Filtrage de sécurité et filtrage WMI¶

Get-GPPermissions -Name "CFG-Postes-EnvironnementBureau" -All |
    Select-Object Trustee, Permission, Inherited |
    Format-Table -AutoSize

Trustee                  Permission      Inherited
-------                  ----------      ---------
CONTOSO\Domain Admins    GpoEditDeleteModifySecurity False
CONTOSO\Enterprise Admins GpoEditDeleteModifySecurity False
CONTOSO\GRP-Postes-Std   GpoApply        False
NT AUTHORITY\Authenticated Users GpoRead False
BUILTIN\SYSTEM           GpoApply        False

# Retrieve the GPO's AD path first
$gpo = Get-GPO -Name "CFG-Postes-EnvironnementBureau"
$gpoDN = "CN={$($gpo.Id.ToString().ToUpper())},CN=Policies,CN=System,$(
    (Get-ADDomain).DistinguishedName)"

# Read the full ACL
$acl = Get-Acl -Path "AD:$gpoDN"
$acl.Access |
    Select-Object IdentityReference, ActiveDirectoryRights, AccessControlType |
    Format-Table -AutoSize

IdentityReference               ActiveDirectoryRights     AccessControlType
-----------------               ---------------------     -----------------
CONTOSO\GRP-Postes-Std          ExtendedRight             Allow
NT AUTHORITY\Authenticated Users GenericRead               Allow
BUILTIN\SYSTEM                  ExtendedRight             Allow

# Grant GpoApply to the computer group
Set-GPPermissions -Name "CFG-Postes-EnvironnementBureau" `
    -TargetName "GRP-Ordinateurs-Standard" `
    -TargetType Group `
    -PermissionLevel GpoApply

# Downgrade Authenticated Users to Read-only (admins can still browse settings in GPMC)
Set-GPPermissions -Name "CFG-Postes-EnvironnementBureau" `
    -TargetName "Authenticated Users" `
    -TargetType Group `
    -PermissionLevel GpoRead

Trustee                          Permission  Inherited
-------                          ----------  ---------
CONTOSO\GRP-Ordinateurs-Standard GpoApply    False
NT AUTHORITY\Authenticated Users GpoRead     False

# Audit script: list all GPOs where Authenticated Users has GpoApply
Get-GPO -All | ForEach-Object {
    $gpo = $_
    $perms = Get-GPPermissions -Guid $gpo.Id -All -ErrorAction SilentlyContinue
    $authUsers = $perms | Where-Object {
        $_.Trustee.Name -eq "Authenticated Users" -and
        $_.Permission -eq "GpoApply"
    }
    if (-not $authUsers) {
        [PSCustomObject]@{
            GPOName    = $gpo.DisplayName
            Status     = "Authenticated Users NOT in GpoApply — verify computer group"
        }
    }
} | Format-Table -AutoSize

# Add an explicit DENY ACE on Apply Group Policy for a group
# Apply Group Policy extended right GUID
$applyGpGuid = [Guid]"edacfd8f-ffb3-11d1-b41d-00a0c968f939"

$gpo = Get-GPO -Name "CFG-Utilisateurs-BureauStandard"
$gpoDN = "CN={$($gpo.Id.ToString().ToUpper())},CN=Policies,CN=System,$(
    (Get-ADDomain).DistinguishedName)"

$acl = Get-Acl -Path "AD:$gpoDN"

# Resolve the group SID
$groupSid = (Get-ADGroup -Identity "GRP-Admins-IT").SID

# Build the DENY ACE for the extended right
$ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
    $groupSid,
    [System.DirectoryServices.ActiveDirectoryRights]::ExtendedRight,
    [System.Security.AccessControl.AccessControlType]::Deny,
    $applyGpGuid
)

$acl.AddAccessRule($ace)
Set-Acl -Path "AD:$gpoDN" -AclObject $acl
Write-Host "DENY ACE added for GRP-Admins-IT on $($gpo.DisplayName)"

