From d033d7ae1bb62d0c2893d98c3a0f84735721388f Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Fri, 5 Apr 2024 16:13:08 -0500 Subject: [PATCH 01/15] add: 1.1.1 test as automated and organized csv. --- helpers/Build-Help.ps1 | 4 +- helpers/Get-AdminRoleUserLicense.ps1 | 45 ++++++++ source/helper/TestDefinitions.csv | 103 +++++++++--------- .../Test-AdministrativeAccountCompliance .ps1 | 69 ++++++++++++ source/tests/Test-AntiPhishingPolicy.ps1 | 1 + .../tests/Test-BlockSharedMailboxSignIn.ps1 | 1 + source/tests/Test-IdentifyExternalEmail.ps1 | 1 + source/tests/Test-NotifyMalwareInternal.ps1 | 2 + source/tests/Test-SpamPolicyAdminNotify.ps1 | 2 + 9 files changed, 175 insertions(+), 53 deletions(-) create mode 100644 helpers/Get-AdminRoleUserLicense.ps1 create mode 100644 source/tests/Test-AdministrativeAccountCompliance .ps1 diff --git a/helpers/Build-Help.ps1 b/helpers/Build-Help.ps1 index b84d417..82e139f 100644 --- a/helpers/Build-Help.ps1 +++ b/helpers/Build-Help.ps1 @@ -4,10 +4,10 @@ Import-Module .\output\module\M365FoundationsCISReport\*\*.psd1 <# - $ver = "v0.0.1" + $ver = "v0.1.1" git checkout main git pull origin main - git tag -a $ver -m "Release version $ver Minor Update" + git tag -a $ver -m "Release version $ver Bugfix Update" git push origin $ver "Fix: PR #37" git push origin $ver diff --git a/helpers/Get-AdminRoleUserLicense.ps1 b/helpers/Get-AdminRoleUserLicense.ps1 new file mode 100644 index 0000000..e9576ef --- /dev/null +++ b/helpers/Get-AdminRoleUserLicense.ps1 @@ -0,0 +1,45 @@ +function Get-AdminRoleUserLicense { + [CmdletBinding()] + param ( + [Parameter(Mandatory = $false)] + [bool]$SkipGraphConnection = $false + ) + + # Connect to Microsoft Graph if not skipping connection + if (-not $SkipGraphConnection) { + Connect-MgGraph -Scopes "Directory.Read.All", "Domain.Read.All", "Policy.Read.All", "Organization.Read.All" -NoWelcome + } + + $adminRoleUsers = @() + $userIds = @() + $adminroles = Get-MgRoleManagementDirectoryRoleDefinition | Where-Object { $_.DisplayName -like "*Admin*" } + + foreach ($role in $adminroles) { + $usersInRole = Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$($role.Id)'" + + foreach ($user in $usersInRole) { + $userIds += $user.PrincipalId + $userDetails = Get-MgUser -UserId $user.PrincipalId -Property "DisplayName, UserPrincipalName, Id, onPremisesSyncEnabled" + + $adminRoleUsers += [PSCustomObject]@{ + RoleName = $role.DisplayName + UserName = $userDetails.DisplayName + UserPrincipalName = $userDetails.UserPrincipalName + UserId = $userDetails.Id + HybridUser = $userDetails.onPremisesSyncEnabled + Licenses = "" # Placeholder for licenses, to be filled later + } + } + } + + foreach ($userId in $userIds | Select-Object -Unique) { + $licenses = Get-MgUserLicenseDetail -UserId $userId + $licenseList = ($licenses.SkuPartNumber -join '|') + + $adminRoleUsers | Where-Object { $_.UserId -eq $userId } | ForEach-Object { + $_.Licenses = $licenseList + } + } + + return $adminRoleUsers +} \ No newline at end of file diff --git a/source/helper/TestDefinitions.csv b/source/helper/TestDefinitions.csv index 99ced50..653429c 100644 --- a/source/helper/TestDefinitions.csv +++ b/source/helper/TestDefinitions.csv @@ -1,51 +1,52 @@ -Index,TestFileName,Rec,ELevel,ProfileLevel,IG1,IG2,IG3 -1,Test-AntiPhishingPolicy.ps1,2.1.7,E5,L1,FALSE,FALSE,TRUE -2,Test-AuditDisabledFalse.ps1,6.1.1,E3,L1,TRUE,TRUE,TRUE -3,Test-AuditLogSearch.ps1,3.1.1,E3,L1,TRUE,TRUE,TRUE -4,Test-BlockChannelEmails.ps1,8.1.2,E3,L1,FALSE,FALSE,FALSE -5,Test-BlockMailForwarding.ps1,6.2.1,E3,L1,FALSE,FALSE,FALSE -6,Test-BlockSharedMailboxSignIn.ps1,1.2.2,E3,L1,FALSE,FALSE,FALSE -7,Test-CommonAttachmentFilter.ps1,2.1.2,E3,L1,FALSE,TRUE,TRUE -8,Test-CustomerLockbox.ps1,1.3.6,E5,L2,FALSE,FALSE,FALSE -9,Test-DialInBypassLobby.ps1,8.5.4,E3,L1,FALSE,FALSE,FALSE -10,Test-DisallowInfectedFilesDownload.ps1,7.3.1,E5,L2,TRUE,TRUE,TRUE -11,Test-EnableDKIM.ps1,2.1.9,E3,L1,FALSE,TRUE,TRUE -12,Test-ExternalNoControl.ps1,8.5.7,E3,L1,FALSE,FALSE,FALSE -13,Test-ExternalSharingCalendars.ps1,1.3.3,E3,L2,FALSE,TRUE,TRUE -14,Test-GlobalAdminsCount.ps1,1.1.3,E3,L1,TRUE,TRUE,TRUE -15,Test-GuestAccessExpiration.ps1,7.2.9,E3,L1,FALSE,FALSE,FALSE -16,Test-IdentifyExternalEmail.ps1,6.2.3,E3,L1,FALSE,FALSE,FALSE -17,Test-LinkSharingRestrictions.ps1,7.2.7,E3,L1,TRUE,TRUE,TRUE -18,Test-MailboxAuditingE3.ps1,6.1.2,E3,L1,TRUE,TRUE,TRUE -19,Test-MailboxAuditingE5.ps1,6.1.3,E5,L1,TRUE,TRUE,TRUE -20,Test-MailTipsEnabled.ps1,6.5.2,E3,L2,FALSE,FALSE,FALSE -21,Test-ManagedApprovedPublicGroups.ps1,1.2.1,E3,L2,TRUE,TRUE,TRUE -22,Test-MeetingChatNoAnonymous.ps1,8.5.5,E3,L1,FALSE,FALSE,FALSE -23,Test-ModernAuthExchangeOnline.ps1,6.5.1,E3,L1,FALSE,TRUE,TRUE -24,Test-ModernAuthSharePoint.ps1,7.2.1,E3,L1,FALSE,TRUE,TRUE -25,Test-NoAnonymousMeetingJoin.ps1,8.5.1,E3,L2,FALSE,FALSE,FALSE -26,Test-NoAnonymousMeetingStart.ps1,8.5.2,E3,L1,FALSE,FALSE,FALSE -27,Test-NotifyMalwareInternal.ps1,2.1.3,E3,L1,FALSE,TRUE,TRUE -28,Test-NoWhitelistDomains.ps1,6.2.2,E3,L1,FALSE,FALSE,FALSE -29,Test-OneDriveContentRestrictions.ps1,7.2.4,E3,L2,TRUE,TRUE,TRUE -30,Test-OneDriveSyncRestrictions.ps1,7.3.2,E3,L2,FALSE,FALSE,FALSE -31,Test-OrganizersPresent.ps1,8.5.6,E3,L1,FALSE,FALSE,FALSE -32,Test-OrgOnlyBypassLobby.ps1,8.5.3,E3,L1,FALSE,FALSE,TRUE -33,Test-PasswordHashSync.ps1,5.1.8.1,E3,L1,FALSE,TRUE,TRUE -34,Test-PasswordNeverExpirePolicy.ps1,1.3.1,E3,L1,TRUE,TRUE,TRUE -35,Test-ReauthWithCode.ps1,7.2.10,E3,L1,FALSE,FALSE,FALSE -36,Test-ReportSecurityInTeams.ps1,8.6.1,E3,L1,FALSE,FALSE,FALSE -37,Test-RestrictCustomScripts.ps1,7.3.4,E3,L1,FALSE,FALSE,TRUE -38,Test-RestrictExternalSharing.ps1,7.2.3,E3,L1,TRUE,TRUE,TRUE -39,Test-RestrictOutlookAddins.ps1,6.3.1,E3,L2,FALSE,TRUE,TRUE -40,Test-RestrictStorageProvidersOutlook.ps1,6.5.3,E3,L2,TRUE,TRUE,TRUE -41,Test-RestrictTenantCreation.ps1,5.1.2.3,E3,L1,FALSE,FALSE,FALSE -42,Test-SafeAttachmentsPolicy.ps1,2.1.4,E5,L2,FALSE,FALSE,TRUE -43,Test-SafeAttachmentsTeams.ps1,2.1.5,E5,L2,TRUE,TRUE,TRUE -44,Test-SafeLinksOfficeApps.ps1,2.1.1,E5,L2,TRUE,TRUE,TRUE -45,Test-SharePointAADB2B.ps1,7.2.2,E3,L1,FALSE,FALSE,FALSE -46,Test-SharePointExternalSharingDomains.ps1,7.2.6,E3,L2,TRUE,TRUE,TRUE -47,Test-SharePointGuestsItemSharing.ps1,7.2.5,E3,L2,TRUE,TRUE,TRUE -48,Test-SpamPolicyAdminNotify.ps1,2.1.6,E3,L1,FALSE,TRUE,TRUE -49,Test-TeamsExternalAccess.ps1,8.2.1,E3,L2,FALSE,FALSE,FALSE -50,Test-TeamsExternalFileSharing.ps1,8.1.1,E3,L2,TRUE,TRUE,TRUE +Index,TestFileName,Rec,ELevel,ProfileLevel,IG1,IG2,IG3,Automated +1,Test-AdministrativeAccountCompliance .ps1,1.1.1,E3,L1,TRUE,TRUE,TRUE,FALSE +2,Test-GlobalAdminsCount.ps1,1.1.3,E3,L1,TRUE,TRUE,TRUE,TRUE +3,Test-ManagedApprovedPublicGroups.ps1,1.2.1,E3,L2,TRUE,TRUE,TRUE,TRUE +4,Test-BlockSharedMailboxSignIn.ps1,1.2.2,E3,L1,FALSE,FALSE,FALSE,TRUE +5,Test-PasswordNeverExpirePolicy.ps1,1.3.1,E3,L1,TRUE,TRUE,TRUE,TRUE +6,Test-ExternalSharingCalendars.ps1,1.3.3,E3,L2,FALSE,TRUE,TRUE,TRUE +7,Test-CustomerLockbox.ps1,1.3.6,E5,L2,FALSE,FALSE,FALSE,TRUE +8,Test-SafeLinksOfficeApps.ps1,2.1.1,E5,L2,TRUE,TRUE,TRUE,TRUE +9,Test-CommonAttachmentFilter.ps1,2.1.2,E3,L1,FALSE,TRUE,TRUE,TRUE +10,Test-NotifyMalwareInternal.ps1,2.1.3,E3,L1,FALSE,TRUE,TRUE,TRUE +11,Test-SafeAttachmentsPolicy.ps1,2.1.4,E5,L2,FALSE,FALSE,TRUE,TRUE +12,Test-SafeAttachmentsTeams.ps1,2.1.5,E5,L2,TRUE,TRUE,TRUE,TRUE +13,Test-SpamPolicyAdminNotify.ps1,2.1.6,E3,L1,FALSE,TRUE,TRUE,TRUE +14,Test-AntiPhishingPolicy.ps1,2.1.7,E5,L1,FALSE,FALSE,TRUE,TRUE +15,Test-EnableDKIM.ps1,2.1.9,E3,L1,FALSE,TRUE,TRUE,TRUE +16,Test-AuditLogSearch.ps1,3.1.1,E3,L1,TRUE,TRUE,TRUE,TRUE +17,Test-RestrictTenantCreation.ps1,5.1.2.3,E3,L1,FALSE,FALSE,FALSE,TRUE +18,Test-PasswordHashSync.ps1,5.1.8.1,E3,L1,FALSE,TRUE,TRUE,TRUE +19,Test-AuditDisabledFalse.ps1,6.1.1,E3,L1,TRUE,TRUE,TRUE,TRUE +20,Test-MailboxAuditingE3.ps1,6.1.2,E3,L1,TRUE,TRUE,TRUE,TRUE +21,Test-MailboxAuditingE5.ps1,6.1.3,E5,L1,TRUE,TRUE,TRUE,TRUE +22,Test-BlockMailForwarding.ps1,6.2.1,E3,L1,FALSE,FALSE,FALSE,TRUE +23,Test-NoWhitelistDomains.ps1,6.2.2,E3,L1,FALSE,FALSE,FALSE,TRUE +24,Test-IdentifyExternalEmail.ps1,6.2.3,E3,L1,FALSE,FALSE,FALSE,TRUE +25,Test-RestrictOutlookAddins.ps1,6.3.1,E3,L2,FALSE,TRUE,TRUE,TRUE +26,Test-ModernAuthExchangeOnline.ps1,6.5.1,E3,L1,FALSE,TRUE,TRUE,TRUE +27,Test-MailTipsEnabled.ps1,6.5.2,E3,L2,FALSE,FALSE,FALSE,TRUE +28,Test-RestrictStorageProvidersOutlook.ps1,6.5.3,E3,L2,TRUE,TRUE,TRUE,TRUE +29,Test-ModernAuthSharePoint.ps1,7.2.1,E3,L1,FALSE,TRUE,TRUE,TRUE +30,Test-SharePointAADB2B.ps1,7.2.2,E3,L1,FALSE,FALSE,FALSE,TRUE +31,Test-RestrictExternalSharing.ps1,7.2.3,E3,L1,TRUE,TRUE,TRUE,TRUE +32,Test-OneDriveContentRestrictions.ps1,7.2.4,E3,L2,TRUE,TRUE,TRUE,TRUE +33,Test-SharePointGuestsItemSharing.ps1,7.2.5,E3,L2,TRUE,TRUE,TRUE,TRUE +34,Test-SharePointExternalSharingDomains.ps1,7.2.6,E3,L2,TRUE,TRUE,TRUE,TRUE +35,Test-LinkSharingRestrictions.ps1,7.2.7,E3,L1,TRUE,TRUE,TRUE,TRUE +36,Test-GuestAccessExpiration.ps1,7.2.9,E3,L1,FALSE,FALSE,FALSE,TRUE +37,Test-ReauthWithCode.ps1,7.2.10,E3,L1,FALSE,FALSE,FALSE,TRUE +38,Test-DisallowInfectedFilesDownload.ps1,7.3.1,E5,L2,TRUE,TRUE,TRUE,TRUE +39,Test-OneDriveSyncRestrictions.ps1,7.3.2,E3,L2,FALSE,FALSE,FALSE,TRUE +40,Test-RestrictCustomScripts.ps1,7.3.4,E3,L1,FALSE,FALSE,TRUE,TRUE +41,Test-TeamsExternalFileSharing.ps1,8.1.1,E3,L2,TRUE,TRUE,TRUE,TRUE +42,Test-BlockChannelEmails.ps1,8.1.2,E3,L1,FALSE,FALSE,FALSE,TRUE +43,Test-TeamsExternalAccess.ps1,8.2.1,E3,L2,FALSE,FALSE,FALSE,TRUE +44,Test-NoAnonymousMeetingJoin.ps1,8.5.1,E3,L2,FALSE,FALSE,FALSE,TRUE +45,Test-NoAnonymousMeetingStart.ps1,8.5.2,E3,L1,FALSE,FALSE,FALSE,TRUE +46,Test-OrgOnlyBypassLobby.ps1,8.5.3,E3,L1,FALSE,FALSE,TRUE,TRUE +47,Test-DialInBypassLobby.ps1,8.5.4,E3,L1,FALSE,FALSE,FALSE,TRUE +48,Test-MeetingChatNoAnonymous.ps1,8.5.5,E3,L1,FALSE,FALSE,FALSE,TRUE +49,Test-OrganizersPresent.ps1,8.5.6,E3,L1,FALSE,FALSE,FALSE,TRUE +50,Test-ExternalNoControl.ps1,8.5.7,E3,L1,FALSE,FALSE,FALSE,TRUE +51,Test-ReportSecurityInTeams.ps1,8.6.1,E3,L1,FALSE,FALSE,FALSE,TRUE diff --git a/source/tests/Test-AdministrativeAccountCompliance .ps1 b/source/tests/Test-AdministrativeAccountCompliance .ps1 new file mode 100644 index 0000000..9841865 --- /dev/null +++ b/source/tests/Test-AdministrativeAccountCompliance .ps1 @@ -0,0 +1,69 @@ +function Test-AdministrativeAccountCompliance { + [CmdletBinding()] + param ( + [switch]$SkipGraphConnection + ) + begin { + #. C:\Temp\CISAuditResult.ps1 + $validLicenses = @('AAD_PREMIUM', 'AAD_PREMIUM_P2') + } + process { + if (-not $SkipGraphConnection) { + Connect-MgGraph -Scopes "Directory.Read.All", "User.Read.All", "RoleManagement.Read.Directory" -NoWelcome + } + $adminRoles = Get-MgRoleManagementDirectoryRoleDefinition | Where-Object { $_.DisplayName -like "*Admin*" } + $adminRoleUsers = @() + foreach ($role in $adminRoles) { + $roleAssignments = Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$($role.Id)'" + foreach ($assignment in $roleAssignments) { + $userDetails = Get-MgUser -UserId $assignment.PrincipalId -Property "DisplayName, UserPrincipalName, Id, OnPremisesSyncEnabled" + $licenses = (Get-MgUserLicenseDetail -UserId $assignment.PrincipalId).SkuPartNumber -join '|' + $adminRoleUsers += [PSCustomObject]@{ + UserName = $userDetails.UserPrincipalName + RoleName = $role.DisplayName + UserId = $userDetails.Id + HybridUser = $userDetails.OnPremisesSyncEnabled + Licenses = $licenses + } + } + } + $uniqueAdminRoleUsers = $adminRoleUsers | Group-Object -Property UserName | ForEach-Object { + $first = $_.Group | Select-Object -First 1 + $roles = ($_.Group.RoleName -join ', ') + $licenses = (($_.Group | Select-Object -ExpandProperty Licenses) -join ',').Split(',') | Select-Object -Unique + + $first | Select-Object UserName, UserId, HybridUser, @{Name = 'Roles'; Expression = { $roles } }, @{Name = 'Licenses'; Expression = { $licenses -join '|' } } + } + $nonCompliantUsers = $uniqueAdminRoleUsers | Where-Object { + $_.HybridUser -or + -not ($_.Licenses -split '\|' | Where-Object { $validLicenses -contains $_ }) + } + $failureReasons = $nonCompliantUsers | ForEach-Object { + $accountType = if ($_.HybridUser) { "Hybrid" } else { "Cloud-Only" } + $missingLicenses = $validLicenses | Where-Object { $_ -notin ($_.Licenses -split '\|') } + "$($_.UserName)|$($_.Roles)|$accountType|Missing: $($missingLicenses -join ',')" + } + $failureReasons = $failureReasons -join "`n" + + $auditResult = [CISAuditResult]::new() + $auditResult.Status = if ($nonCompliantUsers) { 'Fail' } else { 'Pass' } + $auditResult.ELevel = 'E3' + $auditResult.ProfileLevel = 'L1' + $auditResult.Rec = '1.1.1' + $auditResult.RecDescription = "Ensure Administrative accounts are separate and cloud-only" + $auditResult.CISControlVer = 'v8' + $auditResult.CISControl = "5.4" + $auditResult.CISDescription = "Restrict Administrator Privileges to Dedicated Administrator Accounts" + $auditResult.IG1 = $true + $auditResult.IG2 = $true + $auditResult.IG3 = $true + $auditResult.Result = $nonCompliantUsers.Count -eq 0 + $auditResult.Details = "Compliant Accounts: $($uniqueAdminRoleUsers.Count - $nonCompliantUsers.Count); Non-Compliant Accounts: $($nonCompliantUsers.Count)" + $auditResult.FailureReason = if ($nonCompliantUsers) { "Non-compliant accounts: `nUsername | Roles | HybridStatus | Missing Licence`n$failureReasons" } else { "N/A" } + } + + end { + # Output the result + return $auditResult + } +} \ No newline at end of file diff --git a/source/tests/Test-AntiPhishingPolicy.ps1 b/source/tests/Test-AntiPhishingPolicy.ps1 index 6ed2be0..de8f0ed 100644 --- a/source/tests/Test-AntiPhishingPolicy.ps1 +++ b/source/tests/Test-AntiPhishingPolicy.ps1 @@ -11,6 +11,7 @@ function Test-AntiPhishingPolicy { } process { + # 2.1.7 Ensure that an anti-phishing policy has been created # Retrieve and validate the anti-phishing policies $antiPhishPolicies = Get-AntiPhishPolicy diff --git a/source/tests/Test-BlockSharedMailboxSignIn.ps1 b/source/tests/Test-BlockSharedMailboxSignIn.ps1 index 68f8425..b74afad 100644 --- a/source/tests/Test-BlockSharedMailboxSignIn.ps1 +++ b/source/tests/Test-BlockSharedMailboxSignIn.ps1 @@ -14,6 +14,7 @@ function Test-BlockSharedMailboxSignIn { # 1.2.2 (L1) Ensure sign-in to shared mailboxes is blocked # Pass if all shared mailboxes have AccountEnabled set to False. # Fail if any shared mailbox has AccountEnabled set to True. + # Review: Details property - Add verbosity. $MBX = Get-EXOMailbox -RecipientTypeDetails SharedMailbox $sharedMailboxDetails = $MBX | ForEach-Object { Get-AzureADUser -ObjectId $_.ExternalDirectoryObjectId } diff --git a/source/tests/Test-IdentifyExternalEmail.ps1 b/source/tests/Test-IdentifyExternalEmail.ps1 index 9881070..9c421c0 100644 --- a/source/tests/Test-IdentifyExternalEmail.ps1 +++ b/source/tests/Test-IdentifyExternalEmail.ps1 @@ -13,6 +13,7 @@ function Test-IdentifyExternalEmail { process { # 6.2.3 (L1) Ensure email from external senders is identified # Requirement is to have external sender tagging enabled + # Review $externalInOutlook = Get-ExternalInOutlook $externalTaggingEnabled = ($externalInOutlook | ForEach-Object { $_.Enabled }) -contains $true diff --git a/source/tests/Test-NotifyMalwareInternal.ps1 b/source/tests/Test-NotifyMalwareInternal.ps1 index b6df85b..90e7f74 100644 --- a/source/tests/Test-NotifyMalwareInternal.ps1 +++ b/source/tests/Test-NotifyMalwareInternal.ps1 @@ -10,6 +10,8 @@ function Test-NotifyMalwareInternal { } process { + # 2.1.3 Ensure notifications for internal users sending malware is Enabled + # Retrieve all 'Custom' malware filter policies and check notification settings $malwareNotifications = Get-MalwareFilterPolicy | Where-Object { $_.RecommendedPolicyType -eq 'Custom' } $policiesToReport = @() diff --git a/source/tests/Test-SpamPolicyAdminNotify.ps1 b/source/tests/Test-SpamPolicyAdminNotify.ps1 index 353f9a7..ebe2d81 100644 --- a/source/tests/Test-SpamPolicyAdminNotify.ps1 +++ b/source/tests/Test-SpamPolicyAdminNotify.ps1 @@ -10,6 +10,8 @@ function Test-SpamPolicyAdminNotify { } process { + # 2.1.6 Ensure Exchange Online Spam Policies are set to notify administrators + # Get the default hosted outbound spam filter policy $hostedOutboundSpamFilterPolicy = Get-HostedOutboundSpamFilterPolicy | Where-Object { $_.IsDefault -eq $true } From 1e510f311b2f08f1badb7dec4f6f8672a302e7a7 Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Fri, 5 Apr 2024 18:13:16 -0500 Subject: [PATCH 02/15] add: Functions to merge tests into excel benchmark --- source/Public/Merge-CISExcelAndCsvData.ps1 | 47 ++++++++++++++ source/Public/Update-CISExcelWorksheet.ps1 | 62 +++++++++++++++++++ .../Test-AdministrativeAccountCompliance .ps1 | 6 +- 3 files changed, 111 insertions(+), 4 deletions(-) create mode 100644 source/Public/Merge-CISExcelAndCsvData.ps1 create mode 100644 source/Public/Update-CISExcelWorksheet.ps1 diff --git a/source/Public/Merge-CISExcelAndCsvData.ps1 b/source/Public/Merge-CISExcelAndCsvData.ps1 new file mode 100644 index 0000000..b63eacf --- /dev/null +++ b/source/Public/Merge-CISExcelAndCsvData.ps1 @@ -0,0 +1,47 @@ +function Merge-CISExcelAndCsvData { + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true)] + [string]$ExcelPath, + + [Parameter(Mandatory = $true)] + [string]$WorksheetName, + + [Parameter(Mandatory = $true)] + [string]$CsvPath + ) + + process { + # Import data from Excel and CSV + $import = Import-Excel -Path $ExcelPath -WorksheetName $WorksheetName + $csvData = Import-Csv -Path $CsvPath + + # Define a function to create a merged object + function CreateMergedObject($excelItem, $csvRow) { + $newObject = New-Object PSObject + + foreach ($property in $excelItem.PSObject.Properties) { + $newObject | Add-Member -MemberType NoteProperty -Name $property.Name -Value $property.Value + } + + $newObject | Add-Member -MemberType NoteProperty -Name 'CSV_Status' -Value $csvRow.Status + $newObject | Add-Member -MemberType NoteProperty -Name 'CSV_Details' -Value $csvRow.Details + $newObject | Add-Member -MemberType NoteProperty -Name 'CSV_FailureReason' -Value $csvRow.FailureReason + + return $newObject + } + + # Iterate over each item in the imported Excel object and merge with CSV data + $mergedData = foreach ($item in $import) { + $csvRow = $csvData | Where-Object { $_.Rec -eq $item.'recommendation #' } + if ($csvRow) { + CreateMergedObject -excelItem $item -csvRow $csvRow + } else { + CreateMergedObject -excelItem $item -csvRow ([PSCustomObject]@{Status=$null; Details=$null; FailureReason=$null}) + } + } + + # Return the merged data + return $mergedData + } +} diff --git a/source/Public/Update-CISExcelWorksheet.ps1 b/source/Public/Update-CISExcelWorksheet.ps1 new file mode 100644 index 0000000..712a89b --- /dev/null +++ b/source/Public/Update-CISExcelWorksheet.ps1 @@ -0,0 +1,62 @@ +function Update-CISExcelWorksheet { + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true)] + [string]$ExcelPath, + + [Parameter(Mandatory = $true)] + [string]$WorksheetName, + + [Parameter(Mandatory = $true)] + [psobject[]]$Data, + + [Parameter(Mandatory = $false)] + [int]$StartingRowIndex = 2 # Default starting row index, assuming row 1 has headers + ) + + process { + # Load the existing Excel sheet + $excelPackage = Open-ExcelPackage -Path $ExcelPath + $worksheet = $excelPackage.Workbook.Worksheets[$WorksheetName] + + if (-not $worksheet) { + throw "Worksheet '$WorksheetName' not found in '$ExcelPath'" + } + + # Function to update cells in the worksheet + function Update-WorksheetCells { + param ( + $Worksheet, + $Data, + $StartingRowIndex + ) + + # Check and set headers + $firstItem = $Data[0] + $colIndex = 1 + foreach ($property in $firstItem.PSObject.Properties) { + if ($StartingRowIndex -eq 2 -and $Worksheet.Cells[1, $colIndex].Value -eq $null) { + $Worksheet.Cells[1, $colIndex].Value = $property.Name + } + $colIndex++ + } + + # Iterate over each row in the data and update cells + $rowIndex = $StartingRowIndex + foreach ($item in $Data) { + $colIndex = 1 + foreach ($property in $item.PSObject.Properties) { + $Worksheet.Cells[$rowIndex, $colIndex].Value = $property.Value + $colIndex++ + } + $rowIndex++ + } + } + + # Update the worksheet with the provided data + Update-WorksheetCells -Worksheet $worksheet -Data $Data -StartingRowIndex $StartingRowIndex + + # Save and close the Excel package + Close-ExcelPackage $excelPackage + } +} \ No newline at end of file diff --git a/source/tests/Test-AdministrativeAccountCompliance .ps1 b/source/tests/Test-AdministrativeAccountCompliance .ps1 index 9841865..597936a 100644 --- a/source/tests/Test-AdministrativeAccountCompliance .ps1 +++ b/source/tests/Test-AdministrativeAccountCompliance .ps1 @@ -1,16 +1,14 @@ function Test-AdministrativeAccountCompliance { [CmdletBinding()] param ( - [switch]$SkipGraphConnection + # Parameters can be added if needed ) begin { #. C:\Temp\CISAuditResult.ps1 $validLicenses = @('AAD_PREMIUM', 'AAD_PREMIUM_P2') } process { - if (-not $SkipGraphConnection) { - Connect-MgGraph -Scopes "Directory.Read.All", "User.Read.All", "RoleManagement.Read.Directory" -NoWelcome - } + $adminRoles = Get-MgRoleManagementDirectoryRoleDefinition | Where-Object { $_.DisplayName -like "*Admin*" } $adminRoleUsers = @() foreach ($role in $adminRoles) { From ba0a3819b9a213372f3de00634e4d44a4736a427 Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Fri, 5 Apr 2024 18:35:21 -0500 Subject: [PATCH 03/15] add: Create public function for merge --- .../Merge-CISExcelAndCsvData.ps1 | 0 source/Private/Update-CISExcelWorksheet.ps1 | 33 ++++++++++ source/Private/Update-WorksheetCells.ps1 | 28 +++++++++ source/Public/Sync-CISExcelAndCsvData.ps1 | 61 ++++++++++++++++++ source/Public/Update-CISExcelWorksheet.ps1 | 62 ------------------- 5 files changed, 122 insertions(+), 62 deletions(-) rename source/{Public => Private}/Merge-CISExcelAndCsvData.ps1 (100%) create mode 100644 source/Private/Update-CISExcelWorksheet.ps1 create mode 100644 source/Private/Update-WorksheetCells.ps1 create mode 100644 source/Public/Sync-CISExcelAndCsvData.ps1 delete mode 100644 source/Public/Update-CISExcelWorksheet.ps1 diff --git a/source/Public/Merge-CISExcelAndCsvData.ps1 b/source/Private/Merge-CISExcelAndCsvData.ps1 similarity index 100% rename from source/Public/Merge-CISExcelAndCsvData.ps1 rename to source/Private/Merge-CISExcelAndCsvData.ps1 diff --git a/source/Private/Update-CISExcelWorksheet.ps1 b/source/Private/Update-CISExcelWorksheet.ps1 new file mode 100644 index 0000000..6de5747 --- /dev/null +++ b/source/Private/Update-CISExcelWorksheet.ps1 @@ -0,0 +1,33 @@ +function Update-CISExcelWorksheet { + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true)] + [string]$ExcelPath, + + [Parameter(Mandatory = $true)] + [string]$WorksheetName, + + [Parameter(Mandatory = $true)] + [psobject[]]$Data, + + [Parameter(Mandatory = $false)] + [int]$StartingRowIndex = 2 # Default starting row index, assuming row 1 has headers + ) + + process { + # Load the existing Excel sheet + $excelPackage = Open-ExcelPackage -Path $ExcelPath + $worksheet = $excelPackage.Workbook.Worksheets[$WorksheetName] + + if (-not $worksheet) { + throw "Worksheet '$WorksheetName' not found in '$ExcelPath'" + } + + + # Update the worksheet with the provided data + Update-WorksheetCells -Worksheet $worksheet -Data $Data -StartingRowIndex $StartingRowIndex + + # Save and close the Excel package + Close-ExcelPackage $excelPackage + } +} \ No newline at end of file diff --git a/source/Private/Update-WorksheetCells.ps1 b/source/Private/Update-WorksheetCells.ps1 new file mode 100644 index 0000000..eae857f --- /dev/null +++ b/source/Private/Update-WorksheetCells.ps1 @@ -0,0 +1,28 @@ + function Update-WorksheetCells { + param ( + $Worksheet, + $Data, + $StartingRowIndex + ) + + # Check and set headers + $firstItem = $Data[0] + $colIndex = 1 + foreach ($property in $firstItem.PSObject.Properties) { + if ($StartingRowIndex -eq 2 -and $Worksheet.Cells[1, $colIndex].Value -eq $null) { + $Worksheet.Cells[1, $colIndex].Value = $property.Name + } + $colIndex++ + } + + # Iterate over each row in the data and update cells + $rowIndex = $StartingRowIndex + foreach ($item in $Data) { + $colIndex = 1 + foreach ($property in $item.PSObject.Properties) { + $Worksheet.Cells[$rowIndex, $colIndex].Value = $property.Value + $colIndex++ + } + $rowIndex++ + } + } diff --git a/source/Public/Sync-CISExcelAndCsvData.ps1 b/source/Public/Sync-CISExcelAndCsvData.ps1 new file mode 100644 index 0000000..d1afc6f --- /dev/null +++ b/source/Public/Sync-CISExcelAndCsvData.ps1 @@ -0,0 +1,61 @@ +<# + .SYNOPSIS + Synchronizes data between an Excel file and a CSV file and optionally updates the Excel worksheet. + .DESCRIPTION + The Sync-CISExcelAndCsvData function merges data from a specified Excel file and a CSV file based on a common key. It can also update the Excel worksheet with the merged data. This function is particularly useful for updating Excel records with additional data from a CSV file while preserving the original formatting and structure of the Excel worksheet. + .PARAMETER ExcelPath + The path to the Excel file that contains the original data. This parameter is mandatory. + .PARAMETER WorksheetName + The name of the worksheet within the Excel file that contains the data to be synchronized. This parameter is mandatory. + .PARAMETER CsvPath + The path to the CSV file containing data to be merged with the Excel data. This parameter is mandatory. + .PARAMETER SkipUpdate + If specified, the function will return the merged data object without updating the Excel worksheet. This is useful for previewing the merged data. + .EXAMPLE + PS> Sync-CISExcelAndCsvData -ExcelPath "path\to\excel.xlsx" -WorksheetName "DataSheet" -CsvPath "path\to\data.csv" + Merges data from 'data.csv' into 'excel.xlsx' on the 'DataSheet' worksheet and updates the worksheet with the merged data. + .EXAMPLE + PS> $mergedData = Sync-CISExcelAndCsvData -ExcelPath "path\to\excel.xlsx" -WorksheetName "DataSheet" -CsvPath "path\to\data.csv" -SkipUpdate + Retrieves the merged data object for preview without updating the Excel worksheet. + .INPUTS + None. You cannot pipe objects to Sync-CISExcelAndCsvData. + .OUTPUTS + Object[] + If the SkipUpdate switch is used, the function returns an array of custom objects representing the merged data. + .NOTES + - Ensure that the 'ImportExcel' module is installed and up to date. + - It is recommended to backup the Excel file before running this script to prevent accidental data loss. + - This function is part of the CIS Excel and CSV Data Management Toolkit. + .LINK + Online documentation: [Your Documentation Link Here] +#> + +function Sync-CISExcelAndCsvData { + [CmdletBinding()] + param ( + [Parameter(Mandatory = $true)] + [string]$ExcelPath, + + [Parameter(Mandatory = $true)] + [string]$WorksheetName, + + [Parameter(Mandatory = $true)] + [string]$CsvPath, + + [Parameter(Mandatory = $false)] + [switch]$SkipUpdate + ) + + process { + # Merge Excel and CSV data + $mergedData = Merge-CISExcelAndCsvData -ExcelPath $ExcelPath -WorksheetName $WorksheetName -CsvPath $CsvPath + + # Output the merged data if the user chooses to skip the update + if ($SkipUpdate) { + return $mergedData + } else { + # Update the Excel worksheet with the merged data + Update-CISExcelWorksheet -ExcelPath $ExcelPath -WorksheetName $WorksheetName -Data $mergedData + } + } +} diff --git a/source/Public/Update-CISExcelWorksheet.ps1 b/source/Public/Update-CISExcelWorksheet.ps1 deleted file mode 100644 index 712a89b..0000000 --- a/source/Public/Update-CISExcelWorksheet.ps1 +++ /dev/null @@ -1,62 +0,0 @@ -function Update-CISExcelWorksheet { - [CmdletBinding()] - param ( - [Parameter(Mandatory = $true)] - [string]$ExcelPath, - - [Parameter(Mandatory = $true)] - [string]$WorksheetName, - - [Parameter(Mandatory = $true)] - [psobject[]]$Data, - - [Parameter(Mandatory = $false)] - [int]$StartingRowIndex = 2 # Default starting row index, assuming row 1 has headers - ) - - process { - # Load the existing Excel sheet - $excelPackage = Open-ExcelPackage -Path $ExcelPath - $worksheet = $excelPackage.Workbook.Worksheets[$WorksheetName] - - if (-not $worksheet) { - throw "Worksheet '$WorksheetName' not found in '$ExcelPath'" - } - - # Function to update cells in the worksheet - function Update-WorksheetCells { - param ( - $Worksheet, - $Data, - $StartingRowIndex - ) - - # Check and set headers - $firstItem = $Data[0] - $colIndex = 1 - foreach ($property in $firstItem.PSObject.Properties) { - if ($StartingRowIndex -eq 2 -and $Worksheet.Cells[1, $colIndex].Value -eq $null) { - $Worksheet.Cells[1, $colIndex].Value = $property.Name - } - $colIndex++ - } - - # Iterate over each row in the data and update cells - $rowIndex = $StartingRowIndex - foreach ($item in $Data) { - $colIndex = 1 - foreach ($property in $item.PSObject.Properties) { - $Worksheet.Cells[$rowIndex, $colIndex].Value = $property.Value - $colIndex++ - } - $rowIndex++ - } - } - - # Update the worksheet with the provided data - Update-WorksheetCells -Worksheet $worksheet -Data $Data -StartingRowIndex $StartingRowIndex - - # Save and close the Excel package - Close-ExcelPackage $excelPackage - } -} \ No newline at end of file From d037f82f602febf4a09c08290dd617ca28c84d01 Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Mon, 8 Apr 2024 13:59:35 -0500 Subject: [PATCH 04/15] add: test for 1.1.4 guest users --- .../tests/Test-GuestUsersBiweeklyReview.ps1 | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 source/tests/Test-GuestUsersBiweeklyReview.ps1 diff --git a/source/tests/Test-GuestUsersBiweeklyReview.ps1 b/source/tests/Test-GuestUsersBiweeklyReview.ps1 new file mode 100644 index 0000000..b89ae85 --- /dev/null +++ b/source/tests/Test-GuestUsersBiweeklyReview.ps1 @@ -0,0 +1,61 @@ +function Test-GuestUsersBiweeklyReview { + [CmdletBinding()] + param () + + begin { + #. .\source\Classes\CISAuditResult.ps1 + $auditResults = @() + } + + process { + # 1.1.4 (L1) Ensure Guest Users are reviewed at least biweekly + # The function will fail if guest users are found since they should be reviewed manually biweekly. + + try { + # Connect to Microsoft Graph - placeholder for connection command + # Connect-MgGraph -Scopes "User.Read.All" + $guestUsers = Get-MgUser -All -Filter "UserType eq 'Guest'" + + # Create an instance of CISAuditResult and populate it + $auditResult = [CISAuditResult]::new() + $auditResult.CISControl = "5.1, 5.3" + $auditResult.CISDescription = "Establish and Maintain an Inventory of Accounts, Disable Dormant Accounts" + $auditResult.Rec = "1.1.4" + $auditResult.RecDescription = "Ensure Guest Users are reviewed at least biweekly" + $auditResult.ELevel = "E3" + $auditResult.ProfileLevel = "L1" + $auditResult.IG1 = $true + $auditResult.IG2 = $true + $auditResult.IG3 = $true + $auditResult.CISControlVer = 'v8' + + if ($guestUsers) { + $auditCommand = "Get-MgUser -All -Property UserType,UserPrincipalName | Where {`$_.UserType -ne 'Member'} | Format-Table UserPrincipalName, UserType" + $auditResult.Status = "Fail" + $auditResult.Result = $false + $auditResult.Details = "Manual review required. To list guest users, run: `"$auditCommand`"." + $auditResult.FailureReason = "Guest users present: $($guestUsers.Count)" + } else { + $auditResult.Status = "Pass" + $auditResult.Result = $true + $auditResult.Details = "No guest users found." + $auditResult.FailureReason = "N/A" + } + } + catch { + $auditResult.Status = "Error" + $auditResult.Result = $false + $auditResult.Details = "Error while attempting to check guest users. Error message: $($_.Exception.Message)" + $auditResult.FailureReason = "An error occurred during the audit check." + } + + $auditResults += $auditResult + } + + end { + # Return auditResults + return $auditResults + } +} + + From a4dce52825669168fc8ecf8522baa2b0f2b19a26 Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Mon, 15 Apr 2024 15:51:00 -0500 Subject: [PATCH 05/15] add: future changes to be committed --- helpers/Automation Candidates.md | 52 ++++++++++++++++++++++ helpers/Build-Help.ps1 | 4 +- source/Public/Get-AdminRoleUserLicense.ps1 | 52 ++++++++++++++++++++++ source/Public/Invoke-M365SecurityAudit.ps1 | 6 +-- 4 files changed, 110 insertions(+), 4 deletions(-) create mode 100644 helpers/Automation Candidates.md create mode 100644 source/Public/Get-AdminRoleUserLicense.ps1 diff --git a/helpers/Automation Candidates.md b/helpers/Automation Candidates.md new file mode 100644 index 0000000..1b3d262 --- /dev/null +++ b/helpers/Automation Candidates.md @@ -0,0 +1,52 @@ +# Automation Candidates + +## 5.1.1.1 (L1) Ensure Security Defaults is disabled on Azure Active Directory + +- `Connect-MgGraph -Scopes "Policy.Read.All"` +- `Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy | ft IsEnabled` + +## 5.1.2.1 (L1) Ensure 'Per-user MFA' is disabled + +- `Connect-MsolService` +- Commands: + +```powershell +$UserList = Get-MsolUser -All | Where-Object { $_.UserType -eq 'Member' } +$Report = @() +foreach ($user in $UserList) { + $PerUserMFAState = $null + if ($user.StrongAuthenticationRequirements) { + $PerUserMFAState = $user.StrongAuthenticationRequirements.State + } + else { + $PerUserMFAState = 'Disabled' + } + $obj = [pscustomobject][ordered]@{ + UserPrincipalName = $User.UserPrincipalName + DisplayName = $User.DisplayName + PerUserMFAState = $PerUserMFAState + } + $Report += $obj +} +$Report +``` + +## 5.1.3.1 (L1) Ensure a dynamic group for guest users is created + +- `Connect-MgGraph -Scopes "Group.Read.All"` +- Commands: + +```powershell +$groups = Get-MgGroup | Where-Object { $_.GroupTypes -contains "DynamicMembership" } +$groups | ft DisplayName,GroupTypes,MembershipRule +``` + +## 6.1.4 (L1) Ensure 'AuditBypassEnabled' is not enabled on mailboxes + +- `Connect-ExchangeOnline` +- Commands: + +```powershell +$MBX = Get-MailboxAuditBypassAssociation -ResultSize unlimited +$MBX | where {$_.AuditBypassEnabled -eq $true} | Format-Table Name,AuditBypassEnabled +``` diff --git a/helpers/Build-Help.ps1 b/helpers/Build-Help.ps1 index 82e139f..a2d483b 100644 --- a/helpers/Build-Help.ps1 +++ b/helpers/Build-Help.ps1 @@ -12,4 +12,6 @@ Import-Module .