Deploiement et industrialisation¶

# Validate a .reg file before deployment
function Test-RegFile {
    param(
        [Parameter(Mandatory)]
        [string]$Path
    )

    if (-not (Test-Path $Path)) {
        Write-Error "File not found: $Path"
        return $false
    }

    $content = Get-Content -Path $Path -Raw -Encoding Unicode
    $issues = @()

    # Check header
    if ($content -notmatch "^Windows Registry Editor Version 5\.00") {
        $issues += "Missing or invalid header (expected 'Windows Registry Editor Version 5.00')"
    }

    # Check for dangerous paths
    $dangerousPaths = @(
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa",
        "HKEY_LOCAL_MACHINE\\SAM",
        "HKEY_LOCAL_MACHINE\\SECURITY",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services"
    )

    foreach ($dangerousPath in $dangerousPaths) {
        if ($content -match [regex]::Escape($dangerousPath)) {
            $issues += "WARNING: Modifies sensitive path: $dangerousPath"
        }
    }

    # Check for key deletions
    $deletions = [regex]::Matches($content, '\[-[^\]]+\]')
    if ($deletions.Count -gt 0) {
        $issues += "Contains $($deletions.Count) key deletion(s): $($deletions.Value -join ', ')"
    }

    # Summary
    if ($issues.Count -eq 0) {
        Write-Host "[PASS] $Path - No issues found" -ForegroundColor Green
        return $true
    } else {
        Write-Host "[WARN] $Path - $($issues.Count) issue(s) found:" -ForegroundColor Yellow
        $issues | ForEach-Object { Write-Host "  - $_" -ForegroundColor Yellow }
        return $false
    }
}

# Usage
Test-RegFile -Path "C:\Admin\Deploy\factupro-fix.reg"

# Deploy a .reg file with logging and rollback capability
function Deploy-RegFile {
    param(
        [Parameter(Mandatory)]
        [string]$RegFilePath,

        [Parameter(Mandatory)]
        [string]$LogDirectory
    )

    $timestamp = Get-Date -Format "yyyyMMdd-HHmmss"
    $computerName = $env:COMPUTERNAME
    $logFile = Join-Path $LogDirectory "regdeploy-$computerName-$timestamp.log"

    # Create backup of affected keys before applying
    $content = Get-Content $RegFilePath -Raw -Encoding Unicode
    $keys = [regex]::Matches($content, '\[(?!-)([^\]]+)\]') |
        ForEach-Object { $_.Groups[1].Value }

    $backupFile = Join-Path $LogDirectory "backup-$computerName-$timestamp.reg"

    foreach ($key in $keys) {
        $regPath = $key -replace "HKEY_LOCAL_MACHINE", "HKLM" -replace "HKEY_CURRENT_USER", "HKCU"
        reg export $regPath $backupFile /y 2>&1 | Out-Null
    }

    # Apply the .reg file
    $result = Start-Process -FilePath "reg.exe" -ArgumentList "import `"$RegFilePath`"" `
        -Wait -PassThru -NoNewWindow

    # Log the result
    $logEntry = @"
Timestamp  : $timestamp
Computer   : $computerName
RegFile    : $RegFilePath
BackupFile : $backupFile
ExitCode   : $($result.ExitCode)
Status     : $(if ($result.ExitCode -eq 0) { "Success" } else { "Failed" })
"@

    $logEntry | Out-File -FilePath $logFile -Encoding UTF8
    return $result.ExitCode -eq 0
}

# Usage
Deploy-RegFile -RegFilePath "C:\Admin\Deploy\factupro-fix.reg" `
               -LogDirectory "C:\Admin\Logs\RegDeploy"

# Mass deployment of a .reg file via PowerShell Remoting
$computers = Get-ADComputer -Filter "Name -like 'PC-FINANCE-*'" |
    Select-Object -ExpandProperty Name

$regContent = Get-Content "C:\Admin\Deploy\factupro-fix.reg" -Raw -Encoding Unicode

$deployResults = Invoke-Command -ComputerName $computers -ScriptBlock {
    param($regData, $timestamp)

