Compliance registre (HIPAA, PCI-DSS, SOC 2, GDPR)¶

# Quick CIS compliance check for key controls
$controls = @(
    @{ Name = "SMBv1 Disabled"; Path = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"; Value = "SMB1"; Expected = 0 },
    @{ Name = "NTLMv2 Only"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"; Value = "LmCompatibilityLevel"; Expected = 5 },
    @{ Name = "RDP NLA Required"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"; Value = "UserAuthentication"; Expected = 1 },
    @{ Name = "Guest Account Disabled"; Path = "HKLM:\SAM\SAM\Domains\Account\Users\000001F5"; Value = "F"; Expected = $null }
)

foreach ($ctrl in $controls) {
    $current = (Get-ItemProperty -Path $ctrl.Path -Name $ctrl.Value -ErrorAction SilentlyContinue).$($ctrl.Value)
    $status = if ($current -eq $ctrl.Expected) { "PASS" } else { "FAIL (current=$current)" }
    Write-Output "$($ctrl.Name) : $status"
}

# HIPAA access control hardening
$polPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
$lsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"

# Enable UAC
Set-ItemProperty -Path $polPath -Name "EnableLUA" -Value 1 -Type DWord

# UAC: prompt for consent on secure desktop for admins
Set-ItemProperty -Path $polPath -Name "ConsentPromptBehaviorAdmin" -Value 2 -Type DWord

# NTLMv2 only, refuse LM and NTLM
Set-ItemProperty -Path $lsaPath -Name "LmCompatibilityLevel" -Value 5 -Type DWord

# Block anonymous enumeration of SAM accounts
Set-ItemProperty -Path $lsaPath -Name "RestrictAnonymousSAM" -Value 1 -Type DWord
Set-ItemProperty -Path $lsaPath -Name "RestrictAnonymous" -Value 1 -Type DWord

Write-Output "HIPAA access controls applied."

# HIPAA audit requirements
$lsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
Set-ItemProperty -Path $lsaPath -Name "AuditBaseObjects" -Value 1 -Type DWord
Set-ItemProperty -Path $lsaPath -Name "FullPrivilegeAuditing" -Value ([byte[]](0x01)) -Type Binary

# Increase Security event log size (1 GB minimum for HIPAA)
$secLogPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security"
New-Item -Path $secLogPath -Force | Out-Null
Set-ItemProperty -Path $secLogPath -Name "MaxSize" -Value 1073741824 -Type DWord
Set-ItemProperty -Path $secLogPath -Name "Retention" -Value 0 -Type DWord

# Verify security log configuration
$log = Get-WinEvent -ListLog "Security"
Write-Output "Security log : $([math]::Round($log.MaximumSizeInBytes / 1MB)) MB max"

# HIPAA encryption verification
# Check BitLocker status via registry
$fvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE"
$fveProps = Get-ItemProperty -Path $fvePath -ErrorAction SilentlyContinue

$results = @()
$results += [PSCustomObject]@{
    Control  = "BitLocker OS Drive Encryption"
    Status   = if ($fveProps.OSEncryptionType) { "Configured (Type=$($fveProps.OSEncryptionType))" } else { "Not configured" }
    HIPAA    = "164.312(a)(2)(iv)"
}

# Check TLS settings
$tlsPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols"
$tls12 = Get-ItemProperty "$tlsPath\TLS 1.2\Server" -ErrorAction SilentlyContinue
$results += [PSCustomObject]@{
    Control  = "TLS 1.2 Enabled"
    Status   = if ($tls12.Enabled -ne 0) { "Enabled" } else { "Disabled" }
    HIPAA    = "164.312(e)(1)"
}

# Check obsolete protocols disabled
foreach ($proto in @("SSL 2.0", "SSL 3.0", "TLS 1.0", "TLS 1.1")) {
    $serverPath = "$tlsPath\$proto\Server"
    $props = Get-ItemProperty -Path $serverPath -ErrorAction SilentlyContinue
    $results += [PSCustomObject]@{
        Control  = "$proto Disabled"
        Status   = if ($props.Enabled -eq 0) { "Disabled (OK)" } else { "Enabled (RISK)" }
        HIPAA    = "164.312(e)(1)"
    }
}

$results | Format-Table -AutoSize

# PCI-DSS Requirement 2: Remove defaults and harden
$smbPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
$lsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"

