Antivirus enterprise¶

# List all Defender policy subkeys
Get-ChildItem "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -ErrorAction SilentlyContinue |
    Select-Object PSChildName | Sort-Object PSChildName

# Check Defender operational status via registry
$defPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender"
$polPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"

$operational = Get-ItemProperty -Path $defPath -ErrorAction SilentlyContinue
$policy = Get-ItemProperty -Path $polPath -ErrorAction SilentlyContinue

Write-Output "Defender installe       : $(if(Test-Path $defPath){'Oui'}else{'Non'})"
Write-Output "DisableAntiSpyware (legacy pol): $($policy.DisableAntiSpyware)"
Write-Output "ProductStatus           : $($operational.ProductStatus)"

# Cross-reference registry with Get-MpPreference
$prefs = Get-MpPreference
Write-Output "RealTime Protection    : $(-not $prefs.DisableRealtimeMonitoring)"
Write-Output "Cloud Protection       : $($prefs.MAPSReporting -ne 0)"
Write-Output "Exclusion Paths        : $($prefs.ExclusionPath -join '; ')"
Write-Output "Exclusion Processes    : $($prefs.ExclusionProcess -join '; ')"
Write-Output "Exclusion Extensions   : $($prefs.ExclusionExtension -join '; ')"

# List all exclusion categories
$exclPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions"
Get-ChildItem $exclPath -ErrorAction SilentlyContinue |
    Select-Object PSChildName

# Read path exclusions
$pathExcl = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths"
Get-ItemProperty -Path $pathExcl -ErrorAction SilentlyContinue |
    Select-Object * -ExcludeProperty PS*

# Read process exclusions
$procExcl = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes"
Get-ItemProperty -Path $procExcl -ErrorAction SilentlyContinue |
    Select-Object * -ExcludeProperty PS*

# Read extension exclusions
$extExcl = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions"
Get-ItemProperty -Path $extExcl -ErrorAction SilentlyContinue |
    Select-Object * -ExcludeProperty PS*

# Add a path exclusion via registry (GPO equivalent)
$pathExcl = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths"
if (-not (Test-Path $pathExcl)) {
    New-Item -Path $pathExcl -Force | Out-Null
}

# Enable exclusions
$exclRoot = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions"
Set-ItemProperty -Path $exclRoot -Name "Exclusions_Paths" -Value 1 -Type DWord

# Add the path (value name = path, value data = 0)
New-ItemProperty -Path $pathExcl -Name "C:\MonApp\Data" -Value 0 -PropertyType DWord -Force | Out-Null

# Verify
(Get-ItemProperty $pathExcl)."C:\MonApp\Data"

# Preferred method: use Add-MpPreference (updates registry automatically)
Add-MpPreference -ExclusionPath "C:\MonApp\Data"
Add-MpPreference -ExclusionProcess "monapp.exe"
Add-MpPreference -ExclusionExtension ".dat"

# Verify
$prefs = Get-MpPreference
Write-Output "Paths     : $($prefs.ExclusionPath -join '; ')"
Write-Output "Processes : $($prefs.ExclusionProcess -join '; ')"
Write-Output "Extensions: $($prefs.ExclusionExtension -join '; ')"

# Check Tamper Protection status
$tpPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features"
$tp = (Get-ItemProperty -Path $tpPath -Name "TamperProtection" -ErrorAction SilentlyContinue).TamperProtection

$states = @{
    0 = "Desactive"
    1 = "Active (par le systeme)"
    2 = "Active (par la politique cloud)"
    4 = "Active"
    5 = "Active et verrouille"
}

Write-Output "Tamper Protection : $($states[[int]$tp]) (valeur = $tp)"

# Attempt to disable real-time protection with Tamper Protection ON
try {
    Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" `
        -Name "DisableRealtimeMonitoring" -Value 1 -Type DWord -Force
    Write-Output "Modification reussie (Tamper Protection probablement desactive)"
} catch {
    Write-Output "Modification BLOQUEE par Tamper Protection"
}

