WMI, CIM et le registre¶

# Query the StdRegProv class to list all available methods
$class = [wmiclass]"root\default:StdRegProv"
$class.Methods | Select-Object Name | Sort-Object Name

# Define hive constants for use throughout the session
$HKCR = [uint32]2147483648
$HKCU = [uint32]2147483649
$HKLM = [uint32]2147483650
$HKU  = [uint32]2147483651
$HKCC = [uint32]2147483653

# Read a REG_SZ value using legacy WMI syntax
$HKLM = [uint32]2147483650
$result = Invoke-WmiMethod -Namespace "root\default" -Class StdRegProv `
    -Name GetStringValue `
    -ArgumentList $HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion", "ProductName"

$result.sValue

# Read a REG_DWORD value using legacy WMI syntax
$result = Invoke-WmiMethod -Namespace "root\default" -Class StdRegProv `
    -Name GetDWORDValue `
    -ArgumentList $HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion", "InstallationType"

# Note: InstallationType is REG_SZ, use GetStringValue instead
# This example reads CurrentBuildNumber (also REG_SZ) -- let's use a true DWORD
$result = Invoke-WmiMethod -Namespace "root\default" -Class StdRegProv `
    -Name GetDWORDValue `
    -ArgumentList $HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion", "UBR"

$result.uValue

# Read a REG_SZ value using modern CIM syntax
$HKLM = [uint32]2147483650

$params = @{
    hDefKey     = $HKLM
    sSubKeyName = "SOFTWARE\Microsoft\Windows NT\CurrentVersion"
    sValueName  = "ProductName"
}

$result = Invoke-CimMethod -Namespace "root\default" -ClassName StdRegProv `
    -MethodName GetStringValue -Arguments $params

$result.sValue

# Read the Update Build Revision (UBR) number
$HKLM = [uint32]2147483650

$result = Invoke-CimMethod -Namespace "root\default" -ClassName StdRegProv `
    -MethodName GetDWORDValue -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\Microsoft\Windows NT\CurrentVersion"
        sValueName  = "UBR"
    }

Write-Output "UBR: $($result.uValue)"

# List all subkeys under the Run key
$HKLM = [uint32]2147483650

$result = Invoke-CimMethod -Namespace "root\default" -ClassName StdRegProv `
    -MethodName EnumKey -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
    }

# EnumKey at this level might fail -- Run is a value container, not a key container
# Let's enumerate the Uninstall key instead
$result = Invoke-CimMethod -Namespace "root\default" -ClassName StdRegProv `
    -MethodName EnumKey -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    }

$result.sNames | Select-Object -First 10

# List all values under the CurrentVersion key
$HKLM = [uint32]2147483650

$result = Invoke-CimMethod -Namespace "root\default" -ClassName StdRegProv `
    -MethodName EnumValues -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\Microsoft\Windows NT\CurrentVersion"
    }

# Map type codes to names
$typeNames = @{
    1 = "REG_SZ"; 2 = "REG_EXPAND_SZ"; 3 = "REG_BINARY"
    4 = "REG_DWORD"; 7 = "REG_MULTI_SZ"; 11 = "REG_QWORD"
}

for ($i = 0; $i -lt $result.sNames.Count; $i++) {
    [PSCustomObject]@{
        Name = $result.sNames[$i]
        Type = $typeNames[[int]$result.Types[$i]]
    }
} | Format-Table -AutoSize

# Create a new registry key
$HKLM = [uint32]2147483650

$result = Invoke-CimMethod -Namespace "root\default" -ClassName StdRegProv `
    -MethodName CreateKey -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\MonEntreprise\Config"
    }

if ($result.ReturnValue -eq 0) {
    Write-Output "Key created successfully"
}

# Write a REG_SZ value
$HKLM = [uint32]2147483650

Invoke-CimMethod -Namespace "root\default" -ClassName StdRegProv `
    -MethodName SetStringValue -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\MonEntreprise\Config"
        sValueName  = "Version"
        sValue      = "2.5.0"
    }

