Gestion d'entreprise et cloud¶

# Show all MDM policy sources currently writing to the registry
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers" -ErrorAction SilentlyContinue |
    ForEach-Object { [PSCustomObject]@{
        Provider = $_.PSChildName
        Policies = (Get-ChildItem $_.PSPath -Recurse -ErrorAction SilentlyContinue).Count
    }} | Format-Table -AutoSize

# Examine the active MDM policy for a specific area
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Experience" -ErrorAction SilentlyContinue

# Force an Intune sync and check the registry
Start-Process "ms-device-enrollment:?mode=mdm"
Start-Sleep -Seconds 30

# Verify the policy was written
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Name "DisableSearchBoxSuggestions" -ErrorAction SilentlyContinue

# List all PolicyManager providers and their policy count
$providers = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers" -ErrorAction SilentlyContinue
foreach ($provider in $providers) {
    $guid = $provider.PSChildName
    $count = (Get-ChildItem $provider.PSPath -Recurse -ErrorAction SilentlyContinue).Count
    Write-Output "Provider: $guid -> $count policies"
}

# Detection script: check if telemetry is set to minimum
$path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection"
$expected = 1
$current = (Get-ItemProperty -Path $path -Name "AllowTelemetry" -ErrorAction SilentlyContinue).AllowTelemetry

if ($current -eq $expected) {
    Write-Output "Compliant: AllowTelemetry is $current"
    exit 0
} else {
    Write-Output "Non-compliant: AllowTelemetry is $current (expected $expected)"
    exit 1
}

# Remediation script: set telemetry to minimum
$path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection"
try {
    Set-ItemProperty -Path $path -Name "AllowTelemetry" -Value 1 -Type DWord -Force
    Write-Output "Remediated: AllowTelemetry set to 1"
    exit 0
} catch {
    Write-Output "Failed to remediate: $_"
    exit 1
}

# Display Entra ID join information from the registry
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\CloudDomainJoin\JoinInfo" -ErrorAction SilentlyContinue |
    ForEach-Object {
        $props = Get-ItemProperty $_.PSPath
        [PSCustomObject]@{
            TenantId   = $_.PSChildName
            UserEmail  = $props.UserEmail
            TenantName = $props.TenantName
            JoinType   = $props.JoinType
            ThumbPrint = $props.CertThumbprint
        }
    } | Format-List

# Read the CDJ AAD metadata
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD" -ErrorAction SilentlyContinue |
    Select-Object TenantId, TenantName

# Determine Entra ID join status from registry only
function Get-JoinStatusFromRegistry {
    $result = [PSCustomObject]@{
        AzureADJoined    = $false
        HybridJoined     = $false
        WorkplaceJoined  = $false
        TenantId         = $null
        DomainJoined     = $false
    }

    # Check CloudDomainJoin
    $joinInfo = Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\CloudDomainJoin\JoinInfo" -ErrorAction SilentlyContinue
    if ($joinInfo) {
        $props = Get-ItemProperty $joinInfo[0].PSPath
        $result.TenantId = $joinInfo[0].PSChildName

        switch ($props.JoinType) {
            6  { $result.AzureADJoined = $true }
            4  { $result.HybridJoined = $true }
            13 { $result.WorkplaceJoined = $true }
        }
    }

    # Check traditional domain join
    $domainKey = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -ErrorAction SilentlyContinue
    if ($domainKey.Domain -and $domainKey.Domain -ne "") {
        $result.DomainJoined = $true
    }

    return $result
}

Get-JoinStatusFromRegistry | Format-List

# List SCCM policy assignments
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\CCM\Policy\Machine\ActualConfig" -ErrorAction SilentlyContinue |
    Select-Object PSChildName | Format-Table -AutoSize

# Check SCCM client version and site code
$sms = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client" -ErrorAction SilentlyContinue
Write-Output "Client Version: $($sms.ProductVersion)"
Write-Output "Site Code: $($sms.AssignedSiteCode)"

# SCCM detection method: check if an application's registry key exists
$detectionPath = "HKLM:\SOFTWARE\Contoso\MyApp"
$detectionValue = "Version"
$expectedVersion = "2.1.0"

$actual = (Get-ItemProperty -Path $detectionPath -Name $detectionValue -ErrorAction SilentlyContinue).$detectionValue

if ($actual -ge $expectedVersion) {
    Write-Output "Application detected: version $actual"
    # Return $true by writing output — SCCM interprets any stdout as "detected"
} else {
    # Return nothing — SCCM interprets empty stdout as "not detected"
}

