Adobe Creative Suite & Java/JRE¶

# Check Adobe Reader DC installation and version
$paths = @(
    "HKLM:\SOFTWARE\Adobe\Acrobat Reader\DC\Installer",
    "HKLM:\SOFTWARE\WOW6432Node\Adobe\Acrobat Reader\DC\Installer"
)

foreach ($p in $paths) {
    if (Test-Path $p) {
        $info = Get-ItemProperty -Path $p -ErrorAction SilentlyContinue
        Write-Output "Path    : $p"
        Write-Output "Version : $($info.VersionMajor).$($info.VersionMinor)"
        Write-Output "Instdir : $($info.Path)"
        break
    }
}

# Harden Adobe Reader DC via registry
$featurePath = "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown"
New-Item -Path $featurePath -Force | Out-Null

# Disable JavaScript execution in PDFs
Set-ItemProperty -Path $featurePath -Name "bDisableJavaScript" -Value 1 -Type DWord

# Disable Flash content
Set-ItemProperty -Path $featurePath -Name "bEnableFlash" -Value 0 -Type DWord

# Enable Enhanced Security (standalone and browser)
Set-ItemProperty -Path $featurePath -Name "bEnhancedSecurityStandalone" -Value 1 -Type DWord
Set-ItemProperty -Path $featurePath -Name "bEnhancedSecurityInBrowser" -Value 1 -Type DWord

# Enable Protected Mode (sandbox)
Set-ItemProperty -Path $featurePath -Name "bProtectedMode" -Value 1 -Type DWord

# Enable Protected View for all files
Set-ItemProperty -Path $featurePath -Name "iProtectedView" -Value 2 -Type DWord

# Disable all Adobe cloud services
$svcPath = "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cServices"
New-Item -Path $svcPath -Force | Out-Null

Set-ItemProperty -Path $svcPath -Name "bToggleAdobeDocumentServices" -Value 1 -Type DWord
Set-ItemProperty -Path $svcPath -Name "bToggleWebConnectors" -Value 1 -Type DWord
Set-ItemProperty -Path $svcPath -Name "bToggleSendAndTrack" -Value 1 -Type DWord
Set-ItemProperty -Path $svcPath -Name "bToggleAdobeSign" -Value 1 -Type DWord

# Disable SharePoint and Webmail integration
$spPath = "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cSharePoint"
New-Item -Path $spPath -Force | Out-Null
Set-ItemProperty -Path $spPath -Name "bDisableSharePointFeatures" -Value 1 -Type DWord

$wmPath = "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cWebmailProfiles"
New-Item -Path $wmPath -Force | Out-Null
Set-ItemProperty -Path $wmPath -Name "bDisableWebmail" -Value 1 -Type DWord

# Check Adobe ARM (update manager) configuration
$armPath = "HKLM:\SOFTWARE\Adobe\Adobe ARM\1.0\ARM"
if (Test-Path $armPath) {
    Get-ItemProperty -Path $armPath | Select-Object iCheckReader, iDisableCheckForUpdates, Mode
} else {
    Write-Output "Adobe ARM not found. Check WOW6432Node path."
    $armWow = "HKLM:\SOFTWARE\WOW6432Node\Adobe\Adobe ARM\1.0\ARM"
    if (Test-Path $armWow) {
        Get-ItemProperty -Path $armWow | Select-Object iCheckReader, iDisableCheckForUpdates, Mode
    }
}

# Disable Adobe automatic updates via ARM
$armPath = "HKLM:\SOFTWARE\Adobe\Adobe ARM\1.0\ARM"
New-Item -Path $armPath -Force | Out-Null
Set-ItemProperty -Path $armPath -Name "iCheckReader" -Value 0 -Type DWord
Set-ItemProperty -Path $armPath -Name "iDisableCheckForUpdates" -Value 1 -Type DWord
Set-ItemProperty -Path $armPath -Name "Mode" -Value 0 -Type DWord

# Disable Adobe Acrobat Update Service
Set-Service -Name "AdobeARMservice" -StartupType Disabled -ErrorAction SilentlyContinue
Stop-Service -Name "AdobeARMservice" -ErrorAction SilentlyContinue

# Disable Adobe Genuine Monitor Service
Set-Service -Name "AGMService" -StartupType Disabled -ErrorAction SilentlyContinue

# Verify services status
foreach ($svc in @("AdobeARMservice", "AGMService", "AdobeUpdateService")) {
    $s = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($s) {
        Write-Output "$($s.Name) : Status=$($s.Status), StartType=$($s.StartType)"
    }
}

