PowerShell security scripts collection for Windows hardening

Sharing some PowerShell scripts I use regularly for Windows security auditing:

Find accounts with password never expires

Get-ADUser -Filter {PasswordNeverExpires -eq $true} -Properties PasswordNeverExpires |
Select-Object Name, SamAccountName, PasswordNeverExpires

Find admin accounts that logged in recently

Get-WinEvent -FilterHashtable @{LogName='Security';ID=4624} -MaxEvents 1000 |
Where-Object { $_.Properties[8].Value -match 'admin' } |
Select-Object TimeCreated, @{N='User';E={$_.Properties[5].Value}}

Check SMB signing status

Get-SmbServerConfiguration | Select-Object RequireSecuritySignature, EnableSecuritySignature

Audit local admin group across domain computers

$computers = Get-ADComputer -Filter {OperatingSystem -like "*Windows*"} | Select -ExpandProperty Name
foreach ($pc in $computers) {
    try {
        $admins = Invoke-Command -ComputerName $pc -ScriptBlock {
            Get-LocalGroupMember -Group "Administrators"
        } -ErrorAction Stop
        Write-Host "$pc : $($admins.Name -join ', ')"
    } catch { Write-Host "$pc : UNREACHABLE" -ForegroundColor Red }
}

Feel free to add yours below!