# Write a REG_DWORD value
Invoke-CimMethod -Namespace "root\default" -ClassName StdRegProv `
    -MethodName SetDWORDValue -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\MonEntreprise\Config"
        sValueName  = "MaxRetries"
        uValue      = [uint32]5
    }

# Delete a value
$HKLM = [uint32]2147483650

Invoke-CimMethod -Namespace "root\default" -ClassName StdRegProv `
    -MethodName DeleteValue -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\MonEntreprise\Config"
        sValueName  = "Version"
    }

# Delete all values first, then the key (key must be empty)
Invoke-CimMethod -Namespace "root\default" -ClassName StdRegProv `
    -MethodName DeleteValue -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\MonEntreprise\Config"
        sValueName  = "MaxRetries"
    }

Invoke-CimMethod -Namespace "root\default" -ClassName StdRegProv `
    -MethodName DeleteKey -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\MonEntreprise\Config"
    }

# Quick test: verify WinRM connectivity to a remote machine
Test-WSMan -ComputerName "SRV-DC01" -ErrorAction Stop

# Create a CIM session to a remote machine
$session = New-CimSession -ComputerName "SRV-DC01"

# Use the session for registry operations
$HKLM = [uint32]2147483650

$result = Invoke-CimMethod -CimSession $session `
    -Namespace "root\default" -ClassName StdRegProv `
    -MethodName GetStringValue -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\Microsoft\Windows NT\CurrentVersion"
        sValueName  = "ProductName"
    }

Write-Output "$($session.ComputerName): $($result.sValue)"

# Clean up the session when done
Remove-CimSession $session

# Force DCOM transport (for legacy machines without WinRM)
$options = New-CimSessionOption -Protocol Dcom
$session = New-CimSession -ComputerName "LEGACY-SRV" -SessionOption $options

# Force WinRM (default, explicit for clarity)
$options = New-CimSessionOption -Protocol Wsman
$session = New-CimSession -ComputerName "SRV-DC01" -SessionOption $options

# Read OS version from 100+ machines in parallel
$computers = Get-ADComputer -Filter {OperatingSystem -like "Windows Server*"} |
    Select-Object -ExpandProperty Name

$HKLM = [uint32]2147483650

$results = $computers | ForEach-Object -Parallel {
    try {
        $session = New-CimSession -ComputerName $_ -ErrorAction Stop
        $result = Invoke-CimMethod -CimSession $session `
            -Namespace "root\default" -ClassName StdRegProv `
            -MethodName GetStringValue -Arguments @{
                hDefKey     = $using:HKLM
                sSubKeyName = "SOFTWARE\Microsoft\Windows NT\CurrentVersion"
                sValueName  = "ProductName"
            }
        [PSCustomObject]@{
            Computer = $_
            Product  = $result.sValue
            Status   = "OK"
        }
        Remove-CimSession $session
    }
    catch {
        [PSCustomObject]@{
            Computer = $_
            Product  = $null
            Status   = $_.Exception.Message
        }
    }
} -ThrottleLimit 20

$results | Format-Table -AutoSize

# PowerShell 5.1 alternative: create sessions in bulk, then query
$sessions = $computers | ForEach-Object {
    New-CimSession -ComputerName $_ -ErrorAction SilentlyContinue
}

$sessions | ForEach-Object {
    $result = Invoke-CimMethod -CimSession $_ `
        -Namespace "root\default" -ClassName StdRegProv `
        -MethodName GetStringValue -Arguments @{
            hDefKey     = $HKLM
            sSubKeyName = "SOFTWARE\Microsoft\Windows NT\CurrentVersion"
            sValueName  = "ProductName"
        }
    [PSCustomObject]@{
        Computer = $_.ComputerName
        Product  = $result.sValue
    }
}

