Cryptographie, DPAPI et certificats¶

# Check if TLS 1.0 is enabled on the server side
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -ErrorAction SilentlyContinue |
    Select-Object Enabled, DisabledByDefault

# Export raw blob from a root CA certificate
$thumbprint = (Get-ChildItem Cert:\LocalMachine\Root | Select-Object -First 1).Thumbprint
$regPath = "HKLM:\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\$thumbprint"
$blob = (Get-ItemProperty -Path $regPath).Blob
"Blob size: $($blob.Length) bytes"

# List all trusted root CAs on the machine
Get-ChildItem Cert:\LocalMachine\Root | Format-Table Thumbprint, Subject -AutoSize

# List personal certificates of the current user
Get-ChildItem Cert:\CurrentUser\My | Format-Table Thumbprint, Subject, NotAfter -AutoSize

# Find certificates expiring within the next 30 days
$limit = (Get-Date).AddDays(30)
Get-ChildItem Cert:\LocalMachine\My |
    Where-Object { $_.NotAfter -lt $limit } |
    Format-Table Subject, NotAfter -AutoSize

# Demonstrate DPAPI encryption and decryption (user context)
Add-Type -AssemblyName System.Security
$plaintext = [System.Text.Encoding]::UTF8.GetBytes("RegistrySecretValue")

# Encrypt with DPAPI (user scope)
$encrypted = [System.Security.Cryptography.ProtectedData]::Protect(
    $plaintext,
    $null,
    [System.Security.Cryptography.DataProtectionScope]::CurrentUser
)

# Store in registry
New-Item -Path "HKCU:\SOFTWARE\DPAPITest" -Force | Out-Null
Set-ItemProperty -Path "HKCU:\SOFTWARE\DPAPITest" -Name "Secret" -Value $encrypted -Type Binary

# Read back and decrypt
$stored = (Get-ItemProperty -Path "HKCU:\SOFTWARE\DPAPITest").Secret
$decrypted = [System.Security.Cryptography.ProtectedData]::Unprotect(
    $stored,
    $null,
    [System.Security.Cryptography.DataProtectionScope]::CurrentUser
)
[System.Text.Encoding]::UTF8.GetString($decrypted)

# Cleanup
Remove-Item -Path "HKCU:\SOFTWARE\DPAPITest" -Force

# List all stored credentials
cmdkey /list

# List vault schemas registered on the system
Get-ChildItem "HKLM:\SOFTWARE\Vault" -ErrorAction SilentlyContinue

# List all registered CNG providers
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\Cryptography\Providers" |
    ForEach-Object {
        [PSCustomObject]@{
            Name  = $_.PSChildName
            Image = (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).Image
        }
    } | Format-Table -AutoSize

# List all key storage providers and their capabilities
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\Cryptography\Providers" |
    Where-Object {
        (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).Functions -match "KeyStorage"
    } |
    ForEach-Object { $_.PSChildName }

# Disable SSL 2.0 (Server and Client)
$protocols = @("SSL 2.0", "SSL 3.0", "TLS 1.0", "TLS 1.1")

foreach ($protocol in $protocols) {
    foreach ($side in @("Server", "Client")) {
        $path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$protocol\$side"
        New-Item -Path $path -Force | Out-Null
        Set-ItemProperty -Path $path -Name "Enabled" -Value 0 -Type DWord
        Set-ItemProperty -Path $path -Name "DisabledByDefault" -Value 1 -Type DWord
    }
}

# Ensure TLS 1.2 is explicitly enabled
foreach ($side in @("Server", "Client")) {
    $path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\$side"
    New-Item -Path $path -Force | Out-Null
    Set-ItemProperty -Path $path -Name "Enabled" -Value 1 -Type DWord
    Set-ItemProperty -Path $path -Name "DisabledByDefault" -Value 0 -Type DWord
}

# Enable TLS 1.3 if on Windows Server 2022+
foreach ($side in @("Server", "Client")) {
    $path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\$side"
    New-Item -Path $path -Force | Out-Null
    Set-ItemProperty -Path $path -Name "Enabled" -Value 1 -Type DWord
    Set-ItemProperty -Path $path -Name "DisabledByDefault" -Value 0 -Type DWord
}

