GPO et SCCM/MECM en coexistence¶

# Detect WSUS GPO conflict on local machine or remote endpoints
# Returns: GPO WUServer value, CCM SUP URL, conflict status
param(
    [string[]]$ComputerName = @($env:COMPUTERNAME),
    [string]$ExpectedSUPUrl = "http://sccm-sup.contoso.local:8530"  # Adapt to your environment
)

function Get-WSUSConflictStatus {
    param([string]$Computer)

    $result = Invoke-Command -ComputerName $Computer -ScriptBlock {
        param($ExpectedSUP)

        # GPO-defined WUServer
        $wuPath   = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
        $gpoWU    = (Get-ItemProperty -Path $wuPath -ErrorAction SilentlyContinue).WUServer
        $useWU    = (Get-ItemProperty -Path $wuPath -ErrorAction SilentlyContinue).UseWUServer
        $gpoWUAU  = (Get-ItemProperty -Path "$wuPath\AU" -ErrorAction SilentlyContinue).UseWUServer

        # CCM-defined SUP (from WMI)
        $ccmSUP = $null
        try {
            $ccmSUP = (Get-WmiObject -Namespace "root\ccm\SoftwareUpdates\WUAHandler" `
                -Class CCM_UpdateSource -ErrorAction SilentlyContinue |
                Where-Object { $_.ContentLocation -like "http*" } |
                Select-Object -First 1).ContentLocation
        } catch { }

        # Conflict detection
        $hasGpoWU   = -not [string]::IsNullOrEmpty($gpoWU)
        $conflict   = $hasGpoWU -and ($gpoWU -ne $ExpectedSUP)

        [PSCustomObject]@{
            Computer        = $env:COMPUTERNAME
            GPO_WUServer    = if ($gpoWU) { $gpoWU } else { "(not set)" }
            GPO_UseWUServer = $useWU
            CCM_SUP         = if ($ccmSUP) { $ccmSUP } else { "(WMI unavailable)" }
            Conflict        = $conflict
            Resolution      = if ($conflict) { "Remove WUServer GPO or align to SUP URL" }
                              elseif ($hasGpoWU) { "OK - GPO matches expected SUP" }
                              else { "OK - No GPO WUServer override" }
        }
    } -ArgumentList $ExpectedSUP -ErrorAction SilentlyContinue

    return $result
}

foreach ($computer in $ComputerName) {
    Get-WSUSConflictStatus -Computer $computer
}

Computer        : WS-001
GPO_WUServer    : http://old-wsus.contoso.local:8530
GPO_UseWUServer : 1
CCM_SUP         : http://sccm-sup.contoso.local:8530
Conflict        : True
Resolution      : Remove WUServer GPO or align to SUP URL

Computer        : WS-002
GPO_WUServer    : (not set)
GPO_UseWUServer :
CCM_SUP         : http://sccm-sup.contoso.local:8530
Conflict        : False
Resolution      : OK - No GPO WUServer override

# Read live CCM client configuration for conflict debugging
# Run locally on the target machine or via Invoke-Command

param([string]$ComputerName = $env:COMPUTERNAME)

Invoke-Command -ComputerName $ComputerName -ScriptBlock {
    # CCM assigned site and management point
    $ccmBase = "HKLM:\SOFTWARE\Microsoft\CCM"
    $ccmSetup = "HKLM:\SOFTWARE\Microsoft\SMS\Client\Configuration\Client Properties"

    $assignedSite = (Get-ItemProperty -Path $ccmBase -EA SilentlyContinue).AssignedSiteCode
    $mp           = (Get-ItemProperty -Path $ccmBase -EA SilentlyContinue).CurrentManagementPoint
    $cacheSize    = (Get-ItemProperty -Path "$ccmBase\CcmCache" -EA SilentlyContinue).Size
    $doGroupId    = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" `
                        -EA SilentlyContinue).DOGroupId

    # Software Update Point from CCM WMI
    $sup = $null
    try {
        $sup = (Get-WmiObject -Namespace "root\ccm" -Class SMS_Authority -EA SilentlyContinue |
                Select-Object -ExpandProperty CurrentManagementPoint)
    } catch { }

    # Check for GPO override on Delivery Optimization
    $doGPODownloadMode = (Get-ItemProperty -Path `
        "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" `
        -EA SilentlyContinue).DODownloadMode

