public/Remove-VPASAllDiscoveredAccounts.ps1
|
<#
.Synopsis DELETE ALL DISCOVERED ACCOUNTS FROM PENDING ACCOUNTS CREATED BY: Vadim Melamed, EMAIL: vmelamed5@gmail.com .DESCRIPTION USE THIS FUNCTION TO DELETE ALL DISCOVERED ACCOUNTS FROM THE PENDING SAFE LIST .PARAMETER token HashTable of data containing various pieces of login information (PVWA, LoginToken, HeaderType, etc). If -token is not passed, function will use last known hashtable generated by New-VPASToken .PARAMETER Confirm Skip the confirmation prompt confirming the removal of all discovered accounts .PARAMETER WhatIf Run code simulation to see what is affected by running the command as well as any possible implications This is a code simulation flag, meaning the command will NOT actually run .PARAMETER HideWhatIfOutput Suppress any code simulation output from the console .EXAMPLE $WhatIfSimulation = Remove-VPASAllDiscoveredAccounts -WhatIf .EXAMPLE $DeleteDiscoveredAccountsStatus = Remove-VPASAllDiscoveredAccounts -Confirm .OUTPUTS $true if successful $false if failed #> function Remove-VPASAllDiscoveredAccounts{ [OutputType([bool],'System.Object')] [CmdletBinding()] Param( [Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true,Position=0)] [Switch]$Confirm, [Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true,Position=1)] [hashtable]$token, [Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true,Position=2)] [Switch]$WhatIf, [Parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true,Position=3)] [Switch]$HideWhatIfOutput ) Begin{ $tokenval,$sessionval,$PVWA,$Header,$ISPSS,$IdentityURL,$EnableTextRecorder,$AuditTimeStamp,$NoSSL,$VaultVersion,$HideWarnings,$AuthenticatedAs,$SubDomain = Get-VPASSession -token $token $CommandName = $MyInvocation.MyCommand.Name $log = Write-VPASTextRecorder -inputval $CommandName -token $token -LogType COMMAND } process{ Write-Verbose "SUCCESSFULLY PARSED PVWA VALUE" Write-Verbose "SUCCESSFULLY PARSED TOKEN VALUE" try{ if($NoSSL){ Write-Verbose "NO SSL ENABLED, USING HTTP INSTEAD OF HTTPS" $uri = "http://$PVWA/passwordvault/api/DiscoveredAccounts" } else{ Write-Verbose "SSL ENABLED BY DEFAULT, USING HTTPS" $uri = "https://$PVWA/passwordvault/api/DiscoveredAccounts" } $log = Write-VPASTextRecorder -inputval $uri -token $token -LogType URI $log = Write-VPASTextRecorder -inputval "DELETE" -token $token -LogType METHOD if(!$WhatIf){ if($Confirm){ Write-verbose "CONFIRM FLAG PASSED...SKIPPING VALIDATION" write-verbose "MAKING API CALL TO CYBERARK" if($sessionval){ $response = Invoke-RestMethod -Headers @{"Authorization"=$Header} -Uri $uri -Method DELETE -ContentType "application/json" -WebSession $sessionval } else{ $response = Invoke-RestMethod -Headers @{"Authorization"=$Header} -Uri $uri -Method DELETE -ContentType "application/json" } $log = Write-VPASTextRecorder -inputval "REST API COMMAND RETURNED: TRUE" -token $token -LogType MISC Write-Verbose "DISCOVERED ACCOUNTS HAVE BEEN DELETED" return $true } else{ Write-VPASOutput -str "ARE YOU SURE YOU WANT TO DELETE ALL DISCOVERED ACCOUNTS (Y/N) [Y]: " -type C $confirmstr = Read-Host if([String]::IsNullOrEmpty($confirmstr)){ Write-verbose "VALIDATION CONFIRMED" write-verbose "MAKING API CALL TO CYBERARK" if($sessionval){ $response = Invoke-RestMethod -Headers @{"Authorization"=$Header} -Uri $uri -Method DELETE -ContentType "application/json" -WebSession $sessionval } else{ $response = Invoke-RestMethod -Headers @{"Authorization"=$Header} -Uri $uri -Method DELETE -ContentType "application/json" } $log = Write-VPASTextRecorder -inputval "REST API COMMAND RETURNED: TRUE" -token $token -LogType MISC Write-Verbose "DISCOVERED ACCOUNTS HAVE BEEN DELETED" return $true } elseif($confirmstr -eq "Y" -or $confirmstr -eq "y"){ Write-verbose "VALIDATION CONFIRMED" write-verbose "MAKING API CALL TO CYBERARK" if($sessionval){ $response = Invoke-RestMethod -Headers @{"Authorization"=$Header} -Uri $uri -Method DELETE -ContentType "application/json" -WebSession $sessionval } else{ $response = Invoke-RestMethod -Headers @{"Authorization"=$Header} -Uri $uri -Method DELETE -ContentType "application/json" } $log = Write-VPASTextRecorder -inputval "REST API COMMAND RETURNED: TRUE" -token $token -LogType MISC Write-Verbose "DISCOVERED ACCOUNTS HAVE BEEN DELETED" return $true } else{ $log = Write-VPASTextRecorder -inputval "CANCELING API CALL" -token $token -LogType MISC $log = Write-VPASTextRecorder -inputval "REST API COMMAND RETURNED: FALSE" -token $token -LogType MISC Write-VPASOutput -str "DISCOVERED ACCOUNTS WILL NOT BE DELETED...RETURNING FALSE" -type E return $false } } } elseif($WhatIf){ $log = Write-VPASTextRecorder -token $token -LogType WHATIF1 $WhatIfHash = @{} $WhatIfArr = @() Write-Verbose "INITIATING COMMAND SIMULATION" $WhatIfInfo = Get-VPASDiscoveredAccounts -token $token -SearchQuery " " $WhatIfInfoCount = $WhatIfInfo.Count if(!$HideWhatIfOutput){ Write-VPASOutput -str "====== BEGIN COMMAND SIMULATION ======" -type S Write-VPASOutput -str "THE FOLLOWING DISCOVERED ACCOUNTS WOULD BE DELETED FROM ACCOUNTS DISCOVERY:" -type S } foreach($WhatIfRec in $WhatIfInfo.value){ $WhatIfRecID = $WhatIfRec.id $WhatIfRecName = $WhatIfRec.name if(!$HideWhatIfOutput){ Write-VPASOutput -str "$WhatIfRecID : $WhatIfRecName" -type S } $WhatIfTempHash = @{ AccountID = $WhatIfRecID ObjectName = $WhatIfRecName } $WhatIfArr += $WhatIfTempHash } if(!$HideWhatIfOutput){ Write-VPASOutput -str "---" -type S Write-VPASOutput -str "ACCOUNTS : $WhatIfInfoCount" -type S Write-VPASOutput -str "URI : $uri" -type S Write-VPASOutput -str "METHOD : DELETE" -type S Write-VPASOutput -str " " -type S Write-VPASOutput -str "======= END COMMAND SIMULATION =======" -type S } $WhatIfHash = @{ WhatIf = @{ AmountOfAccounts = $WhatIfInfoCount RestURI = $uri RestMethod = "DELETE" Accounts = $WhatIfArr Disclaimer = "THESE PENDING ACCOUNTS WILL BE DELETED IF -WhatIf FLAG IS REMOVED" } } $WhatIfJSON = $WhatIfHash | ConvertTo-Json | ConvertFrom-Json $log = Write-VPASTextRecorder -inputval $WhatIfJSON -token $token -LogType RETURNARRAY $log = Write-VPASTextRecorder -token $token -LogType WHATIF2 return $WhatIfJSON } }catch{ $log = Write-VPASTextRecorder -inputval $_ -token $token -LogType ERROR $log = Write-VPASTextRecorder -inputval "REST API COMMAND RETURNED: FALSE" -token $token -LogType MISC Write-Verbose "UNABLE TO DELETE ALL DISCOVERED ACCOUNTS...RETURNING FALSE" Write-VPASOutput -str $_ -type E return $false } } End{ $log = Write-VPASTextRecorder -inputval $CommandName -token $token -LogType DIVIDER } } |