    $tempFile = Join-Path $env:TEMP "deploy-$timestamp.reg"
    $logFile  = "C:\Windows\Logs\RegDeploy\deploy-$timestamp.log"

    try {
        # Ensure log directory exists
        $logDir = Split-Path $logFile -Parent
        if (-not (Test-Path $logDir)) { New-Item -Path $logDir -ItemType Directory -Force | Out-Null }

        # Write .reg file to temp
        $regData | Out-File -FilePath $tempFile -Encoding Unicode -Force

        # Apply
        $proc = Start-Process -FilePath "reg.exe" -ArgumentList "import `"$tempFile`"" `
            -Wait -PassThru -NoNewWindow

        # Log
        "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') | ExitCode: $($proc.ExitCode)" |
            Out-File $logFile -Encoding UTF8

        # Cleanup temp file
        Remove-Item $tempFile -Force -ErrorAction SilentlyContinue

        [PSCustomObject]@{
            Computer = $env:COMPUTERNAME
            Status   = if ($proc.ExitCode -eq 0) { "Success" } else { "Failed" }
            ExitCode = $proc.ExitCode
        }
    } catch {
        [PSCustomObject]@{
            Computer = $env:COMPUTERNAME
            Status   = "Error"
            ExitCode = -1
        }
    }
} -ArgumentList $regContent, (Get-Date -Format "yyyyMMdd-HHmmss") `
  -ThrottleLimit 50 -ErrorAction SilentlyContinue

# Summary
$deployResults | Group-Object Status | Select-Object Name, Count | Format-Table -AutoSize

# DSC configuration for security baseline registry settings
Configuration SecurityBaseline {

    param(
        [Parameter(Mandatory)]
        [string[]]$ComputerName
    )

    Import-DscResource -ModuleName PSDesiredStateConfiguration

    Node $ComputerName {

        # CIS 2.3.1.1 - Limit blank password use
        Registry LimitBlankPasswordUse {
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa"
            ValueName = "LimitBlankPasswordUse"
            ValueData = "1"
            ValueType = "Dword"
        }

        # CIS 2.3.7.1 - SMB server signing required
        Registry SMBServerSigning {
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
            ValueName = "RequireSecuritySignature"
            ValueData = "1"
            ValueType = "Dword"
        }

        # CIS 2.3.7.2 - SMB client signing required
        Registry SMBClientSigning {
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManWorkstation\Parameters"
            ValueName = "RequireSecuritySignature"
            ValueData = "1"
            ValueType = "Dword"
        }

        # STIG V-220972 - Disable WDigest credential caching
        Registry WDigestDisabled {
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest"
            ValueName = "UseLogonCredential"
            ValueData = "0"
            ValueType = "Dword"
        }

        # CIS 18.10.42.1 - Disable WinRM basic authentication
        Registry WinRMNoBasic {
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service"
            ValueName = "AllowBasic"
            ValueData = "0"
            ValueType = "Dword"
        }

        # Application-specific setting
        Registry FactuProEndpoint {
            Ensure    = "Present"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\MonEntreprise\FactuPro"
            ValueName = "ApiEndpoint"
            ValueData = "factuapi-v2.entreprise.local"
            ValueType = "String"
        }

        # Remove a deprecated value
        Registry RemoveOldEndpoint {
            Ensure    = "Absent"
            Key       = "HKEY_LOCAL_MACHINE\SOFTWARE\MonEntreprise\FactuPro\Legacy"
            ValueName = "OldEndpoint"
        }
    }
}

# Compile the DSC configuration (generates .mof files)
SecurityBaseline -ComputerName "SRV-APP01", "SRV-APP02", "SRV-APP03" `
    -OutputPath "C:\Admin\DSC\SecurityBaseline"

# List the generated MOF files
Get-ChildItem "C:\Admin\DSC\SecurityBaseline" -Filter "*.mof"

# Apply the configuration in Push mode
Start-DscConfiguration -Path "C:\Admin\DSC\SecurityBaseline" -Wait -Verbose -Force