# Clean up all sessions
$sessions | Remove-CimSession

# Default: uses Kerberos (recommended in domain environments)
$session = New-CimSession -ComputerName "SRV-DC01"

# Explicit credentials (prompts for password)
$cred = Get-Credential -UserName "DOMAIN\Admin"
$session = New-CimSession -ComputerName "SRV-DC01" -Credential $cred

# Force NTLM (for workgroup machines or cross-domain without trust)
$options = New-CimSessionOption -Protocol Wsman
$session = New-CimSession -ComputerName "192.168.1.50" `
    -Credential $cred `
    -SessionOption $options `
    -Authentication Negotiate

function Read-RegistryValueWmi {
    param(
        [uint32]$Hive = 2147483650,  # HKLM
        [string]$Key,
        [string]$ValueName,
        [Microsoft.Management.Infrastructure.CimSession]$CimSession
    )

    $commonArgs = @{
        Namespace  = "root\default"
        ClassName  = "StdRegProv"
    }
    if ($CimSession) { $commonArgs["CimSession"] = $CimSession }

    # Step 1: enumerate values to find the type
    $enum = Invoke-CimMethod @commonArgs -MethodName EnumValues -Arguments @{
        hDefKey     = $Hive
        sSubKeyName = $Key
    }

    $idx = [Array]::IndexOf($enum.sNames, $ValueName)
    if ($idx -lt 0) {
        Write-Error "Value '$ValueName' not found in '$Key'"
        return
    }

    $type = $enum.Types[$idx]

    # Step 2: call the appropriate method based on type
    $methodMap = @{
        1  = @{ Method = "GetStringValue";         Property = "sValue" }
        2  = @{ Method = "GetExpandedStringValue";  Property = "sValue" }
        3  = @{ Method = "GetBinaryValue";          Property = "uValue" }
        4  = @{ Method = "GetDWORDValue";           Property = "uValue" }
        7  = @{ Method = "GetMultiStringValue";     Property = "sValue" }
        11 = @{ Method = "GetQWORDValue";           Property = "uValue" }
    }

    $entry = $methodMap[$type]
    if (-not $entry) {
        Write-Warning "Unsupported type code: $type -- falling back to GetBinaryValue"
        $entry = @{ Method = "GetBinaryValue"; Property = "uValue" }
    }

    $result = Invoke-CimMethod @commonArgs -MethodName $entry.Method -Arguments @{
        hDefKey     = $Hive
        sSubKeyName = $Key
        sValueName  = $ValueName
    }

    [PSCustomObject]@{
        ValueName = $ValueName
        Type      = $type
        Data      = $result.($entry.Property)
        ReturnVal = $result.ReturnValue
    }
}

# Usage
Read-RegistryValueWmi -Key "SOFTWARE\Microsoft\Windows NT\CurrentVersion" -ValueName "ProductName"
Read-RegistryValueWmi -Key "SOFTWARE\Microsoft\Windows NT\CurrentVersion" -ValueName "UBR"
Read-RegistryValueWmi -Key "SOFTWARE\Microsoft\Windows NT\CurrentVersion" -ValueName "DigitalProductId"

function Get-RegistryTreeWmi {
    param(
        [uint32]$Hive = 2147483650,
        [string]$Key,
        [Microsoft.Management.Infrastructure.CimSession]$CimSession,
        [int]$Depth = 0,
        [int]$MaxDepth = 10
    )

    $commonArgs = @{
        Namespace = "root\default"
        ClassName = "StdRegProv"
    }
    if ($CimSession) { $commonArgs["CimSession"] = $CimSession }

    # Enumerate values at current level
    $values = Invoke-CimMethod @commonArgs -MethodName EnumValues -Arguments @{
        hDefKey     = $Hive
        sSubKeyName = $Key
    }

    if ($values.ReturnValue -eq 0 -and $values.sNames) {
        foreach ($name in $values.sNames) {
            [PSCustomObject]@{
                Path      = $Key
                ValueName = $name
                Depth     = $Depth
            }
        }
    }

