Zero Trust Architecture & VDI¶

# Verify Zero Trust foundational controls
$ztControls = @(
    @{ Name = "UAC Enabled"; Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"; Value = "EnableLUA"; Expected = 1 },
    @{ Name = "UAC Admin Prompt"; Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"; Value = "ConsentPromptBehaviorAdmin"; Expected = 2 },
    @{ Name = "RDP NLA"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"; Value = "UserAuthentication"; Expected = 1 },
    @{ Name = "NTLMv2 Only"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"; Value = "LmCompatibilityLevel"; Expected = 5 },
    @{ Name = "Credential Guard"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"; Value = "EnableVirtualizationBasedSecurity"; Expected = 1 },
    @{ Name = "Secure Boot"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State"; Value = "UEFISecureBootEnabled"; Expected = 1 }
)

foreach ($ctrl in $ztControls) {
    $current = (Get-ItemProperty -Path $ctrl.Path -Name $ctrl.Value -ErrorAction SilentlyContinue).$($ctrl.Value)
    $status = if ($current -eq $ctrl.Expected) { "PASS" } else { "FAIL (current=$current)" }
    Write-Output "$($ctrl.Name) : $status"
}

# Verify TPM status via registry and WMI
$tpmReg = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Tpm" -ErrorAction SilentlyContinue
$tpmWmi = Get-WmiObject -Namespace "root\cimv2\Security\MicrosoftTpm" `
    -Class Win32_Tpm -ErrorAction SilentlyContinue

Write-Output "TPM Present       : $(if ($tpmWmi) { 'Yes' } else { 'No' })"
Write-Output "TPM Version       : $($tpmWmi.SpecVersion)"
Write-Output "TPM Activated     : $($tpmWmi.IsActivated_InitialValue)"
Write-Output "TPM Owned         : $($tpmWmi.IsOwned_InitialValue)"
Write-Output "TPM Registry Key  : $(if ($tpmReg) { 'Present' } else { 'Missing' })"

# Verify Secure Boot status
$sbPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State"
$sbState = Get-ItemProperty -Path $sbPath -ErrorAction SilentlyContinue

Write-Output "Secure Boot Enabled : $(if ($sbState.UEFISecureBootEnabled -eq 1) { 'Yes' } else { 'No' })"

# Cross-reference with Confirm-SecureBootUEFI
try {
    $confirmed = Confirm-SecureBootUEFI
    Write-Output "Confirm-SecureBootUEFI : $confirmed"
} catch {
    Write-Output "Confirm-SecureBootUEFI : Not supported on this platform"
}

# Enable VBS and HVCI via registry
$dgPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"
$hvciPath = "$dgPath\Scenarios\HypervisorEnforcedCodeIntegrity"

# Enable Virtualization Based Security
Set-ItemProperty -Path $dgPath -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord
Set-ItemProperty -Path $dgPath -Name "RequirePlatformSecurityFeatures" -Value 3 -Type DWord

# Enable HVCI
New-Item -Path $hvciPath -Force | Out-Null
Set-ItemProperty -Path $hvciPath -Name "Enabled" -Value 1 -Type DWord
Set-ItemProperty -Path $hvciPath -Name "Locked" -Value 1 -Type DWord

# Enable Credential Guard
$credGuardPath = "$dgPath\Scenarios\CredentialGuard"
New-Item -Path $credGuardPath -Force | Out-Null
Set-ItemProperty -Path $credGuardPath -Name "Enabled" -Value 1 -Type DWord
Set-ItemProperty -Path $credGuardPath -Name "Locked" -Value 1 -Type DWord

# Verify Device Guard status
$dgInfo = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace "root\Microsoft\Windows\DeviceGuard" `
    -ErrorAction SilentlyContinue
Write-Output "VBS Status           : $($dgInfo.VirtualizationBasedSecurityStatus)"
Write-Output "HVCI Running         : $($dgInfo.SecurityServicesRunning -contains 2)"
Write-Output "Credential Guard     : $($dgInfo.SecurityServicesRunning -contains 1)"