\output\module\M365FoundationsCISReport\*\*.psd1 "Fix: PR #37" git push origin $ver # git tag -d $ver -#> \ No newline at end of file +#> + + diff --git a/source/Public/Get-AdminRoleUserLicense.ps1 b/source/Public/Get-AdminRoleUserLicense.ps1 new file mode 100644 index 0000000..d746dd9 --- /dev/null +++ b/source/Public/Get-AdminRoleUserLicense.ps1 @@ -0,0 +1,52 @@ +function Get-AdminRoleUserLicense { + [CmdletBinding()] + param ( + [Parameter(Mandatory = $false)] + [switch]$SkipGraphConnection + ) + + begin { + if (-not $SkipGraphConnection) { + Connect-MgGraph -Scopes "Directory.Read.All", "Domain.Read.All", "Policy.Read.All", "Organization.Read.All" -NoWelcome + } + + $adminRoleUsers = @() + $userIds = @() + } + Process { # Connect to Microsoft Graph if not skipping connection + + $adminroles = Get-MgRoleManagementDirectoryRoleDefinition | Where-Object { $_.DisplayName -like "*Admin*" } + + foreach ($role in $adminroles) { + $usersInRole = Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$($role.Id)'" + + foreach ($user in $usersInRole) { + $userIds += $user.PrincipalId + $userDetails = Get-MgUser -UserId $user.PrincipalId -Property "DisplayName, UserPrincipalName, Id, onPremisesSyncEnabled" + + $adminRoleUsers += [PSCustomObject]@{ + RoleName = $role.DisplayName + UserName = $userDetails.DisplayName + UserPrincipalName = $userDetails.UserPrincipalName + UserId = $userDetails.Id + HybridUser = $userDetails.onPremisesSyncEnabled + Licenses = "" # Placeholder for licenses, to be filled later + } + } + } + + foreach ($userId in $userIds | Select-Object -Unique) { + $licenses = Get-MgUserLicenseDetail -UserId $userId + $licenseList = ($licenses.SkuPartNumber -join '|') + + $adminRoleUsers | Where-Object { $_.UserId -eq $userId } | ForEach-Object { + $_.Licenses = $licenseList + } + } + } + End { + Write-Host "Disconnecting from Microsoft Graph..." -ForegroundColor Green + Disconnect-MgGraph | Out-Null + return $adminRoleUsers + } +} \ No newline at end of file diff --git a/source/Public/Invoke-M365SecurityAudit.ps1 b/source/Public/Invoke-M365SecurityAudit.ps1 index 48f8c52..250f2b0 100644 --- a/source/Public/Invoke-M365SecurityAudit.ps1 +++ b/source/Public/Invoke-M365SecurityAudit.ps1 @@ -248,12 +248,12 @@ function Invoke-M365SecurityAudit { } End { - # Return all collected audit results - return $allAuditResults - # Check if the Disconnect switch is present if (!($DoNotDisconnect)) { # Clean up sessions Disconnect-M365Suite } + # Return all collected audit results + return $allAuditResults + # Check if the Disconnect switch is present } } \ No newline at end of file From b381421f4519b3d364f6c5d7ff63c6b3636472cc Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Mon, 15 Apr 2024 15:54:52 -0500 Subject: [PATCH 06/15] add: Error handling for Get-AdminRoleUserLicense --- source/Public/Get-AdminRoleUserLicense.ps1 | 36 ++++++++++++---------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/source/Public/Get-AdminRoleUserLicense.ps1 b/source/Public/Get-AdminRoleUserLicense.ps1 index d746dd9..10e613d 100644 --- a/source/Public/Get-AdminRoleUserLicense.ps1 +++ b/source/Public/Get-AdminRoleUserLicense.ps1 @@ -13,40 +13,44 @@ function Get-AdminRoleUserLicense { $adminRoleUsers = @() $userIds = @() } - Process { # Connect to Microsoft Graph if not skipping connection + Process { $adminroles = Get-MgRoleManagementDirectoryRoleDefinition | Where-Object { $_.DisplayName -like "*Admin*" } foreach ($role in $adminroles) { $usersInRole = Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$($role.Id)'" foreach ($user in $usersInRole) { - $userIds += $user.PrincipalId - $userDetails = Get-MgUser -UserId $user.PrincipalId -Property "DisplayName, UserPrincipalName, Id, onPremisesSyncEnabled" + $userDetails = Get-MgUser -UserId $user.PrincipalId -Property "DisplayName, UserPrincipalName, Id, onPremisesSyncEnabled" -ErrorAction SilentlyContinue - $adminRoleUsers += [PSCustomObject]@{ - RoleName = $role.DisplayName - UserName = $userDetails.DisplayName - UserPrincipalName = $userDetails.UserPrincipalName - UserId = $userDetails.Id - HybridUser = $userDetails.onPremisesSyncEnabled - Licenses = "" # Placeholder for licenses, to be filled later + if ($userDetails) { + $userIds += $user.PrincipalId + $adminRoleUsers += [PSCustomObject]@{ + RoleName = $role.DisplayName + UserName = $userDetails.DisplayName + UserPrincipalName = $userDetails.UserPrincipalName + UserId = $userDetails.Id + HybridUser = $userDetails.onPremisesSyncEnabled + Licenses = $null # Initialize as $null + } } } } foreach ($userId in $userIds | Select-Object -Unique) { - $licenses = Get-MgUserLicenseDetail -UserId $userId - $licenseList = ($licenses.SkuPartNumber -join '|') - - $adminRoleUsers | Where-Object { $_.UserId -eq $userId } | ForEach-Object { - $_.Licenses = $licenseList + $licenses = Get-MgUserLicenseDetail -UserId $userId -ErrorAction SilentlyContinue + if ($licenses) { + $licenseList = ($licenses.SkuPartNumber -join '|') + $adminRoleUsers | Where-Object { $_.UserId -eq $userId } | ForEach-Object { + $_.Licenses = $licenseList + } } } } + End { Write-Host "Disconnecting from Microsoft Graph..." -ForegroundColor Green Disconnect-MgGraph | Out-Null return $adminRoleUsers } -} \ No newline at end of file +} From ad2c85d0346dc87f8e31ab55be7e9325f15377c7 Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Mon, 15 Apr 2024 15:58:12 -0500 Subject: [PATCH 07/15] fix: format TestDefinitions.csv --- source/helper/TestDefinitions.csv | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/helper/TestDefinitions.csv b/source/helper/TestDefinitions.csv index 653429c..5bef5ae 100644 --- a/source/helper/TestDefinitions.csv +++ b/source/helper/TestDefinitions.csv @@ -1,5 +1,5 @@ Index,TestFileName,Rec,ELevel,ProfileLevel,IG1,IG2,IG3,Automated -1,Test-AdministrativeAccountCompliance .ps1,1.1.1,E3,L1,TRUE,TRUE,TRUE,FALSE +1,Test-AdministrativeAccountCompliance.ps1,1.1.1,E3,L1,TRUE,TRUE,TRUE,FALSE 2,Test-GlobalAdminsCount.ps1,1.1.3,E3,L1,TRUE,TRUE,TRUE,TRUE 3,Test-ManagedApprovedPublicGroups.ps1,1.2.1,E3,L2,TRUE,TRUE,TRUE,TRUE 4,Test-BlockSharedMailboxSignIn.ps1,1.2.2,E3,L1,FALSE,FALSE,FALSE,TRUE From fe503509eae1db87166757ae2a71b814c303aaaf Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Mon, 15 Apr 2024 16:02:13 -0500 Subject: [PATCH 08/15] fix: Test-AdministrativeAccountCompliance filename --- ...ntCompliance .ps1 => Test-AdministrativeAccountCompliance.ps1} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename source/tests/{Test-AdministrativeAccountCompliance .ps1 => Test-AdministrativeAccountCompliance.ps1} (100%) diff --git a/source/tests/Test-AdministrativeAccountCompliance .ps1 b/source/tests/Test-AdministrativeAccountCompliance.ps1 similarity index 100% rename from source/tests/Test-AdministrativeAccountCompliance .ps1 rename to source/tests/Test-AdministrativeAccountCompliance.ps1 From 8f44424962322ecf9ff3d8658f440ebad388c89d Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Mon, 15 Apr 2024 16:27:01 -0500 Subject: [PATCH 09/15] fix: Error handling in 1.1.1 test --- .../Test-AdministrativeAccountCompliance.ps1 | 28 ++++++++++++------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/source/tests/Test-AdministrativeAccountCompliance.ps1 b/source/tests/Test-AdministrativeAccountCompliance.ps1 index 597936a..3273774 100644 --- a/source/tests/Test-AdministrativeAccountCompliance.ps1 +++ b/source/tests/Test-AdministrativeAccountCompliance.ps1 @@ -8,23 +8,29 @@ function Test-AdministrativeAccountCompliance { $validLicenses = @('AAD_PREMIUM', 'AAD_PREMIUM_P2') } process { - $adminRoles = Get-MgRoleManagementDirectoryRoleDefinition | Where-Object { $_.DisplayName -like "*Admin*" } $adminRoleUsers = @() + foreach ($role in $adminRoles) { $roleAssignments = Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$($role.Id)'" + foreach ($assignment in $roleAssignments) { - $userDetails = Get-MgUser -UserId $assignment.PrincipalId -Property "DisplayName, UserPrincipalName, Id, OnPremisesSyncEnabled" - $licenses = (Get-MgUserLicenseDetail -UserId $assignment.PrincipalId).SkuPartNumber -join '|' - $adminRoleUsers += [PSCustomObject]@{ - UserName = $userDetails.UserPrincipalName - RoleName = $role.DisplayName - UserId = $userDetails.Id - HybridUser = $userDetails.OnPremisesSyncEnabled - Licenses = $licenses + $userDetails = Get-MgUser -UserId $assignment.PrincipalId -Property "DisplayName, UserPrincipalName, Id, OnPremisesSyncEnabled" -ErrorAction SilentlyContinue + if ($userDetails) { + $licenses = Get-MgUserLicenseDetail -UserId $assignment.PrincipalId -ErrorAction SilentlyContinue + $licenseString = if ($licenses) { ($licenses.SkuPartNumber -join '|') } else { "No Licenses Found" } + + $adminRoleUsers += [PSCustomObject]@{ + UserName = $userDetails.UserPrincipalName + RoleName = $role.DisplayName + UserId = $userDetails.Id + HybridUser = $userDetails.OnPremisesSyncEnabled + Licenses = $licenseString + } } } } + $uniqueAdminRoleUsers = $adminRoleUsers | Group-Object -Property UserName | ForEach-Object { $first = $_.Group | Select-Object -First 1 $roles = ($_.Group.RoleName -join ', ') @@ -32,10 +38,12 @@ function Test-AdministrativeAccountCompliance { $first | Select-Object UserName, UserId, HybridUser, @{Name = 'Roles'; Expression = { $roles } }, @{Name = 'Licenses'; Expression = { $licenses -join '|' } } } + $nonCompliantUsers = $uniqueAdminRoleUsers | Where-Object { $_.HybridUser -or -not ($_.Licenses -split '\|' | Where-Object { $validLicenses -contains $_ }) } + $failureReasons = $nonCompliantUsers | ForEach-Object { $accountType = if ($_.HybridUser) { "Hybrid" } else { "Cloud-Only" } $missingLicenses = $validLicenses | Where-Object { $_ -notin ($_.Licenses -split '\|') } @@ -64,4 +72,4 @@ function Test-AdministrativeAccountCompliance { # Output the result return $auditResult } -} \ No newline at end of file +} From 8e2fab701c8ce83473e828caeaf8158782eeeb57 Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Mon, 15 Apr 2024 17:03:39 -0500 Subject: [PATCH 10/15] docs: Update comments for new functions --- source/Public/Get-AdminRoleUserLicense.ps1 | 28 ++++++++++++++++++++++ source/Public/Sync-CISExcelAndCsvData.ps1 | 2 +- 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/source/Public/Get-AdminRoleUserLicense.ps1 b/source/Public/Get-AdminRoleUserLicense.ps1 index 10e613d..f292c1c 100644 --- a/source/Public/Get-AdminRoleUserLicense.ps1 +++ b/source/Public/Get-AdminRoleUserLicense.ps1 @@ -1,3 +1,31 @@ +<# +.SYNOPSIS + Retrieves user licenses and roles for administrative accounts from Microsoft 365 via the Graph API. +.DESCRIPTION + The Get-AdminRoleUserLicense function connects to Microsoft Graph and retrieves all users who are assigned administrative roles along with their user details and licenses. This function is useful for auditing and compliance checks to ensure that administrators have appropriate licenses and role assignments. +.PARAMETER SkipGraphConnection + A switch parameter that, when set, skips the connection to Microsoft Graph if already established. This is useful for