# Disable SMBv1
Set-ItemProperty -Path $smbPath -Name "SMB1" -Value 0 -Type DWord

# Block null sessions
Set-ItemProperty -Path $smbPath -Name "RestrictNullSessAccess" -Value 1 -Type DWord

# Exclude Anonymous from Everyone group
Set-ItemProperty -Path $lsaPath -Name "EveryoneIncludesAnonymous" -Value 0 -Type DWord

# Disable administrative shares
Set-ItemProperty -Path $smbPath -Name "AutoShareServer" -Value 0 -Type DWord
Set-ItemProperty -Path $smbPath -Name "AutoShareWks" -Value 0 -Type DWord

Write-Output "PCI-DSS Req. 2 controls applied."

# PCI-DSS Requirement 8: Password policies
# These are typically set via GPO/secpol.msc but can be verified via registry

# Verify current password policy
$output = net accounts
Write-Output "=== Current Password Policy ==="
$output | Select-String -Pattern "Minimum|Maximum|Lockout|threshold"

# PCI-DSS compliant values:
# - Min password length: 7+
# - Max password age: 90 days
# - Lockout threshold: 6 attempts
# - Lockout duration: 30 minutes
# - Reset lockout count: 30 minutes

# Apply via net accounts (writes to SAM/LSA registry)
net accounts /minpwlen:7 /maxpwage:90 /lockoutthreshold:6 `
    /lockoutduration:30 /lockoutwindow:30

# PCI-DSS Requirement 10: Logging and monitoring
# Configure all event logs for PCI-DSS compliance

$logConfigs = @(
    @{ Log = "Security"; MinSize = 1073741824 },     # 1 GB
    @{ Log = "System"; MinSize = 268435456 },         # 256 MB
    @{ Log = "Application"; MinSize = 268435456 }     # 256 MB
)

foreach ($cfg in $logConfigs) {
    $regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\$($cfg.Log)"
    New-Item -Path $regPath -Force | Out-Null
    Set-ItemProperty -Path $regPath -Name "MaxSize" -Value $cfg.MinSize -Type DWord
    Set-ItemProperty -Path $regPath -Name "Retention" -Value 0 -Type DWord

    $log = Get-WinEvent -ListLog $cfg.Log
    Write-Output "$($cfg.Log) : $([math]::Round($log.MaximumSizeInBytes / 1MB)) MB"
}

# Enable command-line auditing (PCI-DSS 10.2.6)
$auditPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit"
New-Item -Path $auditPath -Force | Out-Null
Set-ItemProperty -Path $auditPath -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -Type DWord

# Enable PowerShell script block logging (PCI-DSS 10.2)
$psLogPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
New-Item -Path $psLogPath -Force | Out-Null
Set-ItemProperty -Path $psLogPath -Name "EnableScriptBlockLogging" -Value 1 -Type DWord
Set-ItemProperty -Path $psLogPath -Name "EnableScriptBlockInvocationLogging" -Value 1 -Type DWord

Write-Output "PCI-DSS Req. 10 logging configured."

# PCI-DSS service hardening: disable unnecessary services
$servicesToDisable = @(
    @{ Name = "RemoteRegistry"; PCI = "2.2.2" },
    @{ Name = "TlntSvr"; PCI = "2.2.2" },
    @{ Name = "SNMPTRAP"; PCI = "2.2.2" },
    @{ Name = "SSDPSRV"; PCI = "2.2.2" },
    @{ Name = "upnphost"; PCI = "2.2.2" },
    @{ Name = "WMPNetworkSvc"; PCI = "2.2.2" },
    @{ Name = "XblAuthManager"; PCI = "2.2.2" },
    @{ Name = "XblGameSave"; PCI = "2.2.2" }
)

foreach ($svc in $servicesToDisable) {
    $s = Get-Service -Name $svc.Name -ErrorAction SilentlyContinue
    if ($s) {
        Set-Service -Name $svc.Name -StartupType Disabled -ErrorAction SilentlyContinue
        Stop-Service -Name $svc.Name -Force -ErrorAction SilentlyContinue
        Write-Output "[PCI $($svc.PCI)] $($svc.Name) : Disabled"
    }
}