# Pin Adobe Reader to a specific version by blocking ARM checks
$armLegacyPath = "HKLM:\SOFTWARE\Adobe\Adobe ARM\Legacy\Reader\{AC76BA86-7AD7-1036-7B44-AC0F074E4100}"
if (-not (Test-Path $armLegacyPath)) {
    New-Item -Path $armLegacyPath -Force | Out-Null
}
Set-ItemProperty -Path $armLegacyPath -Name "Mode" -Value 0 -Type DWord

# Block Creative Cloud Desktop App auto-update
$ccxPath = "HKLM:\SOFTWARE\Policies\Adobe\CCXProcess"
New-Item -Path $ccxPath -Force | Out-Null
Set-ItemProperty -Path $ccxPath -Name "DisableAutoUpdate" -Value 1 -Type DWord

# Verify current installed version
$readerExe = "C:\Program Files\Adobe\Acrobat DC\Reader\AcroRd32.exe"
if (Test-Path $readerExe) {
    $ver = (Get-Item $readerExe).VersionInfo.ProductVersion
    Write-Output "Adobe Reader DC version courante : $ver"
} else {
    $readerExe64 = "C:\Program Files\Adobe\Acrobat DC\Reader\Acrobat.exe"
    if (Test-Path $readerExe64) {
        $ver = (Get-Item $readerExe64).VersionInfo.ProductVersion
        Write-Output "Adobe Acrobat DC version courante : $ver"
    }
}

# Enumerate all installed Java versions
$jrePaths = @(
    "HKLM:\SOFTWARE\JavaSoft\Java Runtime Environment",
    "HKLM:\SOFTWARE\WOW6432Node\JavaSoft\Java Runtime Environment",
    "HKLM:\SOFTWARE\JavaSoft\JDK",
    "HKLM:\SOFTWARE\Eclipse Adoptium\JRE",
    "HKLM:\SOFTWARE\Eclipse Adoptium\JDK"
)

foreach ($base in $jrePaths) {
    if (Test-Path $base) {
        Write-Output "=== $base ==="
        $props = Get-ItemProperty -Path $base -ErrorAction SilentlyContinue
        if ($props.CurrentVersion) {
            Write-Output "  Current Version : $($props.CurrentVersion)"
        }
        Get-ChildItem -Path $base -ErrorAction SilentlyContinue |
            ForEach-Object {
                $verProps = Get-ItemProperty -Path $_.PSPath -ErrorAction SilentlyContinue
                Write-Output "  $($_.PSChildName) -> JavaHome: $($verProps.JavaHome)"
            }
    }
}

# Get detailed Java version info from registry
$currentVer = (Get-ItemProperty "HKLM:\SOFTWARE\JavaSoft\Java Runtime Environment" -ErrorAction SilentlyContinue).CurrentVersion
if ($currentVer) {
    $verPath = "HKLM:\SOFTWARE\JavaSoft\Java Runtime Environment\$currentVer"
    $info = Get-ItemProperty -Path $verPath -ErrorAction SilentlyContinue
    Write-Output "Java Version  : $currentVer"
    Write-Output "Java Home     : $($info.JavaHome)"
    Write-Output "Runtime Lib   : $($info.RuntimeLib)"
    Write-Output "Update Version: $($info.UpdateVersion)"
}

# Set Java security level to High via registry
$jrePath = "HKLM:\SOFTWARE\JavaSoft\Java Runtime Environment"
if (Test-Path $jrePath) {
    Set-ItemProperty -Path $jrePath -Name "SECURITY_LEVEL" -Value 2 -Type DWord
    Write-Output "Java security level set to HIGH (2)"
}

# Deploy Java Exception Site List for all users
$deploymentDir = "$env:WINDIR\Sun\Java\Deployment"
$securityDir = "$deploymentDir\security"
New-Item -Path $securityDir -ItemType Directory -Force | Out-Null

# Create the exception site list
$exceptionSites = @(
    "https://erp.entreprise.com",
    "https://compta.entreprise.com",
    "https://intranet.entreprise.com:8443"
)
$exceptionSites | Out-File "$securityDir\exception.sites" -Encoding ASCII

# Create deployment.properties to point to the system-wide config
$deploymentProps = @"
deployment.user.security.exception.sites=$securityDir\exception.sites
deployment.security.level=HIGH
deployment.security.level.locked
"@
$deploymentProps | Out-File "$deploymentDir\deployment.properties" -Encoding ASCII

