Backup et monitoring¶

# Check Veeam Backup & Replication installation
reg query "HKLM\SOFTWARE\Veeam\Veeam Backup and Replication" 2>$null

# Increase max simultaneous snapshots for VMware environments
Set-ItemProperty -Path "HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication" `
    -Name "MaxSnapshotsCount" -Value 8 -Type DWord

# Set verbose logging for troubleshooting
Set-ItemProperty -Path "HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication" `
    -Name "LoggingLevel" -Value 6 -Type DWord

# Check Veeam Agent installation and license
$agentPath = "HKLM:\SOFTWARE\Veeam\Veeam Agent for Microsoft Windows"
if (Test-Path $agentPath) {
    Get-ItemProperty -Path $agentPath |
        Select-Object InstallationPath, LicenseType
} else {
    Write-Output "Veeam Agent is not installed"
}

# Check wbengine service status and configuration
Get-Service -Name wbengine | Select-Object Name, Status, StartType

# Check backup schedule and recent history
Get-ScheduledTask -TaskPath "\Microsoft\Windows\Backup\" -ErrorAction SilentlyContinue |
    Select-Object TaskName, State
wbadmin get versions 2>$null | Select-Object -First 5

# Check Zabbix Agent 2 installation
reg query "HKLM\SOFTWARE\Zabbix SIA\Zabbix Agent 2" 2>$null

# Check Zabbix Agent 2 service
Get-Service -Name "Zabbix Agent 2" -ErrorAction SilentlyContinue |
    Select-Object Name, Status, StartType

# Deploy Zabbix Agent 2 with custom parameters via MSI
$msiArgs = @(
    "/i", "\\fileserver\deploy$\zabbix_agent2-7.0.0-windows-amd64.msi",
    "/qn",
    "SERVER=zabbix.corp.local",
    "SERVERACTIVE=zabbix.corp.local",
    "HOSTNAME=$env:COMPUTERNAME",
    "LISTENPORT=10050",
    "ENABLEPATH=1",
    "INSTALLFOLDER=`"C:\Program Files\Zabbix Agent 2`""
)
Start-Process "msiexec.exe" -ArgumentList $msiArgs -Wait -NoNewWindow

# Test Zabbix agent connectivity from the server
# Run this on the Zabbix server or proxy
zabbix_get -s 10.0.1.50 -k "agent.version"

# Check Zabbix Agent 2 log for errors
Get-Content "C:\Program Files\Zabbix Agent 2\zabbix_agent2.log" -Tail 20 |
    Select-String -Pattern "error|cannot|failed" -CaseSensitive:$false

# Configure SNMP community strings
$commPath = "HKLM:\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities"
if (-not (Test-Path $commPath)) {
    New-Item -Path $commPath -Force | Out-Null
}
# Set read-only community
Set-ItemProperty -Path $commPath -Name "monitoring-corp" -Value 4 -Type DWord
# Remove default "public" community if it exists
Remove-ItemProperty -Path $commPath -Name "public" -ErrorAction SilentlyContinue

# Configure permitted SNMP managers
$mgrPath = "HKLM:\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\PermittedManagers"
if (-not (Test-Path $mgrPath)) {
    New-Item -Path $mgrPath -Force | Out-Null
}
Set-ItemProperty -Path $mgrPath -Name "1" -Value "zabbix.corp.local" -Type String
Set-ItemProperty -Path $mgrPath -Name "2" -Value "nagios.corp.local" -Type String

# Configure SNMP trap destinations
$trapPath = "HKLM:\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration\monitoring-corp"
New-Item -Path $trapPath -Force | Out-Null
Set-ItemProperty -Path $trapPath -Name "1" -Value "zabbix.corp.local" -Type String

# Set SNMP contact/location and restart service
$rfcPath = "HKLM:\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\RFC1156Agent"
Set-ItemProperty -Path $rfcPath -Name "sysContact" -Value "infra@corp.local" -Type String
Set-ItemProperty -Path $rfcPath -Name "sysLocation" -Value "Datacenter Paris - Rack A12" -Type String
Restart-Service -Name "SNMP"

# Query key performance counters for monitoring
$counters = @(
    "\Processor(_Total)\% Processor Time",
    "\Memory\Available MBytes",
    "\PhysicalDisk(_Total)\Avg. Disk Queue Length"
)
Get-Counter -Counter $counters -SampleInterval 2 -MaxSamples 1 |
    Select-Object -ExpandProperty CounterSamples |
    Select-Object Path, CookedValue

# Audit permanent WMI event subscriptions (security concern)
Get-CimInstance -Namespace "root\subscription" -ClassName __EventFilter -ErrorAction SilentlyContinue |
    Select-Object Name, Query

# Check NSClient++ installation and service
reg query "HKLM\SOFTWARE\NSClient++" 2>$null
Get-Service -Name "nscp" -ErrorAction SilentlyContinue | Select-Object Name, Status, StartType

