Automatisation et CI/CD pour les GPO¶

# Validate all GPO XML exports — runs on Windows runners
$errors = 0

Get-ChildItem -Path ".\gpo-backups" -Recurse -Filter "*.xml" | ForEach-Object {
    try {
        [xml](Get-Content $_.FullName -Raw) | Out-Null
    } catch {
        Write-Error "INVALID XML: $($_.FullName) — $_"
        $errors++
    }
}

if ($errors -gt 0) {
    Write-Error "XML validation failed: $errors file(s) invalid"
    exit 1
}

Write-Host "All XML files passed validation"

# Export a GPO's registry.pol files to LGPO text format
# Prerequisites: LGPO.exe in $LgpoPath

param(
    [Parameter(Mandatory)]
    [string]$GpoName,

    [string]$OutputPath = ".\gpo-text",
    [string]$LgpoPath   = "C:\Tools\LGPO\LGPO.exe"
)

$gpo = Get-GPO -Name $GpoName -ErrorAction Stop
$gpoGuid = $gpo.Id.ToString("B")

# Locate the GPO's registry.pol files in SYSVOL
$sysvolBase = "\\$env:USERDNSDOMAIN\SYSVOL\$env:USERDNSDOMAIN\Policies\$gpoGuid"
$machinePol = Join-Path $sysvolBase "Machine\Registry.pol"
$userPol    = Join-Path $sysvolBase "User\Registry.pol"

$destFolder = Join-Path $OutputPath $GpoName
New-Item -ItemType Directory -Path $destFolder -Force | Out-Null

# Machine policy
if (Test-Path $machinePol) {
    & $LgpoPath /parse /m $machinePol | Set-Content "$destFolder\machine.txt" -Encoding UTF8
    Write-Host "Exported machine policy: $destFolder\machine.txt"
}

# User policy
if (Test-Path $userPol) {
    & $LgpoPath /parse /u $userPol | Set-Content "$destFolder\user.txt" -Encoding UTF8
    Write-Host "Exported user policy: $destFolder\user.txt"
}

# Export all GPO XML reports for Git versioning
param(
    [string]$OutputPath = ".\gpo-xml-reports"
)

New-Item -ItemType Directory -Path $OutputPath -Force | Out-Null

Get-GPO -All | ForEach-Object {
    $safeName = $_.DisplayName -replace '[\\/:*?"<>|]', '_'
    $outFile   = Join-Path $OutputPath "$safeName.xml"

    Get-GPOReport -Guid $_.Id -ReportType Xml |
        Set-Content -Path $outFile -Encoding UTF8

    Write-Host "Exported: $safeName.xml"
}

Write-Host "Done. $((Get-GPO -All).Count) GPO reports exported to $OutputPath"

# Nightly GPO backup with Git auto-commit
# Schedule: Task Scheduler, daily at 23:00
# Run as: Domain Admin service account with Git credentials configured
# Prerequisites: Git in PATH, repo cloned at $RepoPath

param(
    [string]$RepoPath    = "C:\GPO-Git-Repo",
    [string]$BackupSubdir = "gpo-backups",
    [string]$TextSubdir   = "gpo-text",
    [string]$LgpoPath    = "C:\Tools\LGPO\LGPO.exe",
    [string]$LogPath     = "C:\Logs\gpo-git-backup.log"
)

function Write-Log {
    param([string]$Message, [string]$Level = "INFO")
    $entry = "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') [$Level] $Message"
    Add-Content -Path $LogPath -Value $entry
    Write-Host $entry
}

$date       = Get-Date -Format "yyyy-MM-dd"
$backupPath = Join-Path $RepoPath $BackupSubdir $date
$textPath   = Join-Path $RepoPath $TextSubdir

Write-Log "Starting nightly GPO backup — date: $date"

# --- Pull latest changes to avoid conflicts ---
Push-Location $RepoPath
try {
    git pull origin main --quiet
    if ($LASTEXITCODE -ne 0) { Write-Log "git pull failed — continuing anyway" -Level "WARN" }
} finally {
    Pop-Location
}

# --- Backup all GPOs ---
New-Item -ItemType Directory -Path $backupPath -Force | Out-Null

try {
    $results = Backup-GPO -All -Path $backupPath -ErrorAction Stop
    Write-Log "Backed up $($results.Count) GPOs"