batch processing or when used within scripts where multiple calls are made and the connection is managed externally. +.EXAMPLE + PS> Get-AdminRoleUserLicense + + This example retrieves all administrative role users along with their licenses by connecting to Microsoft Graph using the default scopes. +.EXAMPLE + PS> Get-AdminRoleUserLicense -SkipGraphConnection + + This example retrieves all administrative role users along with their licenses without attempting to connect to Microsoft Graph, assuming that the connection is already established. +.INPUTS + None. You cannot pipe objects to Get-AdminRoleUserLicense. +.OUTPUTS + PSCustomObject + Returns a custom object for each user with administrative roles that includes the following properties: RoleName, UserName, UserPrincipalName, UserId, HybridUser, and Licenses. +.NOTES + Version: 1.0 + Author: Your Name + Creation Date: 2024-04-15 + Purpose/Change: Initial function development to support Microsoft 365 administrative role auditing. +.LINK + https://criticalsolutionsnetwork.github.io/M365FoundationsCISReport/#Get-AdminRoleUserLicense +#> function Get-AdminRoleUserLicense { [CmdletBinding()] param ( diff --git a/source/Public/Sync-CISExcelAndCsvData.ps1 b/source/Public/Sync-CISExcelAndCsvData.ps1 index d1afc6f..223ccfc 100644 --- a/source/Public/Sync-CISExcelAndCsvData.ps1 +++ b/source/Public/Sync-CISExcelAndCsvData.ps1 @@ -27,7 +27,7 @@ - It is recommended to backup the Excel file before running this script to prevent accidental data loss. - This function is part of the CIS Excel and CSV Data Management Toolkit. .LINK - Online documentation: [Your Documentation Link Here] + https://criticalsolutionsnetwork.github.io/M365FoundationsCISReport/#Get-AdminRoleUserLicense #> function Sync-CISExcelAndCsvData { From bbb1dd35862d459a49c3a219df0af73826ffd75d Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Tue, 16 Apr 2024 09:04:14 -0500 Subject: [PATCH 11/15] fix: Properties for skip and include tests --- source/Public/Invoke-M365SecurityAudit.ps1 | 4 ++-- source/Public/Sync-CISExcelAndCsvData.ps1 | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/source/Public/Invoke-M365SecurityAudit.ps1 b/source/Public/Invoke-M365SecurityAudit.ps1 index 250f2b0..cff7e59 100644 --- a/source/Public/Invoke-M365SecurityAudit.ps1 +++ b/source/Public/Invoke-M365SecurityAudit.ps1 @@ -92,7 +92,7 @@ function Invoke-M365SecurityAudit { # Inclusion of specific recommendation numbers [Parameter(ParameterSetName = 'RecFilter')] [ValidateSet( - '1.1.3', '1.2.1', '1.2.2', '1.3.1', '1.3.3', '1.3.6', '2.1.1', '2.1.2', ` + '1.1.1','1.1.3', '1.2.1', '1.2.2', '1.3.1', '1.3.3', '1.3.6', '2.1.1', '2.1.2', ` '2.1.3', '2.1.4', '2.1.5', '2.1.6', '2.1.7', '2.1.9', '3.1.1', '5.1.2.3', ` '5.1.8.1', '6.1.1', '6.1.2', '6.1.3', '6.2.1', '6.2.2', '6.2.3', '6.3.1', ` '6.5.1', '6.5.2', '6.5.3', '7.2.1', '7.2.10', '7.2.2', '7.2.3', '7.2.4', ` @@ -105,7 +105,7 @@ function Invoke-M365SecurityAudit { # Exclusion of specific recommendation numbers [Parameter(ParameterSetName = 'SkipRecFilter')] [ValidateSet( - '1.1.3', '1.2.1', '1.2.2', '1.3.1', '1.3.3', '1.3.6', '2.1.1', '2.1.2', ` + '1.1.1','1.1.3', '1.2.1', '1.2.2', '1.3.1', '1.3.3', '1.3.6', '2.1.1', '2.1.2', ` '2.1.3', '2.1.4', '2.1.5', '2.1.6', '2.1.7', '2.1.9', '3.1.1', '5.1.2.3', ` '5.1.8.1', '6.1.1', '6.1.2', '6.1.3', '6.2.1', '6.2.2', '6.2.3', '6.3.1', ` '6.5.1', '6.5.2', '6.5.3', '7.2.1', '7.2.10', '7.2.2', '7.2.3', '7.2.4', ` diff --git a/source/Public/Sync-CISExcelAndCsvData.ps1 b/source/Public/Sync-CISExcelAndCsvData.ps1 index 223ccfc..378aba4 100644 --- a/source/Public/Sync-CISExcelAndCsvData.ps1 +++ b/source/Public/Sync-CISExcelAndCsvData.ps1 @@ -27,7 +27,7 @@ - It is recommended to backup the Excel file before running this script to prevent accidental data loss. - This function is part of the CIS Excel and CSV Data Management Toolkit. .LINK - https://criticalsolutionsnetwork.github.io/M365FoundationsCISReport/#Get-AdminRoleUserLicense + https://criticalsolutionsnetwork.github.io/M365FoundationsCISReport/#Sync-CISExcelAndCsvData #> function Sync-CISExcelAndCsvData { From 02529c9cba653878917136f76dfdd7c168ac5dd0 Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Tue, 16 Apr 2024 09:50:29 -0500 Subject: [PATCH 12/15] docs: Update help --- README.md | Bin 12446 -> 10176 bytes docs/index.html | Bin 40340 -> 30406 bytes source/Public/Get-AdminRoleUserLicense.ps1 | 2 -- 3 files changed, 2 deletions(-) diff --git a/README.md b/README.md index f50e965fdfb1b6e182232b4b01e2aaaa7d6f4d04..fcddb5550c5cdc5d77b6e9013e12ec0cc92eaf89 100644 GIT binary patch literal 10176 zcmdT~ZBN@u7XF@JF@h_lMI;nx_XFy(VkzxL0*Xl6yDLEI#Ga5@>>01ePGHp^zt1@{ zj%|{(&`Z0wRjWF-XU@x<*XMX$ob3MP)mvMdSQgqEcQ_cHtIXzwII(e=s7_~nT^#F3 z8Hei+6Ya#AovC~{QAr|Fen;TuNIDe@YXmkBBW0pVD)SpBq>1TqtX+}oQCZ+6&{DZ5 zCQ2OU3RI`KuxSe7;-K(vfs@{;HFR6$k(NnsIFY$JNc4>oFZ(aVz!WMs%(6@>{`!LX zOO-TkuhZ#?jSXzli{`s*Z0w1D*;1tPP8eH=(kbR6mDmkb#MtJdeqCf`o>`|{pZBU+ zpnV2oafhvPmFn9~QRJYB)#;|d7Nb%pkTZiiNX%;cOu`UD?94T=PO`A=D=TjXkA+fKy5rySV z1C338U?$cP?V!gZnn-i4oWPlrB(dsuI&UH4xWxHaoW-h;I&s)MQ7{BC)eeL&p7?yP zo=u7(b9-A`kco|!f1ev|O=mWn^&{<6ROY(4V>0;JtL^(axyL(I^bX=wn{%6}k51*s!C%(# zaCm2I=CtdaE1a;JLX|MPyi%R_kQ@u0XN&eBXYr09qX@oP;8|`{aiXK#Iy)`|oEA!! ze01+}nN7sO*`N<*m|!7qJD)#)&d5<6Icle~ibrwL8{X)Q_c*l1sEESAmAH6K&S%Y; z%wd91n%lqX&>!r}Was_sQi(6vt%tiy{^7}MV@LV^5{6%I@e?e>-vi-hx`-wstC)wLWU(n` z6J>-`xN?x$dlNh_2u-d~YuIZQ4j>a4TYM*!E95BA&}SS14dNP(5{|$pH4b!5e6$(#UIUrEWR)CCObM z!j5GEhpYd8>wohZv5H*>%0wJgeU5#RG!*(W9D}fX z4-vs^`koi#Y>P5S=$0bl+hJ2yiIO-3wssO<$hK{JqoV|vwxwBV8m7ZieJ=aAzCemyz!_I?c5X<7vj}VN6wTL*fC{&8b zA;-I@Qx=XLe(r2ia;0TdF|+wi{~COi zqrSFVt4gu0^;HH?XDY;%r{A8l+rUiijp`9|!;lCM$cEXE=Go1^MPZ=Imfq4i4%AVV z@|H4Fom)e$1EX1;vQ`lmy${MrQ*g@tm?z@(5JqpV_eJlGO{F%RjpjEma2M_#k{dFc z|NTb8Y&rDPtyAmE-NT8BZs^AEIP$@muCQ>d^Awj$Q{t0xd2~!6WiAYnKFjS`Cu;G* zuOZRENA2DkZoMTt?q=*90(vI#g8a zKvM{l7@=qKZ3OS$N)2-jE^7!HT5B%)3g;-hDeZ`a6B778-X{K!cb<^{knJAId7VmH zd;^4WLFuUZ>n;MlTGeAA`w##{rnF2uRl8L6mUBWok0-SAU4(WYPiXf$2(?30i)L-N zL75Tyh-O^o4l!sKT4ng&F>GCOr8 z`$&!e$_7T3!Alh%LXHVDQ@1Gosc~6$j`#U$mD7*pDxwm69wxI~IRJAU%JTpt1=#sP z8uE2~&B9D0p)_*JIKU?jOAG~ny(Sv3TtnTFu5?12q+g)C;Dy7C30F5vsH0mE08^W@izYHp?5)Pc84TYOH4yMf>>8W5kZYQ-)L=F6 zjC${H;?*9Wco68c%2pTJ@3pyP7-9gP?lJ7uC-q^Hq)pL>%GX-W`5NL5y&9f`Vqop) z6<%u=DPrw-dyT=MGnLbLWd*=MCU^8I6fAUhs935hCgiJmozTE|@1YUjK(KzILgrP- z_C4X@?}WXCQirV*>7`gv?=%s)-33JMC(5&!+(mc0zun*MZi?;>F1EWX1f5N&67_kV z#9djT@OJFCykF}qUoOc08>`U=S11087``0jdU9j$oDKIyoB9`VbW7lI@6b(Q{t`&} zT9dtgaD|oIu0vP^VEZyE1}G*XX`&=TLvnD zMMgaY$D`XwB?l&kIsxp<3Ssn9IC^OU^ils8Izy)^(OwlZg}D$aSYFB6U}e?H;h$Aw zmfT^qi=|bcN8|)Sxfl(p;%kWJ3Jw8|F=aaXs|o|z$KBtnO$pI#J%MZsZOLSQ}o8wZ)cbTusloDe^@uA9i4i8TCU+W|77<>}n)Mt?>C-1fHQmRCm=J z7Uk|#E1ns%gL$gl9^5JVf(Qa>f-`W^ZphH7n9V`|So01SFO*U_>XzcpfY zDCO_f_Dx|MgU+5fG7eb+1i~PzJ4h+zuq$>OpYg!K3e>tV5y}>2M&5{10d&$61C$*^ zlM85k!xPiPk&JHWHE`aDo+E`Ug;t|9Y=9VjyD<8uHFQEWH^s*d_z(qVns^gUtV2&1 z+K#y%uoTWxRQ(E7zn&6tNap^AqWB39$9Ww4!P?|TBM@`se^9Nv;y6Vem&F=+*=1ob z6$PgLZQ^c`lv@ErtPv~tGD;PA6uh-wNY>4{ymLZc7}5`a*wL+?by3+tL*1H4mp-Z@ z^>*i*ck65ujtR>{Hk$iJ?c*(@pwBm&W#QtW_Ba1NQA1($b2a0K!9IyKKA0i#8&Whs bF$muNuyDZ@(~p_ZuF%sH4QN;F{=D-)dsN|z literal 12446 zcmeI2Yfl?T6o%(>rT&K%R7z9D&_LP`5p6{Yi6Rk#0!dpzq=F5J8)K+1kV^UOZQo~( z53{@8b?hWisvyf=@9gZ%xnJj>zvn|1o`mJ_efTas3@2e2x}g>J!yvSE*A4x!79NM~ z@GKmLQ;qcWgf~t!YZy8j{W5$Jzw?2$HuPRoqr91(?S$7F@9X)N-aOZnp4NP=Ye%0f z9Ou@{Ml%lt1#7hQ97wVeBw0AnXji+u)_eO}=}laDUt`R*eOmE4(9^c&4+XWYWcaav zrZFI3-JY(7^Vw+RL~8>Tcw}K!bMtE%Z5m-S&REkgvstyN{q}`ZBjN{ihkCoC(Km7B zdto7bs}&z>Wnk**nyAg2Wg0GMB+-vuz_cIkUr@fG8Qjr ziM$mhsV`{ZP!>6!^dQqXa^%o~K|8$C7w&gT)T)*?r`M`*J=Oas@fYsEC-?&GzzEC| zj%Z63_d>S2k%IRAndX84&>6&CNhwgC#9z}6WH(^~9h0U(0iHSx?Z`_slR2-nHdvd! zvkzQhN0SaD1e*h;k3>(i1;zc~(V-yP*FGJs#{Q@JhZZ1dSpbW^zF@t3&2{-@_*%5V zmYfRa`(aTZ;~Nxg3ztLP=WWkIq|YnOE7GN}kpoF|Lv(KH7s*=;W?dE|&5(r!t=A2= zbM)SgmK@3JYe$n_*KFr&OM9N{y^gN%D_P#3<9bEQTZPlP-apr_SVOqf6nByMfgny8 z+0#a)J->Zn-OR6GFV6%IR9v9?QVuWBFD0A!0d=LP+?cE!#?bKv1wem!Iq4Jbp( zsIQmo-xI9?&#-hSl3V1?{AU)agFN!I8!Z9W!>wTv9%TA$gyr|Z2is|y(vN-#Z2;0T zw9{apiAFmS8hAR82Wkl#tj%-5))B-jqKery^z=uKG{OTxfQB+}Q&+QO<1=?hb2l}A zAdLgpZsf!uywpm?=MS`AUlgmF#R~aYVl86c6qkLSU!pA;h+jt+W47Z_r1SA;bS1*! zK6^{h<2k^oqP2YXUG~$v;t77N>|<|y zaFy4bHKy5C+|gDX_PKJzqfNhBT*{qCu2pdr&)-QRQ^c6Xd#id_-fJTdBB5$uLLLT6SW%bfq9S1;?txE zt6n0jEN)Rgn}Qv=tBa=%H>%r33AX!W2a8sCRqIg!$Ih~XSyi+XuS^%kJl&+7@ry%w zNo;XXt4vGTI_o)2ta>$+JX94k*#bNo)z4#5rP`-mM{3qpZt5vG$vQgTO;Mp0JrU6z z-qt!CM2d`<#oU)n5ZzMsMYgQNmMW?qC0kc!QWQme*NgoSq;+~3d%u-U^r@=mUM`iW z=a=ipc`2KPBG8wLz4bkiT$T&pYFmrE^rGvGuY&-*$qkHkpG1vv*2 zlDAv=+^g7+|CDl+ujW_L0UfdY#eU1NWcj|%I$Ax%I|NlbHAS5d*~v3u;ttC~t)FBW zCR`^=MUK4FZc(`F{HZV`Z-Dj(;Sc?5j=YNLH|x&Q=SrPahwQ2R4E;rZ^RU@Dj#Z6Y zhYTOw*Bx2&o_aQWv97ce+G8AJR?W*KT1Yo4c@C3TgOPoU z8RevY-8fy~4Vq6BNi_gWE!z3`(4b>UEXgyosQc5^ww`l6ZHu~Kc`02~JH=tSv7JOAKXv<+qPaXg<0npx z2WE9GE4Pyg>CA>zOX&34c@&p7VmWk@{F$ydeONnJGW{73mw^vC(U8tCa7O3qPY4+0 zo(b#flL4mJS*Ys&L$yIXTU3Vo<4*ygt9;$It;=ImU9uA(X5Ba!vmSm`kNb(Lg&X>x zDdS|6Hz)VjXSKG_X-8D@n%#I`eXfFg_ynvwlHL&fsmkYaXlLt?#({i?$@`q}sO!nk z#W`u!;ycAU!d$F2*=lt)mn_W13dvlKW>9ZSxb{YRcs#QF)1H&?sDoNpu^!`EXf>H~ z?slGxsB@efJci?qb|FyA~3QTC2vUUD4hYcU+%AMtEJu6=MTg4%+-oli0y`aP nXK6cvhnScQ&NXIJD-UEniILx^WLqBK#BACAOjI&Xv`j!q?76PYwUh+-l|m zw8bozelA5ilZlwm#4J6RSw4|*Ec_%C**sy032OSUd>9Dt#VmiA2Hq^+5$-e%=dpb1 zPoGDGx zSd5CukKH`*W7*%anwb>E%$5J1M`wNKAMP)E?mo~B5Qnj}+B`hy%Wy2Y9zhUC$*GuR za@2RIfxO%41YzTG)lZ6&mBxk+;`NsiIg~7C4RCB7Nm-uHxKXdWNs$oj+Y;XV9ip~KebzW;{lx9_R|x#m-&RH4WH&iscAkt^SrNn5&N(<~$0e0on|J3HvM`yW-n#zMEaN zEErcpVn!6CaqQ2aBrAMcU_no-VHudf3gs+UgQl+v9{RPizj?gS!xHA+sF7}x77Go9 zQ9g@(P|Gk*gVPG!4FF*(>O)=$5CQf24yYTjJW2k+ZK%qQ)|I_s8eS@^r58qLB8dGw z?>nU0{0QcgJBsH~sI-^$Jp*@|FVs2xcZ(Vr^d>uN6)$?-f#9KHrAeY5sXjrtp$nK^ zRtXS=8;{*xDB{?ihVDK7kx$+G{No~bckTjmYTNv0SGOpCp;WyaB^87g4xv(1P?st6 zx`VgTnC*+DHdeI)swCE2Q5L0#bMQ|hipv=qRu53ZYC?4HMLHgnnE;cZ} z=Cz-V$$YU1oFqh9td5crHTld>Om}(arb&G1434=EP!2x6LA?lsXN;a93Jx-?fx-l)#XNew*@bqLDgc7wW>12`A z0>(kyTAbP>SSbon1WJGdqGUEN%rx+K;zbafBcc%Yne?*&b~Fk(no`s&2g?XQkdrh9 zef6D3Q4BN3^E^j%RMQ|Z#d$S`P{Zp%?p1_lP={ec7376dWp@9M@wS8*BC4wEGK#BO zZdAxAsKM8^>lZ)D!rcp@2%dv~e#vF_7)EoF!_Zy#1?E45MjROoyM1wgR?{GvE*wu8ta8u(DKr&t*0m1m#%IMuw|cX|b6LQWK7%bi2a$n}naZ$Cr6n~; zFBf1g;S(i-nBgX%)u;r2_A_MdQDO9zu+GNm5uzjrm3G`f?Pf~&9oq%SJ#)%9Up;p83 z<1`ubDx1KJGBxfHE7~Yl!!|hZl=q{A32T0IG=dCZln{5oP-RSEMLCNjKM5pOgEBZ} zxWTS-fKyDc53T^Tx)6L z#63EVW=sP6iaJ0jFU84LTs+u^cO^}p`59afkmvcfH$~Mq&OrE{)UybZ$$j+$8(LBatLU`LLW7#ePF6YuTb`VRo*U6*bWE1 zBpqghRYch9@F%p&E>s)g>wlxk4M?7{u~dE% z62qW!F@={Zf)iB0uSar~UcsbiX}JI!`kML)6j>8VCP_)0RtfUl$s4aMkP7SlX7Lm(_-nA-CVvYBc?aUWxXl@Uw} zA#z9)TKTv3E2qO(N`;aFf}Mi>QI;U>d@Gt+b1QW7S`ny#qK_2T$P_@dW(k z)DkV-xv{dFbgf=T7pShxv~tvS*;`=*+(zQ|=Xn9ve+y)!TtQ)A6E>>R3ptI7+|sb< zUJv)#(f&M#r{-tI<84?<^DF@=i-2DXHE=ctqz{&41B%@Dwzem8Nf{n&2Vm16p2KU; z_#a_Cl%5kmks%EJNjJ=Ev2m!>}!Wx*TRvNJZPsTzZ{A zL#pE(&I}95OKQ2U)S;hOQG$85RGV#3jATPSs*l;#jI8Ye-dAW0#M2ap(Ch6Iu5S;+ zc7@c;i+xBowj{BtkX<2YZ_3@i=kDC+fjygNvox2T{RuWk@cmG2LsSMRb}3|>&dB~E zb}>%r$`&PC*Rtx&Jj2VW>_Xt*Mz?w}_*?u-_}qYT;)#O`pLU!!F-5&+G+o2@J5IE= z-k6QmTD=E52R8NK;2(QWo;^MgJLEv)H*ag>X^YKnn-IgBkW!5u+b?FpLYDuk86Z9c zn=ab<#;m8kOQRXVdMh;JoOK+@2yNnuJOF$C2s|*W`yhYNtpKJKtP`)=Ssd^sA zF8lo(^heZthuJrRXc=){c*(mou z;mC<#g5_yECvli3vN%t(Q*VqppAWq#?X27W?X2}dHL#*#-)ZBwAvTsz8-w@S-RoRG zgn{b6)sCR*JMe6Cu=Qa7B!Ni|nstt^KgU6{u65FYwu45MBeNsdemSLL*zTySBbl5< zkh_aM19I~mLzu1YFJbnV(UF1WDgfG@g?)2^7gz3sx>9cd&X;;Sav$^&w4b4Gk-tIjk*& zqgY-SHoM?X6hoN=lc}Gb+BV%LQNmK)CKLNNTcaPk*JSP7y2moXcJLlK@P5f+LEe%h zXwYO#J`&+ROsCkuB9n6Q(+R%8B->Yl9gY_D{4jztWak{cdYY=xnSJtl(To3uLO2}J zFH{^w*%Uw5dT4InelKtzJSO99VLSxVvn-_;nsuK)*6|*yMaAKdJ2c3TeiU~0xO#?;C_o2Y2+T^ zWzZ_@ryLLOs~C22&<|?m)cq3RaVV#EjbAOs5jW`sBQ1P&A!LmlwE-2jk(4i z*ne!