    # Stop recursion if max depth reached
    if ($Depth -ge $MaxDepth) { return }

    # Enumerate subkeys and recurse
    $subkeys = Invoke-CimMethod @commonArgs -MethodName EnumKey -Arguments @{
        hDefKey     = $Hive
        sSubKeyName = $Key
    }

    if ($subkeys.ReturnValue -eq 0 -and $subkeys.sNames) {
        foreach ($subkey in $subkeys.sNames) {
            $childPath = if ($Key) { "$Key\$subkey" } else { $subkey }
            Get-RegistryTreeWmi -Hive $Hive -Key $childPath `
                -CimSession $CimSession -Depth ($Depth + 1) -MaxDepth $MaxDepth
        }
    }
}

# List all values under a key tree (max 3 levels deep)
Get-RegistryTreeWmi -Key "SOFTWARE\MonEntreprise" -MaxDepth 3 | Format-Table -AutoSize

# Always check ReturnValue before using the data
$result = Invoke-CimMethod -Namespace "root\default" -ClassName StdRegProv `
    -MethodName GetStringValue -Arguments @{
        hDefKey     = [uint32]2147483650
        sSubKeyName = "SOFTWARE\CleInexistante"
        sValueName  = "Test"
    }

switch ($result.ReturnValue) {
    0  { Write-Output "Value: $($result.sValue)" }
    1  { Write-Warning "Value not found" }
    2  { Write-Error "Access denied" }
    6  { Write-Error "Key does not exist" }
    default { Write-Error "Unexpected error: $($result.ReturnValue)" }
}

# Read the security descriptor of a registry key
$HKLM = [uint32]2147483650

$result = Invoke-CimMethod -Namespace "root\default" -ClassName StdRegProv `
    -MethodName GetSecurityDescriptor -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\MonEntreprise"
    }

if ($result.ReturnValue -eq 0) {
    $sd = $result.Descriptor
    Write-Output "Owner: $($sd.Owner.Name)"
    Write-Output "DACL entries: $($sd.DACL.Count)"

    foreach ($ace in $sd.DACL) {
        [PSCustomObject]@{
            Trustee    = $ace.Trustee.Name
            AccessMask = "0x{0:X}" -f $ace.AccessMask
            AceType    = $ace.AceType  # 0=Allow, 1=Deny
        }
    }
}

function Get-InstalledSoftwareWmi {
    param(
        [string[]]$ComputerName,
        [int]$ThrottleLimit = 20
    )

    $HKLM = [uint32]2147483650

    # Both 64-bit and 32-bit uninstall locations
    $uninstallPaths = @(
        "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
        "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall"
    )

    $ComputerName | ForEach-Object -Parallel {
        $computer = $_
        try {
            $session = New-CimSession -ComputerName $computer -ErrorAction Stop

            foreach ($path in $using:uninstallPaths) {
                $keys = Invoke-CimMethod -CimSession $session `
                    -Namespace "root\default" -ClassName StdRegProv `
                    -MethodName EnumKey -Arguments @{
                        hDefKey     = $using:HKLM
                        sSubKeyName = $path
                    }

                if ($keys.ReturnValue -ne 0 -or -not $keys.sNames) { continue }

                foreach ($subkey in $keys.sNames) {
                    $fullPath = "$path\$subkey"

                    $displayName = (Invoke-CimMethod -CimSession $session `
                        -Namespace "root\default" -ClassName StdRegProv `
                        -MethodName GetStringValue -Arguments @{
                            hDefKey     = $using:HKLM
                            sSubKeyName = $fullPath
                            sValueName  = "DisplayName"
                        }).sValue

                    if (-not $displayName) { continue }

                    $version = (Invoke-CimMethod -CimSession $session `
                        -Namespace "root\default" -ClassName StdRegProv `
                        -MethodName GetStringValue -Arguments @{
                            hDefKey     = $using:HKLM
                            sSubKeyName = $fullPath
                            sValueName  = "DisplayVersion"
                        }).sValue