# Even if the registry write succeeds, Defender ignores the policy value
$status = Get-MpComputerStatus
Write-Output "Protection temps reel effective : $($status.RealTimeProtectionEnabled)"

# Method 1: Disable via Microsoft 365 Defender portal (cloud-managed)
# Endpoint Security > Antivirus > Tamper Protection: Off
# This is the ONLY supported method for cloud-managed devices

# Method 2: For non-cloud devices, use local settings
# Windows Security > Virus & threat protection > Tamper Protection: Off

# Method 3: Check if Tamper Protection allows local admin override
$tpSource = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" `
    -Name "TamperProtectionSource" -ErrorAction SilentlyContinue).TamperProtectionSource
Write-Output "Source de Tamper Protection : $tpSource"
# Values: "Intune" = managed by cloud, "E5" = managed by Defender for Endpoint

# CrowdStrike registry locations
$csLocations = @(
    "HKLM:\SYSTEM\CrowdStrike",
    "HKLM:\SOFTWARE\CrowdStrike"
)

foreach ($loc in $csLocations) {
    Write-Output "=== $loc ==="
    if (Test-Path $loc) {
        Get-ChildItem $loc -ErrorAction SilentlyContinue |
            Select-Object PSChildName | ForEach-Object { Write-Output "  $($_.PSChildName)" }
    } else {
        Write-Output "  (non present)"
    }
}

# Read Falcon sensor information
$falconPath = "HKLM:\SYSTEM\CrowdStrike\{9B03C1D9-3138-44ED-9FAE-D9F4C034B88D}\{16e0423f-7058-48c9-a204-725362b67639}\Default"
$props = Get-ItemProperty -Path $falconPath -ErrorAction SilentlyContinue

Write-Output "Customer ID (CID) : $($props.CU)"
Write-Output "Agent ID (AID)    : $($props.AG)"
Write-Output "Sensor version    : $($props.adb)"

# Check CrowdStrike service status
$services = @("CSFalconService", "CSAgent")
foreach ($svc in $services) {
    $s = Get-Service $svc -ErrorAction SilentlyContinue
    if ($s) {
        Write-Output "$svc : $($s.Status) (StartType: $($s.StartType))"
    }
}

# Check if the kernel driver is loaded
$driver = Get-Service CSDeviceControl -ErrorAction SilentlyContinue
if ($driver) {
    Write-Output "CSDeviceControl (driver) : $($driver.Status)"
}

# Check Falcon cloud connectivity via registry
$connPath = "HKLM:\SYSTEM\CrowdStrike\{9B03C1D9-3138-44ED-9FAE-D9F4C034B88D}\{16e0423f-7058-48c9-a204-725362b67639}\Default"
$state = Get-ItemProperty -Path $connPath -Name "ProvisionState" -ErrorAction SilentlyContinue

Write-Output "Provision State : $($state.ProvisionState)"
# 0 = Not provisioned, 1 = Provisioned, 2 = Error

# Symantec Endpoint Protection registry paths
$sepPaths = @(
    "HKLM:\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion",
    "HKLM:\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC",
    "HKLM:\SOFTWARE\WOW6432Node\Symantec\Symantec Endpoint Protection\CurrentVersion"
)

foreach ($p in $sepPaths) {
    if (Test-Path $p) {
        Write-Output "=== $($p.Split('\')[-1]) ==="
        Get-ItemProperty -Path $p -ErrorAction SilentlyContinue |
            Select-Object ProductVersion, PRODUCTNAME, InstallDate
    }
}

# Check SEPM connection
$sylinkPath = "HKLM:\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC\SYLINK\SyLink"
$props = Get-ItemProperty -Path $sylinkPath -ErrorAction SilentlyContinue

Write-Output "Serveur SEPM    : $($props.ServerName)"
Write-Output "Communication   : $($props.CommunicationStatus)"
Write-Output "Dernier contact : $($props.LastUpdate)"

# Check SEP services
$sepServices = @("SepMasterService", "SNAC", "ccSvcHst")
foreach ($svc in $sepServices) {
    $s = Get-Service $svc -ErrorAction SilentlyContinue
    if ($s) {
        Write-Output "$svc : $($s.Status)"
    }
}

