PowerShell Remoting et le registre a distance¶

# Enable PowerShell Remoting (must run as Administrator)
Enable-PSRemoting -Force

# Check WinRM service status and listener configuration
Get-Service WinRM
winrm enumerate winrm/config/listener

# Add specific machines to TrustedHosts
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "SRV01,SRV02,192.168.1.0/24" -Force

# Verify the configuration
Get-Item WSMan:\localhost\Client\TrustedHosts

# Verify firewall rules for WinRM
Get-NetFirewallRule -DisplayName "*Windows Remote Management*" |
    Select-Object DisplayName, Enabled, Direction, Action

# Read a registry value on a remote machine
Invoke-Command -ComputerName PC-COMPTA-03 -ScriptBlock {
    Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" `
                     -Name "DisableNotifications"
}

# Set a registry value on a remote machine
Invoke-Command -ComputerName PC-COMPTA-03 -ScriptBlock {
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" `
                     -Name "DisableNotifications" `
                     -Value 0
}

# Create a new registry key and value on a remote machine
Invoke-Command -ComputerName SRV-APP01 -ScriptBlock {
    $path = "HKLM:\SOFTWARE\MonEntreprise\AppConfig"
    if (-not (Test-Path $path)) {
        New-Item -Path $path -Force | Out-Null
    }
    New-ItemProperty -Path $path -Name "MaintenanceMode" -Value 1 -PropertyType DWord -Force
}

# Remove a specific registry value on a remote machine
Invoke-Command -ComputerName SRV-APP01 -ScriptBlock {
    Remove-ItemProperty -Path "HKLM:\SOFTWARE\MonEntreprise\AppConfig" `
                        -Name "MaintenanceMode" -ErrorAction Stop
}

# Remove an entire registry key and its children
Invoke-Command -ComputerName SRV-APP01 -ScriptBlock {
    Remove-Item -Path "HKLM:\SOFTWARE\MonEntreprise\AppConfig" -Recurse -Force
}

# Create a persistent session
$session = New-PSSession -ComputerName SRV-APP01

# Execute multiple operations via the same session
Invoke-Command -Session $session -ScriptBlock {
    $path = "HKLM:\SOFTWARE\MonEntreprise\Deploy"
    New-Item -Path $path -Force | Out-Null
    New-ItemProperty -Path $path -Name "Version" -Value "2.5.1" -PropertyType String -Force
    New-ItemProperty -Path $path -Name "DeployDate" -Value (Get-Date -Format "yyyy-MM-dd") -PropertyType String -Force
}

# Verify
Invoke-Command -Session $session -ScriptBlock {
    Get-ItemProperty "HKLM:\SOFTWARE\MonEntreprise\Deploy"
}

# Clean up
Remove-PSSession $session

# Create a CIM session to a remote machine
$cimSession = New-CimSession -ComputerName SRV-DC01

# Verify the session
$cimSession

# Read a REG_SZ value using CIM StdRegProv
$HKLM = [uint32]2147483650

$result = Invoke-CimMethod -CimSession $cimSession `
    -Namespace "root\default" `
    -ClassName "StdRegProv" `
    -MethodName "GetStringValue" `
    -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\Microsoft\Windows NT\CurrentVersion"
        sValueName  = "ProductName"
    }

$result.sValue

# Read a REG_DWORD value using CIM StdRegProv
$result = Invoke-CimMethod -CimSession $cimSession `
    -Namespace "root\default" `
    -ClassName "StdRegProv" `
    -MethodName "GetDWORDValue" `
    -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
        sValueName  = "EnableLUA"
    }

$result.uValue

# Write a REG_DWORD value using CIM StdRegProv
Invoke-CimMethod -CimSession $cimSession `
    -Namespace "root\default" `
    -ClassName "StdRegProv" `
    -MethodName "SetDWORDValue" `
    -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\MonEntreprise\Config"
        sValueName  = "AuditEnabled"
        uValue      = [uint32]1
    }