# Configure LCM (Local Configuration Manager) for Pull mode with monitoring
[DSCLocalConfigurationManager()]
Configuration LCMConfig {

    param(
        [Parameter(Mandatory)]
        [string[]]$ComputerName
    )

    Node $ComputerName {
        Settings {
            RefreshMode                    = "Pull"
            ConfigurationMode              = "ApplyAndAutoCorrect"
            ConfigurationModeFrequencyMins = 30
            RefreshFrequencyMins           = 30
            RebootNodeIfNeeded             = $false
            AllowModuleOverwrite           = $true
            StatusRetentionTimeInDays      = 7
        }
    }
}

# Compile and apply the LCM configuration
LCMConfig -ComputerName "SRV-APP01" -OutputPath "C:\Admin\DSC\LCMConfig"
Set-DscLocalConfigurationManager -Path "C:\Admin\DSC\LCMConfig" -Verbose

# Check DSC compliance status on a remote machine
Invoke-Command -ComputerName "SRV-APP01" -ScriptBlock {
    $status = Get-DscConfigurationStatus
    [PSCustomObject]@{
        Computer         = $env:COMPUTERNAME
        Status           = $status.Status
        Type             = $status.Type
        StartDate        = $status.StartDate
        DurationInSeconds = $status.DurationInSeconds
        RebootRequested  = $status.RebootRequested
        ResourcesInDesiredState    = $status.ResourcesInDesiredState.Count
        ResourcesNotInDesiredState = $status.ResourcesNotInDesiredState.Count
    }
}

# Get details about non-compliant resources
Invoke-Command -ComputerName "SRV-APP01" -ScriptBlock {
    $status = Get-DscConfigurationStatus
    $status.ResourcesNotInDesiredState | ForEach-Object {
        [PSCustomObject]@{
            ResourceId   = $_.ResourceId
            ResourceName = $_.ResourceName
            InDesiredState = $_.InDesiredState
            StartDate    = $_.StartDate
            DurationInSeconds = $_.DurationInSeconds
        }
    }
}

# Monitor DSC compliance across all servers
$servers = Get-ADComputer -Filter "OperatingSystem -like '*Server*'" |
    Select-Object -ExpandProperty Name

$complianceReport = Invoke-Command -ComputerName $servers -ScriptBlock {
    try {
        $status = Get-DscConfigurationStatus -ErrorAction Stop
        [PSCustomObject]@{
            Computer    = $env:COMPUTERNAME
            Status      = $status.Status
            LastRun     = $status.StartDate
            InDesired   = $status.ResourcesInDesiredState.Count
            NotDesired  = $status.ResourcesNotInDesiredState.Count
            Compliant   = ($status.ResourcesNotInDesiredState.Count -eq 0)
        }
    } catch {
        [PSCustomObject]@{
            Computer    = $env:COMPUTERNAME
            Status      = "NoDSC"
            LastRun     = $null
            InDesired   = 0
            NotDesired  = 0
            Compliant   = $false
        }
    }
} -ThrottleLimit 50 -ErrorAction SilentlyContinue

# Summary
$complianceReport | Sort-Object Compliant, Computer |
    Format-Table Computer, Status, LastRun, InDesired, NotDesired,
        @{N="Compliance";E={if ($_.Compliant) {"OK"} else {"DRIFT"}}} -AutoSize

# Generate OMA-URI definitions for Intune import
$omaSettings = @(
    [PSCustomObject]@{
        Name     = "Disable WDigest"
        OmaUri   = "./Device/Vendor/MSFT/Registry/HKLM/SYSTEM/CurrentControlSet/Control/SecurityProviders/WDigest/UseLogonCredential"
        DataType = "Integer"
        Value    = "0"
    },
    [PSCustomObject]@{
        Name     = "SMB Server Signing"
        OmaUri   = "./Device/Vendor/MSFT/Registry/HKLM/SYSTEM/CurrentControlSet/Services/LanmanServer/Parameters/RequireSecuritySignature"
        DataType = "Integer"
        Value    = "1"
    },
    [PSCustomObject]@{
        Name     = "Limit Blank Passwords"
        OmaUri   = "./Device/Vendor/MSFT/Registry/HKLM/SYSTEM/CurrentControlSet/Control/Lsa/LimitBlankPasswordUse"
        DataType = "Integer"
        Value    = "1"
    },
    [PSCustomObject]@{
        Name     = "FactuPro Endpoint"
        OmaUri   = "./Device/Vendor/MSFT/Registry/HKLM/SOFTWARE/MonEntreprise/FactuPro/ApiEndpoint"
        DataType = "String"
        Value    = "factuapi-v2.entreprise.local"
    }
)

