Sécurité endpoint via GPO¶

# Verify Defender GPO settings are applied on remote endpoints
$computers = Get-ADComputer -Filter { OperatingSystem -like "*Windows*" } |
    Select-Object -ExpandProperty Name

foreach ($computer in $computers) {
    $result = Invoke-Command -ComputerName $computer -ScriptBlock {
        $defenderPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
        $rtPath       = "$defenderPath\Real-Time Protection"

        [PSCustomObject]@{
            Computer              = $env:COMPUTERNAME
            DisableAntiSpyware    = (Get-ItemProperty $defenderPath -EA SilentlyContinue).DisableAntiSpyware
            DisableRealtimeMonitor = (Get-ItemProperty $rtPath -EA SilentlyContinue).DisableRealtimeMonitoring
            DisableBehaviorMonitor = (Get-ItemProperty $rtPath -EA SilentlyContinue).DisableBehaviorMonitoring
            MAPSReporting         = (Get-ItemProperty "$defenderPath\Spynet" -EA SilentlyContinue).MAPSReporting
            DefenderStatus        = (Get-MpComputerStatus).AntivirusEnabled
        }
    } -ErrorAction SilentlyContinue

    $result
}

# Deploy all 16 ASR rules in Audit mode (2) via GPO registry settings
$gpoName = "ASR-Audit-All"
$domain  = (Get-ADDomain).DNSRoot

# Create GPO if not exists
if (-not (Get-GPO -Name $gpoName -ErrorAction SilentlyContinue)) {
    New-GPO -Name $gpoName -Domain $domain -Comment "ASR rules — Audit phase"
}

# Registry path for ASR rules
$regPath = "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules"

# All 16 ASR rule GUIDs
$asrRules = @(
    "BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550",
    "D4F940AB-401B-4EFC-AADC-AD5F3C50688A",
    "3B576869-A4EC-4529-8536-B80A7769E899",
    "75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84",
    "D3E037E1-3EB8-44C8-A917-57927947596D",
    "5BEB7EFE-FD9A-4556-801D-275E5FFC04CC",
    "92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B",
    "01443614-CD74-433A-B99E-2ECDC07BFC25",
    "C1DB55AB-C21A-4637-BB3F-A12568109D35",
    "9E6C4E1F-7D60-472F-BA1A-A39EF669E4B0",
    "D1E49AAC-8F56-4280-B9BA-993A6D77406C",
    "B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4",
    "26190899-1602-49E8-8B27-EB1D0A1CE869",
    "7674BA52-37EB-4A4F-A9A1-F0F9A1619A2C",
    "E6DB77E5-3DF2-4CF1-B95A-636979351E5B",
    "56A863A9-875E-4185-98A7-B882C64B5CE5"
)

# Enable ASR feature via GPO
Set-GPRegistryValue -Name $gpoName -Key $regPath -ValueName "." `
    -Type String -Value "" | Out-Null

# Set parent key to enable ASR
Set-GPRegistryValue -Name $gpoName `
    -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR" `
    -ValueName "ExploitGuard_ASR_Rules" -Type DWord -Value 1

# Set all rules to Audit mode (2)
foreach ($guid in $asrRules) {
    Set-GPRegistryValue -Name $gpoName -Key $regPath `
        -ValueName $guid -Type String -Value "2"
    Write-Host "Set $guid -> Audit (2)"
}

# Switch specific stable ASR rules to Block mode (1)
# Only rules validated during audit phase — adjust the list per your audit findings
$gpoName = "ASR-Block-Stable"
$regPath = "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules"

# Rules confirmed stable in your environment — example subset
$stableRules = @(
    "9E6C4E1F-7D60-472F-BA1A-A39EF669E4B0",  # Block LSASS credential stealing
    "C1DB55AB-C21A-4637-BB3F-A12568109D35",  # Advanced ransomware protection
    "56A863A9-875E-4185-98A7-B882C64B5CE5"   # Block vulnerable signed drivers
)

foreach ($guid in $stableRules) {
    Set-GPRegistryValue -Name $gpoName -Key $regPath `
        -ValueName $guid -Type String -Value "1"
    Write-Host "Set $guid -> Block (1)"
}

# Collect ASR events from the last 7 days across remote endpoints
$computers = Get-ADComputer -Filter { OperatingSystem -like "*Windows*" } |
    Select-Object -ExpandProperty Name

$report = foreach ($computer in $computers) {
    Invoke-Command -ComputerName $computer -ErrorAction SilentlyContinue -ScriptBlock {
        Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" `
            -FilterXPath "*[System[(EventID=1121 or EventID=1122) and
                TimeCreated[timediff(@SystemTime) <= 604800000]]]" `
            -ErrorAction SilentlyContinue |
        ForEach-Object {
            $xml = [xml]$_.ToXml()
            $data = $xml.Event.EventData.Data
            [PSCustomObject]@{
                Computer  = $env:COMPUTERNAME
                Time      = $_.TimeCreated
                EventID   = $_.Id
                RuleGUID  = ($data | Where-Object { $_.Name -eq "ID" }).'#text'
                File      = ($data | Where-Object { $_.Name -eq "Path" }).'#text'
                ProcessID = ($data | Where-Object { $_.Name -eq "ProcessID" }).'#text'
            }
        }
    }
}