    $results | Select-Object DisplayName, Id, BackupDirectory |
        Export-Csv "$backupPath\manifest.csv" -NoTypeInformation
} catch {
    Write-Log "Backup-GPO failed: $_" -Level "ERROR"
    exit 1
}

# --- Export LGPO text format for diff-friendly history ---
New-Item -ItemType Directory -Path $textPath -Force | Out-Null

if (Test-Path $LgpoPath) {
    Get-GPO -All | ForEach-Object {
        $gpoGuid    = $_.Id.ToString("B")
        $safeName   = $_.DisplayName -replace '[\\/:*?"<>|]', '_'
        $destFolder = Join-Path $textPath $safeName
        New-Item -ItemType Directory -Path $destFolder -Force | Out-Null

        $sysvolBase = "\\$env:USERDNSDOMAIN\SYSVOL\$env:USERDNSDOMAIN\Policies\$gpoGuid"

        $machinePol = Join-Path $sysvolBase "Machine\Registry.pol"
        $userPol    = Join-Path $sysvolBase "User\Registry.pol"

        if (Test-Path $machinePol) {
            & $LgpoPath /parse /m $machinePol |
                Set-Content "$destFolder\machine.txt" -Encoding UTF8
        }
        if (Test-Path $userPol) {
            & $LgpoPath /parse /u $userPol |
                Set-Content "$destFolder\user.txt" -Encoding UTF8
        }
    }
    Write-Log "LGPO text exports complete"
} else {
    Write-Log "LGPO.exe not found at $LgpoPath — skipping text export" -Level "WARN"
}

# --- Git commit if there are changes ---
Push-Location $RepoPath
try {
    git add "$BackupSubdir/$date" "$TextSubdir" 2>&1 | Out-Null

    $status = git status --porcelain
    if ($status) {
        $commitMsg = "chore: nightly GPO backup $date — $($results.Count) GPOs"
        git commit -m $commitMsg --author="GPO-Bot <gpo-bot@domain.local>"

        if ($LASTEXITCODE -eq 0) {
            Write-Log "Git commit created: $commitMsg"
        } else {
            Write-Log "git commit failed" -Level "ERROR"
        }
    } else {
        Write-Log "No changes detected — no commit needed"
    }
} finally {
    Pop-Location
}

Write-Log "Nightly backup complete"

# Pester test suite for SEC-Postes-Baseline GPO
# Run AFTER applying the GPO on the test VM via LGPO.exe
# Requires: Pester 5.x, run as Administrator on target machine

BeforeAll {
    # Allow up to 90 seconds for GP to apply before running tests
    $maxWait   = 90
    $elapsed   = 0
    $gpresult  = $null

    while ($elapsed -lt $maxWait) {
        $gpresult = gpresult /r 2>&1
        if ($gpresult -match "SEC-Postes-Baseline") { break }
        Start-Sleep -Seconds 10
        $elapsed += 10
    }
}

Describe "SEC-Postes-Baseline — Registry validation" {

    Context "Windows Defender settings" {

        It "Defender real-time protection is enabled (DisableAntiSpyware = 0)" {
            $value = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" `
                                      -Name "DisableAntiSpyware" -ErrorAction SilentlyContinue
            $value.DisableAntiSpyware | Should -Be 0
        }

        It "Cloud protection level is set to Advanced (MpCloudBlockLevel = 2)" {
            $value = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" `
                                      -Name "MpCloudBlockLevel" -ErrorAction SilentlyContinue
            $value.MpCloudBlockLevel | Should -Be 2
        }
    }

    Context "Windows Update settings" {

        It "Auto-update is not disabled (NoAutoUpdate = 0)" {
            $value = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" `
                                      -Name "NoAutoUpdate" -ErrorAction SilentlyContinue
            $value.NoAutoUpdate | Should -Be 0
        }

        It "Active hours maximum range is set (ActiveHoursMaxRange = 12)" {
            $value = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" `
                                      -Name "ActiveHoursMaxRange" -ErrorAction SilentlyContinue
            $value.ActiveHoursMaxRange | Should -Be 12
        }
    }

    Context "Network security" {

        It "LAN Manager authentication level is set to NTLMv2 only (LmCompatibilityLevel = 5)" {
            $value = Get-ItemProperty `
                -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
                -Name "LmCompatibilityLevel" -ErrorAction SilentlyContinue
            $value.LmCompatibilityLevel | Should -Be 5
        }
    }
}