# Test a WQL query locally before deploying as a WMI filter
$namespace = "root\CIMv2"
$query     = "SELECT * FROM Win32_OperatingSystem WHERE Version >= '10.0.22000'"

$result = Get-WmiObject -Namespace $namespace -Query $query -ErrorAction SilentlyContinue

if ($result) {
    Write-Host "WMI filter result: TRUE — GPO would apply on this machine"
    $result | Select-Object Caption, Version | Format-Table
} else {
    Write-Host "WMI filter result: FALSE — GPO would NOT apply on this machine"
}

WMI filter result: TRUE — GPO would apply on this machine

Caption                          Version
-------                          -------
Microsoft Windows 11 Professionnel 10.0.22631

# Option 1: Win32_InstalledWin32Program (faster, no MSI reconfigure)
$query1 = "SELECT * FROM Win32_InstalledWin32Program WHERE Name LIKE '%Microsoft 365%'"

# Option 2: Registry-based detection (fastest)
# Check in HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
# or HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
$query2 = "SELECT * FROM Win32_OperatingSystem" # placeholder — use ILT for registry
# Note: for registry-based software detection, prefer Item-Level Targeting (Ch. 12)
# over WMI filters — ILT can query registry keys directly without performance impact

function New-GPWmiFilter {
    <#
    .SYNOPSIS
        Creates a WMI filter object in Active Directory.
    .PARAMETER Name
        Display name of the WMI filter.
    .PARAMETER Description
        Description stored in msWMI-Parm1.
    .PARAMETER Namespace
        WMI namespace for the query (default: root\CIMv2).
    .PARAMETER Query
        WQL query string.
    #>
    param(
        [Parameter(Mandatory)][string]$Name,
        [string]$Description = "",
        [string]$Namespace   = "root\CIMv2",
        [Parameter(Mandatory)][string]$Query
    )

    $domain        = (Get-ADDomain).DistinguishedName
    $wmiFilterPath = "CN=SOM,CN=WMIPolicy,CN=System,$domain"

    # Generate a unique GUID for the filter object name
    $guid = [System.Guid]::NewGuid().ToString("B").ToUpper()
    $now  = (Get-Date).ToUniversalTime().ToString("yyyyMMddHHmmss.ffffff-000")

    # msWMI-Parm2 format: "<version>;<filtercount>;<reserved>;<querylen>;WQL;<namespace>;<query>;"
    $parm2 = "1;3;10;$($Query.Length);WQL;$Namespace;$Query;"

    $attributes = @{
        "msWMI-Name"             = $Name
        "msWMI-Parm1"            = $Description
        "msWMI-Parm2"            = $parm2
        "msWMI-Author"           = "$env:USERNAME@$env:USERDNSDOMAIN"
        "msWMI-CreationDate"     = $now
        "msWMI-ChangeDate"       = $now
        "msWMI-ID"               = $guid
        "showInAdvancedViewOnly" = $true
    }

    New-ADObject -Name $guid `
                 -Type "msWMI-Som" `
                 -Path $wmiFilterPath `
                 -OtherAttributes $attributes `
                 -ErrorAction Stop

    Write-Host "WMI filter created: '$Name' — GUID: $guid"
    return $guid
}

# Create a filter for Windows 11 machines only
$filterId = New-GPWmiFilter `
    -Name        "WMI - Windows 11 Only" `
    -Description "Apply only to Windows 11 machines (build 22000+)" `
    -Query       "SELECT * FROM Win32_OperatingSystem WHERE Version >= '10.0.22000'"

function Set-GPWmiFilterLink {
    <#
    .SYNOPSIS
        Associates an existing WMI filter with a GPO.
    .PARAMETER GPOName
        Display name of the target GPO.
    .PARAMETER WmiFilterName
        Display name of the WMI filter to link.
    #>
    param(
        [Parameter(Mandatory)][string]$GPOName,
        [Parameter(Mandatory)][string]$WmiFilterName
    )

