Audit et conformite du registre¶

# Enable Object Access auditing via local security policy
auditpol /set /subcategory:"Registry" /success:enable /failure:enable

# Verify the current audit configuration
auditpol /get /subcategory:"Registry"

# Set a SACL on a critical registry key to audit all modifications
$regKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"

# Get the current ACL
$acl = Get-Acl -Path $regKey

# Create an audit rule: audit SetValue and Delete for Everyone
$auditRule = New-Object System.Security.AccessControl.RegistryAuditRule(
    "Everyone",                                              # Identity
    "SetValue,Delete,WriteKey",                              # Registry rights to audit
    "ContainerInherit,ObjectInherit",                        # Inheritance flags
    "None",                                                  # Propagation flags
    "Success,Failure"                                        # Audit flags
)

# Add the audit rule to the ACL
$acl.AddAuditRule($auditRule)

# Apply the modified ACL
Set-Acl -Path $regKey -AclObject $acl

# Verify the SACL
(Get-Acl $regKey -Audit).Audit | Format-List

# Search for registry modification events (Event ID 4657)
$events = Get-WinEvent -FilterHashtable @{
    LogName   = "Security"
    Id        = 4657
    StartTime = (Get-Date).AddDays(-7)
} -ErrorAction SilentlyContinue

# Filter for our specific key
$defenderEvents = $events | Where-Object {
    $_.Message -like "*Windows Defender*" -and
    $_.Message -like "*DisableAntiSpyware*"
}

$defenderEvents | ForEach-Object {
    [PSCustomObject]@{
        Time       = $_.TimeCreated
        User       = ($_.Properties[1].Value)  # SubjectUserName
        Process    = ($_.Properties[11].Value) # ProcessName
        OldValue   = ($_.Properties[10].Value) # OldValueType + OldValue
        NewValue   = ($_.Properties[12].Value) # NewValueType + NewValue
        Operation  = ($_.Properties[8].Value)  # OperationType
    }
} | Format-Table -AutoSize

# Display the full detail of a 4657 event
$event = $defenderEvents | Select-Object -First 1
$event | Format-List *

# Search for failed registry access attempts (Event ID 4656 with failure)
Get-WinEvent -FilterHashtable @{
    LogName   = "Security"
    Id        = 4656
    StartTime = (Get-Date).AddDays(-1)
} -ErrorAction SilentlyContinue |
Where-Object {
    $_.Message -like "*REGISTRY*" -and
    $_.Message -like "*Failure*"
} | Select-Object TimeCreated,
    @{N="User";E={$_.Properties[1].Value}},
    @{N="Key";E={$_.Properties[6].Value}} |
Format-Table -AutoSize

# On the collector server: create a subscription for registry audit events
$subscriptionXml = @"
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>RegistryAudit</SubscriptionId>
    <SubscriptionType>SourceInitiated</SubscriptionType>
    <Description>Collect registry modification events</Description>
    <Enabled>true</Enabled>
    <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
    <Query>
        <![CDATA[
            <QueryList>
                <Query Id="0" Path="Security">
                    <Select Path="Security">
                        *[System[(EventID=4657 or EventID=4656)]]
                    </Select>
                </Query>
            </QueryList>
        ]]>
    </Query>
    <ReadExistingEvents>false</ReadExistingEvents>
    <ContentFormat>Events</ContentFormat>
</Subscription>
"@

$subscriptionXml | Out-File "C:\Admin\RegistryAudit-Sub.xml" -Encoding UTF8
wecutil cs "C:\Admin\RegistryAudit-Sub.xml"

# CIS 2.3.1.1 - Limit blank password use
$path = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
$value = (Get-ItemProperty -Path $path -Name "LimitBlankPasswordUse" -ErrorAction SilentlyContinue).LimitBlankPasswordUse

if ($value -eq 1) {
    Write-Host "[PASS] LimitBlankPasswordUse = 1 (blank passwords blocked)" -ForegroundColor Green
} else {
    Write-Host "[FAIL] LimitBlankPasswordUse = $value (expected: 1)" -ForegroundColor Red
}

# STIG V-220972 - WDigest must not store credentials in memory
$path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest"
$value = (Get-ItemProperty -Path $path -Name "UseLogonCredential" -ErrorAction SilentlyContinue).UseLogonCredential

if ($value -eq 0) {
    Write-Host "[PASS] WDigest credential caching disabled" -ForegroundColor Green
} elseif ($null -eq $value) {
    Write-Host "[PASS] UseLogonCredential not set (default: disabled on Win 8.1+)" -ForegroundColor Yellow
} else {
    Write-Host "[FAIL] WDigest stores credentials in memory (UseLogonCredential = $value)" -ForegroundColor Red
}