# Verify files created
Get-ChildItem $securityDir
Get-Content "$securityDir\exception.sites"

# Point Java to the Deployment Rule Set
$jrePath = "HKLM:\SOFTWARE\JavaSoft\Java Runtime Environment"
Set-ItemProperty -Path $jrePath -Name "DEPLOYMENT_RULE_SET" `
    -Value "C:\Windows\Sun\Java\Deployment\DeploymentRuleSet.jar" -Type String

# Verify the DRS path
$drsPath = (Get-ItemProperty -Path $jrePath -ErrorAction SilentlyContinue).DEPLOYMENT_RULE_SET
Write-Output "DRS Path : $drsPath"
Write-Output "DRS Exists : $(Test-Path $drsPath)"

# Disable Java auto-update completely
$updatePaths = @(
    "HKLM:\SOFTWARE\JavaSoft\Java Update\Policy",
    "HKLM:\SOFTWARE\WOW6432Node\JavaSoft\Java Update\Policy"
)

foreach ($path in $updatePaths) {
    if (-not (Test-Path $path)) {
        New-Item -Path $path -Force | Out-Null
    }
    Set-ItemProperty -Path $path -Name "EnableJavaUpdate" -Value 0 -Type DWord
    Set-ItemProperty -Path $path -Name "EnableAutoUpdateCheck" -Value 0 -Type DWord
    Set-ItemProperty -Path $path -Name "NotifyDownload" -Value 0 -Type DWord
    Set-ItemProperty -Path $path -Name "NotifyInstall" -Value 0 -Type DWord
}

# Disable the Java Update Scheduler task
$taskName = "JavaUpdateSched"
$task = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue
if ($task) {
    Disable-ScheduledTask -TaskName $taskName
    Write-Output "Task '$taskName' disabled."
} else {
    Write-Output "Task '$taskName' not found."
}

# Disable Java Update Service
Set-Service -Name "JavaQuickStarterService" -StartupType Disabled -ErrorAction SilentlyContinue
Stop-Service -Name "JavaQuickStarterService" -ErrorAction SilentlyContinue

# List all installed Java versions with their paths
$registryRoots = @(
    "HKLM:\SOFTWARE\JavaSoft\Java Runtime Environment",
    "HKLM:\SOFTWARE\WOW6432Node\JavaSoft\Java Runtime Environment"
)

$javaVersions = @()
foreach ($root in $registryRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -ErrorAction SilentlyContinue |
            ForEach-Object {
                $props = Get-ItemProperty -Path $_.PSPath -ErrorAction SilentlyContinue
                if ($props.JavaHome) {
                    $javaVersions += [PSCustomObject]@{
                        Version  = $_.PSChildName
                        JavaHome = $props.JavaHome
                        Arch     = if ($root -match "WOW6432") { "x86" } else { "x64" }
                        Exists   = Test-Path $props.JavaHome
                    }
                }
            }
    }
}
$javaVersions | Format-Table -AutoSize

# Set default Java version via registry
$targetVersion = "1.8.0_401"
$jrePath = "HKLM:\SOFTWARE\JavaSoft\Java Runtime Environment"

if (Test-Path "$jrePath\$targetVersion") {
    Set-ItemProperty -Path $jrePath -Name "CurrentVersion" -Value $targetVersion -Type String
    Write-Output "Default Java version set to $targetVersion"

    # Verify
    $current = (Get-ItemProperty $jrePath).CurrentVersion
    Write-Output "Current version (registry) : $current"
    & java -version 2>&1 | Select-Object -First 1
} else {
    Write-Output "Version $targetVersion not found in registry."
}

# Disable Java browser plugin
$pluginPaths = @(
    "HKLM:\SOFTWARE\JavaSoft\Java Plug-in",
    "HKLM:\SOFTWARE\WOW6432Node\JavaSoft\Java Plug-in"
)

foreach ($path in $pluginPaths) {
    $versions = Get-ChildItem -Path $path -ErrorAction SilentlyContinue
    foreach ($ver in $versions) {
        Set-ItemProperty -Path $ver.PSPath -Name "UseNewJavaPlugin" -Value 0 -Type DWord `
            -ErrorAction SilentlyContinue
        Write-Output "Disabled Java plugin for $($ver.PSChildName)"
    }
}