# Disable RC4 (all variants)
$rc4Ciphers = @("RC4 40/128", "RC4 56/128", "RC4 64/128", "RC4 128/128")
foreach ($cipher in $rc4Ciphers) {
    $path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\$cipher"
    New-Item -Path $path -Force | Out-Null
    Set-ItemProperty -Path $path -Name "Enabled" -Value 0 -Type DWord
}

# Disable DES and Triple DES
foreach ($cipher in @("DES 56/56", "Triple DES 168")) {
    $path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\$cipher"
    New-Item -Path $path -Force | Out-Null
    Set-ItemProperty -Path $path -Name "Enabled" -Value 0 -Type DWord
}

# Disable MD5 hash algorithm
$path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5"
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name "Enabled" -Value 0 -Type DWord

# Set minimum DH key size to 2048 bits
$path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman"
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name "ServerMinKeyBitLength" -Value 2048 -Type DWord

# View current cipher suite order
Get-TlsCipherSuite | Format-Table Name, CipherSuite, Protocols -AutoSize

# Enable a specific cipher suite with highest priority
Enable-TlsCipherSuite -Name "TLS_AES_256_GCM_SHA384" -Position 0

# Disable a weak cipher suite
Disable-TlsCipherSuite -Name "TLS_RSA_WITH_3DES_EDE_CBC_SHA"

# Check AutoRootUpdate configuration
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate" -ErrorAction SilentlyContinue |
    Select-Object RootDirURL, DisableRootAutoUpdate

# List all explicitly disallowed certificates
Get-ChildItem Cert:\LocalMachine\Disallowed |
    Format-Table Thumbprint, Subject, Issuer -AutoSize

# Verify which root CAs were deployed via GPO
Get-ChildItem "HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates" -ErrorAction SilentlyContinue |
    ForEach-Object { $_.PSChildName }

# Check if EFS is enabled on the machine
$efsConfig = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\EFS" -ErrorAction SilentlyContinue
if ($efsConfig.EfsConfiguration -eq 1) {
    "EFS is disabled by policy"
} else {
    "EFS is enabled (or not configured = enabled by default)"
}

# List EFS certificates for the current user
Get-ChildItem Cert:\CurrentUser\My |
    Where-Object { $_.EnhancedKeyUsageList.ObjectId -contains "1.3.6.1.4.1.311.10.3.4" } |
    Format-Table Subject, Thumbprint, NotAfter -AutoSize

# Disable EFS via registry (equivalent to GPO)
$path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\EFS"
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name "EfsConfiguration" -Value 1 -Type DWord

# Test certificate chain validation for a specific certificate
$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -match "your-server" }
$chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
$chain.Build($cert)
$chain.ChainStatus | Format-Table Status, StatusInformation -AutoSize

# Search for recent Schannel errors
Get-WinEvent -FilterHashtable @{
    LogName = "System"
    ProviderName = "Schannel"
    Level = 2  # Error
    StartTime = (Get-Date).AddDays(-7)
} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Id, Message |
    Format-Table -AutoSize -Wrap

# Verify the server certificate has a matching private key
$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -match "your-server" }
if ($cert.HasPrivateKey) {
    "Private key is present"
} else {
    "MISSING private key - this will cause Schannel event 36871"
}

# Verify protocol configuration is consistent
$schannelBase = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols"
foreach ($protocol in @("TLS 1.0", "TLS 1.1", "TLS 1.2", "TLS 1.3")) {
    foreach ($side in @("Server", "Client")) {
        $path = "$schannelBase\$protocol\$side"
        $props = Get-ItemProperty -Path $path -ErrorAction SilentlyContinue
        if ($props) {
            "$protocol $side : Enabled=$($props.Enabled) DisabledByDefault=$($props.DisabledByDefault)"
        } else {
            "$protocol $side : Not configured (OS default)"
        }
    }
}

# Check if the DPAPI backup key exists on a domain controller
# (run on DC only)
$backupKeyPath = "HKLM:\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb"
if (Test-Path $backupKeyPath) {
    "DPAPI backup key provider is registered"
} else {
    "WARNING: DPAPI backup key provider is missing"
}

# Comprehensive cryptography diagnostic script
Write-Host "=== CERTIFICATE STORES ===" -ForegroundColor Cyan

# Count certificates in each store
$stores = @("Root", "CA", "My", "Disallowed", "TrustedPeople", "TrustedPublisher")
foreach ($store in $stores) {
    $count = (Get-ChildItem "Cert:\LocalMachine\$store" -ErrorAction SilentlyContinue).Count
    Write-Host "  LocalMachine\$store : $count certificates"
}