                    $publisher = (Invoke-CimMethod -CimSession $session `
                        -Namespace "root\default" -ClassName StdRegProv `
                        -MethodName GetStringValue -Arguments @{
                            hDefKey     = $using:HKLM
                            sSubKeyName = $fullPath
                            sValueName  = "Publisher"
                        }).sValue

                    [PSCustomObject]@{
                        Computer    = $computer
                        Name        = $displayName
                        Version     = $version
                        Publisher   = $publisher
                    }
                }
            }
            Remove-CimSession $session
        }
        catch {
            [PSCustomObject]@{
                Computer  = $computer
                Name      = "ERROR"
                Version   = $null
                Publisher  = $_.Exception.Message
            }
        }
    } -ThrottleLimit $ThrottleLimit
}

# Run the inventory and export to CSV
$computers = Get-ADComputer -Filter * -SearchBase "OU=Workstations,DC=corp,DC=local" |
    Select-Object -ExpandProperty Name

$inventory = Get-InstalledSoftwareWmi -ComputerName $computers -ThrottleLimit 30

$inventory | Export-Csv -Path "C:\Reports\software_inventory.csv" -NoTypeInformation -Encoding UTF8

Write-Output "Inventoried $($inventory.Count) software entries across $($computers.Count) machines"

function Set-RegistryValueFleet {
    param(
        [string[]]$ComputerName,
        [uint32]$Hive = 2147483650,
        [string]$Key,
        [string]$ValueName,
        [string]$ValueData,
        [ValidateSet("String","DWord","ExpandString","MultiString","QWord")]
        [string]$ValueType = "String",
        [int]$ThrottleLimit = 20
    )

    $methodMap = @{
        "String"       = "SetStringValue"
        "DWord"        = "SetDWORDValue"
        "ExpandString" = "SetExpandedStringValue"
        "MultiString"  = "SetMultiStringValue"
        "QWord"        = "SetQWORDValue"
    }

    $method = $methodMap[$ValueType]

    $ComputerName | ForEach-Object -Parallel {
        $computer = $_
        try {
            $session = New-CimSession -ComputerName $computer -ErrorAction Stop

            # Create the key if it doesn't exist
            Invoke-CimMethod -CimSession $session `
                -Namespace "root\default" -ClassName StdRegProv `
                -MethodName CreateKey -Arguments @{
                    hDefKey     = $using:Hive
                    sSubKeyName = $using:Key
                } | Out-Null

            # Build the arguments based on value type
            $setArgs = @{
                hDefKey     = $using:Hive
                sSubKeyName = $using:Key
                sValueName  = $using:ValueName
            }

            switch ($using:ValueType) {
                "DWord"  { $setArgs["uValue"] = [uint32]$using:ValueData }
                "QWord"  { $setArgs["uValue"] = [uint64]$using:ValueData }
                default  { $setArgs["sValue"] = $using:ValueData }
            }

            $result = Invoke-CimMethod -CimSession $session `
                -Namespace "root\default" -ClassName StdRegProv `
                -MethodName $using:method -Arguments $setArgs

            [PSCustomObject]@{
                Computer    = $computer
                ReturnValue = $result.ReturnValue
                Status      = if ($result.ReturnValue -eq 0) { "OK" } else { "FAILED" }
            }

            Remove-CimSession $session
        }
        catch {
            [PSCustomObject]@{
                Computer    = $computer
                ReturnValue = -1
                Status      = $_.Exception.Message
            }
        }
    } -ThrottleLimit $ThrottleLimit
}

# Deploy a registry setting to all workstations
$workstations = (Get-ADComputer -Filter {OperatingSystem -like "Windows 10*"}).Name