$omaSettings | Export-Csv "C:\Admin\Intune\oma-uri-baseline.csv" -NoTypeInformation
$omaSettings | Format-Table -AutoSize

# On the Intune-managed device: verify MDM applied registry settings
# Check the MDM diagnostic log
$mdmDiagPath = "$env:ProgramData\Microsoft\IntuneManagementExtension\Logs"
Get-ChildItem $mdmDiagPath -Filter "*.log" | Sort-Object LastWriteTime -Descending | Select-Object -First 3

# Verify a specific registry value set by Intune
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" `
    -Name "UseLogonCredential"

# Check MDM enrollment status
dsregcmd /status | Select-String "AzureAdJoined|MdmUrl|TenantName"

# SecurityBaseline.Tests.ps1 - Pester tests for registry compliance

Describe "Security Baseline - Registry Compliance" {

    Context "Authentication hardening" {

        It "CIS 2.3.1.1 - Blank passwords should be blocked" {
            $value = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
                -Name "LimitBlankPasswordUse" -ErrorAction SilentlyContinue
            $value.LimitBlankPasswordUse | Should -Be 1
        }

        It "STIG V-220972 - WDigest credential caching should be disabled" {
            $value = Get-ItemProperty `
                "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" `
                -Name "UseLogonCredential" -ErrorAction SilentlyContinue
            $value.UseLogonCredential | Should -Be 0
        }

        It "WinRM basic authentication should be disabled" {
            $value = Get-ItemProperty `
                "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service" `
                -Name "AllowBasic" -ErrorAction SilentlyContinue
            $value.AllowBasic | Should -Be 0
        }
    }

    Context "Network hardening" {

        It "CIS 2.3.7.1 - SMB server signing should be required" {
            $value = Get-ItemProperty `
                "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" `
                -Name "RequireSecuritySignature" -ErrorAction SilentlyContinue
            $value.RequireSecuritySignature | Should -Be 1
        }

        It "CIS 2.3.7.2 - SMB client signing should be required" {
            $value = Get-ItemProperty `
                "HKLM:\SYSTEM\CurrentControlSet\Services\LanManWorkstation\Parameters" `
                -Name "RequireSecuritySignature" -ErrorAction SilentlyContinue
            $value.RequireSecuritySignature | Should -Be 1
        }
    }

    Context "Application configuration" {

        It "FactuPro API endpoint should be set to v2" {
            $value = Get-ItemProperty "HKLM:\SOFTWARE\MonEntreprise\FactuPro" `
                -Name "ApiEndpoint" -ErrorAction SilentlyContinue
            $value.ApiEndpoint | Should -Be "factuapi-v2.entreprise.local"
        }

        It "Legacy FactuPro endpoint should be removed" {
            $path = "HKLM:\SOFTWARE\MonEntreprise\FactuPro\Legacy"
            $value = Get-ItemProperty $path -Name "OldEndpoint" -ErrorAction SilentlyContinue
            $value | Should -BeNullOrEmpty
        }
    }
}

# Run Pester tests
Invoke-Pester -Path "C:\Admin\Tests\SecurityBaseline.Tests.ps1" -Output Detailed

# Run Pester tests on remote machines
$computers = @("SRV-APP01", "SRV-APP02", "SRV-APP03")
$testScript = Get-Content "C:\Admin\Tests\SecurityBaseline.Tests.ps1" -Raw

