pliancy/occam

O365 Configuration Compliance Audit Manager

occam's Issues

Error pops up when discovering rules in the C:\Windows\System32 dir

PowerShell prompts that are launched as Administrator default to C:\Windows\System32 as the working directory. When OCCAM attempts to discovery .Rule.ps1 files, it does so recursively, which can return errors when attempting to search parts of System32 that the PowerShell process does not have access to.

We can either:

1. Warn users when running in C:\Windows\System32 that they need to run OCCAM somewhere else
2. Add a special case that does a non-recursive search in C:\Windows\System32
3. Catch and silence the errors when in C:\Windows\System32

Exception Error failing to aquire token

I just installed, and ran invoke-occam. it asked for my CSP email, then prompted me to pick a client. once picked, I got this error:

`Error Acquiring Token: System.Threading.ThreadStateException: ActiveX control '8856f961-340a-11d0-a96b-00c04fd705a2' cannot be instantiated because the current thread is not in a single-threaded apartment. at System.Windows.Forms.WebBrowserBase..ctor(String clsidString) at System.Windows.Forms.WebBrowser..ctor() at Microsoft.Identity.Client.Platforms.net45.WindowsFormsWebAuthenticationDialogBase..ctor(Object ownerWindow) at Microsoft.Identity.Client.Platforms.net45.WindowsFormsWebAuthenticationDialog..ctor(Object ownerWindow) at Microsoft.Identity.Client.Platforms.net45.InteractiveWebUI.OnAuthenticate() at Microsoft.Identity.Client.Platforms.net45.WebUI.<>c__DisplayClass20_0.b__1(Object tcs) --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.Identity.Client.Platforms.net45.WebUI.d__20.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.Identity.Client.Internal.AuthCodeRequestComponent.d__6.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Identity.Client.Internal.AuthCodeRequestComponent.d__4.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Identity.Client.Internal.Requests.InteractiveRequest.d__11.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Identity.Client.Internal.Requests.InteractiveRequest.d__8.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.d__13.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Identity.Client.ApiConfig.Executors.PublicClientExecutor.d__2.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Exchange.Management.AdminApiProvider.Authentication.MSALTokenProvider.d__22.MoveNext()
WARNING: Failed to connect to Tenant REDACTED, skipping audit
Name BlockBasicAuthDefaultPolicy BlockBasicAuthAllPolicies ImapDisabled PopDisabled UnifiedAuditLogg
ing
Select-Object : Property "Nam" cannot be found.
At C:\Program Files\WindowsPowerShell\Modules\occam\1.1.0\Internal\Write-PSObject.ps1:786 char:40

• ... $values[$i] = $oLine | Select-Object -ExpandProperty $col;

•                                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidArgument: (@{Name=REDACTED ...dAuditLogging=}:PSObject) [Select-Object], PSArgumen
    tException
  • FullyQualifiedErrorId : ExpandPropertyNotFound,Microsoft.PowerShell.Commands.SelectObjectCommand

---

Ber`

Add `-UserPrincipalName` param to avoid interactive prompt

Interactively typing in the UPN used to connect to EXO is annoying. This way it can be passed as a param.