^;C-iMfrxq8(0sf@v-kM!pEi4XJ@P5dTeal4!CAvejMCjeCkM<{3brrJwjD3%h{@GaliKJy!)`tB!->fH|w)w`c4s_RRz8^n60xwS|Mu(M>Z zcA?T!BV+KF)v(s$dqE&)5INA+ewO){WOmgni)20>Vi)QIl0kn|LoY9sKe$~Q13x65c_+Qi z6Hqt$?r=Uct z3UNXc5U^-3H-6K4pu-ZX{#p@~t~&mrvs1uXU&ehb#944ar7M1<^XTNYM0_3DfhqzM z;UoKeI3pK(1>z2HKoOP%;sz3WEwg}3Y-eUF{%SvJ>5-J zjRJ0IS>IQar z3IL>VH$GlOfh`y&5@x_SqLJq0de`BFrj1AF3rB^Jc|)D3LMS1hFlw_q7KhBMkSPjO zJ>#_}qG7x=8-qjDDXh-$(oF(4_d7rfl6_!!Qe`=D#dA5vfh<5khmmMT{$57DAds(W z|NQ*i3nD|=+&muLDo&=({Ga1gt+Pn$gs51Is;P2~;1DX#!nqum>g7b&95hJjCY)Nd z4WAuHQT;{xh@FG`C}w-bh4XmFSrZuhtcut&6Kn;C5osRW*IsQpGzZ7Fadm5lM(Ivn zA8rLHXe$I(7YhNun}c3&5Rs+36k*6KgJ&zGL1B@pc<+(YT8rJB>F+(D{V6N0gg|(6rWN#vO1#ANTMEv~zDG&c5VHQkp+U z@a~P_@b(ImkiGBE zV7}-LL`9CqC_$_-4zzOAB%d%O7M9#MZ#PcKLFtSAqhAFlhT0J1xNPTb5cQwqs|jTS z2cOD7^PIxDttjg+eopw5;;(S^!dR)4u8yvT(C_T)2<#&hf&ElPV6Tn4wxX+%My4@% zAAS6%LaNss?*DTls@F8W7*I{cCX}r0|G;&KKJl^TUYtuDpM*c3(-AN~u@tM=iyzHq zeSC=obf{|f{V9imps;$Jpfm^SRG7XFy&A36oa_B*3kkI4ut91+*~-s5s}HSgl2iV9!hl{ zkd!p*w1t5{&6o@W8-(ENk6C;ak>2Y_>BMEMkV1NCMQXAJLs+&UPKxwi@g2%+O--^R zeqmxqK&@UBlNz_BJmZg@iM;KsWC(hFIo z5!TESYamP~xq&L>Z(K!XSQhz`KB4*2BK?ME%4VHX+iRX7J#Wp0wmSIeR>f(50Zyt^ z>J3iL@5n>yMoVA#BctZy`kTQmqRp1ygR;J|oLY8032dn`C*j8bLf z9mWv^Jz4wqD3r{$$5$6y&My~wRh?4DCi=B5`t+I3KQ_2dmMz)A* zVJjRmFJ2Vs3rSYFcM<0o@U_+~Q{fQmk5p=Qa?;YewyMbH1-WQ%KUs9SG|aaKC=XQ8 zs5)tw|g1#MeuFq{6;D!Jf{;~wuTBvqS0bNevjnfoqtNmGoyDMrJR=lFy4=!=Bz|Ib$ z0@M><#ej3yhnII9rYBd5t zYi)S3OvVMlYr3)ic95P8X+=b&%yV54d!Pt>$*o4IO1)JKEtD!Jd$Td}^P-{PL%~jm zVJEGm>%6ulY-H?HYWb$avAMrd%I@EC)C>@8u5k{ zVsAExw16Dyk-J=^KJ=!kZ?OkpQv8J4l<9}78vYHqj1w*I6&9wSQc$-rH!4@+Xm(`n%HlLlRRg_QM;ml$MK z@pU!ExUE2Lt^g!z4yUnV^1o2|>M4ah=3rQ0_VeNqr>ieNa{f<@|BAB5?_*0X?23ku z7y4GEu7a^magMV1Ir)1$M;0?WI8Q^hC$#op%PH(9&Sw>=2`Nan*j4E_*!oTdvjVH- zMR~K)9pMtGywMU{TS9u+_CxBXL0{m!hxMY@7vFD-)^fXOdb!y%KW?fNMjmY|B86kN zj~mLG(gU#ci{^e2!j&yCY=rj3($}>&i^#I^^G2*_Cet8hhe5|9+`7@& z^w9ZAUz_%oSlOXC+eYBfx9ITh_Rf8Gd)M9FE^8>1eT8t(*(GP=<3i%7z)c`YD)td- zl|*G}gf7x+FW}dI8zT!_tVVEMWS3tb!%&fXpX{ z$0qL5TPpt$xI&s$Q+-`OD-p2V`w`=~Y7UVff2*QDx_X#ul-12ywOK^*5*iIvhyUIw z%>%!6<$I%~E(ZGL=V3c&U705lHvRUnb*06d4^xA$yl8e_T#2umCoj%_d--)seD&hG zGj5wosDdVRmElS7^7r2z=el)mz6+@uB^e()Fy;Eg-+$lT-mY3{T~UFsPvW>O`^XZ= z7s%xg0$8%yaWs`!<~4&>JLp3onP<~UlSYZG`0-^kZ12&@N>U(2N=c2Cwc=4W=_VNb z8Y8^Erp`v~vFdKp_mvuGNBA{twO{oo2GXGKd&C$?*t`lQ-7iF7BPH5nHb1&MZ6h)7 zY`57L^xyKb>#*>1+P3t>cg0q;#O@}D@YT=9$jsVpApfLJY0rGhms_d3JY#)%Jk|O4oT=FK>#k2SuF2bafWt zd72`mn4{rskgnULS`Ol_<1G$|zbK`{XrO{hKUKgF+hOY}?1x)hVM&IGJg4AgMA0>! zljhaQzq~KM`uc|#FJ4}^UOH`O?6lertOd3vcp|+5Q`c;@NBzLl)AWP$FQ@A`n0l+V z(br+yiBMJJYmAC{0cyFv2649|FHL|!GrMhBX*ET*Lqk9wX_(dn^u}Y~+G>K7yb&x3 z)K~9XAYuN=2;dU0>=OJMdPuPYeIkKv_o#tXtth-H>K?b5dqCeUu+S?H;q6VB*Y)mz zQx6VENbz5MHo6DEXUPITG(&_dr{}=4)HT|UAws9$2Llls zmLy2z-=a#&I;<*XCU5Sa*X;+c*`*8$#O_uy5S{ukE1|wAuYT}RbrUH#5N(sEJ5IqYSMH?u%5)Q z<(ESx{wiTOiC(r~XqKyj6+J+LLC_qh%}MKlgl#FPsghH5OK;K0b*t6g#teiS(ygs` zY_Qd}CtJ_@o8Sx*Cx9^w`N{Ne$;GWLW-o^<8>gBl2y|_l6H9@uJ$MDjV{k&nh(za; c>+9yL{~@;qjIql6!N!O>%!Qn&d~5Ch13kx;D*ylh literal 40340 zcmeI5`*RdWlE?d3F5>=&LEg2*nvnqEwap4x48lts#vI7L+rTUVdLa;!P9v}tEdTo6 zeLt0xsz-Ov^dNDZMCDACu)zCW#A>*=n3Z&vHoj{f$mr@FIVtqsff)WT9Vs1EgXx7yRUE&W+r zJma&XKDgVfR#j$AwR_bsYKJ@Zc6-$`wbs+~Ug&#Qu+8iHu6nql>xJrawV?l(^#4-0 zUe?`<`gWyS9R9x;;5XP7)K439O97gJ;My02d+Kj1^pnGXr`k{thkEk5npKUSAlj;4 zhH-$Mo@%exMgsKDLzy*|SykOv`n99GV9@$Guey6`Z9QNEynsVW^;CW@Jlz$p!22My zwyo0OW+%Y0uTnclV|9F|SLm4j=KD4M%~wCG{eidv*yh9ci@M(zl+fsPfa;!l0_tAn z-+mA-{;m?Q1=06O$)P| zleD)S$8hhKT8I>~mYqKI2aV!$s0=lB11C7tDW-Y>Pdov8@Haic_t28>vtb-?%0O+c zYcyNc8(pCVlmPo1y2t3?_x$6dSrXSHL2W$C^YK!PguA@E{KM7o)n;|Ino$os`fp{< zNW$Udr|Q}7a1Sm%2=HDLFDzDnuD+~p2MWNQk;@0tH+QOs)dRJ$r|0{s)f;kNlTfzKNs{_RU13i z3yoo3-?sxj*HjknpcZ$53O;+GzhCu@mY=D{f~btHMaTVG{Y`f_)fZ2>g4unQSyUSr z^!K&Cp`8y@2V7AfEyt*>r&j@DdK~D($hp5A;7;qoo$!I-rYmRs*6?vlW84sC(ai_K z-)|o~2SYt+oY5B#?do$NS|5ngPsRDhEpQB0-}qpmq1=bX2J#cNkat2cj059-Xo#_>rid^x(4ip7Pjt*FJ7p(iY+Kb+u^P$ZV2XeePkw(1Yj= zqzY|DnW))K<_*?IdX5hR-xv(N>YM6uqRr8isZ9aGec>B@RBDJ_JwrRZ3Q}(RB5H-G z3#f-@`K3x@3EvE<`IYKk(D(Xt!xGvH8<4^i?aqgQ6s=OyYC)PCuA2{@W?8~z52}ua z7mxap+J|;f;c<;dQIo|{V*TgUcGRX|u&zye)!QS^Og)BOVH>_cZ{tDs)e_z_t*q$- zJUu}M&pH=k{ST_YbZqa}(4PAmUD|q=wY(?j@P3-%H~jVm@A`1u2cbVa{5{#09Ll`q zd5z<##{W$J_ce0+)z(wl1Chjq>W@Vaj@vf8Ivz&DwIN#U3**F7`}%G^elrHJ`cMj+ zy{Q`JgF?fL;>bD<9Ky05T4Y1DC$EWCF}vMfx5Pa0AKX>qzNCr!lkjL8WsG<6edwR~ zk_faJ!#;Yh$W0e0ERM5C(`k^lsu~X6vzmND6yF3syZ9RBj`PhN)LP0$*=~uHT zb*XQrz1PYy<#)S}6Mt&lSi10{_k0rYTnYS+wQi=O_l17IazPc-@I(p3^ezl_h>#3%)?~6q{Q>^J9_0QeMmZ_A9=QwSh2VEN{%9bb+KRG^SngE#Td*EnDl)#II((@E(yc zGFeDP`oyB}RA%z=WBoSuVZ@ZRT+vg}Fn!{(mRg*$H2xhKWXsmHX?*uZO8Yg**lql1 zTD;_ve~Fd)K`(3zC$zhgj1jr=nz@dl)lnZ}vgRJiL!pO=nZW{me%$>4UCJfhG0~0% z@^Q$nWyVYsl+yN0*s**$I6{|$JF;LFTff#f_%7z&C&wc-MrqcP#%+2imy?oT;kwcT zYt~%jINr5-?isd0)fBb3?2u)!&yw)EBW^`Ql=2Z!L!$^>4tR}LKM+qmB*^Mnx zBGof#DV~|NVNMl7jqR(pd2vbN|3- zSaPA?h5Ly2(+IE)3wMWQn{aJjSX0l~Orm@Ex~aFmS_LbwhB|{RQkoC`OgX9@`8~T~ zhO2*+*?*`y%wiE0LXjK#4$qTyy*6 zgf+G9PXbiAAKk>~4n@xC*hK7pvoGUg;ELCLN!&%&b26?*zKIs7ooWngbx(KG7A-$Z z)-;zAvI{OJ%}{KmN=`5Z)5YI%zIi1 zD2u&DhnenXd#qrakGZLL^V9T@R# ztu3D9bGYcq$?3-IAh~|58t~Ju;}X4xXM**D+wfGb9rfB9&YH3w0({c~`H_9;<#ul9 zqDx$dHC^2Y=%!uE7Lc|@jiHy#1G*&fWR$KfTl3%Lm~#1U*APVK*k|*g`Q8uyK^l9# zA4Czdrru|>9?AHTU6>t?erYI0rFMk+tX+5>@`7a8-p8&o1GEzO#j^P~)VJjde^mQm z<8%Ed%l}aSvE@k4=lbIwwOJ7YpYi0Lu1MmzT91bH?y2rUn7`doZDjjE^Bq0Se^|Tr z{Fd5gZU=2pmZC(uuH>fhK|3#x+W9ZtL4sL9;%(myZ6V=g*X^#4lV`8=p||@%esb;N zV}BfY6aKuTl9Tv9r-$=p%|5a!!T8)q+(cQ&)O}$Hi(~6dCan!`OlgeQ^8Y7Sa3kIi zwr*X#`JFOdPR%Jj@Z(RL9+#%{2$th?>`q-i7N_+1Xz1}ESZ}kyc(Liaz-F)Fk*F7K za_Kvmr7yjPs0XLM#Yy>d59M>QCVEOiJmbg1=$rWWxG_VXE6$^tQO_*au-?;JmgTUx ztI5MHtsalA9ut;VgSf zS~p8xLIX40o4)!N~ofn}~aeQ$6ox zvkxaZM*0GiF=x=Lei9|{$JfV>${=auMTfIoS)Wn`YI+8tjibBpJ1h5>gsI(OmT7dB z0LWrlgVWdkm;8O)-$0L+$TPg9B#f4i9KsZT{@r?EUe>atKgzD%Rj>IQ9b_Cmq99x6 zxf3#w)I>ThpOoh)nZ@D>c@y_>(1M4m zkE5AAZrnJ(Y`3MK01z;-@PQ4;9a( zGfwDiyea&LW#y>TeCV9+Eb6|^*ez?t**X3489c8QXZO0w0&fyB%Y>JUZpF^n3>5E- z?dUi2J=jBJ_Sw+C!9MtWRD`)bn_Hhpv-!ghZ;3vf#rSY7pN=hRqu%dR{+L^iGZU;` zi8C8>l1$!@HCeo?Ir)!I7E=w{X`C&J8$3a96^~BoOHxf=kiNaE*CG4 zZ>T+1Y7)KEg2n2r$0Qfbj#ZXT8`U$pH+H-s!e>XP zso&J@H=RyQ&}G(pDqCG-YhCYU#+ZW48SyNmbmQzN)ux+DebC}QD533EZXj41H z`+^^<&le@8X>Hq7ZsMCub-7{1RQaYsYKbP15j;NL)IxHQ$Y1rx`;b1DGxg;@UKzS4 zjoAEF$y9zu$q(l%n(|(|pD+%G zqj}Gsj#@2iC49AeeMKhEeU-hh9Id}??Z)=zna*%ZB+ z7wo$fIJA>qZD$oE#r6ile`A$5YpiVdd56j)8=&{q6aFuFFKFP&X4K=4>p$tT21|2-yI_6FwF-x z2D}k=l3*T*Teh(%lC}?S0_;5jYo5dUeij?>+9$f_~aO z+5utGp33qjH>3K6PIfW@qvZ4o@@QzTlhVHJREaV_3PQJ1z}FXCaJ5Nd8ZEgFukWE^ zeB8D-NNQPV{X31{_Jc-?vX<1&SaI3C8Dcrx7sbw`z#sEn6X5F`!XGol?6nqi9{qsX zo#8nJ%tEq%m!E?0Fjx{K#NJ=B6I0kx`+{0TBU?6wb+DdAu@$j*)drbKdq-?O+ckvo zICN=$oS1^VInJVGppOUh`2)nSeV>~bz1>ubnn-BDCQ@ycn&G6v#acTKh_sgAhz-03Xe$mRe zUj!)}U25_OzddCi#(LYMwRf&VN-a0;x9eZ?O2(CLdmep|Wo0zs7CS2k4m_T&96fgP zirO{gXr&v$SEc)V8@4tbc<}ygXPt5_NxnkG zH1??32XqPg)p*O+_ki_LQk9N8=ed$EZ3SpvX3CewefTAD-GZ%m2J6S=H{R@t-oNpO z_Y-Zq*zs7Wjq_Blc~%7zewlk?=$UlgARHIR0LR+9X>k-MrGqX9Y#f){{*cHN z{-0+H7{^upAJ@1|O0RVC396pZmpsxR$X%(TGYw$cS#?t6ZE zZZ~o+GT|eNZQD9DGK18ughnXx6PT9W$wq~x4v-cr}vO! zSPJ9B$D=&4;7iE|r?y_@%?H)qxyDduE37E)Ky-s;&SvBI>W$i6- z9?Yy-L<`s%fWTxKGotSO;a-@#g4nYK)Uf^ard- zZs>*GRgW9{I3=S83PgVQeXpJ^Ek_sqK5yCbsde5M$bSZtF9QyZC*t1Uv(;xh8+a%1 zhwZ8IlW@v9Wm{Rs2|i_%PrQv@crCth|9(O81osj7lhxRkbiqY2Z!}Qeh-|_yfyOUI zwMowpg=@%0#Pc6!t0%exm%<;vm2o)7az!qW7tKfdr!y9QchYOApK^)HvlsrXsZRag z_&W}3_frY|G}3u#0#1>%^F^>MWN#vGdO5?lom%?h=p4mE(ZT#5{*!Y`pT$!q?c6`k zQf4gaK1;5BxA5TWJR%TQS3*cu9HJ>p++eA#{l4<8JiML>0B)La=C;!5%=|KMLT2jt+6M6eN z;Rp{ZdbPC9n`F-m7`>KXy)PiKSf#xsJSg+pfcav8+S}pG=I;b8Gxk_ro2OtOe9v5c zrtj?j!_M*UJ9ursIy6u{dTw}q@B(~cFhZ>v`3d;=U+9niz@fJTG!NC6%_8}T*yRL_ zZs?CIv|Mk6#qin=$$Ws3j4LBNr?%f7_3v;rUx6;}C=T=~p7I`Tjjzon3|e9Je)760 z-kf&u8~2?%=j5lbiVNR&Hp8K{X_$1}J1z5m+NjwDDr9R-*zlQS=o;61J_-B=Y)=HC z^@{wFxtz(M1Ly`-rY`czfa=9|`=7Cwi_GxA8QevA_B<*g;h zmT8Mw=>cXQ-zej3`BhHLc^a}d^U?s(SLQAh!iO*^e5rAa(n;QL+ts89&H&!>wAA*~ zn+yhv$ov#e_{jB{@lhOS94XXr&TG<(Ha>61^kN(I@jkTY9Bdl}c*16+{g-+rY7zJV z>0(TlJKqbs#kHq#S=ts@bAF;$I;J*ha=(rGet<5M_i0Bw?Aj3XORlxX=WbF z2z*W+DOtq}wR&h(U;jcL14i|9Zevz`SqW-b%nYQ&+7X}7915E!PHg+F%8)OkoWHpr=^G_9|Hf$Z zJMkCeFY`D^8LKu9)fduP*Li68p7_d7gpKVre>2;DHh6s{wo{zZGui>nUQxf6r5flL zeSNMEJ5F`??ru3_TT)w3sezzk@uThi+9al#^3q3@qE_CODAbR$8irk zS|cIjM;*t5l}LXzN4Sm+KTnR;RAn^HiEQROa?Wqm6nQ*FX5A#4RbTkbc<=ax=6#y> z^L+wM0}zp*ooo$|&CZxFm)2%}$10C#pjU!dfe%e4XiS-u%8H)BVX-u;+UhOV@7xlMaN8i*j{5USN7kJux?+KBvGX|gtq!AQouL)j z&9l!}G_sVwDRrCjUhR@oOtnPmFr2u=d`B!XIaoE^5DJ*cJ)vC{Z1t|)n3_? z^ zJ=q!eyvbR4>_us^Smf_nA%X3T~V} z@2jFj+J=woym~NBKu0qtei&9*x3ynN{QF>q6-MxYoyI&GKa8~(PK1f;EX+r$V+nqC z%rC2T_=3#cXbQzT_{$zAMQ-pG)99-S^Jq*mlW_P|{Sgna@*7&D+K^bE+~xyaH;1bq zh|wPf>3CHALv{WjUHL_IUApmSX*smpW0g3sKXxxgccAr%tzB+S2bn~Yr!c9*6GfL@ z4fM~Y>AG6@hyK74Z6o!~ux$tybj^&gW4-45h0j5cSV8h7@DsE!Ew`noc!tJN#5P{&d2<`F zv_(-)3+V5)V!U3L)l!zoW=2?2eoJ*XmeMid`kQgU0rZMT3LPvJk-9Faw@JKZu z2Mj`y`fNnEF_;f#9?goNn-e#php=gQ9mLbF?Mj=P!vrl)9un*YJa%Cy1JE;-H)Qa1 zAp|;;x4LBKcTS4W%*R2?ME}zyiFj_wXDk%+Puw5nYG4BT0Vi5 xWAHS6mlhF7k?`liiekt9Q#yw7hq`as_2w**y}OC#K?W_qLP_H5SAyN{{2%@D#XSH3 diff --git a/source/Public/Get-AdminRoleUserLicense.ps1 b/source/Public/Get-AdminRoleUserLicense.ps1 index f292c1c..6c307ee 100644 --- a/source/Public/Get-AdminRoleUserLicense.ps1 +++ b/source/Public/Get-AdminRoleUserLicense.ps1 @@ -19,8 +19,6 @@ PSCustomObject Returns a custom object for each user with administrative roles that includes the following properties: RoleName, UserName, UserPrincipalName, UserId, HybridUser, and Licenses. .NOTES - Version: 1.0 - Author: Your Name Creation Date: 2024-04-15 Purpose/Change: Initial function development to support Microsoft 365 administrative role auditing. .LINK From a8c7da2b7df31fbc28c86f1583799f7e3439f1c0 Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Tue, 16 Apr 2024 13:33:19 -0500 Subject: [PATCH 13/15] fix: add project uri and icon to manifest. --- .vscode/settings.json | 5 ++ source/M365FoundationsCISReport.psd1 | 4 +- tests/Unit/Public/Get-Something.tests.ps1 | 91 ----------------------- 3 files changed, 7 insertions(+), 93 deletions(-) create mode 100644 .vscode/settings.json delete mode 100644 tests/Unit/Public/Get-Something.tests.ps1 diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 0000000..46b4e6a --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,5 @@ +{ + "cSpell.words": [ + "Msol" + ] +} \ No newline at end of file diff --git a/source/M365FoundationsCISReport.psd1 b/source/M365FoundationsCISReport.psd1 index 4c7bc06..1a9cfa2 100644 --- a/source/M365FoundationsCISReport.psd1 +++ b/source/M365FoundationsCISReport.psd1 @@ -102,10 +102,10 @@ PrivateData = @{ LicenseUri = 'https://creativecommons.org/licenses/by-nc-sa/4.0/deed.en' # A URL to the main website for this project. - # ProjectUri = '' + ProjectUri = 'https://github.com/CriticalSolutionsNetwork/M365FoundationsCISReport' # A URL to an icon representing this module. - # IconUri = '' + IconUri = 'https://csn-source.s3.us-east-2.amazonaws.com/CSN-Icon.png' # ReleaseNotes of this module ReleaseNotes = '' diff --git a/tests/Unit/Public/Get-Something.tests.ps1 b/tests/Unit/Public/Get-Something.tests.ps1 deleted file mode 100644 index 99c0c35..0000000 --- a/tests/Unit/Public/Get-Something.tests.ps1 +++ /dev/null @@ -1,91 +0,0 @@ -BeforeAll { - $script:dscModuleName = 