# Check SCCM client health status
$eval = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\CCM\CcmEval" -ErrorAction SilentlyContinue
Write-Output "Last evaluation: $($eval.LastEvalTime)"
Write-Output "Result: $($eval.LastEvalResult)"

# Read Autopilot provisioning settings
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Provisioning\AutopilotSettings" -ErrorAction SilentlyContinue |
    Select-Object CloudAssignedTenantId, CloudAssignedTenantDomain, IsAutopilotDevice, CloudAssignedOobeConfig |
    Format-List

# Monitor ESP progress for device setup apps
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\Autopilot\EnrollmentStatusTracking\Device\Setup\Apps\Tracking" -ErrorAction SilentlyContinue |
    ForEach-Object {
        $props = Get-ItemProperty $_.PSPath
        [PSCustomObject]@{
            PackageId         = $_.PSChildName
            InstallationState = $props.InstallationState
            LastError         = $props.LastError
        }
    } | Format-Table -AutoSize

# Verify White Glove / Pre-provisioning status
$autopilot = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Provisioning\AutopilotSettings" -ErrorAction SilentlyContinue
if ($autopilot.PreProvisioningCompleted -eq 1) {
    Write-Output "Pre-provisioning completed successfully"
} else {
    Write-Output "Pre-provisioning NOT completed"
}

# DSC Configuration: enforce corporate registry settings
Configuration EnterpriseRegistryBaseline {

    Import-DscResource -ModuleName PSDesiredStateConfiguration

    Node "localhost" {

        # Disable Windows telemetry beyond required level
        Registry DisableTelemetry {
            Key       = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection"
            ValueName = "AllowTelemetry"
            ValueType = "Dword"
            ValueData = "1"
            Ensure    = "Present"
            Force     = $true
        }

        # Enforce NTP server configuration
        Registry NtpServer {
            Key       = "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters"
            ValueName = "NtpServer"
            ValueType = "String"
            ValueData = "time.windows.com,0x9"
            Ensure    = "Present"
        }

        # Disable autorun on all drives
        Registry DisableAutorun {
            Key       = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer"
            ValueName = "NoDriveTypeAutoRun"
            ValueType = "Dword"
            ValueData = "255"
            Ensure    = "Present"
            Force     = $true
        }

        # Block anonymous enumeration of SAM accounts
        Registry RestrictAnonymousSAM {
            Key       = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
            ValueName = "RestrictAnonymousSAM"
            ValueType = "Dword"
            ValueData = "1"
            Ensure    = "Present"
        }

        # Remove a deprecated registry value
        Registry RemoveDeprecatedKey {
            Key       = "HKLM:\SOFTWARE\Contoso\LegacyApp"
            ValueName = "EnableV1Protocol"
            Ensure    = "Absent"
        }
    }
}

# Compile the configuration to a MOF file
EnterpriseRegistryBaseline -OutputPath "C:\DSC\EnterpriseBaseline"

# Apply the configuration
Start-DscConfiguration -Path "C:\DSC\EnterpriseBaseline" -Wait -Verbose -Force

# Check Guest Configuration agent status
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\GuestConfig" -ErrorAction SilentlyContinue |
    ForEach-Object { Get-ItemProperty $_.PSPath } | Format-List

# Check if MDM has priority over GPO
$mdmConflict = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM\ControlPolicyConflict" -ErrorAction SilentlyContinue
if ($mdmConflict.MDMWinsOverGP -eq 1) {
    Write-Output "MDM (Intune) wins over Group Policy"
} else {
    Write-Output "Group Policy wins over MDM (default behavior)"
}

# Identify the source of a specific policy setting
function Get-PolicySource {
    param(
        [string]$Area = "Experience",
        [string]$PolicyName = "AllowCortana"
    )

    $sources = @()

    # Check MDM PolicyManager
    $mdm = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\$Area" -Name $PolicyName -ErrorAction SilentlyContinue
    if ($mdm) {
        $sources += [PSCustomObject]@{
            Source = "MDM (PolicyManager)"
            Value  = $mdm.$PolicyName
            Path   = "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\$Area"
        }
    }

    # Check GPO Policies
    $gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\$Area"
    $gpo = Get-ItemProperty $gpoPath -Name $PolicyName -ErrorAction SilentlyContinue
    if ($gpo) {
        $sources += [PSCustomObject]@{
            Source = "Group Policy"
            Value  = $gpo.$PolicyName
            Path   = $gpoPath
        }
    }

