From ba364813edc01f14452e5812e74582169de56885 Mon Sep 17 00:00:00 2001 From: NexusOne23 Date: Mon, 8 Dec 2025 10:32:49 +0100 Subject: [PATCH] v2.2.0 - Complete Security Hardening Framework (632 Settings) --- .github/FUNDING.yml | 3 + .github/ISSUE_TEMPLATE/bug_report.md | 79 + .github/ISSUE_TEMPLATE/feature_request.md | 103 + .github/PULL_REQUEST_TEMPLATE.md | 94 + .github/workflows/ci.yml | 226 + .github/workflows/pester-tests.yml | 71 + .gitignore | 58 + CHANGELOG.md | 324 ++ CODE_OF_CONDUCT.md | 135 + CONTRIBUTING.md | 783 ++++ Core/Config.ps1 | 466 ++ Core/Framework.ps1 | 927 ++++ Core/Logger.ps1 | 366 ++ Core/NonInteractive.ps1 | 206 + Core/Rollback.ps1 | 2969 +++++++++++++ Core/Validator.ps1 | 426 ++ Docs/FEATURES.md | 742 ++++ Docs/LICENSE-HISTORY.md | 86 + Docs/NONINTERACTIVE-MODE.md | 467 +++ Docs/SECURITY-ANALYSIS.md | 105 + LICENSE | 697 +++ Modules/ASR/ASR.psd1 | 39 + Modules/ASR/ASR.psm1 | 52 + Modules/ASR/Config/ASR-Rules.json | 173 + Modules/ASR/Private/Backup-ASRRegistry.ps1 | 105 + .../ASR/Private/Get-ASRRuleDefinitions.ps1 | 34 + Modules/ASR/Private/Restore-ASRSettings.ps1 | 28 + Modules/ASR/Private/Set-ASRViaPowerShell.ps1 | 131 + Modules/ASR/Private/Test-ASRCompliance.ps1 | 117 + Modules/ASR/Private/Test-CloudProtection.ps1 | 34 + .../ASR/Private/Test-ConfigMgrPresence.ps1 | 41 + Modules/ASR/Public/Invoke-ASRRules.ps1 | 571 +++ .../AdvancedSecurity/AdvancedSecurity.psd1 | 73 + .../AdvancedSecurity/AdvancedSecurity.psm1 | 65 + .../AdvancedSecurity/Config/AdminShares.json | 116 + .../AdvancedSecurity/Config/Credentials.json | 78 + Modules/AdvancedSecurity/Config/Firewall.json | 20 + Modules/AdvancedSecurity/Config/RDP.json | 64 + .../AdvancedSecurity/Config/SRP-Rules.json | 85 + .../Config/WindowsUpdate.json | 57 + .../Backup-AdvancedSecuritySettings.ps1 | 380 ++ .../Private/Block-FingerProtocol.ps1 | 107 + .../Private/Disable-AdminShares.ps1 | 219 + .../Private/Disable-LegacyTLS.ps1 | 73 + .../Private/Disable-RiskyPorts.ps1 | 245 ++ .../AdvancedSecurity/Private/Disable-WPAD.ps1 | 147 + .../Private/Enable-RdpNLA.ps1 | 172 + .../Private/Remove-PowerShellV2.ps1 | 98 + .../Set-DiscoveryProtocolsSecurity.ps1 | 150 + .../Private/Set-FirewallShieldsUp.ps1 | 66 + .../Private/Set-IPv6Security.ps1 | 102 + .../AdvancedSecurity/Private/Set-SRPRules.ps1 | 192 + .../Private/Set-WDigestProtection.ps1 | 113 + .../Private/Set-WindowsUpdate.ps1 | 110 + .../Private/Set-WirelessDisplaySecurity.ps1 | 200 + .../Private/Stop-RiskyServices.ps1 | 216 + .../Private/Test-AdminShares.ps1 | 100 + .../Test-DiscoveryProtocolsSecurity.ps1 | 121 + .../Private/Test-FingerProtocol.ps1 | 57 + .../Private/Test-FirewallShieldsUp.ps1 | 39 + .../Private/Test-IPv6Security.ps1 | 61 + .../Private/Test-LegacyTLS.ps1 | 75 + .../Private/Test-PowerShellV2.ps1 | 61 + .../Private/Test-RdpSecurity.ps1 | 96 + .../Private/Test-RiskyPorts.ps1 | 134 + .../Private/Test-RiskyServices.ps1 | 89 + .../Private/Test-SRPCompliance.ps1 | 126 + .../AdvancedSecurity/Private/Test-WDigest.ps1 | 130 + .../AdvancedSecurity/Private/Test-WPAD.ps1 | 88 + .../Private/Test-WindowsUpdate.ps1 | 91 + .../Private/Test-WirelessDisplaySecurity.ps1 | 70 + .../Public/Invoke-AdvancedSecurity.ps1 | 1141 +++++ .../Restore-AdvancedSecuritySettings.ps1 | 312 ++ .../Public/Test-AdvancedSecurity.ps1 | 188 + Modules/AntiAI/AntiAI.psd1 | 35 + Modules/AntiAI/AntiAI.psm1 | 60 + Modules/AntiAI/Config/AntiAI-Settings.json | 419 ++ Modules/AntiAI/Private/Disable-ClickToDo.ps1 | 97 + Modules/AntiAI/Private/Disable-Copilot.ps1 | 250 ++ .../Private/Disable-CopilotAdvanced.ps1 | 206 + Modules/AntiAI/Private/Disable-ExplorerAI.ps1 | 76 + Modules/AntiAI/Private/Disable-NotepadAI.ps1 | 87 + Modules/AntiAI/Private/Disable-PaintAI.ps1 | 104 + Modules/AntiAI/Private/Disable-Recall.ps1 | 120 + .../AntiAI/Private/Disable-SettingsAgent.ps1 | 77 + .../AntiAI/Private/Set-RecallProtection.ps1 | 130 + Modules/AntiAI/Private/Set-SystemAIModels.ps1 | 118 + .../AntiAI/Private/Test-AntiAICompliance.ps1 | 652 +++ Modules/AntiAI/Public/Invoke-AntiAI.ps1 | 508 +++ Modules/DNS/Config/DNS.json | 38 + Modules/DNS/Config/Providers.json | 140 + Modules/DNS/DNS.psd1 | 38 + Modules/DNS/DNS.psm1 | 43 + Modules/DNS/Private/Backup-DNSSettings.ps1 | 300 ++ .../DNS/Private/Disable-DHCPDnsOverride.ps1 | 65 + Modules/DNS/Private/Enable-DoH.ps1 | 119 + Modules/DNS/Private/Get-PhysicalAdapters.ps1 | 150 + Modules/DNS/Private/Reset-DnsState.ps1 | 106 + Modules/DNS/Private/Set-DNSServers.ps1 | 183 + Modules/DNS/Private/Set-DoHPolicy.ps1 | 113 + Modules/DNS/Private/Test-DNSConnectivity.ps1 | 117 + Modules/DNS/Public/Get-DNSStatus.ps1 | 197 + .../DNS/Public/Invoke-DNSConfiguration.ps1 | 722 ++++ Modules/DNS/Public/Restore-DNSSettings.ps1 | 501 +++ .../EdgeHardening/Config/EdgePolicies.json | 150 + Modules/EdgeHardening/Config/Summary.json | 9 + Modules/EdgeHardening/EdgeHardening.psd1 | 66 + Modules/EdgeHardening/EdgeHardening.psm1 | 62 + .../Private/Backup-EdgePolicies.ps1 | 151 + .../Private/Restore-EdgePolicies.ps1 | 71 + .../Private/Set-EdgePolicies.ps1 | 185 + .../Private/Test-EdgePolicies.ps1 | 187 + .../Public/Invoke-EdgeHardening.ps1 | 383 ++ .../Public/Test-EdgeHardening.ps1 | 110 + Modules/Privacy/Config/Bloatware-Map.json | 26 + Modules/Privacy/Config/Bloatware.json | 119 + Modules/Privacy/Config/OneDrive.json | 43 + .../Privacy/Config/Privacy-MSRecommended.json | 326 ++ Modules/Privacy/Config/Privacy-Paranoid.json | 458 ++ Modules/Privacy/Config/Privacy-Strict.json | 437 ++ Modules/Privacy/Privacy.psd1 | 30 + Modules/Privacy/Privacy.psm1 | 71 + .../Private/Backup-PrivacySettings.ps1 | 179 + .../Private/Disable-TelemetryServices.ps1 | 22 + .../Private/Disable-TelemetryTasks.ps1 | 22 + Modules/Privacy/Private/Remove-Bloatware.ps1 | 361 ++ .../Private/Set-AppPrivacySettings.ps1 | 59 + .../Privacy/Private/Set-OneDriveSettings.ps1 | 45 + .../Private/Set-PersonalizationSettings.ps1 | 28 + .../Private/Set-PolicyBasedAppRemoval.ps1 | 117 + .../Privacy/Private/Set-TelemetrySettings.ps1 | 53 + .../Public/Invoke-PrivacyHardening.ps1 | 507 +++ Modules/Privacy/Public/Restore-Bloatware.ps1 | 293 ++ Modules/Privacy/Test-PrivacyCompliance.ps1 | 176 + .../Config/BitLockerPolicies.json | 36 + .../ParsedSettings/AuditPolicies.json | 163 + .../Computer-RegistryPolicies.json | 2313 ++++++++++ .../ParsedSettings/SecurityTemplates.json | 118 + .../ParsedSettings/Summary.json | 10 + .../ParsedSettings/User-RegistryPolicies.json | 37 + .../Private/Backup-AuditPolicies.ps1 | 66 + .../Private/Backup-RegistryPolicies.ps1 | 200 + .../Private/Backup-SecurityTemplate.ps1 | 87 + .../Private/Backup-XboxTask.ps1 | 81 + .../Private/Disable-XboxTask.ps1 | 67 + .../Private/Restore-AuditPolicies.ps1 | 69 + .../Private/Restore-RegistryPolicies.ps1 | 231 + .../Private/Restore-SecurityTemplate.ps1 | 93 + .../Private/Restore-XboxTask.ps1 | 92 + .../Private/Set-AuditPolicies.ps1 | 146 + .../Private/Set-RegistryPolicies.ps1 | 219 + .../Private/Set-SecurityTemplate.ps1 | 239 ++ .../Public/Invoke-SecurityBaseline.ps1 | 647 +++ .../Public/Restore-SecurityBaseline.ps1 | 190 + .../SecurityBaseline/SecurityBaseline.psd1 | 45 + .../SecurityBaseline/SecurityBaseline.psm1 | 50 + Modules/_ModuleTemplate/ModuleTemplate.psd1 | 54 + Modules/_ModuleTemplate/ModuleTemplate.psm1 | 54 + .../Private/Test-TemplateRequirements.ps1 | 49 + .../Public/Invoke-ModuleTemplate.ps1 | 200 + NoIDPrivacy-Interactive.ps1 | 980 +++++ NoIDPrivacy.ps1 | 435 ++ README.md | 878 ++++ SECURITY.md | 178 + Start-NoIDPrivacy.bat | 39 + Tests/Integration/ASR.Integration.Tests.ps1 | 31 + .../AdvancedSecurity.Integration.Tests.ps1 | 74 + .../Integration/AntiAI.Integration.Tests.ps1 | 42 + Tests/Integration/DNS.Integration.Tests.ps1 | 36 + .../EdgeHardening.Integration.Tests.ps1 | 52 + .../Integration/Privacy.Integration.Tests.ps1 | 31 + .../SecurityBaseline.Integration.Tests.ps1 | 36 + Tests/Run-AllTests.ps1 | 75 + Tests/Run-Tests.ps1 | 159 + Tests/Setup-TestEnvironment.ps1 | 88 + Tests/Unit/ASR.Tests.ps1 | 171 + Tests/Unit/AdvancedSecurity.Tests.ps1 | 197 + Tests/Unit/AntiAI.Tests.ps1 | 267 ++ Tests/Unit/DNS.Tests.ps1 | 224 + Tests/Unit/EdgeHardening.Tests.ps1 | 171 + Tests/Unit/ModuleTemplate.Tests.ps1 | 177 + Tests/Unit/Privacy.Tests.ps1 | 243 ++ Tools/Parse-EdgeBaseline.ps1 | 302 ++ Tools/Parse-SecurityBaseline.ps1 | 497 +++ Tools/Verify-Complete-Hardening.ps1 | 3729 +++++++++++++++++ Utils/Compatibility.ps1 | 92 + Utils/Dependencies.ps1 | 239 ++ Utils/Hardware.ps1 | 239 ++ Utils/Localization.ps1 | 209 + Utils/Registry.ps1 | 332 ++ Utils/Service.ps1 | 231 + assets/framework-architecture.png | Bin 0 -> 57391 bytes config.json | 109 + gui-state.json | 35 + install.ps1 | 332 ++ 195 files changed, 43788 insertions(+) create mode 100644 .github/FUNDING.yml create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md create mode 100644 .github/ISSUE_TEMPLATE/feature_request.md create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/pester-tests.yml create mode 100644 .gitignore create mode 100644 CHANGELOG.md create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md create mode 100644 Core/Config.ps1 create mode 100644 Core/Framework.ps1 create mode 100644 Core/Logger.ps1 create mode 100644 Core/NonInteractive.ps1 create mode 100644 Core/Rollback.ps1 create mode 100644 Core/Validator.ps1 create mode 100644 Docs/FEATURES.md create mode 100644 Docs/LICENSE-HISTORY.md create mode 100644 Docs/NONINTERACTIVE-MODE.md create mode 100644 Docs/SECURITY-ANALYSIS.md create mode 100644 LICENSE create mode 100644 Modules/ASR/ASR.psd1 create mode 100644 Modules/ASR/ASR.psm1 create mode 100644 Modules/ASR/Config/ASR-Rules.json create mode 100644 Modules/ASR/Private/Backup-ASRRegistry.ps1 create mode 100644 Modules/ASR/Private/Get-ASRRuleDefinitions.ps1 create mode 100644 Modules/ASR/Private/Restore-ASRSettings.ps1 create mode 100644 Modules/ASR/Private/Set-ASRViaPowerShell.ps1 create mode 100644 Modules/ASR/Private/Test-ASRCompliance.ps1 create mode 100644 Modules/ASR/Private/Test-CloudProtection.ps1 create mode 100644 Modules/ASR/Private/Test-ConfigMgrPresence.ps1 create mode 100644 Modules/ASR/Public/Invoke-ASRRules.ps1 create mode 100644 Modules/AdvancedSecurity/AdvancedSecurity.psd1 create mode 100644 Modules/AdvancedSecurity/AdvancedSecurity.psm1 create mode 100644 Modules/AdvancedSecurity/Config/AdminShares.json create mode 100644 Modules/AdvancedSecurity/Config/Credentials.json create mode 100644 Modules/AdvancedSecurity/Config/Firewall.json create mode 100644 Modules/AdvancedSecurity/Config/RDP.json create mode 100644 Modules/AdvancedSecurity/Config/SRP-Rules.json create mode 100644 Modules/AdvancedSecurity/Config/WindowsUpdate.json create mode 100644 Modules/AdvancedSecurity/Private/Backup-AdvancedSecuritySettings.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Block-FingerProtocol.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Disable-AdminShares.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Disable-LegacyTLS.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Disable-RiskyPorts.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Disable-WPAD.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Enable-RdpNLA.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Remove-PowerShellV2.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Set-DiscoveryProtocolsSecurity.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Set-FirewallShieldsUp.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Set-IPv6Security.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Set-SRPRules.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Set-WDigestProtection.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Set-WindowsUpdate.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Set-WirelessDisplaySecurity.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Stop-RiskyServices.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-AdminShares.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-DiscoveryProtocolsSecurity.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-FingerProtocol.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-FirewallShieldsUp.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-IPv6Security.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-LegacyTLS.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-PowerShellV2.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-RdpSecurity.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-RiskyPorts.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-RiskyServices.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-SRPCompliance.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-WDigest.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-WPAD.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-WindowsUpdate.ps1 create mode 100644 Modules/AdvancedSecurity/Private/Test-WirelessDisplaySecurity.ps1 create mode 100644 Modules/AdvancedSecurity/Public/Invoke-AdvancedSecurity.ps1 create mode 100644 Modules/AdvancedSecurity/Public/Restore-AdvancedSecuritySettings.ps1 create mode 100644 Modules/AdvancedSecurity/Public/Test-AdvancedSecurity.ps1 create mode 100644 Modules/AntiAI/AntiAI.psd1 create mode 100644 Modules/AntiAI/AntiAI.psm1 create mode 100644 Modules/AntiAI/Config/AntiAI-Settings.json create mode 100644 Modules/AntiAI/Private/Disable-ClickToDo.ps1 create mode 100644 Modules/AntiAI/Private/Disable-Copilot.ps1 create mode 100644 Modules/AntiAI/Private/Disable-CopilotAdvanced.ps1 create mode 100644 Modules/AntiAI/Private/Disable-ExplorerAI.ps1 create mode 100644 Modules/AntiAI/Private/Disable-NotepadAI.ps1 create mode 100644 Modules/AntiAI/Private/Disable-PaintAI.ps1 create mode 100644 Modules/AntiAI/Private/Disable-Recall.ps1 create mode 100644 Modules/AntiAI/Private/Disable-SettingsAgent.ps1 create mode 100644 Modules/AntiAI/Private/Set-RecallProtection.ps1 create mode 100644 Modules/AntiAI/Private/Set-SystemAIModels.ps1 create mode 100644 Modules/AntiAI/Private/Test-AntiAICompliance.ps1 create mode 100644 Modules/AntiAI/Public/Invoke-AntiAI.ps1 create mode 100644 Modules/DNS/Config/DNS.json create mode 100644 Modules/DNS/Config/Providers.json create mode 100644 Modules/DNS/DNS.psd1 create mode 100644 Modules/DNS/DNS.psm1 create mode 100644 Modules/DNS/Private/Backup-DNSSettings.ps1 create mode 100644 Modules/DNS/Private/Disable-DHCPDnsOverride.ps1 create mode 100644 Modules/DNS/Private/Enable-DoH.ps1 create mode 100644 Modules/DNS/Private/Get-PhysicalAdapters.ps1 create mode 100644 Modules/DNS/Private/Reset-DnsState.ps1 create mode 100644 Modules/DNS/Private/Set-DNSServers.ps1 create mode 100644 Modules/DNS/Private/Set-DoHPolicy.ps1 create mode 100644 Modules/DNS/Private/Test-DNSConnectivity.ps1 create mode 100644 Modules/DNS/Public/Get-DNSStatus.ps1 create mode 100644 Modules/DNS/Public/Invoke-DNSConfiguration.ps1 create mode 100644 Modules/DNS/Public/Restore-DNSSettings.ps1 create mode 100644 Modules/EdgeHardening/Config/EdgePolicies.json create mode 100644 Modules/EdgeHardening/Config/Summary.json create mode 100644 Modules/EdgeHardening/EdgeHardening.psd1 create mode 100644 Modules/EdgeHardening/EdgeHardening.psm1 create mode 100644 Modules/EdgeHardening/Private/Backup-EdgePolicies.ps1 create mode 100644 Modules/EdgeHardening/Private/Restore-EdgePolicies.ps1 create mode 100644 Modules/EdgeHardening/Private/Set-EdgePolicies.ps1 create mode 100644 Modules/EdgeHardening/Private/Test-EdgePolicies.ps1 create mode 100644 Modules/EdgeHardening/Public/Invoke-EdgeHardening.ps1 create mode 100644 Modules/EdgeHardening/Public/Test-EdgeHardening.ps1 create mode 100644 Modules/Privacy/Config/Bloatware-Map.json create mode 100644 Modules/Privacy/Config/Bloatware.json create mode 100644 Modules/Privacy/Config/OneDrive.json create mode 100644 Modules/Privacy/Config/Privacy-MSRecommended.json create mode 100644 Modules/Privacy/Config/Privacy-Paranoid.json create mode 100644 Modules/Privacy/Config/Privacy-Strict.json create mode 100644 Modules/Privacy/Privacy.psd1 create mode 100644 Modules/Privacy/Privacy.psm1 create mode 100644 Modules/Privacy/Private/Backup-PrivacySettings.ps1 create mode 100644 Modules/Privacy/Private/Disable-TelemetryServices.ps1 create mode 100644 Modules/Privacy/Private/Disable-TelemetryTasks.ps1 create mode 100644 Modules/Privacy/Private/Remove-Bloatware.ps1 create mode 100644 Modules/Privacy/Private/Set-AppPrivacySettings.ps1 create mode 100644 Modules/Privacy/Private/Set-OneDriveSettings.ps1 create mode 100644 Modules/Privacy/Private/Set-PersonalizationSettings.ps1 create mode 100644 Modules/Privacy/Private/Set-PolicyBasedAppRemoval.ps1 create mode 100644 Modules/Privacy/Private/Set-TelemetrySettings.ps1 create mode 100644 Modules/Privacy/Public/Invoke-PrivacyHardening.ps1 create mode 100644 Modules/Privacy/Public/Restore-Bloatware.ps1 create mode 100644 Modules/Privacy/Test-PrivacyCompliance.ps1 create mode 100644 Modules/SecurityBaseline/Config/BitLockerPolicies.json create mode 100644 Modules/SecurityBaseline/ParsedSettings/AuditPolicies.json create mode 100644 Modules/SecurityBaseline/ParsedSettings/Computer-RegistryPolicies.json create mode 100644 Modules/SecurityBaseline/ParsedSettings/SecurityTemplates.json create mode 100644 Modules/SecurityBaseline/ParsedSettings/Summary.json create mode 100644 Modules/SecurityBaseline/ParsedSettings/User-RegistryPolicies.json create mode 100644 Modules/SecurityBaseline/Private/Backup-AuditPolicies.ps1 create mode 100644 Modules/SecurityBaseline/Private/Backup-RegistryPolicies.ps1 create mode 100644 Modules/SecurityBaseline/Private/Backup-SecurityTemplate.ps1 create mode 100644 Modules/SecurityBaseline/Private/Backup-XboxTask.ps1 create mode 100644 Modules/SecurityBaseline/Private/Disable-XboxTask.ps1 create mode 100644 Modules/SecurityBaseline/Private/Restore-AuditPolicies.ps1 create mode 100644 Modules/SecurityBaseline/Private/Restore-RegistryPolicies.ps1 create mode 100644 Modules/SecurityBaseline/Private/Restore-SecurityTemplate.ps1 create mode 100644 Modules/SecurityBaseline/Private/Restore-XboxTask.ps1 create mode 100644 Modules/SecurityBaseline/Private/Set-AuditPolicies.ps1 create mode 100644 Modules/SecurityBaseline/Private/Set-RegistryPolicies.ps1 create mode 100644 Modules/SecurityBaseline/Private/Set-SecurityTemplate.ps1 create mode 100644 Modules/SecurityBaseline/Public/Invoke-SecurityBaseline.ps1 create mode 100644 Modules/SecurityBaseline/Public/Restore-SecurityBaseline.ps1 create mode 100644 Modules/SecurityBaseline/SecurityBaseline.psd1 create mode 100644 Modules/SecurityBaseline/SecurityBaseline.psm1 create mode 100644 Modules/_ModuleTemplate/ModuleTemplate.psd1 create mode 100644 Modules/_ModuleTemplate/ModuleTemplate.psm1 create mode 100644 Modules/_ModuleTemplate/Private/Test-TemplateRequirements.ps1 create mode 100644 Modules/_ModuleTemplate/Public/Invoke-ModuleTemplate.ps1 create mode 100644 NoIDPrivacy-Interactive.ps1 create mode 100644 NoIDPrivacy.ps1 create mode 100644 README.md create mode 100644 SECURITY.md create mode 100644 Start-NoIDPrivacy.bat create mode 100644 Tests/Integration/ASR.Integration.Tests.ps1 create mode 100644 Tests/Integration/AdvancedSecurity.Integration.Tests.ps1 create mode 100644 Tests/Integration/AntiAI.Integration.Tests.ps1 create mode 100644 Tests/Integration/DNS.Integration.Tests.ps1 create mode 100644 Tests/Integration/EdgeHardening.Integration.Tests.ps1 create mode 100644 Tests/Integration/Privacy.Integration.Tests.ps1 create mode 100644 Tests/Integration/SecurityBaseline.Integration.Tests.ps1 create mode 100644 Tests/Run-AllTests.ps1 create mode 100644 Tests/Run-Tests.ps1 create mode 100644 Tests/Setup-TestEnvironment.ps1 create mode 100644 Tests/Unit/ASR.Tests.ps1 create mode 100644 Tests/Unit/AdvancedSecurity.Tests.ps1 create mode 100644 Tests/Unit/AntiAI.Tests.ps1 create mode 100644 Tests/Unit/DNS.Tests.ps1 create mode 100644 Tests/Unit/EdgeHardening.Tests.ps1 create mode 100644 Tests/Unit/ModuleTemplate.Tests.ps1 create mode 100644 Tests/Unit/Privacy.Tests.ps1 create mode 100644 Tools/Parse-EdgeBaseline.ps1 create mode 100644 Tools/Parse-SecurityBaseline.ps1 create mode 100644 Tools/Verify-Complete-Hardening.ps1 create mode 100644 Utils/Compatibility.ps1 create mode 100644 Utils/Dependencies.ps1 create mode 100644 Utils/Hardware.ps1 create mode 100644 Utils/Localization.ps1 create mode 100644 Utils/Registry.ps1 create mode 100644 Utils/Service.ps1 create mode 100644 assets/framework-architecture.png create mode 100644 config.json create mode 100644 gui-state.json create mode 100644 install.ps1 diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 0000000..9fa7d8a --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1,3 @@ +# Support NoID Privacy development + +buy_me_a_coffee: noidprivacy diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..e4ba02a --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,79 @@ +--- +name: ๐Ÿ› Bug Report +about: Report a bug or unexpected behavior +title: '[BUG] ' +labels: 'bug' +assignees: '' +--- + +## ๐Ÿ› Bug Description + +A clear and concise description of what the bug is. + +## ๐Ÿ“‹ Steps to Reproduce + +1. Run command: `...` +2. Configure module: `...` +3. Execute script: `...` +4. See error + +## โœ… Expected Behavior + +A clear description of what you expected to happen. + +## โŒ Actual Behavior + +A clear description of what actually happened. + +## ๐Ÿ’ป System Information + +- **OS**: Windows 11 [e.g., 25H2 Build 26200] +- **PowerShell Version**: [e.g., 5.1.26100.2161] +- **CPU**: [e.g., AMD Ryzen 7 9800X3D] +- **TPM**: [e.g., 2.0 Present] +- **Third-Party AV**: [e.g., None, Windows Defender only] +- **Script Version**: [e.g., v2.2.0] +- **Execution Mode**: [Interactive / Direct / DryRun] + +**Get System Info:** +```powershell +# Run this to get system info +$PSVersionTable +Get-ComputerInfo | Select-Object OsName, OsVersion, OsBuildNumber +Get-Tpm | Select-Object TpmPresent, TpmReady +``` + +## ๐Ÿ“ Log Files + +Please attach or paste the relevant portion of the log file: + +**Location**: `Logs\NoIDPrivacy_YYYYMMDD_HHMMSS.log` + +``` +[Paste relevant log excerpt here] +``` + +## ๐Ÿ“ธ Screenshots + +If applicable, add screenshots to help explain your problem. + +## ๐Ÿ” Additional Context + +Add any other context about the problem here: +- Was this a fresh installation or re-run? +- Did the script work previously? +- Any recent system changes? +- Running in VM or physical machine? + +## โœ”๏ธ Checklist + +- [ ] I have searched for similar issues +- [ ] I have verified this is reproducible +- [ ] I have included the log file +- [ ] I have provided complete system information +- [ ] I have tested on a clean Windows 11 25H2 installation (if possible) + +## ๐Ÿ”’ Security Note + +If this is a **security vulnerability**, please **DO NOT** create a public issue! +Instead, report it privately via: https://github.com/NexusOne23/noid-privacy/security/advisories diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..573c983 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,103 @@ +--- +name: โœจ Feature Request +about: Suggest a new feature or enhancement +title: '[FEATURE] ' +labels: 'enhancement' +assignees: '' +--- + +## ๐Ÿš€ Feature Request + +**Note:** For questions or discussions, please use [GitHub Discussions](https://github.com/NexusOne23/noid-privacy/discussions) instead! + +## ๐Ÿ” Problem Statement + +**Is your feature request related to a problem?** + +Describe the problem this feature would solve. Example: "I'm frustrated when [...]" + +## ๐Ÿ’ก Proposed Solution + +Describe the solution you'd like to see implemented. + +## ๐Ÿ”„ Alternatives Considered + +Describe any alternative solutions or features you've considered. + +## ๐Ÿ“Š Impact Assessment + +Please assess the potential impact of this feature: + +### Security Impact +- [ ] Enhances security +- [ ] No security impact +- [ ] Potential security concerns (explain below) + +**Details:** + +### Privacy Impact +- [ ] Enhances privacy +- [ ] No privacy impact +- [ ] Potential privacy concerns (explain below) + +**Details:** + +### Compatibility Impact +- [ ] No breaking changes +- [ ] Minor breaking changes +- [ ] Major breaking changes (explain below) + +**Details:** + +### Usability Impact +- [ ] Improves usability +- [ ] No usability impact +- [ ] May affect usability (explain below) + +**Details:** + +## ๐Ÿ“ Additional Context + +Add any other context, examples, or mockups about the feature request here. + +## ๐ŸŽฏ Use Cases + +Describe specific use cases where this feature would be beneficial: + +1. **Use case 1**: [Description] +2. **Use case 2**: [Description] +3. **Use case 3**: [Description] + +## ๐Ÿ“š References + +Link to any relevant documentation, standards, or similar implementations: + +- [Example: Microsoft documentation] +- [Example: CIS Benchmark requirement] +- [Example: Similar project implementation] + +## ๐Ÿท๏ธ Module Target + +Which module would this feature belong to? + +- [ ] SecurityBaseline (MS Baseline settings) +- [ ] ASR (Attack Surface Reduction) +- [ ] DNS (Secure DNS) +- [ ] Privacy (Telemetry, Bloatware) +- [ ] AntiAI (AI Features Lockdown) +- [ ] EdgeHardening (Microsoft Edge) +- [ ] AdvancedSecurity (Beyond MS Baseline) +- [ ] Core (Framework/Architecture) +- [ ] New Module (describe below) + +## โœ”๏ธ Checklist + +- [ ] I have searched for similar feature requests +- [ ] I have considered the impact on security and privacy +- [ ] I have described the problem and proposed solution clearly +- [ ] I have provided use cases and examples +- [ ] This is NOT a security vulnerability (use Security Advisory instead) + +## ๐Ÿ’ผ Commercial Licensing + +If this feature is critical for your organization and you need it prioritized, consider our [commercial licensing options](https://github.com/NexusOne23/noid-privacy/discussions) with dedicated support and custom development. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..b73ff5b --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,94 @@ +# Pull Request + +## ๐Ÿ“ Description + +Please include a summary of the changes and the related issue. Explain the motivation and context. + +Fixes #(issue number) + +## ๐ŸŽฏ Type of Change + +Please delete options that are not relevant: + +- [ ] ๐Ÿ› Bug fix (non-breaking change which fixes an issue) +- [ ] โœจ New feature (non-breaking change which adds functionality) +- [ ] ๐Ÿ’ฅ Breaking change (fix or feature that would cause existing functionality to not work as expected) +- [ ] ๐Ÿ“š Documentation update +- [ ] ๐Ÿ”ง Code refactoring (no functional changes) +- [ ] โšก Performance improvement +- [ ] โœ… Test coverage improvement + +## ๐Ÿงช Testing + +Please describe the tests you ran to verify your changes: + +- [ ] Tested on Windows 11 25H2 +- [ ] Tested on Windows 11 24H2 +- [ ] Tested in VM environment +- [ ] Tested on physical hardware +- [ ] Unit tests pass (`.\Tests\Run-Tests.ps1`) +- [ ] Integration tests pass +- [ ] Verification script passes (`.\Tools\Verify-Complete-Hardening.ps1`) + +**Test Configuration:** +- **OS Version**: Windows 11 25H2 Build 26200 +- **PowerShell Version**: 5.1.26100.xxxx +- **Test Environment**: VM / Physical + +## ๐Ÿ“‹ Checklist + +- [ ] My code follows the style guidelines of this project +- [ ] I have performed a self-review of my code +- [ ] I have commented my code, particularly in hard-to-understand areas +- [ ] I have made corresponding changes to the documentation +- [ ] My changes generate no new warnings +- [ ] I have added tests that prove my fix is effective or that my feature works +- [ ] New and existing unit tests pass locally with my changes +- [ ] Any dependent changes have been merged and published +- [ ] I have updated the CHANGELOG.md +- [ ] I have read and agree to the [Code of Conduct](../CODE_OF_CONDUCT.md) + +## ๐Ÿ”’ Security Considerations + +- [ ] This change does not introduce security vulnerabilities +- [ ] This change has been reviewed for security implications +- [ ] Sensitive data is handled properly (if applicable) +- [ ] No hardcoded credentials or secrets + +**Security Impact Details:** + +## ๐Ÿ“š Documentation + +- [ ] README.md updated (if needed) +- [ ] CHANGELOG.md updated +- [ ] Docs/ folder updated (if needed) +- [ ] Code comments added/updated + +## ๐Ÿ”„ Backwards Compatibility + +- [ ] This change is backwards compatible +- [ ] This change includes migration path for existing users +- [ ] Breaking changes are documented + +**Compatibility Details:** + +## ๐ŸŽจ Screenshots (if applicable) + +Add screenshots to help explain your changes (e.g., UI changes, verification report). + +## ๐Ÿ“ Additional Notes + +Add any additional notes for reviewers here. + +--- + +## For Maintainers + +**Review Checklist:** +- [ ] Code quality meets project standards +- [ ] Tests are comprehensive +- [ ] Documentation is complete +- [ ] Security implications reviewed +- [ ] Backwards compatibility considered +- [ ] CHANGELOG updated +- [ ] Ready to merge diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..0db2d1e --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,226 @@ +name: CI - PowerShell Quality Checks + +on: + push: + branches: [ main ] + pull_request: + branches: [ main ] + workflow_dispatch: + +permissions: + contents: read + checks: write + pull-requests: write + +jobs: + psscriptanalyzer: + name: PSScriptAnalyzer + runs-on: windows-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Run PSScriptAnalyzer + shell: pwsh + run: | + Write-Host "Installing PSScriptAnalyzer..." + Install-Module -Name PSScriptAnalyzer -Force -Scope CurrentUser -SkipPublisherCheck -ErrorAction Stop + + Write-Host "" + Write-Host "Running PSScriptAnalyzer (Errors only)..." + $results = Invoke-ScriptAnalyzer -Path . -Recurse -Severity Error + + if ($results) { + Write-Host "" + Write-Host "=== PSScriptAnalyzer Errors Found ===" -ForegroundColor Red + $results | Format-Table -AutoSize + + Write-Host "" + Write-Host "Error Count: $($results.Count)" -ForegroundColor Red + Write-Host "Failing CI due to errors" -ForegroundColor Red + exit 1 + } else { + Write-Host "" + Write-Host "No errors found! (Warnings are ignored)" -ForegroundColor Green + } + + test-powershell-51: + name: Test on PowerShell 5.1 + runs-on: windows-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Test PowerShell Scripts (5.1) + shell: powershell + run: | + Write-Host "PowerShell Version: $($PSVersionTable.PSVersion)" -ForegroundColor Cyan + Write-Host "Testing script syntax..." + $ErrorActionPreference = 'Stop' + + $failed = $false + Get-ChildItem -Path . -Filter "*.ps1" -Recurse -ErrorAction SilentlyContinue | ForEach-Object { + Write-Host "Checking: $($_.Name)" + try { + $errors = $null + $tokens = [System.Management.Automation.PSParser]::Tokenize((Get-Content $_.FullName -Raw), [ref]$errors) + if ($errors.Count -gt 0) { + Write-Host " [ERROR] $($errors[0].Message)" -ForegroundColor Red + $failed = $true + } else { + Write-Host " [OK]" -ForegroundColor Green + } + } catch { + Write-Host " [ERROR] $_" -ForegroundColor Red + $failed = $true + } + } + + if ($failed) { + Write-Host "" + Write-Host "Syntax check FAILED" -ForegroundColor Red + exit 1 + } else { + Write-Host "" + Write-Host "All scripts have valid syntax!" -ForegroundColor Green + } + + test-powershell-7: + name: Test on PowerShell 7.4 + runs-on: windows-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Test PowerShell Scripts (7.4) + shell: pwsh + run: | + Write-Host "PowerShell Version: $($PSVersionTable.PSVersion)" -ForegroundColor Cyan + Write-Host "Testing script syntax..." + $ErrorActionPreference = 'Stop' + + $failed = $false + Get-ChildItem -Path . -Filter "*.ps1" -Recurse -ErrorAction SilentlyContinue | ForEach-Object { + Write-Host "Checking: $($_.Name)" + try { + $errors = $null + $tokens = $null + $ast = [System.Management.Automation.Language.Parser]::ParseFile($_.FullName, [ref]$tokens, [ref]$errors) + if ($errors.Count -gt 0) { + Write-Host " [ERROR] $($errors[0].Message)" -ForegroundColor Red + $failed = $true + } else { + Write-Host " [OK]" -ForegroundColor Green + } + } catch { + Write-Host " [ERROR] $_" -ForegroundColor Red + $failed = $true + } + } + + if ($failed) { + Write-Host "" + Write-Host "Syntax check FAILED" -ForegroundColor Red + exit 1 + } else { + Write-Host "" + Write-Host "All scripts have valid syntax!" -ForegroundColor Green + } + + validate-structure: + name: Validate Project Structure + runs-on: windows-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Check Required Files + shell: pwsh + run: | + Write-Host "Checking project structure..." -ForegroundColor Cyan + + $required = @( + "README.md", + "LICENSE", + "CHANGELOG.md", + "NoIDPrivacy-Interactive.ps1", + "Core/Framework.ps1", + "Modules", + "Tools" + ) + + $missing = @() + foreach ($item in $required) { + if (Test-Path $item) { + Write-Host "[OK] $item" -ForegroundColor Green + } else { + Write-Host "[MISSING] $item" -ForegroundColor Red + $missing += $item + } + } + + if ($missing.Count -gt 0) { + Write-Host "" + Write-Host "Missing required files/folders!" -ForegroundColor Red + exit 1 + } else { + Write-Host "" + Write-Host "All required files present!" -ForegroundColor Green + } + + - name: Check Module Structure + shell: pwsh + run: | + Write-Host "`nValidating module structure..." -ForegroundColor Cyan + + $modules = @( + "SecurityBaseline", + "ASR", + "DNS", + "Privacy", + "AntiAI", + "EdgeHardening", + "AdvancedSecurity" + ) + + $failed = $false + foreach ($module in $modules) { + $modulePath = "Modules/$module" + if (Test-Path $modulePath) { + Write-Host "[OK] Module: $module" -ForegroundColor Green + + # Check for required module files + $moduleFile = "$modulePath/$module.psm1" + $manifestFile = "$modulePath/$module.psd1" + + if (Test-Path $moduleFile) { + Write-Host " [OK] $module.psm1" -ForegroundColor Green + } else { + Write-Host " [MISSING] $module.psm1" -ForegroundColor Red + $failed = $true + } + + if (Test-Path $manifestFile) { + Write-Host " [OK] $module.psd1" -ForegroundColor Green + } else { + Write-Host " [MISSING] $module.psd1" -ForegroundColor Red + $failed = $true + } + } else { + Write-Host "[MISSING] Module: $module" -ForegroundColor Red + $failed = $true + } + } + + if ($failed) { + Write-Host "" + Write-Host "Module structure validation FAILED!" -ForegroundColor Red + exit 1 + } else { + Write-Host "" + Write-Host "All modules are correctly structured!" -ForegroundColor Green + } diff --git a/.github/workflows/pester-tests.yml b/.github/workflows/pester-tests.yml new file mode 100644 index 0000000..04333be --- /dev/null +++ b/.github/workflows/pester-tests.yml @@ -0,0 +1,71 @@ +name: Pester Tests + +on: + push: + branches: [ main, develop ] + pull_request: + branches: [ main ] + workflow_dispatch: + +jobs: + test: + runs-on: windows-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Install Pester + shell: pwsh + run: | + Install-Module -Name Pester -Force -SkipPublisherCheck -Scope CurrentUser + Import-Module Pester + + - name: Run Unit Tests + shell: pwsh + run: | + $config = New-PesterConfiguration + $config.Run.Path = "Tests/Unit" + $config.Run.PassThru = $true + $config.Output.Verbosity = 'Detailed' + $config.TestResult.Enabled = $true + $config.TestResult.OutputPath = "TestResults-Unit.xml" + $config.TestResult.OutputFormat = 'NUnitXml' + + $results = Invoke-Pester -Configuration $config + + if ($results.FailedCount -gt 0) { + Write-Error "Unit tests failed: $($results.FailedCount) failures" + exit 1 + } + + - name: Run Integration Tests (DryRun only) + shell: pwsh + run: | + $config = New-PesterConfiguration + $config.Run.Path = "Tests/Integration" + $config.Run.PassThru = $true + $config.Output.Verbosity = 'Detailed' + $config.TestResult.Enabled = $true + $config.TestResult.OutputPath = "TestResults-Integration.xml" + $config.TestResult.OutputFormat = 'NUnitXml' + + $results = Invoke-Pester -Configuration $config + + if ($results.FailedCount -gt 0) { + Write-Error "Integration tests failed: $($results.FailedCount) failures" + exit 1 + } + + - name: Upload Test Results + uses: actions/upload-artifact@v4 + if: always() + with: + name: test-results + path: TestResults-*.xml + + - name: Publish Test Results + uses: EnricoMi/publish-unit-test-result-action/windows@v2 + if: always() + with: + files: TestResults-*.xml diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..8fe512f --- /dev/null +++ b/.gitignore @@ -0,0 +1,58 @@ +# Logs +Logs/ +*.log + +# Backups +Backups/ +*.reg +*.bak + +# Reports +Reports/ +*.html +*.csv + +# Temporary files +*.tmp +*.temp + +# PowerShell module cache +*.psm1.tmp +*.ps1.tmp + +# Windows +Thumbs.db +Desktop.ini +$RECYCLE.BIN/ + +# IDE +.vscode/ +.idea/ +*.code-workspace + +# Build artifacts +Build/Output/ +Build/Release/ +*.msi +*.exe + +# Test results +Tests/Results/ +*.trx +*.coverage + +# User configuration (don't commit personal settings) +config.local.json + +# Sensitive data +*.key +*.pem +*.pfx +secrets/ + +# Common build artifacts and IDE metadata +[Bb]in/ +[Oo]bj/ +TestResults/ +.vs/ + diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..3cdcbee --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,324 @@ +# Changelog + +All notable changes to NoID Privacy will be documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +--- + +## [2.2.0] - 2025-12-08 + +### ๐Ÿš€ Enhanced Framework - 630+ Settings + +**Major update with expanded AI lockdown, improved privacy coverage, and ASR quick-toggle fix.** + +--- + +## ๐ŸŒŸ Release Highlights + +โœ… **630+ Settings** - Expanded from 580+ (Privacy, AntiAI, EdgeHardening, AdvSec Wireless Display) +โœ… **NonInteractive Mode** - Full GUI integration via config.json +โœ… **Third-Party AV Support** - Automatic detection, graceful ASR skip +โœ… **AntiAI Enhanced** - 32 policies (was 24), Recall Export Block, Edge Copilot disabled +โœ… **Pre-Framework ASR Snapshot** - Preserves rule state before multi-module runs +โœ… **Smart Registry Backup** - JSON fallback for protected keys +โœ… **Critical Bugfixes** - ASR Quick-Toggle, NonInteractive strict-mode, DNS offline + +### โœ… Added + +**NonInteractive Mode (GUI Integration)** +- Complete `config.json` support for automated execution +- All 7 modules fully configurable without prompts when values are provided in `config.json` +- Enables GUI-driven hardening in non-interactive mode (no Read-Host prompts) + +**Pre-Framework ASR Snapshot** +- Captures all 19 ASR rules before multi-module runs +- Ensures original system state is preserved +- Prevents ASR rule loss during complex operations + +**AntiAI Module Enhancements (24 โ†’ 32 policies)** +- Recall Export Block (prevents snapshot export) +- Advanced Copilot Blocks (URI handlers, Edge sidebar) +- Improved Edge Copilot sidebar disable (5 additional policies) +- Hardware Copilot key remapped to Notepad +- CapabilityAccessManager AI blocking + +**AdvancedSecurity: Wireless Display / Miracast Hardening** +- New Wireless Display security available in all AdvancedSecurity profiles (Balanced/Enterprise/Maximum) +- Default: Block receiving projections and require PIN for incoming connections +- Optional: Complete disable (blocks sending projections, mDNS discovery, ports 7236/7250, and Wi-Fi Direct adapters) + +**AdvancedSecurity: Discovery Protocols Security (Maximum profile)** +- Optional WS-Discovery + mDNS complete disable +- Blocks automatic device discovery (printers, TVs, scanners) +- Firewall rules for UDP 3702 (WS-Discovery) and UDP 5353 (mDNS) +- Prevents network mapping and mDNS spoofing attacks + +**AdvancedSecurity: IPv6 Disable (Maximum profile - mitm6 mitigation)** +- Optional complete IPv6 disable (DisabledComponents = 0xFF) +- Prevents mitm6 attacks (DHCPv6 spoofing โ†’ DNS takeover โ†’ NTLM relay) +- Defense-in-depth (WPAD already disabled by framework) +- Recommended for air-gapped/standalone systems + +**Privacy Module Expansion (55+ โ†’ 77 settings)** +- Cloud Clipboard toggle (user-configurable) +- Enhanced compliance verification +- Improved bloatware detection +- Better OneDrive sync compatibility + +**Third-Party Antivirus Detection** +- Automatic detection of Kaspersky, Norton, Bitdefender, etc. +- ASR module gracefully skipped when 3rd-party AV active +- Clear user notification explaining why +- All other modules continue normally (613 settings) + +**Smart Registry Backup System** +- JSON fallback for protected system keys +- Handles access-denied scenarios gracefully +- Empty marker files for non-existent keys +- Improved restore reliability + +**Documentation** +- AV Compatibility section: "Designed for Microsoft Defender โ€“ Works with Any Antivirus" +- Clear 632 vs 613 explanation for Defender vs. 3rd-party AV setups +- Improved troubleshooting guides + +### ๐Ÿ”จ Fixed + +**ASR Quick-Toggle Bug (Critical)** +- Fixed: Quick-toggling ASR rules caused 3 advanced rules to disappear +- Affected rules: Safe Mode Reboot, Copied System Tools, Webshell Creation +- Root cause: `Set-MpPreference` was called with single rule instead of full rule set +- Fix: Now reads existing rules, updates target, writes complete set back + +**NonInteractive Strict-Mode Error** +- Fixed fatal error when dot-sourcing `NonInteractive.ps1` in GUI context +- Safe check for `$global:NonInteractiveMode` variable + +**Registry Backup Protected Keys** +- Enhanced JSON fallback for protected system keys +- Prevents backup failures on restricted registry paths +- Creates marker files for rollback tracking + +**DNS Offline Handling** +- Graceful handling when system temporarily offline during DNS test +- Configuration proceeds and activates when connection restored + +**Module Progress Feedback** +- Improved status messages during long operations +- No more "stuck at 95%" feeling + +### ๐Ÿ“Š What Changed + +| Component | v2.1.0 | v2.2.0 | +|-----------|--------|--------| +| Total Settings | 580+ | **632** | +| AntiAI Policies | 24 | **32** | +| Privacy Settings | 55+ | **77** | +| NonInteractive Mode | โŒ | โœ… | +| 3rd-Party AV Detection | โŒ | โœ… | +| Pre-Framework ASR Snapshot | โŒ | โœ… | +| Smart Registry Backup | Basic | **JSON Fallback** | + +--- + +## [2.1.0] - 2025-11-23 + +### ๐ŸŽ‰ Production Release - Complete Windows 11 Security Framework + +**The first complete, production-ready release of NoID Privacy v2.x - 580+ settings, 7 modules, full BAVR pattern implementation.