# Real-time protection registry settings
$rtPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"
Get-ItemProperty -Path $rtPath -ErrorAction SilentlyContinue |
    Select-Object DisableRealtimeMonitoring, DisableBehaviorMonitoring,
        DisableOnAccessProtection, DisableScanOnRealtimeEnable

# Scan schedule settings
$scanPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan"
Get-ItemProperty -Path $scanPath -ErrorAction SilentlyContinue |
    Select-Object ScheduleDay, ScheduleTime, ScanParameters, DisableCatchupFullScan

# Cloud protection settings
$cloudPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet"
$enginePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine"

$spynet = Get-ItemProperty -Path $cloudPath -ErrorAction SilentlyContinue
$engine = Get-ItemProperty -Path $enginePath -ErrorAction SilentlyContinue

Write-Output "SpyNetReporting              : $($spynet.SpyNetReporting)"
Write-Output "SubmitSamplesConsent         : $($spynet.SubmitSamplesConsent)"
Write-Output "MpCloudBlockLevel            : $($engine.MpCloudBlockLevel)"
Write-Output "MpBafsExtendedTimeout        : $($engine.MpBafsExtendedTimeout)"

# Check registered antivirus products via WMI (Windows Security Center)
$avProducts = Get-CimInstance -Namespace "root\SecurityCenter2" -ClassName AntiVirusProduct `
    -ErrorAction SilentlyContinue

$avProducts | ForEach-Object {
    [PSCustomObject]@{
        Product     = $_.displayName
        State       = "0x{0:X}" -f $_.productState
        Path        = $_.pathToSignedProductExe
    }
} | Format-Table -AutoSize

# Decode antivirus productState
function Decode-AVState {
    param([int]$State)

    $hex = "0x{0:X}" -f $State
    $stateBytes = [BitConverter]::GetBytes($State)

    $enabled = ($stateBytes[1] -band 0x10) -ne 0
    $upToDate = ($stateBytes[1] -band 0x00) -eq 0

    [PSCustomObject]@{
        HexState  = $hex
        Enabled   = $enabled
        UpToDate  = $upToDate
    }
}

$avProducts | ForEach-Object {
    $decoded = Decode-AVState -State $_.productState
    Write-Output "$($_.displayName) : Active=$($decoded.Enabled)"
}

# Check if Defender is in passive mode
$passivePath = "HKLM:\SOFTWARE\Microsoft\Windows Defender"
$passive = (Get-ItemProperty -Path $passivePath -Name "PassiveMode" `
    -ErrorAction SilentlyContinue).PassiveMode

$forcePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
$forcePassive = (Get-ItemProperty -Path $forcePath -Name "ForcePassiveMode" `
    -ErrorAction SilentlyContinue).ForcePassiveMode

Write-Output "Defender PassiveMode  : $passive"
Write-Output "ForcePassiveMode (pol): $forcePassive"

# Check for potential driver conflicts between security products
$filterDrivers = @("CSAgent", "WdFilter", "SymEFASI", "fltMgr")
foreach ($drv in $filterDrivers) {
    $svc = Get-Service $drv -ErrorAction SilentlyContinue
    if ($svc) {
        $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$drv"
        $start = (Get-ItemProperty $regPath -Name "Start" -ErrorAction SilentlyContinue).Start
        $group = (Get-ItemProperty $regPath -Name "Group" -ErrorAction SilentlyContinue).Group
        Write-Output "$drv : Status=$($svc.Status), Start=$start, Group=$group"
    }
}

# Check Defender threat history
$threats = Get-MpThreatDetection | Where-Object {
    $_.InitialDetectionTime -gt (Get-Date).AddDays(-7)
}

$threats | Select-Object ThreatID, @{N="Threat";E={
    (Get-MpThreat -ThreatID $_.ThreatID).ThreatName
}}, InitialDetectionTime, ActionSuccess |
    Format-Table -AutoSize