# Check device compliance indicators used by Conditional Access
$complianceChecks = @(
    @{
        Name = "BitLocker Encryption"
        Check = { (Get-BitLockerVolume -MountPoint "C:" -ErrorAction SilentlyContinue).ProtectionStatus -eq "On" }
    },
    @{
        Name = "Windows Firewall (Domain)"
        Check = {
            $fw = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" -ErrorAction SilentlyContinue
            $fw.EnableFirewall -eq 1
        }
    },
    @{
        Name = "Antivirus Active"
        Check = {
            $status = Get-MpComputerStatus -ErrorAction SilentlyContinue
            $status.RealTimeProtectionEnabled -eq $true
        }
    },
    @{
        Name = "Secure Boot"
        Check = {
            $sb = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State" -ErrorAction SilentlyContinue
            $sb.UEFISecureBootEnabled -eq 1
        }
    },
    @{
        Name = "Credential Guard"
        Check = {
            $dg = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" -ErrorAction SilentlyContinue
            $dg.EnableVirtualizationBasedSecurity -eq 1
        }
    }
)

foreach ($check in $complianceChecks) {
    $result = try { & $check.Check } catch { $false }
    $status = if ($result) { "Compliant" } else { "Non-Compliant" }
    Write-Output "$($check.Name) : $status"
}

# Citrix VDI optimization via registry
$citrixGraphics = "HKLM:\SOFTWARE\Citrix\Graphics"
$citrixPortICA = "HKLM:\SOFTWARE\Citrix\PortICA"

New-Item -Path $citrixGraphics -Force | Out-Null
New-Item -Path $citrixPortICA -Force | Out-Null

# Limit FPS for better density
Set-ItemProperty -Path $citrixGraphics -Name "MaxFramesPerSecond" -Value 24 -Type DWord

# Use lossy compression for better bandwidth
Set-ItemProperty -Path $citrixGraphics -Name "EnableLossless" -Value 0 -Type DWord

# Disable desktop composition
Set-ItemProperty -Path $citrixPortICA -Name "DisableDesktopComposition" -Value 1 -Type DWord

Write-Output "Citrix VDI optimization applied."

# VMware Horizon VDI optimization
$blastPath = "HKLM:\SOFTWARE\Policies\VMware, Inc.\VMware Blast\Config"
New-Item -Path $blastPath -Force | Out-Null

# Limit bandwidth and FPS
Set-ItemProperty -Path $blastPath -Name "MaxBandwidthKbps" -Value 25000 -Type DWord
Set-ItemProperty -Path $blastPath -Name "EncoderMaxFPS" -Value 24 -Type DWord
Set-ItemProperty -Path $blastPath -Name "H264maxQP" -Value 36 -Type DWord

# Disable USB redirection for security
$usbPath = "HKLM:\SOFTWARE\Policies\VMware, Inc.\VMware VDM\Agent\USB"
New-Item -Path $usbPath -Force | Out-Null
Set-ItemProperty -Path $usbPath -Name "DisableRemoteConfig" -Value 1 -Type DWord

Write-Output "VMware Horizon VDI optimization applied."

# Azure Virtual Desktop optimization
$tsPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
New-Item -Path $tsPath -Force | Out-Null

# Enable AVC 444 mode for better visual quality
Set-ItemProperty -Path $tsPath -Name "AVC444ModePreferred" -Value 1 -Type DWord

# Prefer GPU hardware encoding
Set-ItemProperty -Path $tsPath -Name "AVCHardwareEncodePreferred" -Value 1 -Type DWord

# Prefer UDP transport (Shortpath)
Set-ItemProperty -Path $tsPath -Name "SelectTransport" -Value 1 -Type DWord

# Session timeouts
$rdpPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
Set-ItemProperty -Path $rdpPath -Name "MaxIdleTime" -Value 900000 -Type DWord         # 15 minutes
Set-ItemProperty -Path $rdpPath -Name "MaxDisconnectionTime" -Value 3600000 -Type DWord # 1 hour

# Disable printer redirection (security + performance)
Set-ItemProperty -Path $tsPath -Name "fDisableCpm" -Value 1 -Type DWord

Write-Output "Azure Virtual Desktop optimization applied."