# SOC 2 CC8: Enable registry change tracking on critical keys
$criticalKeys = @(
    "HKLM:\SYSTEM\CurrentControlSet\Services",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System",
    "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
)

foreach ($keyPath in $criticalKeys) {
    if (Test-Path $keyPath) {
        $acl = Get-Acl -Path $keyPath
        $auditRule = New-Object System.Security.AccessControl.RegistryAuditRule(
            "Everyone",
            "SetValue,CreateSubKey,Delete",
            "ContainerInherit,ObjectInherit",
            "None",
            "Success,Failure"
        )
        $acl.AddAuditRule($auditRule)
        Set-Acl -Path $keyPath -AclObject $acl
        Write-Output "SACL applied on : $keyPath"
    }
}

# SOC 2 CC6/CC7: Verify access logging configuration
$checks = @()

# Check if Object Access auditing is enabled
$auditPol = auditpol /get /category:"Object Access" 2>&1
$checks += [PSCustomObject]@{
    Criteria = "CC7.2"
    Control  = "Registry Object Access Auditing"
    Status   = if ($auditPol -match "Success and Failure") { "Enabled" } else { "Review needed" }
}

# Check if process tracking is enabled
$procAudit = auditpol /get /subcategory:"Process Creation" 2>&1
$checks += [PSCustomObject]@{
    Criteria = "CC7.2"
    Control  = "Process Creation Auditing"
    Status   = if ($procAudit -match "Success") { "Enabled" } else { "Disabled" }
}

# Check command-line logging
$cmdLinePath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit"
$cmdLine = Get-ItemProperty -Path $cmdLinePath -ErrorAction SilentlyContinue
$checks += [PSCustomObject]@{
    Criteria = "CC7.2"
    Control  = "Command Line in Process Events"
    Status   = if ($cmdLine.ProcessCreationIncludeCmdLine_Enabled -eq 1) { "Enabled" } else { "Disabled" }
}

# Check PowerShell logging
$psLogPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
$psLog = Get-ItemProperty -Path $psLogPath -ErrorAction SilentlyContinue
$checks += [PSCustomObject]@{
    Criteria = "CC7.2"
    Control  = "PowerShell Script Block Logging"
    Status   = if ($psLog.EnableScriptBlockLogging -eq 1) { "Enabled" } else { "Disabled" }
}

$checks | Format-Table -AutoSize

# GDPR: Identify personal data in user registry hives
$personalDataKeys = @(
    @{ Path = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs"; Desc = "Recent documents" },
    @{ Path = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"; Desc = "Run command history" },
    @{ Path = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths"; Desc = "Typed paths in Explorer" },
    @{ Path = "HKCU:\SOFTWARE\Microsoft\Internet Explorer\TypedURLs"; Desc = "IE typed URLs" },
    @{ Path = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU"; Desc = "Open/Save dialog history" }
)

foreach ($key in $personalDataKeys) {
    if (Test-Path $key.Path) {
        $count = (Get-Item -Path $key.Path).ValueCount
        Write-Output "$($key.Desc) : $count entries found"
    } else {
        Write-Output "$($key.Desc) : Key not present"
    }
}

# GDPR: Cleanup personal data from registry (user departure procedure)
# WARNING: Run this only for users who have left the organization

$cleanupKeys = @(
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU"
)

foreach ($key in $cleanupKeys) {
    if (Test-Path $key) {
        $values = Get-Item -Path $key
        $count = $values.ValueCount
        Remove-Item -Path $key -Recurse -Force -ErrorAction SilentlyContinue
        New-Item -Path $key -Force | Out-Null
        Write-Output "Cleaned $count entries from $(Split-Path $key -Leaf)"
    }
}

# GDPR Art. 25: Data protection by design - disable tracking features
$explorerPath = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
$polPath = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer"
New-Item -Path $polPath -Force | Out-Null

# Disable recent documents tracking
Set-ItemProperty -Path $polPath -Name "NoRecentDocsHistory" -Value 1 -Type DWord

# Clear recent docs on logoff
Set-ItemProperty -Path $polPath -Name "ClearRecentDocsOnExit" -Value 1 -Type DWord

# Disable recent items in Start menu
Set-ItemProperty -Path $explorerPath -Name "Start_TrackDocs" -Value 0 -Type DWord

Write-Output "GDPR retention policies applied."