** + +--- + +## ๐ŸŒŸ Release Highlights + +โœ… **All 7 Modules Production-Ready** - Complete framework with 580+ security settings +โœ… **Zero-Day Protection** - CVE-2025-9491 mitigation (SRP .lnk protection) +โœ… **100% BAVR Coverage** - Every setting can be backed up, applied, verified, and restored +โœ… **Professional Code Quality** - All lint warnings resolved, comprehensive error handling +โœ… **Zero Tracking** - No cookies, no analytics, no telemetry (we practice what we preach) + +### โœ… Added - Complete Framework + +#### All 7 Security Modules + +**SecurityBaseline** (425 settings) - Microsoft Security Baseline for Windows 11 25H2 +- 335 Registry policies (Computer + User Configuration) +- 67 Security Template settings (Password Policy, Account Lockout, User Rights, Security Options) +- 23 Advanced Audit policies (Complete security event logging) +- Credential Guard, BitLocker policies, VBS & HVCI +- No LGPO.exe dependency (100% native PowerShell) + +**ASR** (19 rules) - Attack Surface Reduction +- 18 rules in Block mode, 1 configurable (PSExec/WMI) +- Blocks ransomware, macros, exploits, credential theft +- Office/Adobe/Email protection +- ConfigMgr detection for compatibility + +**DNS** (5 checks) - Secure DNS with DoH encryption +- 3 providers: Cloudflare (default), Quad9, AdGuard +- REQUIRE mode (no unencrypted fallback) or ALLOW mode (VPN-friendly) +- IPv4 + IPv6 dual-stack support +- DNSSEC validation + +**Privacy** (55+ settings) - Telemetry & Privacy Hardening +- 3 operating modes: MSRecommended (default), Strict, Paranoid +- Telemetry minimized to Security-Essential level +- Bloatware removal with auto-restore via winget (policy-based on 25H2+ Ent/Edu) +- OneDrive telemetry off (sync functional) +- App permissions default-deny + +**AntiAI** (24 policies) - AI Lockdown +- Generative AI Master Switch (blocks ALL AI models system-wide) +- Windows Recall (complete deactivation + component protection) +- Windows Copilot (system-wide disabled + hardware key remapped) +- Click to Do, Paint AI, Notepad AI, Settings Agent - all disabled + +**EdgeHardening** (20 policies) - Microsoft Edge Security Baseline +- SmartScreen enforced, Tracking Prevention strict +- SSL/TLS hardening, Extension security +- IE Mode restrictions +- Native PowerShell implementation (no LGPO.exe) + +**AdvancedSecurity** (44 settings) - Beyond Microsoft Baseline +- **SRP .lnk Protection (CVE-2025-9491)** - Zero-day mitigation for ClickFix malware +- **RDP Hardening** - Disabled by default, TLS + NLA enforced +- **Legacy Protocol Blocking** - SMBv1, NetBIOS, LLMNR, WPAD, PowerShell v2 +- **TLS Hardening** - 1.0/1.1 OFF, 1.2/1.3 ON +- **Windows Update** - 3 GUI-equivalent settings (interactive configuration) +- **Finger Protocol** - Blocked (ClickFix malware protection) + +#### Core Features + +**Complete BAVR Pattern (Backup-Apply-Verify-Restore)** +- All 580+ settings now fully verified in `Verify-Complete-Hardening.ps1` +- EdgeHardening: 20 verification checks added +- AdvancedSecurity: 42 verification checks added +- 100% coverage achieved (was 89.4%) + +**Bloatware Removal & Restore** +- `REMOVED_APPS_LIST.txt` created in backup folder with reinstall instructions +- `REMOVED_APPS_WINGET.json` metadata enables automatic reinstallation via `winget` +- Session restore attempts auto-restore first, falls back to manual Microsoft Store reinstall +- Policy-based removal for Windows 11 25H2+ Ent/Edu editions + +**Documentation & Repository** +- **FEATURES.md** - Complete settings reference +- **SECURITY-ANALYSIS.md** - Home user impact analysis +- **README.md** - Professional restructure with improved visual hierarchy +- **CHANGELOG.md** - Comprehensive release history +- **.gitignore** - Clean repository (ignores Logs/, Backups/, Reports/) + +--- + +### ๐Ÿ”จ Fixed - Critical Bugfixes + +**DNS Module Crash (CRITICAL)** +- Fixed `System.Object[]` to `System.Int32` type conversion error in `Get-PhysicalAdapters` +- Removed unary comma operator causing DNS configuration failure +- Prevents complete DNS module failure on certain network configurations + +**Bloatware Count Accuracy** +- Corrected misleading console output showing "2 apps removed" instead of actual count +- Fixed pipeline contamination from `Register-Backup` output in `Remove-Bloatware.ps1` +- Now shows accurate count (e.g., "14 apps removed") + +**Restore Logging System** +- Implemented dedicated `RESTORE_Session_XXXXXX_timestamp.log` file +- Captures all restore activities from A-Z with detailed logging +- Fixed empty `Message` parameter validation errors in `Write-RestoreLog` + +**User Selection Logs** +- Moved user selection messages from INFO to DEBUG (cleaner console output) +- Affects: Privacy mode selection, DNS provider selection, ASR mode selection +- Console now shows only critical information, detailed logs in log file + +**Code Quality & Linting** +- Removed all unused variables (`$isAdmin` in `Invoke-AdvancedSecurity.ps1`) +- Fixed PSScriptAnalyzer warnings across entire project +- Resolved double backslash escaping in documentation paths + +**Terminal Services GPO Cleanup** +- Enhanced GPO cleanup with explicit value removal +- Improved restore consistency for Terminal Services registry keys +- Cosmetic variance only (no functional impact) + +**Temporary File Leaks** +- SecurityBaseline: Added `finally` blocks to prevent temp file pollution +- Ensures cleanup of `secedit.exe` temp files even on errors +- Prevents TEMP folder accumulation + +--- + +### ๐Ÿ“Š What Changed + +**Framework Completion** +- Status: **7/7 modules (100%)** - All production-ready +- Total Settings: **580+** (was 521) +- BAVR Coverage: **100%** (was 89.4%) +- Verification: **EdgeHardening** (20 checks) + **AdvancedSecurity** (44 checks) added + +**Module Structure** +- All 7 modules now use consistent `/Config/` folder structure +- ASR: `Data/` โ†’ `Config/` +- EdgeHardening: `ParsedSettings/` โ†’ `Config/` + +**Documentation Improvements** +- README: Professional restructure, improved navigation +- Added "Why NoID Privacy?" section (Security โ†” Privacy connection) +- Added "Our Privacy Promise" section (Zero tracking) +- Fixed all inconsistent list formatting (trailing spaces โ†’ proper bullets) + +**Restore System** +- Production tested with full apply-restore cycle verification +- Restores to clean baseline state +- AdvancedSecurity: 100% perfect restoration + +--- + +### โš ๏ธ Breaking Changes + +**License Change** +- **MIT (v1.x) โ†’ GPL v3.0 (v2.x+)** +- Reason: Complete rewrite from scratch (100% new codebase) +- Impact: Derivatives must comply with GPL v3.0 copyleft requirements +- Note: v1.8.x releases remain under MIT license (unchanged) +- **Dual-Licensing:** Commercial licenses available for closed-source use + +--- + +### ๐Ÿ“ˆ Before/After Comparison + +**Before v2.1.0:** +``` +Modules: 5/7 (71%) +Settings: 521 +BAVR Coverage: 89.4% +Restore Accuracy: Unknown +Code Quality: Lint warnings present +Temp File Cleanup: Partial +``` + +**After v2.1.0:** +``` +Modules: 7/7 (100%) +Settings: 580+ +BAVR Coverage: 100% +Restore: Verified (full cycle) +Code Quality: PSScriptAnalyzer clean +Temp File Cleanup: Complete +``` + +--- + +## ๐Ÿ“š Additional Resources + +- **Full Documentation:** See [README.md](README.md) and [FEATURES.md](Docs/FEATURES.md) +- **Security Analysis:** See [SECURITY-ANALYSIS.md](Docs/SECURITY-ANALYSIS.md) +- **Bug Reports:** [GitHub Issues](https://github.com/NexusOne23/noid-privacy/issues) +- **Discussions:** [GitHub Discussions](https://github.com/NexusOne23/noid-privacy/discussions) + +--- + +**Made with ๐Ÿ›ก๏ธ for the Windows Security Community** diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..17bee9f --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,135 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, caste, color, religion, or sexual +identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +* Demonstrating empathy and kindness toward other people +* Being respectful of differing opinions, viewpoints, and experiences +* Giving and gracefully accepting constructive feedback +* Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +* Focusing on what is best not just for us as individuals, but for the overall + community + +Examples of unacceptable behavior include: + +* The use of sexualized language or imagery, and sexual attention or advances of + any kind +* Trolling, insulting or derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or email address, + without their explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +Community leaders have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, and will communicate reasons for moderation +decisions when appropriate. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. +Examples of representing our community include using an official email address, +posting via an official social media account, or acting as an appointed +representative at an online or offline event. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement via: + +- **GitHub Discussions**: https://github.com/NexusOne23/noid-privacy/discussions +- **GitHub Issues**: For code-related conduct issues only + +All complaints will be reviewed and investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Enforcement Guidelines + +Community leaders will follow these Community Impact Guidelines in determining +the consequences for any action they deem in violation of this Code of Conduct: + +### 1. Correction + +**Community Impact**: Use of inappropriate language or other behavior deemed +unprofessional or unwelcome in the community. + +**Consequence**: A private, written warning from community leaders, providing +clarity around the nature of the violation and an explanation of why the +behavior was inappropriate. A public apology may be requested. + +### 2. Warning + +**Community Impact**: A violation through a single incident or series of +actions. + +**Consequence**: A warning with consequences for continued behavior. No +interaction with the people involved, including unsolicited interaction with +those enforcing the Code of Conduct, for a specified period of time. This +includes avoiding interactions in community spaces as well as external channels +like social media. Violating these terms may lead to a temporary or permanent +ban. + +### 3. Temporary Ban + +**Community Impact**: A serious violation of community standards, including +sustained inappropriate behavior. + +**Consequence**: A temporary ban from any sort of interaction or public +communication with the community for a specified period of time. No public or +private interaction with the people involved, including unsolicited interaction +with those enforcing the Code of Conduct, is allowed during this period. +Violating these terms may lead to a permanent ban. + +### 4. Permanent Ban + +**Community Impact**: Demonstrating a pattern of violation of community +standards, including sustained inappropriate behavior, harassment of an +individual, or aggression toward or disparagement of classes of individuals. + +**Consequence**: A permanent ban from any sort of public interaction within the +community. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.1, available at +[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1]. + +Community Impact Guidelines were inspired by +[Mozilla's code of conduct enforcement ladder][Mozilla CoC]. + +For answers to common questions about this code of conduct, see the FAQ at +[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at +[https://www.contributor-covenant.org/translations][translations]. + +[homepage]: https://www.contributor-covenant.org +[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html +[Mozilla CoC]: https://github.com/mozilla/diversity +[FAQ]: https://www.contributor-covenant.org/faq +[translations]: https://www.contributor-covenant.org/translations diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..31e7763 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,783 @@ +# ๐Ÿ› ๏ธ Contributor Guide - Building New Modules + +**How to build production-quality hardening modules for NoID Privacy** + +This guide shows you how to create a new module using the **AdvancedSecurity** module as the reference implementation. Every principle, pattern, and structure you see here is based on real, production-tested code. + +--- + +## ๐Ÿ“‹ Table of Contents + +1. [Module Architecture](#module-architecture) +2. [File Structure](#file-structure) +3. [Core Integration Points](#core-integration-points) +4. [Implementation Checklist](#implementation-checklist) +5. [Best Practices](#best-practices) +6. [Testing & Verification](#testing--verification) + +--- + +## ๐Ÿ—๏ธ Module Architecture + +### Design Principles + +All modules in NoID Privacy follow these principles: + +1. **Separation of Concerns** - Public vs Private functions +2. **Backup Before Modify** - Always backup before changes +3. **Comprehensive Testing** - Test functions for compliance +4. **Structured Logging** - Use Write-Log for everything +5. **Error Handling** - Try/Catch everywhere +6. **PowerShell Best Practices** - Modern CIM, explicit returns, validated parameters + +### Module Types + +| Type | Example | Auto-Enabled | Use Case | +|------|---------|--------------|----------| +| **Core Hardening** | SecurityBaseline, ASR | โœ… Yes | Standard security settings, always safe | +| **Service-Based** | DNS, Privacy | โš ๏ธ Optional | User choice (provider, mode) | +| **Advanced/Aggressive** | AdvancedSecurity | โŒ Opt-in only | Breaking changes, requires testing | + +--- + +## ๐Ÿ“ File Structure + +### Required Structure + +``` +Modules/ +โ””โ”€โ”€ YourModule/ + โ”œโ”€โ”€ YourModule.psd1 # Module Manifest (REQUIRED) + โ”œโ”€โ”€ YourModule.psm1 # Module Loader (REQUIRED) + โ”œโ”€โ”€ Config/ # Configuration files + โ”‚ โ”œโ”€โ”€ Feature1.json # Feature-specific config + โ”‚ โ””โ”€โ”€ Feature2.json + โ”œโ”€โ”€ Private/ # Internal functions (not exported) + โ”‚ โ”œโ”€โ”€ Set-Feature1.ps1 # Implementation functions + โ”‚ โ”œโ”€โ”€ Set-Feature2.ps1 + โ”‚ โ”œโ”€โ”€ Test-Feature1.ps1 # Compliance test functions + โ”‚ โ”œโ”€โ”€ Test-Feature2.ps1 + โ”‚ โ”œโ”€โ”€ Backup-YourModuleSettings.ps1 # Comprehensive backup + โ”‚ โ””โ”€โ”€ Restore-YourModuleSettings.ps1 # Comprehensive restore + โ””โ”€โ”€ Public/ # Exported functions (user-facing) + โ”œโ”€โ”€ Invoke-YourModule.ps1 # Main entry point + โ””โ”€โ”€ Test-YourModule.ps1 # Compliance test entry point +``` + +### Example: AdvancedSecurity Module Structure + +``` +Modules/AdvancedSecurity/ +โ”œโ”€โ”€ AdvancedSecurity.psd1 # Manifest with version 2.2.0 +โ”œโ”€โ”€ AdvancedSecurity.psm1 # Loads Private/*.ps1 and Public/*.ps1 +โ”œโ”€โ”€ Config/ +โ”‚ โ”œโ”€โ”€ RDP.json # RDP hardening config +โ”‚ โ”œโ”€โ”€ Credentials.json # WDigest config +โ”‚ โ””โ”€โ”€ AdminShares.json # Admin shares config +โ”œโ”€โ”€ Private/ +โ”‚ โ”œโ”€โ”€ Enable-RdpNLA.ps1 # RDP hardening implementation +โ”‚ โ”œโ”€โ”€ Set-WDigestProtection.ps1 # WDigest implementation +โ”‚ โ”œโ”€โ”€ Disable-AdminShares.ps1 # Admin shares implementation +โ”‚ โ”œโ”€โ”€ Disable-RiskyPorts.ps1 # Firewall ports +โ”‚ โ”œโ”€โ”€ Stop-RiskyServices.ps1 # Services management +โ”‚ โ”œโ”€โ”€ Disable-WPAD.ps1 # WPAD disable +โ”‚ โ”œโ”€โ”€ Disable-LegacyTLS.ps1 # TLS 1.0/1.1 disable +โ”‚ โ”œโ”€โ”€ Remove-PowerShellV2.ps1 # PSv2 removal +โ”‚ โ”œโ”€โ”€ Test-RdpSecurity.ps1 # RDP compliance test +โ”‚ โ”œโ”€โ”€ Test-WDigest.ps1 # WDigest compliance test +โ”‚ โ”œโ”€โ”€ Test-AdminShares.ps1 # Admin shares test +โ”‚ โ”œโ”€โ”€ Test-RiskyPorts.ps1 # Ports compliance test +โ”‚ โ”œโ”€โ”€ Test-RiskyServices.ps1 # Services compliance test +โ”‚ โ”œโ”€โ”€ Backup-AdvancedSecuritySettings.ps1 # Full backup +โ”‚ โ””โ”€โ”€ Restore-AdvancedSecuritySettings.ps1 # Full restore +โ””โ”€โ”€ Public/ + โ”œโ”€โ”€ Invoke-AdvancedSecurity.ps1 # Main function with profiles + โ””โ”€โ”€ Test-AdvancedSecurity.ps1 # Compliance aggregator +``` + +--- + +## ๐Ÿ”ง Core Integration Points + +### 1. Module Manifest (.psd1) + +**Template:** +```powershell +@{ + RootModule = 'YourModule.psm1' + ModuleVersion = '2.2.0' + GUID = 'YOUR-GUID-HERE' # Generate with [guid]::NewGuid() + Author = 'Your Name' + CompanyName = 'NoID Privacy' + Copyright = '(c) 2025. All rights reserved.' + Description = 'Brief description of what your module does' + + PowerShellVersion = '5.1' + + FunctionsToExport = @( + 'Invoke-YourModule', + 'Test-YourModule' + ) + + CmdletsToExport = @() + VariablesToExport = @() + AliasesToExport = @() + + PrivateData = @{ + PSData = @{ + Tags = @('Security', 'Hardening', 'Windows11') + ProjectUri = 'https://github.com/yourusername/noid-privacy' + ReleaseNotes = @" +v2.2.0 - Initial Release +- Feature 1 +- Feature 2 +"@ + } + } +} +``` + +**Real Example (AdvancedSecurity.psd1):** +```powershell +@{ + RootModule = 'AdvancedSecurity.psm1' + ModuleVersion = '2.2.0' + GUID = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890' + Author = 'NexusOne23' + Description = 'Advanced Security hardening beyond Microsoft Security Baseline' + + FunctionsToExport = @( + 'Invoke-AdvancedSecurity', + 'Test-AdvancedSecurity' + ) + + PrivateData = @{ + PSData = @{ + Tags = @('Security', 'Hardening', 'RDP', 'TLS', 'Windows11') + ReleaseNotes = @" +v2.2.0 - Production Release +- RDP NLA enforcement + optional complete disable +- WDigest credential protection +- Administrative shares disable (domain-aware) +- Risky firewall ports closure (LLMNR, NetBIOS, UPnP/SSDP) +- Risky network services stop +- Legacy TLS 1.0/1.1 disable +- WPAD auto-discovery disable +- PowerShell v2 removal +- Profile system (Balanced/Enterprise/Maximum) +- Comprehensive backup/restore +"@ + } + } +} +``` + +--- + +### 2. Module Loader (.psm1) + +**Template:** +```powershell +<# +.SYNOPSIS + Module loader for YourModule +#> + +# Get module root path +$ModuleRoot = $PSScriptRoot + +# Import Private functions (not exported) +$PrivateFunctions = Get-ChildItem -Path "$ModuleRoot\Private\*.ps1" -ErrorAction SilentlyContinue + +foreach ($function in $PrivateFunctions) { + try { + . $function.FullName + Write-Verbose "Imported private function: $($function.BaseName)" + } + catch { + Write-Error "Failed to import private function $($function.FullName): $_" + } +} + +# Import Public functions (will be exported) +$PublicFunctions = Get-ChildItem -Path "$ModuleRoot\Public\*.ps1" -ErrorAction SilentlyContinue + +foreach ($function in $PublicFunctions) { + try { + . $function.FullName + Write-Verbose "Imported public function: $($function.BaseName)" + } + catch { + Write-Error "Failed to import public function $($function.FullName): $_" + } +} + +# Export only Public functions +$PublicFunctionNames = $PublicFunctions | ForEach-Object { $_.BaseName } +Export-ModuleMember -Function $PublicFunctionNames + +Write-Verbose "YourModule loaded successfully. Exported functions: $($PublicFunctionNames -join ', ')" +``` + +--- + +### 3. Logging Integration + +**Always use Write-Log from Core/Logger.ps1:** + +```powershell +# Import at module level if not using framework +. "$PSScriptRoot\..\..\Core\Logger.ps1" + +# In your functions +Write-Log -Level INFO -Message "Starting feature configuration..." -Module "YourModule" +Write-Log -Level SUCCESS -Message "Feature configured successfully" -Module "YourModule" +Write-Log -Level WARNING -Message "Non-critical issue detected" -Module "YourModule" +Write-Log -Level ERROR -Message "Failed to apply setting" -Module "YourModule" -Exception $_.Exception +Write-Log -Level DEBUG -Message "Registry key set: $regPath" -Module "YourModule" +``` + +**Log Levels:** +- `INFO` - General progress +- `SUCCESS` - Operation completed +- `WARNING` - Non-critical issues +- `ERROR` - Failures +- `DEBUG` - Detailed diagnostic info + +--- + +### 4. Backup Integration + +**Use Core/Rollback.ps1 functions:** + +```powershell +# Backup registry key +Backup-RegistryKey -KeyPath "HKLM:\SYSTEM\CurrentControlSet\..." -BackupName "YourFeature" + +# Backup service +Backup-ServiceConfiguration -ServiceName "YourService" + +# Register custom backup data +$backupData = @{ + YourData = $someValue + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" +} | ConvertTo-Json + +Register-Backup -Type "YourFeature_Settings" -Data $backupData -Name "YourFeatureName" +``` + +**Real Example (from AdvancedSecurity):** +```powershell +function Backup-AdvancedSecuritySettings { + try { + # Start backup session + $backupSession = Start-ModuleBackup -ModuleName "AdvancedSecurity" + + $backupCount = 0 + + # 1. RDP Settings + $rdpBackup = Backup-RegistryKey -KeyPath "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -BackupName "RDP_Settings" + if ($rdpBackup) { $backupCount++ } + + # 2. Services + $services = @("SSDPSRV", "upnphost", "lmhosts") + foreach ($svc in $services) { + $svcBackup = Backup-ServiceConfiguration -ServiceName $svc + if ($svcBackup) { $backupCount++ } + } + + # 3. Custom data (firewall rules snapshot) + $firewallRules = Get-NetFirewallRule | Where-Object { ... } + $firewallData = @{ + Rules = $firewallRules + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + } | ConvertTo-Json -Depth 10 + + $firewallBackup = Register-Backup -Type "Firewall_Rules" -Data $firewallData -Name "RiskyPorts_Firewall" + if ($firewallBackup) { $backupCount++ } + + return $backupCount + } + catch { + Write-Log -Level ERROR -Message "Backup failed: $_" -Module "YourModule" + return $false + } +} +``` + +--- + +## โœ… Implementation Checklist + +### Phase 1: Planning & Structure + +- [ ] Define module name and purpose +- [ ] Choose module type (Core/Service/Advanced) +- [ ] Plan features and settings +- [ ] Create folder structure +- [ ] Generate GUID for manifest +- [ ] Write module manifest (.psd1) +- [ ] Write module loader (.psm1) + +### Phase 2: Configuration + +- [ ] Create Config/*.json files for each feature +- [ ] Document settings with rationale +- [ ] Include impact assessment +- [ ] Add Microsoft documentation links +- [ ] Define default values + +### Phase 3: Implementation Functions (Private/) + +For each feature: +- [ ] Create Set-FeatureName.ps1 + - [ ] Add comprehensive help block + - [ ] Implement backup integration + - [ ] Add registry/service/file modifications + - [ ] Include error handling (try/catch) + - [ ] Add logging at every step + - [ ] Return $true on success, $false on failure +- [ ] Create Test-FeatureName.ps1 + - [ ] Check compliance + - [ ] Return PSCustomObject with status + - [ ] Include Details array for human-readable output + +### Phase 4: Aggregation Functions (Private/) + +- [ ] Create Backup-YourModuleSettings.ps1 + - [ ] Backup all features + - [ ] Use Start-ModuleBackup for session tracking + - [ ] Return backup count +- [ ] Create Restore-YourModuleSettings.ps1 + - [ ] Restore from backup directory + - [ ] Handle missing backups gracefully + - [ ] Log all restore operations + +### Phase 5: Public Interface (Public/) + +- [ ] Create Invoke-YourModule.ps1 + - [ ] Add [CmdletBinding(SupportsShouldProcess=$true)] + - [ ] Define parameters (profiles, modes, switches) + - [ ] Check for admin rights + - [ ] Initialize backup system + - [ ] Call Backup-YourModuleSettings (unless -SkipBackup) + - [ ] Call all Set-Feature functions + - [ ] Track applied/failed features + - [ ] Return structured PSCustomObject + - [ ] Provide user-friendly console output +- [ ] Create Test-YourModule.ps1 + - [ ] Call all Test-Feature functions + - [ ] Aggregate results + - [ ] Calculate compliance percentage + - [ ] Return array of compliance objects + +### Phase 6: Integration + +- [ ] Update config.json with module entry + - [ ] Set appropriate status (IMPLEMENTED/PLANNED) + - [ ] Set enabled (true for auto, false for opt-in) + - [ ] Add priority number + - [ ] Include description +- [ ] Update README.md + - [ ] Add module to appropriate table + - [ ] Document features + - [ ] Provide usage examples + - [ ] Explain opt-in if applicable +- [ ] Update Verify-Complete-Hardening.ps1 (if auto-enabled) + +### Phase 7: Testing + +- [ ] Test on clean Windows 11 VM +- [ ] Verify backup creation +- [ ] Verify settings application +- [ ] Test compliance checks +- [ ] Verify restore functionality +- [ ] Test error scenarios +- [ ] Test -WhatIf mode +- [ ] Document any issues + +--- + +## ๐Ÿ“š Best Practices + +### 1. Use Modern PowerShell + +**โœ… DO:** +```powershell +$computerSystem = Get-CimInstance -ClassName Win32_ComputerSystem +$adapters = Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration -Filter "IPEnabled = TRUE" +``` + +**โŒ DON'T:** +```powershell +$computerSystem = Get-WmiObject Win32_ComputerSystem # Deprecated +``` + +--- + +### 2. Explicit Error Handling + +**โœ… DO:** +```powershell +try { + Set-ItemProperty -Path $regPath -Name $valueName -Value $value -Type DWord -Force -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Registry value set successfully" -Module "YourModule" + return $true +} +catch { + Write-Log -Level ERROR -Message "Failed to set registry value: $_" -Module "YourModule" -Exception $_.Exception + return $false +} +``` + +**โŒ DON'T:** +```powershell +Set-ItemProperty -Path $regPath -Name $valueName -Value $value # No error handling! +``` + +--- + +### 3. Structured Returns + +**โœ… DO (for action functions):** +```powershell +function Set-YourFeature { + try { + # ... implementation ... + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed: $_" -Module "YourModule" + return $false + } +} +``` + +**โœ… DO (for test functions):** +```powershell +function Test-YourFeature { + try { + $result = [PSCustomObject]@{ + Feature = "Your Feature Name" + Status = "Secure" # or "Insecure" or "Partially Secure" + Details = @() + Compliant = $true # or $false + } + + # ... check settings ... + + if ($settingCorrect) { + $result.Details += "Setting is correct" + } else { + $result.Status = "Insecure" + $result.Compliant = $false + $result.Details += "Setting is incorrect!" + } + + return $result + } + catch { + Write-Log -Level ERROR -Message "Test failed: $_" -Module "YourModule" + return [PSCustomObject]@{ + Feature = "Your Feature Name" + Status = "Error" + Details = @("Failed to test: $_") + Compliant = $false + } + } +} +``` + +**โœ… DO (for main public function with scripting support):** +```powershell +function Invoke-YourModule { + try { + # ... apply all features ... + + # Return structured object + return [PSCustomObject]@{ + Success = $true + FeaturesApplied = $appliedFeatures + FeaturesFailed = $failedFeatures + TotalFeatures = $appliedFeatures.Count + $failedFeatures.Count + Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + } + } + catch { + return [PSCustomObject]@{ + Success = $false + ErrorMessage = $_.Exception.Message + Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + } + } +} +``` + +--- + +### 4. Validated Parameters + +**โœ… DO:** +```powershell +[CmdletBinding()] +param( + [Parameter(Mandatory = $false)] + [ValidateSet('Mode1', 'Mode2', 'Mode3')] + [string]$Mode = 'Mode1', + + [Parameter(Mandatory = $false)] + [switch]$Force +) +``` + +--- + +### 5. Comprehensive Help + +**โœ… DO:** +```powershell +function Set-YourFeature { + <# + .SYNOPSIS + Brief one-line description + + .DESCRIPTION + Detailed description of what the function does. + + Why this feature is important: + - Security benefit 1 + - Security benefit 2 + + Potential impact: + - Impact consideration 1 + - Impact consideration 2 + + .PARAMETER ParameterName + Description of parameter + + .EXAMPLE + Set-YourFeature + Basic usage + + .EXAMPLE + Set-YourFeature -Force + Force mode example + + .NOTES + Additional important information + References: Microsoft KB article, CVE, etc. + #> + [CmdletBinding()] + param(...) + + # Implementation +} +``` + +--- + +### 6. WhatIf Support for Destructive Operations + +**โœ… DO:** +```powershell +function Invoke-YourModule { + [CmdletBinding(SupportsShouldProcess=$true)] + param(...) + + if ($PSCmdlet.ShouldProcess("YourModule", "Apply hardening")) { + # Apply changes + } + else { + Write-Host "WhatIf mode - no changes applied" -ForegroundColor Yellow + return $true + } +} +``` + +**Usage:** +```powershell +Invoke-YourModule -WhatIf # Dry run +``` + +--- + +## ๐Ÿงช Testing & Verification + +### Pester Test Runner (Framework-Wide) + +```powershell +# 1) Test-Umgebung vorbereiten (einmalig) +.\Tests\Setup-TestEnvironment.ps1 + +# 2) Alle Tests (Unit + Integration + Validation) ausfรผhren +.\Tests\Run-Tests.ps1 + +# 3) Nur bestimmte Testtypen ausfรผhren +.\Tests\Run-Tests.ps1 -TestType Unit +.\Tests\Run-Tests.ps1 -TestType Integration +.\Tests\Run-Tests.ps1 -TestType Validation + +# 4) Mit Code Coverage +.\Tests\Run-Tests.ps1 -TestType All -CodeCoverage + +# Alternative: Einfacher Runner fรผr alle Tests +.\Tests\Run-AllTests.ps1 + +### Manual Testing Checklist + +1. **Clean Windows 11 VM** + ```powershell + # Check Windows version + winver # Should be 24H2 or 25H2 + + # Check PowerShell version + $PSVersionTable.PSVersion # Should be 5.1+ + ``` + +2. **Import Module** + ```powershell + Import-Module .\Modules\YourModule\YourModule.psd1 -Force -Verbose + ``` + +3. **Test Compliance (Before)** + ```powershell + $before = Test-YourModule + $before | Format-Table + ``` + +4. **Apply Hardening** + ```powershell + $result = Invoke-YourModule + $result + ``` + +5. **Test Compliance (After)** + ```powershell + $after = Test-YourModule + $after | Format-Table + + # Check improvement + $beforeCompliant = ($before | Where-Object { $_.Compliant }).Count + $afterCompliant = ($after | Where-Object { $_.Compliant }).Count + Write-Host "Before: $beforeCompliant compliant" + Write-Host "After: $afterCompliant compliant" + ``` + +6. **Test Restore** + ```powershell + Restore-YourModuleSettings + + $restored = Test-YourModule + $restored | Format-Table + ``` + +7. **Test WhatIf** + ```powershell + Invoke-YourModule -WhatIf + ``` + +### Automated Testing Template + +```powershell +# Test-YourModule-Integration.ps1 + +Describe "YourModule Integration Tests" { + BeforeAll { + Import-Module ".\Modules\YourModule\YourModule.psd1" -Force + } + + Context "Module Loading" { + It "Should export public functions" { + $commands = Get-Command -Module YourModule + $commands.Count | Should -Be 2 + $commands.Name | Should -Contain 'Invoke-YourModule' + $commands.Name | Should -Contain 'Test-YourModule' + } + } + + Context "Compliance Testing" { + It "Should return compliance results" { + $results = Test-YourModule + $results | Should -Not -BeNullOrEmpty + $results[0].PSObject.Properties.Name | Should -Contain 'Feature' + $results[0].PSObject.Properties.Name | Should -Contain 'Status' + $results[0].PSObject.Properties.Name | Should -Contain 'Compliant' + } + } + + Context "Application" { + It "Should apply hardening successfully" { + $result = Invoke-YourModule + $result.Success | Should -Be $true + $result.FeaturesApplied.Count | Should -BeGreaterThan 0 + } + } +} +``` + +--- + +## ๐ŸŽฏ Real-World Example: AdvancedSecurity Module + +The **AdvancedSecurity** module is the gold standard reference implementation. Study these files: + +### Key Files to Study + +1. **Manifest & Loader** + - `AdvancedSecurity.psd1` - Version, exports, metadata + - `AdvancedSecurity.psm1` - Function loading pattern + +2. **Feature Implementation** + - `Private/Enable-RdpNLA.ps1` - Registry modification with backup + - `Private/Disable-AdminShares.ps1` - Domain-aware safety checks + - `Private/Stop-RiskyServices.ps1` - Service management with dependencies + +3. **Testing** + - `Private/Test-RdpSecurity.ps1` - Compliance check pattern + - `Public/Test-AdvancedSecurity.ps1` - Test aggregation + +4. **Public Interface** + - `Public/Invoke-AdvancedSecurity.ps1` - Profile system, backup, structured returns + +5. **Backup/Restore** + - `Private/Backup-AdvancedSecuritySettings.ps1` - Comprehensive backup + - `Private/Restore-AdvancedSecuritySettings.ps1` - Full restore logic + +--- + +## ๐Ÿ“ Summary + +### Key Takeaways + +1. **Structure Matters** - Follow the Private/Public separation +2. **Always Backup** - Before ANY modification +3. **Log Everything** - Use Write-Log consistently +4. **Error Handling** - Try/Catch everywhere +5. **Explicit Returns** - $true/$false for actions, PSCustomObject for tests +6. **Modern PowerShell** - CIM instead of WMI +7. **User-Friendly** - Clear console output + structured data for scripts +8. **Test Thoroughly** - Clean VM, before/after, restore + +### Quick Start for New Module + +```powershell +# 1. Create structure +mkdir "Modules\YourModule\Private" +mkdir "Modules\YourModule\Public" +mkdir "Modules\YourModule\Config" + +# 2. Generate GUID +[guid]::NewGuid() + +# 3. Create manifest (use template above) +# 4. Create loader (use template above) +# 5. Implement Private functions (Set-*, Test-*, Backup-*, Restore-*) +# 6. Implement Public functions (Invoke-*, Test-*) +# 7. Update config.json +# 8. Update README.md +# 9. Test on clean VM +``` + +--- + +**Questions? Study AdvancedSecurity v2.2.0 - it's the reference implementation!** ๐ŸŽฏ diff --git a/Core/Config.ps1 b/Core/Config.ps1 new file mode 100644 index 0000000..2f0fd63 --- /dev/null +++ b/Core/Config.ps1 @@ -0,0 +1,466 @@ +<# +.SYNOPSIS + Configuration management for NoID Privacy Framework + +.DESCRIPTION + Handles loading, saving, and validating configuration settings + from JSON configuration files. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+ +#> + +# Global configuration object +$script:Config = $null + +function Initialize-Config { + <# + .SYNOPSIS + Initialize configuration system + + .PARAMETER ConfigPath + Path to configuration file (JSON) + + .PARAMETER CreateDefault + Create default configuration if file doesn't exist + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [string]$ConfigPath = (Join-Path $PSScriptRoot "..\config.json"), + + [Parameter(Mandatory = $false)] + [bool]$CreateDefault = $true + ) + + # Check if config file exists + if (-not (Test-Path -Path $ConfigPath)) { + if ($CreateDefault) { + Write-Log -Level INFO -Message "Configuration file not found, creating default" -Module "Config" + New-DefaultConfig -Path $ConfigPath + } + else { + throw "Configuration file not found: $ConfigPath" + } + } + + # Load configuration + try { + $configContent = Get-Content -Path $ConfigPath -Raw -Encoding UTF8 + $script:Config = $configContent | ConvertFrom-Json + + Write-Log -Level INFO -Message "Configuration loaded successfully" -Module "Config" + } + catch { + Write-Log -Level ERROR -Message "Failed to load configuration" -Module "Config" -Exception $_.Exception + throw + } + + # Validate configuration + if (-not (Test-ConfigValid)) { + throw "Configuration validation failed" + } +} + +function New-DefaultConfig { + <# + .SYNOPSIS + Create default configuration file + + .PARAMETER Path + Path where configuration file should be created + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$Path + ) + + $defaultConfig = @{ + version = "2.2.0" + modules = @{ + SecurityBaseline = @{ + enabled = $true + priority = 1 + status = "IMPLEMENTED" + } + ASR = @{ + enabled = $true + priority = 2 + status = "IMPLEMENTED" + } + DNS = @{ + enabled = $true + priority = 3 + provider = "" + status = "IMPLEMENTED" + } + Privacy = @{ + enabled = $true + priority = 4 + mode = "" + status = "IMPLEMENTED" + } + AntiAI = @{ + enabled = $true + priority = 5 + status = "IMPLEMENTED" + description = "Disable all Windows 11 AI features (Recall, Copilot, Paint AI, etc.)" + } + EdgeHardening = @{ + enabled = $true + priority = 6 + status = "IMPLEMENTED" + description = "Microsoft Edge v139 Security Baseline: 20 security policies including SmartScreen enforcement, site isolation, SSL/TLS hardening, extension blocklist, IE Mode restrictions, and Spectre mitigations. No LGPO.exe dependency." + version = "2.2.0" + baseline = "Edge v139" + policies = 20 + features = @{ + smartscreen_enforcement = $true + site_isolation = $true + ssl_error_blocking = $true + extension_blocklist = $true + ie_mode_restrictions = $true + spectre_mitigations = $true + application_encryption = $true + auth_scheme_restrictions = $true + } + } + AdvancedSecurity = @{ + enabled = $true + priority = 7 + status = "IMPLEMENTED" + description = "Advanced Security hardening beyond MS Baseline: RDP NLA/Disable, WDigest protection, Admin Shares disable, Risky ports/services, Legacy TLS disable, WPAD disable, PowerShell v2 removal, SRP .lnk protection, Windows Update (3 GUI settings), Finger Protocol block. Opt-in by design (use -SecurityProfile Balanced/Enterprise/Maximum)" + version = "2.2.0" + policies = 36 + features = @{ + rdp_hardening = $true + wdigest_protection = $true + admin_shares_disable = $true + risky_ports_closure = $true + risky_services_stop = $true + legacy_tls_disable = $true + wpad_disable = $true + powershell_v2_removal = $true + srp_lnk_protection = $true + windows_update_config = $true + finger_protocol_block = $true + } + profiles = @("Balanced", "Enterprise", "Maximum") + } + } + options = @{ + dryRun = $false + createBackup = $true + verboseLogging = $true + autoReboot = $false + } + } + + try { + $defaultConfig | ConvertTo-Json -Depth 10 | Set-Content -Path $Path -Encoding UTF8 | Out-Null + Write-Log -Level SUCCESS -Message "Default configuration created: $Path" -Module "Config" + } + catch { + Write-Log -Level ERROR -Message "Failed to create default configuration" -Module "Config" -Exception $_.Exception + throw + } +} + +function Test-ConfigValid { + <# + .SYNOPSIS + Validate configuration structure and values + + .OUTPUTS + Boolean indicating if configuration is valid + #> + [CmdletBinding()] + [OutputType([bool])] + param() + + if ($null -eq $script:Config) { + Write-Log -Level ERROR -Message "Configuration is null" -Module "Config" + return $false + } + + # Check required properties + $requiredProps = @('version', 'modules', 'options') + foreach ($prop in $requiredProps) { + if (-not (Get-Member -InputObject $script:Config -Name $prop -MemberType NoteProperty)) { + Write-Log -Level ERROR -Message "Missing required property: $prop" -Module "Config" + return $false + } + } + + # Validate modules + if ($null -eq $script:Config.modules) { + Write-Log -Level ERROR -Message "Modules configuration is missing" -Module "Config" + return $false + } + + # Validate each module configuration + foreach ($prop in $script:Config.modules.PSObject.Properties) { + $moduleName = $prop.Name + $moduleConfig = $prop.Value + + # Check required module properties + $requiredModuleProps = @('enabled', 'priority') + foreach ($moduleProp in $requiredModuleProps) { + if (-not (Get-Member -InputObject $moduleConfig -Name $moduleProp -MemberType NoteProperty)) { + Write-Log -Level ERROR -Message "Module '$moduleName' missing required property: $moduleProp" -Module "Config" + return $false + } + } + + # Validate property types + if ($moduleConfig.enabled -isnot [bool]) { + Write-Log -Level ERROR -Message "Module '$moduleName' property 'enabled' must be boolean" -Module "Config" + return $false + } + + if ($moduleConfig.priority -isnot [int] -and $moduleConfig.priority -isnot [long]) { + Write-Log -Level ERROR -Message "Module '$moduleName' property 'priority' must be integer" -Module "Config" + return $false + } + + # Module-specific validation + if ($moduleName -eq "DNS") { + # Validate DNS provider if specified + if (Get-Member -InputObject $moduleConfig -Name 'provider' -MemberType NoteProperty) { + $validProviders = @('Cloudflare', 'Quad9', 'AdGuard', '', 'KEEP') + + # Empty string means interactive selection + if ($moduleConfig.provider -eq '') { + Write-Log -Level DEBUG -Message "DNS provider not specified - will prompt user for selection" -Module "Config" + } + elseif ($moduleConfig.provider -eq 'KEEP') { + Write-Log -Level DEBUG -Message "DNS provider set to KEEP - will detect and preserve current provider" -Module "Config" + } + elseif ($validProviders -notcontains $moduleConfig.provider) { + Write-Log -Level ERROR -Message "DNS module has invalid provider: '$($moduleConfig.provider)'. Valid providers: $($validProviders -join ', ')" -Module "Config" + return $false + } + else { + Write-Log -Level DEBUG -Message "DNS provider validated: $($moduleConfig.provider)" -Module "Config" + } + } + else { + # Provider property missing - will prompt for selection + Write-Log -Level DEBUG -Message "DNS provider not specified - will prompt user for selection" -Module "Config" + } + } + + if ($moduleName -eq "Privacy") { + # Validate Privacy mode if specified + if (Get-Member -InputObject $moduleConfig -Name 'mode' -MemberType NoteProperty) { + $validModes = @('MSRecommended', 'Strict', 'Paranoid', '') + + # Empty string means interactive selection + if ($moduleConfig.mode -eq '') { + Write-Log -Level DEBUG -Message "Privacy mode not specified - will prompt user for selection" -Module "Config" + } + elseif ($validModes -notcontains $moduleConfig.mode) { + Write-Log -Level ERROR -Message "Privacy module has invalid mode: '$($moduleConfig.mode)'. Valid modes: $($validModes -join ', ')" -Module "Config" + return $false + } + else { + Write-Log -Level DEBUG -Message "Privacy mode validated: $($moduleConfig.mode)" -Module "Config" + } + } + else { + # Mode property missing - will prompt for selection + Write-Log -Level DEBUG -Message "Privacy mode not specified - will prompt user for selection" -Module "Config" + } + } + } + + # Validate options + if ($null -eq $script:Config.options) { + Write-Log -Level ERROR -Message "Options configuration is missing" -Module "Config" + return $false + } + + # Check required option properties + $requiredOptions = @('dryRun', 'createBackup', 'verboseLogging', 'autoReboot') + foreach ($option in $requiredOptions) { + if (-not (Get-Member -InputObject $script:Config.options -Name $option -MemberType NoteProperty)) { + Write-Log -Level ERROR -Message "Missing required option: $option" -Module "Config" + return $false + } + } + + Write-Log -Level INFO -Message "Configuration validation passed" -Module "Config" + return $true +} + +function Get-Config { + <# + .SYNOPSIS + Get current configuration object + + .OUTPUTS + Configuration object + #> + return $script:Config +} + +function Get-ModuleConfig { + <# + .SYNOPSIS + Get configuration for specific module + + .PARAMETER ModuleName + Name of the module + + .OUTPUTS + Module configuration object or $null if not found + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$ModuleName + ) + + if ($null -eq $script:Config -or $null -eq $script:Config.modules) { + Write-Log -Level WARNING -Message "Configuration not initialized" -Module "Config" + return $null + } + + $moduleConfig = $script:Config.modules | Get-Member -Name $ModuleName -MemberType NoteProperty + if ($null -eq $moduleConfig) { + Write-Log -Level WARNING -Message "Module configuration not found: $ModuleName" -Module "Config" + return $null + } + + return $script:Config.modules.$ModuleName +} + +function Test-ModuleAvailability { + <# + .SYNOPSIS + Check if a module is actually implemented and available + + .DESCRIPTION + Checks if module directory exists and contains the required .psd1 manifest file + + .PARAMETER ModuleName + Name of the module to check + + .OUTPUTS + Boolean - True if module is implemented, False otherwise + + .EXAMPLE + Test-ModuleAvailability -ModuleName "SecurityBaseline" + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [string]$ModuleName + ) + + # Get framework root (3 levels up from Config.ps1) + $frameworkRoot = Split-Path $PSScriptRoot -Parent + $modulePath = Join-Path $frameworkRoot "Modules\$ModuleName" + $manifestPath = Join-Path $modulePath "$ModuleName.psd1" + + # Check if module directory exists + if (-not (Test-Path $modulePath)) { + Write-Log -Level DEBUG -Message "Module directory not found: $modulePath" -Module "Config" + return $false + } + + # Check if module manifest exists + if (-not (Test-Path $manifestPath)) { + Write-Log -Level DEBUG -Message "Module manifest not found: $manifestPath" -Module "Config" + return $false + } + + Write-Log -Level DEBUG -Message "Module $ModuleName is available" -Module "Config" + return $true +} + +function Get-EnabledModules { + <# + .SYNOPSIS + Get list of enabled modules sorted by priority + + .DESCRIPTION + Returns only modules that are both enabled in config AND actually implemented + + .OUTPUTS + Array of enabled module names sorted by priority + #> + [CmdletBinding()] + [OutputType([string[]])] + param() + + if ($null -eq $script:Config -or $null -eq $script:Config.modules) { + Write-Log -Level WARNING -Message "Configuration not initialized" -Module "Config" + return @() + } + + $enabledModules = @() + + foreach ($prop in $script:Config.modules.PSObject.Properties) { + $moduleName = $prop.Name + $moduleConfig = $prop.Value + + if ($moduleConfig.enabled -eq $true) { + # Check if module is actually implemented + if (Test-ModuleAvailability -ModuleName $moduleName) { + $enabledModules += [PSCustomObject]@{ + Name = $moduleName + Priority = $moduleConfig.priority + } + } + else { + $status = if ($moduleConfig.PSObject.Properties.Name -contains 'status') { $moduleConfig.status } else { 'UNKNOWN' } + Write-Log -Level WARNING -Message "Module '$moduleName' is enabled in config but not implemented (Status: $status)" -Module "Config" + } + } + } + + # Sort by priority + $sorted = $enabledModules | Sort-Object -Property Priority + + return $sorted | ForEach-Object { $_.Name } +} + +function Set-ModuleEnabled { + <# + .SYNOPSIS + Enable or disable a module + + .PARAMETER ModuleName + Name of the module + + .PARAMETER Enabled + Enable (true) or disable (false) the module + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$ModuleName, + + [Parameter(Mandatory = $true)] + [bool]$Enabled + ) + + if ($null -eq $script:Config -or $null -eq $script:Config.modules) { + throw "Configuration not initialized" + } + + $moduleConfig = $script:Config.modules | Get-Member -Name $ModuleName -MemberType NoteProperty + if ($null -eq $moduleConfig) { + throw "Module not found: $ModuleName" + } + + $script:Config.modules.