    [PSCustomObject]@{
        Computer            = $env:COMPUTERNAME
        AssignedSite        = $assignedSite
        ManagementPoint     = $mp
        CacheSize_MB        = $cacheSize
        DO_GroupID          = $doGroupId
        DO_GPO_DownloadMode = if ($null -ne $doGPODownloadMode) { $doGPODownloadMode } else { "(not set by GPO)" }
        CCM_SUP             = if ($sup) { $sup } else { "(WMI query failed)" }
    }
}

Computer            : WS-001
AssignedSite        : P01
ManagementPoint     : sccm-mp.contoso.local
CacheSize_MB        : 5120
DO_GroupID          : {a1b2c3d4-0000-0000-0000-000000000001}
DO_GPO_DownloadMode : 2
CCM_SUP             : sccm-mp.contoso.local

# Configure SCCM ccmexec.exe as AppLocker Managed Installer via GPO registry
# This script writes the AppLocker Managed Installer rule to a GPO
# Requires: RSAT GroupPolicy module, GroupPolicy module

#Requires -Modules GroupPolicy

param(
    [Parameter(Mandatory)]
    [string]$GPOName,

    [string]$Domain = (Get-ADDomain).DNSRoot
)

# AppLocker Managed Installer rule XML for ccmexec.exe
# RuleCollection type="ManagedInstaller" is the key — not Exe/Script/etc.
$managedInstallerXml = @'
<AppLockerPolicy Version="1">
  <RuleCollection Type="ManagedInstaller" EnforcementMode="AuditOnly">
    <FilePublisherRule
        Id="6cc9b840-b4ab-4e6d-97f4-12a8a9b3c4e7"
        Name="SCCM CCMExec - Managed Installer"
        Description="Tag all executables installed by SCCM client as trusted"
        UserOrGroupSid="S-1-1-0"
        Action="Allow">
      <Conditions>
        <FilePublisherCondition
            PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US"
            ProductName="SYSTEM CENTER CONFIGURATION MANAGER"
            BinaryName="CCMEXEC.EXE">
          <BinaryVersionRange LowSection="*" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
  </RuleCollection>
</AppLockerPolicy>
'@

# Write rule to target GPO via Set-GPRegistryValue (AppLocker XML via registry)
$gpo = Get-GPO -Name $GPOName -Domain $Domain -ErrorAction Stop

# AppLocker stores its policy as binary XML in registry
$xmlBytes = [System.Text.Encoding]::Unicode.GetBytes($managedInstallerXml)

Set-GPRegistryValue -Guid $gpo.Id -Domain $Domain `
    -Key "HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2\ManagedInstaller" `
    -ValueName "Policy" `
    -Type Binary `
    -Value $xmlBytes

Write-Output "Managed Installer rule written to GPO: $GPOName"
Write-Output "Next step: Enable 'Enabled:Managed Installer' option in your WDAC policy XML."

# Verify WDAC is correctly tagging SCCM-deployed executables as Managed Installer
# Events to look for:
#   3076 (Audit block — would have been blocked without MI tag)
#   3077 (Enforce block — blocked by WDAC)
#   3089 (Allowed by Managed Installer tag)

param(
    [string]$ComputerName = $env:COMPUTERNAME,
    [int]$LastHours = 24
)

Invoke-Command -ComputerName $ComputerName -ScriptBlock {
    param($Hours)

    $since  = (Get-Date).AddHours(-$Hours)
    $logName = "Microsoft-Windows-CodeIntegrity/Operational"

    $events = Get-WinEvent -LogName $logName -ErrorAction SilentlyContinue |
        Where-Object { $_.TimeCreated -ge $since } |
        Where-Object { $_.Id -in @(3076, 3077, 3089) } |
        Select-Object TimeCreated, Id,
            @{N="EventType"; E={
                switch ($_.Id) {
                    3076 { "Audit Block (MI tag bypassed)" }
                    3077 { "ENFORCE Block (WDAC blocked)" }
                    3089 { "Allowed by Managed Installer" }
                }
            }},
            @{N="FilePath"; E={ $_.Properties[1].Value }},
            @{N="SignerInfo"; E={ $_.Properties[4].Value }}

    if (-not $events) {
        Write-Output "No WDAC events in the last $Hours hours. If SCCM deployed software, Managed Installer is working silently (no block events = OK)."
    } else {
        $events | Sort-Object TimeCreated | Format-Table -AutoSize
    }
} -ArgumentList $LastHours

No WDAC events in the last 24 hours.
If SCCM deployed software, Managed Installer is working silently (no block events = OK).