    $domain        = (Get-ADDomain).DistinguishedName
    $wmiFilterPath = "CN=SOM,CN=WMIPolicy,CN=System,$domain"

    # Find the WMI filter object by display name (msWMI-Name attribute)
    $filter = Get-ADObject -SearchBase $wmiFilterPath `
        -Filter { ObjectClass -eq "msWMI-Som" } `
        -Properties "msWMI-Name","msWMI-ID" |
        Where-Object { $_."msWMI-Name" -eq $WmiFilterName }

    if (-not $filter) {
        throw "WMI filter '$WmiFilterName' not found in $wmiFilterPath"
    }

    # Build the gPCWQLFilter value: ["<domain>\SOM\{GUID}";]
    $filterRef = "[`"$domain\SOM\$($filter.Name)`";]"

    # Update the GPO AD object
    $gpo    = Get-GPO -Name $GPOName
    $gpoDN  = "CN={$($gpo.Id.ToString().ToUpper())},CN=Policies,CN=System,$domain"

    Set-ADObject -Identity $gpoDN -Replace @{ "gPCWQLFilter" = $filterRef }
    Write-Host "WMI filter '$WmiFilterName' linked to GPO '$GPOName'"
}

WMI filter 'WMI - Windows 11 Only' linked to GPO 'CFG-Win11-OptimisationsUI'

# Query the Group Policy Operational log for filtering-related events
Get-WinEvent -LogName "Microsoft-Windows-GroupPolicy/Operational" `
    -MaxEvents 2000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Id -in @(5313, 5320, 5321, 5314) } |
    Select-Object TimeCreated, Id,
        @{
            Name       = "Summary"
            Expression = {
                # Extract the first meaningful line from the event message
                ($_.Message -split "`n" |
                    Where-Object { $_ -match "GPO|WMI|filter|policy|denied" } |
                    Select-Object -First 2) -join " | "
            }
        } |
    Format-Table -AutoSize -Wrap

TimeCreated           Id   Summary
-----------           --   -------
2024-11-15 08:32:14   5313 The GPO did not apply because it was not applicable. | Reason: The user does not have permission...
2024-11-15 08:32:15   5320 WMI filter evaluation was successful. Result: FALSE. | Filter: WMI - Windows 11 Only
2024-11-15 08:32:16   5320 WMI filter evaluation was successful. Result: TRUE.  | Filter: WMI - Portables Only

$domain        = (Get-ADDomain).DistinguishedName
$wmiFilterPath = "CN=SOM,CN=WMIPolicy,CN=System,$domain"

Get-ADObject -SearchBase $wmiFilterPath `
    -Filter { ObjectClass -eq "msWMI-Som" } `
    -Properties "msWMI-Name","msWMI-Parm1","msWMI-Parm2","msWMI-Author","msWMI-ChangeDate" |
    Select-Object `
        @{N="Name";        E={ $_."msWMI-Name" }},
        @{N="Description"; E={ $_."msWMI-Parm1" }},
        @{N="Author";      E={ $_."msWMI-Author" }},
        @{N="LastChanged"; E={ $_."msWMI-ChangeDate" }},
        @{N="Query";       E={
            # Extract the WQL query from the msWMI-Parm2 encoded string
            $parts = $_."msWMI-Parm2" -split ";"
            if ($parts.Count -ge 7) { $parts[6] } else { $_."msWMI-Parm2" }
        }} |
    Format-Table -AutoSize -Wrap

# Generate a full HTML report on the local machine
gpresult /h "$env:TEMP\gpreport.html" /f
Start-Process "$env:TEMP\gpreport.html"

# For a remote machine (requires admin rights and WinRM)
gpresult /s NOM-POSTE /h "$env:TEMP\gpreport-remote.html" /f

# Console output: denied GPOs section
gpresult /r | Select-String -Pattern "Denied|Filtered|WMI" -Context 1,1

# Step 1: Create the pilot group and add test machines
New-ADGroup -Name "GRP-Postes-Pilotes-GPO-X" `
    -GroupScope DomainLocal `
    -GroupCategory Security `
    -Path "OU=Groupes,DC=contoso,DC=local"