$ModuleName.enabled = $Enabled + Write-Log -Level INFO -Message "Module '$ModuleName' set to: $Enabled" -Module "Config" +} + +# Note: Export-ModuleMember not used - this script is dot-sourced, not imported as module diff --git a/Core/Framework.ps1 b/Core/Framework.ps1 new file mode 100644 index 0000000..b80c532 --- /dev/null +++ b/Core/Framework.ps1 @@ -0,0 +1,927 @@ +<# +.SYNOPSIS + Main orchestration engine for NoID Privacy Framework + +.DESCRIPTION + Core framework that orchestrates module execution, manages configuration, + logging, validation, and rollback functionality. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+ + +.EXAMPLE + .\Framework.ps1 -DryRun + Run in dry-run mode to preview changes + +.EXAMPLE + .\Framework.ps1 -ModulesOnly SecurityBaseline,ASR + Run only specific modules +#> + +# Note: This script is dot-sourced as a library, not called directly with parameters. +# All configuration comes from config.json via Initialize-Config. + +# Script-level variables +$script:FrameworkVersion = "2.2.0" +$script:FrameworkRoot = Split-Path -Parent $PSScriptRoot +$script:ExecutionStartTime = Get-Date + +# Import core and utility modules +$script:ModulesToLoad = @( + [PSCustomObject]@{ Path = "Core\Logger.ps1"; Name = "Logger" }, + [PSCustomObject]@{ Path = "Core\Config.ps1"; Name = "Config" }, + [PSCustomObject]@{ Path = "Core\Validator.ps1"; Name = "Validator" }, + [PSCustomObject]@{ Path = "Core\Rollback.ps1"; Name = "Rollback" }, + [PSCustomObject]@{ Path = "Core\NonInteractive.ps1"; Name = "NonInteractive" }, + [PSCustomObject]@{ Path = "Utils\Registry.ps1"; Name = "Registry Utils" }, + [PSCustomObject]@{ Path = "Utils\Service.ps1"; Name = "Service Utils" }, + [PSCustomObject]@{ Path = "Utils\Hardware.ps1"; Name = "Hardware Utils" }, + # NOTE: Utils\GPO.ps1 removed - v2.0 SecurityBaseline is self-contained, no LGPO.exe dependency + [PSCustomObject]@{ Path = "Utils\Localization.ps1"; Name = "Localization Utils" }, + [PSCustomObject]@{ Path = "Utils\Compatibility.ps1"; Name = "Compatibility Utils" }, + [PSCustomObject]@{ Path = "Utils\Dependencies.ps1"; Name = "Dependencies Utils" } +) + +Write-Host "NoID Privacy Framework v$script:FrameworkVersion" -ForegroundColor Cyan +Write-Host "========================================" -ForegroundColor Cyan +Write-Host "" + +foreach ($moduleInfo in $script:ModulesToLoad) { + $modulePath = Join-Path $script:FrameworkRoot $moduleInfo.Path + + if (Test-Path -Path $modulePath) { + try { + . $modulePath + Write-Host "[OK] Loaded: $($moduleInfo.Name)" -ForegroundColor Green + } + catch { + Write-Host "[ERROR] Failed to load: $($moduleInfo.Name)" -ForegroundColor Red + Write-Host "Error: $_" -ForegroundColor Red + exit 1 + } + } + else { + Write-Host "[ERROR] Module not found: $($moduleInfo.Name) ($modulePath)" -ForegroundColor Red + exit 1 + } +} + +Write-Host "" + +function Initialize-Framework { + <# + .SYNOPSIS + Initialize the framework and all subsystems + #> + [CmdletBinding()] + param() + + Write-Host "Initializing framework..." -ForegroundColor Cyan + + # Only initialize logger if not already initialized (NoIDPrivacy.ps1 may have already done it) + if ([string]::IsNullOrEmpty($global:LoggerConfig.LogFilePath)) { + $logLevel = if ($VerboseLogging) { [LogLevel]::DEBUG } else { [LogLevel]::INFO } + $logDirectory = Join-Path $script:FrameworkRoot "Logs" + Initialize-Logger -LogDirectory $logDirectory -MinimumLevel $logLevel + } + + Write-Log -Level INFO -Message "NoID Privacy Framework v$script:FrameworkVersion starting" -Module "Framework" + Write-Log -Level INFO -Message "PowerShell version: $($PSVersionTable.PSVersion)" -Module "Framework" + + # Load configuration + if ($ConfigPath) { + Initialize-Config -ConfigPath $ConfigPath + } + else { + Initialize-Config + } + + # Initialize backup system + if (-not $SkipBackup) { + Initialize-BackupSystem + + # Create system restore point + Write-Host "Creating system restore point..." -ForegroundColor Yellow + $restorePointCreated = New-SystemRestorePoint + + if (-not $restorePointCreated) { + Write-Log -Level WARNING -Message "System restore point creation failed or unavailable" -Module "Framework" + } + } + else { + Write-Log -Level WARNING -Message "Backup system SKIPPED (not recommended)" -Module "Framework" + } + + Write-Host "" +} + +function Test-FrameworkPrerequisites { + <# + .SYNOPSIS + Validate all prerequisites before execution + + .OUTPUTS + Boolean indicating if prerequisites are met + #> + [CmdletBinding()] + [OutputType([bool])] + param() + + Write-Host "Validating system prerequisites..." -ForegroundColor Cyan + Write-Host "" + + $prereqsPassed = Test-Prerequisites + + if (-not $prereqsPassed.Success) { + Write-Log -Level ERROR -Message "Prerequisite validation failed" -Module "Framework" + Write-Host "" + Write-Host "PREREQUISITE CHECK FAILED" -ForegroundColor Red + Write-Host "Please resolve the issues above before continuing." -ForegroundColor Red + return $false + } + + Write-Host "" + Write-Host "All basic prerequisite checks passed" -ForegroundColor Green + Write-Host "" + + # Check if system is domain-joined (interactive warning only in CLI mode) + Write-Host "Checking domain status..." -ForegroundColor Cyan + if (Test-NonInteractiveMode) { + # GUI mode - just check, don't prompt + $null = Test-DomainJoined + } + else { + # CLI mode - show interactive warning + $null = Test-DomainJoined -Interactive + } + Write-Host "" + + # Confirm system backup exists (interactive prompt only in CLI mode) + Write-Host "Verifying system backup..." -ForegroundColor Cyan + if (Test-NonInteractiveMode) { + # GUI mode - auto-confirm (backup is created by engine) + Write-Host "[GUI] Backup verification: Auto-confirmed" -ForegroundColor Cyan + $backupStatus = [PSCustomObject]@{ UserConfirmed = $true } + } + else { + # CLI mode - interactive prompt + $backupStatus = Confirm-SystemBackup + } + + if (-not $backupStatus.UserConfirmed) { + Write-Log -Level ERROR -Message "System backup confirmation failed" -Module "Framework" + return $false + } + + Write-Host "" + Write-Host "All prerequisite checks completed successfully" -ForegroundColor Green + Write-Host "" + + return $true +} + +function Get-ModulesToExecute { + <# + .SYNOPSIS + Determine which modules should be executed + + .OUTPUTS + Array of module names to execute + #> + [CmdletBinding()] + [OutputType([string[]])] + param() + + if ($ModulesOnly -and $ModulesOnly.Count -gt 0) { + Write-Log -Level INFO -Message "Running specific modules: $($ModulesOnly -join ', ')" -Module "Framework" + return $ModulesOnly + } + else { + $enabledModules = Get-EnabledModules + Write-Log -Level INFO -Message "Running all enabled modules: $($enabledModules -join ', ')" -Module "Framework" + return $enabledModules + } +} + +# NOTE: Invoke-HardeningModule has been removed. +# Use Invoke-Hardening instead for module execution. + +function Start-HardeningProcess { + <# + .SYNOPSIS + Main execution entry point + #> + [CmdletBinding()] + param() + + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "STARTING HARDENING PROCESS" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + + if ($DryRun) { + Write-Host "MODE: DRY RUN (Preview only)" -ForegroundColor Yellow + Write-Log -Level WARNING -Message "Running in DRY RUN mode - no changes will be applied" -Module "Framework" + } + else { + Write-Host "MODE: APPLY CHANGES" -ForegroundColor Green + Write-Log -Level INFO -Message "Running in APPLY mode - changes will be applied" -Module "Framework" + } + + Write-Host "" + + # Get modules to execute + $modulesToRun = Get-ModulesToExecute + + if ($modulesToRun.Count -eq 0) { + Write-Log -Level WARNING -Message "No modules enabled for execution" -Module "Framework" + Write-Host "No modules to execute. Check your configuration." -ForegroundColor Yellow + return + } + + Write-Host "Modules to execute: $($modulesToRun.Count)" -ForegroundColor Cyan + foreach ($mod in $modulesToRun) { + Write-Host " - $mod" -ForegroundColor White + } + Write-Host "" + + # Confirmation prompt (unless in dry run or NonInteractive mode) + if (-not $DryRun -and -not (Test-NonInteractiveMode)) { + Write-Host "WARNING: This will modify your system settings." -ForegroundColor Yellow + Write-Host "A backup and restore point have been created." -ForegroundColor Yellow + Write-Host "" + + do { + $confirmation = Read-Host "Do you want to continue? [Y/N] (default: Y)" + if ([string]::IsNullOrWhiteSpace($confirmation)) { $confirmation = "Y" } + $confirmation = $confirmation.ToUpper() + + if ($confirmation -notin @('Y', 'N')) { + Write-Host "" + Write-Host "Invalid input. Please enter Y or N." -ForegroundColor Red + Write-Host "" + } + } while ($confirmation -notin @('Y', 'N')) + + if ($confirmation -ne "Y") { + Write-Log -Level INFO -Message "Execution cancelled by user" -Module "Framework" + Write-Host "" + Write-Host "Execution cancelled." -ForegroundColor Yellow + Write-Host "" + return + } + + Write-Host "" + } + elseif (Test-NonInteractiveMode) { + Write-NonInteractiveDecision -Module "Framework" -Decision "Auto-confirming execution (GUI mode)" + } + + # Execute modules using Invoke-Hardening + Write-Log -Level INFO -Message "Starting module execution: $($modulesToRun -join ', ')" -Module "Framework" + + # Determine correct module parameter based on what user selected + if ($modulesToRun.Count -eq 1) { + $hardeningResult = Invoke-Hardening -Module $modulesToRun[0] -DryRun:$DryRun + } + else { + $hardeningResult = Invoke-Hardening -Module "All" -DryRun:$DryRun + } + + # Summary (correctly use hardeningResult.ModuleResults) + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "EXECUTION SUMMARY" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + + $totalDuration = (Get-Date) - $script:ExecutionStartTime + + # Correct calculation from ModuleResults + $totalModules = $hardeningResult.ModulesExecuted + $successCount = ($hardeningResult.ModuleResults | Where-Object { $_.Success }).Count + $failureCount = $totalModules - $successCount + + Write-Host "Total modules executed: $totalModules" -ForegroundColor White + Write-Host "Successful: $successCount" -ForegroundColor Green + Write-Host "Failed: $failureCount" -ForegroundColor $(if ($failureCount -gt 0) { "Red" } else { "White" }) + Write-Host "Total duration: $([math]::Round($totalDuration.TotalMinutes, 2)) minutes" -ForegroundColor White + + if ($hardeningResult.Warnings.Count -gt 0) { + Write-Host "Warnings: $($hardeningResult.Warnings.Count)" -ForegroundColor Yellow + } + if ($hardeningResult.Errors.Count -gt 0) { + Write-Host "Errors: $($hardeningResult.Errors.Count)" -ForegroundColor Red + } + + Write-Host "" + + Write-Log -Level INFO -Message "Hardening process completed" -Module "Framework" + Write-Log -Level INFO -Message "Log file: $(Get-LogFilePath)" -Module "Framework" + + Write-Host "Log file: $(Get-LogFilePath)" -ForegroundColor Cyan + Write-Host "" + + # Reboot recommendation + if (-not $DryRun -and $successCount -gt 0) { + Write-Host "RECOMMENDATION: Restart your computer for all changes to take effect." -ForegroundColor Yellow + Write-Host "" + } +} + +function Invoke-Hardening { + <# + .SYNOPSIS + Execute hardening module(s) + + .PARAMETER Module + Module name to execute (SecurityBaseline, ASR, DNS, etc.) or "All" + + .PARAMETER DryRun + Preview changes without applying them + + .OUTPUTS + PSCustomObject with execution results + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param( + [Parameter(Mandatory = $true)] + [ValidateSet("SecurityBaseline", "ASR", "DNS", "Privacy", "AntiAI", "EdgeHardening", "AdvancedSecurity", "All")] + [string]$Module, + + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + $startTime = Get-Date + $results = [PSCustomObject]@{ + Success = $true + ModulesExecuted = 0 + Duration = $null + Errors = @() + Warnings = @() + ModuleResults = @() + } + + # Get module list to execute + $modulesToExecute = @() + + if ($Module -eq "All") { + # Get all enabled modules from config (sorted by priority) + $modulesToExecute = Get-EnabledModules + } + else { + # Single module - check if it's enabled in config + $moduleConfig = $script:Config.modules.$Module + + if ($null -eq $moduleConfig) { + Write-Log -Level WARNING -Message "Module '$Module' not found in configuration" -Module "Framework" + $results.Warnings += "Module '$Module' not configured" + return $results + } + + if ($moduleConfig.enabled -eq $false) { + Write-Log -Level INFO -Message "Module '$Module' is disabled in configuration - skipping" -Module "Framework" + Write-Host "Module '$Module' is disabled - skipping execution" -ForegroundColor Gray + return $results + } + + $modulesToExecute = @($Module) + } + + Write-Log -Level INFO -Message "Executing modules: $($modulesToExecute -join ', ')" -Module "Framework" + + # Initialize backup system ONCE before all modules + if (-not $DryRun) { + try { + Initialize-BackupSystem + Write-Log -Level INFO -Message "Backup session initialized for all modules" -Module "Framework" + + # Set session type from GUI config (for backup identification) + # SessionType is in options block when sent from GUI + if ($script:Config.options -and $script:Config.options.PSObject.Properties.Name -contains 'sessionType' -and $script:Config.options.sessionType) { + Set-SessionType -SessionType $script:Config.options.sessionType + Write-Log -Level DEBUG -Message "Session type from GUI config: $($script:Config.options.sessionType)" -Module "Framework" + } + else { + # CLI mode: Auto-detect session type based on module count + $autoSessionType = if ($modulesToExecute.Count -ge 7) { "wizard" } + elseif ($modulesToExecute.Count -eq 1) { "advanced" } + else { "manual" } + Set-SessionType -SessionType $autoSessionType + Write-Log -Level DEBUG -Message "Session type auto-detected: $autoSessionType (based on $($modulesToExecute.Count) modules)" -Module "Framework" + } + + # Create Pre-Framework Snapshot for ASR Rules (shared resource conflict prevention) + # Only when: Multi-module apply AND ASR module is in the list + # Why: SecurityBaseline sets 15 ASR rules, then ASR sets 19 rules + # We need to capture the ORIGINAL state before ANY module touches ASR + if ($modulesToExecute.Count -gt 1 -and $modulesToExecute -contains "ASR") { + Write-Log -Level INFO -Message "Creating Pre-Framework ASR snapshot (multi-module apply with ASR detected)" -Module "Framework" + + try { + $sessionPath = $global:BackupBasePath + $mpPref = Get-MpPreference -ErrorAction SilentlyContinue + + if (-not $mpPref) { + Write-Log -Level INFO -Message "Pre-Framework ASR snapshot skipped: Get-MpPreference returned no data (Defender/ASR not available)." -Module "Framework" + } + else { + $hasIdsProp = $mpPref.PSObject.Properties.Match('AttackSurfaceReductionRules_Ids').Count -gt 0 + $hasActionsProp = $mpPref.PSObject.Properties.Match('AttackSurfaceReductionRules_Actions').Count -gt 0 + + if (-not $hasIdsProp -and -not $hasActionsProp) { + Write-Log -Level INFO -Message "Pre-Framework ASR snapshot skipped: ASR rule properties not present (third-party AV or Defender ASR disabled)." -Module "Framework" + } + else { + $ruleIds = @() + $ruleActions = @() + + if ($hasIdsProp -and $mpPref.AttackSurfaceReductionRules_Ids) { + $ruleIds = @($mpPref.AttackSurfaceReductionRules_Ids) + } + + if ($hasActionsProp -and $mpPref.AttackSurfaceReductionRules_Actions) { + $ruleActions = @($mpPref.AttackSurfaceReductionRules_Actions) + } + + $ruleCount = $ruleIds.Count + + $preFrameworkSnapshot = @{ + ASR = @{ + RuleIds = $ruleIds + RuleActions = $ruleActions + SnapshotDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + RuleCount = $ruleCount + } + AppliesTo = @("ASR") # Only apply this snapshot if ASR module is being restored + } + + $snapshotPath = Join-Path $sessionPath "PreFramework_Snapshot.json" + $preFrameworkSnapshot | ConvertTo-Json -Depth 10 | Out-File $snapshotPath -Encoding UTF8 + Write-Log -Level SUCCESS -Message "Pre-Framework snapshot saved: $ruleCount ASR rules captured (original system state)" -Module "Framework" + } + } + } + catch { + Write-Log -Level WARNING -Message "Failed to create Pre-Framework snapshot (non-critical): $_" -Module "Framework" + } + } + } + catch { + Write-ErrorLog -Message "Failed to initialize backup system" -Module "Framework" -ErrorRecord $_ + $warnMsg = "Backup system initialization failed - proceeding without automatic backup" + $results.Warnings += $warnMsg + } + } + + # Execute each module + foreach ($moduleName in $modulesToExecute) { + try { + Write-Log -Level INFO -Message "========================================" -Module "Framework" + Write-Log -Level INFO -Message "Module: $moduleName" -Module "Framework" + Write-Log -Level INFO -Message "========================================" -Module "Framework" + + # Module Confirmation Prompt for interactive CLI runs. + # Skipped in DryRun and in NonInteractive/GUI mode. + if (-not $DryRun -and -not (Test-NonInteractiveMode)) { + Write-Host "" + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " MODULE: $moduleName" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + + # Module-specific description + switch ($moduleName) { + "SecurityBaseline" { + Write-Host "Microsoft Security Baseline for Windows 11 25H2" -ForegroundColor White + Write-Host "" + Write-Host " > Applies 425 hardening settings:" -ForegroundColor Gray + Write-Host " - 335 Registry policies (password, firewall, BitLocker)" -ForegroundColor Gray + Write-Host " - 67 Security template settings (user rights, audit)" -ForegroundColor Gray + Write-Host " - 23 Advanced audit policies" -ForegroundColor Gray + Write-Host " - VBS + Credential Guard + Memory Integrity" -ForegroundColor Gray + Write-Host "" + Write-Host " Impact: Enterprise-grade security, may break legacy software" -ForegroundColor Yellow + } + "ASR" { + Write-Host "Attack Surface Reduction Rules" -ForegroundColor White + Write-Host "" + Write-Host " > Applies 19 Microsoft Defender ASR rules:" -ForegroundColor Gray + Write-Host " - Block ransomware, exploits, malicious scripts" -ForegroundColor Gray + Write-Host " - Block credential theft (lsass.exe protection)" -ForegroundColor Gray + Write-Host " - Block Office macros, email executables" -ForegroundColor Gray + Write-Host " - Block untrusted USB execution, Safe Mode reboot" -ForegroundColor Gray + Write-Host "" + Write-Host " Note: You'll be asked about SCCM/Intune usage" -ForegroundColor Yellow + } + "DNS" { + Write-Host "Secure DNS with DNS-over-HTTPS" -ForegroundColor White + Write-Host "" + Write-Host " > Configures encrypted DNS:" -ForegroundColor Gray + Write-Host " - Choose provider: Cloudflare, Quad9, or AdGuard" -ForegroundColor Gray + Write-Host " - Enable DoH encryption (HTTPS)" -ForegroundColor Gray + Write-Host " - Blocks DNS hijacking and snooping" -ForegroundColor Gray + Write-Host " - IPv4 + IPv6 configuration" -ForegroundColor Gray + Write-Host "" + Write-Host " Note: You'll choose provider and DoH mode interactively" -ForegroundColor Yellow + } + "Privacy" { + Write-Host "Telemetry & Privacy Hardening" -ForegroundColor White + Write-Host "" + Write-Host " > Applies privacy settings based on selected mode:" -ForegroundColor Gray + Write-Host " - Telemetry control (3 modes: MSRecommended/Strict/Paranoid)" -ForegroundColor Gray + Write-Host " - MSRecommended: 37 settings (default, max compatibility)" -ForegroundColor DarkGray + Write-Host " - Strict/Paranoid: 37-40 settings + services disabled" -ForegroundColor DarkGray + Write-Host " - Disable ads, tips, personalization" -ForegroundColor Gray + Write-Host " - Remove bloatware (up to 24 apps, if present)" -ForegroundColor Gray + Write-Host " - OneDrive hardening (keeps sync functional)" -ForegroundColor Gray + Write-Host "" + Write-Host " Note: You'll choose privacy mode interactively" -ForegroundColor Yellow + } + "AntiAI" { + Write-Host "Disable Windows 11 AI Features" -ForegroundColor White + Write-Host "" + Write-Host " > Disables 13 features via 32 policies:" -ForegroundColor Gray + Write-Host " - Windows Recall + Export Block" -ForegroundColor Gray + Write-Host " - Windows Copilot (app + URI handlers + Edge sidebar)" -ForegroundColor Gray + Write-Host " - Click to Do, Explorer AI Actions" -ForegroundColor Gray + Write-Host " - Paint AI (3), Notepad AI, Settings Agent" -ForegroundColor Gray + Write-Host "" + Write-Host " Impact: All AI features disabled, reboot required" -ForegroundColor Yellow + } + "EdgeHardening" { + Write-Host "Microsoft Edge v139 Security Baseline" -ForegroundColor White + Write-Host "" + Write-Host " > Applies Edge security policies:" -ForegroundColor Gray + Write-Host " - Enhanced Security Mode, SmartScreen + PUA" -ForegroundColor Gray + Write-Host " - Site Isolation + SSL/TLS hardening" -ForegroundColor Gray + Write-Host " - Tracking Prevention + Privacy settings" -ForegroundColor Gray + Write-Host " - Extension blocklist (blocks all by default)" -ForegroundColor Gray + Write-Host "" + Write-Host " Impact: Maximum Edge security, extensions blocked by default" -ForegroundColor Yellow + } + "AdvancedSecurity" { + Write-Host "Advanced Security Hardening (Beyond MS Baseline)" -ForegroundColor White + Write-Host "" + Write-Host " > Applies 15 security features (50 individual settings):" -ForegroundColor Gray + Write-Host " - RDP hardening + optional complete disable" -ForegroundColor Gray + Write-Host " - WDigest credential protection" -ForegroundColor Gray + Write-Host " - Admin Shares disable (domain-aware)" -ForegroundColor Gray + Write-Host " - Risky ports/services block (LLMNR, NetBIOS, UPnP)" -ForegroundColor Gray + Write-Host " - Legacy TLS 1.0/1.1 disable, WPAD disable, PSv2 removal" -ForegroundColor Gray + Write-Host " - SRP .lnk protection (CVE-2025-9491)" -ForegroundColor Gray + Write-Host " - Windows Update (3 simple GUI settings)" -ForegroundColor Gray + Write-Host " - Wireless Display (Miracast) security" -ForegroundColor Gray + Write-Host "" + Write-Host " Note: You'll choose profile (Balanced/Enterprise/Maximum)" -ForegroundColor Yellow + } + default { + Write-Host "This module will apply changes to your system." -ForegroundColor White + Write-Host "" + } + } + + Write-Host "" + Write-Host "Options:" -ForegroundColor White + Write-Host " [Y] Yes - Apply this module" -ForegroundColor Green + Write-Host " [N] No - Skip this module" -ForegroundColor Yellow + Write-Host " [A] Abort - Stop entire process" -ForegroundColor Red + Write-Host "" + + do { + $response = Read-Host "Continue with ${moduleName}? [Y/N/A] (default: Y)" + if ([string]::IsNullOrWhiteSpace($response)) { $response = "Y" } + $response = $response.ToUpper() + } while ($response -notin @('Y', 'N', 'A', 'YES', 'NO', 'ABORT')) + + if ($response -in @('A', 'ABORT')) { + Write-Log -Level WARNING -Message "User aborted execution at module: $moduleName" -Module "Framework" + Write-Host "" + Write-Host "Execution aborted by user" -ForegroundColor Red + Write-Host "" + $results.Warnings += "Execution aborted by user at module: $moduleName" + break + } + elseif ($response -in @('N', 'NO')) { + Write-Log -Level INFO -Message "User skipped module: $moduleName" -Module "Framework" + Write-Host "" + Write-Host "Skipping module: $moduleName" -ForegroundColor Yellow + Write-Host "" + continue + } + + Write-Host "" + Write-Host "Proceeding with $moduleName..." -ForegroundColor Green + Write-Host "" + } + + $moduleResult = $null + $modulePath = Join-Path $script:FrameworkRoot "Modules\$moduleName" + + # Check if module exists + if (-not (Test-Path $modulePath)) { + $errMsg = "Module not found: $moduleName (Path: $modulePath)" + Write-Log -Level WARNING -Message $errMsg -Module "Framework" + $results.Warnings += $errMsg + continue + } + + # Check module implementation status (FIX #2) + $moduleConfig = $script:Config.modules.$moduleName + if ($moduleConfig.PSObject.Properties.Name -contains 'status') { + if ($moduleConfig.status -ne 'IMPLEMENTED') { + Write-Log -Level WARNING -Message "Skipping module '$moduleName' - Status: $($moduleConfig.status) (not IMPLEMENTED)" -Module "Framework" + Write-Host " [SKIP] $moduleName - Not yet implemented" -ForegroundColor Yellow + continue + } + } + + # Load and execute module based on name + switch ($moduleName) { + "SecurityBaseline" { + $manifestPath = Join-Path $modulePath "SecurityBaseline.psd1" + if (Test-Path $manifestPath) { + if (-not (Get-Module -Name $moduleName)) { + Import-Module $manifestPath -ErrorAction Stop + } + $moduleResult = Invoke-SecurityBaseline -DryRun:$DryRun + } + else { + throw "Module manifest not found: $manifestPath" + } + } + + "ASR" { + $manifestPath = Join-Path $modulePath "ASR.psd1" + if (Test-Path $manifestPath) { + if (-not (Get-Module -Name $moduleName)) { + Import-Module $manifestPath -ErrorAction Stop + } + $moduleResult = Invoke-ASRRules -DryRun:$DryRun + } + else { + throw "Module manifest not found: $manifestPath" + } + } + + "DNS" { + $manifestPath = Join-Path $modulePath "DNS.psd1" + if (Test-Path $manifestPath) { + if (-not (Get-Module -Name $moduleName)) { + Import-Module $manifestPath -ErrorAction Stop + } + + # DNS module handles provider selection + # ONLY pass config values in NonInteractive mode (GUI) + # In interactive mode, let the module prompt the user! + if (Test-NonInteractiveMode) { + # GUI mode - use config values + $moduleResult = Invoke-DNSConfiguration -Provider $script:Config.modules.DNS.provider -DryRun:$DryRun + } + else { + # Interactive CLI mode - module will ask for provider and DoH mode + $moduleResult = Invoke-DNSConfiguration -DryRun:$DryRun + } + + } + else { + throw "Module manifest not found: $manifestPath" + } + } + + "Privacy" { + $manifestPath = Join-Path $modulePath "Privacy.psd1" + if (Test-Path $manifestPath) { + if (-not (Get-Module -Name $moduleName)) { + Import-Module $manifestPath -ErrorAction Stop + } + + # Privacy module handles mode selection + # ONLY pass config values in NonInteractive mode (GUI) + if (Test-NonInteractiveMode) { + # GUI mode - use config values + $privacyArgs = @{ DryRun = $DryRun } + + if ($script:Config.modules.Privacy.PSObject.Properties.Name -contains 'mode' -and $script:Config.modules.Privacy.mode) { + Write-Log -Level INFO -Message "Privacy mode: $($script:Config.modules.Privacy.mode)" -Module "Framework" + $privacyArgs["Mode"] = $script:Config.modules.Privacy.mode + } + + if ($script:Config.modules.Privacy.PSObject.Properties.Name -contains 'removeBloatware') { + $rb = $script:Config.modules.Privacy.removeBloatware + if ($rb -is [string]) { + $rb = ($rb -eq "Y" -or $rb -eq "yes" -or $rb -eq "true" -or $rb -eq "1") + } + Write-Log -Level INFO -Message "Privacy removeBloatware: $rb" -Module "Framework" + $privacyArgs["RemoveBloatware"] = $rb + } + + $moduleResult = Invoke-PrivacyHardening @privacyArgs + } + else { + # Interactive CLI mode - module will ask for mode selection + $moduleResult = Invoke-PrivacyHardening -DryRun:$DryRun + } + + } + else { + throw "Module manifest not found: $manifestPath" + } + } + + "AntiAI" { + $manifestPath = Join-Path $modulePath "AntiAI.psd1" + if (Test-Path $manifestPath) { + if (-not (Get-Module -Name $moduleName)) { + Import-Module $manifestPath -ErrorAction Stop + } + + # AntiAI module applies maximum AI deactivation (no modes) + Write-Log -Level INFO -Message "Disabling all Windows 11 AI features (13 features, 32 policies)" -Module "Framework" + $moduleResult = Invoke-AntiAI -DryRun:$DryRun + + } + else { + throw "Module manifest not found: $manifestPath" + } + } + + "EdgeHardening" { + $manifestPath = Join-Path $modulePath "EdgeHardening.psd1" + if (Test-Path $manifestPath) { + if (-not (Get-Module -Name $moduleName)) { + Import-Module $manifestPath -ErrorAction Stop + } + + # EdgeHardening applies Microsoft Edge security baseline + Write-Log -Level INFO -Message "Applying Microsoft Edge v139 Security Baseline (24 policies)" -Module "Framework" + $moduleResult = Invoke-EdgeHardening -DryRun:$DryRun + + } + else { + throw "Module manifest not found: $manifestPath" + } + } + + "AdvancedSecurity" { + $manifestPath = Join-Path $modulePath "AdvancedSecurity.psd1" + if (Test-Path $manifestPath) { + if (-not (Get-Module -Name $moduleName)) { + Import-Module $manifestPath -ErrorAction Stop + } + + # AdvancedSecurity handles profile selection + # ONLY pass config values in NonInteractive mode (GUI) + if (Test-NonInteractiveMode) { + # GUI mode - use config values (securityProfile) + $secProfile = $script:Config.modules.AdvancedSecurity.securityProfile + if ($secProfile) { + Write-Log -Level INFO -Message "AdvancedSecurity profile: $secProfile" -Module "Framework" + $moduleResult = Invoke-AdvancedSecurity -SecurityProfile $secProfile -DryRun:$DryRun + } + else { + $moduleResult = Invoke-AdvancedSecurity -DryRun:$DryRun + } + } + else { + # Interactive CLI mode - module will ask for profile + $moduleResult = Invoke-AdvancedSecurity -DryRun:$DryRun + } + + } + else { + throw "Module manifest not found: $manifestPath" + } + } + + default { + $warnMsg = "Module '$moduleName' is not yet implemented" + Write-Log -Level WARNING -Message $warnMsg -Module "Framework" + $results.Warnings += $warnMsg + continue + } + } + + # Store module result + if ($moduleResult) { + # If module returned an array, use the last element as the actual result + # (handles cases where helper functions inadvertently output to pipeline) + if ($moduleResult -is [array]) { + Write-Log -Level DEBUG -Message "Module '$moduleName' returned array ($($moduleResult.Count) items), using last element as result object" -Module "Framework" + $moduleResult = $moduleResult[-1] + } + + $results.ModuleResults += $moduleResult + $results.ModulesExecuted++ + + # Handle different return types: Boolean or PSCustomObject + $success = $false + + if ($moduleResult -is [bool]) { + # Module returned simple boolean (e.g., Privacy module) + $success = $moduleResult + } + elseif ($moduleResult -is [PSCustomObject]) { + # Module returned object with Success property (e.g., ASR, DNS modules) + $hasSuccess = $null -ne ($moduleResult.PSObject.Properties | Where-Object { $_.Name -eq 'Success' }) + $success = if ($hasSuccess) { $moduleResult.Success } else { $false } + } + else { + # Unknown type - assume failure + Write-Log -Level WARNING -Message "Module '$moduleName' returned unexpected type: $($moduleResult.GetType().Name)" -Module "Framework" + } + + if ($success) { + Write-Log -Level SUCCESS -Message "Module '$moduleName' completed successfully" -Module "Framework" + } + else { + Write-Log -Level WARNING -Message "Module '$moduleName' completed with errors" -Module "Framework" + + # Only add errors if moduleResult is an object with Errors property + if ($moduleResult -is [PSCustomObject]) { + $hasErrors = $null -ne ($moduleResult.PSObject.Properties | Where-Object { $_.Name -eq 'Errors' }) + if ($hasErrors -and $moduleResult.Errors.Count -gt 0) { + $results.Errors += $moduleResult.Errors + } + } + } + + # Always collect warnings from modules (regardless of success) + # Warnings are informational (e.g., "rule set to AUDIT mode") - not errors + if ($moduleResult -is [PSCustomObject]) { + $hasWarnings = $null -ne ($moduleResult.PSObject.Properties | Where-Object { $_.Name -eq 'Warnings' }) + if ($hasWarnings -and $moduleResult.Warnings.Count -gt 0) { + $results.Warnings += $moduleResult.Warnings + } + } + } + } + catch { + Write-ErrorLog -Message "Failed to execute module '$moduleName'" -Module "Framework" -ErrorRecord $_ + $errMsg = "Module '$moduleName' execution failed: $($_.Exception.Message)" + $results.Errors += $errMsg + $results.Success = $false + } + } + + # Calculate duration + $results.Duration = (Get-Date) - $startTime + + # Final success status + if ($results.Errors.Count -gt 0) { + $results.Success = $false + } + + # Update session display name for backup identification (after all modules complete) + if (-not $DryRun) { + try { + Update-SessionDisplayName + } + catch { + Write-Log -Level WARNING -Message "Failed to update session display name: $_" -Module "Framework" + } + } + + Write-Log -Level INFO -Message "Hardening execution completed - Modules: $($results.ModulesExecuted), Errors: $($results.Errors.Count), Warnings: $($results.Warnings.Count)" -Module "Framework" + + return $results +} + +# Note: Export-ModuleMember not used - this script is dot-sourced, not imported as module + +# Main execution (only if script is run directly, not dot-sourced) +# This allows Framework.ps1 to be used standalone OR dot-sourced by NoIDPrivacy.ps1 +if ($MyInvocation.InvocationName -ne '.' -and $MyInvocation.Line -notmatch '^\s*\.\s+') { + try { + Initialize-Framework + + $prereqsPassed = Test-FrameworkPrerequisites + + if ($prereqsPassed) { + Start-HardeningProcess + } + else { + Write-Host "Execution aborted due to failed prerequisites." -ForegroundColor Red + exit 1 + } + } + catch { + Write-Host "" + Write-Host "CRITICAL ERROR" -ForegroundColor Red + Write-Host "An unexpected error occurred:" -ForegroundColor Red + Write-Host $_.Exception.Message -ForegroundColor Red + Write-Host "" + Write-Host "Stack trace:" -ForegroundColor Gray + Write-Host $_.ScriptStackTrace -ForegroundColor Gray + + if ($null -ne (Get-Command Write-Log -ErrorAction SilentlyContinue)) { + Write-Log -Level ERROR -Message "Critical framework error" -Module "Framework" -Exception $_.Exception + } + + exit 1 + } +} diff --git a/Core/Logger.ps1 b/Core/Logger.ps1 new file mode 100644 index 0000000..f0d31d6 --- /dev/null +++ b/Core/Logger.ps1 @@ -0,0 +1,366 @@ +<# +.SYNOPSIS + Unified logging system for NoID Privacy Framework + +.DESCRIPTION + Provides centralized logging functionality with multiple severity levels, + file output, and optional console output with color coding. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+ +#> + +# Log severity levels +enum LogLevel { + DEBUG = 0 + INFO = 1 + WARNING = 2 + ERROR = 3 + SUCCESS = 4 +} + +# Global logger configuration - MUST be $global: for cross-module session sharing +# Using $script: would create separate log files per Import-Module call! +# NOTE: Must use Get-Variable to check existence (direct access fails in Strict Mode) +if (-not (Get-Variable -Name 'LoggerConfig' -Scope Global -ErrorAction SilentlyContinue)) { + $global:LoggerConfig = @{ + LogFilePath = "" + MinimumLevel = [LogLevel]::INFO + EnableConsole = $true + EnableFile = $true + TimestampFormat = "yyyy-MM-dd HH:mm:ss" + } +} + +function Initialize-Logger { + <# + .SYNOPSIS + Initialize the logging system + + .PARAMETER LogDirectory + Directory path for log files + + .PARAMETER MinimumLevel + Minimum log level to record (DEBUG, INFO, WARNING, ERROR, SUCCESS) + + .PARAMETER EnableConsole + Enable console output + + .PARAMETER EnableFile + Enable file output + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [string]$LogDirectory = (Join-Path $PSScriptRoot "..\Logs"), + + [Parameter(Mandatory = $false)] + [LogLevel]$MinimumLevel = [LogLevel]::INFO, + + [Parameter(Mandatory = $false)] + [bool]$EnableConsole = $true, + + [Parameter(Mandatory = $false)] + [bool]$EnableFile = $true + ) + + # Reuse existing session if already initialized + if ($global:LoggerConfig.LogFilePath -and (Test-Path -Path $global:LoggerConfig.LogFilePath)) { + Write-Host "[Logger] Reusing existing log session: $($global:LoggerConfig.LogFilePath)" -ForegroundColor DarkGray + return + } + + # Create log directory if it doesn't exist + if ($EnableFile) { + if (-not (Test-Path -Path $LogDirectory)) { + try { + New-Item -ItemType Directory -Path $LogDirectory -Force -ErrorAction Stop | Out-Null + } + catch { + Write-Host "[ERROR] Failed to create log directory: $LogDirectory" -ForegroundColor Red + Write-Host "[ERROR] Exception: $_" -ForegroundColor Red + $EnableFile = $false + } + } + } + + # Generate log file name with timestamp + $timestamp = Get-Date -Format "yyyyMMdd_HHmmss" + $logFileName = "NoIDPrivacy_$timestamp.log" + $global:LoggerConfig.LogFilePath = Join-Path $LogDirectory $logFileName + $global:LoggerConfig.MinimumLevel = $MinimumLevel + $global:LoggerConfig.EnableConsole = $EnableConsole + $global:LoggerConfig.EnableFile = $EnableFile + + # Test if we can write to the log file + if ($EnableFile) { + try { + "# NoID Privacy Log File" | Out-File -FilePath $global:LoggerConfig.LogFilePath -Encoding UTF8 -ErrorAction Stop + } + catch { + Write-Host "[ERROR] Failed to create log file: $($global:LoggerConfig.LogFilePath)" -ForegroundColor Red + Write-Host "[ERROR] Exception: $_" -ForegroundColor Red + $global:LoggerConfig.EnableFile = $false + } + } + + # Write initial log entry + Write-Log -Level INFO -Message "Logger initialized" -Module "Logger" + Write-Log -Level INFO -Message "Log file: $($global:LoggerConfig.LogFilePath)" -Module "Logger" +} + +function Write-Log { + <# + .SYNOPSIS + Write a log entry + + .PARAMETER Level + Log severity level + + .PARAMETER Message + Log message content + + .PARAMETER Module + Module or component name generating the log + + .PARAMETER Exception + Optional exception object for error logging + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [LogLevel]$Level, + + [Parameter(Mandatory = $true)] + [string]$Message, + + [Parameter(Mandatory = $false)] + [string]$Module = "Framework", + + [Parameter(Mandatory = $false)] + [System.Exception]$Exception = $null + ) + + # Check if level meets minimum threshold + if ($Level -lt $global:LoggerConfig.MinimumLevel) { + return + } + + # Format timestamp + $timestamp = Get-Date -Format $global:LoggerConfig.TimestampFormat + + # Build log entry + $logEntry = "[$timestamp] [$Level] [$Module] $Message" + + # Add exception details if present + if ($null -ne $Exception) { + $logEntry += "`n Exception: $($Exception.Message)" + $logEntry += "`n StackTrace: $($Exception.StackTrace)" + } + + # Write to file with robust retry logic + if ($global:LoggerConfig.EnableFile -and $global:LoggerConfig.LogFilePath) { + $maxRetries = 5 + $retryDelayMs = 100 + $writeSuccess = $false + $lastError = $null + + for ($i = 0; $i -lt $maxRetries; $i++) { + try { + Add-Content -Path $global:LoggerConfig.LogFilePath -Value $logEntry -Encoding UTF8 -ErrorAction Stop + $writeSuccess = $true + break + } + catch { + $lastError = $_ + Start-Sleep -Milliseconds $retryDelayMs + # Exponential backoff + $retryDelayMs *= 2 + } + } + + if (-not $writeSuccess) { + # Write error to console with detailed info only after all retries failed + Write-Host "[FILE WRITE ERROR] Failed to write to log file after $maxRetries attempts: $($global:LoggerConfig.LogFilePath)" -ForegroundColor Red + Write-Host "[FILE WRITE ERROR] Last Exception: $lastError" -ForegroundColor Red + # Disable file logging to prevent spam + $global:LoggerConfig.EnableFile = $false + } + } + + # Write to console with color coding (suppress DEBUG-level on console) + if ($global:LoggerConfig.EnableConsole -and $Level -ge [LogLevel]::INFO) { + $consoleColor = switch ($Level) { + ([LogLevel]::DEBUG) { "Gray" } + ([LogLevel]::INFO) { "White" } + ([LogLevel]::WARNING) { "Yellow" } + ([LogLevel]::ERROR) { "Red" } + ([LogLevel]::SUCCESS) { "Green" } + default { "White" } + } + + Write-Host $logEntry -ForegroundColor $consoleColor + } +} + +function Get-LogFilePath { + <# + .SYNOPSIS + Get the current log file path + + .OUTPUTS + String containing the log file path + #> + return $global:LoggerConfig.LogFilePath +} + +function Get-ErrorContext { + <# + .SYNOPSIS + Extract detailed error context from PowerShell error record + + .DESCRIPTION + Provides comprehensive error information including message, location, + line number, command, and stack trace for better debugging. + + .PARAMETER ErrorRecord + The error record to analyze (defaults to $_ in catch block) + + .OUTPUTS + Hashtable with error details + + .EXAMPLE + catch { + $errorContext = Get-ErrorContext -ErrorRecord $_ + Write-Log -Level ERROR -Message $errorContext.Summary -Module "MyModule" + } + #> + [CmdletBinding()] + [OutputType([hashtable])] + param( + [Parameter(Mandatory = $false)] + [System.Management.Automation.ErrorRecord]$ErrorRecord = $_ + ) + + $context = @{ + Message = "" + Exception = "" + Category = "" + TargetObject = "" + ScriptName = "" + LineNumber = 0 + Command = "" + StackTrace = "" + Summary = "" + } + + if ($null -eq $ErrorRecord) { + $context.Summary = "No error record available" + return $context + } + + # Extract basic error information + $context.Message = $ErrorRecord.Exception.Message + $context.Exception = $ErrorRecord.Exception.GetType().FullName + $context.Category = $ErrorRecord.CategoryInfo.Category.ToString() + $context.TargetObject = if ($ErrorRecord.TargetObject) { $ErrorRecord.TargetObject.ToString() } else { "N/A" } + + # Extract script location information + if ($ErrorRecord.InvocationInfo) { + $context.ScriptName = if ($ErrorRecord.InvocationInfo.ScriptName) { + Split-Path -Leaf $ErrorRecord.InvocationInfo.ScriptName + } else { + "N/A" + } + $context.LineNumber = $ErrorRecord.InvocationInfo.ScriptLineNumber + $context.Command = if ($ErrorRecord.InvocationInfo.MyCommand) { + $ErrorRecord.InvocationInfo.MyCommand.Name + } else { + "N/A" + } + } + + # Extract stack trace + if ($ErrorRecord.ScriptStackTrace) { + $context.StackTrace = $ErrorRecord.ScriptStackTrace + } + + # Build comprehensive summary + $summary = "$($context.Message)" + + if ($context.ScriptName -and $context.LineNumber -gt 0) { + $summary += " [File: $($context.ScriptName), Line: $($context.LineNumber)]" + } + + if ($context.Command) { + $summary += " [Command: $($context.Command)]" + } + + if ($context.Category -ne "NotSpecified") { + $summary += " [Category: $($context.Category)]" + } + + $context.Summary = $summary + + return $context +} + +function Write-ErrorLog { + <# + .SYNOPSIS + Write a comprehensive error log entry with full context + + .DESCRIPTION + Convenience function that combines error context extraction + and logging in one call. Provides detailed error information. + + .PARAMETER Message + Custom error message (will be prefixed to error details) + + .PARAMETER Module + Module or component name + + .PARAMETER ErrorRecord + The error record to log (defaults to $_ in catch block) + + .PARAMETER IncludeStackTrace + Include full stack trace in log (default: true) + + .EXAMPLE + catch { + Write-ErrorLog -Message "Failed to apply security settings" -Module "SecurityBaseline" -ErrorRecord $_ + } + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$Message, + + [Parameter(Mandatory = $false)] + [string]$Module = "Framework", + + [Parameter(Mandatory = $false)] + [System.Management.Automation.ErrorRecord]$ErrorRecord = $_, + + [Parameter(Mandatory = $false)] + [bool]$IncludeStackTrace = $true + ) + + $errorContext = Get-ErrorContext -ErrorRecord $ErrorRecord + + # Build comprehensive error message + $fullMessage = "$Message - $($errorContext.Summary)" + + # Log error with basic info + Write-Log -Level ERROR -Message $fullMessage -Module $Module -Exception $ErrorRecord.Exception + + # Log additional context if available + if ($IncludeStackTrace -and $errorContext.StackTrace) { + Write-Log -Level DEBUG -Message "Stack Trace: $($errorContext.StackTrace)" -Module $Module + } +} + +# Note: Export-ModuleMember not used - this script is dot-sourced, not imported as module +# All functions are automatically available when dot-sourced diff --git a/Core/NonInteractive.ps1 b/Core/NonInteractive.ps1 new file mode 100644 index 0000000..aed48bf --- /dev/null +++ b/Core/NonInteractive.ps1 @@ -0,0 +1,206 @@ +#Requires -Version 5.1 + +<# +.SYNOPSIS + NonInteractive mode helper functions for NoID Privacy GUI integration + +.DESCRIPTION + Provides helper functions to check if running in NonInteractive mode (GUI) + and to retrieve config values instead of prompting users. + + Used by all modules to support both CLI (interactive) and GUI (non-interactive) modes. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + + Usage in modules: + 1. Call Test-NonInteractiveMode to check if prompts should be skipped + 2. Use Get-NonInteractiveValue to get config values with defaults +#> + +<# +.SYNOPSIS + Test if running in NonInteractive mode (GUI) + +.DESCRIPTION + Checks if the global config has nonInteractive=true set. + When true, all Read-Host prompts should be skipped and config values used instead. + +.OUTPUTS + [bool] True if nonInteractive mode is enabled + +.EXAMPLE + if (Test-NonInteractiveMode) { + # Use config value + $choice = Get-NonInteractiveValue -Module "DNS" -Key "provider" -Default "Quad9" + } else { + # Interactive prompt + $choice = Read-Host "Select provider" + } +#> +function Test-NonInteractiveMode { + [CmdletBinding()] + [OutputType([bool])] + param() + + # Check environment variable FIRST (set by GUI before process starts) + if ($env:NOIDPRIVACY_NONINTERACTIVE -eq "true") { + return $true + } + + # Check global config + if ($script:Config -and $script:Config.options) { + if ($script:Config.options.nonInteractive -eq $true) { + return $true + } + } + + return $false +} + +# Set global variable at load time if environment variable is set +# This allows modules to check $global:NonInteractiveMode directly +if ($env:NOIDPRIVACY_NONINTERACTIVE -eq "true") { + # Only show banner once per session, even if this file is dot-sourced multiple times + # Use Get-Variable to avoid strict-mode errors when the variable does not yet exist + $niVar = Get-Variable -Name NonInteractiveMode -Scope Global -ErrorAction SilentlyContinue + $niValue = if ($niVar) { [bool]$niVar.Value } else { $false } + + if (-not $niValue) { + Write-Host "[GUI] Non-Interactive mode detected (environment variable)" -ForegroundColor Cyan + } + + $global:NonInteractiveMode = $true +} + +<# +.SYNOPSIS + Get a value from config for NonInteractive mode + +.DESCRIPTION + Retrieves a module-specific config value when running in NonInteractive mode. + Falls back to default if not found. + +.PARAMETER Module + The module name (SecurityBaseline, ASR, DNS, Privacy, AntiAI, EdgeHardening, AdvancedSecurity) + +.PARAMETER Key + The config key to retrieve + +.PARAMETER Default + Default value if key not found + +.OUTPUTS + The config value or default + +.EXAMPLE + $provider = Get-NonInteractiveValue -Module "DNS" -Key "provider" -Default "Quad9" +#> +function Get-NonInteractiveValue { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$Module, + + [Parameter(Mandatory = $true)] + [string]$Key, + + [Parameter(Mandatory = $false)] + $Default = $null + ) + + try { + $hasConfig = $null -ne $script:Config + $hasModules = $hasConfig -and ($null -ne $script:Config.modules) + $hasModule = $hasModules -and ($null -ne $script:Config.modules.$Module) + + if ($hasModule) { + $moduleConfig = $script:Config.modules.$Module + $hasKey = $null -ne $moduleConfig.$Key + + if ($hasKey) { + $value = $moduleConfig.$Key + Write-Log -Level DEBUG -Message "[NonInteractive] $Module.$Key = $value (from config)" -Module "Core" + return $value + } + } + } + catch { + Write-Log -Level WARNING -Message "[NonInteractive] Failed to read $Module.$Key from config: $_" -Module "Core" + } + + Write-Log -Level DEBUG -Message "[NonInteractive] $Module.$Key = $Default (default)" -Module "Core" + return $Default +} + +<# +.SYNOPSIS + Check if auto-confirm is enabled + +.DESCRIPTION + Returns true if autoConfirm or nonInteractive is enabled. + Used for Y/N confirmation prompts that should auto-confirm to Y. + +.OUTPUTS + [bool] True if should auto-confirm +#> +function Test-AutoConfirm { + [CmdletBinding()] + [OutputType([bool])] + param() + + if ($script:Config -and $script:Config.options) { + if ($script:Config.options.autoConfirm -eq $true) { + return $true + } + if ($script:Config.options.nonInteractive -eq $true) { + return $true + } + } + + return $false +} + +<# +.SYNOPSIS + Log a NonInteractive mode decision + +.DESCRIPTION + Helper to log when a decision was made automatically in NonInteractive mode. + Outputs to both console and log file for transparency. + +.PARAMETER Module + The module name + +.PARAMETER Decision + Description of the decision made + +.PARAMETER Value + The value that was used +#> +function Write-NonInteractiveDecision { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$Module, + + [Parameter(Mandatory = $true)] + [string]$Decision, + + [Parameter(Mandatory = $false)] + $Value = $null + ) + + $message = if ($null -ne $Value) { + "[GUI] $Decision : $Value" + } else { + "[GUI] $Decision" + } + + Write-Host $message -ForegroundColor Cyan + Write-Log -Level INFO -Message $message -Module $Module +} + +# Functions are available globally when dot-sourced by Framework.ps1 +# No Export-ModuleMember needed (script is not loaded as a module) diff --git a/Core/Rollback.ps1 b/Core/Rollback.ps1 new file mode 100644 index 0000000..6241b4a --- /dev/null +++ b/Core/Rollback.ps1 @@ -0,0 +1,2969 @@ +<# +.SYNOPSIS + Backup and rollback functionality for NoID Privacy Framework + +.DESCRIPTION + Implements the BACKUP/APPLY/VERIFY/RESTORE pattern for safe system modifications. + Creates backups before changes and provides rollback capabilities. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+ +#> + +# Global backup tracking (MUST be $global: for cross-module session sharing) +# Using $script: would create separate sessions per Import-Module call! +# IMPORTANT: Only initialize if not already set - prevents reset on re-load! +# NOTE: Must use Get-Variable to check existence (direct access fails in Strict Mode) +if (-not (Get-Variable -Name 'BackupIndex' -Scope Global -ErrorAction SilentlyContinue)) { $global:BackupIndex = @() } +if (-not (Get-Variable -Name 'BackupBasePath' -Scope Global -ErrorAction SilentlyContinue)) { $global:BackupBasePath = "" } +if (-not (Get-Variable -Name 'NewlyCreatedKeys' -Scope Global -ErrorAction SilentlyContinue)) { $global:NewlyCreatedKeys = @() } +if (-not (Get-Variable -Name 'SessionManifest' -Scope Global -ErrorAction SilentlyContinue)) { $global:SessionManifest = @{} } +if (-not (Get-Variable -Name 'CurrentModule' -Scope Global -ErrorAction SilentlyContinue)) { $global:CurrentModule = "" } + +function Initialize-BackupSystem { + <# + .SYNOPSIS + Initialize the backup system + + .PARAMETER BackupDirectory + Directory path for storing backups + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [string]$BackupDirectory = (Join-Path $PSScriptRoot "..\Backups") + ) + + # Create backup directory if it doesn't exist + if (-not (Test-Path -Path $BackupDirectory)) { + New-Item -ItemType Directory -Path $BackupDirectory -Force | Out-Null + } + + # Reuse existing session if already initialized + if ($global:BackupBasePath -and (Test-Path -Path $global:BackupBasePath)) { + Write-Log -Level DEBUG -Message "Backup system already initialized, reusing session: $global:BackupBasePath" -Module "Rollback" + return $true + } + + # Create session-specific backup folder + $timestamp = Get-Date -Format "yyyyMMdd_HHmmss" + $sessionId = "Session_$timestamp" + $sessionBackupPath = Join-Path $BackupDirectory $sessionId + New-Item -ItemType Directory -Path $sessionBackupPath -Force | Out-Null + + # Normalize path for clean log output (removes ..\) + $global:BackupBasePath = [System.IO.Path]::GetFullPath($sessionBackupPath) + $global:BackupIndex = @() + $global:NewlyCreatedKeys = @() + + # Initialize session manifest + $global:SessionManifest = @{ + sessionId = $sessionId + displayName = "" # Auto-generated based on modules + sessionType = "unknown" # wizard | advanced | manual + timestamp = Get-Date -Format "o" + frameworkVersion = "2.2.0" + modules = @() + totalItems = 0 + restorable = $true + sessionPath = $global:BackupBasePath + } + + Write-Log -Level INFO -Message "Backup system initialized: $global:BackupBasePath" -Module "Rollback" + + return $true +} + +function Set-SessionType { + <# + .SYNOPSIS + Set the session type for better identification in restore UI + + .PARAMETER SessionType + Type of session: wizard, advanced, or manual + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [ValidateSet("wizard", "advanced", "manual")] + [string]$SessionType + ) + + if ($global:SessionManifest) { + $global:SessionManifest.sessionType = $SessionType + Write-Log -Level DEBUG -Message "Session type set to: $SessionType" -Module "Rollback" + } +} + +function Update-SessionDisplayName { + <# + .SYNOPSIS + Auto-generate a user-friendly display name based on session type and modules + Should be called after all modules are backed up + #> + [CmdletBinding()] + param() + + if (-not $global:SessionManifest) { return } + + # Force arrays to prevent single-element string issues + $moduleCount = @($global:SessionManifest.modules).Count + $moduleNames = @($global:SessionManifest.modules | ForEach-Object { $_.name }) + $sessionType = $global:SessionManifest.sessionType + + # Calculate ACTUAL settings count (not backup items!) + # Each module applies a specific number of settings (Paranoid mode = max): + $settingsPerModule = @{ + "SecurityBaseline" = 425 # 335 Registry + 67 Security Template + 23 Audit + "ASR" = 19 # 19 ASR Rules + "DNS" = 5 # 5 DNS Settings + "Privacy" = 77 # 53 Registry (MSRecommended) + 24 Bloatware + "AntiAI" = 32 # 32 Registry Policies (13 features incl. Copilot 4-Layer) + "EdgeHardening" = 24 # 24 Edge Policies (22-23 applied depending on extensions) + "AdvancedSecurity" = 50 # 50 Advanced Settings (15 features incl. Discovery Protocols + IPv6) + } + + $totalSettings = 0 + foreach ($moduleName in $moduleNames) { + if ($settingsPerModule.ContainsKey($moduleName)) { + $totalSettings += $settingsPerModule[$moduleName] + } + } + + # Generate display name based on context + if ($moduleCount -eq 0) { + $displayName = "Empty Session" + } + elseif ($sessionType -eq "wizard") { + if ($moduleCount -ge 7) { + $displayName = "Full Hardening ($totalSettings Settings)" + } + elseif ($moduleCount -ge 4) { + $displayName = "Wizard: $moduleCount Modules ($totalSettings Settings)" + } + else { + # Few modules - list them + $short = ($moduleNames | Select-Object -First 3) -join ", " + $displayName = "Wizard: $short ($totalSettings Settings)" + } + } + elseif ($sessionType -eq "advanced") { + # Advanced mode = always single module + $displayName = "$($moduleNames[0]) Only ($totalSettings Settings)" + } + else { + # manual or unknown - just list modules + $short = ($moduleNames | Select-Object -First 2) -join ", " + if ($moduleCount -gt 2) { $short += "..." } + $displayName = "$short ($totalSettings Settings)" + } + + $global:SessionManifest.displayName = $displayName + Write-Log -Level INFO -Message "Session display name: $displayName" -Module "Rollback" + + # Update manifest file + $manifestPath = Join-Path $global:BackupBasePath "manifest.json" + if (Test-Path $manifestPath) { + try { + $encoding = New-Object System.Text.UTF8Encoding($false) + $json = $global:SessionManifest | ConvertTo-Json -Depth 5 + [System.IO.File]::WriteAllText($manifestPath, $json, $encoding) + } + catch { + Write-Log -Level WARNING -Message "Failed to update manifest with display name: $_" -Module "Rollback" + } + } +} + +function Start-ModuleBackup { + <# + .SYNOPSIS + Start backup for a specific module + + .PARAMETER ModuleName + Name of the module (e.g., SecurityBaseline, ASR) + + .OUTPUTS + String - Path to the module backup folder + #> + [CmdletBinding()] + [OutputType([string])] + param( + [Parameter(Mandatory = $true)] + [ValidateSet("SecurityBaseline", "ASR", "DNS", "Privacy", "AntiAI", "EdgeHardening", "AdvancedSecurity")] + [string]$ModuleName + ) + + if ([string]::IsNullOrEmpty($global:BackupBasePath)) { + throw "Backup system not initialized. Call Initialize-BackupSystem first." + } + + # Create module subfolder + $moduleBackupPath = Join-Path $global:BackupBasePath $ModuleName + if (-not (Test-Path $moduleBackupPath)) { + New-Item -ItemType Directory -Path $moduleBackupPath -Force | Out-Null + } + + $global:CurrentModule = $ModuleName + + Write-Log -Level INFO -Message "Started backup for module: $ModuleName" -Module "Rollback" + + # Return the module backup path + return $moduleBackupPath +} + +function Complete-ModuleBackup { + <# + .SYNOPSIS + Complete backup for a module and update session manifest + + .DESCRIPTION + Finalizes the backup process for the current module. + Updates the session manifest.json with module statistics. + This is CRITICAL for the Restore-Session function to work. + + .PARAMETER ItemsBackedUp + Number of items successfully backed up + + .PARAMETER Status + Status of the backup (Success, Failed, Skipped) + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [int]$ItemsBackedUp, + + [Parameter(Mandatory = $true)] + [ValidateSet("Success", "Failed", "Skipped")] + [string]$Status + ) + + if ([string]::IsNullOrEmpty($global:BackupBasePath)) { + throw "Backup system not initialized. Call Initialize-BackupSystem first." + } + + if ([string]::IsNullOrEmpty($global:CurrentModule)) { + Write-Log -Level WARNING -Message "No active module backup to complete" -Module "Rollback" + return + } + + # Update Manifest Object + $moduleData = @{ + name = $global:CurrentModule + backupPath = $global:CurrentModule + itemsBackedUp = $ItemsBackedUp + status = $Status + timestamp = Get-Date -Format "o" + } + + $global:SessionManifest.modules += $moduleData + $global:SessionManifest.totalItems += $ItemsBackedUp + + # Write Manifest to Disk (robust against transient file locks) + $manifestPath = Join-Path $global:BackupBasePath "manifest.json" + $maxAttempts = 5 + $attempt = 0 + $delayMs = 200 + $encoding = New-Object System.Text.UTF8Encoding($false) + + while ($attempt -lt $maxAttempts) { + try { + $attempt++ + $json = $global:SessionManifest | ConvertTo-Json -Depth 5 + [System.IO.File]::WriteAllText($manifestPath, $json, $encoding) + Write-Log -Level INFO -Message "Completed backup for $($global:CurrentModule) (Items: $ItemsBackedUp). Manifest updated." -Module "Rollback" + break + } + catch [System.IO.IOException] { + if ($attempt -ge $maxAttempts) { + Write-Log -Level ERROR -Message "Failed to write session manifest after $maxAttempts attempts: $_" -Module "Rollback" + break + } + Start-Sleep -Milliseconds $delayMs + } + catch { + Write-Log -Level ERROR -Message "Failed to write session manifest: $_" -Module "Rollback" + break + } + } + + # Reset Current Module + $global:CurrentModule = "" +} + +function Backup-RegistryKey { + <# + .SYNOPSIS + Backup a registry key before modification + + .PARAMETER KeyPath + Registry key path (e.g., "HKLM:\SOFTWARE\Policies\Microsoft\Windows") + + .PARAMETER BackupName + Descriptive name for this backup + + .OUTPUTS + String containing backup file path + #> + [CmdletBinding()] + [OutputType([string])] + param( + [Parameter(Mandatory = $true)] + [string]$KeyPath, + + [Parameter(Mandatory = $true)] + [string]$BackupName + ) + + if ([string]::IsNullOrEmpty($global:BackupBasePath)) { + throw "Backup system not initialized. Call Initialize-BackupSystem first." + } + + try { + # Sanitize backup name for filename + $safeBackupName = $BackupName -replace '[\\/:*?"<>|]', '_' + + # Save to current module folder if active, otherwise root + $backupFolder = if ($global:CurrentModule) { + Join-Path $global:BackupBasePath $global:CurrentModule + } + else { + $global:BackupBasePath + } + + $backupFile = Join-Path $backupFolder "$safeBackupName`_Registry.reg" + + # Convert PowerShell path to reg.exe format + $regPath = $KeyPath -replace 'HKLM:\\', 'HKEY_LOCAL_MACHINE\' ` + -replace 'HKCU:\\', 'HKEY_CURRENT_USER\' ` + -replace 'HKCR:\\', 'HKEY_CLASSES_ROOT\' ` + -replace 'HKU:\\', 'HKEY_USERS\' ` + -replace 'HKCC:\\', 'HKEY_CURRENT_CONFIG\' + + # Use unique temp files to prevent race conditions + $guid = [Guid]::NewGuid().ToString() + $stdoutFile = Join-Path $env:TEMP "reg_export_stdout_$guid.txt" + $stderrFile = Join-Path $env:TEMP "reg_export_stderr_$guid.txt" + + # Export registry key using Start-Process for better error handling + $process = Start-Process -FilePath "reg.exe" ` + -ArgumentList "export", "`"$regPath`"", "`"$backupFile`"", "/y" ` + -Wait ` + -NoNewWindow ` + -PassThru ` + -RedirectStandardOutput $stdoutFile ` + -RedirectStandardError $stderrFile + + # Cleanup temp files + $errorOutput = Get-Content $stderrFile -Raw -ErrorAction SilentlyContinue + Remove-Item $stdoutFile, $stderrFile -Force -ErrorAction SilentlyContinue + + if ($process.ExitCode -eq 0) { + Write-Log -Level SUCCESS -Message "Registry backup created: $BackupName" -Module "Rollback" + + # Add to backup index + $global:BackupIndex += [PSCustomObject]@{ + Type = "Registry" + Name = $BackupName + Path = $KeyPath + BackupFile = $backupFile + Timestamp = Get-Date + } + + return $backupFile + } + else { + # Check if key simply doesn't exist yet (normal when creating new keys) + if ($errorOutput -match "nicht gefunden|cannot find|not found") { + # Key doesn't exist - CREATE EMPTY MARKER so restore knows to DELETE this key + Write-Log -Level INFO -Message "Registry key does not exist (will create empty marker): $BackupName" -Module "Rollback" + + try { + $emptyMarker = @{ + KeyPath = $KeyPath + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + State = "NotExisted" + Message = "Registry key did not exist before hardening - must be deleted during restore" + } | ConvertTo-Json + + $markerFile = Join-Path $backupFolder "$safeBackupName`_EMPTY.json" + $emptyMarker | Set-Content -Path $markerFile -Encoding UTF8 -Force + + Write-Log -Level SUCCESS -Message "Empty marker created for non-existent key: $BackupName" -Module "Rollback" + + # Add to backup index + $global:BackupIndex += [PSCustomObject]@{ + Type = "EmptyMarker" + Name = $BackupName + Path = $KeyPath + BackupFile = $markerFile + Timestamp = Get-Date + } + + return $markerFile + } + catch { + Write-Log -Level WARNING -Message "Could not create empty marker for ${BackupName}: $($_.Exception.Message)" -Module "Rollback" + return $null + } + } + else { + # Actual error + Write-Log -Level WARNING -Message "Registry backup may have failed: $errorOutput" -Module "Rollback" + return $null + } + } + } + catch { + Write-ErrorLog -Message "Failed to backup registry key: $KeyPath" -Module "Rollback" -ErrorRecord $_ + return $null + } +} + +function Register-NewRegistryKey { + <# + .SYNOPSIS + Track a newly created registry key for proper restore + + .DESCRIPTION + When a registry key is created that didn't exist before, it must be tracked + so it can be deleted (not just restored) during rollback. + + .PARAMETER KeyPath + PowerShell-style registry path (e.g., HKLM:\SOFTWARE\...) + + .EXAMPLE + Register-NewRegistryKey -KeyPath "HKLM:\SOFTWARE\Policies\Microsoft\Windows\NewKey" + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$KeyPath + ) + + if ([string]::IsNullOrEmpty($global:BackupBasePath)) { + throw "Backup system not initialized. Call Initialize-BackupSystem first." + } + + # Add to tracking list (avoid duplicates) + if ($global:NewlyCreatedKeys -notcontains $KeyPath) { + $global:NewlyCreatedKeys += $KeyPath + Write-Log -Level DEBUG -Message "Tracking new registry key for rollback: $KeyPath" -Module "Rollback" + } +} + +function Backup-ServiceConfiguration { + <# + .SYNOPSIS + Backup service configuration before modification + + .PARAMETER ServiceName + Name of the service + + .PARAMETER BackupName + Optional descriptive name for this backup. If not provided, uses ServiceName. + + .OUTPUTS + String containing backup file path + #> + [CmdletBinding()] + [OutputType([string])] + param( + [Parameter(Mandatory = $true)] + [string]$ServiceName, + + [Parameter(Mandatory = $false)] + [string]$BackupName + ) + + if ([string]::IsNullOrEmpty($global:BackupBasePath)) { + throw "Backup system not initialized. Call Initialize-BackupSystem first." + } + + # Use ServiceName as BackupName if not provided + if ([string]::IsNullOrEmpty($BackupName)) { + $BackupName = $ServiceName + } + + try { + $service = Get-Service -Name $ServiceName -ErrorAction Stop + + # Get detailed service configuration (may not exist for some services) + $serviceConfig = Get-CimInstance -ClassName Win32_Service -Filter "Name='$ServiceName'" -ErrorAction SilentlyContinue + + $backupData = [PSCustomObject]@{ + Name = $service.Name + DisplayName = $service.DisplayName + Status = $service.Status + StartType = $service.StartType + StartMode = if ($serviceConfig) { $serviceConfig.StartMode } else { $service.StartType.ToString() } + PathName = if ($serviceConfig) { $serviceConfig.PathName } else { "" } + Description = if ($serviceConfig) { $serviceConfig.Description } else { "" } + } + + # Save to JSON + $safeBackupName = $BackupName -replace '[\\/:*?"<>|]', '_' + + # Save to current module folder if active, otherwise root + $backupFolder = if ($global:CurrentModule) { + Join-Path $global:BackupBasePath $global:CurrentModule + } + else { + $global:BackupBasePath + } + + $backupFile = Join-Path $backupFolder "$safeBackupName`_Service.json" + $backupData | ConvertTo-Json | Set-Content -Path $backupFile -Encoding UTF8 | Out-Null + + Write-Log -Level SUCCESS -Message "Service backup created: $BackupName ($ServiceName)" -Module "Rollback" + + # Add to backup index + $global:BackupIndex += [PSCustomObject]@{ + Type = "Service" + Name = $BackupName + ServiceName = $ServiceName + BackupFile = $backupFile + Timestamp = Get-Date + } + + return $backupFile + } + catch { + Write-Log -Level ERROR -Message "Failed to backup service: $ServiceName" -Module "Rollback" -Exception $_.Exception + return $null + } +} + +function Backup-ScheduledTask { + <# + .SYNOPSIS + Backup scheduled task configuration before modification + + .PARAMETER TaskPath + Full path of the scheduled task (e.g., "\Microsoft\Windows\AppID\TaskName") + Can be either full path or just folder path if TaskName is provided separately. + + .PARAMETER TaskName + Optional - Name of the scheduled task if TaskPath is just the folder + + .PARAMETER BackupName + Optional descriptive name for this backup. Auto-generated if not provided. + + .OUTPUTS + String containing backup file path + #> + [CmdletBinding()] + [OutputType([string])] + param( + [Parameter(Mandatory = $true)] + [string]$TaskPath, + + [Parameter(Mandatory = $false)] + [string]$TaskName, + + [Parameter(Mandatory = $false)] + [string]$BackupName + ) + + if ([string]::IsNullOrEmpty($global:BackupBasePath)) { + throw "Backup system not initialized. Call Initialize-BackupSystem first." + } + + try { + # Parse TaskPath - if it contains task name, split it + if ([string]::IsNullOrEmpty($TaskName)) { + # TaskPath is full path like "\Microsoft\Windows\AppID\TaskName" + $TaskName = Split-Path $TaskPath -Leaf + $actualTaskPath = Split-Path $TaskPath -Parent + if ([string]::IsNullOrEmpty($actualTaskPath)) { + $actualTaskPath = "\" + } + } + else { + $actualTaskPath = $TaskPath + } + + # Generate BackupName if not provided + if ([string]::IsNullOrEmpty($BackupName)) { + $BackupName = $TaskName -replace '\s', '_' + } + + # Check if task exists first + $task = Get-ScheduledTask -TaskPath $actualTaskPath -TaskName $TaskName -ErrorAction SilentlyContinue + + if (-not $task) { + # Task doesn't exist - this is normal for many telemetry tasks on Win11 + Write-Log -Level DEBUG -Message "Scheduled task not found (already disabled/removed): $actualTaskPath\$TaskName" -Module "Rollback" + return $null + } + + # Export task to XML + $taskXml = Export-ScheduledTask -TaskPath $actualTaskPath -TaskName $TaskName + + # Save to file + $safeBackupName = $BackupName -replace '[\\/:*?"<>|]', '_' + + # Save to current module folder if active, otherwise root + $backupFolder = if ($global:CurrentModule) { + Join-Path $global:BackupBasePath $global:CurrentModule + } + else { + $global:BackupBasePath + } + + $backupFile = Join-Path $backupFolder "$safeBackupName`_Task.xml" + $taskXml | Set-Content -Path $backupFile -Encoding UTF8 | Out-Null + + Write-Log -Level SUCCESS -Message "Scheduled task backup created: $BackupName" -Module "Rollback" + + # Add to backup index + $global:BackupIndex += [PSCustomObject]@{ + Type = "ScheduledTask" + Name = $BackupName + TaskPath = $TaskPath + TaskName = $TaskName + BackupFile = $backupFile + Timestamp = Get-Date + } + + return $backupFile + } + catch { + # Only log as ERROR if task exists but backup failed (real error) + Write-Log -Level ERROR -Message "Failed to backup scheduled task: $actualTaskPath\$TaskName" -Module "Rollback" -Exception $_.Exception + return $null + } +} + +function Register-Backup { + <# + .SYNOPSIS + Register a generic backup with custom data + + .DESCRIPTION + Allows modules to register custom backup data (e.g., DNS settings, firewall rules). + The data is stored as JSON and can be restored using module-specific restore logic. + + .PARAMETER Type + Type of backup (e.g., "DNS", "Firewall", "Custom") + + .PARAMETER Data + Backup data as JSON string or PowerShell object + + .PARAMETER Name + Optional descriptive name for the backup + + .OUTPUTS + Path to backup file or $null if failed + + .EXAMPLE + Register-Backup -Type "DNS" -Data $dnsBackupJson -Name "DNS_Settings" + #> + [CmdletBinding()] + [OutputType([string])] + param( + [Parameter(Mandatory = $true)] + [string]$Type, + + [Parameter(Mandatory = $true)] + $Data, + + [Parameter(Mandatory = $false)] + [string]$Name + ) + + try { + if (-not $global:BackupBasePath) { + Write-Log -Level ERROR -Message "Backup system not initialized" -Module "Rollback" + return $null + } + + # Generate backup name if not provided + if (-not $Name) { + $timestamp = Get-Date -Format "yyyyMMdd_HHmmss" + $Name = "$Type`_$timestamp" + } + + # Sanitize backup name + $safeName = $Name -replace '[\\/:*?"<>|]', '_' + + # Create type-specific folder + $typeFolder = Join-Path $global:BackupBasePath $Type + if (-not (Test-Path $typeFolder)) { + New-Item -ItemType Directory -Path $typeFolder -Force | Out-Null + } + + $backupFile = Join-Path $typeFolder "$safeName.json" + + # Convert data to JSON if not already + if ($Data -is [string]) { + $Data | Set-Content -Path $backupFile -Encoding UTF8 | Out-Null + } + else { + $Data | ConvertTo-Json -Depth 10 | Set-Content -Path $backupFile -Encoding UTF8 | Out-Null + } + + Write-Log -Level SUCCESS -Message "Backup registered: $Type - $Name" -Module "Rollback" + + # Add to backup index + $global:BackupIndex += [PSCustomObject]@{ + Type = $Type + Name = $Name + BackupFile = $backupFile + Timestamp = Get-Date + } + + return $backupFile + } + catch { + Write-Log -Level ERROR -Message "Failed to register backup: $Type - $Name" -Module "Rollback" -Exception $_.Exception + return $null + } +} + +function New-SystemRestorePoint { + <# + .SYNOPSIS + Create a system restore point + + .PARAMETER Description + Description for the restore point + + .OUTPUTS + Boolean indicating success + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $false)] + [string]$Description = "NoID Privacy - Before Hardening" + ) + + try { + # Check if System Restore is enabled + $restoreEnabled = $null -ne (Get-ComputerRestorePoint -ErrorAction SilentlyContinue) + + if ($restoreEnabled) { + Write-Log -Level INFO -Message "Creating system restore point..." -Module "Rollback" + + Checkpoint-Computer -Description $Description -RestorePointType "MODIFY_SETTINGS" + + Write-Log -Level SUCCESS -Message "System restore point created" -Module "Rollback" + return $true + } + else { + Write-Log -Level WARNING -Message "System Restore is not enabled on this system" -Module "Rollback" + return $false + } + } + catch { + Write-Log -Level ERROR -Message "Failed to create system restore point" -Module "Rollback" -Exception $_.Exception + return $false + } +} + +function Get-BackupIndex { + <# + .SYNOPSIS + Get list of all backups created in current session + + .OUTPUTS + Array of backup objects + #> + [CmdletBinding()] + [OutputType([PSCustomObject[]])] + param() + + return $global:BackupIndex +} + +function Restore-FromBackup { + <# + .SYNOPSIS + Restore a specific backup + + .PARAMETER BackupFile + Path to backup file + + .PARAMETER Type + Type of backup (Registry, Service, ScheduledTask) + + .OUTPUTS + Boolean indicating success + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [string]$BackupFile, + + [Parameter(Mandatory = $true)] + [ValidateSet("Registry", "Service", "ScheduledTask")] + [string]$Type + ) + + if (-not (Test-Path -Path $BackupFile)) { + Write-Log -Level ERROR -Message "Backup file not found: $BackupFile" -Module "Rollback" + return $false + } + + try { + switch ($Type) { + "Registry" { + Write-Log -Level INFO -Message "Restoring registry from: $BackupFile" -Module "Rollback" + + # Check if backup file has content (more than just header) + $backupContent = Get-Content -Path $BackupFile -Raw -ErrorAction SilentlyContinue + $hasContent = $backupContent -and ($backupContent.Length -gt 100) -and ($backupContent -match '\[HKEY') + + if (-not $hasContent) { + # Backup is empty - the key didn't exist before hardening + # Extract key path from filename and delete it + Write-Log -Level INFO -Message "Empty backup detected - key did not exist before hardening" -Module "Rollback" + + # Try to extract key path from backup content if available + if ($backupContent -match '\[HKEY[^\]]+\]') { + $keyPath = $matches[0] -replace '^\[' -replace '\]$' + + # Use [regex]::Escape to prevent unintended matches + $keyPath = $keyPath -replace [regex]::Escape('HKEY_LOCAL_MACHINE'), 'HKLM:' ` + -replace [regex]::Escape('HKEY_CURRENT_USER'), 'HKCU:' ` + -replace [regex]::Escape('HKEY_CLASSES_ROOT'), 'HKCR:' ` + -replace [regex]::Escape('HKEY_USERS'), 'HKU:' ` + -replace [regex]::Escape('HKEY_CURRENT_CONFIG'), 'HKCC:' + + # CRITICAL: Validate key path is within expected scope! + $allowedPrefixes = @( + 'HKLM:\\SOFTWARE\\Policies', + 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies', + 'HKCU:\\SOFTWARE\\Policies', + 'HKLM:\\SYSTEM\\CurrentControlSet\\Services', + 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings', + 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server' + ) + + $isAllowed = $false + foreach ($prefix in $allowedPrefixes) { + if ($keyPath.StartsWith($prefix, [StringComparison]::OrdinalIgnoreCase)) { + $isAllowed = $true + break + } + } + + if (-not $isAllowed) { + Write-Log -Level WARNING -Message "Refusing to delete key outside allowed scope: $keyPath" -Module "Rollback" + return $true + } + + if (Test-Path $keyPath) { + try { + Remove-Item -Path $keyPath -Recurse -Force -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Deleted non-existent key: $keyPath" -Module "Rollback" + return $true + } + catch { + Write-Log -Level WARNING -Message "Could not delete key: $keyPath - $_" -Module "Rollback" + return $false + } + } + } + + Write-Log -Level INFO -Message "Backup empty - nothing to restore" -Module "Rollback" + return $true + } + + # PRE-CHECK: Extract key path from .reg file and check if it's a protected key + # This prevents unnecessary WARNING/ERROR messages for known protected keys + $keyPathToRestore = "" + $backupContent = Get-Content -Path $BackupFile -Raw -ErrorAction SilentlyContinue + if ($backupContent -match '\[(HKEY[^\]]+)\]') { + $keyPathToRestore = $matches[1] + } + + # List of known protected keys (Windows system protection prevents reg.exe import) + $knownProtectedKeys = @( + 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server', + 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings', + 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' + ) + + $isKnownProtected = $false + foreach ($protectedKey in $knownProtectedKeys) { + if ($keyPathToRestore -match [regex]::Escape($protectedKey)) { + $isKnownProtected = $true + break + } + } + + # If this is a known protected key, skip reg.exe import and use JSON-Fallback instead + if ($isKnownProtected) { + Write-Log -Level INFO -Message "Standard registry import skipped for protected key (will use Smart JSON-Fallback)." -Module "Rollback" + return $true # Success - JSON backup will handle this key via Smart Fallback + } + + # Use unique temp files to prevent race conditions + $guid = [Guid]::NewGuid().ToString() + $stdoutFile = Join-Path $env:TEMP "reg_import_stdout_$guid.txt" + $stderrFile = Join-Path $env:TEMP "reg_import_stderr_$guid.txt" + + # Use Start-Process to properly handle reg.exe output + $process = Start-Process -FilePath "reg.exe" ` + -ArgumentList "import", "`"$BackupFile`"" ` + -Wait ` + -NoNewWindow ` + -PassThru ` + -RedirectStandardOutput $stdoutFile ` + -RedirectStandardError $stderrFile + + # Cleanup temp files + $errorOutput = Get-Content $stderrFile -Raw -ErrorAction SilentlyContinue + Remove-Item $stdoutFile, $stderrFile -Force -ErrorAction SilentlyContinue + + if ($process.ExitCode -eq 0) { + Write-Log -Level SUCCESS -Message "Registry restored successfully" -Module "Rollback" + return $true + } + else { + $errorMessage = $errorOutput + # Check for Access Denied error (English and German variants) + if ($errorMessage -match "Zugriff verweigert|Access is denied|Fehler beim Zugriff auf die Registrierung") { + Write-Log -Level WARNING -Message "Access Denied during registry restore for $BackupFile. Attempting to delete key and retry import..." -Module "Rollback" + + if (-not [string]::IsNullOrEmpty($keyPathToRestore)) { + try { + # Convert reg.exe path to PowerShell path + $psKeyPath = $keyPathToRestore -replace 'HKEY_LOCAL_MACHINE', 'HKLM:' ` + -replace 'HKEY_CURRENT_USER', 'HKCU:' ` + -replace 'HKEY_CLASSES_ROOT', 'HKCR:' ` + -replace 'HKEY_USERS', 'HKU:' ` + -replace 'HKEY_CURRENT_CONFIG', 'HKCC:' + + if (Test-Path $psKeyPath) { + Write-Log -Level INFO -Message "Deleting existing protected key: $psKeyPath before re-import." -Module "Rollback" + Remove-Item -Path $psKeyPath -Recurse -Force -ErrorAction SilentlyContinue # SilentlyContinue to avoid error if it's truly protected + } + + # Retry import + $process = Start-Process -FilePath "reg.exe" ` + -ArgumentList "import", "`"$BackupFile`"" ` + -Wait ` + -NoNewWindow ` + -PassThru ` + -RedirectStandardOutput $stdoutFile ` + -RedirectStandardError $stderrFile + + $errorOutput = Get-Content $stderrFile -Raw -ErrorAction SilentlyContinue + Remove-Item $stdoutFile, $stderrFile -Force -ErrorAction SilentlyContinue + + if ($process.ExitCode -eq 0) { + Write-Log -Level SUCCESS -Message "Registry restored successfully after deleting key and retrying" -Module "Rollback" + return $true + } + else { + Write-Log -Level ERROR -Message "Registry restore failed even after deleting key (Exit Code: $($process.ExitCode)): $errorOutput" -Module "Rollback" + return $false + } + } + catch { + Write-Log -Level ERROR -Message "Failed to delete key or retry import for ${keyPathToRestore}: $($_.Exception.Message)" -Module "Rollback" + return $false + } + } + } + Write-Log -Level ERROR -Message "Registry restore failed (Exit Code: $($process.ExitCode)): $errorMessage" -Module "Rollback" + return $false + } + } + + "Service" { + Write-Log -Level INFO -Message "Restoring service from: $BackupFile" -Module "Rollback" + $serviceConfig = Get-Content -Path $BackupFile -Raw | ConvertFrom-Json + + Set-Service -Name $serviceConfig.Name -StartupType $serviceConfig.StartType -ErrorAction Stop + + Write-Log -Level SUCCESS -Message "Service restored: $($serviceConfig.Name)" -Module "Rollback" + return $true + } + + "ScheduledTask" { + Write-Log -Level INFO -Message "Restoring scheduled task from: $BackupFile" -Module "Rollback" + + try { + $taskData = Get-Content -Path $BackupFile -Raw | ConvertFrom-Json + + # Import task XML if exists + if ($taskData.XmlDefinition) { + # Register-ScheduledTask requires TaskName and Xml (string) + # Force overwrite if exists + Register-ScheduledTask -Xml $taskData.XmlDefinition -TaskName $taskData.TaskName -Force | Out-Null + Write-Log -Level SUCCESS -Message "Scheduled task restored: $($taskData.TaskName)" -Module "Rollback" + return $true + } + else { + Write-Log -Level WARNING -Message "No XML definition found in backup for task: $($taskData.TaskName)" -Module "Rollback" + return $false + } + } + catch { + Write-ErrorLog -Message "Failed to restore scheduled task" -Module "Rollback" -ErrorRecord $_ + return $false + } + } + + default { + Write-Log -Level ERROR -Message "Unknown backup type: $Type" -Module "Rollback" + return $false + } + } + } + catch { + Write-ErrorLog -Message "Failed to restore from backup file: $BackupFilePath" -Module "Rollback" -ErrorRecord $_ + return $false + } +} + +function Invoke-RestoreRebootPrompt { + <# + .SYNOPSIS + Prompt user for system reboot after restore + + .DESCRIPTION + Offers immediate or deferred reboot with countdown. + Uses validation loop for consistent behavior. + + .OUTPUTS + None + #> + [CmdletBinding()] + param() + + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host " SYSTEM REBOOT RECOMMENDED" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + + # Check if Privacy module was restored with non-restorable apps + if ($script:PrivacyNonRestorableApps -and $script:PrivacyNonRestorableApps.Count -gt 0) { + Write-Host "MANUAL ACTION REQUIRED:" -ForegroundColor Yellow + Write-Host "" + Write-Host "The following apps were removed during hardening but cannot be" -ForegroundColor Gray + Write-Host "automatically restored via winget (not available in catalog):" -ForegroundColor Gray + Write-Host "" + foreach ($app in $script:PrivacyNonRestorableApps) { + Write-Host " - $app" -ForegroundColor White + } + Write-Host "" + Write-Host "Please reinstall these apps manually from the Microsoft Store" -ForegroundColor Gray + Write-Host "after the reboot if you need them." -ForegroundColor Gray + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + } + + Write-Host "RECOMMENDED: Reboot after restore" -ForegroundColor White + Write-Host "" + Write-Host "Some security settings require a reboot to be fully activated:" -ForegroundColor Gray + Write-Host "" + Write-Host " - Group Policy changes (processed but not fully active)" -ForegroundColor Gray + Write-Host " - Security Template settings (user rights, audit)" -ForegroundColor Gray + Write-Host " - Registry policies affecting boot-time services" -ForegroundColor Gray + Write-Host "" + Write-Host "While gpupdate has processed the restored policies, a reboot" -ForegroundColor Gray + Write-Host "ensures complete activation of all security settings." -ForegroundColor Gray + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + + # Prompt user with validation loop + do { + Write-Host "Reboot now? [Y/N] (default: Y): " -NoNewline -ForegroundColor White + $choice = Read-Host + if ([string]::IsNullOrWhiteSpace($choice)) { $choice = "Y" } + $choice = $choice.Trim().ToUpper() + + if ($choice -notin @('Y', 'N')) { + Write-Host "" + Write-Host "Invalid input. Please enter Y or N." -ForegroundColor Red + Write-Host "" + } + } while ($choice -notin @('Y', 'N')) + + if ($choice -eq 'Y') { + Write-Host "" + Write-Host "[>] Initiating system reboot in 10 seconds..." -ForegroundColor Yellow + Write-Host " Press Ctrl+C to cancel" -ForegroundColor Gray + Write-Host "" + + # Countdown from 10 + for ($i = 10; $i -gt 0; $i--) { + Write-Host " Rebooting in $i seconds..." -ForegroundColor Yellow + Start-Sleep -Seconds 1 + } + + Write-Host "" + Write-Host "[+] Rebooting system now..." -ForegroundColor Green + Write-Host "" + + # Reboot + Restart-Computer -Force + } + else { + Write-Host "" + Write-Host "[!] Reboot deferred" -ForegroundColor Yellow + Write-Host "" + Write-Host "IMPORTANT: Please reboot manually at your earliest convenience." -ForegroundColor White + Write-Host "Some restored settings may not be fully active until after reboot." -ForegroundColor Gray + Write-Host "" + } +} + +function Restore-AllBackups { + <# + .SYNOPSIS + Restore all backups from current session (full rollback) + + .OUTPUTS + Boolean indicating overall success + #> + [CmdletBinding()] + [OutputType([bool])] + param() + + Write-Log -Level WARNING -Message "Starting full rollback of all changes" -Module "Rollback" + + $allSucceeded = $true + + # Restore in reverse order (LIFO) + $reversedIndex = $global:BackupIndex | Sort-Object -Property Timestamp -Descending + + foreach ($backup in $reversedIndex) { + $success = Restore-FromBackup -BackupFile $backup.BackupFile -Type $backup.Type + + if (-not $success) { + $allSucceeded = $false + } + } + + # Delete newly created registry keys (they didn't exist before) + if ($global:NewlyCreatedKeys.Count -gt 0) { + Write-Log -Level INFO -Message "Removing $($global:NewlyCreatedKeys.Count) newly created registry keys..." -Module "Rollback" + + # Sort in reverse order (deepest keys first) to avoid errors + $sortedKeys = $global:NewlyCreatedKeys | Sort-Object -Property Length -Descending + + foreach ($keyPath in $sortedKeys) { + try { + if (Test-Path -Path $keyPath) { + Remove-Item -Path $keyPath -Recurse -Force -ErrorAction Stop + Write-Log -Level INFO -Message "Deleted newly created key: $keyPath" -Module "Rollback" + } + } + catch { + Write-Log -Level WARNING -Message "Failed to delete newly created key: $keyPath - $_" -Module "Rollback" + $allSucceeded = $false + } + } + } + + if ($allSucceeded) { + Write-Log -Level SUCCESS -Message "Full rollback completed successfully" -Module "Rollback" + } + else { + Write-Log -Level WARNING -Message "Full rollback completed with some failures" -Module "Rollback" + } + + # Prompt for reboot after restore + Invoke-RestoreRebootPrompt + + return $allSucceeded +} + +function Get-BackupSessions { + <# + .SYNOPSIS + Get list of all backup sessions + + .PARAMETER BackupDirectory + Directory containing backup sessions + + .OUTPUTS + Array of session objects with manifest data + #> + [CmdletBinding()] + [OutputType([PSCustomObject[]])] + param( + [Parameter(Mandatory = $false)] + [string]$BackupDirectory = (Join-Path $PSScriptRoot "..