# Enumerate subkeys under a registry path
$enum = Invoke-CimMethod -CimSession $cimSession `
    -Namespace "root\default" `
    -ClassName "StdRegProv" `
    -MethodName "EnumKey" `
    -Arguments @{
        hDefKey     = $HKLM
        sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    }

$enum.sNames | Select-Object -First 10

# Read NTP configuration from multiple machines at once
$computers = Get-ADComputer -Filter "OperatingSystem -like '*Windows 10*'" |
    Select-Object -ExpandProperty Name

$results = Invoke-Command -ComputerName $computers -ScriptBlock {
    Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" `
                     -Name "NtpServer" -ErrorAction SilentlyContinue |
        Select-Object -ExpandProperty NtpServer
} -ThrottleLimit 50 -ErrorAction SilentlyContinue

$results | Select-Object PSComputerName, @{N="NtpServer";E={$_}} |
    Sort-Object PSComputerName

# Define the expected NTP server
$expectedNtp = "ntp.entreprise.local,0x9"

# Find and fix non-compliant machines
$nonCompliant = $results | Where-Object { $_ -ne $expectedNtp }

$nonCompliantNames = $nonCompliant | Select-Object -ExpandProperty PSComputerName

if ($nonCompliantNames) {
    Invoke-Command -ComputerName $nonCompliantNames -ScriptBlock {
        param($ntpServer)
        Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" `
                         -Name "NtpServer" -Value $ntpServer
        Restart-Service W32Time -Force
    } -ArgumentList $expectedNtp -ThrottleLimit 50

    Write-Host "$($nonCompliantNames.Count) machines corrected."
} else {
    Write-Host "All machines are compliant."
}

# Robust mass registry operation with error handling
$computers = @("SRV-APP01", "SRV-APP02", "SRV-DB01", "PC-OFFLINE-01")

$job = Invoke-Command -ComputerName $computers -ScriptBlock {
    try {
        $path = "HKLM:\SOFTWARE\MonEntreprise\SecurityBaseline"
        if (-not (Test-Path $path)) {
            New-Item -Path $path -Force | Out-Null
        }
        Set-ItemProperty -Path $path -Name "BaselineVersion" -Value "2026.04" -Force
        Set-ItemProperty -Path $path -Name "AppliedDate" -Value (Get-Date -Format "yyyy-MM-dd") -Force

        [PSCustomObject]@{
            Status  = "Success"
            Machine = $env:COMPUTERNAME
        }
    } catch {
        [PSCustomObject]@{
            Status  = "Failed"
            Machine = $env:COMPUTERNAME
            Error   = $_.Exception.Message
        }
    }
} -ErrorAction SilentlyContinue -ErrorVariable remoteErrors -ThrottleLimit 50

# Display successes
$job | Where-Object Status -eq "Success" |
    Format-Table Machine, Status -AutoSize

# Display failures (machines that responded with errors)
$job | Where-Object Status -eq "Failed" |
    Format-Table Machine, Status, Error -AutoSize

# Display unreachable machines
$remoteErrors | ForEach-Object {
    [PSCustomObject]@{
        Machine = $_.TargetObject
        Error   = $_.Exception.Message
    }
} | Format-Table -AutoSize

# PowerShell 7+ parallel execution for registry operations
$computers = Get-Content "C:\Admin\workstations.txt"

$computers | ForEach-Object -Parallel {
    $result = Invoke-Command -ComputerName $_ -ScriptBlock {
        Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" |
            Select-Object EnableLUA, ConsentPromptBehaviorAdmin
    } -ErrorAction SilentlyContinue

    if ($result) {
        [PSCustomObject]@{
            Computer = $_
            UAC      = if ($result.EnableLUA -eq 1) { "Enabled" } else { "Disabled" }
            Consent  = $result.ConsentPromptBehaviorAdmin
        }
    }
} -ThrottleLimit 100 | Export-Csv "C:\Admin\uac-audit.csv" -NoTypeInformation