# Create SCCM Configuration Baseline to verify GPO-set registry values
# Requires: ConfigurationManager PowerShell module (on SCCM Primary Site server)
# Adapt $SiteCode and $SiteServer to your environment

#Requires -Modules ConfigurationManager

param(
    [string]$SiteCode    = "P01",
    [string]$SiteServer  = "sccm-primary.contoso.local",
    [string]$BaselineName = "GPO Security Baseline Audit"
)

# Connect to SCCM site
$psDrive = Get-PSDrive -Name $SiteCode -ErrorAction SilentlyContinue
if (-not $psDrive) {
    $null = New-PSDrive -Name $SiteCode -PSProvider CMSite -Root $SiteServer
}
Set-Location "$SiteCode`:\"

# Configuration Items to create
# Each CI checks one registry value that a security GPO should have set
$ciDefinitions = @(
    @{
        Name        = "CI-GPO-LMCompatibilityLevel"
        Description = "Verify LAN Manager authentication level >= 3 (NTLMv2 only)"
        RegHive     = "LocalMachine"
        RegKey      = "SYSTEM\CurrentControlSet\Control\Lsa"
        RegValue    = "LmCompatibilityLevel"
        RegType     = "Integer"
        ExpectedVal = 3
        Operator    = "GreaterEquals"
    },
    @{
        Name        = "CI-GPO-SMBSigning-Client"
        Description = "Verify SMB client signing is required (GPO: Microsoft network client - Digitally sign communications always)"
        RegHive     = "LocalMachine"
        RegKey      = "SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters"
        RegValue    = "RequireSecuritySignature"
        RegType     = "Integer"
        ExpectedVal = 1
        Operator    = "Equals"
    },
    @{
        Name        = "CI-GPO-SMBSigning-Server"
        Description = "Verify SMB server signing is required"
        RegHive     = "LocalMachine"
        RegKey      = "SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
        RegValue    = "RequireSecuritySignature"
        RegType     = "Integer"
        ExpectedVal = 1
        Operator    = "Equals"
    },
    @{
        Name        = "CI-GPO-WUServer-NotSet"
        Description = "Verify WUServer is NOT overriding SCCM SUP (key should be absent or empty)"
        RegHive     = "LocalMachine"
        RegKey      = "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
        RegValue    = "WUServer"
        RegType     = "String"
        ExpectedVal = ""
        Operator    = "Equals"
    },
    @{
        Name        = "CI-GPO-CredentialGuard"
        Description = "Verify Device Guard / Credential Guard is enabled (GPO: Virtualization Based Security)"
        RegHive     = "LocalMachine"
        RegKey      = "SYSTEM\CurrentControlSet\Control\DeviceGuard"
        RegValue    = "EnableVirtualizationBasedSecurity"
        RegType     = "Integer"
        ExpectedVal = 1
        Operator    = "Equals"
    }
)

$createdCIs = @()

foreach ($ci in $ciDefinitions) {
    Write-Host "Creating CI: $($ci.Name)..." -ForegroundColor Cyan

    $newCI = New-CMConfigurationItem `
        -Name        $ci.Name `
        -Description $ci.Description `
        -CreationType WindowsOS

    # Add registry setting rule to CI
    $registrySetting = New-CMRegistryAuditSetting `
        -Hive        $ci.RegHive `
        -Key         $ci.RegKey `
        -ValueName   $ci.RegValue `
        -DataType    $ci.RegType

    $complianceRule = New-CMComplianceRuleValue `
        -InputObject $registrySetting `
        -ExpectedValue $ci.ExpectedVal `
        -RuleOperator  $ci.Operator `
        -NoncomplianceSeverity Warning

    Set-CMConfigurationItem -InputObject $newCI -AddRule $complianceRule | Out-Null

    $createdCIs += $newCI
    Write-Host "  Created: $($ci.Name)" -ForegroundColor Green
}

# Create baseline and add all CIs
Write-Host "`nCreating Configuration Baseline: $BaselineName..." -ForegroundColor Cyan

$baseline = New-CMBaseline `
    -Name        $BaselineName `
    -Description "Audits effective presence of GPO security settings in registry. Does not modify values."

foreach ($ci in $createdCIs) {
    Set-CMBaseline -InputObject $baseline -AddOSConfigurationItem $ci | Out-Null
}

Write-Host "Baseline created. Deploy to a device collection to start compliance reporting." -ForegroundColor Green
Write-Host "Path in console: Assets and Compliance > Compliance Settings > Configuration Baselines > $BaselineName"

# Pull GPO compliance baseline results from SCCM SQL reporting
# Requires: SQL access to SCCM database, read-only is sufficient

param(
    [string]$SccmSqlServer  = "sccm-sql.contoso.local",
    [string]$SccmDatabase   = "CM_P01",
    [string]$BaselineName   = "GPO Security Baseline Audit",
    [int]$TopNonCompliant   = 20
)