# Define a multi-framework compliance baseline as JSON
$baselineJson = @"
{
    "name": "Enterprise Compliance Baseline v1.0",
    "controls": [
        {
            "id": "SMB-001",
            "description": "Disable SMBv1 protocol",
            "path": "HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters",
            "value": "SMB1",
            "expected": 0,
            "type": "DWord",
            "frameworks": ["PCI-DSS 2.2", "CIS 18.3.3", "SOC2 CC6.1"]
        },
        {
            "id": "AUTH-001",
            "description": "NTLMv2 only authentication",
            "path": "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa",
            "value": "LmCompatibilityLevel",
            "expected": 5,
            "type": "DWord",
            "frameworks": ["HIPAA 164.312(d)", "PCI-DSS 2.2", "CIS 2.3.11.7"]
        },
        {
            "id": "ACC-001",
            "description": "UAC enabled",
            "path": "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
            "value": "EnableLUA",
            "expected": 1,
            "type": "DWord",
            "frameworks": ["HIPAA 164.312(a)", "PCI-DSS 8.1", "SOC2 CC6.1"]
        },
        {
            "id": "LOG-001",
            "description": "Command line process auditing",
            "path": "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Audit",
            "value": "ProcessCreationIncludeCmdLine_Enabled",
            "expected": 1,
            "type": "DWord",
            "frameworks": ["PCI-DSS 10.2", "SOC2 CC7.2", "HIPAA 164.312(b)"]
        },
        {
            "id": "NET-001",
            "description": "Block anonymous SAM enumeration",
            "path": "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa",
            "value": "RestrictAnonymousSAM",
            "expected": 1,
            "type": "DWord",
            "frameworks": ["HIPAA 164.312(a)", "PCI-DSS 2.2.3", "CIS 2.3.10.2"]
        },
        {
            "id": "RDP-001",
            "description": "RDP Network Level Authentication",
            "path": "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp",
            "value": "UserAuthentication",
            "expected": 1,
            "type": "DWord",
            "frameworks": ["PCI-DSS 8.3", "HIPAA 164.312(d)", "SOC2 CC6.1"]
        }
    ]
}
"@

# Save baseline to file
$baselinePath = "C:\Compliance\baseline.json"
New-Item -Path "C:\Compliance" -ItemType Directory -Force | Out-Null
$baselineJson | Out-File $baselinePath -Encoding UTF8
Write-Output "Baseline saved to $baselinePath"

# Multi-framework compliance scanner
function Test-ComplianceBaseline {
    param(
        [string]$BaselinePath,
        [switch]$Remediate
    )

    $baseline = Get-Content $BaselinePath -Raw | ConvertFrom-Json
    $results = @()

    foreach ($ctrl in $baseline.controls) {
        $current = $null
        if (Test-Path $ctrl.path) {
            $current = (Get-ItemProperty -Path $ctrl.path -Name $ctrl.value -ErrorAction SilentlyContinue).$($ctrl.value)
        }

        $compliant = ($current -eq $ctrl.expected)

        if (-not $compliant -and $Remediate) {
            New-Item -Path $ctrl.path -Force -ErrorAction SilentlyContinue | Out-Null
            Set-ItemProperty -Path $ctrl.path -Name $ctrl.value -Value $ctrl.expected -Type $ctrl.type
            $remediated = $true
        } else {
            $remediated = $false
        }

        $results += [PSCustomObject]@{
            ID          = $ctrl.id
            Description = $ctrl.description
            Expected    = $ctrl.expected
            Current     = $current
            Compliant   = $compliant
            Remediated  = $remediated
            Frameworks  = $ctrl.frameworks -join ", "
        }
    }

    return $results
}

# Run the scanner in audit mode
$results = Test-ComplianceBaseline -BaselinePath "C:\Compliance\baseline.json"
$results | Format-Table ID, Description, Expected, Current, Compliant -AutoSize

# Summary by framework
$frameworks = @("HIPAA", "PCI-DSS", "SOC2", "CIS")
foreach ($fw in $frameworks) {
    $fwResults = $results | Where-Object { $_.Frameworks -match $fw }
    $pass = ($fwResults | Where-Object Compliant).Count
    $total = $fwResults.Count
    Write-Output "$fw : $pass / $total controls compliant"
}

# Targeted remediation by framework
function Invoke-FrameworkRemediation {
    param(
        [string]$BaselinePath,
        [ValidateSet("HIPAA", "PCI-DSS", "SOC2", "CIS", "GDPR")]
        [string]$Framework
    )

    $baseline = Get-Content $BaselinePath -Raw | ConvertFrom-Json
    $targeted = $baseline.controls | Where-Object { $_.frameworks -match $Framework }

    Write-Output "=== Remediation for $Framework ==="
    Write-Output "Controls to check : $($targeted.Count)"