Write-Host ""
Write-Host "=== EXPIRING CERTIFICATES (next 30 days) ===" -ForegroundColor Cyan
$limit = (Get-Date).AddDays(30)
Get-ChildItem Cert:\LocalMachine\My -ErrorAction SilentlyContinue |
    Where-Object { $_.NotAfter -lt $limit -and $_.NotAfter -gt (Get-Date) } |
    ForEach-Object {
        Write-Host "  [EXPIRING] $($_.Subject) - expires $($_.NotAfter.ToString('yyyy-MM-dd'))" -ForegroundColor Yellow
    }

Write-Host ""
Write-Host "=== SCHANNEL PROTOCOL CONFIGURATION ===" -ForegroundColor Cyan
$schannelBase = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols"
foreach ($protocol in @("SSL 2.0", "SSL 3.0", "TLS 1.0", "TLS 1.1", "TLS 1.2", "TLS 1.3")) {
    $serverPath = "$schannelBase\$protocol\Server"
    $props = Get-ItemProperty -Path $serverPath -ErrorAction SilentlyContinue
    if ($props -and $props.Enabled -eq 0) {
        Write-Host "  $protocol Server : DISABLED" -ForegroundColor Green
    } elseif ($props -and $props.Enabled -eq 1) {
        Write-Host "  $protocol Server : ENABLED" -ForegroundColor White
    } else {
        Write-Host "  $protocol Server : NOT CONFIGURED (OS default)" -ForegroundColor Gray
    }
}

Write-Host ""
Write-Host "=== CIPHER SUITES (top 10) ===" -ForegroundColor Cyan
Get-TlsCipherSuite | Select-Object -First 10 | ForEach-Object {
    Write-Host "  $($_.Name)"
}

Write-Host ""
Write-Host "=== EFS STATUS ===" -ForegroundColor Cyan
$efsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\EFS"
$efsConfig = Get-ItemProperty -Path $efsPath -ErrorAction SilentlyContinue
if ($efsConfig -and $efsConfig.EfsConfiguration -eq 1) {
    Write-Host "  EFS : DISABLED by policy" -ForegroundColor Yellow
} else {
    Write-Host "  EFS : ENABLED (or default)"
}

Write-Host ""
Write-Host "=== DPAPI PROVIDER ===" -ForegroundColor Cyan
$dpapiPath = "HKLM:\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb"
if (Test-Path $dpapiPath) {
    Write-Host "  DPAPI backup provider : PRESENT" -ForegroundColor Green
} else {
    Write-Host "  DPAPI backup provider : NOT FOUND" -ForegroundColor Red
}

Write-Host ""
Write-Host "=== RECENT SCHANNEL ERRORS (last 7 days) ===" -ForegroundColor Cyan
$events = Get-WinEvent -FilterHashtable @{
    LogName = "System"
    ProviderName = "Schannel"
    Level = 2
    StartTime = (Get-Date).AddDays(-7)
} -MaxEvents 5 -ErrorAction SilentlyContinue

if ($events) {
    foreach ($evt in $events) {
        Write-Host "  [$($evt.TimeCreated.ToString('yyyy-MM-dd HH:mm'))] Event $($evt.Id) : $($evt.Message.Substring(0, [Math]::Min(100, $evt.Message.Length)))..." -ForegroundColor Yellow
    }
} else {
    Write-Host "  No Schannel errors in the last 7 days" -ForegroundColor Green
}

Write-Host ""
Write-Host "=== AUTO ROOT UPDATE ===" -ForegroundColor Cyan
$autoUpdate = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate" -ErrorAction SilentlyContinue
if ($autoUpdate) {
    $url = $autoUpdate.RootDirURL
    $disabled = $autoUpdate.DisableRootAutoUpdate
    Write-Host "  URL : $url"
    if ($disabled -eq 1) {
        Write-Host "  AutoRootUpdate : DISABLED" -ForegroundColor Yellow
    } else {
        Write-Host "  AutoRootUpdate : ENABLED" -ForegroundColor Green
    }
} else {
    Write-Host "  AutoRootUpdate : DEFAULT (enabled)" -ForegroundColor Green
}