, Description("Specifies if this property should be audited.")] Boolean ApplicationRoleChangePasswordGroup;
10+
[Write, Description("Specifies if this property should be audited.")] Boolean AuditChangeGroup;
11+
[Write, Description("Specifies if this property should be audited.")] Boolean BackupRestoreGroup;
12+
[Write, Description("Specifies if this property should be audited.")] Boolean BrokerLoginGroup;
13+
[Write, Description("Specifies if this property should be audited.")] Boolean DatabaseChangeGroup;
14+
[Write, Description("Specifies if this property should be audited.")] Boolean DatabaseLogoutGroup;
15+
[Write, Description("Specifies if this property should be audited.")] Boolean DatabaseMirroringLoginGroup;
16+
[Write, Description("Specifies if this property should be audited.")] Boolean DatabaseObjectAccessGroup;
17+
[Write, Description("Specifies if this property should be audited.")] Boolean DatabaseObjectChangeGroup;
18+
[Write, Description("Specifies if this property should be audited.")] Boolean DatabaseObjectOwnershipChangeGroup;
19+
[Write, Description("Specifies if this property should be audited.")] Boolean DatabaseObjectPermissionChangeGroup;
20+
[Write, Description("Specifies if this property should be audited.")] Boolean DatabaseOperationGroup;
21+
[Write, Description("Specifies if this property should be audited.")] Boolean DatabaseOwnershipChangeGroup;
22+
[Write, Description("Specifies if this property should be audited.")] Boolean DatabasePermissionChangeGroup;
23+
[Write, Description("Specifies if this property should be audited.")] Boolean DatabasePrincipalChangeGroup;
24+
[Write, Description("Specifies if this property should be audited.")] Boolean DatabasePrincipalImpersonationGroup;
25+
[Write, Description("Specifies if this property should be audited.")] Boolean DatabaseRoleMemberChangeGroup;
26+
[Write, Description("Specifies if this property should be audited.")] Boolean DbccGroup;
27+
[Write, Description("Specifies if this property should be audited.")] Boolean FailedDatabaseAuthenticationGroup;
28+
[Write, Description("Specifies if this property should be audited.")] Boolean FailedLoginGroup;
29+
[Write, Description("Specifies if this property should be audited.")] Boolean FulltextGroup;
30+
[Write, Description("Specifies if this property should be audited.")] Boolean LoginChangePasswordGroup;
31+
[Write, Description("Specifies if this property should be audited.")] Boolean LogoutGroup;
32+
[Write, Description("Specifies if this property should be audited.")] Boolean SchemaObjectAccessGroup;
33+
[Write, Description("Specifies if this property should be audited.")] Boolean SchemaObjectChangeGroup;
34+
[Write, Description("Specifies if this property should be audited.")] Boolean SchemaObjectOwnershipChangeGroup;
35+
[Write, Description("Specifies if this property should be audited.")] Boolean SchemaObjectPermissionChangeGroup;
36+
[Write, Description("Specifies if this property should be audited.")] Boolean ServerObjectChangeGroup;
37+
[Write, Description("Specifies if this property should be audited.")] Boolean ServerObjectOwnershipChangeGroup;
38+
[Write, Description("Specifies if this property should be audited.")] Boolean ServerObjectPermissionChangeGroup;
39+
[Write, Description("Specifies if this property should be audited.")] Boolean ServerOperationGroup;
40+
[Write, Description("Specifies if this property should be audited.")] Boolean ServerPermissionChangeGroup;
41+
[Write, Description("Specifies if this property should be audited.")] Boolean ServerPrincipalChangeGroup;
42+
[Write, Description("Specifies if this property should be audited.")] Boolean ServerPrincipalImpersonationGroup;
43+
[Write, Description("Specifies if this property should be audited.")] Boolean ServerRoleMemberChangeGroup;
44+
[Write, Description("Specifies if this property should be audited.")] Boolean ServerStateChangeGroup;
45+
[Write, Description("Specifies if this property should be audited.")] Boolean SuccessfulDatabaseAuthenticationGroup;
46+
[Write, Description("Specifies if this property should be audited.")] Boolean SuccessfulLoginGroup;
47+
[Write, Description("Specifies if this property should be audited.")] Boolean TraceChangeGroup;
48+
[Write, Description("Specifies if this property should be audited.")] Boolean UserChangePasswordGroup;
49+
[Write, Description("Specifies if this property should be audited.")] Boolean UserDefinedAuditGroup;
50+
[Write, Description("Specifies if this property should be audited.")] Boolean TransactionGroup;
51+
[Write, Description("Specifies if the audit should be present or absent. If 'Present' then the audit will be added to the server and, if needed, the audit will be updated. If 'Absent' then the audit will be removed from the server. Defaults to 'Present'."), ValueMap{"Present", "Absent"}, Values{"Present", "Absent"}] String Ensure;
52+
[Write, Description("Specifies if it is allowed to re-create the server audit when the DestinationType changes. Defaults to $false not allowing server audits to be re-created.")] Boolean Force;
53+
};