# Configure constrained delegation on SRV-APP01 in Active Directory
# SRV-APP01 will be allowed to delegate credentials to SRV-FILE01
Set-ADComputer -Identity "SRV-APP01" -Add @{
    "msDS-AllowedToDelegateTo" = @(
        "cifs/SRV-FILE01.entreprise.local"
        "cifs/SRV-FILE01"
    )
}

# Verify the delegation
Get-ADComputer "SRV-APP01" -Properties "msDS-AllowedToDelegateTo" |
    Select-Object -ExpandProperty "msDS-AllowedToDelegateTo"

# Enable CredSSP (TEST ENVIRONMENT ONLY)
Enable-WSManCredSSP -Role Client -DelegateComputer "SRV-APP01.entreprise.local" -Force
Enable-WSManCredSSP -Role Server -Force  # On SRV-APP01

# Connect with CredSSP
$cred = Get-Credential
Invoke-Command -ComputerName SRV-APP01 -Credential $cred -Authentication CredSSP -ScriptBlock {
    # This second hop now works (but at what cost?)
    Invoke-Command -ComputerName SRV-FILE01 -ScriptBlock {
        Get-ItemProperty "HKLM:\SOFTWARE\MonApp"
    }
}

# Create a JEA role capability file
$roleCapability = @{
    Path            = "C:\Program Files\WindowsPowerShell\Modules\RegistryJEA\RoleCapabilities\RegistryOperator.psrc"
    VisibleCmdlets  = @(
        "Get-ItemProperty"
        "Set-ItemProperty"
        "Test-Path"
        @{
            Name       = "New-Item"
            Parameters = @{ Name = "Path"; ValidatePattern = "HKLM:\\SOFTWARE\\MonEntreprise\\*" }
        }
    )
    VisibleFunctions = @()
    VisibleProviders = @("Registry")
}

New-PSRoleCapabilityFile @roleCapability

# Create and register the JEA session configuration
$sessionConfig = @{
    Path                = "C:\Admin\RegistryJEA.pssc"
    SessionType         = "RestrictedRemoteServer"
    RunAsVirtualAccount = $true
    RoleDefinitions     = @{
        "ENTREPRISE\Registry-Operators" = @{ RoleCapabilities = "RegistryOperator" }
    }
}

New-PSSessionConfigurationFile @sessionConfig
Register-PSSessionConfiguration -Name "RegistryJEA" -Path "C:\Admin\RegistryJEA.pssc" -Force

# Connect to the JEA endpoint
Enter-PSSession -ComputerName SRV-APP01 -ConfigurationName RegistryJEA

# This works (authorized)
Get-ItemProperty "HKLM:\SOFTWARE\MonEntreprise\Config"

# This fails (not authorized)
Remove-Item "HKLM:\SOFTWARE\Microsoft\Windows"

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Set-Service -Name sshd -StartupType Automatic
Start-Service sshd

New-Item -Path "HKLM:\SOFTWARE\OpenSSH" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell `
    -Value "C:\Program Files\PowerShell\7\pwsh.exe" -Type String

Restart-Service sshd

Enter-PSSession -HostName server01 -UserName admin

Invoke-Command -HostName server01,server02 -UserName admin -ScriptBlock {
    Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion
}

# Get all workstations from Active Directory
$computers = Get-ADComputer -Filter "OperatingSystem -like '*Windows 10*' -or OperatingSystem -like '*Windows 11*'" `
    -SearchBase "OU=Workstations,DC=entreprise,DC=local" |
    Select-Object -ExpandProperty Name

Write-Host "Machines found: $($computers.Count)"

# Audit the legacy DisableAntiSpyware policy and collect the effective Defender state
$auditResults = Invoke-Command -ComputerName $computers -ScriptBlock {
    $path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
    $policy = Get-ItemProperty -Path $path -Name "DisableAntiSpyware" -ErrorAction SilentlyContinue
    $mpStatus = Get-MpComputerStatus -ErrorAction SilentlyContinue