    # Check local preferences
    $localPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\$Area"
    $local = Get-ItemProperty $localPath -Name $PolicyName -ErrorAction SilentlyContinue
    if ($local) {
        $sources += [PSCustomObject]@{
            Source = "Local Setting"
            Value  = $local.$PolicyName
            Path   = $localPath
        }
    }

    return $sources
}

Get-PolicySource -Area "Experience" -PolicyName "AllowCortana" | Format-Table -AutoSize

# Check current telemetry level
$telemetry = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -ErrorAction SilentlyContinue
$levels = @{ 0 = "Security"; 1 = "Required"; 2 = "Enhanced"; 3 = "Optional" }
$level = $levels[$telemetry.AllowTelemetry]
Write-Output "Telemetry level: $($telemetry.AllowTelemetry) ($level)"

# Audit CIS critical settings
$cisChecks = @(
    @{ Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"; Name = "EnableLUA"; Expected = 1; CIS = "2.3.7.1" },
    @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"; Name = "LmCompatibilityLevel"; Expected = 5; CIS = "2.3.10.5" },
    @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile"; Name = "EnableFirewall"; Expected = 1; CIS = "9.1.1" },
    @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest"; Name = "UseLogonCredential"; Expected = 0; CIS = "18.9.11.1" },
    @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"; Name = "SMB1"; Expected = 0; CIS = "18.9.25.1" },
    @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection"; Name = "AllowTelemetry"; Expected = 1; CIS = "18.9.65.1" }
)

foreach ($check in $cisChecks) {
    $actual = (Get-ItemProperty -Path $check.Path -Name $check.Name -ErrorAction SilentlyContinue).($check.Name)
    $status = if ($actual -eq $check.Expected) { "PASS" } else { "FAIL" }
    Write-Output "[$status] CIS $($check.CIS): $($check.Name) = $actual (expected $($check.Expected))"
}

# Download and examine a Security Baseline (example path after extraction)
$baselinePath = "C:\SecurityBaseline\Windows11-23H2\GPOs"

# List all registry.pol files in the baseline
Get-ChildItem $baselinePath -Recurse -Filter "registry.pol" |
    ForEach-Object {
        Write-Output "Baseline GPO: $($_.Directory.Parent.Name)"
        Write-Output "  Path: $($_.FullName)"
    }

# Check MDM enrollment status
$enrollments = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments" -ErrorAction SilentlyContinue
foreach ($enrollment in $enrollments) {
    $props = Get-ItemProperty $enrollment.PSPath
    if ($props.ProviderID) {
        [PSCustomObject]@{
            EnrollmentId = $enrollment.PSChildName
            ProviderID   = $props.ProviderID
            UPN          = $props.UPN
            EnrollmentState = $props.EnrollmentState
        }
    }
} | Format-Table -AutoSize

# Check last MDM sync time
$enrollmentId = (Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments" -ErrorAction SilentlyContinue |
    Where-Object { (Get-ItemProperty $_.PSPath).ProviderID -eq "MS DM Server" }).PSChildName

if ($enrollmentId) {
    $dmClient = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Enrollments\$enrollmentId\DMClient\MS DM Server" -ErrorAction SilentlyContinue
    Write-Output "Last sync attempt: $($dmClient.LastSuccessfulSyncTime)"
    Write-Output "Number of applied policies: $($dmClient.NumberOfAppliedPolicies)"
}

# List all active MDM policies and their areas
$areas = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device" -ErrorAction SilentlyContinue
Write-Output "Active policy areas: $($areas.Count)"
$areas | Select-Object PSChildName | Sort-Object PSChildName | Format-Table -AutoSize

# Trigger an Intune sync from PowerShell
$syncCmd = New-CimInstance -Namespace "root\cimv2\mdm\dmmap" `
    -ClassName "MDM_DeviceAction_Provider01" `
    -Property @{ ParentID = "./Vendor/MSFT/RemoteWipe"; InstanceID = "doWipe"; ActionVerb = "SyncML" } `
    -ErrorAction SilentlyContinue

# Alternative: use the scheduled task
Get-ScheduledTask | Where-Object { $_.TaskName -like "*EnterpriseMgmt*" } |
    Start-ScheduledTask

# Detailed enrollment diagnostic
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments" -ErrorAction SilentlyContinue |
    ForEach-Object {
        $props = Get-ItemProperty $_.PSPath
        if ($props.ProviderID) {
            [PSCustomObject]@{
                GUID        = $_.PSChildName
                Provider    = $props.ProviderID
                UPN         = $props.UPN
                State       = $props.EnrollmentState
                LastError   = "0x{0:X8}" -f [int]$props.LastError
                ResourceID  = $props.AADResourceID
            }
        }
    } | Format-List