Set-RegistryValueFleet -ComputerName $workstations `
    -Key "SOFTWARE\Policies\MonEntreprise\Security" `
    -ValueName "EnforceEncryption" `
    -ValueData "1" `
    -ValueType "DWord" |
    Where-Object Status -ne "OK" |
    Format-Table -AutoSize

function Test-RegistryCompliance {
    param(
        [string[]]$ComputerName,
        [hashtable[]]$Rules,   # @{ Key="..."; Value="..."; Expected="..."; Type="DWord" }
        [int]$ThrottleLimit = 20
    )

    $HKLM = [uint32]2147483650

    $ComputerName | ForEach-Object -Parallel {
        $computer = $_
        try {
            $session = New-CimSession -ComputerName $computer -ErrorAction Stop

            foreach ($rule in $using:Rules) {
                $methodMap = @{
                    "String" = @{ Method = "GetStringValue"; Prop = "sValue" }
                    "DWord"  = @{ Method = "GetDWORDValue";  Prop = "uValue" }
                }
                $m = $methodMap[$rule.Type]

                $result = Invoke-CimMethod -CimSession $session `
                    -Namespace "root\default" -ClassName StdRegProv `
                    -MethodName $m.Method -Arguments @{
                        hDefKey     = $using:HKLM
                        sSubKeyName = $rule.Key
                        sValueName  = $rule.Value
                    }

                $actual = $result.($m.Prop)
                $compliant = ($actual -eq $rule.Expected)

                [PSCustomObject]@{
                    Computer  = $computer
                    Rule      = "$($rule.Key)\$($rule.Value)"
                    Expected  = $rule.Expected
                    Actual    = $actual
                    Compliant = $compliant
                }
            }
            Remove-CimSession $session
        }
        catch {
            [PSCustomObject]@{
                Computer  = $computer
                Rule      = "CONNECTION"
                Expected  = "N/A"
                Actual    = $_.Exception.Message
                Compliant = $false
            }
        }
    } -ThrottleLimit $ThrottleLimit
}

# Define compliance rules
$rules = @(
    @{
        Key      = "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
        Value    = "NoAutoUpdate"
        Expected = 0
        Type     = "DWord"
    },
    @{
        Key      = "SOFTWARE\Policies\Microsoft\Windows\System"
        Value    = "EnableSmartScreen"
        Expected = 1
        Type     = "DWord"
    },
    @{
        Key      = "SOFTWARE\Policies\Microsoft\Windows Defender"
        Value    = "DisableAntiSpyware"
        Expected = $null  # modern baseline: the legacy value should be absent
        Type     = "DWord"
    }
)

# Run the audit
$computers = (Get-ADComputer -Filter * -SearchBase "OU=Servers,DC=corp,DC=local").Name

$auditResults = Test-RegistryCompliance -ComputerName $computers -Rules $rules

# Summary report
$auditResults | Group-Object Compliant | Select-Object Name, Count

# Export non-compliant entries
$auditResults | Where-Object { -not $_.Compliant } |
    Export-Csv -Path "C:\Reports\compliance_failures.csv" -NoTypeInformation -Encoding UTF8

# Watch for changes to a specific registry value
$query = @"
SELECT * FROM __RegistryValueChangeEvent
WHERE Hive='HKEY_LOCAL_MACHINE'
AND KeyPath='SOFTWARE\\MonEntreprise\\Config'
AND ValueName='Version'
"@

Register-CimIndicationEvent -Namespace "root\default" `
    -Query $query `
    -SourceIdentifier "RegValueChange" `
    -Action {
        $event = $Event.SourceEventArgs.NewEvent
        $timestamp = [DateTime]::FromFileTime($event.TIME_CREATED)
        Write-Host "[$timestamp] Value changed: $($event.KeyPath)\$($event.ValueName)" -ForegroundColor Yellow
    }

Write-Output "Monitoring started. Modify the registry value to see events."
Write-Output "Run 'Unregister-Event RegValueChange' to stop."