# Generic VDI Windows optimizations via registry
$explorerPath = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
$visualPath = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects"
$sysPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"

# Disable animations and visual effects
Set-ItemProperty -Path $explorerPath -Name "TaskbarAnimations" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name "MenuShowDelay" -Value 0 -Type String
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop\WindowMetrics" -Name "MinAnimate" -Value 0 -Type String

# Disable Windows Search indexing service
Set-Service -Name "WSearch" -StartupType Disabled -ErrorAction SilentlyContinue
Stop-Service -Name "WSearch" -ErrorAction SilentlyContinue

# Disable Superfetch / SysMain
Set-Service -Name "SysMain" -StartupType Disabled -ErrorAction SilentlyContinue
Stop-Service -Name "SysMain" -ErrorAction SilentlyContinue

# Disable Windows Tips
$contentPath = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager"
New-Item -Path $contentPath -Force | Out-Null
Set-ItemProperty -Path $contentPath -Name "SoftLandingEnabled" -Value 0 -Type DWord
Set-ItemProperty -Path $contentPath -Name "SubscribedContent-338389Enabled" -Value 0 -Type DWord

# Reduce event log sizes for non-persistent VDI
$logNames = @("Application", "System")
foreach ($log in $logNames) {
    $logPath = "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\$log"
    Set-ItemProperty -Path $logPath -Name "MaxSize" -Value 5242880 -Type DWord  # 5 MB
}

Write-Output "Generic VDI Windows optimization applied."

# List all loaded user profiles (active sessions)
$profilePath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
Get-ChildItem $profilePath | ForEach-Object {
    $props = Get-ItemProperty $_.PSPath
    $sid = $_.PSChildName
    $loaded = Test-Path "Registry::HKU\$sid"
    [PSCustomObject]@{
        SID        = $sid
        Profile    = $props.ProfileImagePath
        Loaded     = $loaded
        LastLogon  = if ($props.LocalProfileLoadTimeHigh) { "Active" } else { "Cached" }
    }
} | Where-Object { $_.SID -match "S-1-5-21" } | Format-Table -AutoSize

# Verify session isolation: each user has separate HKCU
$activeSessions = query user 2>&1 | Select-Object -Skip 1 | ForEach-Object {
    $fields = $_ -split "\s{2,}"
    [PSCustomObject]@{
        User      = $fields[0].Trim()
        SessionID = $fields[2].Trim()
        State     = $fields[3].Trim()
    }
} | Where-Object { $_.State -eq "Active" }

Write-Output "Active sessions : $($activeSessions.Count)"
$activeSessions | Format-Table -AutoSize

# Each session uses isolated HKCU via SID mapping
Write-Output "`nRegistry isolation verified via HKU hive:"
Get-ChildItem "Registry::HKU" | Where-Object { $_.Name -match "S-1-5-21" -and $_.Name -notmatch "_Classes" } |
    ForEach-Object { Write-Output "  $($_.Name)" }

# Zero Trust firewall: enable all profiles, block inbound by default, log everything
$profiles = @("DomainProfile", "StandardProfile", "PublicProfile")

foreach ($profile in $profiles) {
    $fwPath = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\$profile"
    $logPath = "$fwPath\Logging"
    New-Item -Path $logPath -Force | Out-Null

    # Enable firewall, block inbound
    Set-ItemProperty -Path $fwPath -Name "EnableFirewall" -Value 1 -Type DWord
    Set-ItemProperty -Path $fwPath -Name "DefaultInboundAction" -Value 1 -Type DWord
    Set-ItemProperty -Path $fwPath -Name "DefaultOutboundAction" -Value 0 -Type DWord
    Set-ItemProperty -Path $fwPath -Name "DisableNotifications" -Value 1 -Type DWord