$remoteResults = Invoke-Command -ComputerName $computers -ScriptBlock {
    param($script)

    # Write test script to temp
    $tempTest = Join-Path $env:TEMP "SecurityBaseline.Tests.ps1"
    $script | Out-File $tempTest -Encoding UTF8

    # Run Pester and return results
    $pesterResult = Invoke-Pester -Path $tempTest -PassThru -Output None

    # Clean up
    Remove-Item $tempTest -Force

    [PSCustomObject]@{
        Computer = $env:COMPUTERNAME
        Total    = $pesterResult.TotalCount
        Passed   = $pesterResult.PassedCount
        Failed   = $pesterResult.FailedCount
        Score    = if ($pesterResult.TotalCount -gt 0) {
            [math]::Round(($pesterResult.PassedCount / $pesterResult.TotalCount) * 100, 1)
        } else { 0 }
        FailedTests = ($pesterResult.Failed | ForEach-Object { $_.Name }) -join "; "
    }
} -ArgumentList $testScript -ThrottleLimit 50

$remoteResults | Format-Table Computer, Passed, Failed, Score, FailedTests -AutoSize

# baseline-config.psd1 - Registry baseline definition (versionable in Git)
@{
    Version     = "2026.04.01"
    Author      = "Infrastructure Team"
    Description = "Standard registry baseline for enterprise workstations"

    Settings = @(
        # Security hardening
        @{
            Category = "Security"
            Name     = "LimitBlankPasswordUse"
            Key      = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
            Value    = 1
            Type     = "DWord"
        },
        @{
            Category = "Security"
            Name     = "UseLogonCredential"
            Key      = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest"
            Value    = 0
            Type     = "DWord"
        },
        @{
            Category = "Security"
            Name     = "RequireSecuritySignature"
            Key      = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
            Value    = 1
            Type     = "DWord"
        },

        # Network configuration
        @{
            Category = "Network"
            Name     = "NtpServer"
            Key      = "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters"
            Value    = "ntp.entreprise.local,0x9"
            Type     = "String"
        },

        # Application configuration
        @{
            Category = "Application"
            Name     = "ApiEndpoint"
            Key      = "HKLM:\SOFTWARE\MonEntreprise\FactuPro"
            Value    = "factuapi-v2.entreprise.local"
            Type     = "String"
        },
        @{
            Category = "Application"
            Name     = "SyncIntervalMinutes"
            Key      = "HKLM:\SOFTWARE\MonEntreprise\FactuPro"
            Value    = 60
            Type     = "DWord"
        }
    )
}

# Deploy-Baseline.ps1 - Universal baseline deployment script

param(
    [Parameter(Mandatory)]
    [string]$BaselineFile,

    [Parameter(Mandatory)]
    [string[]]$ComputerName,

    [int]$ThrottleLimit = 50
)

# Load the baseline
$baseline = Import-PowerShellDataFile -Path $BaselineFile
Write-Host "Baseline version: $($baseline.Version)"
Write-Host "Settings count : $($baseline.Settings.Count)"
Write-Host "Target machines : $($ComputerName.Count)"

# Deploy to all machines
$results = Invoke-Command -ComputerName $ComputerName -ScriptBlock {
    param($settings)

    $machineResults = @()

    foreach ($setting in $settings) {
        $result = [PSCustomObject]@{
            Computer = $env:COMPUTERNAME
            Category = $setting.Category
            Name     = $setting.Name
            Status   = "Unknown"
        }

        try {
            # Create key if it does not exist
            if (-not (Test-Path $setting.Key)) {
                New-Item -Path $setting.Key -Force | Out-Null
            }

            # Set the value
            $params = @{
                Path  = $setting.Key
                Name  = $setting.Name
                Value = $setting.Value
                Force = $true
            }

            if ($setting.Type -eq "DWord") {
                $params["PropertyType"] = "DWord"
            } elseif ($setting.Type -eq "String") {
                $params["PropertyType"] = "String"
            }