# Deploy ADMX files from Git repo to SYSVOL Central Store
# Compares SHA256 hashes — only copies changed files
# Requires: Domain Admin, write access to SYSVOL

param(
    [string]$SourcePath = ".\admx\PolicyDefinitions",
    [string]$SysvolPath = "\\$env:USERDNSDOMAIN\SYSVOL\$env:USERDNSDOMAIN\Policies\PolicyDefinitions",
    [switch]$DryRun,
    [string]$LogPath    = "C:\Logs\admx-deploy.log"
)

function Write-Log {
    param([string]$Message, [string]$Level = "INFO")
    $entry = "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') [$Level] $Message"
    Add-Content -Path $LogPath -Value $entry
    Write-Host $entry
}

function Get-FileHash256 {
    param([string]$Path)
    if (-not (Test-Path $Path)) { return $null }
    return (Get-FileHash -Path $Path -Algorithm SHA256).Hash
}

Write-Log "Starting ADMX deployment$(if ($DryRun) { ' [DRY RUN]' })"
Write-Log "Source: $SourcePath"
Write-Log "Target: $SysvolPath"

if (-not (Test-Path $SysvolPath)) {
    Write-Log "Central Store path not found: $SysvolPath" -Level "ERROR"
    exit 1
}

$deployed = 0
$skipped  = 0
$errors   = 0

Get-ChildItem -Path $SourcePath -Recurse -File | ForEach-Object {
    $relativePath = $_.FullName.Substring($SourcePath.Length).TrimStart('\')
    $targetPath   = Join-Path $SysvolPath $relativePath

    $sourceHash = Get-FileHash256 $_.FullName
    $targetHash = Get-FileHash256 $targetPath

    if ($sourceHash -eq $targetHash) {
        $skipped++
        return
    }

    $action = if ($targetHash) { "UPDATE" } else { "ADD" }
    Write-Log "$action $relativePath"

    if (-not $DryRun) {
        try {
            $targetDir = Split-Path $targetPath -Parent
            if (-not (Test-Path $targetDir)) {
                New-Item -ItemType Directory -Path $targetDir -Force | Out-Null
            }
            Copy-Item -Path $_.FullName -Destination $targetPath -Force
            $deployed++
        } catch {
            Write-Log "Failed to copy $relativePath : $_" -Level "ERROR"
            $errors++
        }
    } else {
        $deployed++
    }
}

Write-Log "Deployment complete — Deployed: $deployed, Skipped (unchanged): $skipped, Errors: $errors"

if ($errors -gt 0) { exit 1 }

# Detect ADMX namespace conflicts in the PolicyDefinitions folder
# A conflict occurs when two .admx files declare the same namespace URI

param(
    [string]$AdmxPath = ".\admx\PolicyDefinitions"
)

$namespaceMap = @{}
$conflicts    = @()

Get-ChildItem -Path $AdmxPath -Filter "*.admx" | ForEach-Object {
    try {
        [xml]$content = Get-Content $_.FullName -Raw

        $targetNamespace = $content.policyDefinitions.policyNamespaces.target.namespace

        if (-not $targetNamespace) { return }

        if ($namespaceMap.ContainsKey($targetNamespace)) {
            $conflicts += [PSCustomObject]@{
                Namespace  = $targetNamespace
                File1      = $namespaceMap[$targetNamespace]
                File2      = $_.Name
            }
        } else {
            $namespaceMap[$targetNamespace] = $_.Name
        }
    } catch {
        Write-Warning "Could not parse $($_.Name): $_"
    }
}

if ($conflicts.Count -gt 0) {
    Write-Error "NAMESPACE CONFLICTS DETECTED:"
    $conflicts | Format-Table -AutoSize
    exit 1
}

Write-Host "No namespace conflicts detected — $($namespaceMap.Count) namespaces checked"

# Deploy a GPO link to the staging ring OU only
# Staging ring = a representative sample OU (10% of fleet, mixed models)
# After 24h monitoring, a human approves promotion to production

param(
    [Parameter(Mandatory)]
    [string]$GpoName,

    [string]$StagingOu    = "OU=Staging-Ring,OU=Computers,DC=domain,DC=local",
    [string]$ProductionOu = "OU=Computers,DC=domain,DC=local",