# Add pilot machines to the group
Add-ADGroupMember -Identity "GRP-Postes-Pilotes-GPO-X" `
    -Members "POSTE-TEST-01$","POSTE-TEST-02$"

# Step 2: Configure GPO security filtering for pilot group only
Set-GPPermissions -Name "CFG-NouvelleConfiguration" `
    -TargetName "GRP-Postes-Pilotes-GPO-X" `
    -TargetType Group `
    -PermissionLevel GpoApply

Set-GPPermissions -Name "CFG-NouvelleConfiguration" `
    -TargetName "Authenticated Users" `
    -TargetType Group `
    -PermissionLevel GpoRead  # Read only — no apply

Write-Host "Pilot filtering configured. Link the GPO to the OU when ready."

# Create WMI filters for OS targeting
$win10Guid = New-GPWmiFilter `
    -Name        "WMI - Windows 10 Only" `
    -Description "Apply to Windows 10 machines (build < 22000)" `
    -Query       "SELECT * FROM Win32_OperatingSystem WHERE Version LIKE '10.0.%' AND Version < '10.0.22000'"

$win11Guid = New-GPWmiFilter `
    -Name        "WMI - Windows 11 Only" `
    -Description "Apply to Windows 11 machines (build >= 22000)" `
    -Query       "SELECT * FROM Win32_OperatingSystem WHERE Version >= '10.0.22000'"

# Link filters to their respective GPOs
Set-GPWmiFilterLink -GPOName "CFG-Win10-ParametresUI" -WmiFilterName "WMI - Windows 10 Only"
Set-GPWmiFilterLink -GPOName "CFG-Win11-ParametresUI" -WmiFilterName "WMI - Windows 11 Only"

Write-Host "WMI filters created and linked. Both GPOs can be linked to the same OU."

$domain        = (Get-ADDomain).DistinguishedName
$wmiFilterPath = "CN=SOM,CN=WMIPolicy,CN=System,$domain"

# Build a lookup table of WMI filter GUIDs to names
$wmiFilters = @{}
Get-ADObject -SearchBase $wmiFilterPath `
    -Filter { ObjectClass -eq "msWMI-Som" } `
    -Properties "msWMI-Name" |
    ForEach-Object { $wmiFilters[$_.Name] = $_."msWMI-Name" }

Get-GPO -All | Sort-Object DisplayName | ForEach-Object {
    $gpo = $_

    # Get security filtering
    $perms = Get-GPPermissions -Guid $gpo.Id -All -ErrorAction SilentlyContinue
    $applyTargets = ($perms |
        Where-Object { $_.Permission -eq "GpoApply" } |
        ForEach-Object { $_.Trustee.Name }) -join ", "

    # Get WMI filter link from AD object
    $gpoDN  = "CN={$($gpo.Id.ToString().ToUpper())},CN=Policies,CN=System,$domain"
    $gpoObj = Get-ADObject -Identity $gpoDN -Properties "gPCWQLFilter" -ErrorAction SilentlyContinue
    $wmiLink = "None"
    if ($gpoObj."gPCWQLFilter") {
        # Extract GUID from the gPCWQLFilter attribute value
        if ($gpoObj."gPCWQLFilter" -match "\{([A-F0-9\-]+)\}") {
            $filterGuid = $Matches[1]
            $wmiLink = if ($wmiFilters[$filterGuid]) { $wmiFilters[$filterGuid] } else { $filterGuid }
        }
    }

    [PSCustomObject]@{
        GPOName       = $gpo.DisplayName
        Status        = $gpo.GpoStatus
        ApplyTargets  = if ($applyTargets) { $applyTargets } else { "(none)" }
        WMIFilter     = $wmiLink
    }
} | Format-Table -AutoSize -Wrap