Sécurité des GPO elles-mêmes¶

# List all accounts with GPO edit rights across all GPOs in the domain
Import-Module GroupPolicy

$editRights = @("GpoEdit", "GpoEditDeleteModifySecurity")

Get-GPO -All | ForEach-Object {
    $gpo = $_
    Get-GPPermissions -Guid $gpo.Id -All | Where-Object {
        $_.Permission -in $editRights
    } | ForEach-Object {
        [PSCustomObject]@{
            GPOName    = $gpo.DisplayName
            GUID       = $gpo.Id
            Trustee    = $_.Trustee.Name
            TrusteeType = $_.Trustee.SidType
            Permission = $_.Permission
            Inherited  = $_.Inherited
        }
    }
} | Sort-Object GPOName, Trustee

# Generate a full GPO permission report and export to CSV
Import-Module GroupPolicy

$reportPath = "C:\Temp\GPO-ACL-Report-$(Get-Date -Format 'yyyyMMdd-HHmm').csv"
$allPermissions = @()

$allGPOs = Get-GPO -All

foreach ($gpo in $allGPOs) {
    $perms = Get-GPPermissions -Guid $gpo.Id -All
    foreach ($perm in $perms) {
        $allPermissions += [PSCustomObject]@{
            GPOName      = $gpo.DisplayName
            GUID         = $gpo.Id.ToString()
            LinkedOU     = ($gpo | Get-GPOLinks | Select-Object -ExpandProperty Target -EA SilentlyContinue) -join "; "
            Trustee      = $perm.Trustee.Name
            TrusteeSID   = $perm.Trustee.Sid
            TrusteeType  = $perm.Trustee.SidType
            Permission   = $perm.Permission.ToString()
            Inherited    = $perm.Inherited
            LastModified = $gpo.ModificationTime.ToString("yyyy-MM-dd HH:mm")
        }
    }
}

$allPermissions | Export-Csv -Path $reportPath -NoTypeInformation -Encoding UTF8
Write-Host "Permission report exported: $reportPath ($($allPermissions.Count) entries)"

# Alert on any account with GPO edit rights outside the approved list
Import-Module GroupPolicy

# Adjust this list to match your environment's approved delegation groups
$approvedTrustees = @(
    "CONTOSO\Domain Admins",
    "CONTOSO\GPO-Editors",
    "CONTOSO\GPO-Admins",
    "CONTOSO\Enterprise Admins"
)

$editRights = @("GpoEdit", "GpoEditDeleteModifySecurity")

$unexpected = Get-GPO -All | ForEach-Object {
    $gpo = $_
    Get-GPPermissions -Guid $gpo.Id -All | Where-Object {
        $_.Permission -in $editRights -and
        $_.Trustee.Name -notin $approvedTrustees
    } | ForEach-Object {
        [PSCustomObject]@{
            GPOName    = $gpo.DisplayName
            Trustee    = $_.Trustee.Name
            TrusteeType = $_.Trustee.SidType
            Permission = $_.Permission
        }
    }
}

if ($unexpected) {
    Write-Warning "UNEXPECTED GPO EDITORS DETECTED: $($unexpected.Count) entries"
    $unexpected | Format-Table -AutoSize
} else {
    Write-Host "All GPO editors are within the approved list."
}

# Remove CREATOR OWNER permissions from all GPOs (production hardening)
Import-Module GroupPolicy

Get-GPO -All | ForEach-Object {
    $gpo = $_
    $creatorOwnerPerms = Get-GPPermissions -Guid $gpo.Id -All |
        Where-Object { $_.Trustee.Name -eq "CREATOR OWNER" }

    if ($creatorOwnerPerms) {
        Write-Host "Removing CREATOR OWNER from: $($gpo.DisplayName)"
        Set-GPPermissions -Guid $gpo.Id `
            -TargetName "CREATOR OWNER" `
            -TargetType "Group" `
            -PermissionLevel "None"
    }
}

Write-Host "CREATOR OWNER cleanup complete."