# Verify the digital signature of the blocked application
$exePath = "C:\Program Files\ComptaPro\ComptaPro.exe"
$sig = Get-AuthenticodeSignature -FilePath $exePath -ErrorAction SilentlyContinue

Write-Output "Fichier     : $exePath"
Write-Output "Statut      : $($sig.Status)"
Write-Output "Signataire  : $($sig.SignerCertificate.Subject)"
Write-Output "Emetteur    : $($sig.SignerCertificate.Issuer)"
Write-Output "Valide      : $($sig.SignerCertificate.NotAfter -gt (Get-Date))"

# Restore the file from quarantine first
$threats = Get-MpThreat | Where-Object { $_.ThreatName -match "Fuerboos" }
foreach ($t in $threats) {
    Remove-MpThreat -ThreatID $t.ThreatID
}
Write-Output "Menace retiree de la quarantaine."

# The file can also be submitted via:
# https://www.microsoft.com/en-us/wdsi/filesubmission

# Add targeted exclusions (path + process)
Add-MpPreference -ExclusionPath "C:\Program Files\ComptaPro"
Add-MpPreference -ExclusionProcess "ComptaPro.exe"

# Verify via registry
$pathExcl = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" `
    -ErrorAction SilentlyContinue
$procExcl = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" `
    -ErrorAction SilentlyContinue

Write-Output "Exclusion chemin  : $($pathExcl.'C:\Program Files\ComptaPro')"
Write-Output "Exclusion process : $($procExcl.'ComptaPro.exe')"

# GPO Registry Preferences to deploy:
# Computer Configuration > Preferences > Windows Settings > Registry

# Path exclusion
$regData = @{
    Hive   = "HKEY_LOCAL_MACHINE"
    Key    = "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths"
    Values = @{
        "C:\Program Files\ComptaPro" = @{ Type = "REG_DWORD"; Data = 0 }
    }
}

# Process exclusion
$regData2 = @{
    Hive   = "HKEY_LOCAL_MACHINE"
    Key    = "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes"
    Values = @{
        "ComptaPro.exe" = @{ Type = "REG_DWORD"; Data = 0 }
    }
}

# Enable the exclusion policy
$regData3 = @{
    Hive   = "HKEY_LOCAL_MACHINE"
    Key    = "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions"
    Values = @{
        "Exclusions_Paths"     = @{ Type = "REG_DWORD"; Data = 1 }
        "Exclusions_Processes" = @{ Type = "REG_DWORD"; Data = 1 }
    }
}

Write-Output "GPO Registry Preferences a configurer :"
Write-Output "  1. Paths\C:\Program Files\ComptaPro = 0 (REG_DWORD)"
Write-Output "  2. Processes\ComptaPro.exe = 0 (REG_DWORD)"
Write-Output "  3. Exclusions_Paths = 1, Exclusions_Processes = 1"

# Post-fix verification script
Write-Output "=== Verification post-correction ==="

# Check 1: Application runs
$proc = Start-Process "C:\Program Files\ComptaPro\ComptaPro.exe" -PassThru
Start-Sleep -Seconds 3
$running = -not $proc.HasExited
Write-Output "1. ComptaPro demarre : $running"
if ($running) { Stop-Process $proc -Force }

# Check 2: No new detections
$recentThreats = Get-MpThreatDetection |
    Where-Object {
        $_.InitialDetectionTime -gt (Get-Date).AddMinutes(-5) -and
        $_.Resources -match "ComptaPro"
    }
Write-Output "2. Nouvelles detections : $(if($recentThreats){'OUI (probleme)'}else{'Aucune (OK)'})"

# Check 3: Exclusions in place
$prefs = Get-MpPreference
$pathOk = $prefs.ExclusionPath -contains "C:\Program Files\ComptaPro"
$procOk = $prefs.ExclusionProcess -contains "ComptaPro.exe"
Write-Output "3. Exclusion chemin  : $pathOk"
Write-Output "4. Exclusion process : $procOk"

# Check 4: Real-time protection still active
$status = Get-MpComputerStatus
Write-Output "5. Protection temps reel : $($status.RealTimeProtectionEnabled)"