\Backups") + ) + + if (-not (Test-Path $BackupDirectory)) { + return @() + } + + $sessions = @() + $sessionFolders = Get-ChildItem -Path $BackupDirectory -Directory | Where-Object { $_.Name -match '^Session_\d{8}_\d{6}$' } + + foreach ($folder in $sessionFolders) { + $manifestPath = Join-Path $folder.FullName "manifest.json" + + if (Test-Path $manifestPath) { + try { + $manifest = Get-Content $manifestPath -Raw | ConvertFrom-Json + + $sessions += [PSCustomObject]@{ + SessionId = $manifest.sessionId + Timestamp = [DateTime]::Parse($manifest.timestamp) + FrameworkVersion = $manifest.frameworkVersion + Modules = $manifest.modules + TotalItems = $manifest.totalItems + Restorable = $manifest.restorable + SessionPath = $manifest.sessionPath + FolderPath = $folder.FullName + } + } + catch { + Write-Log -Level WARNING -Message "Failed to read manifest for session: $($folder.Name)" -Module "Rollback" + } + } + } + + # Ensure we return an array (Sort-Object can return single object unwrapped) + $sorted = @($sessions | Sort-Object -Property Timestamp -Descending) + return $sorted +} + +function Get-SessionManifest { + <# + .SYNOPSIS + Get manifest for a specific session + + .PARAMETER SessionPath + Path to the session folder + + .OUTPUTS + Session manifest object + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param( + [Parameter(Mandatory = $true)] + [string]$SessionPath + ) + + $manifestPath = Join-Path $SessionPath "manifest.json" + + if (-not (Test-Path $manifestPath)) { + throw "Session manifest not found: $manifestPath" + } + + return Get-Content $manifestPath -Raw | ConvertFrom-Json +} + +function Initialize-RestoreLog { + <# + .SYNOPSIS + Initialize separate detailed log file for restore operations + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$SessionPath + ) + + try { + $logsDir = Join-Path (Split-Path $PSScriptRoot -Parent) "Logs" + if (-not (Test-Path $logsDir)) { + New-Item -ItemType Directory -Path $logsDir -Force | Out-Null + } + + $timestamp = Get-Date -Format "yyyyMMdd_HHmmss" + $sessionId = Split-Path $SessionPath -Leaf + $restoreLogFile = "RESTORE_$($sessionId)_$timestamp.log" + $script:RestoreLogPath = Join-Path $logsDir $restoreLogFile + + # Initialize restore log file + $header = @( + "================================================================" + " NoID Privacy - RESTORE LOG" + " Session: $sessionId" + " Restore Started: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" + "================================================================" + "" + ) + $header | Out-File -FilePath $script:RestoreLogPath -Encoding UTF8 + + Write-Log -Level INFO -Message "Restore log initialized: $script:RestoreLogPath" -Module "Rollback" + return $true + } + catch { + Write-Log -Level WARNING -Message "Failed to initialize restore log: $_" -Module "Rollback" + $script:RestoreLogPath = $null + return $false + } +} + +function Write-RestoreLog { + <# + .SYNOPSIS + Write to restore-specific log (in addition to main log) + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$Message, + + [Parameter(Mandatory = $false)] + [ValidateSet('INFO', 'SUCCESS', 'WARNING', 'ERROR', 'DEBUG')] + [string]$Level = 'INFO' + ) + + if (-not $script:RestoreLogPath) { return } + + try { + $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + $logEntry = "[$timestamp] [$Level] $Message" + $logEntry | Out-File -FilePath $script:RestoreLogPath -Append -Encoding UTF8 + } + catch { + # Silently fail to avoid breaking restore operation + $null = $null + } +} + +function Restore-Session { + <# + .SYNOPSIS + Restore complete session (all modules) + + .PARAMETER SessionPath + Path to the session folder + + .PARAMETER ModuleNames + Optional array of specific module names to restore (restores all if not specified) + + .OUTPUTS + Boolean indicating overall success + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [string]$SessionPath, + + [Parameter(Mandatory = $false)] + [string[]]$ModuleNames + ) + + if (-not (Test-Path $SessionPath)) { + Write-Log -Level ERROR -Message "Session path not found: $SessionPath" -Module "Rollback" + return $false + } + + # Track restore duration + $startTime = Get-Date + + # CRITICAL: Initialize separate restore log (ONLY for restore operations) + Initialize-RestoreLog -SessionPath $SessionPath + Write-RestoreLog -Level INFO -Message "========================================" + Write-RestoreLog -Level INFO -Message "RESTORE SESSION START" + Write-RestoreLog -Level INFO -Message "Session Path: $SessionPath" + if ($ModuleNames) { + Write-RestoreLog -Level INFO -Message "Specific Modules: $($ModuleNames -join ', ')" + } else { + Write-RestoreLog -Level INFO -Message "Restoring: ALL modules" + } + Write-RestoreLog -Level INFO -Message "========================================" + Write-RestoreLog -Level INFO -Message " " + + try { + $manifest = Get-SessionManifest -SessionPath $SessionPath + + Write-Log -Level INFO -Message "Starting session restore: $($manifest.sessionId)" -Module "Rollback" + Write-RestoreLog -Level INFO -Message "Session ID: $($manifest.sessionId)" + + Write-Log -Level INFO -Message "Session created: $($manifest.timestamp)" -Module "Rollback" + Write-RestoreLog -Level INFO -Message "Session Created: $($manifest.timestamp)" + + Write-Log -Level INFO -Message "Total items: $($manifest.totalItems)" -Module "Rollback" + Write-RestoreLog -Level INFO -Message "Total Items Backed Up: $($manifest.totalItems)" + Write-RestoreLog -Level INFO -Message " " + + $allSucceeded = $true + $modulesToRestore = if ($ModuleNames) { + $manifest.modules | Where-Object { $ModuleNames -contains $_.name } + } + else { + $manifest.modules + } + + # Restore in reverse order (LIFO - last applied, first restored) + $reversedModules = $modulesToRestore | Sort-Object -Property timestamp -Descending + + foreach ($moduleInfo in $reversedModules) { + Write-Log -Level INFO -Message "Restoring module: $($moduleInfo.name) ($($moduleInfo.itemsBackedUp) items)" -Module "Rollback" + Write-RestoreLog -Level INFO -Message "========================================" + Write-RestoreLog -Level INFO -Message "MODULE: $($moduleInfo.name)" + Write-RestoreLog -Level INFO -Message "Items Backed Up: $($moduleInfo.itemsBackedUp)" + Write-RestoreLog -Level INFO -Message "Backup Path: $($moduleInfo.backupPath)" + Write-RestoreLog -Level INFO -Message "Timestamp: $($moduleInfo.timestamp)" + Write-RestoreLog -Level INFO -Message "========================================" + + $moduleBackupPath = Join-Path $SessionPath $moduleInfo.backupPath + + if (-not (Test-Path $moduleBackupPath)) { + Write-Log -Level ERROR -Message "Module backup path not found: $moduleBackupPath" -Module "Rollback" + Write-RestoreLog -Level ERROR -Message "CRITICAL: Module backup path not found: $moduleBackupPath" + $allSucceeded = $false + continue + } + Write-RestoreLog -Level DEBUG -Message "Backup path verified: $moduleBackupPath" + + # Pre-restore cleanup: Clear active policies BEFORE restoring backups + # This ensures hardened settings don't interfere with backup restore + + if ($moduleInfo.name -eq "SecurityBaseline") { + # Detect domain-joined systems to avoid disrupting domain GPO cache + $isDomainJoined = $false + try { + $cs = Get-CimInstance Win32_ComputerSystem -ErrorAction Stop + $isDomainJoined = $cs.PartOfDomain + } + catch { + $isDomainJoined = $false + } + Write-Log -Level INFO -Message "Restoring SecurityBaseline from LocalGPO backup..." -Module "Rollback" + Write-RestoreLog -Level INFO -Message "[STEP 1] LocalGPO Restore" + + # STEP 1: Restore full LocalGPO directory from backup + # This is the official MS method to restore ALL GPO settings at once + # More reliable than Clear + Restore-RegistryPolicies (avoids permission issues) + $localGPOBackup = Join-Path $moduleBackupPath "LocalGPO" + $localGPOPath = "C:\Windows\System32\GroupPolicy" + Write-RestoreLog -Level DEBUG -Message "LocalGPO backup path: $localGPOBackup" + Write-RestoreLog -Level DEBUG -Message "LocalGPO target path: $localGPOPath" + + if ($isDomainJoined) { + Write-Log -Level WARNING -Message "Domain-joined system detected - skipping LocalGPO delete/restore to avoid interfering with domain GPO cache" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "Domain-joined system - Local Group Policy folder will NOT be modified. Please restore via domain GPO if required." + } + elseif (Test-Path $localGPOBackup) { + Write-Log -Level INFO -Message "Restoring LocalGPO directory from backup..." -Module "Rollback" + Write-RestoreLog -Level INFO -Message "LocalGPO backup found - restoring full directory" + + try { + # Delete current GPO directory if it exists + if (-not $isDomainJoined -and (Test-Path $localGPOPath)) { + Write-RestoreLog -Level DEBUG -Message "Removing current LocalGPO directory..." + Remove-Item -Path $localGPOPath -Recurse -Force -ErrorAction Stop + Write-Log -Level INFO -Message "Removed current LocalGPO directory" -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "Current LocalGPO removed" + } + else { + Write-RestoreLog -Level DEBUG -Message "No current LocalGPO directory to remove" + } + + # Restore backup + Write-RestoreLog -Level DEBUG -Message "Copying LocalGPO backup to system..." + Copy-Item -Path $localGPOBackup -Destination $localGPOPath -Recurse -Force -ErrorAction Stop + Write-Log -Level SUCCESS -Message "LocalGPO directory restored from backup" -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "LocalGPO directory restored successfully" + + # Force Group Policy update to apply restored settings + Write-Log -Level INFO -Message "Applying restored Group Policy settings (gpupdate)..." -Module "Rollback" + Write-RestoreLog -Level INFO -Message "[STEP 1.1] Running gpupdate /force..." + $gpupdateProcess = Start-Process -FilePath "gpupdate.exe" -ArgumentList "/force" -Wait -NoNewWindow -PassThru + Write-RestoreLog -Level DEBUG -Message "gpupdate exit code: $($gpupdateProcess.ExitCode)" + + if ($gpupdateProcess.ExitCode -eq 0) { + Write-Log -Level SUCCESS -Message "Group Policy settings applied successfully" -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "gpupdate completed successfully" + } + else { + Write-Log -Level WARNING -Message "gpupdate returned exit code $($gpupdateProcess.ExitCode) - continuing" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "gpupdate returned non-zero exit code: $($gpupdateProcess.ExitCode)" + } + } + catch { + Write-Log -Level ERROR -Message "Failed to restore LocalGPO directory: $($_.Exception.Message)" -Module "Rollback" + Write-RestoreLog -Level ERROR -Message "LocalGPO restore FAILED: $($_.Exception.Message)" + Write-RestoreLog -Level ERROR -Message "Stack trace: $($_.ScriptStackTrace)" + } + } + else { + Write-Log -Level INFO -Message "No LocalGPO backup found (system was clean before hardening) - clearing current GPO" -Module "Rollback" + Write-RestoreLog -Level INFO -Message "No LocalGPO backup found - system was clean before hardening" + + # System had no GPO before hardening - just clear current GPO + if (Test-Path $localGPOPath) { + try { + Write-RestoreLog -Level DEBUG -Message "Removing current LocalGPO (cleanup)..." + Remove-Item -Path $localGPOPath -Recurse -Force -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Cleared LocalGPO directory (system was clean)" -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "LocalGPO cleared successfully" + } + catch { + Write-Log -Level WARNING -Message "Could not clear LocalGPO: $_" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "LocalGPO cleanup failed: $_" + } + } + else { + Write-RestoreLog -Level DEBUG -Message "No LocalGPO directory exists (correct state)" + } + } + + # STEP 1.5: Explicitly restore registry policies from JSON backup (counter GPO tattooing) + # GPO tattooing: When GPO sets registry values and is then removed, values persist + # Solution: Explicitly restore original values from JSON backup using Restore-RegistryPolicies + Write-RestoreLog -Level INFO -Message "[STEP 2] Registry Policies Restore (counter GPO tattooing)" + $regBackupJson = Join-Path $moduleBackupPath "RegistryPolicies.json" + Write-RestoreLog -Level DEBUG -Message "Registry backup JSON: $regBackupJson" + if (Test-Path $regBackupJson) { + Write-Log -Level INFO -Message "Restoring registry policies from JSON backup (countering GPO tattooing)..." -Module "Rollback" + Write-RestoreLog -Level INFO -Message "Registry backup found - restoring original values" + + try { + # Load restore function if not in scope + if (-not (Get-Command "Restore-RegistryPolicies" -ErrorAction SilentlyContinue)) { + Write-RestoreLog -Level DEBUG -Message "Loading Restore-RegistryPolicies function..." + $funcPath = Join-Path $PSScriptRoot "..\Modules\SecurityBaseline\Private\Restore-RegistryPolicies.ps1" + Write-RestoreLog -Level DEBUG -Message "Function path: $funcPath" + if (Test-Path $funcPath) { + . $funcPath + Write-Log -Level DEBUG -Message "Loaded Restore-RegistryPolicies function" -Module "Rollback" + Write-RestoreLog -Level DEBUG -Message "Function loaded successfully" + } + else { + Write-Log -Level WARNING -Message "Restore-RegistryPolicies.ps1 not found - skipping explicit registry restore" -Module "Rollback" + Write-RestoreLog -Level ERROR -Message "Restore-RegistryPolicies.ps1 NOT FOUND - registry restore skipped!" + } + } + else { + Write-RestoreLog -Level DEBUG -Message "Restore-RegistryPolicies function already loaded" + } + + if (Get-Command "Restore-RegistryPolicies" -ErrorAction SilentlyContinue) { + Write-RestoreLog -Level DEBUG -Message "Calling Restore-RegistryPolicies..." + # Call restore function directly with combined JSON backup + $restoreResult = Restore-RegistryPolicies -BackupPath $regBackupJson + Write-RestoreLog -Level DEBUG -Message "Restore function returned - Success: $($restoreResult.Success)" + + if ($restoreResult.Success) { + Write-Log -Level SUCCESS -Message "Registry policies restored: $($restoreResult.ItemsRestored) items (GPO tattooing countered)" -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "Registry policies restored: $($restoreResult.ItemsRestored) items" + } + else { + Write-Log -Level WARNING -Message "Registry restore had errors: $($restoreResult.Errors.Count) errors" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "Registry restore had $($restoreResult.Errors.Count) errors:" + foreach ($err in $restoreResult.Errors) { + Write-Log -Level DEBUG -Message " - $err" -Module "Rollback" + Write-RestoreLog -Level ERROR -Message " - $err" + } + } + + # CRITICAL FIX: Terminal Services GPO Cleanup + # After restore, the Terminal Services key may exist but be empty (all values deleted). + # Verify checks expect the key to NOT exist if system was clean before apply. + # Solution: Remove the key if it's completely empty after restore. + Write-RestoreLog -Level INFO -Message "[FIX 2/3] Checking Terminal Services GPO cleanup..." + $tsKey = "HKLM:\Software\Policies\Microsoft\Windows NT\Terminal Services" + if (Test-Path $tsKey) { + Write-RestoreLog -Level DEBUG -Message "Terminal Services key exists: $tsKey" + try { + $tsProps = Get-ItemProperty -Path $tsKey -ErrorAction SilentlyContinue + $propNames = @() + if ($tsProps) { + $propNames = $tsProps.PSObject.Properties.Name | Where-Object { + $_ -notin @('PSPath', 'PSParentPath', 'PSChildName', 'PSProvider', 'PSDrive') + } + } + Write-RestoreLog -Level DEBUG -Message "Terminal Services key value count: $($propNames.Count)" + + if ($propNames.Count -eq 0) { + Remove-Item -Path $tsKey -Recurse -Force -ErrorAction SilentlyContinue + Write-Log -Level INFO -Message "Removed empty Terminal Services policy key (GPO cleanup - system was clean before hardening)" -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "Terminal Services key removed (was empty - system was clean)" + } + else { + Write-Log -Level DEBUG -Message "Terminal Services key has $($propNames.Count) values - keeping key" -Module "Rollback" + Write-RestoreLog -Level INFO -Message "Terminal Services key has $($propNames.Count) values - keeping key" + Write-RestoreLog -Level DEBUG -Message "Values: $($propNames -join ', ')" + } + } + catch { + Write-Log -Level DEBUG -Message "Could not check/clean Terminal Services key: $_" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "Terminal Services cleanup failed: $_" + } + } + else { + Write-RestoreLog -Level DEBUG -Message "Terminal Services key does not exist (correct state)" + } + } + } + catch { + Write-Log -Level WARNING -Message "Failed to restore registry policies from JSON: $($_.Exception.Message)" -Module "Rollback" + Write-RestoreLog -Level ERROR -Message "Registry restore exception: $($_.Exception.Message)" + Write-RestoreLog -Level ERROR -Message "Stack trace: $($_.ScriptStackTrace)" + } + } + else { + Write-Log -Level WARNING -Message "No RegistryPolicies.json backup found - GPO restore only (tattooing may occur)" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "No RegistryPolicies.json backup found - GPO tattooing may occur!" + } + + # STEP 3: Restore Audit Policies from pre-hardening backup + Write-RestoreLog -Level INFO -Message "[STEP 3] Audit Policies Restore" + $auditBackupFile = Join-Path $moduleBackupPath "AuditPolicies.csv" + Write-RestoreLog -Level DEBUG -Message "Audit backup file: $auditBackupFile" + if (Test-Path $auditBackupFile) { + Write-Log -Level INFO -Message "Found audit policy backup" -Module "Rollback" + Write-RestoreLog -Level INFO -Message "Audit backup found - restoring..." + Write-Log -Level INFO -Message "Restoring audit policies from backup..." -Module "Rollback" + + try { + $auditRestoreProcess = Start-Process -FilePath "auditpol.exe" ` + -ArgumentList "/restore", "/file:`"$auditBackupFile`"" ` + -Wait ` + -NoNewWindow ` + -PassThru + + if ($auditRestoreProcess.ExitCode -eq 0) { + Write-Log -Level SUCCESS -Message "Audit policies restored from pre-hardening backup" -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "Audit policies restored successfully" + } + else { + Write-Log -Level WARNING -Message "Audit policy restore had errors (Exit: $($auditRestoreProcess.ExitCode)) - continuing" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "Audit restore had errors (Exit: $($auditRestoreProcess.ExitCode))" + } + } + catch { + Write-Log -Level WARNING -Message "Audit policy restore failed: $_ - continuing" -Module "Rollback" + Write-RestoreLog -Level ERROR -Message "Audit restore exception: $_" + } + } + else { + Write-Log -Level WARNING -Message "No pre-hardening audit policy backup found - skipping audit restore (keeping current state)" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "No audit backup found - skipping" + } + + # STEP 3.5: Clear Security Template Registry Values not in secedit export + # CRITICAL FIX: secedit /export only exports values explicitly set in Security DB. + # Values on Windows-Default are NOT exported, so they won't be restored by secedit /configure. + # These 8 values are set by SecurityBaseline but may not exist in backup INF: + Write-RestoreLog -Level INFO -Message "[STEP 3.5] Clearing Security Template Registry Values (secedit gap fix)" + $secTemplateRegValues = @( + @{ Path = "HKLM:\System\CurrentControlSet\Services\LanmanWorkstation\Parameters"; Name = "RequireSecuritySignature" }, + @{ Path = "HKLM:\System\CurrentControlSet\Control\Lsa\MSV1_0"; Name = "allownullsessionfallback" }, + @{ Path = "HKLM:\System\CurrentControlSet\Control\Lsa"; Name = "LmCompatibilityLevel" }, + @{ Path = "HKLM:\System\CurrentControlSet\Control\Lsa"; Name = "SCENoApplyLegacyAuditPolicy" }, + @{ Path = "HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters"; Name = "requiresecuritysignature" }, + @{ Path = "HKLM:\System\CurrentControlSet\Control\Lsa"; Name = "RestrictRemoteSAM" }, + @{ Path = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System"; Name = "FilterAdministratorToken" }, + @{ Path = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System"; Name = "InactivityTimeoutSecs" } + ) + + $clearedSecTemplateValues = 0 + foreach ($regVal in $secTemplateRegValues) { + try { + if (Test-Path $regVal.Path) { + $existingVal = Get-ItemProperty -Path $regVal.Path -Name $regVal.Name -ErrorAction SilentlyContinue + if ($existingVal) { + Remove-ItemProperty -Path $regVal.Path -Name $regVal.Name -Force -ErrorAction Stop + $clearedSecTemplateValues++ + Write-RestoreLog -Level DEBUG -Message "Cleared: $($regVal.Path)\$($regVal.Name)" + } + } + } + catch { + Write-RestoreLog -Level DEBUG -Message "Could not clear $($regVal.Path)\$($regVal.Name): $_" + } + } + Write-RestoreLog -Level SUCCESS -Message "Cleared $clearedSecTemplateValues Security Template registry values (secedit gap)" + + # STEP 4: Restore Security Template + Write-RestoreLog -Level INFO -Message "[STEP 4] Security Template Restore" + + # Fail-Safe for Restore-SecurityTemplate (Module Scope Fix) + if (-not (Get-Command "Restore-SecurityTemplate" -ErrorAction SilentlyContinue)) { + $funcPath = Join-Path $PSScriptRoot "..\Modules\SecurityBaseline\Private\Restore-SecurityTemplate.ps1" + if (Test-Path $funcPath) { . $funcPath } + } + + $rollbackTemplateFile = Join-Path $moduleBackupPath "StandaloneDelta_Rollback.inf" + if (Test-Path $rollbackTemplateFile) { + Write-Log -Level INFO -Message "Found rollback template for standalone delta" -Module "Rollback" + Write-RestoreLog -Level INFO -Message "Using StandaloneDelta_Rollback.inf" + $secTemplatResult = Restore-SecurityTemplate -BackupPath $rollbackTemplateFile + } + else { + Write-Log -Level INFO -Message "No rollback template found - using full security policy backup (expected)" -Module "Rollback" + Write-RestoreLog -Level DEBUG -Message "No StandaloneDelta - using SecurityTemplate.inf" + $secPolicyBackupFile = Join-Path $moduleBackupPath "SecurityTemplate.inf" + if (Test-Path $secPolicyBackupFile) { + Write-Log -Level INFO -Message "Found security template backup" -Module "Rollback" + Write-RestoreLog -Level INFO -Message "Security template backup found - restoring via secedit..." + $secTemplatResult = Restore-SecurityTemplate -BackupPath $secPolicyBackupFile + Write-RestoreLog -Level SUCCESS -Message "Security template restored" + } + else { + Write-Log -Level WARNING -Message "No security policy backups found - skipping secedit restore" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "No security template backup found - skipping" + $secTemplatResult = $true + } + } + + if (-not $secTemplatResult) { + Write-Log -Level WARNING -Message "Security template restore had errors - continuing" -Module "Rollback" + } + + # STEP 5: Restore Xbox Task if it was disabled + $xboxTaskBackup = Join-Path $moduleBackupPath "XboxTask.json" + if (Test-Path $xboxTaskBackup) { + try { + $taskData = Get-Content $xboxTaskBackup -Raw | ConvertFrom-Json + + if ($taskData.TaskExists -and $taskData.WasEnabled) { + Write-Log -Level INFO -Message "Re-enabling Xbox scheduled task (was enabled before hardening)..." -Module "Rollback" + + Enable-ScheduledTask -TaskName $taskData.TaskName -TaskPath $taskData.TaskPath -ErrorAction Stop | Out-Null + Write-Log -Level SUCCESS -Message "Xbox task re-enabled: $($taskData.TaskName)" -Module "Rollback" + } + else { + Write-Log -Level INFO -Message "Xbox task was not enabled before hardening - leaving disabled" -Module "Rollback" + } + } + catch { + Write-Log -Level WARNING -Message "Failed to restore Xbox task state: $_" -Module "Rollback" + } + } + } + + if ($moduleInfo.name -eq "ASR") { + Write-Log -Level INFO -Message "Clearing ASR configuration before restore..." -Module "Rollback" + Write-RestoreLog -Level INFO -Message "[ASR] Clearing all ASR configurations..." + + # Clear MpPreference-based ASR rules + $asrClearResult = Clear-ASRRules + if (-not $asrClearResult) { + Write-Log -Level WARNING -Message "ASR rules clear had errors - continuing" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "MpPreference ASR clear had errors" + } + else { + Write-RestoreLog -Level SUCCESS -Message "MpPreference ASR rules cleared" + } + + # CRITICAL: Also clear Registry-based ASR rules (set by SecurityBaseline via GPO) + # These are in: HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules + $asrPolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR" + $asrRulesPath = "$asrPolicyPath\Rules" + try { + if (Test-Path $asrRulesPath) { + Remove-Item -Path $asrRulesPath -Recurse -Force -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Cleared Registry-based ASR rules (GPO path)" -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "Registry ASR rules cleared (GPO path)" + } + if (Test-Path $asrPolicyPath) { + # Also remove the ExploitGuard_ASR_Rules flag from the parent key + Remove-ItemProperty -Path $asrPolicyPath -Name "ExploitGuard_ASR_Rules" -ErrorAction SilentlyContinue + Write-RestoreLog -Level DEBUG -Message "Removed ExploitGuard_ASR_Rules flag" + } + } + catch { + Write-Log -Level WARNING -Message "Could not clear Registry ASR rules: $_" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "Registry ASR clear error: $_" + } + + # CRITICAL FIX: In multi-module sessions, SecurityBaseline applies 15 ASR rules BEFORE + # the ASR module runs. This means ASR_ActiveConfiguration.json captures the WRONG state + # (post-SecurityBaseline, not pre-hardening). PreFramework_Snapshot.json is created + # BEFORE any module runs and has the TRUE pre-hardening state. + # + # Priority order: + # 1. PreFramework_Snapshot.json (if exists) - TRUE pre-hardening state + # 2. ASR_ActiveConfiguration.json (fallback) - only correct for single-module ASR runs + + $preFrameworkPath = Join-Path $SessionPath "PreFramework_Snapshot.json" + $usePreFramework = $false + $asrRulesToRestore = @() + + if (Test-Path $preFrameworkPath) { + Write-Log -Level INFO -Message "Found PreFramework_Snapshot.json - using TRUE pre-hardening ASR state" -Module "Rollback" + Write-RestoreLog -Level INFO -Message "Using PreFramework_Snapshot.json for TRUE pre-hardening state" + try { + $preFramework = Get-Content $preFrameworkPath -Raw | ConvertFrom-Json + if ($preFramework.ASR) { + $usePreFramework = $true + # Build rules array from PreFramework snapshot + if ($preFramework.ASR.RuleIds -and $preFramework.ASR.RuleIds.Count -gt 0) { + for ($i = 0; $i -lt $preFramework.ASR.RuleIds.Count; $i++) { + if ($preFramework.ASR.RuleActions[$i] -ne 0) { + $asrRulesToRestore += @{ + GUID = $preFramework.ASR.RuleIds[$i] + Action = $preFramework.ASR.RuleActions[$i] + } + } + } + } + Write-Log -Level DEBUG -Message "PreFramework snapshot: $($preFramework.ASR.RuleCount) total rules, $($asrRulesToRestore.Count) active" -Module "Rollback" + } + } + catch { + Write-Log -Level WARNING -Message "Failed to parse PreFramework_Snapshot.json: $_ - falling back to module backup" -Module "Rollback" + $usePreFramework = $false + } + } + + # Fallback to module-level backup if PreFramework not available + if (-not $usePreFramework) { + $asrMpPrefBackup = Get-ChildItem -Path $moduleBackupPath -Filter "ASR_ActiveConfiguration.json" -ErrorAction SilentlyContinue | Select-Object -First 1 + + if ($asrMpPrefBackup) { + Write-Log -Level INFO -Message "Using ASR_ActiveConfiguration.json (single-module or legacy backup)" -Module "Rollback" + try { + $asrBackupData = Get-Content $asrMpPrefBackup.FullName -Raw | ConvertFrom-Json + if ($asrBackupData.Rules) { + $asrRulesToRestore = $asrBackupData.Rules | Where-Object { $_.Action -ne 0 } + } + } + catch { + Write-Log -Level ERROR -Message "Failed to parse ASR_ActiveConfiguration.json: $_" -Module "Rollback" + } + } + else { + Write-Log -Level WARNING -Message "No ASR backup found - ASR rules will remain cleared" -Module "Rollback" + } + } + + # Apply the rules (from either source) + if ($asrRulesToRestore.Count -gt 0) { + try { + $ruleIds = $asrRulesToRestore | ForEach-Object { $_.GUID } + $ruleActions = $asrRulesToRestore | ForEach-Object { $_.Action } + + Set-MpPreference -AttackSurfaceReductionRules_Ids $ruleIds ` + -AttackSurfaceReductionRules_Actions $ruleActions ` + -ErrorAction Stop + + $sourceDesc = if ($usePreFramework) { "PreFramework snapshot (TRUE pre-hardening)" } else { "ASR_ActiveConfiguration.json" } + Write-Log -Level SUCCESS -Message "ASR rules restored via Set-MpPreference ($($asrRulesToRestore.Count) active rules from $sourceDesc)" -Module "Rollback" + } + catch { + Write-Log -Level ERROR -Message "Failed to restore ASR via Set-MpPreference: $_" -Module "Rollback" + $allSucceeded = $false + } + } + else { + # System had 0 active ASR rules before hardening (Clean State) + # Clear-ASRRules already did the job, and Registry rules were also cleared. + $sourceDesc = if ($usePreFramework) { "PreFramework snapshot" } else { "ASR backup" } + Write-Log -Level SUCCESS -Message "ASR: $sourceDesc contains 0 active rules. System restored to clean state (0/19 ASR rules)." -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "ASR restored to clean state (0 rules) from $sourceDesc" + } + } + + # Restore all registry backups for this module + $regFiles = Get-ChildItem -Path $moduleBackupPath -Filter "*_Registry.reg" -ErrorAction SilentlyContinue + foreach ($regFile in $regFiles) { + # Special handling for AuditPolicy registry - just delete the value instead of importing + if ($regFile.Name -match "AuditPolicy_SCENoApplyLegacyAuditPolicy") { + try { + Write-Log -Level INFO -Message "Removing SCENoApplyLegacyAuditPolicy registry value..." -Module "Rollback" + Remove-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "SCENoApplyLegacyAuditPolicy" -ErrorAction SilentlyContinue + Write-Log -Level SUCCESS -Message "SCENoApplyLegacyAuditPolicy removed" -Module "Rollback" + } + catch { + Write-Log -Level WARNING -Message "Could not remove SCENoApplyLegacyAuditPolicy (may not exist)" -Module "Rollback" + } + } + else { + $success = Restore-FromBackup -BackupFile $regFile.FullName -Type "Registry" + if (-not $success) { + # Check if we have a JSON fallback (Smart Warning Suppression) + $isProtectedKey = $false + if ($moduleInfo.name -eq "AntiAI" -and $regFile.Name -match "Explorer_Advanced_Device_Registry") { $isProtectedKey = $true } + if ($moduleInfo.name -eq "AdvancedSecurity" -and ($regFile.Name -match "RDP_Settings" -or $regFile.Name -match "WPAD_")) { $isProtectedKey = $true } + + if ($isProtectedKey) { + Write-Log -Level INFO -Message "Standard registry import skipped for protected key (will use Smart JSON-Fallback)." -Module "Rollback" + } + else { + Write-Log -Level WARNING -Message "Registry restore failed for: $($regFile.Name) - continuing..." -Module "Rollback" + } + # Don't fail entire restore for registry errors - continue with other restores + } + } + } + + # Special handling for protected registry keys (RDP, WPAD) that fail with reg.exe import + # These keys require PowerShell-based restore from JSON backups + if ($moduleInfo.name -eq "AntiAI") { + # Explorer Advanced Settings - use JSON backup if .reg import failed + $expJsonBackup = Get-ChildItem -Path $moduleBackupPath -Filter "Explorer_Advanced_Device_JSON.json" -ErrorAction SilentlyContinue | Select-Object -First 1 + if ($expJsonBackup) { + Write-Log -Level INFO -Message "Restoring Explorer Advanced settings via PowerShell (protected key)..." -Module "Rollback" + try { + $expData = Get-Content $expJsonBackup.FullName -Raw | ConvertFrom-Json + if ($null -ne $expData.ShowCopilotButton) { + $expPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" + if (Test-Path $expPath) { + Set-ItemProperty -Path $expPath -Name "ShowCopilotButton" -Value $expData.ShowCopilotButton -Force -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Explorer Advanced settings restored via PowerShell" -Module "Rollback" + } + } + } catch { + Write-Log -Level WARNING -Message "PowerShell-based Explorer restore failed: $($_.Exception.Message)" -Module "Rollback" + } + } + + # Apply AntiAI pre-state snapshot (32 policies) if available + $antiAIPreStatePath = Join-Path $moduleBackupPath "AntiAI_PreState.json" + if (Test-Path $antiAIPreStatePath) { + Write-Log -Level INFO -Message "Restoring AntiAI pre-state snapshot (32 policies)..." -Module "Rollback" + try { + $preEntries = Get-Content $antiAIPreStatePath -Raw | ConvertFrom-Json + + foreach ($entry in $preEntries) { + if (-not $entry.Path -or -not $entry.Name) { continue } + + if ($entry.Exists) { + # Value existed before hardening - restore original value/type + $keyPath = $entry.Path + try { + if (-not (Test-Path $keyPath)) { + New-Item -Path $keyPath -Force | Out-Null + } + + $regType = switch ($entry.Type) { + "DWord" { "DWord" } + "String" { "String" } + "MultiString" { "MultiString" } + default { "String" } + } + + $existing = Get-ItemProperty -Path $keyPath -Name $entry.Name -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $keyPath -Name $entry.Name -Value $entry.Value -Force -ErrorAction SilentlyContinue + } + else { + New-ItemProperty -Path $keyPath -Name $entry.Name -Value $entry.Value -PropertyType $regType -Force -ErrorAction SilentlyContinue | Out-Null + } + } + catch { + Write-Log -Level WARNING -Message "Failed to restore AntiAI value $($entry.Path)\$($entry.Name): $($_.Exception.Message)" -Module "Rollback" + } + } + else { + # Value did not exist before hardening - was created during hardening, so remove it + try { + if (Test-Path $entry.Path) { + Remove-ItemProperty -Path $entry.Path -Name $entry.Name -ErrorAction SilentlyContinue + } + } + catch { + Write-Log -Level DEBUG -Message "AntiAI pre-state cleanup: could not remove $($entry.Path)\$($entry.Name) - $($_.Exception.Message)" -Module "Rollback" + } + } + } + + Write-Log -Level SUCCESS -Message "AntiAI pre-state snapshot applied successfully" -Module "Rollback" + } + catch { + Write-Log -Level WARNING -Message "Failed to apply AntiAI pre-state snapshot: $($_.Exception.Message)" -Module "Rollback" + } + } + } + + if ($moduleInfo.name -eq "AdvancedSecurity") { + # RDP Settings - use JSON backup if .reg import failed + $rdpJsonBackup = Get-ChildItem -Path $moduleBackupPath -Filter "RDP_Hardening.json" -ErrorAction SilentlyContinue | Select-Object -First 1 + if ($rdpJsonBackup) { + Write-Log -Level INFO -Message "Restoring RDP settings via PowerShell (protected key)..." -Module "Rollback" + try { + $rdpData = Get-Content $rdpJsonBackup.FullName -Raw | ConvertFrom-Json + + $policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" + $systemPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" + + # Restore Policy settings (if backed up) + if ($null -ne $rdpData.Policy_UserAuthentication) { + if (Test-Path $policyPath) { + Set-ItemProperty -Path $policyPath -Name "UserAuthentication" -Value $rdpData.Policy_UserAuthentication -Force -ErrorAction Stop + } + } + if ($null -ne $rdpData.Policy_SecurityLayer) { + if (Test-Path $policyPath) { + Set-ItemProperty -Path $policyPath -Name "SecurityLayer" -Value $rdpData.Policy_SecurityLayer -Force -ErrorAction Stop + } + } + + # Restore System settings (if backed up) + if ($null -ne $rdpData.System_fDenyTSConnections) { + if (Test-Path $systemPath) { + Set-ItemProperty -Path $systemPath -Name "fDenyTSConnections" -Value $rdpData.System_fDenyTSConnections -Force -ErrorAction Stop + } + } + + Write-Log -Level SUCCESS -Message "RDP settings restored via PowerShell" -Module "Rollback" + } + catch { + Write-Log -Level WARNING -Message "PowerShell-based RDP restore failed: $($_.Exception.Message)" -Module "Rollback" + } + } + else { + Write-Log -Level INFO -Message "RDP_Hardening.json backup not found (backup created before JSON feature was added)" -Module "Rollback" + Write-Log -Level INFO -Message "RDP settings cannot be fully restored from this backup - create new backup for complete restore" -Module "Rollback" + } + + # WPAD Settings - use JSON backup if .reg import failed + $wpadJsonBackup = Get-ChildItem -Path $moduleBackupPath -Filter "WPAD.json" -ErrorAction SilentlyContinue | Select-Object -First 1 + if ($wpadJsonBackup) { + Write-Log -Level INFO -Message "Restoring WPAD settings via PowerShell (protected key)..." -Module "Rollback" + try { + $wpadData = Get-Content $wpadJsonBackup.FullName -Raw | ConvertFrom-Json + + # WPAD JSON format: { "FullPath\\ValueName": value } + foreach ($property in $wpadData.PSObject.Properties) { + $fullPath = $property.Name + $lastBackslash = $fullPath.LastIndexOf('\') + + if ($lastBackslash -gt 0) { + $keyPath = $fullPath.Substring(0, $lastBackslash) + $valueName = $fullPath.Substring($lastBackslash + 1) + + if ($null -ne $property.Value -and (Test-Path $keyPath)) { + Set-ItemProperty -Path $keyPath -Name $valueName -Value $property.Value -Force -ErrorAction Stop + } + } + } + + Write-Log -Level SUCCESS -Message "WPAD settings restored via PowerShell" -Module "Rollback" + } + catch { + Write-Log -Level WARNING -Message "PowerShell-based WPAD restore failed: $($_.Exception.Message)" -Module "Rollback" + } + } + else { + Write-Log -Level INFO -Message "WPAD.json backup not found (backup created before JSON feature was added)" -Module "Rollback" + Write-Log -Level INFO -Message "WPAD settings cannot be fully restored from this backup - create new backup for complete restore" -Module "Rollback" + } + } + + # Handle Empty Markers: Delete registry keys that didn't exist before hardening + $emptyMarkers = Get-ChildItem -Path $moduleBackupPath -Filter "*_EMPTY.json" -ErrorAction SilentlyContinue + foreach ($marker in $emptyMarkers) { + try { + $markerData = Get-Content $marker.FullName -Raw | ConvertFrom-Json + + if ($markerData.State -eq "NotExisted" -and $markerData.KeyPath) { + Write-Log -Level INFO -Message "Processing empty marker: Registry key '$($markerData.KeyPath)' did not exist before hardening - deleting..." -Module "Rollback" + + if (Test-Path $markerData.KeyPath) { + Remove-Item -Path $markerData.KeyPath -Recurse -Force -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Deleted registry key (did not exist before hardening): $($markerData.KeyPath)" -Module "Rollback" + } + else { + Write-Log -Level INFO -Message "Registry key already doesn't exist: $($markerData.KeyPath)" -Module "Rollback" + } + } + } + catch { + Write-Log -Level WARNING -Message "Failed to process empty marker $($marker.Name): $_" -Module "Rollback" + } + } + + # Restore all service backups for this module + $serviceFiles = Get-ChildItem -Path $moduleBackupPath -Filter "*_Service.json" -ErrorAction SilentlyContinue + foreach ($serviceFile in $serviceFiles) { + $success = Restore-FromBackup -BackupFile $serviceFile.FullName -Type "Service" + if (-not $success) { + $allSucceeded = $false + } + } + + # Restore all task backups for this module + $taskFiles = Get-ChildItem -Path $moduleBackupPath -Filter "*_Task.xml" -ErrorAction SilentlyContinue + foreach ($taskFile in $taskFiles) { + $success = Restore-FromBackup -BackupFile $taskFile.FullName -Type "ScheduledTask" + if (-not $success) { + $allSucceeded = $false + } + } + + # Special handling for DNS: Restore DNS settings from backup + if ($moduleInfo.name -eq "DNS") { + Write-Log -Level INFO -Message "Restoring DNS settings from backup..." -Module "Rollback" + + # Find DNS backup file + $dnsBackupFile = Get-ChildItem -Path $moduleBackupPath -Filter "*.json" -ErrorAction SilentlyContinue | Select-Object -First 1 + + if ($dnsBackupFile) { + Write-Log -Level INFO -Message "Found DNS backup: $($dnsBackupFile.Name)" -Module "Rollback" + + # Load DNS module for restore + $dnsModulePath = Join-Path (Split-Path $PSScriptRoot -Parent) "Modules\DNS\DNS.psd1" + if (Test-Path $dnsModulePath) { + try { + Import-Module $dnsModulePath -Force -ErrorAction Stop + + # Call DNS module's restore function + $restoreResult = Restore-DNSSettings -BackupFilePath $dnsBackupFile.FullName + + if ($restoreResult) { + Write-Log -Level SUCCESS -Message "DNS settings restored successfully" -Module "Rollback" + } + else { + Write-Log -Level WARNING -Message "DNS restore had issues - check logs" -Module "Rollback" + $allSucceeded = $false + } + + Remove-Module DNS -ErrorAction SilentlyContinue + } + catch { + Write-Log -Level ERROR -Message "Failed to restore DNS settings: $_" -Module "Rollback" + $allSucceeded = $false + } + } + else { + Write-Log -Level WARNING -Message "DNS module not found - cannot restore DNS settings" -Module "Rollback" + $allSucceeded = $false + } + } + else { + Write-Log -Level WARNING -Message "No DNS backup file found in: $moduleBackupPath" -Module "Rollback" + } + } + + # Special handling for EdgeHardening: Restore Edge policy pre-state snapshot + if ($moduleInfo.name -eq "EdgeHardening") { + $edgePreStatePath = Join-Path $moduleBackupPath "EdgeHardening_PreState.json" + if (Test-Path $edgePreStatePath) { + Write-Log -Level INFO -Message "Restoring Edge policy pre-state snapshot..." -Module "Rollback" + try { + $preEntries = Get-Content $edgePreStatePath -Raw | ConvertFrom-Json + + $edgeRoot = "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Edge" + if (Test-Path $edgeRoot) { + $keysToProcess = @() + $keysToProcess += $edgeRoot + $childKeys = Get-ChildItem -Path $edgeRoot -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.PSIsContainer } + foreach ($child in $childKeys) { + $keysToProcess += $child.PSPath + } + + foreach ($keyPath in $keysToProcess) { + try { + $currentProps = Get-ItemProperty -Path $keyPath -ErrorAction SilentlyContinue + if ($currentProps) { + $propNames = $currentProps.PSObject.Properties.Name | Where-Object { $_ -notin @('PSPath', 'PSParentPath', 'PSChildName', 'PSProvider', 'PSDrive') } + foreach ($prop in $propNames) { + Remove-ItemProperty -Path $keyPath -Name $prop -ErrorAction SilentlyContinue + } + } + } + catch { + Write-Log -Level DEBUG -Message "Could not clear $keyPath : $_" -Module "Rollback" + } + } + } + + $restoredCount = 0 + foreach ($entry in $preEntries) { + if (-not $entry.Path -or -not $entry.Name) { continue } + + try { + if (-not (Test-Path $entry.Path)) { + New-Item -Path $entry.Path -Force -ErrorAction Stop | Out-Null + } + + $regType = switch ($entry.Type) { + "DWord" { "DWord" } + "String" { "String" } + "MultiString" { "MultiString" } + "ExpandString" { "ExpandString" } + "Binary" { "Binary" } + "QWord" { "QWord" } + default { "String" } + } + + New-ItemProperty -Path $entry.Path -Name $entry.Name -Value $entry.Value -PropertyType $regType -Force -ErrorAction Stop | Out-Null + $restoredCount++ + } + catch { + Write-Log -Level DEBUG -Message "Failed to restore Edge policy value $($entry.Path)\\$($entry.Name): $_" -Module "Rollback" + } + } + + Write-Log -Level SUCCESS -Message "Edge policy pre-state restored ($restoredCount values)" -Module "Rollback" + } + catch { + Write-Log -Level WARNING -Message "Failed to restore EdgeHardening pre-state snapshot: $_" -Module "Rollback" + } + } + else { + Write-Log -Level INFO -Message "No EdgeHardening pre-state snapshot found - using .reg restore + empty markers only" -Module "Rollback" + } + } + + # Special handling for Privacy: Restore registry snapshot + removed apps + if ($moduleInfo.name -eq "Privacy") { + # STEP 1: Restore Privacy registry pre-state snapshot (counters GPO tattooing) + $privacyPreStatePath = Join-Path $moduleBackupPath "Privacy_PreState.json" + if (Test-Path $privacyPreStatePath) { + Write-Log -Level INFO -Message "Restoring Privacy registry pre-state snapshot..." -Module "Rollback" + try { + $preEntries = Get-Content $privacyPreStatePath -Raw | ConvertFrom-Json + + # Build list of all keys to clear first (must match Backup-PrivacySettings list) + # CRITICAL: Include ALL keys that Privacy module modifies, including HKCU user settings! + $keysToProcess = @( + # HKLM Policy keys + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer", + "HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\SettingSync", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy", + "HKLM:\SOFTWARE\Policies\Microsoft\OneDrive", + "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore", + "HKLM:\SOFTWARE\Policies\Microsoft\Dsh", + "HKLM:\SOFTWARE\Policies\Microsoft\FindMyDevice", + "HKLM:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics", + # HKCU Policy keys + "HKCU:\Software\Policies\Microsoft\Windows\Explorer", + # HKCU User settings (FIX: these were missing, causing restore incomplete!) + "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\SearchSettings", + "HKCU:\Control Panel\International\User Profile", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\SystemSettings\AccountNotifications", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement", + "HKCU:\SOFTWARE\Microsoft\Personalization\Settings", + # NEW: Input Personalization Settings (v2.2.0 - FIX missing HKCU restore) + "HKCU:\SOFTWARE\Microsoft\InputPersonalization", + "HKCU:\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics" + ) + + # Clear all current values in Privacy keys (prepare clean slate) + foreach ($keyPath in $keysToProcess) { + if (Test-Path $keyPath) { + try { + $currentProps = Get-ItemProperty -Path $keyPath -ErrorAction SilentlyContinue + if ($currentProps) { + $propNames = $currentProps.PSObject.Properties.Name | Where-Object { $_ -notin @('PSPath', 'PSParentPath', 'PSChildName', 'PSProvider') } + foreach ($prop in $propNames) { + Remove-ItemProperty -Path $keyPath -Name $prop -ErrorAction SilentlyContinue + } + } + } catch { + Write-Log -Level DEBUG -Message "Could not clear $keyPath : $_" -Module "Rollback" + } + } + } + + # Restore original values from snapshot + $restoredCount = 0 + foreach ($entry in $preEntries) { + if (-not $entry.Path -or -not $entry.Name) { continue } + + try { + if (-not (Test-Path $entry.Path)) { + New-Item -Path $entry.Path -Force -ErrorAction Stop | Out-Null + } + + $regType = switch ($entry.Type) { + "DWord" { "DWord" } + "String" { "String" } + "MultiString" { "MultiString" } + "ExpandString" { "ExpandString" } + "Binary" { "Binary" } + default { "String" } + } + + New-ItemProperty -Path $entry.Path -Name $entry.Name -Value $entry.Value -PropertyType $regType -Force -ErrorAction Stop | Out-Null + $restoredCount++ + } + catch { + Write-Log -Level DEBUG -Message "Failed to restore Privacy value $($entry.Path)\$($entry.Name): $_" -Module "Rollback" + } + } + + Write-Log -Level SUCCESS -Message "Privacy registry pre-state restored ($restoredCount values)" -Module "Rollback" + } + catch { + Write-Log -Level WARNING -Message "Failed to restore Privacy pre-state snapshot: $_" -Module "Rollback" + } + } + else { + Write-Log -Level WARNING -Message "No Privacy pre-state snapshot found - using .reg restore only (tattooing may occur)" -Module "Rollback" + } + + # STEP 2: Restore removed apps via winget (if metadata exists) + Write-Log -Level INFO -Message "Restoring removed apps for Privacy module (winget) if applicable..." -Module "Rollback" + + $privacyModulePath = Join-Path (Split-Path $PSScriptRoot -Parent) "Modules\Privacy\Privacy.psd1" + if (Test-Path $privacyModulePath) { + try { + Import-Module $privacyModulePath -Force -ErrorAction Stop + + if (Get-Command Restore-Bloatware -ErrorAction SilentlyContinue) { + $restoreAppsResult = Restore-Bloatware -BackupPath $moduleBackupPath + + # Restore-Bloatware now returns PSCustomObject with Success and NonRestorableApps properties + if ($restoreAppsResult.Success) { + Write-Log -Level SUCCESS -Message "Privacy apps restore (winget) completed" -Module "Rollback" + } + else { + Write-Log -Level WARNING -Message "Privacy apps restore (winget) reported issues - check logs" -Module "Rollback" + $allSucceeded = $false + } + + # Track non-restorable apps for user notification before reboot + if ($restoreAppsResult.NonRestorableApps -and $restoreAppsResult.NonRestorableApps.Count -gt 0) { + $script:PrivacyNonRestorableApps = $restoreAppsResult.NonRestorableApps + } + } + else { + Write-Log -Level WARNING -Message "Restore-Bloatware function not found in Privacy module - skipping app restore" -Module "Rollback" + } + + Remove-Module Privacy -ErrorAction SilentlyContinue + } + catch { + Write-Log -Level ERROR -Message "Failed to restore Privacy apps via winget: $_" -Module "Rollback" + $allSucceeded = $false + } + } + else { + Write-Log -Level WARNING -Message "Privacy module not found - cannot restore removed apps" -Module "Rollback" + } + } + + # Special handling for SecurityBaseline: Restore LocalGPO after clearing + if ($moduleInfo.name -eq "SecurityBaseline") { + $gpoBackupPath = Join-Path $moduleBackupPath "LocalGPO" + if (Test-Path $gpoBackupPath) { + Write-Log -Level INFO -Message "Restoring Local Group Policy from: $gpoBackupPath" -Module "Rollback" + + try { + $gpoTargetPath = "C:\Windows\System32\GroupPolicy" + + # Check if backup directory has content (not empty) + $backupContent = Get-ChildItem -Path $gpoBackupPath -Recurse -ErrorAction SilentlyContinue + + if ($backupContent -and $backupContent.Count -gt 0) { + # Copy all contents from LocalGPO backup to GroupPolicy directory + Copy-Item -Path "$gpoBackupPath\*" -Destination $gpoTargetPath -Recurse -Force -ErrorAction Stop + + Write-Log -Level SUCCESS -Message "Local Group Policy restored successfully from backup" -Module "Rollback" + } + else { + # Empty backup = system had no LocalGPO before hardening + Write-Log -Level INFO -Message "LocalGPO backup is empty (system was clean before hardening) - no restore needed" -Module "Rollback" + } + } + catch { + Write-Log -Level ERROR -Message "Exception restoring Local Group Policy: $($_.Exception.Message)" -Module "Rollback" + $allSucceeded = $false + } + } + else { + Write-Log -Level WARNING -Message "No LocalGPO backup found for SecurityBaseline - policies remain cleared" -Module "Rollback" + } + } + + # Special handling for AdvancedSecurity: Restore custom settings + if ($moduleInfo.name -eq "AdvancedSecurity") { + Write-Log -Level INFO -Message "Restoring Advanced Security settings..." -Module "Rollback" + Write-RestoreLog -Level INFO -Message "[ADVANCEDSECURITY] Starting restore..." + + # STEP 1: Restore AdvancedSecurity registry pre-state snapshot (counters GPO tattooing) + $advSecPreStatePath = Join-Path $moduleBackupPath "AdvancedSecurity_PreState.json" + Write-RestoreLog -Level DEBUG -Message "PreState snapshot path: $advSecPreStatePath" + if (Test-Path $advSecPreStatePath) { + Write-Log -Level INFO -Message "Restoring AdvancedSecurity registry pre-state snapshot..." -Module "Rollback" + Write-RestoreLog -Level INFO -Message "[STEP 1] AdvancedSecurity Registry PreState Restore" + try { + Write-RestoreLog -Level DEBUG -Message "Loading PreState JSON..." + $preEntries = Get-Content $advSecPreStatePath -Raw | ConvertFrom-Json + Write-RestoreLog -Level DEBUG -Message "PreState entries loaded: $($preEntries.Count) values" + + # Build list of all keys to clear first + $keysToProcess = @( + "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server", + "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services", + "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest", + "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters", + "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server", + "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client", + "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server", + "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client", + "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters", # mDNS / Discovery Protocols + "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp", # Official MS DisableWpad key + "HKLM:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad", # Legacy WpadOverride + "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings", # AutoDetect + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate", + "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect", # Wireless Display / Miracast + "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile", # Firewall Shields Up + "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" # IPv6 disable (mitm6 mitigation) + ) + + # Clear all current values in AdvancedSecurity keys (prepare clean slate) + Write-RestoreLog -Level DEBUG -Message "Clearing current AdvancedSecurity keys (preparing clean slate)..." + Write-RestoreLog -Level DEBUG -Message "Keys to process: $($keysToProcess.Count)" + $clearedCount = 0 + foreach ($keyPath in $keysToProcess) { + if (Test-Path $keyPath) { + try { + $currentProps = Get-ItemProperty -Path $keyPath -ErrorAction SilentlyContinue + if ($currentProps) { + $propNames = $currentProps.PSObject.Properties.Name | Where-Object { + $_ -notin @('PSPath', 'PSParentPath', 'PSChildName', 'PSProvider', 'PSDrive') + } + foreach ($prop in $propNames) { + # Skip system-critical RDP values that should never be deleted + if ($keyPath -like "*Terminal Server*" -and $prop -in @("fSingleSessionPerUser", "TSEnabled", "TSUserEnabled")) { + continue + } + Remove-ItemProperty -Path $keyPath -Name $prop -ErrorAction SilentlyContinue + $clearedCount++ + } + } + } + catch { + Write-Log -Level DEBUG -Message "Could not clear $keyPath : $_" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "Could not clear $keyPath : $_" + } + } + } + Write-RestoreLog -Level DEBUG -Message "Cleared $clearedCount values from AdvancedSecurity keys" + + # Restore original values from snapshot + Write-RestoreLog -Level DEBUG -Message "Restoring original values from PreState snapshot..." + $restoredCount = 0 + $failedCount = 0 + foreach ($entry in $preEntries) { + if (-not $entry.Path -or -not $entry.Name) { continue } + + try { + if (-not (Test-Path $entry.Path)) { + New-Item -Path $entry.Path -Force -ErrorAction Stop | Out-Null + } + + $regType = switch ($entry.Type) { + "DWord" { "DWord" } + "String" { "String" } + "MultiString" { "MultiString" } + "ExpandString" { "ExpandString" } + "Binary" { "Binary" } + "QWord" { "QWord" } + default { "String" } + } + + New-ItemProperty -Path $entry.Path -Name $entry.Name -Value $entry.Value -PropertyType $regType -Force -ErrorAction Stop | Out-Null + $restoredCount++ + } + catch { + Write-Log -Level DEBUG -Message "Failed to restore AdvancedSecurity value $($entry.Path)\$($entry.Name): $_" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "Failed to restore: $($entry.Path)\$($entry.Name) - $_" + $failedCount++ + } + } + + Write-Log -Level SUCCESS -Message "AdvancedSecurity registry pre-state restored ($restoredCount values)" -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "PreState restored: $restoredCount values restored, $failedCount failed" + } + catch { + Write-Log -Level WARNING -Message "Failed to restore AdvancedSecurity pre-state snapshot: $_" -Module "Rollback" + Write-RestoreLog -Level ERROR -Message "PreState restore FAILED: $($_.Exception.Message)" + Write-RestoreLog -Level ERROR -Message "Stack trace: $($_.ScriptStackTrace)" + } + } + else { + Write-Log -Level WARNING -Message "No AdvancedSecurity pre-state snapshot found - using .reg restore only (tattooing may occur)" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "No PreState snapshot found - using .reg restore only (tattooing may occur)" + } + + # STEP 2: Find all AdvancedSecurity custom backup files (RiskyPorts, PowerShellV2, AdminShares) + $advSecBackups = Get-ChildItem -Path $moduleBackupPath -Filter "*_*.json" -ErrorAction SilentlyContinue | Where-Object { $_.Name -notmatch "_Service.json" -and $_.Name -ne "AdvancedSecurity_PreState.json" } + + if ($advSecBackups) { + # Load AdvancedSecurity module for restore + $advSecModulePath = Join-Path (Split-Path $PSScriptRoot -Parent) "Modules\AdvancedSecurity\AdvancedSecurity.psd1" + + if (Test-Path $advSecModulePath) { + try { + Import-Module $advSecModulePath -Force -ErrorAction Stop + + foreach ($backupFile in $advSecBackups) { + Write-Log -Level INFO -Message "Restoring Advanced Security backup: $($backupFile.Name)" -Module "Rollback" + + # Call AdvancedSecurity module's restore function + $restoreResult = Restore-AdvancedSecuritySettings -BackupFilePath $backupFile.FullName + + if ($restoreResult) { + Write-Log -Level SUCCESS -Message "Restored: $($backupFile.Name)" -Module "Rollback" + } + else { + Write-Log -Level WARNING -Message "Failed to restore: $($backupFile.Name)" -Module "Rollback" + $allSucceeded = $false + } + } + + Remove-Module AdvancedSecurity -ErrorAction SilentlyContinue + } + catch { + Write-Log -Level ERROR -Message "Failed to restore Advanced Security settings: $_" -Module "Rollback" + $allSucceeded = $false + } + } + else { + Write-Log -Level WARNING -Message "AdvancedSecurity module not found - cannot restore settings" -Module "Rollback" + $allSucceeded = $false + } + } + + # CRITICAL FIX: Restore Firewall_Rules and SMB_Shares from session root + # Bug: These backups are stored in separate folders (Firewall_Rules/, SMB_Shares/) + # in the session root, not under AdvancedSecurity/, so they were never restored. + # This caused Finger Protocol rule and Admin Shares to remain active after restore. + Write-RestoreLog -Level INFO -Message "[FIX 3a/3] Restoring Firewall_Rules and SMB_Shares from session root..." + $firewallBackupDir = Join-Path $SessionPath "Firewall_Rules" + $smbBackupDir = Join-Path $SessionPath "SMB_Shares" + Write-RestoreLog -Level DEBUG -Message "Firewall backup dir: $firewallBackupDir" + Write-RestoreLog -Level DEBUG -Message "SMB backup dir: $smbBackupDir" + + foreach ($backupDir in @($firewallBackupDir, $smbBackupDir)) { + if (Test-Path $backupDir) { + Write-RestoreLog -Level DEBUG -Message "Processing backup directory: $backupDir" + $backupFiles = Get-ChildItem -Path $backupDir -Filter "*.json" -ErrorAction SilentlyContinue + Write-RestoreLog -Level DEBUG -Message "Found $($backupFiles.Count) backup file(s)" + + if ($backupFiles) { + $advSecModulePath = Join-Path (Split-Path $PSScriptRoot -Parent) "Modules\AdvancedSecurity\AdvancedSecurity.psd1" + + if (Test-Path $advSecModulePath) { + try { + Import-Module $advSecModulePath -Force -ErrorAction Stop + + foreach ($backupFile in $backupFiles) { + Write-Log -Level INFO -Message "Restoring $(Split-Path $backupDir -Leaf) backup: $($backupFile.Name)" -Module "Rollback" + Write-RestoreLog -Level INFO -Message "Restoring: $(Split-Path $backupDir -Leaf)\$($backupFile.Name)" + + $restoreResult = Restore-AdvancedSecuritySettings -BackupFilePath $backupFile.FullName + + if ($restoreResult) { + Write-Log -Level SUCCESS -Message "Restored: $($backupFile.Name)" -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "Successfully restored: $($backupFile.Name)" + } + else { + Write-Log -Level WARNING -Message "Failed to restore: $($backupFile.Name)" -Module "Rollback" + Write-RestoreLog -Level ERROR -Message "FAILED to restore: $($backupFile.Name)" + $allSucceeded = $false + } + } + + Remove-Module AdvancedSecurity -ErrorAction SilentlyContinue + } + catch { + Write-Log -Level ERROR -Message "Failed to restore $(Split-Path $backupDir -Leaf): $_" -Module "Rollback" + $allSucceeded = $false + } + } + } + } + } + + # CRITICAL FIX: Clean up SRP subkeys if system was clean before hardening + # Bug: PreState-Restore only clears values in root key, not the \0\Paths subkeys + # where actual SRP rules live. This caused "Block LNK" rules to remain after restore. + Write-RestoreLog -Level INFO -Message "[FIX 3b/3] Checking SRP subkey cleanup..." + $srpRootKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" + if (Test-Path $srpRootKey) { + Write-RestoreLog -Level DEBUG -Message "SRP root key exists: $srpRootKey" + try { + # Check if PreState had ANY SRP-related entries + $hadSRPInPreState = $false + if (Test-Path $advSecPreStatePath) { + Write-RestoreLog -Level DEBUG -Message "Reading PreState from: $advSecPreStatePath" + $preEntries = Get-Content $advSecPreStatePath -Raw | ConvertFrom-Json + $srpEntries = $preEntries | Where-Object { $_.Path -like "*Safer\CodeIdentifiers*" } + $hadSRPInPreState = $srpEntries.Count -gt 0 + Write-RestoreLog -Level DEBUG -Message "SRP entries in PreState: $($srpEntries.Count)" + } + else { + Write-RestoreLog -Level WARNING -Message "PreState file not found: $advSecPreStatePath" + } + + if (-not $hadSRPInPreState) { + Write-RestoreLog -Level INFO -Message "System had NO SRP rules before hardening - removing SRP subkeys" + # System had NO SRP rules before hardening - clean up all SRP subkeys + $srpPathsKey = "$srpRootKey\0\Paths" + if (Test-Path $srpPathsKey) { + Write-RestoreLog -Level DEBUG -Message "Removing SRP Paths subkey: $srpPathsKey" + Remove-Item -Path $srpPathsKey -Recurse -Force -ErrorAction Stop + Write-Log -Level INFO -Message "Removed SRP Paths subkeys (system had no SRP rules before hardening)" -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "SRP Paths subkeys removed successfully" + } + else { + Write-RestoreLog -Level DEBUG -Message "SRP Paths subkey does not exist (correct state)" + } + } + else { + Write-Log -Level DEBUG -Message "System had SRP rules in PreState - keeping SRP structure" -Module "Rollback" + Write-RestoreLog -Level INFO -Message "System had $($srpEntries.Count) SRP rules in PreState - keeping SRP structure" + } + } + catch { + Write-Log -Level DEBUG -Message "Could not clean SRP subkeys: $_" -Module "Rollback" + Write-RestoreLog -Level ERROR -Message "SRP cleanup failed: $_" + } + } + else { + Write-RestoreLog -Level DEBUG -Message "SRP root key does not exist (correct state)" + } + } + + Write-Log -Level SUCCESS -Message "Completed restore for module: $($moduleInfo.name)" -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "Module $($moduleInfo.name) restore completed" + Write-RestoreLog -Level INFO -Message " " + } + + if ($allSucceeded) { + Write-Log -Level SUCCESS -Message "Session restore completed successfully" -Module "Rollback" + Write-RestoreLog -Level SUCCESS -Message "========================================" + Write-RestoreLog -Level SUCCESS -Message "RESTORE COMPLETED SUCCESSFULLY" + Write-RestoreLog -Level SUCCESS -Message "All modules restored without errors" + Write-RestoreLog -Level SUCCESS -Message "========================================" + } + else { + Write-Log -Level WARNING -Message "Session restore completed with some failures" -Module "Rollback" + Write-RestoreLog -Level WARNING -Message "========================================" + Write-RestoreLog -Level WARNING -Message "RESTORE COMPLETED WITH FAILURES" + Write-RestoreLog -Level WARNING -Message "Check log above for error details" + Write-RestoreLog -Level WARNING -Message "========================================" + } + + # NOTE: Pre-Framework Snapshot processing for ASR has been moved to the module-level + # restore section (see "if ($moduleInfo.name -eq "ASR")" block above). + # + # The module-level ASR restore now correctly prioritizes: + # 1. PreFramework_Snapshot.json - TRUE pre-hardening state (before SecurityBaseline runs) + # 2. ASR_ActiveConfiguration.json - fallback for single-module ASR runs + # + # This section is reserved for future non-ASR shared resources if needed. + # Currently, PreFramework_Snapshot only contains ASR data, so no action needed here. + + Write-Host "" + Write-Host "" + Write-Host "============================================================================" -ForegroundColor Cyan + Write-Host "============================================================================" -ForegroundColor Cyan + if ($allSucceeded) { + Write-Host "" + Write-Host " RESTORE COMPLETED SUCCESSFULLY " -ForegroundColor Green + Write-Host "" + Write-Host " All security settings have been reverted to backup state" -ForegroundColor White + Write-Host " Modules restored: $($reversedModules.Count) | Total items: $($manifest.totalItems)" -ForegroundColor Gray + Write-Host "" + } else { + Write-Host "" + Write-Host " RESTORE COMPLETED WITH ISSUES " -ForegroundColor Yellow + Write-Host "" + Write-Host " Some items could not be restored - check logs for details" -ForegroundColor Gray + Write-Host " Modules processed: $($reversedModules.Count) | Total items: $($manifest.totalItems)" -ForegroundColor Gray + Write-Host "" + } + Write-Host "============================================================================" -ForegroundColor Cyan + Write-Host "============================================================================" -ForegroundColor Cyan + Write-Host "" + Write-Host "" + + # Prompt for reboot after restore + Invoke-RestoreRebootPrompt + + # Final restore log entry + $endTime = Get-Date + $duration = $endTime - $startTime + Write-RestoreLog -Level INFO -Message " " + Write-RestoreLog -Level INFO -Message "========================================" + Write-RestoreLog -Level INFO -Message "RESTORE SESSION END" + Write-RestoreLog -Level INFO -Message "Duration: $($duration.ToString('mm\:ss'))" + Write-RestoreLog -Level INFO -Message "Final Status: $(if ($allSucceeded) {'SUCCESS'} else {'PARTIAL FAILURE'})" + Write-RestoreLog -Level INFO -Message "Restore Log: $script:RestoreLogPath" + Write-RestoreLog -Level INFO -Message "========================================" + + return $allSucceeded + } + catch { + Write-ErrorLog -Message "Failed to restore hardening session: $SessionName" -Module "Rollback" -ErrorRecord $_ + Write-RestoreLog -Level ERROR -Message "CRITICAL FAILURE: $_" + Write-RestoreLog -Level ERROR -Message "Restore aborted with exception" + return $false + } +} + +function Clear-AuditPolicies { + <# + .SYNOPSIS + Clear all audit policies to disabled state + + .DESCRIPTION + Uses auditpol.exe /clear to reset all audit policies to system defaults. + This is the official Microsoft method to clear audit policies. + + .OUTPUTS + Boolean indicating success + #> + [CmdletBinding()] + [OutputType([bool])] + param() + + try { + Write-Log -Level INFO -Message "Clearing all audit policies..." -Module "Rollback" + + # Use auditpol /clear /y (official MS command) + # /clear: Deletes per-user policy, resets system policy, disables all auditing + # /y: Suppress confirmation prompt + $process = Start-Process -FilePath "auditpol.exe" ` + -ArgumentList "/clear", "/y" ` + -Wait ` + -NoNewWindow ` + -PassThru ` + -RedirectStandardOutput (Join-Path $env:TEMP "auditpol_clear_stdout.txt") ` + -RedirectStandardError (Join-Path $env:TEMP "auditpol_clear_stderr.txt") + + if ($process.ExitCode -eq 0) { + Write-Log -Level SUCCESS -Message "Audit policies cleared successfully" -Module "Rollback" + return $true + } + else { + $errorOutput = Get-Content (Join-Path $env:TEMP "auditpol_clear_stderr.txt") -Raw -ErrorAction SilentlyContinue + Write-Log -Level ERROR -Message "Failed to clear audit policies: $errorOutput" -Module "Rollback" + return $false + } + } + catch { + Write-Log -Level ERROR -Message "Exception clearing audit policies" -Module "Rollback" -Exception $_.Exception + return $false + } +} + +function Clear-ASRRules { + <# + .SYNOPSIS + Clear all ASR rules to Not Configured state + + .DESCRIPTION + Uses Remove-MpPreference to remove all ASR rule configurations. + This sets all rules back to "Not configured" state. + + .OUTPUTS + Boolean indicating success + #> + [CmdletBinding()] + [OutputType([bool])] + param() + + try { + Write-Log -Level INFO -Message "Clearing all ASR rules..." -Module "Rollback" + + # Get current ASR rules + $mpPref = Get-MpPreference -ErrorAction Stop + + if ($mpPref.AttackSurfaceReductionRules_Ids -and $mpPref.AttackSurfaceReductionRules_Ids.Count -gt 0) { + # Remove all ASR rule IDs and Actions + Remove-MpPreference -AttackSurfaceReductionRules_Ids $mpPref.AttackSurfaceReductionRules_Ids -ErrorAction Stop + Remove-MpPreference -AttackSurfaceReductionRules_Actions $mpPref.AttackSurfaceReductionRules_Actions -ErrorAction Stop + + Write-Log -Level SUCCESS -Message "Cleared $($mpPref.AttackSurfaceReductionRules_Ids.Count) ASR rules" -Module "Rollback" + return $true + } + else { + Write-Log -Level INFO -Message "No ASR rules configured - nothing to clear" -Module "Rollback" + return $true + } + } + catch { + Write-Log -Level ERROR -Message "Failed to clear ASR rules" -Module "Rollback" -Exception $_.Exception + return $false + } +} + +function Reset-SecurityTemplate { + <# + .SYNOPSIS + Restore security template settings from pre-hardening backup + + .DESCRIPTION + Uses secedit.exe to restore security template settings from the backed up state. + This includes password policies, user rights assignments, and other security settings. + Falls back to defltbase.inf if no backup exists (with warning about limitations). + + .PARAMETER BackupFile + Path to the pre-hardening security policy .inf backup file + + .OUTPUTS + Boolean indicating success + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $false)] + [string]$BackupFile + ) + + try { + $templateToUse = $null + $database = Join-Path $env:TEMP "secedit_restore.sdb" + $logFile = Join-Path $env:TEMP "secedit_restore.log" + + # Check if backup file exists and use it + if ($BackupFile -and (Test-Path $BackupFile)) { + Write-Log -Level INFO -Message "Restoring security template from pre-hardening backup..." -Module "Rollback" + $templateToUse = $BackupFile + } + else { + # Fallback to defltbase.inf with warning + Write-Log -Level WARNING -Message "No pre-hardening backup found. Using defltbase.inf (may not reset all settings)" -Module "Rollback" + Write-Log -Level WARNING -Message "Microsoft KB 313222: defltbase.inf is no longer capable of resetting all security defaults" -Module "Rollback" + + $defaultTemplate = "$env:WINDIR\inf\defltbase.inf" + + if (-not (Test-Path $defaultTemplate)) { + Write-Log -Level ERROR -Message "Default security template not found: $defaultTemplate" -Module "Rollback" + return $false + } + + $templateToUse = $defaultTemplate + } + + # STEP 1: Import .inf file into database (required before configure) + # Import only securitypolicy and user_rights areas (we handle audit policies separately with auditpol) + Write-Log -Level INFO -Message "Importing security template into database..." -Module "Rollback" + $importProcess = Start-Process -FilePath "secedit.exe" ` + -ArgumentList "/import", "/db", "`"$database`"", "/cfg", "`"$templateToUse`"", "/overwrite", "/areas", "securitypolicy", "user_rights", "/log", "`"$logFile`"", "/quiet" ` + -Wait ` + -NoNewWindow ` + -PassThru + + if ($importProcess.ExitCode -ne 0) { + $errorLog = Get-Content $logFile -Raw -ErrorAction SilentlyContinue + Write-Log -Level ERROR -Message "Failed to import security template (Exit: $($importProcess.ExitCode)): $errorLog" -Module "Rollback" + Write-Log -Level ERROR -Message "Template file: $templateToUse" -Module "Rollback" + return $false + } + + Write-Log -Level SUCCESS -Message "Security template imported successfully" -Module "Rollback" + + # STEP 2: Configure system from database (only securitypolicy and user_rights) + Write-Log -Level INFO -Message "Applying security template to system..." -Module "Rollback" + $process = Start-Process -FilePath "secedit.exe" ` + -ArgumentList "/configure", "/db", "`"$database`"", "/areas", "securitypolicy", "user_rights", "/log", "`"$logFile`"", "/quiet" ` + -Wait ` + -NoNewWindow ` + -PassThru + + $errorLog = Get-Content $logFile -Raw -ErrorAction SilentlyContinue + + # Exit code evaluation: + # 0 = success + # 3 = success with warnings + # 1 = error, BUT if it's only SID-mapping issues, treat as success with warning + $isSidMappingOnly = $errorLog -match 'Zuordnungen von Kontennamen.*Sicherheitskennungen|account name.*security identifier' + + if ($process.ExitCode -eq 0 -or $process.ExitCode -eq 3 -or ($process.ExitCode -eq 1 -and $isSidMappingOnly)) { + if ($process.ExitCode -eq 1) { + Write-Log -Level WARNING -Message "Security template restored with SID-mapping warnings (non-fatal, most settings applied)" -Module "Rollback" + } + + if ($BackupFile) { + Write-Log -Level SUCCESS -Message "Security template restored from pre-hardening backup" -Module "Rollback" + } + else { + Write-Log -Level SUCCESS -Message "Security template reset using defltbase.inf (partial reset)" -Module "Rollback" + } + return $true + } + else { + Write-Log -Level ERROR -Message "Failed to restore security template (Exit: $($process.ExitCode)): $errorLog" -Module "Rollback" + return $false + } + } + catch { + Write-ErrorLog -Message "Failed to restore security template from backup" -Module "Rollback" -ErrorRecord $_ + return $false + } +} + +function Clear-LocalGPO { + <# + .SYNOPSIS + Clear all local Group Policy settings to "Not Configured" + + .DESCRIPTION + Deletes the registry.pol files which store local GPO settings. + This is the official Microsoft method to reset all GPO settings to default. + After deletion, gpupdate will recreate empty directories and all settings + will be "Not Configured". + + Reference: https://woshub.com/reset-local-group-policies-settings-in-windows/ + + .OUTPUTS + Boolean indicating success + #> + [CmdletBinding()] + [OutputType([bool])] + param() + + try { + Write-Log -Level INFO -Message "Clearing all local Group Policy settings..." -Module "Rollback" + + # Paths to local GPO registry.pol files + $gpoPaths = @( + "$env:WinDir\System32\GroupPolicyUsers", + "$env:WinDir\System32\GroupPolicy" + ) + + $clearedCount = 0 + + foreach ($path in $gpoPaths) { + if (Test-Path $path) { + try { + Remove-Item -Path $path -Recurse -Force -ErrorAction Stop + Write-Log -Level INFO -Message "Deleted GPO directory: $path" -Module "Rollback" + $clearedCount++ + } + catch { + Write-Log -Level WARNING -Message "Could not delete GPO directory: $path - $_" -Module "Rollback" + } + } + } + + if ($clearedCount -gt 0) { + Write-Log -Level SUCCESS -Message "Local Group Policy cleared successfully" -Module "Rollback" + return $true + } + else { + Write-Log -Level INFO -Message "No local GPO directories found to clear" -Module "Rollback" + return $true + } + } + catch { + Write-ErrorLog -Message "Failed to clear local Group Policy Objects" -Module "Rollback" -ErrorRecord $_ + return $false + } +} + +# Note: Export-ModuleMember not used - this script is dot-sourced, not imported as module diff --git a/Core/Validator.ps1 b/Core/Validator.ps1 new file mode 100644 index 0000000..b02a207 --- /dev/null +++ b/Core/Validator.ps1 @@ -0,0 +1,426 @@ +<# +.SYNOPSIS + System validation for NoID Privacy Framework + +.DESCRIPTION + Provides pre-execution validation checks and post-execution verification + to ensure system safety and compliance. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+ +#> + +function Test-Prerequisites { + <# + .SYNOPSIS + Validate all system prerequisites before hardening + + .OUTPUTS + PSCustomObject with validation results + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + Write-Log -Level INFO -Message "Starting prerequisite validation" -Module "Validator" + + $result = [PSCustomObject]@{ + Success = $true + Errors = @() + Warnings = @() + SystemInfo = $null + } + + # Check 1: Administrator privileges + if (-not (Test-IsAdministrator)) { + Write-Log -Level ERROR -Message "Administrator privileges required" -Module "Validator" + $result.Success = $false + $result.Errors += "Administrator privileges required" + } + else { + Write-Log -Level SUCCESS -Message "Administrator check: PASSED" -Module "Validator" + } + + # Check 2: Windows version + $osInfo = Get-WindowsVersion + if ($osInfo.IsSupported) { + Write-Log -Level SUCCESS -Message "Windows version check: PASSED ($($osInfo.Version))" -Module "Validator" + } + else { + Write-Log -Level ERROR -Message "Unsupported Windows version: $($osInfo.Version)" -Module "Validator" + $result.Success = $false + $result.Errors += "Unsupported Windows version: $($osInfo.Version)" + } + + # Check 3: Disk space + $diskSpace = Get-AvailableDiskSpace + if ($diskSpace -gt 500MB) { + Write-Log -Level SUCCESS -Message "Disk space check: PASSED ($([math]::Round($diskSpace/1MB, 2)) MB available)" -Module "Validator" + } + else { + Write-Log -Level WARNING -Message "Low disk space: $([math]::Round($diskSpace/1MB, 2)) MB" -Module "Validator" + $result.Warnings += "Low disk space: $([math]::Round($diskSpace/1MB, 2)) MB" + } + + # Check 4: PowerShell version + if ($PSVersionTable.PSVersion.Major -ge 5) { + Write-Log -Level SUCCESS -Message "PowerShell version check: PASSED ($($PSVersionTable.PSVersion))" -Module "Validator" + } + else { + Write-Log -Level ERROR -Message "PowerShell 5.1 or higher required" -Module "Validator" + $result.Success = $false + $result.Errors += "PowerShell 5.1 or higher required (found: $($PSVersionTable.PSVersion))" + } + + # Get system info + $result.SystemInfo = Get-SystemInfo + + if ($result.Success) { + Write-Log -Level SUCCESS -Message "All prerequisite checks passed" -Module "Validator" + } + else { + Write-Log -Level ERROR -Message "One or more prerequisite checks failed" -Module "Validator" + } + + return $result +} + +function Test-IsAdministrator { + <# + .SYNOPSIS + Check if script is running with administrator privileges + + .OUTPUTS + Boolean indicating administrator status + #> + [CmdletBinding()] + [OutputType([bool])] + param() + + $currentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()) + return $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) +} + +function Get-WindowsVersion { + <# + .SYNOPSIS + Get Windows version information + + .OUTPUTS + PSCustomObject with version details and support status + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + $os = Get-CimInstance -ClassName Win32_OperatingSystem + $buildNumber = [int]$os.BuildNumber + + # Windows 11 build numbers + # 22000 = 21H2, 22621 = 22H2, 22631 = 23H2, 26100 = 24H2, 26200 = 25H2 + $isWindows11 = $buildNumber -ge 22000 + $isSupported = $buildNumber -ge 26100 # 24H2 or newer + + $versionName = switch ($buildNumber) { + { $_ -ge 26200 } { "Windows 11 25H2"; break } + { $_ -ge 26100 } { "Windows 11 24H2"; break } + { $_ -ge 22631 } { "Windows 11 23H2"; break } + { $_ -ge 22621 } { "Windows 11 22H2"; break } + { $_ -ge 22000 } { "Windows 11 21H2"; break } + default { "Windows $($os.Version)" } + } + + return [PSCustomObject]@{ + Version = $versionName + BuildNumber = $buildNumber + IsWindows11 = $isWindows11 + IsSupported = $isSupported + Edition = $os.Caption + Architecture = $os.OSArchitecture + } +} + +function Get-AvailableDiskSpace { + <# + .SYNOPSIS + Get available disk space on system drive + + .OUTPUTS + Int64 representing available bytes + #> + [CmdletBinding()] + [OutputType([Int64])] + param() + + $systemDrive = $env:SystemDrive + $drive = Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='$systemDrive'" + + return $drive.FreeSpace +} + +function Test-InternetConnectivity { + <# + .SYNOPSIS + Test internet connectivity + + .OUTPUTS + Boolean indicating connectivity status + #> + [CmdletBinding()] + [OutputType([bool])] + [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingComputerNameHardcoded', '')] + param() + + try { + # Using Google DNS (8.8.8.8) - intentional for internet connectivity check + $response = Test-Connection -ComputerName "8.8.8.8" -Count 1 -Quiet -ErrorAction Stop + return $response + } + catch { + return $false + } +} + +function Test-TPMAvailable { + <# + .SYNOPSIS + Check if TPM 2.0 is available + + .OUTPUTS + PSCustomObject with TPM information + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + try { + $tpm = Get-Tpm -ErrorAction SilentlyContinue + + if ($null -eq $tpm) { + return [PSCustomObject]@{ + Present = $false + Version = "N/A" + Enabled = $false + Activated = $false + } + } + + return [PSCustomObject]@{ + Present = $tpm.TpmPresent + Version = if ($tpm.ManufacturerVersion) { $tpm.ManufacturerVersion } else { "2.0" } + Enabled = $tpm.TpmEnabled + Activated = $tpm.TpmActivated + } + } + catch { + Write-Log -Level WARNING -Message "Unable to check TPM status: $_" -Module "Validator" + return [PSCustomObject]@{ + Present = $false + Version = "Unknown" + Enabled = $false + Activated = $false + } + } +} + +function Test-SecureBootEnabled { + <# + .SYNOPSIS + Check if Secure Boot is enabled + + .OUTPUTS + Boolean indicating Secure Boot status + #> + [CmdletBinding()] + [OutputType([bool])] + param() + + try { + $secureBoot = Confirm-SecureBootUEFI -ErrorAction Stop + return $secureBoot + } + catch { + Write-Log -Level WARNING -Message "Unable to check Secure Boot status (may not be UEFI): $_" -Module "Validator" + return $false + } +} + +function Test-VirtualizationEnabled { + <# + .SYNOPSIS + Check if CPU virtualization is enabled + + .OUTPUTS + Boolean indicating virtualization status + #> + [CmdletBinding()] + [OutputType([bool])] + param() + + try { + $cpu = Get-CimInstance -ClassName Win32_Processor + + # Check for Intel VT-x or AMD-V + $vmxEnabled = $cpu.VirtualizationFirmwareEnabled + + return $vmxEnabled + } + catch { + Write-Log -Level WARNING -Message "Unable to check virtualization status: $_" -Module "Validator" + return $false + } +} + +function Get-SystemInfo { + <# + .SYNOPSIS + Get comprehensive system information + + .OUTPUTS + PSCustomObject with detailed system information + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + $osInfo = Get-WindowsVersion + $tpmInfo = Test-TPMAvailable + $secureBoot = Test-SecureBootEnabled + $virtualization = Test-VirtualizationEnabled + $isAdmin = Test-IsAdministrator + $diskSpace = Get-AvailableDiskSpace + $internet = Test-InternetConnectivity + + return [PSCustomObject]@{ + OS = $osInfo + TPM = $tpmInfo + SecureBoot = $secureBoot + Virtualization = $virtualization + IsAdministrator = $isAdmin + DiskSpaceAvailable = $diskSpace + InternetConnected = $internet + PowerShellVersion = $PSVersionTable.PSVersion.ToString() + } +} + +function Test-DomainJoined { + <# + .SYNOPSIS + Check if system is joined to an Active Directory domain + + .DESCRIPTION + Detects if the system is domain-joined and warns about potential + Group Policy conflicts with local hardening settings. + + .PARAMETER Interactive + If set, prompts user to confirm continuation on domain-joined systems + + .OUTPUTS + PSCustomObject with domain status information + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param( + [switch]$Interactive + ) + + try { + $computerSystem = Get-CimInstance Win32_ComputerSystem -ErrorAction Stop + $isDomainJoined = $computerSystem.PartOfDomain + + $result = [PSCustomObject]@{ + IsDomainJoined = $isDomainJoined + DomainName = if ($isDomainJoined) { $computerSystem.Domain } else { "N/A" } + Workgroup = if (-not $isDomainJoined) { $computerSystem.Workgroup } else { "N/A" } + UserConfirmed = $false + } + + if ($isDomainJoined) { + Write-Log -Level WARNING -Message "System is domain-joined: $($computerSystem.Domain)" -Module "Validator" + + if ($Interactive) { + Write-Host "" + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " WARNING: DOMAIN-JOINED SYSTEM" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "This system is joined to domain: " -NoNewline -ForegroundColor White + Write-Host "$($computerSystem.Domain)" -ForegroundColor Cyan + Write-Host "" + Write-Host "IMPORTANT CONSIDERATIONS:" -ForegroundColor Red + Write-Host " - Domain Group Policies will override local policies" -ForegroundColor Yellow + Write-Host " - GPO refresh occurs every 90 minutes" -ForegroundColor Yellow + Write-Host " - Some hardening may be reset automatically" -ForegroundColor Yellow + Write-Host " - Coordinate with AD team before proceeding" -ForegroundColor Yellow + Write-Host "" + Write-Host "RECOMMENDED FOR DOMAIN ENVIRONMENTS:" -ForegroundColor Cyan + Write-Host " - Integrate these settings into Domain GPOs instead" -ForegroundColor White + Write-Host " - Use this tool only for testing/standalone systems" -ForegroundColor White + Write-Host "" + + $continue = Read-Host "Do you want to continue anyway? (yes/no)" + + if ($continue -ne "yes") { + Write-Log -Level INFO -Message "User cancelled due to domain-joined warning" -Module "Validator" + Write-Host "" + Write-Host "Operation cancelled by user." -ForegroundColor Gray + Write-Host "" + exit 1 + } + + $result.UserConfirmed = $true + Write-Log -Level INFO -Message "User confirmed continuation on domain-joined system" -Module "Validator" + } + } + else { + Write-Log -Level INFO -Message "System is standalone (workgroup: $($computerSystem.Workgroup))" -Module "Validator" + } + + return $result + } + catch { + Write-Log -Level ERROR -Message "Failed to check domain status: $_" -Module "Validator" -Exception $_.Exception + return [PSCustomObject]@{ + IsDomainJoined = $false + DomainName = "Error" + Workgroup = "Error" + UserConfirmed = $false + } + } +} + +function Confirm-SystemBackup { + <# + .SYNOPSIS + Non-interactive system backup recommendation + + .DESCRIPTION + Historically this function displayed an interactive prompt asking the + user to confirm that a full system backup exists before proceeding. + For modern CLI and GUI workflows this interaction is removed to avoid + blocking automation. The function now simply logs that a backup is + recommended and returns a confirmation object. + + .PARAMETER Force + Retained for backwards compatibility. No longer changes behaviour. + + .OUTPUTS + PSCustomObject with backup confirmation status + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + Write-Log -Level INFO -Message "Backup recommendation: non-interactive confirmation (no prompt shown)" -Module "Validator" + + $result = [PSCustomObject]@{ + UserConfirmed = $true + BackupRecommended = $true + } + + return $result +} + +# Note: Export-ModuleMember not used - this script is dot-sourced, not imported as module diff --git a/Docs/FEATURES.md b/Docs/FEATURES.md new file mode 100644 index 0000000..9b10b80 --- /dev/null +++ b/Docs/FEATURES.md @@ -0,0 +1,742 @@ +# NoID Privacy - Complete Feature List + +**Framework Version:** v2.2.0 +**Total Security Settings:** 632 (Paranoid mode) +**Modules:** 7 (All Production-Ready) +**Last Updated:** December 7, 2025 + +--- + +## ๐Ÿ“Š Module Overview + +| Module | Settings | Status | Description | +|--------|----------|--------|-------------| +| **SecurityBaseline** | 425 | โœ… v2.2.0 | Microsoft Security Baseline for Windows 11 v25H2 | +| **ASR** | 19 | โœ… v2.2.0 | Attack Surface Reduction rules | +| **DNS** | 5 | โœ… v2.2.0 | Secure DNS with DoH encryption | +| **Privacy** | 77 | โœ… v2.2.0 | Telemetry control, Bloatware removal (53 Registry + 24 Bloatware) | +| **AntiAI** | 32 | โœ… v2.2.0 | AI lockdown (13 features, 32 compliance checks) | +| **EdgeHardening** | 24 | โœ… v2.2.0 | Microsoft Edge browser security (24 policies) | +| **AdvancedSecurity** | 50 | โœ… v2.2.0 | Advanced hardening beyond MS Baseline (incl. Wireless Display, Discovery Protocols, IPv6) | +| **TOTAL** | **632** | โœ… **100%** | **Complete Framework (Paranoid mode)** | + +--- + +## ๐Ÿ”’ Module 1: SecurityBaseline (425 Settings) + +**Description:** Complete