# Audit NTFS permissions on SYSVOL GPO folders and flag unexpected write access
$domain     = $env:USERDNSDOMAIN
$sysvolBase = "\\$domain\SYSVOL\$domain\Policies"

# Identities that are allowed write access
$allowedWriters = @(
    "NT AUTHORITY\SYSTEM",
    "BUILTIN\Administrators",
    "CONTOSO\Domain Admins",
    "CONTOSO\Enterprise Admins"
)

$report = Get-GPO -All | ForEach-Object {
    $gpo     = $_
    $gpoPath = "$sysvolBase\{$($gpo.Id)}"

    if (-not (Test-Path $gpoPath)) {
        Write-Warning "SYSVOL folder missing for GPO: $($gpo.DisplayName) [{$($gpo.Id)}]"
        return
    }

    $acl = Get-Acl -Path $gpoPath
    foreach ($ace in $acl.Access) {
        $isWrite = $ace.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::Write
        if ($isWrite -and $ace.IdentityReference.Value -notin $allowedWriters) {
            [PSCustomObject]@{
                GPOName    = $gpo.DisplayName
                GUID       = $gpo.Id
                Path       = $gpoPath
                Identity   = $ace.IdentityReference.Value
                Rights     = $ace.FileSystemRights.ToString()
                AccessType = $ace.AccessControlType.ToString()
                Inherited  = $ace.IsInherited
            }
        }
    }
}

if ($report) {
    Write-Warning "Unexpected SYSVOL write permissions detected: $($report.Count) entries"
    $report | Format-Table -AutoSize
    $report | Export-Csv "C:\Temp\SYSVOL-ACL-Issues-$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
} else {
    Write-Host "SYSVOL permissions are clean — no unexpected write access found."
}

# Remove unexpected write access from a SYSVOL GPO folder
# Run as Domain Admin on a DC or from an admin workstation with DC connectivity

$domain  = $env:USERDNSDOMAIN
$guid    = "{A1B2C3D4-xxxx-xxxx-xxxx-xxxxxxxxxxxx}"  # replace with actual GUID
$gpoPath = "\\$domain\SYSVOL\$domain\Policies\$guid"
$account = "CONTOSO\svc-deploy"

# Remove all permissions for the account
icacls $gpoPath /remove:g "$account" /T /C

Write-Host "Removed permissions for $account on $gpoPath"

# Verify the change
$acl = Get-Acl -Path $gpoPath
$acl.Access | Where-Object { $_.IdentityReference.Value -eq $account } |
    Format-Table IdentityReference, FileSystemRights, AccessControlType

# Detect gPCFileSysPath modifications — primary GPO Hijacking indicator
$dcPDC     = (Get-ADDomain).PDCEmulator
$startDate = (Get-Date).AddDays(-7)

$events = Get-WinEvent -ComputerName $dcPDC -FilterHashtable @{
    LogName   = 'Security'
    Id        = 5136
    StartTime = $startDate
} -ErrorAction SilentlyContinue

$hijackAttempts = $events | Where-Object {
    $_.Message -match "groupPolicyContainer" -and
    $_.Message -match "gPCFileSysPath"
}

if ($hijackAttempts) {
    Write-Warning "CRITICAL: gPCFileSysPath modification detected — possible GPO Hijacking"

    foreach ($evt in $hijackAttempts) {
        # Extract relevant fields from the event message
        $lines      = $evt.Message -split "`n"
        $objectName = ($lines | Where-Object { $_ -match "Object Name:" })     -replace ".*Object Name:\s*", ""
        $newValue   = ($lines | Where-Object { $_ -match "New Value:" })       -replace ".*New Value:\s*", ""
        $account    = ($lines | Where-Object { $_ -match "Account Name:" })[0] -replace ".*Account Name:\s*", ""

        Write-Host ("-" * 60)
        Write-Host "Time      : $($evt.TimeCreated)"
        Write-Host "Account   : $account"
        Write-Host "GPO object: $objectName"
        Write-Host "New path  : $newValue"
    }
} else {
    Write-Host "No gPCFileSysPath modifications found in the last 7 days."
}