'M365FoundationsCISReport' - - Import-Module -Name $script:dscModuleName -} - -AfterAll { - # Unload the module being tested so that it doesn't impact any other tests. - Get-Module -Name $script:dscModuleName -All | Remove-Module -Force -} - -Describe Get-Something { - BeforeAll { - Mock -CommandName Get-PrivateFunction -MockWith { - # This return the value passed to the Get-PrivateFunction parameter $PrivateData. - $PrivateData - } -ModuleName $dscModuleName - } - - Context 'When passing values using named parameters' { - It 'Should call the private function once' { - { Get-Something -Data 'value' } | Should -Not -Throw - - Should -Invoke -CommandName Get-PrivateFunction -Exactly -Times 1 -Scope It -ModuleName $dscModuleName - } - - It 'Should return a single object' { - $return = Get-Something -Data 'value' - - ($return | Measure-Object).Count | Should -Be 1 - } - - It 'Should return the correct string value' { - $return = Get-Something -Data 'value' - - $return | Should -Be 'value' - } - } - - Context 'When passing values over the pipeline' { - It 'Should call the private function two times' { - { 'value1', 'value2' | Get-Something } | Should -Not -Throw - - Should -Invoke -CommandName Get-PrivateFunction -Exactly -Times 2 -Scope It -ModuleName $dscModuleName - } - - It 'Should return an array with two items' { - $return = 'value1', 'value2' | Get-Something - - $return.Count | Should -Be 2 - } - - It 'Should return an array with the correct string values' { - $return = 'value1', 'value2' | Get-Something - - $return[0] | Should -Be 'value1' - $return[1] | Should -Be 'value2' - } - - It 'Should accept values from the pipeline by property name' { - $return = 'value1', 'value2' | ForEach-Object { - [PSCustomObject]@{ - Data = $_ - OtherProperty = 'other' - } - } | Get-Something - - $return[0] | Should -Be 'value1' - $return[1] | Should -Be 'value2' - } - } - - Context 'When passing WhatIf' { - It 'Should support the parameter WhatIf' { - (Get-Command -Name 'Get-Something').Parameters.ContainsKey('WhatIf') | Should -Be $true - } - - It 'Should not call the private function' { - { Get-Something -Data 'value' -WhatIf } | Should -Not -Throw - - Should -Invoke -CommandName Get-PrivateFunction -Exactly -Times 0 -Scope It -ModuleName $dscModuleName - } - - It 'Should return $null' { - $return = Get-Something -Data 'value' -WhatIf - - $return | Should -BeNullOrEmpty - } - } -} - From cee453a8eb51c3e0a85e05941691b0c0687995dd Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Mon, 29 Apr 2024 11:01:42 -0500 Subject: [PATCH 14/15] docs: Update Changelog and automation candidates --- CHANGELOG.md | 23 +++++++++++++++++++++++ helpers/Automation Candidates.md | 2 +- 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 520cdae..1270b29 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,29 @@ The format is based on and uses the types of changes according to [Keep a Change ## [Unreleased] +### Added + +- Automated and organized CSV testing and added test 1.1.1. +- Functions to merge tests into an Excel benchmark. +- Public function for merging tests. +- Testing for guest users under test 1.1.4. +- Error handling for `Get-AdminRoleUserLicense`. +- Project URI and icon added to manifest. + +### Fixed + +- Format for `TestDefinitions.csv`. +- Filename for `Test-AdministrativeAccountCompliance`. +- Error handling in test 1.1.1. +- Properties for skipping and including tests. + +### Docs + +- Updated comments for new functions. +- Updated help documentation. + +## [0.1.1] - 2024-04-02 + ### Fixed - Fixed Test-ModernAuthExchangeOnline Profile Level in object. diff --git a/helpers/Automation Candidates.md b/helpers/Automation Candidates.md index 1b3d262..7e6695d 100644 --- a/helpers/Automation Candidates.md +++ b/helpers/Automation Candidates.md @@ -37,7 +37,7 @@ $Report - Commands: ```powershell -$groups = Get-MgGroup | Where-Object { $_.GroupTypes -contains "DynamicMembership" } +$groups = Get-MgGroup | Where-Object { $_.GroupTypes -contains "DynamicMembership" } $groups | ft DisplayName,GroupTypes,MembershipRule ``` From 822e2f51a3e4cd6cc5849fe89124667a81cae9c1 Mon Sep 17 00:00:00 2001 From: DrIOS <58635327+DrIOSX@users.noreply.github.com> Date: Mon, 29 Apr 2024 11:03:41 -0500 Subject: [PATCH 15/15] docs: Update help documentation --- README.md | Bin 10176 -> 20738 bytes docs/index.html | Bin 30406 -> 61996 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/README.md b/README.md index fcddb5550c5cdc5d77b6e9013e12ec0cc92eaf89..6ec049da30a1b7e73d7752d987c5183679b4d37a 100644 GIT binary patch literal 20738 zcmeI4?Qc}a6~^atrTz~qh~%bX}_9pG#U9^R4~W3?nB9FLdhsS*VO~9@=DJ=(@d}P%+GX> zuEw8=YR}~TvHnQcpn!Rg_31sonOr&4+)%|nMrm1N>$%LE#q=PLSkZ4rGwYVtd!{`t z=KVq4j-KAr)z^9EuhLTbQZue;W@tLrXW=$awt2XuD}{fo!cNEO)*0s)HRAXBF*S># zp-T_xXEVqEMMITaLzRG{L_8|fe?K`I#YZgltSfU{%!35yJaWvv1l3` z;BL^cn`Mb+GUlb`X4lqt)38A{w&X}O-%8i?W4Xb>UF~H@-)q~ml=<^g&kN>dQp7d z(r=J=E!nzU%RB=MOPcQ>eO~eVakk_jZ>$xK-q7rj>$cW>tLOIgiM)#C{d1nLX?gqh z^j6Qm)v8!Sq_idJg7_0rTz2HUi@o;z^E2yazw)hSInh3sMGyAjK>Ik%ICzv-IPUR0 zJb6{rKh&z&Id~2|;BF(&2TePf>)_Nj5Hz-VT`-T{fj-6;z6DL@DmE*m$&*|9v1dJ* zJjX2in&H0INB&sNL(K<aZ|Dz7eGfeRQwZ4AT{P!UlUdgD zSoj9!us3*aydAP)9cF!@wXt7Z`(A(V=^JBz%6nrJo^bZh*wbyTbtwHf7N2J0`)yf) z@{HH??`2Ui78cM#G#ESDmWR;>da<)_Gh*jo2Tj-nd@wt~PqC*MWuI4UNN99F-@Gq8C9wfM6smTl)z%qD413v< zTC$*zHH|p9(ENV4@x9ikf@NDpTBz| z?v=qLDCirtCYpHaFTxPEg(xs)<$A;c_jIR3ei75x_yH-Pl4~oP2|gCPdMAI|$vYXP z8_IibC_-7(C%>;N<0K!f^M-4hrNoYK0EA+(N)|%gUHpvWL*gbldX#+&5qsF5vF0aU zM&G&GXOF_;&L(I0gH%lw)})KxRcR}J&UV50C4OH`f0bXluU+5M-y`vWt8j0+x1Lv@ z%8dNADW2M@U_}aDqbxCJHzf+P1)CN1VS$e`#(5TBfQ2pkV|#~Z?Tf64Vx3jiKE!i4 z6X}y#?L*Mn(4?@fXkG1<$HENwK(mUx`ebtB1IYy2I-3vwIY}?1Oni%eq5oI}u#eW( za%}p$(9r49wLQXfpK8uBU)b4@cXMuM=}`*;m9s<_@ST6*gRp;O#MWQ#*grm&K6P_A z+XF`cMDy7Gu!UpILj?6U+o9J&AQ>36pUMI+>F-0uZS&UQu8GolEkj?n<_HH`FFW zLnmi#TDz*Bhj`ee%_XKvM)eqzsXp?BdUo+ z(SwL2`bLr$GS>0HO5SVagU$r&`*$>-?QyaAF^U=L>N4>F5`C>a(fQ{Ox`LIVZW!0R z;)~4Z{mIq&a?i`h&sD_;_R4+IiJcSiQ8}PGwlmWcA4^W?A2|6GWd(Xlw7({+eEkfY zAB*3=9A4k}mDeB0rgw3D^H*M92(LG?*K_R@uU((XwmtA;$%Hzp{p01bH@5mecV8TN z+b>xvNV5L-YjwV^&QFW2himeiIl85$x1rdL>Lk_h$Z5%=BVMoTG0i%7UlqTuA=`3L z|KjY;6=UN3IHBm)iy4EYIj^Yqh-GPK1LyB;yLyU#gE%2??sfhg>SJ-Cj?0I4|1j5@ zIN>BVZ&rX;6$RI^{S%!Euj98zG@L;&*C=mxuqRY2c}l+e!XT~ zZKQI3*+j6v7dzOr!poYEQ!?x53e^_qO2Rkbs;~DT`mR1q|F}7aMd5Jl4oXanr;m~hhfyNX04&(ibkl-`*c13QK zuH-Rg*5)(KI>HrIp1#%-%r;bWVMZz>SF&|1b>H=@-PXhXY@divr`g@2wPEvEy;+Zm z`jl%j?aB>YD7iy3zq3|Oi};9by4@JX8@x+D*r$mWc2)8>*K5$b=_s)OkItKBK8*zF z541H!md;7h%KvWa?=Qsl1ywwK<+}c!U%E)m z{U`2I54?n=n_9Z16^Y!6-|kjn3Wear_3A?7bbbA5MhtwWnFFEtwmOphqiFo}Fw&On zLq+xUc}?R4IS_s|I;iR28Ow&+U*Ow$ljO=EFY!H$w}&Ch-qbl1aUuK--%;W)GA`(h z&lSx~WsPVK85P@Kq-Q+U@&kFUh~SalXbz$|*HVb915@Pqv9mI_t5eidczQ*Bao_7R zdaMfiBJLRO6a7wflsAXI*AA%eIco2V<(gfg))0E)p`J*Uh;>i&w7W|mXy(#gI)5iA zU7=U?F2&D-+PVwWos+x)=_nMeQoYzyu7uq%TJMN&bXS6`kXm04Xw3FX949W@P5+*t z&Zns0fxHA>@94*Vj^Ab7f|P=@J{*<1?K3*w?V+#!Nc2N@6ZiE>(NF9*q@c^_Z0>QM zzS7{pZ2WY`Nug*x)B7sd3cCHIbfoU-DROaPm@Qu0fc~N)aooVXDwIyuVZ!V6zO&f4NM~4vC_U3Jj!Bw)8ey;fc z_=tBhyB!j>6k>*tg~vW?ILx+KE$cO zd_KDyzYd)V)bG}oGXNtcB+`d6YCzTv>_^z!sN9lq#?xIy)i}c5W25=qK20BftCy#k zW%}8{kc`9cho^6!3#^JBG7VPnKJ2MtM+?epc=rvDa#BTw3mV<5b{n4{oX!|mLtMd% z>;ydst8Crz*%4LvH9ZrYg_dSE?RmnU^KSF&98VU`*On?W8{2;8WbBR}LF)0f7Mf~K zT**nu%!0zuDWYPovMT2Tyot#bc39h0D(Sq}hhDLx%`>0fMMdq)nY($?6ZPkMPr<{m z_jj~DG;l`FJ-=BG3QX;$<|M1)|F(!Iy4GFhE^p4h`y0LU=`0*7yIU6};ElXH{M-{= zIaEHsbC&-s=`ZZikCWVcI6h&X;Lk(N>$uz*d(-dstr%9lWcu)}#LV|K-?4nEvzQo- z9gR+qg)?s(bD%At&In%U-4$cV(F&#)dUnC6uBRxuSMfE?EUWLCuD?IeiuBbeXMMl; zGueya-1gbdMv2>01ePGHp^zt1@{ zj%|{(&`Z0wRjWF-XU@x<*XMX$ob3MP)mvMdSQgqEcQ_cHtIXzwII(e=s7_~nT^#F3 z8Hei+6Ya#AovC~{QAr|Fen;TuNIDe@YXmkBBW0pVD)SpBq>1TqtX+}oQCZ+6&{DZ5 zCQ2OU3RI`KuxSe7;-K(vfs@{;HFR6$k(NnsIFY$JNc4>oFZ(aVz!WMs%(6@>{`!LX zOO-TkuhZ#?jSXzli{`s*Z0w1D*;1tPP8eH=(kbR6mDmkb#MtJdeqCf`o>`|{pZBU+ zpnV2oafhvPmFn9~QRJYB)#;|d7Nb%pkTZiiNX%;cOu`UD?94T=PO`A=D=TjXkA+fKy5rySV z1C338U?$cP?V!gZnn-i4oWPlrB(dsuI&UH4xWxHaoW-h;I&s)MQ7{BC)eeL&p7?yP zo=u7(b9-A`kco|!f1ev|O=mWn^&{<6ROY(4V>0;JtL^(axyL(I^bX=wn{%6}k51*s!C%(# zaCm2I=CtdaE1a;JLX|MPyi%R_kQ@u0XN&eBXYr09qX@oP;8|`{aiXK#Iy)`|oEA!! ze01+}nN7sO*`N<*m|!7qJD)#)&d5<6Icle~ibrwL8{X)Q_c*l1sEESAmAH6K&S%Y; z%wd91n%lqX&>!r}Was_sQi(6vt%tiy{^7}MV@LV^5{6%I@e?e>-vi-hx`-wstC)wLWU(n` z6J>-`xN?x$dlNh_2u-d~YuIZQ4j>a4TYM*!E95BA&}SS14dNP(5{|$pH4b!5e6$(#UIUrEWR)CCObM z!j5GEhpYd8>wohZv5H*>%0wJgeU5#RG!*(W9D}fX z4-vs^`koi#Y>P5S=$0bl+hJ2yiIO-3wssO<$hK{JqoV|vwxwBV8m7ZieJ=aAzCemyz!_I?c5X<7vj}VN6wTL*fC{&8b zA;-I@Qx=XLe(r2ia;0TdF|+wi{~COi zqrSFVt4gu0^;HH?XDY;%r{A8l+rUiijp`9|!;lCM$cEXE=Go1^MPZ=Imfq4i4%AVV z@|H4Fom)e$1EX1;vQ`lmy${MrQ*g@tm?z@(5JqpV_eJlGO{F%RjpjEma2M_#k{dFc z|NTb8Y&rDPtyAmE-NT8BZs^AEIP$@muCQ>d^Awj$Q{t0xd2~!6WiAYnKFjS`Cu;G* zuOZRENA2DkZoMTt?q=*90(vI#g8a zKvM{l7@=qKZ3OS$N)2-jE^7!HT5B%)3g;-hDeZ`a6B778-X{K!cb<^{knJAId7VmH zd;^4WLFuUZ>n;MlTGeAA`w##{rnF2uRl8L6mUBWok0-SAU4(WYPiXf$2(?30i)L-N zL75Tyh-O^o4l!sKT4ng&F>GCOr8 z`$&!e$_7T3!Alh%LXHVDQ@1Gosc~6$j`#U$mD7*pDxwm69wxI~IRJAU%JTpt1=#sP z8uE2~&B9D0p)_*JIKU?jOAG~ny(Sv3TtnTFu5?12q+g)C;Dy7C30F5vsH0mE08^W@izYHp?5)Pc84TYOH4yMf>>8W5kZYQ-)L=F6 zjC${H;?*9Wco68c%2pTJ@3pyP7-9gP?lJ7uC-q^Hq)pL>%GX-W`5NL5y&9f`Vqop) z6<%u=DPrw-dyT=MGnLbLWd*=MCU^8I6fAUhs935hCgiJmozTE|@1YUjK(KzILgrP- z_C4X@?}WXCQirV*>7`gv?=%s)-33JMC(5&!+(mc0zun*MZi?;>F1EWX1f5N&67_kV z#9djT@OJFCykF}qUoOc08>`U=S11087``0jdU9j$oDKIyoB9`VbW7lI@6b(Q{t`&} zT9dtgaD|oIu0vP^VEZyE1}G*XX`&=TLvnD zMMgaY$D`XwB?l&kIsxp<3Ssn9IC^OU^ils8Izy)^(OwlZg}D$aSYFB6U}e?H;h$Aw zmfT^qi=|bcN8|)Sxfl(p;%kWJ3Jw8|F=aaXs|o|z$KBtnO$pI#J%MZsZOLSQ}o8wZ)cbTusloDe^@uA9i4i8TCU+W|77<>}n)Mt?>C-1fHQmRCm=J z7Uk|#E1ns%gL$gl9^5JVf(Qa>f-`W^ZphH7n9V`|So01SFO*U_>XzcpfY zDCO_f_Dx|MgU+5fG7eb+1i~PzJ4h+zuq$>OpYg!K3e>tV5y}>2M&5{10d&$61C$*^ zlM85k!xPiPk&JHWHE`aDo+E`Ug;t|9Y=9VjyD<8uHFQEWH^s*d_z(qVns^gUtV2&1 z+K#y%uoTWxRQ(E7zn&6tNap^AqWB39$9Ww4!P?|TBM@`se^9Nv;y6Vem&F=+*=1ob z6$PgLZQ^c`lv@ErtPv~tGD;PA6uh-wNY>4{ymLZc7}5`a*wL+?by3+tL*1H4mp-Z@ z^>*i*ck65ujtR>{Hk$iJ?c*(@pwBm&W#QtW_Ba1NQA1($b2a0K!9IyKKA0i#8&Whs bF$muNuyDZ@(~p_ZuF%sH4QN;F{=D-)dsN|z diff --git a/docs/index.html b/docs/index.html index d663cacdd84238a9e7914ddef08f0d8f75fe1eed..70af9501891a2fb5adafa1523b004270f5f2e1e0 100644 GIT binary patch literal 61996 zcmeI5d3O{?miF^s&pGoQ%5uLW=tdG4&$OEcJT%7LoYxBj^eo5i@c~H)%pyjT7haFQ z`aARd;?X6R%q(Rg(SW*69Vx3aW4UqT?r|gXfBygF?)~o5?yK&4ceneG?pAlBn{^Mn zgYIefq`TVvefM`ACD!!u_j}#A*vwhqhB)WYR%zk8vlyWMkr zd!#?N#WOy4)dzQH-KNTHsrIb_|{pE2kzCusHs*PbAJuKpgSerot{b`R9U3qAS1 zTUCvjAbQk2PU8SOGu7VijRfc)rZQV9v#GjI_3N4LfFKU;1>W~lYfn@f+&oKg?5WhVmtzflmsjSo{LS~P`djb*qW1Si4ZyaZzF*M&H9^T7 zeV?HEQau6ntc!172^asN65k7=FN%^w{j~j-WsK9KF*FmVpp!=$C)D#)kb*C05bW&= zj#S1%eYLf%(LCyY(3QDhCcyp!-D7mnd;N*gTo%>CL1Q$_^P{;I4iA10{)eie ztDWvjx1t`N>A%aoCk}^_@2Tgw!#$|@Ai;Z8v~aQer|uuS&(aJ)otet_C2wwace>kZ z@DgA?B z-_|SzJS(Y9Xb8&UKc$$(Eq#BeUtpbDo4T$QPoOns8C*P44^Q-z+2I>~T^NN2%pVAX zHI@4>!4Eyq>%Z&HpSx@Ne_hyu;*HDusl{PPZ%US5Q9D~n4&|A9FY$q~htzr|xrNM! z4j-i60*ZY}&JBGw)yA{#JB?vo-=C!U+)`PngIe4LD(LJx{r#kGw0vJRHZ;q~T4dZ$ z-Jf)KM}6^>E12C=nTu-Uy#7AcH>C4{>VPZiBjp&idwQB6rpJAK7&-T!B)H3ZP$zU? z+)Sm6cMTt(YK#wrS!DBp@b~Ux=ipFInljczL%aGMXs!=5)AvOArWPm$t#3Nm7%2C8 zu>t>NDP#+2Ci=cBx%auG-Yn7WBh5(G&9^mMNP1+-mf(k@W|D(9ME8_OzlZb*%~G}q zoo}l}OC#$fYklsa!H|Q<4Y&$vMwu+x&GUx!Ydyz?fo=@LO!m_^g)~P}mO2Fp_k?fc zQ7a*K^$h9oG;z7*MV1O#7Elk%@*hm4V+X$T&Fn?VxLTw1xqf)=qgIWnxI2BE*i%Q1WeP1u&nE%Tr9|&& z>)~09zK{>-C1%AE9xnl({_zN|j|(08{V1pw!PZHQB#+CsLwFU|skYvD5|Sr$?d4=m zZV7w76Yvll!e+tO1iRQgSVM4uJsda?