# Watch for any change in a registry tree
$query = @"
SELECT * FROM __RegistryTreeChangeEvent WITHIN 5
WHERE Hive='HKEY_LOCAL_MACHINE'
AND RootPath='SOFTWARE\\MonEntreprise'
"@

Register-CimIndicationEvent -Namespace "root\default" `
    -Query $query `
    -SourceIdentifier "RegTreeChange" `
    -Action {
        Write-Host "[$(Get-Date -Format 'HH:mm:ss')] Change detected in HKLM\SOFTWARE\MonEntreprise tree" -ForegroundColor Cyan
    }

# Step 1: Create the EventFilter
$filterArgs = @{
    Namespace = "root\subscription"
    ClassName = "__EventFilter"
}

$filter = New-CimInstance @filterArgs -Property @{
    Name            = "MonitorRegistryChange"
    EventNamespace  = "root\default"
    QueryLanguage   = "WQL"
    Query           = @"
SELECT * FROM __RegistryValueChangeEvent
WHERE Hive='HKEY_LOCAL_MACHINE'
AND KeyPath='SOFTWARE\\MonEntreprise\\Config'
AND ValueName='SecurityPolicy'
"@
}

# Step 2: Create the EventConsumer (CommandLineEventConsumer)
$consumerArgs = @{
    Namespace = "root\subscription"
    ClassName = "CommandLineEventConsumer"
}

$consumer = New-CimInstance @consumerArgs -Property @{
    Name                = "LogRegistryChange"
    CommandLineTemplate = 'powershell.exe -NoProfile -Command "Add-Content -Path C:\Logs\reg_changes.log -Value \"[$(Get-Date)] SecurityPolicy value changed\""'
}

# Step 3: Bind the filter to the consumer
New-CimInstance -Namespace "root\subscription" -ClassName "__FilterToConsumerBinding" -Property @{
    Filter   = [ref]$filter
    Consumer = [ref]$consumer
}

Write-Output "Permanent WMI event subscription created."

# Remove binding
Get-CimInstance -Namespace "root\subscription" -ClassName "__FilterToConsumerBinding" |
    Where-Object { $_.Filter.Name -eq "MonitorRegistryChange" } |
    Remove-CimInstance

# Remove consumer
Get-CimInstance -Namespace "root\subscription" -ClassName "CommandLineEventConsumer" |
    Where-Object { $_.Name -eq "LogRegistryChange" } |
    Remove-CimInstance

# Remove filter
Get-CimInstance -Namespace "root\subscription" -ClassName "__EventFilter" |
    Where-Object { $_.Name -eq "MonitorRegistryChange" } |
    Remove-CimInstance

# Read WMI configuration from the registry
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\WBEM\CIMOM" |
    Select-Object "Repository Directory", "Max DB Size", "Max Object Count", Logging

# Find the StdRegProv provider registration
Get-CimInstance -Namespace "root\default" -ClassName __Win32Provider |
    Where-Object Name -eq "RegProv" |
    Select-Object Name, CLSID, HostingModel

# Test WMI connectivity to a remote machine
try {
    $result = Get-CimInstance -ClassName Win32_OperatingSystem -ComputerName "SRV-TARGET" -ErrorAction Stop
    Write-Output "Connection OK: $($result.Caption)"
}
catch {
    Write-Error "WMI connection failed: $($_.Exception.Message)"

    # Detailed diagnostics
    Test-WSMan -ComputerName "SRV-TARGET" -ErrorAction SilentlyContinue
    Test-NetConnection -ComputerName "SRV-TARGET" -Port 5985
}

# Enable WinRM firewall rules on a remote machine (via PSExec or local)
Enable-PSRemoting -Force

# Verify the rules are active
Get-NetFirewallRule -Name "WINRM-HTTP-In-TCP*" | Select-Object Name, Enabled, Profile