implementation of Microsoft's official Windows 11 v25H2 Security Baseline + +### Components: + +#### Registry Policies (335 settings) +- Computer Configuration policies (330 settings) +- User Configuration policies (5 settings) +- Windows Defender Antivirus baseline +- Windows Firewall configuration +- BitLocker drive encryption settings +- Internet Explorer 11 security zones + +#### Security Template (67 settings) +- **Password Policy:** MinimumPasswordLength (14), PasswordHistorySize (24), etc. +- **Account Lockout:** LockoutBadCount (10), LockoutDuration (10 minutes) +- **User Rights Assignment:** Administrative permissions and privileges +- **Security Options:** Network access, authentication, object access +- **Service Configuration:** Xbox services disabled for security + +#### Audit Policies (23 subcategories) +- Logon/Logoff events +- Account Management +- Policy Change tracking +- Privilege Use monitoring +- System events +- Object Access auditing + +### Key Features: +- โœ… VBS (Virtualization Based Security) +- โœ… Credential Guard +- โœ… System Guard Secure Launch +- โœ… Kernel CET Shadow Stacks (Win11 25H2) +- โœ… Memory Integrity (HVCI) +- โœ… Interactive BitLocker USB prompt (Home/Enterprise choice) + +### Home User Adjustments: +- **BitLocker USB:** Default = 0 (Home Mode - USB works normally) +- **Password Policies:** Only affect local accounts (~5% of users) + +--- + +## ๐Ÿ›ก๏ธ Module 2: ASR (19 Settings) + +**Description:** All 19 Microsoft Defender Attack Surface Reduction rules + +### What ASR Rules Block (and Why It's Important): + +#### Email & Download Attacks +1. **Block executable content from email** - Stops malware from .exe/.dll/.ps1 email attachments +2. **Block JavaScript/VBScript from launching downloads** - Prevents drive-by downloads from malicious websites +3. **Block execution of obfuscated scripts** - Detects and blocks heavily obfuscated PowerShell/JS scripts used by malware +4. **Block untrusted/unsigned processes from USB** - Prevents USB-based malware execution (BadUSB attacks) + +#### Office Exploits +5. **Block Office from creating child processes** - Stops Word/Excel macros from spawning cmd.exe/powershell.exe +6. **Block Office from creating executable content** - Prevents Office from writing .exe files to disk +7. **Block Office from injecting code into other processes** - Stops process injection attacks +8. **Block Win32 API calls from Office macros** - Prevents macros from calling dangerous Windows APIs +9. **Block Adobe Reader from creating child processes** - Same protection for PDF exploits +10. **Block Office communication apps (Outlook) child processes** - Stops email-based exploit chains + +#### Credential Theft & Persistence +11. **Block credential stealing from LSASS** - Protects against Mimikatz and similar tools +12. **Block persistence through WMI** - Prevents malware from hiding in WMI event subscriptions +13. **Block process creation from PSExec/WMI** - Stops lateral movement tools (configurable: Block or Audit) + +#### Ransomware Protection +14. **Use advanced ransomware protection** - AI-powered behavioral detection of ransomware +15. **Block executable files unless they meet reputation criteria** - SmartScreen integration + +#### Advanced Threats +16. **Block abuse of exploited vulnerable signed drivers** - Prevents BYOVD (Bring Your Own Vulnerable Driver) attacks +17. **Block webshell creation** - Stops IIS/Apache webshell deployment (Server-focused) +18. **Block rebooting in Safe Mode** - Prevents ransomware from bypassing defenses +19. **Block use of copied/impersonated system tools** - Detects renamed legitimate tools (rundll32.exe โ†’ run.exe) + +### Interactive Prompt: +- **PSExec/WMI Rule (d1e49aac):** Choose **Block** or **Audit** + - Block: Maximum security (may break SCCM/remote admin tools) + - Audit: Logs events only (good for enterprise compatibility testing) + +--- + +## ๐ŸŒ Module 3: DNS (5 Settings) + +**Description:** Secure DNS with DNS-over-HTTPS encryption + +### Providers (3 available): + +#### Quad9 (Default - Security) +- **IPv4:** 9.9.9.9, 149.112.112.112 +- **IPv6:** 2620:fe::fe, 2620:fe::9 +- **DoH:** https://dns.quad9.net/dns-query +- **Ratings:** Speed 4/5, Privacy 5/5, Security 5/5, Filtering 4/5 +- **Best for:** Security-focused users, malware protection + +#### Cloudflare (Speed) +- **IPv4:** 1.1.1.1, 1.0.0.1 +- **IPv6:** 2606:4700:4700::1111, 2606:4700:4700::1001 +- **DoH:** https://cloudflare-dns.com/dns-query +- **Ratings:** Speed 5/5, Privacy 4/5, Security 4/5, Filtering 2/5 +- **Best for:** Speed-focused users, fastest resolver + +#### AdGuard (Ad-Blocking) +- **IPv4:** 94.140.14.14, 94.140.15.15 +- **IPv6:** 2a10:50c0::ad1:ff, 2a10:50c0::ad2:ff +- **DoH:** https://dns.adguard-dns.com/dns-query +- **Ratings:** Speed 4/5, Privacy 4/5, Security 4/5, Filtering 5/5 +- **Best for:** Ad/tracker blocking at DNS level + +### Features: +- โœ… **DoH Encryption with 2 Interactive Modes:** + - **[1] REQUIRE Mode (Default):** NO unencrypted fallback (AllowFallbackToUdp = $False) + - Best for: Home networks, single-location systems + - Maximum security - DNS queries always encrypted + - **[2] ALLOW Mode:** Fallback to UDP allowed (AllowFallbackToUdp = $True) + - Best for: VPN users, mobile devices, corporate networks, captive portals + - Balanced security - falls back to unencrypted if DoH unavailable + - **[3] Skip:** Keep current DNS settings unchanged +- โœ… DNSSEC validation (server-side by all providers) +- โœ… DHCP-aware backup/restore +- โœ… Physical adapter auto-detection (excludes virtual/VPN adapters) +- โœ… Connectivity validation before apply + +--- + +## ๐Ÿ”‡ Module 4: Privacy (77 Settings) + +**Description:** Windows telemetry control, OneDrive/MS Store telemetry, and bloatware removal + +### What's Actually Done: +- โœ… **Windows Telemetry:** 3 modes (MSRecommended/Strict/Paranoid) +- โœ… **OneDrive Telemetry:** Feedback & sync reports disabled +- โœ… **OneDrive Sync:** Remains FUNCTIONAL (DisablePersonalSync = 0) +- โœ… **MS Store Telemetry:** AutoDownload = 3 (auto-update apps, no upgrade prompts) +- โœ… **Bloatware Removal:** 10-24+ apps removed (PolicyMethod for ENT/EDU, ClassicMethod for others) + +### Operating Modes (Interactive Selection): + +#### MSRecommended (Default - Fully Supported) +- AllowTelemetry = 1 (Required) +- Services NOT disabled (policies only) +- AppPrivacy: Selective (Location/Radios Force Deny, Mic/Camera user decides) +- **Best for:** Production, business environments + +#### Strict (Maximum Privacy) +- AllowTelemetry = 0 (Off) +- Services: DiagTrack + dmwappushservice disabled +- AppPrivacy: Force Deny Mic/Camera/Contacts/Calendar +- **Warning:** Breaks Teams/Zoom, Windows Update error reporting +- **Best for:** High-security, standalone systems + +#### Paranoid (Hardcore - NOT Recommended) +- Everything from Strict + WerSvc disabled +- Tasks: CEIP/AppExperience/DiskDiag disabled +- **Warning:** Breaks error analysis, support severely limited +- **Best for:** Air-gapped, extreme privacy only + +### โš ๏ธ Windows Insider Program Compatibility + +**MSRecommended mode** sets `AllowTelemetry=1` via Group Policy, which blocks Windows Insider Program enrollment. The Insider Program requires "Optional diagnostic data" (AllowTelemetry=3) for initial enrollment. + +**Workaround:** Temporarily remove the `AllowTelemetry` policy before Insider enrollment: +```powershell +Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" +``` + +After enrollment, you can optionally re-apply Privacy hardening. Insider builds will continue to download even with `AllowTelemetry=1` restored. + +**See:** [README Troubleshooting - Windows Insider Program Compatibility](../README.md#windows-insider-program-compatibility) + +--- + +### Bloatware Removal: + +**PolicyMethod (10 apps - ENT/EDU Win11 25H2+):** +- BingNews, BingWeather, MicrosoftSolitaireCollection +- MicrosoftStickyNotes, GamingApp, WindowsFeedbackHub +- Xbox components (GamingOverlay, IdentityProvider, SpeechToTextOverlay, TCUI) + +**ClassicMethod (24 apps - All other editions):** +``` +Microsoft.BingNews, Microsoft.BingWeather +Microsoft.MicrosoftSolitaireCollection, Microsoft.MicrosoftStickyNotes +Microsoft.GamingApp, Microsoft.XboxApp +Microsoft.XboxGamingOverlay, Microsoft.XboxIdentityProvider +Microsoft.XboxSpeechToTextOverlay, Microsoft.Xbox.TCUI +Microsoft.ZuneMusic, Microsoft.ZuneVideo +Microsoft.WindowsFeedbackHub, Microsoft.GetHelp +Microsoft.Getstarted, Microsoft.MixedReality.Portal +Microsoft.People, Microsoft.YourPhone +Clipchamp.Clipchamp, SpotifyAB.SpotifyMusic +*CandyCrush*, Disney.*, Facebook.*, TikTok.TikTok +``` + +### Protected Apps (18 kept): +- **Core Apps:** WindowsStore, WindowsCalculator, Photos, Paint +- **Productivity:** WindowsNotepad, WindowsTerminal, WindowsCamera, ScreenSketch, WindowsSoundRecorder +- **System:** DesktopAppInstaller (winget), StorePurchaseApp +- **Media Codecs:** HEIF, HEVC, WebP, VP9, WebMedia, AV1, MPEG2, RAW (8 extensions) + +### OneDrive Settings: +- Telemetry: Disabled +- Sync: Functional (not broken) +- Store: Enabled (app updates needed) + +--- + +## ๐Ÿค– Module 5: AntiAI (32 Policies) + +**Description:** Disable 13 Windows AI features via 32 registry policies (v2.2.0) + +### 13 AI Features Disabled: + +| # | Feature | Policies | Description | +|---|---------|----------|-------------| +| 1 | **Generative AI Master Switch** | 2 | Blocks ALL apps from using on-device AI models | +| 2 | **Windows Recall** | 8 | Screenshots, OCR, component removal + Enterprise Protection | +| 3 | **Windows Copilot** | 6 | 4-layer disable: WindowsAI, WindowsCopilot, Taskbar, Explorer | +| 4 | **Click to Do** | 2 | Screenshot AI analysis with action suggestions | +| 5 | **Paint Cocreator** | 1 | Cloud-based text-to-image generation | +| 6 | **Paint Generative Fill** | 1 | AI-powered image editing | +| 7 | **Paint Image Creator** | 1 | DALL-E art generator | +| 8 | **Notepad AI** | 1 | Write, Summarize, Rewrite features (GPT) | +| 9 | **Settings Agent** | 1 | AI-powered Settings search | +| 10 | **Recall Export Block** | 1 | Prevents export of Recall data | +| 11 | **Edge Copilot Sidebar** | 3 | EdgeSidebarEnabled, ShowHubsSidebar, HubsSidebarEnabled | +| 12 | **Edge Copilot Context** | 2 | CopilotPageContext, CopilotCDPPageContext | +| 13 | **File Explorer AI Actions** | 1 | HideAIActionsMenu in Explorer context menu | + +### Recall Enterprise Protection: +- **App Deny List:** Browser, Terminal, Password managers, RDP never captured +- **URI Deny List:** Banking (*.bank.*), Email (mail.*), Login pages (*password*, *login*) +- **Storage Duration:** Maximum 30 days retention +- **Storage Space:** Maximum 10 GB allocated + +### Automatically Blocked (by Master Switch): +- Photos Generative Erase / Background effects +- Clipchamp Auto Compose +- Snipping Tool AI-OCR / Quick Redact +- All future generative AI apps + +### 32 Registry Policies Applied: +``` +HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy\LetAppsAccessSystemAIModels = 2 +HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\systemAIModels\Value = Deny +HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\AllowRecallEnablement = 0 +HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\DisableAIDataAnalysis = 1 +HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\DisableAIDataAnalysis = 1 +HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\DisableRecallDataProviders = 1 +HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\SetDenyAppListForRecall = [...] +HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\SetDenyUriListForRecall = [...] +HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\SetMaximumStorageDurationForRecallSnapshots = 30 +HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\SetMaximumStorageSpaceForRecallSnapshots = 10 +HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\TurnOffWindowsCopilot = 1 +HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot\TurnOffWindowsCopilot = 1 +HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot\ShowCopilotButton = 0 +HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer\DisableWindowsCopilot = 1 +HKCU:\Software\Policies\Microsoft\Windows\WindowsCopilot\TurnOffWindowsCopilot = 1 +HKCU:\Software\Policies\Microsoft\Windows\WindowsCopilot\ShowCopilotButton = 0 +HKCU:\Software\Policies\Microsoft\Windows\WindowsAI\SetCopilotHardwareKey = Notepad (redirect) +HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\DisableClickToDo = 1 +HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\DisableClickToDo = 1 +HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Paint\DisableCocreator = 1 +HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Paint\DisableGenerativeFill = 1 +HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Paint\DisableImageCreator = 1 +HKLM:\SOFTWARE\Policies\WindowsNotepad\DisableAIFeatures = 1 +HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\DisableSettingsAgent = 1 +HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\AllowRecallExport = 0 +HKLM:\SOFTWARE\Policies\Microsoft\Edge\EdgeSidebarEnabled = 0 +HKLM:\SOFTWARE\Policies\Microsoft\Edge\ShowHubsSidebar = 0 +HKLM:\SOFTWARE\Policies\Microsoft\Edge\HubsSidebarEnabled = 0 +HKLM:\SOFTWARE\Policies\Microsoft\Edge\CopilotPageContext = 0 +HKLM:\SOFTWARE\Policies\Microsoft\Edge\CopilotCDPPageContext = 0 +``` + +### Impact: +- โœ… No AI data collection +- โœ… No cloud processing of local data +- โœ… Copilot completely hidden from taskbar and Start menu +- โœ… Edge Copilot sidebar disabled +- โœ… Traditional app experience restored +- โœ… **Reboot required** for Recall component removal + +### โš ๏ธ Known Limitations: +Some UI elements in Paint and Photos apps may **still be visible** but non-functional due to lack of Microsoft-provided policies: +- **Photos:** Generative Erase button, Background Blur/Remove options +- **Paint:** Some AI feature UI elements + +**Why?** Microsoft does NOT provide dedicated policies to hide these UI elements. Functionality is **blocked via systemAIModels API Master Switch** (LetAppsAccessSystemAIModels = 2), but UI removal requires Microsoft to add policies in future Windows updates. + +**Result:** Buttons are visible but clicking them does nothing (API access blocked). + +--- + +## ๐ŸŒ Module 6: EdgeHardening (24 Settings) + +**Description:** Microsoft Edge v139 Security Baseline + +### Core Security: +- EnhanceSecurityMode = 2 (Strict) +- SmartScreenEnabled = 1 +- SmartScreenPuaEnabled = 1 +- PreventSmartScreenPromptOverride = 1 +- SitePerProcess = 1 (Site isolation) + +### Privacy: +- TrackingPrevention = 2 (Strict) +- PersonalizationReportingEnabled = 0 +- DiagnosticData = 0 +- DoNotTrack = 1 + +### Security Mitigations: +- SSL/TLS error override blocked +- Extension blocklist (blocks all by default) +- IE Mode restrictions +- SharedArrayBuffer disabled (Spectre protection) +- Application-bound encryption enabled + +### Features: +- โœ… Native PowerShell implementation (no LGPO.exe) +- โœ… AllowExtensions parameter available +- โœ… Full backup/restore support + +--- + +## ๐Ÿ” Module 7: AdvancedSecurity (50 Settings) + +**Description:** Advanced hardening beyond Microsoft Security Baseline + +### Profile-Based Execution: + +| Feature | Balanced | Enterprise | Maximum | +|---------|------|------------|-----------| +| RDP NLA Enforcement | โœ… | โœ… | โœ… | +| WDigest Protection | โœ… | โœ… | โœ… | +| Risky Ports/Services | โœ… | โœ… | โœ… | +| Legacy TLS Disable | โœ… | โœ… | โœ… | +| WPAD Disable | โœ… | โœ… | โœ… | +| PowerShell v2 Removal | โœ… | โœ… | โœ… | +| Admin Shares Disable | โœ… | โš ๏ธ Domain Check | โœ… | +| RDP Complete Disable | โš ๏ธ Optional | โŒ | โœ… | +| UPnP/SSDP Block | โš ๏ธ Optional | โœ… | โœ… | +| Wireless Display Hardening | โœ… | โœ… | โœ… | +| Wireless Display Full Disable | โš ๏ธ Optional | โš ๏ธ Optional | โš ๏ธ Optional | +| Discovery Protocols (WSD/mDNS) Disable | โŒ | โŒ | โš ๏ธ Optional | +| Firewall Shields Up | โŒ | โŒ | โš ๏ธ Optional | +| IPv6 Disable (mitm6 mitigation) | โŒ | โŒ | โš ๏ธ Optional | +| SRP .lnk Protection | โœ… | โœ… | โœ… | +| Windows Update Config | โœ… | โœ… | โœ… | +| Finger Protocol Block | โœ… | โœ… | โœ… | + +### Components: + +#### 1. RDP Hardening (3 settings) +- **NLA Enforcement:** UserAuthentication = 1, SecurityLayer = 2 +- **Optional Disable:** fDenyTSConnections = 1 (Maximum profile only, for air-gapped systems) +- **Protection:** Prevents RDP brute-force attacks + +#### 2. WDigest Credential Protection (1 setting) +- **Registry:** UseLogonCredential = 0 +- **Protection:** Prevents LSASS memory credential theft (Mimikatz) +- **Note:** Deprecated in Win11 24H2+ but kept for backwards compatibility + +#### 3. Risky Ports Closure (15 firewall rules) +- **LLMNR:** Port 5355 TCP/UDP (MITM attack prevention) +- **NetBIOS:** Ports 137-138 TCP/UDP (name resolution hijacking) +- **UPnP:** Ports 1900, 2869 TCP/UDP (NAT traversal exploits) + +#### 4. Risky Services (3 services) +- **SSDP Discovery:** Disabled (UPnP) +- **UPnP Device Host:** Disabled +- **TCP/IP NetBIOS Helper:** Disabled + +#### 5. Administrative Shares (2 registry keys) +- **AutoShareWks = 0:** Disables C$, ADMIN$ +- **AutoShareServer = 0:** Server shares +- **Domain-Aware:** Auto-skipped for domain-joined systems unless -Force + +#### 6. Legacy TLS Disable (8 registry keys) +- **TLS 1.0:** Client + Server disabled +- **TLS 1.1:** Client + Server disabled +- **Protection:** BEAST, CRIME, POODLE attacks prevented + +#### 7. WPAD Disable (3 registry keys) +- **User + Machine:** AutoDetect = 0 +- **WinHTTP:** DisableWpad = 1 +- **Protection:** Proxy hijacking attacks prevented + +#### 8. PowerShell v2 Removal (1 Windows Feature) +- **Feature:** MicrosoftWindowsPowerShellV2Root +- **Protection:** Prevents downgrade attacks (bypasses logging, AMSI, CLM) + +#### 9. SRP .lnk Protection - CVE-2025-9491 (2 rules) +- **Rule 1:** Block %LOCALAPPDATA%\Temp\*.lnk (Outlook attachments) +- **Rule 2:** Block %USERPROFILE%\Downloads\*.lnk (Browser downloads) +- **Protection:** Prevents zero-day LNK RCE exploitation +- **Status:** CRITICAL - Actively exploited since 2017, no patch available + +#### 10. Windows Update Configuration (3 Simple GUI Settings) + +**Aligns with Windows Settings GUI toggles** โ€“ NO forced schedules, NO auto-reboot, and only the documented policy keys needed to drive the visible switches + +**Settings Applied:** + +**1. Get Latest Updates Immediately (ON, managed by policy)** +- Registry: `HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate` +- Keys: + - `AllowOptionalContent = 1` + - `SetAllowOptionalContent = 1` +- Effect: Enables optional/content configuration updates so the toggle "Get the latest updates as soon as they're available" is effectively ON and enforced by policy +- GUI Path: Settings > Windows Update > Advanced options > Get the latest updates as soon as they're available (will show as managed by your organization) + +**2. Microsoft Update for Other Products (ON, user-toggleable)** +- Registry: `HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings` +- Key: `AllowMUUpdateService = 1` +- Effect: Get updates for Office, drivers, and other Microsoft products when updating Windows +- GUI Path: Settings > Windows Update > Advanced options > Receive updates for other Microsoft products (user can still toggle) + +**3. Delivery Optimization - Downloads from Other Devices (OFF, managed by policy)** +- Registry: `HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization` +- Key: `DODownloadMode = 0` +- Effect: HTTP only (Microsoft servers) โ€“ no peer-to-peer, no LAN sharing +- GUI Path: Settings > Windows Update > Advanced options > Delivery Optimization > Allow downloads from other devices = OFF (managed by your organization) + +**User Control & Transparency:** +- โœ… NO forced installation schedules +- โœ… NO auto-reboot policies +- โœ… Microsoft Update toggle remains user-controlled in the GUI +- โœ… Windows clearly indicates where policies manage settings ("Some settings are managed by your organization") + +**Why This Approach?** +- Follows Microsoft Best Practice - matches GUI behavior +- User keeps control over installation timing +- No unexpected reboots at 3 AM +- Transparent - exactly what Windows Settings shows + +#### 11. Finger Protocol Block (1 firewall rule) +- **Port:** TCP 79 outbound +- **Protection:** ClickFix malware campaign mitigation +- **Attack:** Malware uses finger.exe to retrieve commands from attacker servers +- **Impact:** Zero (Finger protocol obsolete since 1990s) + +#### 12. Wireless Display Security (9 settings) + +**Default Hardening (always applied, all profiles):** +- **AllowProjectionToPC = 0:** Block receiving projections (PC can't be used as display) +- **RequirePinForPairing = 2:** Always require PIN for pairing + +**Optional Full Disable (user choice):** +- **AllowProjectionFromPC = 0:** Block sending projections +- **AllowMdnsAdvertisement = 0:** Don't advertise as receiver via mDNS +- **AllowMdnsDiscovery = 0:** Don't discover displays via mDNS +- **AllowProjectionFromPCOverInfrastructure = 0:** Block infrastructure projection +- **AllowProjectionToPCOverInfrastructure = 0:** Block infrastructure receiving +- **Firewall Rules:** Block Miracast ports 7236/7250 (TCP + UDP) + +**Protection:** +- Prevents rogue Miracast receiver attacks (screen capture by attackers in network) +- Blocks WPS PIN brute-force on Miracast connections +- Prevents mDNS spoofing for fake display discovery +- Defense-in-depth for Miracast attack surface + +**Impact:** +- Default: Presentations to TV/projector still work (sending allowed) +- Full Disable: Use HDMI/USB-C cables instead of Miracast + +#### 13. Discovery Protocols Security (WS-Discovery + mDNS) + +**Optional (Maximum profile - user choice):** +- **mDNS Resolver:** Disabled via registry (EnableMDNS = 0) +- **WS-Discovery Services:** FDResPub + SSDPSRV disabled +- **Firewall Blocks:** + - WS-Discovery ports: UDP 3702 (blocked inbound/outbound) + - mDNS port: UDP 5353 (blocked inbound/outbound) + +**Protection:** +- Prevents network mapping via WS-Discovery +- Blocks mDNS spoofing attacks (fake printers/devices) +- Reduces lateral movement attack surface +- Stops automatic device enumeration by attackers + +**Impact:** +- Automatic network printer/scanner discovery stops +- Smart TV discovery via mDNS stops +- Miracast discovery via mDNS stops (even if Feature 12 allows sending) +- Manual IP configuration required for network devices + +#### 14. Firewall Shields Up (Maximum profile only) + +**Optional (Maximum profile):** +- **Block All Inbound:** DefaultInboundAction = Block +- **Block All Outbound:** DefaultOutboundAction = Block (with exceptions) +- Applies to Domain, Private, and Public profiles + +**Protection:** +- Maximum network isolation +- Blocks all unsolicited inbound connections +- Prevents unauthorized outbound connections + +**Impact:** +- Only explicitly allowed traffic passes +- Recommended for air-gapped or high-security systems + +#### 15. IPv6 Disable (Maximum profile only - optional) + +**Optional (Maximum profile - user choice):** +- **DisabledComponents = 0xFF:** Completely disables IPv6 stack +- Prevents all IPv6 traffic including DHCPv6 Solicitation + +**Protection (mitm6 attack):** +- Prevents DHCPv6 spoofing attacks +- Blocks fake DHCPv6 server โ†’ DNS takeover +- Prevents NTLM credential relay via IPv6 +- Defense-in-depth (WPAD already disabled) + +**Impact:** +- IPv6-only services/websites won't work +- Exchange Server may have issues if using IPv6 +- Some Active Directory features may be affected +- **REBOOT REQUIRED** + +**Recommended for:** +- Air-gapped systems +- Standalone workstations (no Exchange/AD) +- High-security environments where IPv6 is not needed + +--- + +## ๐ŸŽฏ Protection Coverage + +### Zero-Day Vulnerabilities: + +#### CVE-2025-9491 - Windows LNK RCE โœ… MITIGATED +- **Status:** Unpatched (Microsoft: "does not meet servicing threshold") +- **Exploited Since:** 2017 by APT groups +- **Our Protection:** SRP rules block .lnk execution from Temp/Downloads +- **Why ASR Fails:** .lnk files not classified as "executable content" +- **Why SmartScreen Fails:** .lnk points to legitimate cmd.exe (trusted) + +#### ClickFix Malware Campaign โœ… MITIGATED +- **Attack Vector:** finger.exe abuse to retrieve malicious commands +- **Our Protection:** Outbound TCP port 79 blocked +- **Impact:** Zero (legacy protocol unused in 2025) + +### Attack Surface Reduction: + +| Attack Type | Protection | +|-------------|-----------| +| **Email Malware** | ASR: Block executables from email | +| **USB Malware** | ASR: Block untrusted USB processes | +| **Office Macros** | ASR: Block Win32 API calls | +| **Credential Theft** | ASR: Block LSASS access + WDigest disabled | +| **Ransomware** | ASR: Advanced ransomware protection | +| **MITM Attacks** | DNS DoH + LLMNR/NetBIOS disabled | +| **RDP Brute-Force** | NLA enforcement + optional disable | +| **Proxy Hijacking** | WPAD disabled | +| **TLS Exploits** | TLS 1.0/1.1 disabled (BEAST/CRIME) | +| **PowerShell Downgrade** | PSv2 removed | +| **DMA Attacks** | FireWire (IEEE 1394) blocked | + +--- + +## ๐Ÿ“‹ Interactive Features + +### User Prompts (13 Total): + +#### SecurityBaseline (1 prompt): +1. **BitLocker USB Policy** (Home/Enterprise) + - Home Mode: USB works normally (no encryption enforcement) + - Enterprise Mode: Require BitLocker encryption on USB drives + +#### ASR (2 prompts): +2. **PSExec/WMI rule mode** (Block/Audit) + - Block: Maximum security (may break SCCM/remote admin) + - Audit: Log only (compatibility testing) + +3. **New Software rule mode** (Block/Audit) + - Block: Block executables that don't meet prevalence criteria + - Audit: Log only (recommended for new software installs) + +#### DNS (2 prompts): +4. **Provider selection** (Quad9/Cloudflare/AdGuard/Skip) + - 3 DNS providers available with ratings + - Skip option to keep current DNS + +5. **DoH Mode selection** (REQUIRE/ALLOW/Skip) + - REQUIRE: No unencrypted fallback (maximum security) + - ALLOW: Fallback to UDP if needed (VPN/corporate/mobile) + - Skip: Keep current DNS settings + +#### Privacy (3 prompts): +6. **Mode selection** (MSRecommended/Strict/Paranoid) + - MSRecommended: Fully supported, production-safe + - Strict: Maximum privacy (may break Teams/Zoom) + - Paranoid: Extreme privacy (very limited support) + +7. **Cloud Clipboard** (Enable/Disable) - *only in MSRecommended mode* + - Disable: No cross-device clipboard sync (privacy) + - Enable: Keep cloud clipboard functionality + +8. **Bloatware Removal** (Yes/No) + - Yes: Remove 10-24 pre-installed apps + - No: Keep all apps installed + +#### AdvancedSecurity (5 prompts): +9. **Profile selection** (Balanced/Enterprise/Maximum) + - Balanced: Safe defaults for home users + - Enterprise: Domain-aware checks + - Maximum: Maximum hardening + +10. **RDP Disable** (Yes/No) - *Balanced profile only, Maximum always disables* + - Yes: Completely disable Remote Desktop + - No: Keep RDP enabled (with NLA hardening) + +11. **UPnP/SSDP Block** (Yes/No) - *Balanced profile only, others always block* + - Yes: Block UPnP/SSDP (may break DLNA streaming) + - No: Keep UPnP enabled + +12. **Wireless Display Disable** (Yes/No) - *all profiles* + - Yes: Completely disable Miracast (use HDMI instead) + - No: Keep Miracast hardened but usable + +13. **Admin Shares Disable** (Yes/No) - *Domain-joined systems only* + - Yes: Disable C$/ADMIN$ even on domain (may break IT tools) + - No: Keep admin shares for IT management (SCCM, PDQ, etc.) + +### Backup & Restore: + +- โœ… Session-based backup system (Initialize-BackupSystem) +- โœ… Full registry backup before changes +- โœ… Service state backup +- โœ… Feature state backup +- โœ… DHCP settings backup (DNS module) +- โœ… Restore capability for all modules + +### Verification: + +- โœ… Test-BaselineCompliance (SecurityBaseline) +- โœ… Test-ASRCompliance (ASR) +- โœ… Test-DNSConnectivity (DNS) +- โœ… Test-AntiAI (AntiAI) +- โœ… Test-PrivacyCompliance (Privacy) +- โœ… Test-EdgeHardening (EdgeHardening) +- โœ… Test-AdvancedSecurity (AdvancedSecurity) + +--- + +## ๐Ÿ”ง Safety Features + +### Pre-Flight Checks: +- โœ… Administrator elevation required +- โœ… OS version detection (Windows 11 24H2+) +- โœ… Hardware capability detection (TPM, VBS) +- โœ… Domain-joined system detection + +### Execution Safety: +- โœ… WhatIf mode (dry-run preview) +- โœ… Profile-based execution (Balanced/Enterprise/Maximum) +- โœ… Incremental backups +- โœ… Error handling with graceful degradation +- โœ… Comprehensive logging + +### Rollback: +- โœ… Restore-SecurityBaseline +- โœ… Restore-DNSSettings +- โœ… Restore-PrivacySettings +- โœ… Restore-AdvancedSecuritySettings + +--- + +## ๐Ÿ“Š Home User Friendly + +### Password Policies (Low Impact): +- โœ… Only affect local accounts (~5% of home users) +- โœ… 95%+ use Microsoft Accounts (managed online by Microsoft) +- โœ… Policies: MinimumPasswordLength (14), PasswordHistory (24), Lockout (10) + +### BitLocker USB (User Choice): +- โœ… Default: Home Mode (USB works normally) +- โœ… Option: Enterprise Mode (encryption enforcement) +- โœ… Interactive prompt during SecurityBaseline + +### FireWire Blocking: +- โœ… Blocks IEEE 1394 devices (DMA attack prevention) +- โœ… Impact: <1% of users (obsolete technology) + + +--- + +## ๐ŸŽ‰ Framework Status + +``` +โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” +NoID Privacy v2.2.0 +โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” + +Total Settings: 632 โœ… +Modules: 7/7 (100%) โœ… +Production Status: Ready โœ… +Verification: 100% โœ… +BACKUP-APPLY-VERIFY-RESTORE: Complete โœ… + +Zero-Day Protection: โœ… CVE-2025-9491 + ClickFix +Microsoft Best Practices: 100% โœ… +Home User Friendly: โœ… Interactive prompts +Enterprise Ready: โœ… Profile-based execution + +Framework Completion: ๐ŸŽ‰ 100% COMPLETE +โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” +``` + +--- + +**Last Updated:** December 7, 2025 +**Framework Version:** v2.2.0 diff --git a/Docs/LICENSE-HISTORY.md b/Docs/LICENSE-HISTORY.md new file mode 100644 index 0000000..ce40f87 --- /dev/null +++ b/Docs/LICENSE-HISTORY.md @@ -0,0 +1,86 @@ +# License History + +This document tracks the license history of NoID Privacy. + +--- + +## Current License (v2.x Series) + +**GNU General Public License v3.0** (GPL-3.0) +**Effective:** November 20, 2025 +**Applies to:** All v2.x releases (v2.0.0 and later) + +See [LICENSE](LICENSE) for full text. + +--- + +## Previous License (v1.0.0 - v1.8.3) + +**MIT License** +**Effective:** 2024 - November 13, 2025 +**Applies to:** All v1.x releases (v1.0.0 through v1.8.3) + +### Why the License Changed + +**Reason for Change:** +- Version 2.0+ represents a **complete rewrite** from scratch +- 100% new codebase with modular architecture +- Zero code from v1.x carried forward +- New author retains full copyright over v2.x codebase + +**Legal Basis:** +- As the sole copyright holder of v2.x code, relicensing is permitted +- MIT License (v1.x) allows derivative works under different licenses +- No external contributors' rights are affected (complete rewrite) + +**Impact:** +- **v1.8.3 and earlier:** Remain under MIT License (cannot be changed retroactively) +- **v2.2.0 and later:** Licensed under GPL v3.0 +- Forks of v1.x can remain MIT-licensed +- Forks of v2.x must comply with GPL v3.0 + +--- + +## MIT License Text (v1.x) + +``` +MIT License + +Copyright (c) 2024-2025 NexusOne23 + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. +``` + +--- + +## Dual-Licensing (v2.x+) + +Version 2.x+ is available under dual-licensing: + +1. **GPL v3.0** (Open Source) - Free for open-source projects +2. **Commercial License** - For closed-source commercial use + +Contact via [GitHub Discussions](https://github.com/NexusOne23/noid-privacy/discussions) for commercial licensing inquiries. + +--- + +## Questions? + +If you have questions about licensing, please open a discussion on GitHub: +https://github.com/NexusOne23/noid-privacy/discussions diff --git a/Docs/NONINTERACTIVE-MODE.md b/Docs/NONINTERACTIVE-MODE.md new file mode 100644 index 0000000..64f21b4 --- /dev/null +++ b/Docs/NONINTERACTIVE-MODE.md @@ -0,0 +1,467 @@ +# NonInteractive Mode - CI/CD & Automation Guide + +## Overview + +NoID Privacy supports fully automated, non-interactive execution for CI/CD pipelines, group policy deployment, and mass system hardening. This guide explains how to run the framework without any interactive prompts. + +--- + +## Configuration-Based Execution + +The framework automatically enters non-interactive mode when all required parameters are pre-configured in `config.json`. + +### Required Configuration Keys + +#### **1. DNS Module - Provider Selection** + +```json +{ + "modules": { + "DNS": { + "enabled": true, + "priority": 3, + "status": "IMPLEMENTED", + "description": "Secure DNS with DoH", + "provider": "Quad9" + } + } +} +``` + +**Valid provider values:** +- `"Quad9"` (default, security-focused, Swiss privacy) +- `"Cloudflare"` (fastest resolver) +- `"AdGuard"` (ad/tracker blocking) + +**When provider is set:** +- No interactive DNS provider selection prompt +- Direct application of specified provider + +--- + +#### **2. Privacy Module - Mode Selection** + +```json +{ + "modules": { + "Privacy": { + "enabled": true, + "priority": 4, + "status": "IMPLEMENTED", + "description": "Privacy hardening", + "mode": "MSRecommended" + } + } +} +``` + +**Valid mode values:** +- `"MSRecommended"` (default, fully supported, production-ready) +- `"Strict"` (maximum privacy, breaks some apps) +- `"Paranoid"` (hardcore, not recommended for production) + +**When mode is set:** +- No interactive privacy mode selection prompt +- Direct application of specified mode with warnings logged + +--- + +#### **3. Global Options - Automation Settings** + +```json +{ + "options": { + "dryRun": false, + "createBackup": true, + "verboseLogging": false, + "autoReboot": false, + "nonInteractive": true + } +} +``` + +**Key options:** +- `nonInteractive`: Explicitly disable all prompts (optional, auto-detected) +- `autoReboot`: Automatically restart after hardening (use with caution) +- `createBackup`: Always create backups (highly recommended) + +--- + +## Command-Line Execution + +### **Basic Non-Interactive Execution** + +```powershell +# Run all enabled modules from config.json +.\NoIDPrivacy.ps1 -Module All + +# Run specific module with provider pre-configured +.\NoIDPrivacy.ps1 -Module DNS + +# Run with command-line overrides +.\NoIDPrivacy.ps1 -Module Privacy -DryRun + +# Run in verbose mode for logging +.\NoIDPrivacy.ps1 -Module All -VerboseLogging +``` + +--- + +### **CI/CD Pipeline Example** + +#### **Azure DevOps Pipeline** + +```yaml +steps: + - task: PowerShell@2 + displayName: 'NoID Privacy Hardening' + inputs: + targetType: 'filePath' + filePath: '$(System.DefaultWorkingDirectory)/NoIDPrivacy.ps1' + arguments: '-Module All -VerboseLogging' + errorActionPreference: 'stop' + pwsh: false + condition: succeededOrFailed() + + - task: PublishBuildArtifacts@1 + displayName: 'Publish Hardening Logs' + inputs: + PathtoPublish: 'Logs' + ArtifactName: 'hardening-logs' +``` + +#### **GitHub Actions Workflow** + +```yaml +name: Windows Hardening + +on: + schedule: + - cron: '0 0 * * 0' # Weekly on Sunday + workflow_dispatch: + +jobs: + harden: + runs-on: windows-latest + steps: + - uses: actions/checkout@v3 + + - name: Run NoID Privacy + shell: powershell + run: | + .\NoIDPrivacy.ps1 -Module All -VerboseLogging + + - name: Upload Logs + if: always() + uses: actions/upload-artifact@v3 + with: + name: hardening-logs + path: Logs/ +``` + +#### **Jenkins Pipeline** + +```groovy +pipeline { + agent { label 'windows' } + + stages { + stage('Hardening') { + steps { + powershell ''' + Set-ExecutionPolicy Bypass -Scope Process -Force + .\\NoIDPrivacy.ps1 -Module All -VerboseLogging + ''' + } + } + } + + post { + always { + archiveArtifacts artifacts: 'Logs/**/*', fingerprint: true + } + } +} +``` + +--- + +## Group Policy Deployment + +### **Method 1: Startup Script** + +1. Copy NoID Privacy to network share: + ``` + \\domain.local\NETLOGON\NoIDPrivacy\ + ``` + +2. Create GPO startup script: + ```powershell + # Startup-Hardening.ps1 + $scriptPath = "\\domain.local\NETLOGON\NoIDPrivacy\NoIDPrivacy.ps1" + + if (Test-Path $scriptPath) { + & $scriptPath -Module All -VerboseLogging + } + ``` + +3. Link GPO to target OU +4. Result logged to: `C:\NoIDPrivacy\Logs\` + +--- + +### **Method 2: Scheduled Task (Recommended)** + +Deploy via GPO Scheduled Task: + +```xml + + + + + 2025-01-01T03:00:00 + + + 1 + + + + + + powershell.exe + -ExecutionPolicy Bypass -File "\\domain.local\NETLOGON\NoIDPrivacy\NoIDPrivacy.ps1" -Module All + + + +``` + +--- + +## Verification Without Interaction + +### **Silent Verification** + +```powershell +# Run verification and export structured JSON +.\Tools\Verify-Complete-Hardening.ps1 -ExportPath "verification-result.json" + +# Parse results programmatically +$verification = Get-Content "verification-result.json" | ConvertFrom-Json + +if ($verification.Failed -eq 0) { + Write-Output "All settings verified successfully" + exit 0 +} else { + Write-Error "Verification failed: $($verification.Failed) settings did not match expected values" + exit 1 +} +``` + +--- + +## Environment Variables (Alternative) + +Instead of modifying `config.json`, use environment variables: + +```powershell +# Set environment variables +$env:NOIDPRIVACY_DNS_PROVIDER = "Quad9" +$env:NOIDPRIVACY_PRIVACY_MODE = "MSRecommended" +$env:NOIDPRIVACY_NONINTERACTIVE = "true" + +# Run framework +.\NoIDPrivacy.ps1 -Module All +``` + +**Note:** Environment variables require framework support and are currently a roadmap feature (not yet implemented). + +--- + +## Return Codes + +**Note:** Exit codes are currently not implemented. Error handling should be done via try/catch blocks and checking the log files. + +### **Example: Error Handling in Scripts** + +```powershell +try { + .\NoIDPrivacy.ps1 -Module All -ErrorAction Stop + Write-Output "Hardening completed successfully" +} +catch { + Write-Error "Hardening failed: $_" + # Check logs for details + $latestLog = Get-ChildItem "Logs" -Filter "NoIDPrivacy-*.log" | Sort-Object LastWriteTime -Descending | Select-Object -First 1 + Get-Content $latestLog.FullName | Select-String "ERROR" + exit 1 +} +``` + +--- + +## Best Practices for Automation + +### **1. Always Use DryRun First** + +```powershell +# Test configuration without applying +.\NoIDPrivacy.ps1 -Module All -DryRun -VerboseLogging + +# Review logs before production run +Get-Content "Logs\NoIDPrivacy-*.log" | Select-String "ERROR|WARNING" +``` + +--- + +### **2. Centralized Logging** + +Configure log aggregation for enterprise deployment: + +```powershell +# Example: Copy logs to central location +$logPath = "C:\NoIDPrivacy\Logs" +$centralPath = "\\fileserver\HardeningLogs\$env:COMPUTERNAME" + +if (Test-Path $logPath) { + Copy-Item -Path "$logPath\*" -Destination $centralPath -Recurse -Force +} +``` + +--- + +### **3. Rollback Plan** + +Always maintain rollback capability: + +```powershell +# Before mass deployment, test rollback +.\NoIDPrivacy.ps1 -Module DNS + +# Restore from latest backup (uses Core\Rollback.ps1) +.\Core\Rollback.ps1 -RestoreLatest + +# Or restore specific module +.\Modules\DNS\Public\Restore-DNSSettings.ps1 + +# Verify rollback worked +.\Tools\Verify-Complete-Hardening.ps1 +``` + +--- + +## Troubleshooting Non-Interactive Mode + +### **Issue: Still Showing Prompts** + +**Cause:** Provider/mode not configured in `config.json` + +**Solution:** +```json +{ + "modules": { + "DNS": { "provider": "Quad9" }, + "Privacy": { "mode": "MSRecommended" } + } +} +``` + +--- + +### **Issue: Script Fails Silently** + +**Cause:** Error suppression in CI/CD + +**Solution:** +```powershell +# Use verbose logging + error action +.\NoIDPrivacy.ps1 -Module All -VerboseLogging -ErrorAction Stop +``` + +--- + +### **Issue: Insufficient Permissions** + +**Cause:** Not running as Administrator + +**Solution:** +```powershell +# For scheduled tasks, use SYSTEM account or admin user +# For GPO, startup scripts run as SYSTEM automatically +``` + +--- + +## Complete Example: Enterprise Deployment Script + +```powershell +<# +.SYNOPSIS + Enterprise deployment wrapper for NoID Privacy + +.DESCRIPTION + Automated hardening with centralized logging and email reporting +#> + +param( + [switch]$DryRun, + [string]$EmailRecipient = "security@company.com" +) + +$ErrorActionPreference = "Stop" +$scriptRoot = Split-Path -Parent $MyInvocation.MyCommand.Path + +try { + # Pre-flight checks + if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { + throw "Must run as Administrator" + } + + # Run hardening + Write-Output "Starting NoID Privacy hardening..." + $result = & "$scriptRoot\NoIDPrivacy.ps1" -Module All -DryRun:$DryRun -VerboseLogging + + # Collect logs + $logPath = "$scriptRoot\Logs" + $latestLog = Get-ChildItem $logPath -Filter "NoIDPrivacy-*.log" | Sort-Object LastWriteTime -Descending | Select-Object -First 1 + + # Send report email + $emailBody = @" +NoID Privacy Hardening Report + +Computer: $env:COMPUTERNAME +Date: $(Get-Date -Format "yyyy-MM-dd HH:mm:ss") +Mode: $(if($DryRun){"DRY RUN"}else{"APPLY"}) + +Log file attached. +"@ + + Send-MailMessage -To $EmailRecipient ` + -From "hardening@company.com" ` + -Subject "Hardening Report - $env:COMPUTERNAME" ` + -Body $emailBody ` + -Attachments $latestLog.FullName ` + -SmtpServer "smtp.company.com" + + Write-Output "Hardening completed successfully" + exit 0 +} +catch { + Write-Error "Hardening failed: $_" + exit 1 +} +``` + +--- + +## Summary + +**For non-interactive execution:** + +1. โœ… Configure `provider` and `mode` in `config.json` +2. โœ… Use `-Module All` parameter +3. โœ… Enable `-VerboseLogging` for CI/CD +4. โœ… Always test with `-DryRun` first +5. โœ… Implement centralized logging +6. โœ… Plan rollback procedures + +**The framework is fully automation-ready when configured correctly!** diff --git a/Docs/SECURITY-ANALYSIS.md b/Docs/SECURITY-ANALYSIS.md new file mode 100644 index 0000000..74e093f --- /dev/null +++ b/Docs/SECURITY-ANALYSIS.md @@ -0,0 +1,105 @@ +# ๐Ÿ›ก๏ธ Security Impact Analysis for Home Users + +**Understanding how Enterprise Security affects your Home PC** + +This document explains the impact of applying the **Microsoft Security Baseline** (designed for Enterprise) to a standalone **Windows 11 Home/Pro** workstation. + +> **Executive Summary:** +> 98% of the settings improve security without visible impact. The remaining 2% (BitLocker, Password Policy) have been adjusted or documented to ensure usability for home users. + +--- + +## 1. Password Policies + +**Setting:** `MinimumPasswordLength = 14`, `PasswordHistory = 24` + +### ๐Ÿ  Home User Impact: **Low / None** +- **Microsoft Accounts:** These policies DO NOT affect your Microsoft Account (Outlook/Live/Hotmail) login. Microsoft manages those policies in the cloud. +- **Local Accounts:** If you use a local "Offline" account, you will be forced to set a 14-character password next time you change it. +- **PIN / FaceID:** Unaffected. You can still use Windows Hello PIN (4-6 digits) to sign in. The complex password is only for the underlying account. + +**Recommendation:** Use a password manager generated password for your local account, and use PIN for daily login. + +--- + +## 2. BitLocker USB Protection + +**Setting:** `DenyWriteAccessOnFixedDrivesIfNotProtected` (Registry Policy) + +### ๐Ÿ  Home User Impact: **High (if enabled)** +- **Enterprise Default:** Windows blocks writing to ANY USB drive unless it is encrypted with BitLocker. +- **NoID Privacy Default:** **DISABLED (Home Mode)**. +- **Why?