‎source/DSCResources/DSC_SqlServerAuditSpecification/en-US/DSC_SqlServerAuditSpecification.strings.psd1‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
ConvertFrom-StringData @'
2+
RetrievingAuditSpecificationInformation = Retrieving information about Audit specification '{0}' from the server '{1}' instance '{2}'. (SSAS0001)
3+
EvaluateAuditSpecification = Determining if the audit specification '{0}' on server '{1}' instance '{2}' is in the desired state. (SSAS0002)
4+
AuditSpecificationExist = The audit specification '{0}' exist in on server '{1}' instance '{2}'. (SSAS0003)
5+
InDesiredState = The audit specification is in desired state. (SSAS0004)
6+
NotInDesiredState = The audit specification is not in desired state. (SSAS0005)
7+
DisableAuditSpecification = Disabling audit audit specification '{0}' on server '{1}' instance '{2}'. (SSAS0006)
8+
EnableAuditSpecification = Enabling audit audit specification '{0}' on server '{1}' instance '{2}'. (SSAS0007)
9+
CreateAuditSpecification = Creating the audit specification '{0}' on server '{1}' instance '{2}'. (SSAS008)
10+
FailedCreateAuditSpecification = Failed creating audit specification '{0}' on server '{1}' instance '{2}'. (SSAS0009)
11+
AuditAlreadyInUse = Audit {0} for audit specification '{1}' on server '{2}' instance '{3}' is already in use for audit specification '{4}' (SSAS0010)
12+
DropAuditSpecification = Removing the audit specification '{0}' from server '{1}' instance '{2}'. (SSAS0011)
13+
FailedDropAuditSpecification = Failed removing the audit specification '{0}' from server '{1}' instance '{2}'. (SSAS0012)
14+
SetAuditSpecification = Setting the audit specification '{0}' on server '{1}' instance '{2}' to the desired state. (SSAS0013)
15+
FailedUpdateAuditSpecification = Failed updating audit specification '{0}' on server '{1}' instance '{2}'. (SSAS0014)
16+
ForceNotEnabled = Unable to re-create the server audit. The server audit needs to be re-created but the configuration has not opt-in to re-create the audit. To opt-in set the parameter Force to $true. (SSAS0015)
17+
'@

‎source/Examples/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ These are the links to the examples for each individual resource.
2626
- [SqlRSSetup](Resources/SqlRSSetup)
2727
- [SqlScript](Resources/SqlScript)
2828
- [SqlScriptQuery](Resources/SqlScriptQuery)
29+
- [SqlServerAudit](Resources/SqlServerAudit)
30+
- [SqlServerAuditSpecification](Resources/SqlServerAuditSpecification)
2931
- [SqlServerConfiguration](Resources/SqlServerConfiguration)
3032
- [SqlServerDatabaseMail](Resources/SqlServerDatabaseMail)
3133
- [SqlServerEndpoint](Resources/SqlServerEndpoint)

‎source/Examples/Resources/SqlServerAuditSpecification/1-AddServerAuditSpecificationAdminAudit.ps1‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
<#
2+
.EXAMPLE
3+
This example shows how to ensure that an audit destination
4+
is absent on the instance sqltest.company.local\DSC.
5+
#>
6+
Configuration Example
7+
{
8+
param
9+
(
10+
[Parameter(Mandatory = $true)]
11+
[System.Management.Automation.PSCredential]
12+
$SqlAdministratorCredential
13+
)
14+
15+
Import-DscResource -ModuleName SqlServerDsc
16+
17+
node localhost
18+
{
19+
SqlServerAudit SecurityLogAudit_Server
20+
{
21+
Ensure = 'Present'
22+
ServerName = 'sqltest.company.local'
23+
InstanceName = 'DSC'
24+
Name = 'SecLogAudit'
25+
DestinationType = 'SecurityLog'
26+
Enabled = $true
27+
PsDscRunAsCredential = $SqlAdministratorCredential
28+
}
29+
30+
SqlServerAuditSpecification 'ServerAuditSpecification_AdminAudit'
31+
{
32+
Ensure = 'Present'
33+
ServerName = 'sqltest.company.local'
34+
InstanceName = 'DSC'
35+
Name = 'AdminAudit'
36+
AuditName = 'SecLogAudit'
37+
Enabled = $true
38+
AuditChangeGroup = $true
39+
BackupRestoreGroup = $true
40+
DatabaseObjectChangeGroup = $true
41+
DatabaseObjectOwnershipChangeGroup = $true
42+
DatabaseObjectPermissionChangeGroup = $true
43+
DatabaseOwnershipChangeGroup = $true
44+
DatabasePermissionChangeGroup = $true
45+
DatabasePrincipalChangeGroup = $true
46+
DatabasePrincipalImpersonationGroup = $true
47+
DatabaseRoleMemberChangeGroup = $true
48+
SchemaObjectChangeGroup = $true
49+
SchemaObjectOwnershipChangeGroup = $true
50+
SchemaObjectPermissionChangeGroup = $true
51+
ServerObjectChangeGroup = $true
52+
ServerObjectOwnershipChangeGroup = $true
53+
ServerObjectPermissionChangeGroup = $true
54+
ServerOperationGroup = $true
55+
ServerPermissionChangeGroup = $true
56+
ServerPrincipalChangeGroup = $true
57+
ServerPrincipalImpersonationGroup = $true
58+
ServerRoleMemberChangeGroup = $true
59+
ServerStateChangeGroup = $true
60+
TraceChangeGroup = $true
61+
DependsOn = '[SqlServerAudit]SecurityLogAudit_Server'
62+
PsDscRunAsCredential = $SqlAdministratorCredential
63+
}
64+
}
65+
}