# Remove Java from Internet Explorer Add-ons
$iePath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved"
$javaClsids = @(
    "{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}",
    "{CAFEEFAC-0017-0000-FFFF-ABCDEFFEDCBA}",
    "{CAFEEFAC-0018-0000-FFFF-ABCDEFFEDCBA}"
)
foreach ($clsid in $javaClsids) {
    $fullPath = "$iePath\$clsid"
    if (Test-Path $fullPath) {
        Remove-Item -Path $fullPath -Force
        Write-Output "Removed IE pre-approval for $clsid"
    }
}

# Block Java plugin in Chrome and Edge via policy
$chromePath = "HKLM:\SOFTWARE\Policies\Google\Chrome"
$edgePath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"

foreach ($path in @($chromePath, $edgePath)) {
    $pluginBlock = "$path\PluginsBlockedForUrls"
    New-Item -Path $pluginBlock -Force | Out-Null
    Set-ItemProperty -Path $pluginBlock -Name "1" -Value "[*.]" -Type String
}
Write-Output "Java plugin blocked in Chrome and Edge policies."

# Pre-deployment inventory script (run on each machine via SCCM or GPO)
$inventory = [PSCustomObject]@{
    ComputerName   = $env:COMPUTERNAME
    AdobeVersion   = $null
    AdobeJSEnabled = $null
    JavaVersions   = @()
    JavaAutoUpdate = $null
}

# Adobe Reader version
$adobePath = "HKLM:\SOFTWARE\Adobe\Acrobat Reader\DC\Installer"
if (Test-Path $adobePath) {
    $adobe = Get-ItemProperty -Path $adobePath -ErrorAction SilentlyContinue
    $inventory.AdobeVersion = "$($adobe.VersionMajor).$($adobe.VersionMinor)"
}

# Adobe JS status
$featurePath = "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown"
if (Test-Path $featurePath) {
    $features = Get-ItemProperty -Path $featurePath -ErrorAction SilentlyContinue
    $inventory.AdobeJSEnabled = ($features.bDisableJavaScript -ne 1)
} else {
    $inventory.AdobeJSEnabled = $true  # No policy = JS enabled by default
}

# Java versions
$jrePath = "HKLM:\SOFTWARE\JavaSoft\Java Runtime Environment"
if (Test-Path $jrePath) {
    Get-ChildItem -Path $jrePath -ErrorAction SilentlyContinue |
        ForEach-Object {
            $props = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
            if ($props.JavaHome) {
                $inventory.JavaVersions += $_.PSChildName
            }
        }
}

# Java auto-update
$updatePath = "HKLM:\SOFTWARE\JavaSoft\Java Update\Policy"
if (Test-Path $updatePath) {
    $update = Get-ItemProperty -Path $updatePath -ErrorAction SilentlyContinue
    $inventory.JavaAutoUpdate = ($update.EnableJavaUpdate -ne 0)
} else {
    $inventory.JavaAutoUpdate = $true  # No policy = auto-update enabled
}

$inventory | Format-List

# Complete hardening script for Adobe Reader DC + Java
# Deploy via GPO startup script or SCCM task sequence

# ---- ADOBE READER DC HARDENING ----
$featurePath = "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown"
$svcPath = "$featurePath\cServices"
$cloudPath = "$featurePath\cCloud"

foreach ($p in @($featurePath, $svcPath, $cloudPath)) {
    New-Item -Path $p -Force | Out-Null
}

# Security hardening
$adobeHardening = @{
    "bDisableJavaScript"            = 1
    "bEnableFlash"                  = 0
    "bEnhancedSecurityStandalone"   = 1
    "bEnhancedSecurityInBrowser"    = 1
    "bProtectedMode"                = 1
    "iProtectedView"                = 2
    "iFileAttachmentPerms"          = 1  # Block file attachments by default
}

foreach ($key in $adobeHardening.Keys) {
    Set-ItemProperty -Path $featurePath -Name $key -Value $adobeHardening[$key] -Type DWord
}

# Cloud services lockdown
$cloudLockdown = @{
    "bToggleAdobeDocumentServices"  = 1
    "bToggleWebConnectors"          = 1
    "bToggleSendAndTrack"           = 1
    "bToggleAdobeSign"              = 1
}

foreach ($key in $cloudLockdown.Keys) {
    Set-ItemProperty -Path $svcPath -Name $key -Value $cloudLockdown[$key] -Type DWord
}

# Disable Adobe updates
$armPath = "HKLM:\SOFTWARE\Adobe\Adobe ARM\1.0\ARM"
New-Item -Path $armPath -Force | Out-Null
Set-ItemProperty -Path $armPath -Name "iCheckReader" -Value 0 -Type DWord
Set-ItemProperty -Path $armPath -Name "iDisableCheckForUpdates" -Value 1 -Type DWord
Set-ItemProperty -Path $armPath -Name "Mode" -Value 0 -Type DWord