$report | Sort-Object Time -Descending | Format-Table -AutoSize

# Check Credential Guard status on local or remote machines
$computers = @("WKS-001", "WKS-002")  # or Get-ADComputer query

Invoke-Command -ComputerName $computers -ScriptBlock {
    $info = Get-ComputerInfo -Property `
        DeviceGuardVirtualizationBasedSecurityStatus,
        DeviceGuardCredentialGuardStatus,
        DeviceGuardSecurityServicesRunning

    [PSCustomObject]@{
        Computer         = $env:COMPUTERNAME
        VBS_Status       = $info.DeviceGuardVirtualizationBasedSecurityStatus
        CredGuard_Status = $info.DeviceGuardCredentialGuardStatus
        ServicesRunning  = $info.DeviceGuardSecurityServicesRunning -join ", "
    }
}

# Deploy Exploit Protection XML configuration — used as a GPO startup script
$xmlSource = "\\contoso.com\SYSVOL\contoso.com\ExploitProtection\config.xml"
$localPath  = "C:\Windows\Temp\ep-config.xml"

# Copy XML locally to avoid UNC dependency at runtime
Copy-Item -Path $xmlSource -Destination $localPath -Force

# Apply system-wide + per-app configuration
Set-ProcessMitigation -PolicyFilePath $localPath

Write-EventLog -LogName Application -Source "GPO-Security" -EventId 5100 `
    -EntryType Information -Message "Exploit Protection policy applied from $xmlSource"

# Export current Exploit Protection settings to XML
$outputPath = "C:\Temp\ep-baseline-$(Get-Date -Format 'yyyyMMdd').xml"
Get-ProcessMitigation -RegistryConfigFilePath $outputPath
Write-Host "Configuration exported to: $outputPath"

# Check Windows Hello for Business provisioning status on endpoints
$computers = Get-ADComputer -Filter { OperatingSystem -like "*Windows 1*" } |
    Select-Object -ExpandProperty Name

$results = Invoke-Command -ComputerName $computers -ErrorAction SilentlyContinue -ScriptBlock {
    # Check registry policy
    $wHfBPath = "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork"
    $enabled  = (Get-ItemProperty $wHfBPath -EA SilentlyContinue).Enabled

    # Check NGC key provisioning (user-level, run as system may not see user keys)
    $ngcPath  = "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\NGC"
    $ngcExists = Test-Path $ngcPath

    [PSCustomObject]@{
        Computer    = $env:COMPUTERNAME
        PolicyEnabled = $enabled
        NgcFolder   = $ngcExists
        TPMPresent  = (Get-Tpm -ErrorAction SilentlyContinue).TpmPresent
        TPMReady    = (Get-Tpm -ErrorAction SilentlyContinue).TpmReady
    }
}

$results | Format-Table -AutoSize

Get-CimInstance Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
    Select-Object LsaCfgFlags, SecurityServicesConfigured, SecurityServicesRunning

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name RunAsPPL -ErrorAction SilentlyContinue

# Consolidated endpoint security audit — Defender, ASR, Credential Guard, WHfB
$computers = Get-ADComputer -Filter { OperatingSystem -like "*Windows*" } |
    Select-Object -First 10 -ExpandProperty Name

$audit = Invoke-Command -ComputerName $computers -ErrorAction SilentlyContinue -ScriptBlock {

    # Defender status
    $mpStatus = Get-MpComputerStatus -ErrorAction SilentlyContinue

    # ASR rules count
    $asrPath  = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules"
    $asrCount = (Get-Item $asrPath -EA SilentlyContinue)?.GetValueNames().Count

    # Credential Guard
    $cgStatus = (Get-ComputerInfo -Property DeviceGuardCredentialGuardStatus `
        -ErrorAction SilentlyContinue).DeviceGuardCredentialGuardStatus

    # WHfB policy
    $wHfBEnabled = (Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\PassportForWork" `
        -EA SilentlyContinue).Enabled

    [PSCustomObject]@{
        Computer         = $env:COMPUTERNAME
        DefenderEnabled  = $mpStatus.AntivirusEnabled
        RealTimeProtect  = $mpStatus.RealTimeProtectionEnabled
        ASRRulesDeployed = $asrCount
        CredentialGuard  = $cgStatus
        WHfBPolicy       = $wHfBEnabled
        TPMReady         = (Get-Tpm -EA SilentlyContinue).TpmReady
    }
}

$audit | Sort-Object Computer | Format-Table -AutoSize

# Export to CSV for compliance reporting
$audit | Export-Csv -Path ".\endpoint-security-audit-$(Get-Date -Format 'yyyyMMdd').csv" `
    -NoTypeInformation -Encoding UTF8
Write-Host "Audit exported to CSV."