`L&j`EdJY8vIVlGINSn~AB_x_>RQovT(NcB z1{TpnN&dw>ZI79ne2dnAF?xw>`8@8O+*oKaMl*y{{N^V~(_KtBN7fLH+S31ziaYzd zx0Y;f%cC_}1N*vzRtpl`2Z{SWJlqgtCcqS69Eca`=C`Z4=)_G%feBNHx*=FJh5 zDUeKs#?lqr0@|J0vRl6|dbRe#dW6G>WWg2X6MNw$&(z~b`|aq%h$-t>(LK#!`6PI) z)HrQv>^maJj@FDx{IEq@{k6#0J$@uDR&qd*m;q$|?L%6mTHq;jO(~ySSrYtkdE5LUY&j9j+#>d{vRV#p=A-5jqaPsnL1u z<%X;zxa5gOMI`FFX6^^A!C+(DOXFLt#_;HdxTL*DP55S-{HJtC)>xa~5I38j)-id?dP8HL!gIy8t;=dM*%mQsH6l|=fNv8J%lGB3VWInKljMM zCgaTX61oLj2k4?V=)_qL%sn#z4zP;A`{UH7@ow5gUr~ZFA~Fd1XZ4)ga1{4fVcS^++6=nAhsz=r1Q4Fr}5AJCqCs zKTOeT;=Zq9?aj0TwkGU97R5Z5ED9-hJ@IBp6w8@!gqyFse-K_+i=xC+ec<6+qB?3q zZ?^0ARct$1-uj>spSwU@twH^=H0Jl6G836t!`hCV-|p|KY;P=xHuG?5{o}!VTYWp@ z$TaZDWVomF3r21wPDi?--;gW#PmT_p;6^zLS%jW$Wa-RF;11HlT66f``{Mlrf%}MiR*F4GO`e8rxXM*Qp(FAYy?V%`9KWQZmUcBv} ztOcM>`tXxivB0AjY*$uX;5z5xMie?C$J{L?K)zpRbR&JgQ!ClO4WG){|K=DZ%=1J2 z7IGu=1~vgJTV!Z5zVOWh+C{I9GNT>PrC3EsFXxCm6F;Cr58(f0*!tr^#w{8P@HpH% zBg)acpo_eYP*P1z6Y%sfwa`kYkgwD}S<(D|T{J=@Ci-9oy^eW&DjA{zWFS%WdH%66 zV7$gW-;%#{U2vjV@PWQ6XcNq0!yV}Po~Qvl5yvNb9pzci%G8`A4`?lG8tV}2m57W? zkE}3O#~ZNlunCB0I4Tx+AliYHeEuwtz+Ia6d_Uf5AZjZTVB>KF5nRV|Qp-=V}A-9m-;PWK(!T79X zDKrnl(3`+_T~q_l$Yy<08_N|<^L zT0NeBpEU?;UC0YtxyRQb?fA0Rn?g-*n#)UCZe>)dw;eOWw%8HX-_S0kYx0I}X|4B$ zXzfDc&AJS&z23MXm`7hkOs~Xz342iHUGbJJJ^YSL1M}A&rgBB-OKaPs))mklrACQ; zt*!TItvJp51cK0`p<|H_W%L6N5IKQfozJ%=2J4w^XaB=DGW+ainHDoXU33y2y{%NF zF*$cwk=~(PQcO)vp%aF5K#scG?jgFs?#q&%Y|jN{)osTrp!o}3WxY5*0@BLPsXC!8 z*S1qig7#Tk_o&~T(WB4-Q+JeWu6PyfJfizj60fui;U*qs#IzS{}+mT1|K} z9pt>JRcRjY=FR(Pp&aZwN7f&s6Ed4x{h-O&XtbG1LmyvGc`>Xp`V9OO8ygzeH& zBRvc~8^7<;IinKKVzDf@S_-a+DsrawUq9n#QTW4u{BTfm5r->Vv=!&I0!vD`)hCaH z_miV0LmD-_D%KoW1tD(#?4^Ge)>p*;N@-a~EK8`SWFs<5Im(ECL5#$iB~O#obu7qv zBxq@`i(orC^8-(Ge9WvyP=fe7BSJbjwn{cSHCY8AazhDpM!hP-$XV}mE=t6IjPJng zBehF3$nn=7QX5D-EL_G%zx1)AJG7pqW{%kaBQn=*Q76SO8d;0uwaXBAv&3xQW8r)hK%cP7t3~Q~gHG4T1*ZID0mz=Xk z`dhFuB4)mv#Y~ZSS>;O7qFz>%Z@snb$4$!y=*Lvc$mudW9BeGJ!C-iYN-vzlfs{jijbmF8lGy$oq5dvTYsK%>H_r%1FGtU*TQIQ?98hI5S`Ud@MV8 znv@3*^_~bU$~Mw<`l)@Z7`4xpAQ!Tw{>3BQOTIYyodIu#FUqLm>E(wz&FT{?G9mkK zD3VdeM$af~?PB5)@|$lcC-bbXvHLn|4gj zN97mg`JdJ(*2&3oJRC>0ma^O@QgQO<(1{d8g5NGGpSL=9dTD>ihp(-gP0=*g%4Ujs z`E0Rr{n_>n``Bx{$G>w#p!V&rsXcaM;l0y>eRXm($u1@9*O{pEdM5V94i7wh&Qe?2 zP2;@wW_*GvE8k1rn!;P`pUgf5ku&^z&Z~^*)snxC);Omv<~5elb9#Ado~;&~Q18Yd z&dZ($w1v-Ov6teLcCgl1yN(?iIiEWASB~!lj{PR=d)P}>j!%hN>Y;Hx^rmgT%rQeb z^h>^pvy!|%Qu7V_+1gzPr6!uU;@R>D9LL$paE?zULks5Jm`fgddwJ+f$~q!UUxL4h|pus@6)Sa%OIxa*h+R%d;d zDVcQr=={7Mh~Ve*PT>VwE$!SmDI#+ZB?3Zfcnu(U3+s67l#D4928|p|TeXd{JRg*| zfI>a^8=S!Kwx18WCJ3Qwufvw!QmoDP&r_LyP6&Jw(uvmpD7xg_7EbzgF6sTWVij~+ zo>1!ZUCI*_pzCYGCo9D0>>Tr0OQ%0POMCP=Z-E{-+l9PVPToV4z#-T4`;pFbz)So{ zt6t}IMIt+z!j6kNBbM{O^2vwmiSNtt1axJ8@gAnYS;S6#w#`$u=ri!zQ}t_nI|n!F zIuqCDZuu-5Vn05`k>8OGoL3t2_{jm}UL2Enq;`D9S6~5*M^-S=Ua-ho zCFk83qg>-$9M7oF_HuM8=5=4Coaqn#=V6r7!5Ew0GDYmUuF<~Rimb6%B|k`K!wsG9 z6{p@pQ-LGSm_ecrEjDlKE+?Row`M%V z`~kBluAn*FUN+D7uy88Gb+IExL|`lqdGgm)^Bx5Bi>Ztu2eGwc2vo z23ekYOU^v<5!n@9M4aGLTW*0x-Ybk$gr;|-Y1&gyPv*?qMQzuk&tzDUOli*=WDKkv zA??H}b$&l2v58 ztZ#AWGZ-_6+)DDm(jcF2*77uxAS}-;+e4PJ1EkJM4+-tubl@rT*OAxRPOLLjEV1XU zJ|Ii_C&Jlg9P>5Gk+@}Q-<8gEb%|nFhiK2zr9M(Ob3OlUWp;NGIa>guk zy`v9N-oO6I;)_9l^ts~E9`6Hy*B*8MPvb&g**ZhV5n+O7h=JLg;D5$j)?ZosQLoi* z`DuF=0q@o%zWMyH*IFBwJ;gf*hz$Tw`>w(=UQ(Y`9wVJL?~X{~DMf6Qd?KV0^1jAT z&M;@xwcTrvyBtC2`izZXT=iq`lneWrxtgWOHfR0BndNbk12J0SDK$>BeN)2I$LP?B z4|(iZ&wOZjHt$+3yJSj!vo&yf@<1H>d;9UBa2yD^g5s3 z>NS%gS{#Z9XU+gW?YkyIJM(^F=&@|oSzFnwY;BPIBdhBM#$Gsinum^tDmWsdYG$^Jj7e(B+sbRN`)Phnr~rmoH~I>|B87nmd;)p?5+XULur5;=3otMgWHQgCZzE4@(rsk7*_*5l2L*oysV;tXZ|Z@9-f5#iqi_2>JwCE4ytp}f7W z)3iTpu}G`A)$66uL|*F*swi_IGtEq;6-UV)DvOKVBg@@c#`IT;e0(Phq;qj-i#jengxiEW_w| zo=%ugW%$fT(^suC$`y)v>m!kS9x`RoYe>TJ-q$oEj;(Zr&@8%@90sC1k!^{ML?6W9Y*%e- zb-7$CV^`Nrl?Z+Us#ueDPG_tw&<1PRyiYgUW!CFe+`Jl26v3;fl;N#1oG?{#jNvb1 z=K*V2UO?b?cXMXqBaOj#yf&LH#U~o!zCQi2-4$iJpT1P^eS2T@QtQju>r?t~f!FXD zKNUW}{7k39@XXm`NCCrrS8bB9^f*yzKN~P>nLhsq4@|uVm)c<B|LWtr^BmOzL@} zs^eQU@3wpkYcnKUIdi3r;1xSo)^?=xU(Y_C#cUk1ZZi$v(wrh`$iIzv$X|44xBH8z zHZrHy^$kn?r<56*p zAISaNOL^0I=Ol8E8dqP!v&>45buELE`GW~DRd_!r()?;OlJ|D2qN zoPWNaatG0`--~wERc}}N>NZ_ z96m^6`Bo5+lNnk1@9Nl)45vM_y_J4_Z=ioC(|7Gb?TZRFMFIWYj`tLGA(Im-#V>Kr zJA0<^gs_f?dw^}1^G<^MdbXiE_xne|MfwlZ@70p?C@ut+Oa2XfGxkP9&M{L{ta;`do9;> zLIh*==@D(I{@92_!F9y6;kp&Ubs)Ibx{vk!&5zs`7?R2zbCwfx~DAXzr*lpN|wH zVn+k>`9ObMu}!x}VKH9EAz4o_5`(}NIjgpRe%XJ(F?#9Q(@UiO9Q}%)D9=%T- z-GM9}!&~%I*DdiDa|gX~KdAGJEHYLjX@9lCq1!Yj1NV%SNMqg4aiH?Plk38zcZ>ARF zJ)_VCk!N(b;fY^ZEXZJVICB8rZ3~olp`(yzrlUO0Jkq1&qQ@8QST2r1pYJpGv!r_& z1$Y9ovj0}DWGMn2z+H@q`NZpl219z9%F4FDTF?`<$}x>`Q|W~p+APohqzv;L@>|IE z+|~b^itsotmSq$54JT#%u6ov}k?(g@54n#_{<-_*@FWYLXaTI{2q{M-#3QsUWQ4W; zc`w;=>}){d_WklRvPfAAJm0HFi#hisXE|hEcux@4y&Y{ottaZFHD|5wYejQa{W$J# zI$hO?lb+S#USGAB9rfw6==Rj-@%u1swi-Xv7c;gh-xN-R8h+^#A8)`xdb)rjRPsW$TL2fb7t6<_*W|V2bE!! zjdIWx-bzZicT-GR$EkMM=shdcXr7#e9NxneJ!?2 zoY6DV0nA=fzm8q)>lc0fgFf`UE-ryPnX8#R65_JNBF0KwP9=VqPF6fS5n@9=L>(=> z$hs$j7`YI;*VYBQ_iti%Kv(!1wmpI0*o}Kx9t6JTU#CEoahGX-eycN4(!9Amn$E^( zDMuuSXlXhXO&K@wAvomdQRnd>?aN<8E=r%VUVXgWy)T{38gt+0UQ_S39oIwwSyI&g z6mfQQHf!J5%wFFnPR@Fjr3+R;SkS~u85Q<(UWu_SSJuXMU=1kNYJszbetcvb-LKVp zO#|GSK2CD`@Vkkk{8lv?=ZCs;LEO2f>qY&)nE0^YOaBi1@mx|UN4j%sti&)*q$T@~ z*vaqn!;q&#qrj@o<*}%8`G1yuj<3Xw+17eG*ha(~FNs2kB$16rlnLFjFG!(2Y<;BI zfl3U)(H|$eC7(YEEexGk`h_f&yLtwN<%-{tRG2HU8}Vpp{;5V)&u=-q8w*fyM7xLjZz0;KV0>S+$h_s#7|w_)&^N5o zKG2hSw#1cz+V^GkZKf95mdSjf^>Z2-J=As}{c(pZ2Xb4mR5!F1j=%hCeg9hDf0T#! zP4}CmSAVVFzo^8H+G~4qFNUJ-<-Xe4R2%=T&x$@s&|iA>k!U5P;TdeoUu)aDqS4SA z5(1024+~?B7Ph3-!`42hUan}YtQF+7u6^}^?y+TeS5$+?2bCQNCdLGQuZVK6qTA=g zy@OjkGjL0cYD;ZgQ@?)CY4|kQ%8|1gkpSia*%B7%w)zKSp2J`CEk^c0_jan$Jxrr3 zeT#D%4I@62DBzspyH~^!ElwF75QkR5$G~gB5`i{eh;IVhj)Q)#ClO=0B)LsLwT1eA znj5d|qHF%IYS7L~VKc6%9tQRh^&Q3L3>0+7RpEmuo-^)#NjZ!8S*+Axt(P!y zf*V-GN*(6mSBgS=3aF`N+mvw^|>Fn^a_FImB6|At94h=jJHaNKoXjv~D z!VhDeRqq?vAH@>%9GJhM)}ad`ck^c`*TG&6KPgi~v{-syLzqWm5}Aa;ujmhtf!%$K zu9SwXa1z_Rt?N$8Bytqu>%<*jcmJt6zmlx{P4|gp<6k7@kZ#{-Ea&vMqd#N^QV-uc z_|`JW97&wQT!$r!EW48CzviY-)WU!24=m9(Tt5uk1HpoX8`Z~$$`EHUq3{>-6NLi;i9;DNFn zG7uLqBK#BACAOjI&Xv`j!q?76PYwUh+-l|m zw8bozelA5ilZlwm#4J6RSw4|*Ec_%C**sy032OSUd>9Dt#VmiA2Hq^+5$-e%=dpb1 zPoGDGx zSd5CukKH`*W7*%anwb>E%$5J1M`wNKAMP)E?mo~B5Qnj}+B`hy%Wy2Y9zhUC$*GuR za@2RIfxO%41YzTG)lZ6&mBxk+;`NsiIg~7C4RCB7Nm-uHxKXdWNs$oj+Y;XV9ip~KebzW;{lx9_R|x#m-&RH4WH&iscAkt^SrNn5&N(<~$0e0on|J3HvM`yW-n#zMEaN zEErcpVn!6CaqQ2aBrAMcU_no-VHudf3gs+UgQl+v9{RPizj?gS!xHA+sF7}x77Go9 zQ9g@(P|Gk*gVPG!4FF*(>O)=$5CQf24yYTjJW2k+ZK%qQ)|I_s8eS@^r58qLB8dGw z?>nU0{0QcgJBsH~sI-^$Jp*@|FVs2xcZ(Vr^d>uN6)$?-f#9KHrAeY5sXjrtp$nK^ zRtXS=8;{*xDB{?ihVDK7kx$+G{No~bckTjmYTNv0SGOpCp;WyaB^87g4xv(1P?st6 zx`VgTnC*+DHdeI)swCE2Q5L0#bMQ|hipv=qRu53ZYC?4HMLHgnnE;cZ} z=Cz-V$$YU1oFqh9td5crHTld>Om}(arb&G1434=EP!2x6LA?lsXN;a93Jx-?fx-l)#XNew*@bqLDgc7wW>12`A z0>(kyTAbP>SSbon1WJGdqGUEN%rx+K;zbafBcc%Yne?*&b~Fk(no`s&2g?XQkdrh9 zef6D3Q4BN3^E^j%RMQ|Z#d$S`P{Zp%?p1_lP={ec7376dWp@9M@wS8*BC4wEGK#BO zZdAxAsKM8^>lZ)D!rcp@2%dv~e#vF_7)EoF!_Zy#1?E45MjROoyM1wgR?{GvE*wu8ta8u(DKr&t*0m1m#%IMuw|cX|b6LQWK7%bi2a$n}naZ$Cr6n~; zFBf1g;S(i-nBgX%)u;r2_A_MdQDO9zu+GNm5uzjrm3G`f?Pf~&9oq%SJ#)%9Up;p83 z<1`ubDx1KJGBxfHE7~Yl!!|hZl=q{A32T0IG=dCZln{5oP-RSEMLCNjKM5pOgEBZ} zxWTS-fKyDc53T^Tx)6L z#63EVW=sP6iaJ0jFU84LTs+u^cO^}p`59afkmvcfH$~Mq&OrE{)UybZ$$j+$8(LBatLU`LLW7#ePF6YuTb`VRo*U6*bWE1 zBpqghRYch9@F%p&E>s)g>wlxk4M?7{u~dE% z62qW!F@={Zf)iB0uSar~UcsbiX}JI!`kML)6j>8VCP_)0RtfUl$s4aMkP7SlX7Lm(_-nA-CVvYBc?aUWxXl@Uw} zA#z9)TKTv3E2qO(N`;aFf}Mi>QI;U>d@Gt+b1QW7S`ny#qK_2T$P_@dW(k z)DkV-xv{dFbgf=T7pShxv~tvS*;`=*+(zQ|=Xn9ve+y)!TtQ)A6E>>R3ptI7+|sb< zUJv)#(f&M#r{-tI<84?<^DF@=i-2DXHE=ctqz{&41B%@Dwzem8Nf{n&2Vm16p2KU; z_#a_Cl%5kmks%EJNjJ=Ev2m!>}!Wx*TRvNJZPsTzZ{A zL#pE(&I}95OKQ2U)S;hOQG$85RGV#3jATPSs*l;#jI8Ye-dAW0#M2ap(Ch6Iu5S;+ zc7@c;i+xBowj{BtkX<2YZ_3@i=kDC+fjygNvox2T{RuWk@cmG2LsSMRb}3|>&dB~E zb}>%r$`&PC*Rtx&Jj2VW>_Xt*Mz?w}_*?u-_}qYT;)#O`pLU!!F-5&+G+o2@J5IE= z-k6QmTD=E52R8NK;2(QWo;^MgJLEv)H*ag>X^YKnn-IgBkW!5u+b?FpLYDuk86Z9c zn=ab<#;m8kOQRXVdMh;JoOK+@2yNnuJOF$C2s|*W`yhYNtpKJKtP`)=Ssd^sA zF8lo(^heZthuJrRXc=){c*(mou z;mC<#g5_yECvli3vN%t(Q*VqppAWq#?X27W?X2}dHL#*#-)ZBwAvTsz8-w@S-RoRG zgn{b6)sCR*JMe6Cu=Qa7B!Ni|nstt^KgU6{u65FYwu45MBeNsdemSLL*zTySBbl5< zkh_aM19I~mLzu1YFJbnV(UF1WDgfG@g?)2^7gz3sx>9cd&X;;Sav$^&w4b4Gk-tIjk*& zqgY-SHoM?X6hoN=lc}Gb+BV%LQNmK)CKLNNTcaPk*JSP7y2moXcJLlK@P5f+LEe%h zXwYO#J`&+ROsCkuB9n6Q(+R%8B->Yl9gY_D{4jztWak{cdYY=xnSJtl(To3uLO2}J zFH{^w*%Uw5dT4InelKtzJSO99VLSxVvn-_;nsuK)*6|*yMaAKdJ2c3TeiU~0xO#?;C_o2Y2+T^ zWzZ_@ryLLOs~C22&<|?m)cq3RaVV#EjbAOs5jW`sBQ1P&A!LmlwE-2jk(4i z*ne!^;C-iMfrxq8(0sf@v-kM!pEi4XJ@P5dTeal4!CAvejMCjeCkM<{3brrJwjD3%h{@GaliKJy!)`tB!->fH|w)w`c4s_RRz8^n60xwS|Mu(M>Z zcA?T!BV+KF)v(s$dqE&)5INA+ewO){WOmgni)20>Vi)QIl0kn|LoY9sKe$~Q13x65c_+Qi z6Hqt$?r=Uct z3UNXc5U^-3H-6K4pu-ZX{#p@~t~&mrvs1uXU&ehb#944ar7M1<^XTNYM0_3DfhqzM z;UoKeI3pK(1>z2HKoOP%;sz3WEwg}3Y-eUF{%SvJ>5-J zjRJ0IS>IQar z3IL>VH$GlOfh`y&5@x_SqLJq0de`BFrj1AF3rB^Jc|)D3LMS1hFlw_q7KhBMkSPjO zJ>#_}qG7x=8-qjDDXh-$(oF(4_d7rfl6_!!Qe`=D#dA5vfh<5khmmMT{$57DAds(W z|NQ*i3nD|=+&muLDo&=({Ga1gt+Pn$gs51Is;P2~;1DX#!nqum>g7b&95hJjCY)Nd z4WAuHQT;{xh@FG`C}w-bh4XmFSrZuhtcut&6Kn;C5osRW*IsQpGzZ7Fadm5lM(Ivn zA8rLHXe$I(7YhNun}c3&5Rs+36k*6KgJ&zGL1B@pc<+(YT8rJB>F+(D{V6N0gg|(6rWN#vO1#ANTMEv~zDG&c5VHQkp+U z@a~P_@b(ImkiGBE zV7}-LL`9CqC_$_-4zzOAB%d%O7M9#MZ#PcKLFtSAqhAFlhT0J1xNPTb5cQwqs|jTS z2cOD7^PIxDttjg+eopw5;;(S^!dR)4u8yvT(C_T)2<#&hf&ElPV6Tn4wxX+%My4@% zAAS6%LaNss?*DTls@F8W7*I{cCX}r0|G;&KKJl^TUYtuDpM*c3(-AN~u@tM=iyzHq zeSC=obf{|f{V9imps;$Jpfm^SRG7XFy&A36oa_B*3kkI4ut91+*~-s5s}HSgl2iV9!hl{ zkd!p*w1t5{&6o@W8-(ENk6C;ak>2Y_>BMEMkV1NCMQXAJLs+&UPKxwi@g2%+O--^R zeqmxqK&@UBlNz_BJmZg@iM;KsWC(hFIo z5!TESYamP~xq&L>Z(K!XSQhz`KB4*2BK?ME%4VHX+iRX7J#Wp0wmSIeR>f(50Zyt^ z>J3iL@5n>yMoVA#BctZy`kTQmqRp1ygR;J|oLY8032dn`C*j8bLf z9mWv^Jz4wqD3r{$$5$6y&My~wRh?4DCi=B5`t+I3KQ_2dmMz)A* zVJjRmFJ2Vs3rSYFcM<0o@U_+~Q{fQmk5p=Qa?;YewyMbH1-WQ%KUs9SG|aaKC=XQ8 zs5)tw|g1#MeuFq{6;D!Jf{;~wuTBvqS0bNevjnfoqtNmGoyDMrJR=lFy4=!=Bz|Ib$ z0@M><#ej3yhnII9rYBd5t zYi)S3OvVMlYr3)ic95P8X+=b&%yV54d!Pt>$*o4IO1)JKEtD!Jd$Td}^P-{PL%~jm zVJEGm>%6ulY-H?HYWb$avAMrd%I@EC)C>@8u5k{ zVsAExw16Dyk-J=^KJ=!kZ?OkpQv8J4l<9}78vYHqj1w*I6&9wSQc$-rH!4@+Xm(`n%HlLlRRg_QM;ml$MK z@pU!ExUE2Lt^g!z4yUnV^1o2|>M4ah=3rQ0_VeNqr>ieNa{f<@|BAB5?_*0X?23ku z7y4GEu7a^magMV1Ir)1$M;0?WI8Q^hC$#op%PH(9&Sw>=2`Nan*j4E_*!oTdvjVH- zMR~K)9pMtGywMU{TS9u+_CxBXL0{m!hxMY@7vFD-)^fXOdb!y%KW?fNMjmY|B86kN zj~mLG(gU#ci{^e2!j&yCY=rj3($}>&i^#I^^G2*_Cet8hhe5|9+`7@& z^w9ZAUz_%oSlOXC+eYBfx9ITh_Rf8Gd)M9FE^8>1eT8t(*(GP=<3i%7z)c`YD)td- zl|*G}gf7x+FW}dI8zT!_tVVEMWS3tb!%&fXpX{ z$0qL5TPpt$xI&s$Q+-`OD-p2V`w`=~Y7UVff2*QDx_X#ul-12ywOK^*5*iIvhyUIw z%>%!6<$I%~E(ZGL=V3c&U705lHvRUnb*06d4^xA$yl8e_T#2umCoj%_d--)seD&hG zGj5wosDdVRmElS7^7r2z=el)mz6+@uB^e()Fy;Eg-+$lT-mY3{T~UFsPvW>O`^XZ= z7s%xg0$8%yaWs`!<~4&>JLp3onP<~UlSYZG`0-^kZ12&@N>U(2N=c2Cwc=4W=_VNb z8Y8^Erp`v~vFdKp_mvuGNBA{twO{oo2GXGKd&C$?*t`lQ-7iF7BPH5nHb1&MZ6h)7 zY`57L^xyKb>#*>1+P3t>cg0q;#O@}D@YT=9$jsVpApfLJY0rGhms_d3JY#)%Jk|O4oT=FK>#k2SuF2bafWt zd72`mn4{rskgnULS`Ol_<1G$|zbK`{XrO{hKUKgF+hOY}?1x)hVM&IGJg4AgMA0>! zljhaQzq~KM`uc|#FJ4}^UOH`O?6lertOd3vcp|+5Q`c;@NBzLl)AWP$FQ@A`n0l+V z(br+yiBMJJYmAC{0cyFv2649|FHL|!GrMhBX*ET*Lqk9wX_(dn^u}Y~+G>K7yb&x3 z)K~9XAYuN=2;dU0>=OJMdPuPYeIkKv_o#tXtth-H>K?b5dqCeUu+S?H;q6VB*Y)mz zQx6VENbz5MHo6DEXUPITG(&_dr{}=4)HT|UAws9$2Llls zmLy2z-=a#&I;<*XCU5Sa*X;+c*`*8$#O_uy5S{ukE1|wAuYT}RbrUH#5N(sEJ5IqYSMH?u%5)Q z<(ESx{wiTOiC(r~XqKyj6+J+LLC_qh%}MKlgl#FPsghH5OK;K0b*t6g#teiS(ygs` zY_Qd}CtJ_@o8Sx*Cx9^w`N{Ne$;GWLW-o^<8>gBl2y|_l6H9@uJ$MDjV{k&nh(za; c>+9yL{~@;qjIql6!N!O>%!Qn&d~5Ch13kx;D*ylh