    # Enable comprehensive logging
    Set-ItemProperty -Path $logPath -Name "LogFilePath" `
        -Value "%systemroot%\system32\LogFiles\Firewall\pfirewall.log" -Type String
    Set-ItemProperty -Path $logPath -Name "LogFileSize" -Value 32767 -Type DWord
    Set-ItemProperty -Path $logPath -Name "LogDroppedPackets" -Value 1 -Type DWord
    Set-ItemProperty -Path $logPath -Name "LogSuccessfulConnections" -Value 1 -Type DWord

    Write-Output "$profile : Firewall enabled, inbound blocked, logging active"
}

# Zero Trust micro-segmentation: allow only necessary traffic
# Example: workstation that only needs AD, DNS, DHCP, and a web app

# Remove all existing rules (start from zero)
Get-NetFirewallRule | Where-Object { $_.Group -ne "Core Networking" } |
    Remove-NetFirewallRule -ErrorAction SilentlyContinue

# Allow only essential services
$rules = @(
    @{ Name = "ZT-DNS"; Proto = "UDP"; Port = 53; Remote = "10.0.0.10,10.0.0.11"; Desc = "DNS servers" },
    @{ Name = "ZT-Kerberos"; Proto = "TCP"; Port = 88; Remote = "10.0.0.10,10.0.0.11"; Desc = "AD Kerberos" },
    @{ Name = "ZT-LDAP"; Proto = "TCP"; Port = 389; Remote = "10.0.0.10,10.0.0.11"; Desc = "AD LDAP" },
    @{ Name = "ZT-LDAPS"; Proto = "TCP"; Port = 636; Remote = "10.0.0.10,10.0.0.11"; Desc = "AD LDAPS" },
    @{ Name = "ZT-DHCP"; Proto = "UDP"; Port = 67; Remote = "Any"; Desc = "DHCP" },
    @{ Name = "ZT-WebApp"; Proto = "TCP"; Port = 443; Remote = "10.0.1.50"; Desc = "Internal web app" }
)

foreach ($rule in $rules) {
    New-NetFirewallRule -DisplayName $rule.Name -Direction Outbound `
        -Protocol $rule.Proto -RemotePort $rule.Port `
        -RemoteAddress $rule.Remote -Action Allow `
        -Description $rule.Desc -Profile Domain | Out-Null
    Write-Output "Rule created : $($rule.Name) -> $($rule.Proto)/$($rule.Port) to $($rule.Remote)"
}

# Check WDAC status via registry
$ciPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI"
$ciProps = Get-ItemProperty -Path $ciPath -ErrorAction SilentlyContinue

Write-Output "WDAC Policy State : $($ciProps.VerifiedAndReputablePolicyState)"
Write-Output "UMCI Audit Mode   : $(if ($ciProps.UMCIAuditMode -eq 1) { 'Audit (non-blocking)' } else { 'Enforced' })"

# Check for deployed WDAC policies
$policyDir = "C:\Windows\System32\CodeIntegrity\CIPolicies\Active"
if (Test-Path $policyDir) {
    $policies = Get-ChildItem $policyDir -Filter "*.cip"
    Write-Output "Active WDAC policies : $($policies.Count)"
    $policies | ForEach-Object { Write-Output "  $($_.Name) ($([math]::Round($_.Length / 1KB)) KB)" }
} else {
    Write-Output "Active WDAC policies : None"
}

# Check AppLocker configuration via registry
$srpPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\SrpV2"
$categories = @("Exe", "Dll", "Script", "Msi", "Appx")

foreach ($cat in $categories) {
    $catPath = "$srpPath\$cat"
    if (Test-Path $catPath) {
        $rules = Get-ChildItem $catPath -ErrorAction SilentlyContinue
        $enforcement = (Get-ItemProperty $catPath -ErrorAction SilentlyContinue).EnforcementMode
        $mode = switch ($enforcement) {
            0 { "Audit" }
            1 { "Enforce" }
            default { "Not configured" }
        }
        Write-Output "$cat : $($rules.Count) rules, Mode = $mode"
    } else {
        Write-Output "$cat : Not configured"
    }
}