    [ValidateSet("Staging", "Production")]
    [string]$Target = "Staging"
)

switch ($Target) {
    "Staging" {
        Write-Host "Linking '$GpoName' to staging ring: $StagingOu"
        New-GPLink -Name $GpoName -Target $StagingOu -LinkEnabled Yes -ErrorAction Stop
        Write-Host "Staging link created. Monitor for 24h before promoting to production."
    }

    "Production" {
        Write-Host "Promoting '$GpoName' to production: $ProductionOu"

        # Verify staging link still exists and GPO is unchanged
        $stagingLink = Get-GPInheritance -Target $StagingOu |
            Select-Object -ExpandProperty GpoLinks |
            Where-Object { $_.DisplayName -eq $GpoName }

        if (-not $stagingLink) {
            Write-Error "Staging link not found — cannot promote without completed staging"
            exit 1
        }

        New-GPLink -Name $GpoName -Target $ProductionOu -LinkEnabled Yes -ErrorAction Stop
        Write-Host "Production link created."
    }
}

# Verify the staging ring has been running for at least 24 hours
# Call this script as a gate before production deployment

param(
    [string]$GpoName,
    [string]$StagingOu      = "OU=Staging-Ring,OU=Computers,DC=domain,DC=local",
    [int]$MinimumHours      = 24
)

$stagingLinks = Get-GPInheritance -Target $StagingOu |
    Select-Object -ExpandProperty GpoLinks |
    Where-Object { $_.DisplayName -eq $GpoName }

if (-not $stagingLinks) {
    Write-Error "GPO '$GpoName' is not linked to staging ring. Staging required before production."
    exit 1
}

# Check GPO version timestamp as proxy for staging start
$gpo = Get-GPO -Name $GpoName
$modificationTime = $gpo.ModificationTime
$stagingAge = (Get-Date) - $modificationTime

if ($stagingAge.TotalHours -lt $MinimumHours) {
    $remaining = [math]::Ceiling($MinimumHours - $stagingAge.TotalHours)
    Write-Error "Staging ring has been active for only $([math]::Floor($stagingAge.TotalHours))h. Minimum: ${MinimumHours}h. Wait ${remaining}h more."
    exit 1
}

Write-Host "Staging maturity check passed: $([math]::Floor($stagingAge.TotalHours))h >= ${MinimumHours}h required"

# Post-deployment verification: compare Git state with live domain GPOs
# Run after each production deployment

param(
    [string]$RepoTextPath = "C:\GPO-Git-Repo\gpo-text",
    [string]$LgpoPath     = "C:\Tools\LGPO\LGPO.exe"
)

$driftDetected = $false

Get-GPO -All | ForEach-Object {
    $gpo        = $_
    $safeName   = $gpo.DisplayName -replace '[\\/:*?"<>|]', '_'
    $repoFolder = Join-Path $RepoTextPath $safeName
    $gpoGuid    = $gpo.Id.ToString("B")

    if (-not (Test-Path $repoFolder)) {
        Write-Warning "GPO '$($gpo.DisplayName)' exists in domain but NOT in Git repo"
        $driftDetected = $true
        return
    }

    # Export current live state to temp
    $tempFolder = Join-Path $env:TEMP "gpo-verify-$safeName"
    New-Item -ItemType Directory -Path $tempFolder -Force | Out-Null

    $sysvolBase = "\\$env:USERDNSDOMAIN\SYSVOL\$env:USERDNSDOMAIN\Policies\$gpoGuid"
    $machinePol = Join-Path $sysvolBase "Machine\Registry.pol"

    if (Test-Path $machinePol) {
        & $LgpoPath /parse /m $machinePol |
            Set-Content "$tempFolder\machine.txt" -Encoding UTF8

        $repoContent  = Get-Content "$repoFolder\machine.txt" -Raw -ErrorAction SilentlyContinue
        $liveContent  = Get-Content "$tempFolder\machine.txt" -Raw

        if ($repoContent -ne $liveContent) {
            Write-Warning "DRIFT: '$($gpo.DisplayName)' machine policy differs from Git"
            $driftDetected = $true
        }
    }

    Remove-Item $tempFolder -Recurse -Force
}

if ($driftDetected) {
    Write-Error "Drift detected — review differences and commit or revert"
    exit 1
}

Write-Host "All GPOs match Git state — no drift detected"