# Verify all gPCFileSysPath values point to the legitimate SYSVOL path
$domain      = $env:USERDNSDOMAIN
$sysvolBase  = "\\$domain\SYSVOL\$domain\Policies"

$gpoObjects = Get-ADObject -Filter { objectClass -eq "groupPolicyContainer" } `
    -Properties gPCFileSysPath, displayName

$anomalies = $gpoObjects | Where-Object {
    $_.gPCFileSysPath -and
    -not $_.gPCFileSysPath.StartsWith($sysvolBase, [System.StringComparison]::OrdinalIgnoreCase)
}

if ($anomalies) {
    Write-Warning "ANOMALY: gPCFileSysPath points outside SYSVOL for $($anomalies.Count) GPO(s)"
    $anomalies | Select-Object DisplayName, gPCFileSysPath | Format-Table -AutoSize
} else {
    Write-Host "All gPCFileSysPath values point to the legitimate SYSVOL path."
}

# Enforce SMB signing on all Domain Controllers via GPO registry values
# These values are set by GPO under:
# Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options

# Registry path for SMB server signing
$serverPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"

# Registry path for SMB client signing
$clientPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters"

# Run on each DC — or deploy via GPO
Set-ItemProperty -Path $serverPath -Name "RequireSecuritySignature" -Value 1 -Type DWord
Set-ItemProperty -Path $serverPath -Name "EnableSecuritySignature"  -Value 1 -Type DWord
Set-ItemProperty -Path $clientPath -Name "RequireSecuritySignature" -Value 1 -Type DWord
Set-ItemProperty -Path $clientPath -Name "EnableSecuritySignature"  -Value 1 -Type DWord

Write-Host "SMB signing enforced on $env:COMPUTERNAME"

# Verify SMB signing status on all Domain Controllers
$dcs = (Get-ADDomainController -Filter *).Name

foreach ($dc in $dcs) {
    $smbConfig = Get-SmbServerConfiguration -CimSession $dc -ErrorAction SilentlyContinue

    [PSCustomObject]@{
        DomainController         = $dc
        RequireSecuritySignature = $smbConfig.RequireSecuritySignature
        EnableSecuritySignature  = $smbConfig.EnableSecuritySignature
        Status                   = if ($smbConfig.RequireSecuritySignature) { "HARDENED" } else { "VULNERABLE" }
    }
} | Format-Table -AutoSize

# Add audit SACL to all SYSVOL GPO folders to enable event 4663 on write operations
$domain     = $env:USERDNSDOMAIN
$sysvolBase = "\\$domain\SYSVOL\$domain\Policies"

Get-GPO -All | ForEach-Object {
    $gpoPath = "$sysvolBase\{$($_.Id)}"

    if (-not (Test-Path $gpoPath)) { return }

    $acl = Get-Acl -Path $gpoPath -Audit

    # Create audit rule: audit write access by Everyone (catches all unexpected writers)
    $auditRule = New-Object System.Security.AccessControl.FileSystemAuditRule(
        "Everyone",
        [System.Security.AccessControl.FileSystemRights]::Write,
        [System.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit",
        [System.Security.AccessControl.PropagationFlags]::None,
        [System.Security.AccessControl.AuditFlags]::Success
    )

    $acl.AddAuditRule($auditRule)
    Set-Acl -Path $gpoPath -AclObject $acl

    Write-Host "SACL set on: $gpoPath"
}

Write-Host "Audit SACL deployment complete."