# Check AppLocker service
$appidSvc = Get-Service -Name "AppIDSvc" -ErrorAction SilentlyContinue
Write-Output "`nAppIDSvc : Status=$($appidSvc.Status), StartType=$($appidSvc.StartType)"

# Enable AppLocker audit mode for executables (safe first step)
$exePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\SrpV2\Exe"
New-Item -Path $exePath -Force | Out-Null
Set-ItemProperty -Path $exePath -Name "EnforcementMode" -Value 0 -Type DWord  # 0 = Audit

# Ensure AppIDSvc is running
Set-Service -Name "AppIDSvc" -StartupType Automatic
Start-Service -Name "AppIDSvc" -ErrorAction SilentlyContinue

# Check audit events
$auditEvents = Get-WinEvent -LogName "Microsoft-Windows-AppLocker/EXE and DLL" `
    -MaxEvents 5 -ErrorAction SilentlyContinue
if ($auditEvents) {
    Write-Output "Recent AppLocker events :"
    $auditEvents | ForEach-Object {
        Write-Output "  [$($_.TimeCreated)] $($_.Message.Substring(0, [Math]::Min(100, $_.Message.Length)))..."
    }
} else {
    Write-Output "No AppLocker events found yet. Wait for application launches."
}

# Zero Trust baseline definition
$ztBaseline = @{
    "Device Health" = @(
        @{ Name = "Secure Boot"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State"; Value = "UEFISecureBootEnabled"; Expected = 1 },
        @{ Name = "VBS Enabled"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"; Value = "EnableVirtualizationBasedSecurity"; Expected = 1 },
        @{ Name = "Credential Guard"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard"; Value = "Enabled"; Expected = 1 },
        @{ Name = "HVCI"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity"; Value = "Enabled"; Expected = 1 }
    )
    "Access Control" = @(
        @{ Name = "UAC Enabled"; Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"; Value = "EnableLUA"; Expected = 1 },
        @{ Name = "UAC Admin Consent"; Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"; Value = "ConsentPromptBehaviorAdmin"; Expected = 2 },
        @{ Name = "NTLMv2 Only"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"; Value = "LmCompatibilityLevel"; Expected = 5 },
        @{ Name = "RDP NLA"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"; Value = "UserAuthentication"; Expected = 1 }
    )
    "Network Security" = @(
        @{ Name = "SMBv1 Disabled"; Path = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"; Value = "SMB1"; Expected = 0 },
        @{ Name = "Firewall Domain"; Path = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile"; Value = "EnableFirewall"; Expected = 1 },
        @{ Name = "Firewall Private"; Path = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile"; Value = "EnableFirewall"; Expected = 1 },
        @{ Name = "Firewall Public"; Path = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile"; Value = "EnableFirewall"; Expected = 1 }
    )
    "Monitoring" = @(
        @{ Name = "PS ScriptBlock Log"; Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"; Value = "EnableScriptBlockLogging"; Expected = 1 },
        @{ Name = "CMD Line Audit"; Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit"; Value = "ProcessCreationIncludeCmdLine_Enabled"; Expected = 1 }
    )
}

# Apply Zero Trust baseline
$totalControls = 0
$appliedControls = 0

foreach ($category in $ztBaseline.Keys) {
    Write-Output "=== $category ==="
    foreach ($ctrl in $ztBaseline[$category]) {
        $totalControls++
        $current = $null
        if (Test-Path $ctrl.Path) {
            $current = (Get-ItemProperty -Path $ctrl.Path -Name $ctrl.Value `
                -ErrorAction SilentlyContinue).$($ctrl.Value)
        }

        if ($current -ne $ctrl.Expected) {
            New-Item -Path $ctrl.Path -Force -ErrorAction SilentlyContinue | Out-Null
            Set-ItemProperty -Path $ctrl.Path -Name $ctrl.Value `
                -Value $ctrl.Expected -Type DWord
            Write-Output "  APPLIED : $($ctrl.Name) ($current -> $($ctrl.Expected))"
            $appliedControls++
        } else {
            Write-Output "  OK      : $($ctrl.Name)"
        }
    }
}