# Define the compliance baseline as a structured array
$baseline = @(
    @{
        Id          = "CIS-2.3.1.1"
        Description = "Limit blank password use"
        Path        = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
        Name        = "LimitBlankPasswordUse"
        Expected    = 1
        Type        = "DWord"
        Severity    = "Critical"
    },
    @{
        Id          = "CIS-2.3.7.1"
        Description = "SMB server signing required"
        Path        = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
        Name        = "RequireSecuritySignature"
        Expected    = 1
        Type        = "DWord"
        Severity    = "High"
    },
    @{
        Id          = "CIS-2.3.7.2"
        Description = "SMB client signing required"
        Path        = "HKLM:\SYSTEM\CurrentControlSet\Services\LanManWorkstation\Parameters"
        Name        = "RequireSecuritySignature"
        Expected    = 1
        Type        = "DWord"
        Severity    = "High"
    },
    @{
        Id          = "CIS-18.4.1"
        Description = "Always install elevated disabled"
        Path        = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer"
        Name        = "AlwaysInstallElevated"
        Expected    = 0
        Type        = "DWord"
        Severity    = "Critical"
    },
    @{
        Id          = "CIS-18.9.4.1"
        Description = "SmartScreen enabled"
        Path        = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System"
        Name        = "EnableSmartScreen"
        Expected    = 1
        Type        = "DWord"
        Severity    = "High"
    },
    @{
        Id          = "STIG-V-220972"
        Description = "WDigest credential caching disabled"
        Path        = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest"
        Name        = "UseLogonCredential"
        Expected    = 0
        Type        = "DWord"
        Severity    = "Critical"
    },
    @{
        Id          = "CIS-18.10.42.1"
        Description = "WinRM basic auth disabled"
        Path        = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service"
        Name        = "AllowBasic"
        Expected    = 0
        Type        = "DWord"
        Severity    = "High"
    },
    @{
        Id          = "CIS-2.3.10.1"
        Description = "Anonymous SID/Name translation disabled"
        Path        = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
        Name        = "RestrictAnonymousSAM"
        Expected    = 1
        Type        = "DWord"
        Severity    = "Medium"
    }
)

# Function to evaluate a single compliance check
function Test-RegistryCompliance {
    param(
        [hashtable]$Check
    )

    $result = [PSCustomObject]@{
        Id          = $Check.Id
        Description = $Check.Description
        Path        = $Check.Path
        ValueName   = $Check.Name
        Expected    = $Check.Expected
        Actual      = $null
        Status      = "Unknown"
        Severity    = $Check.Severity
    }

    try {
        if (-not (Test-Path $Check.Path)) {
            $result.Status = "KeyMissing"
            return $result
        }

        $prop = Get-ItemProperty -Path $Check.Path -Name $Check.Name -ErrorAction Stop
        $result.Actual = $prop.($Check.Name)

        if ($result.Actual -eq $Check.Expected) {
            $result.Status = "Pass"
        } else {
            $result.Status = "Fail"
        }
    } catch {
        $result.Status = "ValueMissing"
    }

    return $result
}

# Run the compliance scan locally
$localResults = $baseline | ForEach-Object { Test-RegistryCompliance -Check $_ }

# Display results with color coding
$localResults | ForEach-Object {
    $color = switch ($_.Status) {
        "Pass"         { "Green" }
        "Fail"         { "Red" }
        "KeyMissing"   { "Yellow" }
        "ValueMissing" { "Yellow" }
        default        { "Gray" }
    }
    Write-Host "[$($_.Status.PadRight(12))] $($_.Id) - $($_.Description)" -ForegroundColor $color
}

# Run the compliance scan across multiple machines
$computers = Get-ADComputer -Filter "OperatingSystem -like '*Windows*'" `
    -SearchBase "OU=Workstations,DC=entreprise,DC=local" |
    Select-Object -ExpandProperty Name

$remoteResults = Invoke-Command -ComputerName $computers -ScriptBlock {
    param($baselineData)

    $baselineData | ForEach-Object {
        $check = $_
        $result = [PSCustomObject]@{
            Computer  = $env:COMPUTERNAME
            Id        = $check.Id
            Severity  = $check.Severity
            Status    = "Unknown"
            Expected  = $check.Expected
            Actual    = $null
        }

        try {
            if (-not (Test-Path $check.Path)) {
                $result.Status = "KeyMissing"
            } else {
                $prop = Get-ItemProperty -Path $check.Path -Name $check.Name -ErrorAction Stop
                $result.Actual = $prop.($check.Name)
                $result.Status = if ($result.Actual -eq $check.Expected) { "Pass" } else { "Fail" }
            }
        } catch {
            $result.Status = "ValueMissing"
        }

        $result
    }
} -ArgumentList (,$baseline) -ThrottleLimit 50 -ErrorAction SilentlyContinue

# Generate a compliance summary
$summary = $remoteResults | Group-Object Computer | ForEach-Object {
    $machineResults = $_.Group
    $total   = $machineResults.Count
    $passed  = ($machineResults | Where-Object Status -eq "Pass").Count
    $failed  = ($machineResults | Where-Object Status -eq "Fail").Count
    $missing = ($machineResults | Where-Object Status -in "KeyMissing","ValueMissing").Count