            # Check if value already exists
            $existing = Get-ItemProperty -Path $setting.Key -Name $setting.Name -ErrorAction SilentlyContinue
            if ($existing) {
                Set-ItemProperty -Path $setting.Key -Name $setting.Name -Value $setting.Value -Force
            } else {
                New-ItemProperty @params | Out-Null
            }

            $result.Status = "Applied"
        } catch {
            $result.Status = "Failed: $($_.Exception.Message)"
        }

        $machineResults += $result
    }

    $machineResults
} -ArgumentList (,$baseline.Settings) -ThrottleLimit $ThrottleLimit -ErrorAction SilentlyContinue `
  -ErrorVariable deployErrors

# Display results
$results | Group-Object Status | Select-Object Name, Count | Format-Table -AutoSize

# Show unreachable machines
if ($deployErrors) {
    Write-Host "`nUnreachable machines:" -ForegroundColor Yellow
    $deployErrors | ForEach-Object { Write-Host "  - $($_.TargetObject)" -ForegroundColor Yellow }
}

# Run validation tests against all new site machines
$newSiteMachines = Get-ADComputer -SearchBase "OU=Site2,OU=Workstations,DC=entreprise,DC=local" `
    -Filter * | Select-Object -ExpandProperty Name

# Generate Pester tests dynamically from the baseline
$baseline = Import-PowerShellDataFile "C:\Admin\Baselines\baseline-config.psd1"

$testScript = @"
Describe "Site 2 Baseline Compliance" {
$(foreach ($s in $baseline.Settings) {
    $expected = if ($s.Type -eq "String") { "'$($s.Value)'" } else { $s.Value }
@"

    It "$($s.Category) - $($s.Name) should be $expected" {
        `$value = Get-ItemProperty "$($s.Key)" -Name "$($s.Name)" -ErrorAction SilentlyContinue
        `$value.$($s.Name) | Should -Be $expected
    }
"@
})
}
"@

# Run on all machines
$testResults = Invoke-Command -ComputerName $newSiteMachines -ScriptBlock {
    param($script)
    $tmp = Join-Path $env:TEMP "baseline-test.ps1"
    $script | Out-File $tmp -Encoding UTF8
    $r = Invoke-Pester -Path $tmp -PassThru -Output None
    Remove-Item $tmp -Force
    [PSCustomObject]@{
        Computer = $env:COMPUTERNAME
        Passed   = $r.PassedCount
        Failed   = $r.FailedCount
        Score    = [math]::Round(($r.PassedCount / $r.TotalCount) * 100, 1)
    }
} -ArgumentList $testScript -ThrottleLimit 50

# Final report
$testResults | Sort-Object Score |
    Format-Table Computer, Passed, Failed, @{N="Score";E={"$($_.Score)%"}} -AutoSize

$avgScore = ($testResults | Measure-Object -Property Score -Average).Average
Write-Host "`nAverage compliance score: $([math]::Round($avgScore, 1))%"

# Set up DSC to maintain the baseline continuously on all Site 2 machines
# This ensures any future drift is automatically corrected

# Generate DSC configuration from the same baseline file
$baseline = Import-PowerShellDataFile "C:\Admin\Baselines\baseline-config.psd1"

Configuration Site2Baseline {
    param([string[]]$ComputerName)

    Import-DscResource -ModuleName PSDesiredStateConfiguration

    Node $ComputerName {
        foreach ($setting in $using:baseline.Settings) {
            $resourceName = "$($setting.Category)_$($setting.Name)" -replace '[^a-zA-Z0-9_]', ''

            Registry $resourceName {
                Ensure    = "Present"
                Key       = $setting.Key -replace "HKLM:", "HKEY_LOCAL_MACHINE"
                ValueName = $setting.Name
                ValueData = [string]$setting.Value
                ValueType = $setting.Type
            }
        }
    }
}

# Compile and deploy
$allSite2 = $newSiteMachines
Site2Baseline -ComputerName $allSite2 -OutputPath "C:\Admin\DSC\Site2Baseline"
Start-DscConfiguration -Path "C:\Admin\DSC\Site2Baseline" -Wait -Force