    $remediated = 0
    foreach ($ctrl in $targeted) {
        $current = $null
        if (Test-Path $ctrl.path) {
            $current = (Get-ItemProperty -Path $ctrl.path -Name $ctrl.value -ErrorAction SilentlyContinue).$($ctrl.value)
        }

        if ($current -ne $ctrl.expected) {
            New-Item -Path $ctrl.path -Force -ErrorAction SilentlyContinue | Out-Null
            Set-ItemProperty -Path $ctrl.path -Name $ctrl.value `
                -Value $ctrl.expected -Type $ctrl.type
            Write-Output "  FIXED : $($ctrl.id) - $($ctrl.description)"
            $remediated++
        } else {
            Write-Output "  OK    : $($ctrl.id) - $($ctrl.description)"
        }
    }

    Write-Output "Remediation complete : $remediated / $($targeted.Count) controls fixed"
}

# Example: remediate PCI-DSS controls only
Invoke-FrameworkRemediation -BaselinePath "C:\Compliance\baseline.json" -Framework "PCI-DSS"

# Export compliance report as CSV for auditors
$results = Test-ComplianceBaseline -BaselinePath "C:\Compliance\baseline.json"

$reportPath = "C:\Compliance\report_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
$results | Select-Object ID, Description, Expected, Current, Compliant, Frameworks |
    Export-Csv -Path $reportPath -NoTypeInformation -Encoding UTF8

Write-Output "Report exported to $reportPath"
Write-Output "Total controls : $($results.Count)"
Write-Output "Compliant      : $(($results | Where-Object Compliant).Count)"
Write-Output "Non-compliant  : $(($results | Where-Object { -not $_.Compliant }).Count)"

# Comprehensive PCI-DSS baseline
$pciBaseline = @"
{
    "name": "PCI-DSS v4.0 Registry Baseline",
    "version": "1.0",
    "date": "2026-04-04",
    "controls": [
        {
            "id": "PCI-2.2.1", "description": "Disable SMBv1",
            "path": "HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters",
            "value": "SMB1", "expected": 0, "type": "DWord",
            "frameworks": ["PCI-DSS 2.2"]
        },
        {
            "id": "PCI-2.2.2", "description": "Disable null sessions",
            "path": "HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters",
            "value": "RestrictNullSessAccess", "expected": 1, "type": "DWord",
            "frameworks": ["PCI-DSS 2.2"]
        },
        {
            "id": "PCI-2.2.3", "description": "NTLMv2 only",
            "path": "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa",
            "value": "LmCompatibilityLevel", "expected": 5, "type": "DWord",
            "frameworks": ["PCI-DSS 2.2"]
        },
        {
            "id": "PCI-8.1.1", "description": "UAC enabled",
            "path": "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
            "value": "EnableLUA", "expected": 1, "type": "DWord",
            "frameworks": ["PCI-DSS 8.1"]
        },
        {
            "id": "PCI-8.3.1", "description": "RDP NLA required",
            "path": "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp",
            "value": "UserAuthentication", "expected": 1, "type": "DWord",
            "frameworks": ["PCI-DSS 8.3"]
        },
        {
            "id": "PCI-10.2.1", "description": "Command-line auditing",
            "path": "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Audit",
            "value": "ProcessCreationIncludeCmdLine_Enabled", "expected": 1, "type": "DWord",
            "frameworks": ["PCI-DSS 10.2"]
        },
        {
            "id": "PCI-10.2.2", "description": "PowerShell script block logging",
            "path": "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging",
            "value": "EnableScriptBlockLogging", "expected": 1, "type": "DWord",
            "frameworks": ["PCI-DSS 10.2"]
        },
        {
            "id": "PCI-1.2.1", "description": "Windows Firewall Domain profile enabled",
            "path": "HKLM:\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile",
            "value": "EnableFirewall", "expected": 1, "type": "DWord",
            "frameworks": ["PCI-DSS 1.2"]
        }
    ]
}
"@

$pciBaseline | Out-File "C:\Compliance\pci-dss-baseline.json" -Encoding UTF8
Write-Output "PCI-DSS baseline saved with $((($pciBaseline | ConvertFrom-Json).controls).Count) controls"

# Deploy PCI-DSS baseline across the fleet
$servers = Get-Content "C:\Admin\pci-servers.txt"
$workstations = Get-Content "C:\Admin\pci-workstations.txt"
$allMachines = $servers + $workstations