# Compare dsregcmd output with registry values
Write-Output "=== dsregcmd /status ==="
$dsreg = dsregcmd /status
$dsreg | Select-String "AzureAdJoined|DomainJoined|WorkplaceJoined|TenantName|DeviceId"

Write-Output "`n=== Registry check ==="

# Cloud Domain Join info
$joinInfo = Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\CloudDomainJoin\JoinInfo" -ErrorAction SilentlyContinue
if ($joinInfo) {
    $props = Get-ItemProperty $joinInfo[0].PSPath
    Write-Output "Registry TenantId: $($joinInfo[0].PSChildName)"
    Write-Output "Registry UserEmail: $($props.UserEmail)"
    Write-Output "Registry JoinType: $($props.JoinType)"
} else {
    Write-Output "No CloudDomainJoin\JoinInfo found — device may not be joined"
}

# Check Automatic Device Join task
$task = Get-ScheduledTask -TaskName "Automatic-Device-Join" -TaskPath "\Microsoft\Windows\Workplace Join\" -ErrorAction SilentlyContinue
if ($task) {
    Write-Output "`nAutomatic-Device-Join task state: $($task.State)"
    $lastRun = (Get-ScheduledTaskInfo -TaskName "Automatic-Device-Join" -TaskPath "\Microsoft\Windows\Workplace Join\" -ErrorAction SilentlyContinue).LastRunTime
    Write-Output "Last run: $lastRun"
}

# Comprehensive enterprise diagnostic script
function Invoke-EnterpriseRegistryDiagnostic {
    $results = @()

    # 1. Check Entra ID join status
    $joinInfo = Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\CloudDomainJoin\JoinInfo" -ErrorAction SilentlyContinue
    $results += [PSCustomObject]@{
        Check   = "Entra ID Join"
        Status  = if ($joinInfo) { "JOINED" } else { "NOT JOINED" }
        Details = if ($joinInfo) { "TenantId: $($joinInfo[0].PSChildName)" } else { "No JoinInfo found" }
    }

    # 2. Check MDM enrollment
    $enrollment = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments" -ErrorAction SilentlyContinue |
        Where-Object { (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).ProviderID -eq "MS DM Server" }
    $results += [PSCustomObject]@{
        Check   = "MDM Enrollment"
        Status  = if ($enrollment) { "ENROLLED" } else { "NOT ENROLLED" }
        Details = if ($enrollment) { "UPN: $((Get-ItemProperty $enrollment.PSPath).UPN)" } else { "No MDM enrollment found" }
    }

    # 3. Check PolicyManager policies
    $policyAreas = (Get-ChildItem "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device" -ErrorAction SilentlyContinue).Count
    $results += [PSCustomObject]@{
        Check   = "MDM Policies"
        Status  = if ($policyAreas -gt 0) { "ACTIVE ($policyAreas areas)" } else { "NONE" }
        Details = "PolicyManager areas found: $policyAreas"
    }

    # 4. Check SCCM client
    $sccm = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client" -ErrorAction SilentlyContinue
    $results += [PSCustomObject]@{
        Check   = "SCCM Client"
        Status  = if ($sccm.ProductVersion) { "INSTALLED ($($sccm.ProductVersion))" } else { "NOT INSTALLED" }
        Details = if ($sccm.AssignedSiteCode) { "Site: $($sccm.AssignedSiteCode)" } else { "No site assigned" }
    }

    # 5. Check MDMWinsOverGP
    $mdmWins = (Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM\ControlPolicyConflict" -ErrorAction SilentlyContinue).MDMWinsOverGP
    $results += [PSCustomObject]@{
        Check   = "MDM vs GPO Priority"
        Status  = if ($mdmWins -eq 1) { "MDM WINS" } else { "GPO WINS" }
        Details = "MDMWinsOverGP = $mdmWins"
    }

    # 6. Check telemetry level
    $telemetry = (Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" -ErrorAction SilentlyContinue).AllowTelemetry
    $results += [PSCustomObject]@{
        Check   = "Telemetry Level"
        Status  = switch ($telemetry) { 0 { "SECURITY" } 1 { "REQUIRED" } 2 { "ENHANCED" } 3 { "OPTIONAL" } default { "NOT SET" } }
        Details = "AllowTelemetry = $telemetry"
    }

    $results | Format-Table -AutoSize
}

Invoke-EnterpriseRegistryDiagnostic