‎source/Examples/Resources/SqlServerAuditSpecification/2-AddServerAuditSpecificationLoginAudit.ps1‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<#
2+
.EXAMPLE
3+
This example shows how to ensure that an audit destination
4+
is absent on the instance sqltest.company.local\DSC.
5+
#>
6+
Configuration Example
7+
{
8+
param
9+
(
10+
[Parameter(Mandatory = $true)]
11+
[System.Management.Automation.PSCredential]
12+
$SqlAdministratorCredential
13+
)
14+
15+
Import-DscResource -ModuleName SqlServerDsc
16+
17+
node localhost
18+
{
19+
SqlServerAudit SecurityLogAudit_Server
20+
{
21+
Ensure = 'Present'
22+
ServerName = 'sqltest.company.local'
23+
InstanceName = 'DSC'
24+
Name = 'SecLogAudit'
25+
DestinationType = 'SecurityLog'
26+
Enabled = $true
27+
PsDscRunAsCredential = $SqlAdministratorCredential
28+
}
29+
30+
SqlServerAuditSpecification 'ServerAuditSpecification_AdminAudit'
31+
{
32+
Ensure = 'Present'
33+
ServerName = 'sqltest.company.local'
34+
InstanceName = 'DSC'
35+
Name = 'AdminAudit'
36+
AuditName = 'SecLogAudit'
37+
Enabled = $true
38+
DatabaseLogoutGroup = $true
39+
FailedDatabaseAuthenticationGroup = $true
40+
FailedLoginGroup = $true
41+
LoginChangePasswordGroup = $true
42+
LogoutGroup = $true
43+
SuccessfulDatabaseAuthenticationGroup = $true
44+
SuccessfulLoginGroup = $true
45+
DependsOn = '[SqlServerAudit]SecurityLogAudit_Server'
46+
PsDscRunAsCredential = $SqlAdministratorCredential
47+
}
48+
}
49+
}

‎source/Examples/Resources/SqlServerAuditSpecification/3-AddServerAuditAuditChange.ps1‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<#
2+
.EXAMPLE
3+
This example shows how to ensure that an audit destination
4+
is absent on the instance sqltest.company.local\DSC.
5+
#>
6+
Configuration Example
7+
{
8+
param
9+
(
10+
[Parameter(Mandatory = $true)]
11+
[System.Management.Automation.PSCredential]
12+
$SqlAdministratorCredential
13+
)
14+
15+
Import-DscResource -ModuleName SqlServerDsc
16+
17+
node localhost
18+
{
19+
SqlServerAudit SecurityLogAudit_Server
20+
{
21+
Ensure = 'Present'
22+
ServerName = 'sqltest.company.local'
23+
InstanceName = 'DSC'
24+
Name = 'SecLogAudit'
25+
DestinationType = 'SecurityLog'
26+
Enabled = $true
27+
PsDscRunAsCredential = $SqlAdministratorCredential
28+
}
29+
30+
SqlServerAuditSpecification 'ServerAuditSpecification_AuditAudit'
31+
{
32+
Ensure = 'Present'
33+
ServerName = 'sqltest.company.local'
34+
InstanceName = 'DSC'
35+
Name = 'AuditAudit'
36+
AuditName = 'SecLogAudit'
37+
Enabled = $true
38+
AuditChangeGroup = $true
39+
TraceChangeGroup = $true
40+
DependsOn = "[SqlServerAudit]SecurityLogAudit_Server"
41+
PsDscRunAsCredential = $SqlAdministratorCredential
42+
}
43+
}
44+
}