# Copy baseline and scanner to each machine
$session = New-PSSession -ComputerName $allMachines -ThrottleLimit 20

Copy-Item -Path "C:\Compliance\pci-dss-baseline.json" `
    -Destination "C:\Compliance\pci-dss-baseline.json" -ToSession $session

# Run remediation on all machines
$remediationResults = Invoke-Command -Session $session -ScriptBlock {
    # Load scanner function
    function Test-ComplianceBaseline {
        param([string]$BaselinePath, [switch]$Remediate)
        $baseline = Get-Content $BaselinePath -Raw | ConvertFrom-Json
        $results = @()
        foreach ($ctrl in $baseline.controls) {
            $current = $null
            if (Test-Path $ctrl.path) {
                $current = (Get-ItemProperty -Path $ctrl.path -Name $ctrl.value `
                    -ErrorAction SilentlyContinue).$($ctrl.value)
            }
            $compliant = ($current -eq $ctrl.expected)
            if (-not $compliant -and $Remediate) {
                New-Item -Path $ctrl.path -Force -ErrorAction SilentlyContinue | Out-Null
                Set-ItemProperty -Path $ctrl.path -Name $ctrl.value `
                    -Value $ctrl.expected -Type $ctrl.type
                $remediated = $true
            } else { $remediated = $false }
            $results += [PSCustomObject]@{
                ID = $ctrl.id; Compliant = $compliant; Remediated = $remediated
            }
        }
        return $results
    }

    $results = Test-ComplianceBaseline -BaselinePath "C:\Compliance\pci-dss-baseline.json" -Remediate
    [PSCustomObject]@{
        Computer   = $env:COMPUTERNAME
        Total      = $results.Count
        Compliant  = ($results | Where-Object Compliant).Count
        Remediated = ($results | Where-Object Remediated).Count
    }
}

$remediationResults | Sort-Object Computer | Format-Table -AutoSize

# Generate audit-ready PCI-DSS compliance report
$auditReport = Invoke-Command -Session $session -ScriptBlock {
    $baseline = Get-Content "C:\Compliance\pci-dss-baseline.json" -Raw | ConvertFrom-Json
    foreach ($ctrl in $baseline.controls) {
        $current = $null
        if (Test-Path $ctrl.path) {
            $current = (Get-ItemProperty -Path $ctrl.path -Name $ctrl.value `
                -ErrorAction SilentlyContinue).$($ctrl.value)
        }
        [PSCustomObject]@{
            Computer    = $env:COMPUTERNAME
            ControlID   = $ctrl.id
            Description = $ctrl.description
            Expected    = $ctrl.expected
            Current     = $current
            Compliant   = ($current -eq $ctrl.expected)
            Timestamp   = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
        }
    }
}

# Export full report
$reportFile = "C:\Compliance\PCI-DSS_Audit_Report_$(Get-Date -Format 'yyyyMMdd').csv"
$auditReport | Export-Csv -Path $reportFile -NoTypeInformation -Encoding UTF8

# Summary
$total = $auditReport.Count
$compliant = ($auditReport | Where-Object Compliant).Count
$pctCompliant = [math]::Round(($compliant / $total) * 100, 1)

Write-Output "=== PCI-DSS Audit Report Summary ==="
Write-Output "Total checks     : $total"
Write-Output "Compliant        : $compliant"
Write-Output "Non-compliant    : $($total - $compliant)"
Write-Output "Compliance rate  : $pctCompliant%"
Write-Output "Report saved to  : $reportFile"

# List non-compliant items
$nonCompliant = $auditReport | Where-Object { -not $_.Compliant }
if ($nonCompliant) {
    Write-Output "`n=== Non-Compliant Items ==="
    $nonCompliant | Group-Object ControlID |
        ForEach-Object { Write-Output "$($_.Name) : $($_.Count) machines" }
}

# Schedule weekly PCI-DSS compliance check
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument @"
-NoProfile -ExecutionPolicy Bypass -File C:\Compliance\Run-PCIDSSCheck.ps1
"@

$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Monday -At "06:00"
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest

Register-ScheduledTask -TaskName "PCI-DSS Weekly Compliance Check" `
    -Action $action -Trigger $trigger -Principal $principal `
    -Description "Weekly PCI-DSS registry compliance scan and report"

Write-Output "Scheduled task created : weekly Monday at 06:00"