From e547dc1ff9a344719626b9ebe67307da763b00db Mon Sep 17 00:00:00 2001
From: Chris Long <clong@cl0ng.com>
Date: Wed, 5 Dec 2018 01:22:10 -0800
Subject: [PATCH] Set privilege to false for all windows shell cmds

https://github.com/clong/DetectionLab/issues/172
---
 Vagrant/Vagrantfile | 82 ++++++++++++++++++++++-----------------------
 1 file changed, 41 insertions(+), 41 deletions(-)

diff --git a/Vagrant/Vagrantfile b/Vagrant/Vagrantfile
index 873e98d..7fd6b92 100644
--- a/Vagrant/Vagrantfile
+++ b/Vagrant/Vagrantfile
@@ -51,21 +51,21 @@ Vagrant.configure("2") do |config|
     cfg.vm.provision "shell", path: "scripts/provision.ps1", privileged: false
     cfg.vm.provision "reload"
     cfg.vm.provision "shell", path: "scripts/provision.ps1", privileged: false
-    cfg.vm.provision "shell", path: "scripts/download_palantir_wef.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/download_palantir_osquery.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-splunkuf.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-inputsconf.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-utilities.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-osquery.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-caldera-agent.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-sysinternals.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/configure-ou.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/configure-wef-gpo.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/configure-powershelllogging.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/configure-AuditingPolicyGPOs.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-autorunstowineventlog.ps1", privileged: true
-    cfg.vm.provision "shell", inline: 'wevtutil el | Foreach-Object {wevtutil cl "$_"}', privileged: true
-    cfg.vm.provision "shell", inline: "Set-SmbServerConfiguration -AuditSmb1Access $true -Force", privileged: true
+    cfg.vm.provision "shell", path: "scripts/download_palantir_wef.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/download_palantir_osquery.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-splunkuf.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-inputsconf.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-utilities.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-osquery.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-caldera-agent.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-sysinternals.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/configure-ou.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/configure-wef-gpo.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/configure-powershelllogging.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/configure-AuditingPolicyGPOs.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-autorunstowineventlog.ps1", privileged: false
+    cfg.vm.provision "shell", inline: 'wevtutil el | Foreach-Object {wevtutil cl "$_"}', privileged: false
+    cfg.vm.provision "shell", inline: "Set-SmbServerConfiguration -AuditSmb1Access $true -Force", privileged: false
 
     cfg.vm.provider "vmware_fusion" do |v, override|
       override.vm.box = "../Boxes/windows_2016_vmware.box"
@@ -109,21 +109,21 @@ Vagrant.configure("2") do |config|
     cfg.vm.provision "shell", path: "scripts/provision.ps1", privileged: false
     cfg.vm.provision "reload"
     cfg.vm.provision "shell", path: "scripts/provision.ps1", privileged: false
-    cfg.vm.provision "shell", path: "scripts/download_palantir_wef.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/download_palantir_osquery.ps1", privileged: true
-    cfg.vm.provision "shell", inline: 'wevtutil el | Foreach-Object {wevtutil cl "$_"}', privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-wefsubscriptions.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-splunkuf.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-windows_ta.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-inputsconf.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-utilities.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-osquery.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-caldera-agent.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-sysinternals.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/configure-pslogstranscriptsshare.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-autorunstowineventlog.ps1", privileged: true
-    cfg.vm.provision "shell", inline: "Set-SmbServerConfiguration -AuditSmb1Access $true -Force", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-microsoft-ata.ps1", privileged: true
+    cfg.vm.provision "shell", path: "scripts/download_palantir_wef.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/download_palantir_osquery.ps1", privileged: false
+    cfg.vm.provision "shell", inline: 'wevtutil el | Foreach-Object {wevtutil cl "$_"}', privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-wefsubscriptions.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-splunkuf.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-windows_ta.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-inputsconf.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-utilities.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-osquery.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-caldera-agent.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-sysinternals.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/configure-pslogstranscriptsshare.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-autorunstowineventlog.ps1", privileged: false
+    cfg.vm.provision "shell", inline: "Set-SmbServerConfiguration -AuditSmb1Access $true -Force", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-microsoft-ata.ps1", privileged: false
 
     cfg.vm.provider "vmware_fusion" do |v, override|
       override.vm.box = "../Boxes/windows_2016_vmware.box"
@@ -167,17 +167,17 @@ Vagrant.configure("2") do |config|
     cfg.vm.provision "shell", path: "scripts/provision.ps1", privileged: false
     cfg.vm.provision "reload"
     cfg.vm.provision "shell", path: "scripts/provision.ps1", privileged: false
-    cfg.vm.provision "shell", path: "scripts/download_palantir_wef.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/download_palantir_osquery.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/MakeWindows10GreatAgain.ps1", privileged: true
-    cfg.vm.provision "shell", inline: 'wevtutil el | Foreach-Object {wevtutil cl "$_"}', privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-splunkuf.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-utilities.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-osquery.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-caldera-agent.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-inputsconf.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-sysinternals.ps1", privileged: true
-    cfg.vm.provision "shell", path: "scripts/install-autorunstowineventlog.ps1", privileged: true
+    cfg.vm.provision "shell", path: "scripts/download_palantir_wef.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/download_palantir_osquery.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/MakeWindows10GreatAgain.ps1", privileged: false
+    cfg.vm.provision "shell", inline: 'wevtutil el | Foreach-Object {wevtutil cl "$_"}', privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-splunkuf.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-utilities.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-osquery.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-caldera-agent.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-inputsconf.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-sysinternals.ps1", privileged: false
+    cfg.vm.provision "shell", path: "scripts/install-autorunstowineventlog.ps1", privileged: false
 
     cfg.vm.provider "vmware_fusion" do |v, override|
       override.vm.box = "../Boxes/windows_10_vmware.box"