Téléverser les fichiers vers "/"

hardening.ps1

@@ -0,0 +1,66 @@
+param([ValidateSet('install','audit','uninstall')][string]$Action = 'audit')
+$ErrorActionPreference = 'Stop'
+$stateDir = Join-Path $env:ProgramData 'Comitari\HardeningSafe'
+$stateFile = Join-Path $stateDir 'original-values.json'
+# Only low-impact, machine-wide controls. Deliberately excludes Windows LAPS, accounts,
+# services, remote management, networking, firewall policy, BitLocker and Defender.
+$settings = @(
+    @{ Path='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'; Name='NoAutorun'; Value=1 },
+    @{ Path='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'; Name='NoDriveTypeAutoRun'; Value=255 },
+    @{ Path='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer'; Name='NoAutoplayfornonVolume'; Value=1 },
+    @{ Path='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization'; Name='NoLockScreenCamera'; Value=1 },
+    @{ Path='HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization'; Name='NoLockScreenSlideshow'; Value=1 }
+)
+function Read-Value($path, $name) {
+    if (-not (Test-Path -LiteralPath $path)) { return @{ Exists=$false; Value=$null } }
+    $key = Get-Item -LiteralPath $path
+    if ($key.GetValueNames() -contains $name) {
+        return @{ Exists=$true; Value=[int]$key.GetValue($name) }
+    }
+    return @{ Exists=$false; Value=$null }
+}
+function Write-Value($path, $name, [int]$value) {
+    if (-not (Test-Path -LiteralPath $path)) { New-Item -Path $path -Force | Out-Null }
+    New-ItemProperty -LiteralPath $path -Name $name -Value $value -PropertyType DWord -Force | Out-Null
+}
+if ($Action -eq 'install') {
+    if (-not (Test-Path -LiteralPath $stateDir)) { New-Item -Path $stateDir -ItemType Directory -Force | Out-Null }
+    if (-not (Test-Path -LiteralPath $stateFile)) {
+        $original = @()
+        foreach ($setting in $settings) {
+            $old = Read-Value $setting.Path $setting.Name
+            $original += [pscustomobject]@{ Path=$setting.Path; Name=$setting.Name; Exists=$old.Exists; Value=$old.Value; Target=$setting.Value }
+        }
+        $json = ConvertTo-Json -InputObject @($original) -Depth 5
+        $temp = "$stateFile.tmp"
+        [System.IO.File]::WriteAllText($temp, $json, [System.Text.UTF8Encoding]::new($false))
+        Move-Item -LiteralPath $temp -Destination $stateFile -Force
+    }
+    foreach ($setting in $settings) { Write-Value $setting.Path $setting.Name $setting.Value }
+    Write-Output 'Installed conservative hardening; LapsByWAPT untouched.'
+}
+elseif ($Action -eq 'audit') {
+    $failed = @()
+    foreach ($setting in $settings) {
+        $actual = Read-Value $setting.Path $setting.Name
+        if (-not $actual.Exists -or $actual.Value -ne $setting.Value) { $failed += "$($setting.Name) != $($setting.Value)" }
+    }
+    if ($failed.Count -gt 0) { $failed | ForEach-Object { Write-Output $_ }; exit 1 }
+    Write-Output 'All 5 settings compliant.'
+}
+else {
+    if (-not (Test-Path -LiteralPath $stateFile)) { throw 'No saved baseline; refusing blind rollback.' }
+    $original = @(Get-Content -LiteralPath $stateFile -Raw | ConvertFrom-Json)
+    foreach ($item in $original) {
+        $current = Read-Value $item.Path $item.Name
+        # Do not override later changes made by GPO or another administrator.
+        if (-not $current.Exists -or $current.Value -ne [int]$item.Target) {
+            Write-Output "Skipped externally changed setting: $($item.Name)"
+            continue
+        }
+        if ($item.Exists) { Write-Value $item.Path $item.Name ([int]$item.Value) }
+        else { Remove-ItemProperty -LiteralPath $item.Path -Name $item.Name -ErrorAction Stop }
+    }
+    # Keep baseline for forensic trace; uninstall is idempotent only for settings still matching targets.
+    Write-Output 'Conditional rollback completed; LapsByWAPT untouched.'
+}