    $reviewReason = if ($null -ne $policy -and $policy.DisableAntiSpyware -eq 1) {
        "LegacyPolicy"
    } elseif ($null -eq $mpStatus) {
        "NoMpStatus"
    } else {
        "OK"
    }

    [PSCustomObject]@{
        Computer           = $env:COMPUTERNAME
        DisableAntiSpyware = if ($null -ne $policy) { $policy.DisableAntiSpyware } else { "N/A" }
        AntivirusEnabled   = if ($null -ne $mpStatus) { $mpStatus.AntivirusEnabled } else { "Unknown" }
        RealTimeProtection = if ($null -ne $mpStatus) { $mpStatus.RealTimeProtectionEnabled } else { "Unknown" }
        IsTamperProtected  = if ($null -ne $mpStatus) { $mpStatus.IsTamperProtected } else { "Unknown" }
        ReviewReason       = $reviewReason
    }
} -ThrottleLimit 50 -ErrorAction SilentlyContinue -ErrorVariable auditErrors

# Summary
$compliant = $auditResults | Where-Object { $_.ReviewReason -eq "OK" }
$needsReview = $auditResults | Where-Object { $_.ReviewReason -ne "OK" }
$unreachable = $auditErrors.Count

Write-Host "Compliant   : $($compliant.Count)"
Write-Host "Needs review: $($needsReview.Count)"
Write-Host "Unreachable : $unreachable"

# Remove the rogue legacy value on suspicious machines
$fixTargets = $auditResults |
    Where-Object { $_.ReviewReason -eq "LegacyPolicy" } |
    Select-Object -ExpandProperty Computer

$fixResults = Invoke-Command -ComputerName $fixTargets -ScriptBlock {
    try {
        $path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"

        # Remove the legacy DisableAntiSpyware value if present
        if ($null -ne (Get-ItemProperty -Path $path -Name "DisableAntiSpyware" -ErrorAction SilentlyContinue)) {
            Remove-ItemProperty -Path $path -Name "DisableAntiSpyware" -Force -ErrorAction Stop
        }

        $mpStatus = Get-MpComputerStatus -ErrorAction SilentlyContinue

        [PSCustomObject]@{
            Computer          = $env:COMPUTERNAME
            Status            = "PolicyRemoved"
            AntivirusEnabled  = if ($null -ne $mpStatus) { $mpStatus.AntivirusEnabled } else { "Unknown" }
            IsTamperProtected = if ($null -ne $mpStatus) { $mpStatus.IsTamperProtected } else { "Unknown" }
        }
    } catch {
        [PSCustomObject]@{
            Computer          = $env:COMPUTERNAME
            Status            = "Error"
            AntivirusEnabled  = "Unknown"
            IsTamperProtected = $_.Exception.Message
        }
    }
} -ThrottleLimit 50 -ErrorAction SilentlyContinue

# Generate a comprehensive report
$timestamp = Get-Date -Format "yyyyMMdd-HHmmss"
$reportPath = "C:\Admin\Reports\defender-audit-$timestamp.csv"

$fullReport = @()

# Add successful audits
$fullReport += $auditResults | Select-Object Computer,
    @{N="Status";E={
        switch ($_.ReviewReason) {
            "LegacyPolicy" { "LegacyPolicy" }
            "NoMpStatus" { "NoMpStatus" }
            default { "Compliant" }
        }
    }},
    DisableAntiSpyware, AntivirusEnabled, RealTimeProtection, IsTamperProtected

# Add unreachable machines
$fullReport += $auditErrors | ForEach-Object {
    [PSCustomObject]@{
        Computer            = $_.TargetObject
        Status              = "Unreachable"
        DisableAntiSpyware  = "Unknown"
        AntivirusEnabled    = "Unknown"
        RealTimeProtection  = "Unknown"
        IsTamperProtected   = "Unknown"
    }
}

$fullReport | Export-Csv -Path $reportPath -NoTypeInformation -Encoding UTF8
Write-Host "Report saved: $reportPath"

# Display summary
$fullReport | Group-Object Status |
    Select-Object Name, Count |
    Format-Table -AutoSize