    [PSCustomObject]@{
        Computer        = $_.Name
        Total           = $total
        Passed          = $passed
        Failed          = $failed
        Missing         = $missing
        ComplianceScore = [math]::Round(($passed / $total) * 100, 1)
    }
}

# Display the summary
$summary | Sort-Object ComplianceScore |
    Format-Table Computer, Passed, Failed, Missing, @{
        N="Score"; E={"$($_.ComplianceScore)%"}; A="Right"
    } -AutoSize

# Export detailed results
$timestamp = Get-Date -Format "yyyyMMdd-HHmmss"
$remoteResults | Export-Csv "C:\Admin\Reports\compliance-$timestamp.csv" -NoTypeInformation

# Critical failures only
$criticalFails = $remoteResults |
    Where-Object { $_.Status -eq "Fail" -and $_.Severity -eq "Critical" }

if ($criticalFails) {
    Write-Host "`nCRITICAL FAILURES:" -ForegroundColor Red
    $criticalFails | Format-Table Computer, Id, Expected, Actual -AutoSize
}

# Verify the current value on the affected server
Invoke-Command -ComputerName SRV-APP03 -ScriptBlock {
    $path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest"
    Get-ItemProperty -Path $path -Name "UseLogonCredential"
}

# Search for the modification event on the affected server
Invoke-Command -ComputerName SRV-APP03 -ScriptBlock {
    Get-WinEvent -FilterHashtable @{
        LogName   = "Security"
        Id        = 4657
        StartTime = (Get-Date).AddDays(-7)
    } -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -like "*WDigest*" -and $_.Message -like "*UseLogonCredential*" } |
    ForEach-Object {
        [PSCustomObject]@{
            Time      = $_.TimeCreated
            User      = $_.Properties[1].Value   # SubjectUserName
            Domain    = $_.Properties[2].Value   # SubjectDomainName
            LogonId   = $_.Properties[3].Value   # SubjectLogonId
            Process   = $_.Properties[11].Value  # ProcessName
            OldValue  = $_.Properties[10].Value  # OldValue
            NewValue  = $_.Properties[12].Value  # NewValue
        }
    }
}

# Find the logon event for this LogonId
Invoke-Command -ComputerName SRV-APP03 -ScriptBlock {
    Get-WinEvent -FilterHashtable @{
        LogName   = "Security"
        Id        = 4624  # Successful logon
        StartTime = (Get-Date).AddDays(-7)
    } -ErrorAction SilentlyContinue |
    Where-Object { $_.Properties[1].Value -eq "svc.backup" } |
    Select-Object -First 5 |
    ForEach-Object {
        [PSCustomObject]@{
            Time       = $_.TimeCreated
            User       = $_.Properties[5].Value
            LogonType  = $_.Properties[8].Value
            SourceIP   = $_.Properties[18].Value
            SourceHost = $_.Properties[11].Value
        }
    }
}

# Step 1: Fix the value immediately
Invoke-Command -ComputerName SRV-APP03 -ScriptBlock {
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" `
                     -Name "UseLogonCredential" -Value 0 -Force
}

# Step 2: Verify the fix
Invoke-Command -ComputerName SRV-APP03 -ScriptBlock {
    (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest").UseLogonCredential
}

# Step 3: Check all other servers for the same issue
$allServers = Get-ADComputer -Filter "OperatingSystem -like '*Server*'" |
    Select-Object -ExpandProperty Name

$wdigestCheck = Invoke-Command -ComputerName $allServers -ScriptBlock {
    $val = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" `
        -Name "UseLogonCredential" -ErrorAction SilentlyContinue).UseLogonCredential
    [PSCustomObject]@{
        Computer = $env:COMPUTERNAME
        Value    = $val
        Status   = if ($val -eq 0 -or $null -eq $val) { "OK" } else { "COMPROMISED" }
    }
} -ThrottleLimit 50 -ErrorAction SilentlyContinue

$wdigestCheck | Where-Object Status -eq "COMPROMISED" | Format-Table -AutoSize

# Add a protective SACL and GPO to prevent recurrence
# 1. Deploy a GPO that enforces UseLogonCredential = 0
# 2. Add a SACL on the WDigest key to detect future modifications
# 3. Reset the password of svc.backup (it may be compromised)
# 4. Investigate PC-ADMIN-07 for signs of compromise

# Generate the incident report
$report = @"
INCIDENT REPORT - WDigest Credential Caching
=============================================
Date detected : $(Get-Date -Format "yyyy-MM-dd HH:mm")
Affected server : SRV-APP03
Modified value  : HKLM\SYSTEM\...\WDigest\UseLogonCredential
Changed from    : 0 to 1
Changed by      : ENTREPRISE\svc.backup
Source machine  : PC-ADMIN-07 (192.168.1.45)
Tool used       : reg.exe
Time of change  : 2026-04-02 14:47:12
Remediation     : Value restored to 0, svc.backup password reset
Status          : Under investigation
"@

$report | Out-File "C:\Admin\Incidents\INC-20260404-WDigest.txt" -Encoding UTF8