# Unified GPO modification alert — monitors both AD object changes (5136) and SYSVOL file changes (4663)
param(
    [int]$LookbackMinutes  = 60,
    [string]$AlertEmail    = "soc@contoso.local",
    [string]$SmtpServer    = "smtp.contoso.local",
    [string]$FromAddress   = "gpo-monitor@contoso.local"
)

$dcPDC    = (Get-ADDomain).PDCEmulator
$cutoff   = (Get-Date).AddMinutes(-$LookbackMinutes)
$alerts   = @()

# --- Event 5136: AD object modifications on groupPolicyContainer ---
$adEvents = Get-WinEvent -ComputerName $dcPDC -FilterHashtable @{
    LogName   = 'Security'
    Id        = 5136
    StartTime = $cutoff
} -ErrorAction SilentlyContinue | Where-Object {
    $_.Message -match "groupPolicyContainer"
}

foreach ($evt in $adEvents) {
    $lines = $evt.Message -split "`n"
    $alerts += [PSCustomObject]@{
        Type      = "AD-Object-5136"
        Time      = $evt.TimeCreated
        Account   = ($lines | Where-Object { $_ -match "Account Name:" })[0] -replace ".*Account Name:\s*", ""
        Object    = ($lines | Where-Object { $_ -match "Object Name:" })     -replace ".*Object Name:\s*", ""
        Attribute = ($lines | Where-Object { $_ -match "LDAP Display Name:" }) -replace ".*LDAP Display Name:\s*", ""
        Source    = $dcPDC
    }
}

# --- Event 4663: SYSVOL file write operations ---
$fileEvents = Get-WinEvent -ComputerName $dcPDC -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4663
    StartTime = $cutoff
} -ErrorAction SilentlyContinue | Where-Object {
    $_.Message -match "SYSVOL" -and
    $_.Message -match "Policies"
}

foreach ($evt in $fileEvents) {
    $lines = $evt.Message -split "`n"
    $alerts += [PSCustomObject]@{
        Type      = "SYSVOL-File-4663"
        Time      = $evt.TimeCreated
        Account   = ($lines | Where-Object { $_ -match "Account Name:" })[0] -replace ".*Account Name:\s*", ""
        Object    = ($lines | Where-Object { $_ -match "Object Name:" })     -replace ".*Object Name:\s*", ""
        Attribute = "File write"
        Source    = $dcPDC
    }
}

# --- Output and optional email alert ---
if ($alerts) {
    Write-Warning "GPO modifications detected: $($alerts.Count) event(s) in the last $LookbackMinutes minutes"
    $alerts | Format-Table -AutoSize

    if ($AlertEmail -and $SmtpServer) {
        $body = $alerts | Format-Table -AutoSize | Out-String
        Send-MailMessage `
            -To      $AlertEmail `
            -From    $FromAddress `
            -Subject "[GPO-ALERT] $($alerts.Count) modification(s) on $($dcPDC) — $(Get-Date -Format 'yyyy-MM-dd HH:mm')" `
            -Body    $body `
            -SmtpServer $SmtpServer
        Write-Host "Alert email sent to $AlertEmail"
    }
} else {
    Write-Host "No GPO modifications detected in the last $LookbackMinutes minutes."
}

# Grant GpoEdit permission to a specific group on a specific GPO
# Replace GPOName and GroupName with actual values

$gpoName   = "SEC-Postes-Baseline"
$groupName = "CONTOSO\GPO-Editors-Securite"

Set-GPPermissions -Name $gpoName `
    -TargetName $groupName `
    -TargetType "Group" `
    -PermissionLevel "GpoEdit"

Write-Host "GpoEdit granted to $groupName on GPO: $gpoName"

# Verify
Get-GPPermissions -Name $gpoName -All |
    Where-Object { $_.Trustee.Name -eq $groupName } |
    Format-Table Trustee, Permission

# Delegate GPO link permission on a specific OU to a group
# This permission is set on the OU, not on the GPO

$ouPath    = "OU=Workstations,OU=Paris,DC=contoso,DC=local"
$groupName = "CONTOSO\GPO-Linkers"

# Get the OU object and modify its permissions via AD module
$ou  = Get-ADOrganizationalUnit -Filter { DistinguishedName -eq $ouPath }
$acl = Get-Acl -Path "AD:$($ou.DistinguishedName)"

# The GUID for "Link GPO" right (msDS-GPLink attribute)
$linkGPORight = [System.Guid]::New("f30e3bc2-9ff0-11d1-b603-0000f80367c1")
$adRight      = [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty
$type         = [System.Security.AccessControl.AccessControlType]::Allow