Write-Output "`n=== Summary ==="
Write-Output "Total controls    : $totalControls"
Write-Output "Already compliant : $($totalControls - $appliedControls)"
Write-Output "Applied now       : $appliedControls"

# Remote Zero Trust compliance verification across the hybrid fleet
$machines = Get-Content "C:\Admin\hybrid-fleet.txt"

$complianceResults = Invoke-Command -ComputerName $machines -ThrottleLimit 30 -ScriptBlock {
    $checks = @(
        @{ Name = "Secure Boot"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State"; Value = "UEFISecureBootEnabled"; Expected = 1 },
        @{ Name = "VBS"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"; Value = "EnableVirtualizationBasedSecurity"; Expected = 1 },
        @{ Name = "UAC"; Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"; Value = "EnableLUA"; Expected = 1 },
        @{ Name = "NTLMv2"; Path = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"; Value = "LmCompatibilityLevel"; Expected = 5 },
        @{ Name = "SMBv1 Off"; Path = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"; Value = "SMB1"; Expected = 0 },
        @{ Name = "FW Domain"; Path = "HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile"; Value = "EnableFirewall"; Expected = 1 },
        @{ Name = "PS Logging"; Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"; Value = "EnableScriptBlockLogging"; Expected = 1 }
    )

    $pass = 0
    foreach ($chk in $checks) {
        $current = (Get-ItemProperty -Path $chk.Path -Name $chk.Value -ErrorAction SilentlyContinue).$($chk.Value)
        if ($current -eq $chk.Expected) { $pass++ }
    }

    [PSCustomObject]@{
        Computer   = $env:COMPUTERNAME
        Total      = $checks.Count
        Compliant  = $pass
        Score      = [math]::Round(($pass / $checks.Count) * 100)
        ZeroTrust  = if ($pass -eq $checks.Count) { "READY" } else { "NOT READY" }
    }
}

$complianceResults | Sort-Object Score -Descending | Format-Table -AutoSize

# Fleet summary
$ready = ($complianceResults | Where-Object ZeroTrust -eq "READY").Count
$total = $complianceResults.Count
Write-Output "`nFleet Zero Trust readiness : $ready / $total machines ($([math]::Round(($ready/$total)*100))%)"

# Generate executive Zero Trust compliance report
$report = $complianceResults | Group-Object ZeroTrust | ForEach-Object {
    [PSCustomObject]@{
        Status   = $_.Name
        Count    = $_.Count
        Percent  = [math]::Round(($_.Count / $complianceResults.Count) * 100, 1)
    }
}

Write-Output "=== Zero Trust Compliance Report ==="
Write-Output "Date          : $(Get-Date -Format 'yyyy-MM-dd HH:mm')"
Write-Output "Fleet size    : $($complianceResults.Count) machines"
Write-Output ""
$report | Format-Table -AutoSize

# Export detailed report
$exportPath = "C:\Compliance\ZeroTrust_Report_$(Get-Date -Format 'yyyyMMdd').csv"
$complianceResults | Export-Csv -Path $exportPath -NoTypeInformation -Encoding UTF8
Write-Output "Detailed report exported to $exportPath"

# List machines needing remediation
$needsWork = $complianceResults | Where-Object ZeroTrust -eq "NOT READY"
if ($needsWork) {
    Write-Output "`nMachines requiring remediation :"
    $needsWork | ForEach-Object {
        Write-Output "  $($_.Computer) : $($_.Compliant)/$($_.Total) controls ($($_.Score)%)"
    }
}