$query = @"
SELECT TOP $TopNonCompliant
    v.Name0                      AS ComputerName,
    v.Operating_System_Name_and0 AS OS,
    bc.DisplayName               AS Baseline,
    ci.DisplayName               AS ConfigItem,
    cr.ComplianceStateName       AS Status,
    cr.LastEvalTime              AS LastChecked
FROM v_R_System v
JOIN v_CICurrentComplianceStatus cr ON cr.ResourceID = v.ResourceID
JOIN v_ConfigurationItems ci        ON ci.CI_ID = cr.CI_ID
JOIN v_BaselineTargetedConfigs btc  ON btc.CI_ID = cr.CI_ID
JOIN v_ConfigurationItems bc        ON bc.CI_ID = btc.BaselineCI_ID
WHERE bc.DisplayName = '$BaselineName'
  AND cr.ComplianceStateName != 'Compliant'
ORDER BY cr.LastEvalTime DESC
"@

$connection = New-Object System.Data.SqlClient.SqlConnection
$connection.ConnectionString = "Server=$SccmSqlServer;Database=$SccmDatabase;Integrated Security=True;"
$connection.Open()

$command = $connection.CreateCommand()
$command.CommandText = $query

$adapter = New-Object System.Data.SqlClient.SqlDataAdapter $command
$dataset = New-Object System.Data.DataSet
$adapter.Fill($dataset) | Out-Null
$connection.Close()

$results = $dataset.Tables[0]
if ($results.Rows.Count -eq 0) {
    Write-Output "All machines compliant on baseline: $BaselineName"
} else {
    Write-Output "Non-compliant machines (top $TopNonCompliant):"
    $results | Format-Table -AutoSize
}

# Bootstrap SCCM client via GPO logon script
# Safe: checks for existing installation before running, no persistent MSI rule
# Deploy via: GPO > Computer Configuration > Windows Settings > Scripts > Startup

$ccmSetupPath = "\\sccm-primary.contoso.local\SMS_P01\Client\ccmsetup.exe"
$ccmInstalled = Test-Path "C:\Windows\CCM\CcmExec.exe"

if ($ccmInstalled) {
    # Client already present — nothing to do
    # The SCCM Automatic Client Upgrade handles version updates
    exit 0
}

if (-not (Test-Path $ccmSetupPath)) {
    Write-EventLog -LogName Application -Source "SCCM-Bootstrap" `
        -EventId 9001 -EntryType Error `
        -Message "SCCM client setup not found at: $ccmSetupPath"
    exit 1
}

# Install client — SMSSITECODE and MP parameters for your site
Start-Process -FilePath $ccmSetupPath `
    -ArgumentList "/mp:sccm-mp.contoso.local SMSSITECODE=P01 SMSSLP=sccm-primary.contoso.local" `
    -Wait

Write-EventLog -LogName Application -Source "SCCM-Bootstrap" `
    -EventId 9002 -EntryType Information `
    -Message "SCCM client bootstrap initiated on $env:COMPUTERNAME"

# Verify SCCM client installation and health on target machines
param(
    [string[]]$ComputerName = @($env:COMPUTERNAME)
)

foreach ($computer in $ComputerName) {
    $result = Invoke-Command -ComputerName $computer -ScriptBlock {
        $ccmExe   = Test-Path "C:\Windows\CCM\CcmExec.exe"
        $service  = Get-Service -Name CcmExec -ErrorAction SilentlyContinue
        $version  = if ($ccmExe) {
            (Get-Item "C:\Windows\CCM\CcmExec.exe").VersionInfo.FileVersion
        } else { "Not installed" }

        # Check for MSI error events (1603/1618) in last 24h
        $msiErrors = Get-WinEvent -LogName Application -MaxEvents 200 `
                        -ErrorAction SilentlyContinue |
                     Where-Object { $_.Id -in @(1603, 1618) -and
                                    $_.Message -like "*ccmsetup*" } |
                     Measure-Object | Select-Object -ExpandProperty Count

        [PSCustomObject]@{
            Computer         = $env:COMPUTERNAME
            CCMExePresent    = $ccmExe
            ServiceStatus    = if ($service) { $service.Status } else { "Not found" }
            ClientVersion    = $version
            MSIErrors_24h    = $msiErrors
            GPO_MSI_Conflict = ($msiErrors -gt 0)
        }
    } -ErrorAction SilentlyContinue