# ---- JAVA HARDENING ----
# Disable auto-update
$javaUpdatePaths = @(
    "HKLM:\SOFTWARE\JavaSoft\Java Update\Policy",
    "HKLM:\SOFTWARE\WOW6432Node\JavaSoft\Java Update\Policy"
)

foreach ($path in $javaUpdatePaths) {
    New-Item -Path $path -Force | Out-Null
    Set-ItemProperty -Path $path -Name "EnableJavaUpdate" -Value 0 -Type DWord
    Set-ItemProperty -Path $path -Name "EnableAutoUpdateCheck" -Value 0 -Type DWord
}

# Set Java security level to High
$jrePath = "HKLM:\SOFTWARE\JavaSoft\Java Runtime Environment"
if (Test-Path $jrePath) {
    Set-ItemProperty -Path $jrePath -Name "SECURITY_LEVEL" -Value 2 -Type DWord
}

# Deploy exception site list
$deployDir = "$env:WINDIR\Sun\Java\Deployment\security"
New-Item -Path $deployDir -ItemType Directory -Force | Out-Null
@(
    "https://erp.entreprise.com",
    "https://compta.entreprise.com"
) | Out-File "$deployDir\exception.sites" -Encoding ASCII

# Disable Java browser plugin (Java 8)
$pluginPaths = @(
    "HKLM:\SOFTWARE\JavaSoft\Java Plug-in",
    "HKLM:\SOFTWARE\WOW6432Node\JavaSoft\Java Plug-in"
)
foreach ($path in $pluginPaths) {
    Get-ChildItem -Path $path -ErrorAction SilentlyContinue |
        ForEach-Object {
            Set-ItemProperty -Path $_.PSPath -Name "UseNewJavaPlugin" -Value 0 `
                -Type DWord -ErrorAction SilentlyContinue
        }
}

# Disable scheduled task and services
Disable-ScheduledTask -TaskName "JavaUpdateSched" -ErrorAction SilentlyContinue
Set-Service -Name "AdobeARMservice" -StartupType Disabled -ErrorAction SilentlyContinue
Stop-Service -Name "AdobeARMservice" -ErrorAction SilentlyContinue

Write-Output "Hardening complete on $env:COMPUTERNAME"

# Post-deployment verification script
$results = @()

# Check Adobe hardening
$featurePath = "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown"
$features = Get-ItemProperty -Path $featurePath -ErrorAction SilentlyContinue

$results += [PSCustomObject]@{
    Check  = "Adobe JS disabled"
    Status = if ($features.bDisableJavaScript -eq 1) { "PASS" } else { "FAIL" }
}
$results += [PSCustomObject]@{
    Check  = "Adobe Protected Mode"
    Status = if ($features.bProtectedMode -eq 1) { "PASS" } else { "FAIL" }
}
$results += [PSCustomObject]@{
    Check  = "Adobe Protected View = All"
    Status = if ($features.iProtectedView -eq 2) { "PASS" } else { "FAIL" }
}

# Check Java hardening
$updatePath = "HKLM:\SOFTWARE\JavaSoft\Java Update\Policy"
$update = Get-ItemProperty -Path $updatePath -ErrorAction SilentlyContinue
$results += [PSCustomObject]@{
    Check  = "Java auto-update disabled"
    Status = if ($update.EnableJavaUpdate -eq 0) { "PASS" } else { "FAIL" }
}

$jrePath = "HKLM:\SOFTWARE\JavaSoft\Java Runtime Environment"
$jre = Get-ItemProperty -Path $jrePath -ErrorAction SilentlyContinue
$results += [PSCustomObject]@{
    Check  = "Java security level = HIGH"
    Status = if ($jre.SECURITY_LEVEL -eq 2) { "PASS" } else { "FAIL" }
}

# Check exception site list
$exceptionFile = "$env:WINDIR\Sun\Java\Deployment\security\exception.sites"
$results += [PSCustomObject]@{
    Check  = "Java exception sites deployed"
    Status = if (Test-Path $exceptionFile) { "PASS" } else { "FAIL" }
}

$results | Format-Table -AutoSize

$passCount = ($results | Where-Object Status -eq "PASS").Count
$totalCount = $results.Count
Write-Output "Score : $passCount / $totalCount checks passed"