# Silent installation of NSClient++ with NRPE enabled
$msiArgs = @(
    "/i", "\\fileserver\deploy$\NSCP-0.5.2-x64.msi",
    "/qn",
    "ALLOWED_HOSTS=nagios.corp.local,icinga.corp.local",
    "PASSWORD=SecureMonitoringKey2025",
    "CONF_NRPE=1", "CONF_NSCA=0", "CONF_WEB=0", "NRPEMODE=LEGACY"
)
Start-Process "msiexec.exe" -ArgumentList $msiArgs -Wait -NoNewWindow

# Enable the Windows Event Collector service
wecutil qc /q

# Verify WEC service status
Get-Service -Name Wecsvc | Select-Object Name, Status, StartType

# Configure event forwarding subscription manager via registry
$wefPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager"
New-Item -Path $wefPath -Force | Out-Null
Set-ItemProperty -Path $wefPath -Name "1" `
    -Value "Server=https://wec.corp.local:5986/wsman/SubscriptionManager/WEC,Refresh=60" `
    -Type String

# Enable and configure WinRM on source machines
winrm quickconfig /q

# Verify WinRM listener
winrm enumerate winrm/config/listener

# Configure WEF collector server
# Run on the designated WEF collector

# Enable WEC service
wecutil qc /q

# Increase the Forwarded Events log size (default 20 MB is too small)
$logPath = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\ForwardedEvents"
Set-ItemProperty -Path $logPath -Name "MaxSize" -Value 4294967296 -Type DWord  # 4 GB
Set-ItemProperty -Path $logPath -Name "Retention" -Value 0 -Type DWord         # Overwrite as needed

# Verify the configuration
Get-ItemProperty -Path $logPath | Select-Object MaxSize, Retention

# Subscription 1: Authentication events
$authXml = @"
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>Auth-Events</SubscriptionId>
    <SubscriptionType>SourceInitiated</SubscriptionType>
    <Description>Authentication events from all servers</Description>
    <Enabled>true</Enabled>
    <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
    <ConfigurationMode>Custom</ConfigurationMode>
    <Delivery Mode="Push">
        <Batching><MaxLatencyTime>300000</MaxLatencyTime></Batching>
    </Delivery>
    <Query><![CDATA[
        <QueryList><Query Id="0" Path="Security">
            <Select Path="Security">*[System[(EventID=4624 or EventID=4625 or EventID=4648 or EventID=4672 or EventID=4768 or EventID=4771 or EventID=4776)]]</Select>
        </Query></QueryList>
    ]]></Query>
    <ReadExistingEvents>false</ReadExistingEvents>
    <TransportName>HTTP</TransportName>
    <AllowedSourceDomainComputers>O:NSG:BAD:P(A;;GA;;;DC)S:</AllowedSourceDomainComputers>
</Subscription>
"@
$authXml | Out-File "C:\WEF\Auth-Events.xml" -Encoding UTF8
wecutil cs "C:\WEF\Auth-Events.xml"

# Create all three subscriptions and verify
foreach ($sub in @("Auth-Events", "Account-Mgmt", "Critical-System")) {
    wecutil cs "C:\WEF\$sub.xml"
}
Write-Output "All subscriptions created successfully."

# GPO startup script: configure WEF source on each server
$wefPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager"
New-Item -Path $wefPath -Force | Out-Null
Set-ItemProperty -Path $wefPath -Name "1" `
    -Value "Server=https://wec.corp.local:5986/wsman/SubscriptionManager/WEC,Refresh=60" `
    -Type String

# Enable WinRM and open firewall
Set-Service -Name WinRM -StartupType Automatic
Start-Service -Name WinRM -ErrorAction SilentlyContinue
if (-not (Get-NetFirewallRule -Name "WINRM-HTTP-In-TCP" -ErrorAction SilentlyContinue)) {
    New-NetFirewallRule -Name "WINRM-HTTP-In-TCP" `
        -DisplayName "Windows Remote Management (HTTP-In)" `
        -Protocol TCP -LocalPort 5985 -Action Allow -Profile Domain
}
Write-Output "WEF source configured on $env:COMPUTERNAME"

# Monitor WEF subscription health on the collector
foreach ($sub in @("Auth-Events", "Account-Mgmt", "Critical-System")) {
    $runtime = wecutil gr $sub 2>&1
    $sourceCount = ($runtime | Select-String -Pattern "RunTimeStatus").Count
    Write-Output "$sub : $sourceCount sources actives"
}

# Check ForwardedEvents log size
$log = Get-WinEvent -ListLog "ForwardedEvents"
Write-Output "Journal: $([math]::Round($log.FileSize / 1MB, 2)) MB / $([math]::Round($log.MaximumSizeInBytes / 1MB, 2)) MB"