$sid  = (Get-ADGroup $groupName).SID
$rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule(
    $sid, $adRight, $type, $linkGPORight
)

$acl.AddAccessRule($rule)
Set-Acl -Path "AD:$($ou.DistinguishedName)" -AclObject $acl

Write-Host "GPO link permission granted to $groupName on OU: $ouPath"

# Revoke all GPO edit permissions for a specific account (e.g., on departure or compromise)
$accountToRevoke = "CONTOSO\svc-old-tool"

Get-GPO -All | ForEach-Object {
    $gpo    = $_
    $hasPerm = Get-GPPermissions -Guid $gpo.Id -All |
        Where-Object { $_.Trustee.Name -eq $accountToRevoke -and
                       $_.Permission -in @("GpoEdit","GpoEditDeleteModifySecurity") }

    if ($hasPerm) {
        Write-Host "Revoking permissions from $accountToRevoke on: $($gpo.DisplayName)"
        Set-GPPermissions -Guid $gpo.Id `
            -TargetName $accountToRevoke `
            -TargetType "User" `
            -PermissionLevel "None"
    }
}

Write-Host "Permission revocation complete for $accountToRevoke"

# Full GPO security posture check — run after any permission or hardening change
Import-Module GroupPolicy, ActiveDirectory

$domain  = $env:USERDNSDOMAIN
$dcPDC   = (Get-ADDomain).PDCEmulator
$results = @()

Write-Host "=== GPO Security Posture Check ===" -ForegroundColor Cyan
Write-Host "Domain : $domain"
Write-Host "PDC    : $dcPDC"
Write-Host ""

# 1. SMB Signing status on all DCs
Write-Host "--- SMB Signing ---"
(Get-ADDomainController -Filter *).Name | ForEach-Object {
    $smb = Get-SmbServerConfiguration -CimSession $_ -EA SilentlyContinue
    $status = if ($smb.RequireSecuritySignature) { "OK" } else { "FAIL" }
    Write-Host "  $_ : RequireSecuritySignature = $($smb.RequireSecuritySignature) [$status]"
}

# 2. CREATOR OWNER check on GPOs
Write-Host ""
Write-Host "--- CREATOR OWNER on GPOs ---"
$creatorOwnerFound = Get-GPO -All | ForEach-Object {
    Get-GPPermissions -Guid $_.Id -All |
        Where-Object { $_.Trustee.Name -eq "CREATOR OWNER" } |
        ForEach-Object { $gpo = $_; Write-Output $gpo }
}
if ($creatorOwnerFound) {
    Write-Warning "  CREATOR OWNER found on $($creatorOwnerFound.Count) GPO permission entries"
} else {
    Write-Host "  OK — No CREATOR OWNER entries found"
}

# 3. Audit Directory Service Changes
Write-Host ""
Write-Host "--- Audit Directory Service Changes ---"
$auditStatus = Invoke-Command -ComputerName $dcPDC -ScriptBlock {
    auditpol /get /subcategory:"Directory Service Changes"
}
Write-Host ($auditStatus | Select-String "Directory Service Changes")

# 4. gPCFileSysPath integrity
Write-Host ""
Write-Host "--- gPCFileSysPath Integrity ---"
$sysvolBase = "\\$domain\SYSVOL\$domain\Policies"
$anomalies  = Get-ADObject -Filter { objectClass -eq "groupPolicyContainer" } `
    -Properties gPCFileSysPath, displayName |
    Where-Object {
        $_.gPCFileSysPath -and
        -not $_.gPCFileSysPath.StartsWith($sysvolBase, [System.StringComparison]::OrdinalIgnoreCase)
    }

if ($anomalies) {
    Write-Warning "  ANOMALY: $($anomalies.Count) gPCFileSysPath outside SYSVOL"
    $anomalies | Select-Object DisplayName, gPCFileSysPath | Format-Table -AutoSize
} else {
    Write-Host "  OK — All gPCFileSysPath values point to SYSVOL"
}

Write-Host ""
Write-Host "=== Check complete ===" -ForegroundColor Cyan