    $result
}

Computer         : WS-001
CCMExePresent    : True
ServiceStatus    : Running
ClientVersion    : 5.00.9096.1000
MSIErrors_24h    : 0
GPO_MSI_Conflict : False

# Consolidated GPO/SCCM coexistence health check
# Covers: WSUS conflict, CCM client health, Managed Installer, MSI errors
param(
    [string[]]$ComputerName,
    [string]$ExpectedSUPUrl   = "http://sccm-sup.contoso.local:8530",
    [string]$ExpectedSiteCode = "P01"
)

# Default to all domain computers if not specified
if (-not $ComputerName) {
    $ComputerName = (Get-ADComputer -Filter { OperatingSystem -like "*Windows 10*" -or
                                              OperatingSystem -like "*Windows 11*" } |
                     Select-Object -ExpandProperty Name)
}

$report = foreach ($computer in $ComputerName) {
    Invoke-Command -ComputerName $computer -ScriptBlock {
        param($ExpSUP, $ExpSite)

        # 1. WSUS conflict check
        $wuPath  = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
        $gpoWU   = (Get-ItemProperty $wuPath -EA SilentlyContinue).WUServer
        $useWU   = (Get-ItemProperty $wuPath -EA SilentlyContinue).UseWUServer
        $wsusConflict = (-not [string]::IsNullOrEmpty($gpoWU)) -and ($gpoWU -ne $ExpSUP)

        # 2. SCCM client health
        $ccmSvc    = Get-Service CcmExec -EA SilentlyContinue
        $ccmVer    = if (Test-Path "C:\Windows\CCM\CcmExec.exe") {
                         (Get-Item "C:\Windows\CCM\CcmExec.exe").VersionInfo.FileVersion
                     } else { $null }
        $assignedSite = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\CCM" -EA SilentlyContinue).AssignedSiteCode

        # 3. MSI errors (GPO Software Installation conflict indicator)
        $msiErrors = (Get-WinEvent -LogName Application -MaxEvents 300 -EA SilentlyContinue |
                      Where-Object { $_.Id -in @(1603, 1618) -and
                                     $_.Message -like "*ccm*" } |
                      Measure-Object).Count

        # 4. Managed Installer (AppLocker rule check)
        $alPolicy  = Get-AppLockerPolicy -Effective -EA SilentlyContinue
        $hasMI     = $false
        if ($alPolicy) {
            $hasMI = ($alPolicy.RuleCollections | Where-Object { $_.GetType().Name -like "*Managed*" }).Count -gt 0
        }

        [PSCustomObject]@{
            Computer          = $env:COMPUTERNAME
            WSUS_Conflict     = $wsusConflict
            GPO_WUServer      = if ($gpoWU) { $gpoWU } else { "(none)" }
            CCM_Service       = if ($ccmSvc) { $ccmSvc.Status } else { "Missing" }
            CCM_Version       = if ($ccmVer) { $ccmVer } else { "Not installed" }
            CCM_AssignedSite  = if ($assignedSite) { $assignedSite } else { "Unknown" }
            SiteCode_OK       = ($assignedSite -eq $ExpSite)
            MSI_Errors_24h    = $msiErrors
            ManagedInstaller  = $hasMI
        }
    } -ArgumentList $ExpectedSUPUrl, $ExpectedSiteCode -ErrorAction SilentlyContinue
}

# Summary
$conflicts   = ($report | Where-Object { $_.WSUS_Conflict }).Count
$msiIssues   = ($report | Where-Object { $_.MSI_Errors_24h -gt 0 }).Count
$missingCCM  = ($report | Where-Object { $_.CCM_Service -eq "Missing" }).Count
$noMI        = ($report | Where-Object { -not $_.ManagedInstaller }).Count

Write-Host "`n=== GPO/SCCM Coexistence Health Report ===" -ForegroundColor Cyan
Write-Host "Total machines checked : $($report.Count)"
Write-Host "WSUS conflicts         : $conflicts" -ForegroundColor $(if ($conflicts) { "Red" } else { "Green" })
Write-Host "MSI install errors     : $msiIssues" -ForegroundColor $(if ($msiIssues) { "Yellow" } else { "Green" })
Write-Host "Missing CCM client     : $missingCCM" -ForegroundColor $(if ($missingCCM) { "Red" } else { "Green" })
Write-Host "No Managed Installer   : $noMI" -ForegroundColor $(if ($noMI) { "Yellow" } else { "Green" })
Write-Host ""

$report | Sort-Object WSUS_Conflict, CCM_Service | Format-Table -AutoSize