‎source/Examples/Resources/SqlServerAuditSpecification/4-AddMultipleServerAudits.ps1‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
<#
2+
.EXAMPLE
3+
This example shows how to add multiple audit specifications to the same instance.
4+
Each audit can only contain one audit specification.
5+
#>
6+
Configuration Example
7+
{
8+
param
9+
(
10+
[Parameter(Mandatory = $true)]
11+
[System.Management.Automation.PSCredential]
12+
$SqlAdministratorCredential
13+
)
14+
15+
Import-DscResource -ModuleName SqlServerDsc
16+
17+
node localhost
18+
{
19+
SqlServerAudit SecurityLogAudit_Server01
20+
{
21+
Ensure = 'Present'
22+
ServerName = 'sqltest.company.local'
23+
InstanceName = 'DSC'
24+
Name = 'SecLogAudit01'
25+
DestinationType = 'SecurityLog'
26+
Enabled = $true
27+
PsDscRunAsCredential = $SqlAdministratorCredential
28+
}
29+
30+
SqlServerAudit SecurityLogAudit_Server02
31+
{
32+
Ensure = 'Present'
33+
ServerName = 'sqltest.company.local'
34+
InstanceName = 'DSC'
35+
Name = 'SecLogAudit02'
36+
DestinationType = 'SecurityLog'
37+
Enabled = $true
38+
PsDscRunAsCredential = $SqlAdministratorCredential
39+
}
40+
41+
SqlServerAuditSpecification ServerAuditSpecification_AuditAudit
42+
{
43+
Ensure = 'Present'
44+
ServerName = 'sqltest.company.local'
45+
InstanceName = 'DSC'
46+
Name = 'AuditAudit'
47+
AuditName = 'SecLogAudit01'
48+
Enabled = $true
49+
AuditChangeGroup = $true
50+
TraceChangeGroup = $true
51+
DependsOn = "[SqlServerAudit]SecurityLogAudit_Server01"
52+
PsDscRunAsCredential = $SqlAdministratorCredential
53+
}
54+
55+
56+
57+
SqlServerAuditSpecification ServerAuditSpecification_AdminAudit
58+
{
59+
Ensure = 'Present'
60+
ServerName = 'sqltest.company.local'
61+
InstanceName = 'DSC'
62+
Name = 'AdminAudit'
63+
AuditName = 'SecLogAudit02'
64+
Enabled = $true
65+
AuditChangeGroup = $true
66+
BackupRestoreGroup = $true
67+
DatabaseObjectChangeGroup = $true
68+
DatabaseObjectOwnershipChangeGroup = $true
69+
DatabaseObjectPermissionChangeGroup = $true
70+
DatabaseOwnershipChangeGroup = $true
71+
DatabasePermissionChangeGroup = $true
72+
DatabasePrincipalChangeGroup = $true
73+
DatabasePrincipalImpersonationGroup = $true
74+
DatabaseRoleMemberChangeGroup = $true
75+
SchemaObjectChangeGroup = $true
76+
SchemaObjectOwnershipChangeGroup = $true
77+
SchemaObjectPermissionChangeGroup = $true
78+
ServerObjectChangeGroup = $true
79+
ServerObjectOwnershipChangeGroup = $true
80+
ServerObjectPermissionChangeGroup = $true
81+
ServerOperationGroup = $true
82+
ServerPermissionChangeGroup = $true
83+
ServerPrincipalChangeGroup = $true
84+
ServerPrincipalImpersonationGroup = $true
85+
ServerRoleMemberChangeGroup = $true
86+
ServerStateChangeGroup = $true
87+
TraceChangeGroup = $true
88+
DependsOn = "[SqlServerAudit]SecurityLogAudit_Server02"
89+
PsDscRunAsCredential = $SqlAdministratorCredential
90+
}
91+
}
92+
}

‎source/Examples/Resources/SqlServerAuditSpecification/5-RemoveAuditSpecification.ps1‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<#
2+
.EXAMPLE
3+
This example shows how to ensure that an audit destination
4+
is absent on the instance sqltest.company.local\DSC.
5+
#>
6+
Configuration Example
7+
{
8+
param
9+
(
10+
[Parameter(Mandatory = $true)]
11+
[System.Management.Automation.PSCredential]
12+
$SqlAdministratorCredential
13+
)
14+
15+
Import-DscResource -ModuleName SqlServerDsc
16+
17+
node localhost
18+
{
19+
SqlServerAuditSpecification 'ServerAuditSpecification_AdminAudit'
20+
{
21+
Ensure = 'Absent'
22+
ServerName = 'sqltest.company.local'
23+
InstanceName = 'DSC'
24+
Name = 'AdminAudit'
25+
AuditName = 'SecLogAudit'
26+
PsDscRunAsCredential = $SqlAdministratorCredential
27+
}
28+
}
29+
}

0 commit comments

Comments
 (0)