** Home users often share USB sticks with TVs, cars, or friends (Mac/Linux). Enforcing BitLocker makes the drive unreadable on non-Windows devices. + +**Your Choice:** +The tool asks you interactively: +- **[N] No (Default):** USB drives work normally. Safe for home use. +- **[Y] Yes:** Maximum security. USB drives are Read-Only until you encrypt them. + +--- + +## 3. FireWire (IEEE 1394) Blocking + +**Setting:** DMA Protection / Device Installation Restrictions + +### ๐Ÿ  Home User Impact: **Near Zero** +- **What is it?** An obsolete connection standard (pre-USB 3.0) used by old camcorders. +- **Why block it?** Vulnerable to Direct Memory Access (DMA) attacks where an attacker plugs a device in and steals RAM content (passwords/keys) in seconds. +- **Reality:** Most modern PCs don't even have FireWire ports. + +**Workaround:** +If you absolutely need to transfer video from a 2005 camcorder: +```powershell +# Run as Admin to temporarily allow +Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" -Name "DenyDeviceClasses" -Value 0 +``` + +--- + +## 4. Attack Surface Reduction (ASR) + +**Setting:** 19 Defender Rules (Block Mode) + +### ๐Ÿ  Home User Impact: **Low** +- **Blocked:** running `.exe` files directly from an email attachment (Outlook). +- **Solution:** Save the file to Downloads folder first, then run it. This simple friction stops 90% of malware. +- **Blocked:** Office Macros downloading files. +- **Solution:** Don't enable macros in documents from unknown sources. + +**PSExec / WMI Rule:** +- Enterprise admin tools used for remote management. +- Home users don't use these. Blocking them stops malware lateral movement. +- **Safe to Block.** + +--- + +## 5. App Compatibility + +### Known Issues +- **Legacy Games (Pre-2010):** Some old games require **DirectPlay** or **SMBv1**. + - *NoID Privacy* disables SMBv1 (WannaCry ransomware vector). +- **Network Scanners:** Old Canon/HP printers might use SMBv1 for "Scan to Folder". + - *Solution:* Use "Scan to Email" or update printer firmware. +- **Cheater Software:** Some game hacks/trainers inject code into processes. ASR rules will block this. + +### Troubleshooting +If an app fails to launch: +1. Check `Windows Security` > `Protection History`. +2. It will show if an **ASR Rule** or **Controlled Folder Access** blocked it. + +--- + +## 6. AI & Privacy + +**Setting:** Recall & Copilot disabled, Telemetry minimized (Security-Essential level) + +### ๐Ÿ  Home User Impact: **Positive** +- **Performance:** Less background activity (indexing, analyzing). +- **Privacy:** Screenshots (Recall) are not taken. +- **Experience:** Start Menu and Taskbar are cleaner (no Copilot ads). +- **Functionality:** Paint/Notepad AI features (Cocreator) will be disabled. If you pay for Copilot Pro, you might want to skip the **AntiAI** module. + +--- + +**Conclusion:** +NoID Privacy transforms a "leaky" Home edition into an "Enterprise Fortress" for everyday use, ohne die Fรคhigkeit zu verlieren, Spiele zu spielen oder normal zu surfen. Die wenigen Reibungspunkte (USB, Makros, alte Protokolle) sind bewusst gesetzte Sicherheitstore. diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..d6f3c3c --- /dev/null +++ b/LICENSE @@ -0,0 +1,697 @@ +๏ปฟ GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + Copyright (C) + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +. + +================================================================================ + +APPLICATION TO NoID Privacy: + +NoID Privacy +Copyright (C) 2025 NexusOne23 + +This program is free software: you can redistribute it and/or modify +it under the terms of the GNU General Public License as published by +the Free Software Foundation, either version 3 of the License, or +(at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU General Public License for more details. + +You should have received a copy of the GNU General Public License +along with this program. If not, see . + +For commercial licensing options (dual-licensing), please see Docs/LICENSE-HISTORY.md +or contact via GitHub Discussions at https://github.com/NexusOne23/noid-privacy/discussions diff --git a/Modules/ASR/ASR.psd1 b/Modules/ASR/ASR.psd1 new file mode 100644 index 0000000..5fc6694 --- /dev/null +++ b/Modules/ASR/ASR.psd1 @@ -0,0 +1,39 @@ +@{ + RootModule = 'ASR.psm1' + ModuleVersion = '2.2.0' + GUID = 'b2c3d4e5-f6a7-8901-bcde-f23456789012' + Author = 'NexusOne23' + CompanyName = 'Open Source Project' + Copyright = '(c) 2025 NexusOne23. Licensed under GPL-3.0.' + Description = 'Attack Surface Reduction (ASR) - All 19 Microsoft Defender ASR rules in Block mode for maximum protection against modern threats' + + PowerShellVersion = '5.1' + + RequiredModules = @() + + FunctionsToExport = @( + 'Invoke-ASRRules' + ) + + CmdletsToExport = @() + VariablesToExport = @() + AliasesToExport = @() + + PrivateData = @{ + PSData = @{ + Tags = @('Security', 'ASR', 'AttackSurfaceReduction', 'Defender', 'Windows11', 'Ransomware') + LicenseUri = '' + ProjectUri = '' + ReleaseNotes = @" +v2.2.0 - Production Release +- All 19 ASR rules implementation +- Hybrid approach: Registry backup + Set-MpPreference application +- SCCM/Configuration Manager detection +- Cloud protection verification +- Exclusions management support +- Full BACKUP/APPLY/VERIFY/RESTORE support +- Security Baseline overlap detection and logging +"@ + } + } +} diff --git a/Modules/ASR/ASR.psm1 b/Modules/ASR/ASR.psm1 new file mode 100644 index 0000000..d8d4a8b --- /dev/null +++ b/Modules/ASR/ASR.psm1 @@ -0,0 +1,52 @@ +<# +.SYNOPSIS + Attack Surface Reduction (ASR) Module + +.DESCRIPTION + Enables all 19 Microsoft Defender ASR rules in Block mode for comprehensive protection. + + Hybrid implementation: + - Registry for backup/verification + - Set-MpPreference for clean application + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+, Administrator privileges, Windows Defender +#> + +# Get the module root path +$ModuleRoot = $PSScriptRoot + +# Dot source all Private functions +$PrivatePath = Join-Path $ModuleRoot "Private" +if (Test-Path $PrivatePath) { + Get-ChildItem -Path $PrivatePath -Filter "*.ps1" | ForEach-Object { + try { + . $_.FullName + } + catch { + Write-Host "WARNING: Failed to import private function $($_.Name): $_" -ForegroundColor Yellow + } + } +} + +# Dot source all Public functions +$PublicPath = Join-Path $ModuleRoot "Public" +if (Test-Path $PublicPath) { + Get-ChildItem -Path $PublicPath -Filter "*.ps1" | ForEach-Object { + try { + . $_.FullName + } + catch { + Write-Host "WARNING: Failed to import public function $($_.Name): $_" -ForegroundColor Yellow + } + } +} + +# Export public functions + Test-ASRCompliance (needed for Invoke-ASRRules verification) +Export-ModuleMember -Function @('Invoke-ASRRules', 'Test-ASRCompliance') + +# Alias for naming consistency (non-breaking change) +New-Alias -Name 'Invoke-ASR' -Value 'Invoke-ASRRules' -Force +Export-ModuleMember -Alias 'Invoke-ASR' diff --git a/Modules/ASR/Config/ASR-Rules.json b/Modules/ASR/Config/ASR-Rules.json new file mode 100644 index 0000000..d0664fb --- /dev/null +++ b/Modules/ASR/Config/ASR-Rules.json @@ -0,0 +1,173 @@ +[ + { + "Name": "Block abuse of exploited vulnerable signed drivers", + "GUID": "56a863a9-875e-4185-98a7-b882c64b5ce5", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": false, + "Warnings": [], + "Description": "Prevents applications from writing vulnerable signed drivers to disk" + }, + { + "Name": "Block Adobe Reader from creating child processes", + "GUID": "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": false, + "Warnings": [], + "Description": "Blocks Adobe Reader from creating processes to prevent malware spread" + }, + { + "Name": "Block all Office applications from creating child processes", + "GUID": "d4f940ab-401b-4efc-aadc-ad5f3c50688a", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": false, + "Warnings": [], + "Description": "Blocks Office apps from creating child processes to prevent malware execution" + }, + { + "Name": "Block credential stealing from LSASS", + "GUID": "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": false, + "Warnings": ["Produces high volume of events - safe to ignore most blocks", "Not required if LSA Protection enabled"], + "Description": "Locks down LSASS to prevent credential theft (Mimikatz protection)" + }, + { + "Name": "Block executable content from email client and webmail", + "GUID": "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": false, + "Warnings": [], + "Description": "Blocks executable files from being launched from Outlook/webmail" + }, + { + "Name": "Block executable files unless they meet prevalence, age, or trusted list", + "GUID": "01443614-cd74-433a-b99e-2ecdc07bfc25", + "Action": 1, + "BaselineStatus": "Missing", + "RequiresCloudProtection": true, + "Warnings": ["Requires cloud-delivered protection", "May block legitimate software - test thoroughly"], + "Description": "Blocks untrusted or unknown executable files based on reputation" + }, + { + "Name": "Block execution of potentially obfuscated scripts", + "GUID": "5beb7efe-fd9a-4556-801d-275e5ffc04cc", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": true, + "Warnings": ["Requires cloud-delivered protection"], + "Description": "Detects and blocks suspicious properties in obfuscated scripts (JS/VBS/PS)" + }, + { + "Name": "Block JavaScript or VBScript from launching downloaded executable content", + "GUID": "d3e037e1-3eb8-44c8-a917-57927947596d", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": false, + "Warnings": [], + "Description": "Prevents scripts from launching potentially malicious downloaded content" + }, + { + "Name": "Block Office applications from creating executable content", + "GUID": "3b576869-a4ec-4529-8536-b80a7769e899", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": false, + "Warnings": [], + "Description": "Prevents Office from saving malicious components to disk for persistence" + }, + { + "Name": "Block Office applications from injecting code into other processes", + "GUID": "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": false, + "Warnings": ["Requires restarting Office applications after configuration"], + "Description": "Blocks code injection from Office apps into other processes" + }, + { + "Name": "Block Office communication application from creating child processes", + "GUID": "26190899-1602-49e8-8b27-eb1d0a1ce869", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": false, + "Warnings": [], + "Description": "Prevents Outlook from creating child processes (social engineering protection)" + }, + { + "Name": "Block persistence through WMI event subscription", + "GUID": "e6db77e5-3df2-4cf1-b95a-636979351e5b", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": false, + "Warnings": ["If using SCCM (CcmExec.exe), audit for 60 days first"], + "Description": "Prevents malware from abusing WMI to attain persistence" + }, + { + "Name": "Block process creations from PSExec and WMI commands", + "GUID": "d1e49aac-8f56-4280-b9ba-993a6d77406c", + "Action": 1, + "BaselineStatus": "Audit", + "RequiresCloudProtection": false, + "Warnings": ["INCOMPATIBLE with SCCM/Configuration Manager", "Security Baseline uses Audit mode", "Only enable Block if NOT using SCCM"], + "Description": "Blocks processes created through PsExec and WMI (lateral movement protection)" + }, + { + "Name": "Block rebooting machine in Safe Mode", + "GUID": "33ddedf1-c6e0-47cb-833e-de6133960387", + "Action": 1, + "BaselineStatus": "Missing", + "RequiresCloudProtection": false, + "Warnings": ["New rule (2024) - not yet in TVM"], + "Description": "Blocks commands to restart machines in Safe Mode (ransomware protection)" + }, + { + "Name": "Block untrusted and unsigned processes that run from USB", + "GUID": "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": false, + "Warnings": [], + "Description": "Prevents unsigned/untrusted executables from running from USB drives" + }, + { + "Name": "Block use of copied or impersonated system tools", + "GUID": "c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb", + "Action": 1, + "BaselineStatus": "Missing", + "RequiresCloudProtection": false, + "Warnings": ["New rule (2024) - not yet in TVM"], + "Description": "Blocks executables identified as copies/impostors of Windows system tools" + }, + { + "Name": "Block Webshell creation for Servers", + "GUID": "a8f5898e-1dc8-49a9-9878-85004b8a61e6", + "Action": 1, + "BaselineStatus": "Missing", + "RequiresCloudProtection": false, + "Warnings": ["New rule (2024) - not yet in TVM", "Server-focused but safe on clients"], + "Description": "Blocks web shell script creation on servers" + }, + { + "Name": "Block Win32 API calls from Office macros", + "GUID": "92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": false, + "Warnings": [], + "Description": "Prevents VBA macros from calling Win32 APIs to launch malicious shellcode" + }, + { + "Name": "Use advanced protection against ransomware", + "GUID": "c1db55ab-c21a-4637-bb3f-a12568109d35", + "Action": 1, + "BaselineStatus": "Block", + "RequiresCloudProtection": true, + "Warnings": ["Requires cloud-delivered protection"], + "Description": "Extra layer of protection against ransomware using client and cloud heuristics" + } +] diff --git a/Modules/ASR/Private/Backup-ASRRegistry.ps1 b/Modules/ASR/Private/Backup-ASRRegistry.ps1 new file mode 100644 index 0000000..d640ea5 --- /dev/null +++ b/Modules/ASR/Private/Backup-ASRRegistry.ps1 @@ -0,0 +1,105 @@ +<# +.SYNOPSIS + Backup current ASR registry settings + +.DESCRIPTION + Creates backup of ASR registry keys before modification + +.PARAMETER BackupId + Identifier for this backup + +.OUTPUTS + PSCustomObject with backup info +#> + +function Backup-ASRRegistry { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [string]$BackupId = "ASR_$(Get-Date -Format 'yyyyMMdd_HHmmss')" + ) + + $result = [PSCustomObject]@{ + Success = $true + BackupPath = $null + Errors = @() + } + + try { + $asrPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR" + + # BACKUP 1: Registry (for reference/verify) + # CRITICAL FIX: Call Backup-RegistryKey unconditionally! + # If key exists: Creates .reg backup + # If key missing: Creates _EMPTY.json marker (Required for proper cleanup during restore) + try { + $regBackup = Backup-RegistryKey -KeyPath $asrPath -BackupName "ASR_Config" + + if ($regBackup) { + if ($regBackup -match "_EMPTY\.json$") { + Write-Log -Level INFO -Message "ASR registry key does not exist - Created Empty Marker for cleanup" -Module "ASR" + } + else { + Write-Log -Level INFO -Message "ASR registry backed up with ID: $BackupId" -Module "ASR" + } + } + } + catch { + Write-Log -Level WARNING -Message "Registry backup failed: $_" -Module "ASR" + $result.Errors += "Registry backup failed: $_" + } + + # BACKUP 2: Get-MpPreference (CRITICAL for restore) + # Registry-only restore doesn't work after Clear-ASRRules + # We MUST save the active Defender configuration + # IMPORTANT: We backup even if 0 rules are active (pre-hardening state) + try { + $mpPref = Get-MpPreference -ErrorAction Stop + + $asrBackupData = @{ + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + BackupId = $BackupId + Rules = @() + } + + # If rules exist, save them + if ($mpPref.AttackSurfaceReductionRules_Ids -and $mpPref.AttackSurfaceReductionRules_Ids.Count -gt 0) { + # Pair IDs with Actions + for ($i = 0; $i -lt $mpPref.AttackSurfaceReductionRules_Ids.Count; $i++) { + $asrBackupData.Rules += @{ + GUID = $mpPref.AttackSurfaceReductionRules_Ids[$i] + Action = $mpPref.AttackSurfaceReductionRules_Actions[$i] + } + } + Write-Log -Level INFO -Message "Backing up $($asrBackupData.Rules.Count) active ASR rules from Get-MpPreference" -Module "ASR" + } + else { + Write-Log -Level INFO -Message "No active ASR rules in Get-MpPreference - backing up empty state (pre-hardening)" -Module "ASR" + } + + # ALWAYS create the JSON file, even if Rules array is empty + # This is critical for restore to know "system had 0 rules before hardening" + $asrJson = $asrBackupData | ConvertTo-Json -Depth 5 + $backupFile = Register-Backup -Type "ASR" -Data $asrJson -Name "ASR_ActiveConfiguration" + + if ($backupFile) { + Write-Log -Level SUCCESS -Message "ASR MpPreference configuration backed up ($($asrBackupData.Rules.Count) rules)" -Module "ASR" + } + else { + Write-Log -Level WARNING -Message "Failed to register ASR MpPreference backup" -Module "ASR" + $result.Errors += "MpPreference backup registration failed" + } + } + catch { + Write-Log -Level WARNING -Message "Get-MpPreference backup failed: $_" -Module "ASR" + $result.Errors += "MpPreference backup failed: $_" + } + } + catch { + $result.Success = $false + $result.Errors += "Backup failed: $($_.Exception.Message)" + Write-Log -Level ERROR -Message "ASR backup failed: $($_.Exception.Message)" -Module "ASR" + } + + return $result +} diff --git a/Modules/ASR/Private/Get-ASRRuleDefinitions.ps1 b/Modules/ASR/Private/Get-ASRRuleDefinitions.ps1 new file mode 100644 index 0000000..ddc216a --- /dev/null +++ b/Modules/ASR/Private/Get-ASRRuleDefinitions.ps1 @@ -0,0 +1,34 @@ +<# +.SYNOPSIS + Load all 19 ASR rule definitions + +.DESCRIPTION + Loads ASR rules from JSON data file with all metadata + +.OUTPUTS + Array of ASR rule objects +#> + +function Get-ASRRuleDefinitions { + [CmdletBinding()] + [OutputType([Array])] + param() + + try { + $configPath = Join-Path $PSScriptRoot "..\Config\ASR-Rules.json" + + if (-not (Test-Path $configPath)) { + throw "ASR rules configuration file not found: $configPath" + } + + $rules = Get-Content $configPath -Raw | ConvertFrom-Json + + Write-Log -Level INFO -Message "Loaded $($rules.Count) ASR rule definitions" -Module "ASR" + + return $rules + } + catch { + Write-Log -Level ERROR -Message "Failed to load ASR rules: $($_.Exception.Message)" -Module "ASR" + throw + } +} diff --git a/Modules/ASR/Private/Restore-ASRSettings.ps1 b/Modules/ASR/Private/Restore-ASRSettings.ps1 new file mode 100644 index 0000000..e56d1ea --- /dev/null +++ b/Modules/ASR/Private/Restore-ASRSettings.ps1 @@ -0,0 +1,28 @@ +<# +.SYNOPSIS + Restore ASR settings from backup + +.DESCRIPTION + Restores ASR registry settings from a previous backup created by Backup-ASRRegistry + +.PARAMETER BackupId + Identifier of the backup to restore + +.OUTPUTS + PSCustomObject with restore results +#> + +function Restore-ASRSettings { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [string]$BackupId + ) + + # This helper is deprecated. ASR restore is handled centrally by the + # framework rollback system (Restore-Session / Restore-AllBackups). + # Keeping this function to avoid breaking existing scripts, but make + # its behavior explicit and safe. + Write-Log -Level WARNING -Message "Restore-ASRSettings is deprecated. Use the main rollback workflow (Restore-AllBackups or GUI Restore) instead." -Module "ASR" + throw "Restore-ASRSettings is deprecated. Use the framework rollback (Core\Rollback.ps1) instead." +} diff --git a/Modules/ASR/Private/Set-ASRViaPowerShell.ps1 b/Modules/ASR/Private/Set-ASRViaPowerShell.ps1 new file mode 100644 index 0000000..272671d --- /dev/null +++ b/Modules/ASR/Private/Set-ASRViaPowerShell.ps1 @@ -0,0 +1,131 @@ +<# +.SYNOPSIS + Apply ASR rules using Set-MpPreference (PowerShell) + +.DESCRIPTION + Uses Microsoft's recommended PowerShell cmdlet to apply ASR rules + Cleaner and more validated than direct registry manipulation + +.PARAMETER Rules + Array of rule objects to apply + +.PARAMETER DryRun + Preview changes without applying + +.OUTPUTS + PSCustomObject with applied count and errors +#> + +function Set-ASRViaPowerShell { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [Array]$Rules, + + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + $result = [PSCustomObject]@{ + Applied = 0 + Errors = @() + Warnings = @() + } + + try { + # Build arrays for Set-MpPreference + $ruleIds = @() + $ruleActions = @() + + foreach ($rule in $Rules) { + $ruleIds += $rule.GUID + $ruleActions += $rule.Action + } + + if ($DryRun) { + Write-Log -Level INFO -Message "[DRYRUN] Would apply $($ruleIds.Count) ASR rules via Set-MpPreference" -Module "ASR" + $result.Applied = $ruleIds.Count + return $result + } + + Write-Log -Level INFO -Message "Applying $($ruleIds.Count) ASR rules via Set-MpPreference..." -Module "ASR" + + # Apply all rules at once + Set-MpPreference -AttackSurfaceReductionRules_Ids $ruleIds ` + -AttackSurfaceReductionRules_Actions $ruleActions ` + -ErrorAction Stop | Out-Null + + $result.Applied = $ruleIds.Count + + # WORKAROUND: GPO Registry has higher priority than Set-MpPreference + # We must set BOTH Set-MpPreference AND GPO Registry to ensure the rule is actually applied + # This applies to user-configurable rules (PSExec/WMI and Prevalence) + $asrRegistryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules" + + # User-configurable rules that need GPO Registry sync + $userConfigurableRules = @( + "d1e49aac-8f56-4280-b9ba-993a6d77406c", # PSExec/WMI (Management Tools) + "01443614-cd74-433a-b99e-2ecdc07bfc25" # Prevalence (New/Unknown Software) + ) + + foreach ($rule in $Rules) { + # For user-configurable rules: Always sync to GPO Registry (Block OR Audit) + if ($userConfigurableRules -contains $rule.GUID) { + try { + $currentValue = Get-ItemProperty -Path $asrRegistryPath -Name $rule.GUID -ErrorAction SilentlyContinue + $needsUpdate = $false + + if ($currentValue) { + # Registry exists - check if value differs + if ([int]$currentValue.($rule.GUID) -ne $rule.Action) { + $needsUpdate = $true + } + } else { + # Registry doesn't exist - need to create it + $needsUpdate = $true + } + + if ($needsUpdate) { + # Ensure path exists + if (-not (Test-Path $asrRegistryPath)) { + New-Item -Path $asrRegistryPath -Force | Out-Null + } + + # Set the registry value (using string type like Security Baseline does) + Set-ItemProperty -Path $asrRegistryPath -Name $rule.GUID -Value $rule.Action.ToString() -Type String -Force -ErrorAction Stop | Out-Null + + $modeName = switch ($rule.Action) { 1 { "Block" } 2 { "Audit" } default { "Unknown" } } + Write-Log -Level INFO -Message "Synced $($rule.Name) to GPO Registry: $modeName mode" -Module "ASR" + } + } + catch { + $result.Warnings += "Could not sync rule $($rule.Name) to GPO registry: $($_.Exception.Message)" + Write-Log -Level WARNING -Message "Could not sync $($rule.Name) to GPO registry: $($_.Exception.Message)" -Module "ASR" + } + } + # For non-configurable rules: Only override if user wants Block and Baseline had Audit + elseif ($rule.Action -eq 1 -and $rule.BaselineStatus -eq "Audit") { + try { + $currentValue = Get-ItemProperty -Path $asrRegistryPath -Name $rule.GUID -ErrorAction SilentlyContinue + + if ($currentValue -and [int]$currentValue.($rule.GUID) -ne 1) { + Set-ItemProperty -Path $asrRegistryPath -Name $rule.GUID -Value "1" -Type String -Force -ErrorAction Stop | Out-Null + Write-Log -Level INFO -Message "Force-applied $($rule.Name) to Block mode via registry (was Audit from Baseline)" -Module "ASR" + } + } + catch { + $result.Warnings += "Could not force-apply rule $($rule.Name) via registry: $($_.Exception.Message)" + Write-Log -Level WARNING -Message "Could not force-apply $($rule.Name) via registry: $($_.Exception.Message)" -Module "ASR" + } + } + } + + Write-Log -Level INFO -Message "Successfully applied $($ruleIds.Count) ASR rules" -Module "ASR" + } + catch { + $result.Errors += "Failed to apply ASR rules: $($_.Exception.Message)" + Write-Log -Level ERROR -Message "Set-MpPreference failed: $($_.Exception.Message)" -Module "ASR" + } + + return $result +} diff --git a/Modules/ASR/Private/Test-ASRCompliance.ps1 b/Modules/ASR/Private/Test-ASRCompliance.ps1 new file mode 100644 index 0000000..49b85c6 --- /dev/null +++ b/Modules/ASR/Private/Test-ASRCompliance.ps1 @@ -0,0 +1,117 @@ +<# +.SYNOPSIS + Verify ASR rules are correctly applied + +.DESCRIPTION + Uses Get-MpPreference to verify all ASR rules are active with correct actions + +.PARAMETER ExpectedRules + Array of rule objects with GUID and Action properties + +.OUTPUTS + PSCustomObject with verification results +#> + +function Test-ASRCompliance { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [Array]$ExpectedRules + ) + + $result = [PSCustomObject]@{ + Passed = $true + CheckedCount = 0 + FailedCount = 0 + FailedRules = @() + } + + try { + # Get current ASR configuration from Defender + $mpPref = Get-MpPreference -ErrorAction Stop + + # Get configured ASR rule IDs and actions + $configuredIds = $mpPref.AttackSurfaceReductionRules_Ids + $configuredActions = $mpPref.AttackSurfaceReductionRules_Actions + + if (-not $configuredIds -or $configuredIds.Count -eq 0) { + $result.Passed = $false + $result.FailedCount = $ExpectedRules.Count + Write-Log -Level WARNING -Message "No ASR rules found in Defender configuration" -Module "ASR" + return $result + } + + # Create hashtable for quick lookup + $configuredRules = @{} + for ($i = 0; $i -lt $configuredIds.Count; $i++) { + $configuredRules[$configuredIds[$i]] = $configuredActions[$i] + } + + # Rules where both BLOCK (1) and AUDIT (2) are considered "Pass" + # These are user-configurable rules where either mode is valid + $flexibleRules = @( + "d1e49aac-8f56-4280-b9ba-993a6d77406c", # PSExec/WMI (Management Tools) + "01443614-cd74-433a-b99e-2ecdc07bfc25" # Prevalence (New/Unknown Software) + ) + + # Verify each expected rule + foreach ($rule in $ExpectedRules) { + $result.CheckedCount++ + + if ($configuredRules.ContainsKey($rule.GUID)) { + $actualAction = $configuredRules[$rule.GUID] + + # Check if this is a flexible rule (Block or Audit both count as Pass) + $isFlexibleRule = $flexibleRules -contains $rule.GUID + $isActiveMode = $actualAction -in @(1, 2) # Block or Audit + + # For flexible rules: Pass if Block OR Audit + # For other rules: Pass only if exact match + $rulePassed = if ($isFlexibleRule) { $isActiveMode } else { $actualAction -eq $rule.Action } + + if (-not $rulePassed) { + $result.FailedCount++ + $result.Passed = $false + $result.FailedRules += $rule.GUID + + $actionName = switch ($actualAction) { + 0 { "Disabled" } + 1 { "Block" } + 2 { "Audit" } + 6 { "Warn" } + default { "Unknown($actualAction)" } + } + $expectedName = switch ($rule.Action) { + 0 { "Disabled" } + 1 { "Block" } + 2 { "Audit" } + 6 { "Warn" } + default { "Unknown($($rule.Action))" } + } + + Write-Log -Level WARNING -Message "Rule '$($rule.Name)' has action $actionName, expected $expectedName" -Module "ASR" + } + } + else { + $result.FailedCount++ + $result.Passed = $false + $result.FailedRules += $rule.GUID + Write-Log -Level WARNING -Message "Rule '$($rule.Name)' not found in Defender configuration" -Module "ASR" + } + } + + if ($result.Passed) { + Write-Log -Level INFO -Message "ASR compliance check passed - all $($result.CheckedCount) rules verified" -Module "ASR" + } + else { + Write-Log -Level WARNING -Message "ASR compliance check found $($result.FailedCount) issues out of $($result.CheckedCount) rules" -Module "ASR" + } + } + catch { + $result.Passed = $false + $result.FailedCount = $ExpectedRules.Count + Write-Log -Level ERROR -Message "Compliance check failed: $($_.Exception.Message)" -Module "ASR" + } + + return $result +} diff --git a/Modules/ASR/Private/Test-CloudProtection.ps1 b/Modules/ASR/Private/Test-CloudProtection.ps1 new file mode 100644 index 0000000..7c0b017 --- /dev/null +++ b/Modules/ASR/Private/Test-CloudProtection.ps1 @@ -0,0 +1,34 @@ +<# +.SYNOPSIS + Verify cloud-delivered protection is enabled + +.DESCRIPTION + Some ASR rules require cloud protection to be enabled + This function checks if it's active + +.OUTPUTS + Boolean - True if cloud protection is enabled +#> + +function Test-CloudProtection { + [CmdletBinding()] + [OutputType([bool])] + param() + + try { + # Check via Get-MpPreference + $mpPref = Get-MpPreference -ErrorAction Stop + + if ($mpPref.MAPSReporting -eq 0) { + Write-Log -Level WARNING -Message "Cloud-delivered protection (MAPS) is disabled" -Module "ASR" + return $false + } + + Write-Log -Level INFO -Message "Cloud-delivered protection is enabled (MAPS: $($mpPref.MAPSReporting))" -Module "ASR" + return $true + } + catch { + Write-Log -Level WARNING -Message "Failed to check cloud protection status: $_" -Module "ASR" + return $false + } +} diff --git a/Modules/ASR/Private/Test-ConfigMgrPresence.ps1 b/Modules/ASR/Private/Test-ConfigMgrPresence.ps1 new file mode 100644 index 0000000..d3a5151 --- /dev/null +++ b/Modules/ASR/Private/Test-ConfigMgrPresence.ps1 @@ -0,0 +1,41 @@ +<# +.SYNOPSIS + Detect SCCM/Configuration Manager presence + +.DESCRIPTION + Checks if Configuration Manager client (CcmExec.exe) is running + This is critical because PSExec/WMI ASR rule conflicts with SCCM + +.OUTPUTS + Boolean - True if ConfigMgr detected +#> + +function Test-ConfigMgrPresence { + [CmdletBinding()] + [OutputType([bool])] + param() + + try { + # Check for CCM service + $ccmService = Get-Service -Name "CcmExec" -ErrorAction SilentlyContinue + + if ($ccmService -and $ccmService.Status -eq "Running") { + Write-Log -Level WARNING -Message "Configuration Manager (SCCM) client detected" -Module "ASR" + return $true + } + + # Check for CCM process + $ccmProcess = Get-Process -Name "CcmExec" -ErrorAction SilentlyContinue + + if ($ccmProcess) { + Write-Log -Level WARNING -Message "Configuration Manager process detected" -Module "ASR" + return $true + } + + return $false + } + catch { + Write-Log -Level WARNING -Message "Failed to detect ConfigMgr: $_. Assuming not present." -Module "ASR" + return $false + } +} diff --git a/Modules/ASR/Public/Invoke-ASRRules.ps1 b/Modules/ASR/Public/Invoke-ASRRules.ps1 new file mode 100644 index 0000000..91700e0 --- /dev/null +++ b/Modules/ASR/Public/Invoke-ASRRules.ps1 @@ -0,0 +1,571 @@ +<# +.SYNOPSIS + Apply all 19 Microsoft Defender ASR rules + +.DESCRIPTION + Enables all 19 Attack Surface Reduction rules in Block mode for comprehensive protection. + + Rules Applied: + - All 19 ASR rules in Block mode (Action = 1) + - Includes 4 rules missing from Security Baseline + - Upgrades 1 rule from Audit to Block (PSExec/WMI - with SCCM check) + + Features: + - SCCM/Configuration Manager detection (PSExec/WMI rule warning) + - Cloud protection verification + - BACKUP/APPLY/VERIFY/RESTORE pattern + - DryRun mode for testing + - Security Baseline overlap detection + +.PARAMETER DryRun + Preview changes without applying them + +.PARAMETER SkipBackup + Skip backup creation (not recommended) + +.PARAMETER SkipVerify + Skip post-application verification + +.PARAMETER Force + Apply even if validation warnings occur (SCCM, Cloud Protection) + +.PARAMETER AllowPSExecWMI + Force enable PSExec/WMI rule even if SCCM detected (use with caution) + +.EXAMPLE + Invoke-ASRRules + Apply all 19 ASR rules with full backup and verification + +.EXAMPLE + Invoke-ASRRules -DryRun + Preview what changes would be made + +.EXAMPLE + Invoke-ASRRules -AllowPSExecWMI -Force + Force enable PSExec/WMI rule despite SCCM detection + +.OUTPUTS + PSCustomObject with results including success status, rules applied, and any errors +#> + +function Invoke-ASRRules { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun, + + [Parameter(Mandatory = $false)] + [switch]$SkipBackup, + + [Parameter(Mandatory = $false)] + [switch]$SkipVerify, + + [Parameter(Mandatory = $false)] + [switch]$Force, + + [Parameter(Mandatory = $false)] + [switch]$AllowPSExecWMI + ) + + begin { + $moduleName = "ASR" + $startTime = Get-Date + + # Ensure core functions are available when the module is imported directly (outside Framework.ps1) + if (-not (Get-Command Initialize-BackupSystem -ErrorAction SilentlyContinue)) { + try { + $frameworkRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent + $coreFiles = @( + "Core\Logger.ps1", + "Core\Config.ps1", + "Core\Validator.ps1", + "Core\Rollback.ps1", + "Utils\Compatibility.ps1" + ) + + foreach ($file in $coreFiles) { + $corePath = Join-Path $frameworkRoot $file + if (Test-Path $corePath) { + . $corePath + } + } + } + catch { + Write-Host "ERROR: Failed to load core dependencies for ASR module: $_" -ForegroundColor Red + } + } + + # Initialize result object + $result = [PSCustomObject]@{ + ModuleName = $moduleName + Success = $false + RulesApplied = 0 + Errors = @() + Warnings = @() + BackupCreated = $false + VerificationPassed = $false + ConfigMgrDetected = $false + CloudProtectionEnabled = $false + Duration = $null + Details = @{ + TotalRules = 19 + BlockMode = 0 + AuditMode = 0 + DisabledMode = 0 + } + } + + Write-Log -Level INFO -Message "Starting ASR rules application (all 19 rules)" -Module $moduleName + + if ($DryRun) { + Write-Log -Level INFO -Message "DRY RUN MODE - No changes will be applied" -Module $moduleName + } + } + + process { + try { + # Step 1: Prerequisites validation + Write-Log -Level INFO -Message "Validating prerequisites..." -Module $moduleName + + if (-not (Test-IsAdmin)) { + throw "Administrator privileges required" + } + + if (-not (Test-WindowsVersion -MinimumBuild 22000)) { + throw "Windows 11 or later required" + } + + # Check Windows Defender status and third-party AV + $defenderService = Get-Service -Name "WinDefend" -ErrorAction SilentlyContinue + $defenderRunning = $defenderService -and $defenderService.Status -eq "Running" + + # Check for third-party antivirus (they disable Defender) + $thirdPartyAV = $null + try { + $avProducts = Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName "AntiVirusProduct" -ErrorAction SilentlyContinue + $thirdPartyAV = $avProducts | Where-Object { $_.displayName -notmatch "Windows Defender|Microsoft Defender" } | Select-Object -First 1 + } + catch { + # SecurityCenter2 not available - continue with Defender check only + $null = $null + } + + if (-not $defenderRunning) { + if ($thirdPartyAV) { + # Third-party AV detected - skip ASR gracefully (not an error!) + $avName = $thirdPartyAV.displayName + Write-Host "" + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " ASR Module Skipped" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "Third-party antivirus detected: $avName" -ForegroundColor Cyan + Write-Host "" + Write-Host "ASR rules require Windows Defender to be active." -ForegroundColor Yellow + Write-Host "Your antivirus ($avName) has its own protection features." -ForegroundColor Yellow + Write-Host "" + Write-Host "This is NOT an error - ASR will be skipped." -ForegroundColor Green + Write-Host "" + + Write-Log -Level WARNING -Message "ASR skipped: Third-party AV detected ($avName). Defender disabled." -Module $moduleName + + $result.Success = $true # Not an error - intentional skip + $result.Warnings += "ASR skipped: Third-party antivirus detected ($avName). Your AV provides similar protection." + $result.RulesApplied = 0 + + return $result + } + else { + # No third-party AV but Defender not running - this IS a problem + throw "Windows Defender service is not running and no third-party antivirus detected. ASR rules require Defender to be active." + } + } + + # Load ASR rule definitions + Write-Log -Level INFO -Message "Loading ASR rule definitions..." -Module $moduleName + $asrRules = Get-ASRRuleDefinitions + + # Step 2: Check for Remote Management Tools (SCCM/Intune/etc.) + Write-Log -Level INFO -Message "Checking for remote management tools..." -Module $moduleName + + # Automatic detection + $configMgrDetected = Test-ConfigMgrPresence + $result.ConfigMgrDetected = $configMgrDetected + + # Check for management tools - NonInteractive or Interactive + $usesManagementTools = $false + + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - use config value + $usesManagementTools = Get-NonInteractiveValue -Module "ASR" -Key "usesManagementTools" -Default $false + Write-NonInteractiveDecision -Module $moduleName -Decision "Management tools setting" -Value $(if ($usesManagementTools) { "Yes (1 AUDIT)" } else { "No (ALL BLOCK)" }) + } + elseif (-not $Force -and -not $AllowPSExecWMI -and -not $DryRun) { + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host " Remote Management Tool Check" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + + if ($configMgrDetected) { + Write-Host "DETECTED: SCCM/Configuration Manager is currently installed" -ForegroundColor Yellow + Write-Host "" + } + + Write-Host "Do you use ANY of these remote management tools?" -ForegroundColor White + Write-Host "" + Write-Host " - Microsoft SCCM (Configuration Manager)" -ForegroundColor Gray + Write-Host " - Microsoft Intune / Endpoint Manager" -ForegroundColor Gray + Write-Host " - PDQ Deploy / PDQ Inventory" -ForegroundColor Gray + Write-Host " - ManageEngine Desktop Central" -ForegroundColor Gray + Write-Host " - Any other WMI/PSExec based management tools" -ForegroundColor Gray + Write-Host "" + Write-Host "These tools use PSExec and WMI for remote management." -ForegroundColor Yellow + Write-Host "If you use them, one ASR rule must be set to AUDIT mode." -ForegroundColor Yellow + Write-Host "" + Write-Host "Options:" -ForegroundColor Cyan + Write-Host " [Y] Yes - I use management tools" -ForegroundColor Yellow + Write-Host " > 1 rule: AUDIT mode (PSExec/WMI only)" -ForegroundColor Gray + Write-Host " > 18 rules: BLOCK mode (full protection)" -ForegroundColor Gray + Write-Host "" + Write-Host " [N] No - I don't use any of these" -ForegroundColor Green + Write-Host " > ALL 19 rules: BLOCK mode (maximum protection)" -ForegroundColor Gray + Write-Host "" + + do { + $choice = Read-Host "Select option [Y/N] (default: N)" + if ([string]::IsNullOrWhiteSpace($choice)) { $choice = "N" } + $choice = $choice.ToUpper() + + if ($choice -notin @('Y', 'N')) { + Write-Host "" + Write-Host "Invalid input. Please enter Y or N." -ForegroundColor Red + Write-Host "" + } + } while ($choice -notin @('Y', 'N')) + + switch ($choice) { + "Y" { + $usesManagementTools = $true + Write-Host "" + Write-Host "1 rule set to AUDIT (PSExec/WMI), 18 rules set to BLOCK" -ForegroundColor Yellow + Write-Log -Level INFO -Message "User confirmed use of management tools - 1 AUDIT + 18 BLOCK" -Module $moduleName + } + "N" { + $usesManagementTools = $false + Write-Host "" + Write-Host "ALL 19 rules will be set to BLOCK mode" -ForegroundColor Green + Write-Log -Level INFO -Message "User confirmed no management tools - ALL 19 BLOCK" -Module $moduleName + } + } + Write-Host "" + } + elseif ($Force -and -not $AllowPSExecWMI) { + # Force flag: Auto-detect or assume safe + $usesManagementTools = $configMgrDetected + Write-Log -Level INFO -Message "Force flag: Using detection result (ConfigMgr: $configMgrDetected)" -Module $moduleName + } + + # Apply PSExec/WMI rule mode based on user choice or detection + if (($usesManagementTools -or $configMgrDetected) -and -not $AllowPSExecWMI) { + $psexecRule = $asrRules | Where-Object { $_.GUID -eq "d1e49aac-8f56-4280-b9ba-993a6d77406c" } + + # Set PSExec/WMI to Audit mode (user confirmed or detected) + $psexecRule.Action = 2 + $result.Warnings += "Management tools detected/confirmed: PSExec/WMI rule set to Audit mode" + Write-Log -Level INFO -Message "PSExec/WMI rule set to Audit mode (management tools in use)" -Module $moduleName + } + + # Step 2b: Prevalence rule (new/unknown software) - NonInteractive or Interactive + if (-not $DryRun) { + $prevalenceRule = $asrRules | Where-Object { $_.GUID -eq "01443614-cd74-433a-b99e-2ecdc07bfc25" } + if ($prevalenceRule) { + $allowNewSoftware = $false + + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - use config value + $allowNewSoftware = Get-NonInteractiveValue -Module "ASR" -Key "allowNewSoftware" -Default $false + + if ($allowNewSoftware) { + $prevalenceRule.Action = 2 + $result.Warnings += "ASR prevalence rule set to AUDIT (less restrictive; see README for details)." + } else { + $prevalenceRule.Action = 1 + } + Write-NonInteractiveDecision -Module $moduleName -Decision "New/Unknown software rule" -Value $(if ($allowNewSoftware) { "AUDIT (allow)" } else { "BLOCK (secure)" }) + } + else { + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host " ASR Rule: New / Unknown Software" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + + Write-Host "Rule: Block executable files unless they meet prevalence, age, or trusted list" -ForegroundColor White + Write-Host "GUID: $($prevalenceRule.GUID)" -ForegroundColor DarkGray + Write-Host "" + Write-Host "This rule blocks very new or unknown executables that" -ForegroundColor Yellow + Write-Host "are not yet trusted by Microsoft's reputation systems." -ForegroundColor Yellow + Write-Host "" + Write-Host "Do you install NEW or UNTRUSTED software frequently?" -ForegroundColor White + Write-Host "" + Write-Host " - Games from independent developers" -ForegroundColor Gray + Write-Host " - Beta software / Early access programs" -ForegroundColor Gray + Write-Host " - Custom/in-house business applications" -ForegroundColor Gray + Write-Host " - Open-source tools without Microsoft reputation" -ForegroundColor Gray + Write-Host "" + Write-Host "Options:" -ForegroundColor Cyan + Write-Host " [Y] Yes - I need to install untrusted software" -ForegroundColor Yellow + Write-Host " > AUDIT mode: Events logged, installs allowed" -ForegroundColor Gray + Write-Host " > Developer/test mode (less secure)" -ForegroundColor Gray + Write-Host "" + Write-Host " [N] No - I only install trusted software" -ForegroundColor Green + Write-Host " > BLOCK mode: Maximum security (recommended)" -ForegroundColor Gray + Write-Host " > New/unknown installers may be blocked" -ForegroundColor Gray + Write-Host "" + + do { + $prevalenceChoice = Read-Host "Select option [Y/N] (default: N)" + if ([string]::IsNullOrWhiteSpace($prevalenceChoice)) { $prevalenceChoice = "N" } + $prevalenceChoice = $prevalenceChoice.ToUpper() + + if ($prevalenceChoice -notin @('Y', 'N')) { + Write-Host "" + Write-Host "Invalid input. Please enter Y or N." -ForegroundColor Red + Write-Host "" + } + } while ($prevalenceChoice -notin @('Y', 'N')) + + switch ($prevalenceChoice) { + "N" { + $prevalenceRule.Action = 1 + Write-Host "" + Write-Host "New/Unknown Software rule set to BLOCK mode (maximum security)" -ForegroundColor Green + Write-Log -Level INFO -Message "Prevalence rule configured to BLOCK (recommended)" -Module $moduleName + } + "Y" { + $prevalenceRule.Action = 2 + Write-Host "" + Write-Host "New/Unknown Software rule set to AUDIT mode (developer/test)" -ForegroundColor Yellow + $result.Warnings += "ASR prevalence rule set to AUDIT (less restrictive; see README for details)." + Write-Log -Level INFO -Message "Prevalence rule configured to AUDIT (developer/compat mode)" -Module $moduleName + } + } + Write-Host "" + } + } + } + + # Step 3: Check cloud protection + Write-Log -Level INFO -Message "Checking cloud-delivered protection..." -Module $moduleName + + $cloudProtectionEnabled = Test-CloudProtection + $result.CloudProtectionEnabled = $cloudProtectionEnabled + + if (-not $cloudProtectionEnabled) { + $cloudRules = $asrRules | Where-Object { $_.RequiresCloudProtection -eq $true } + $result.Warnings += "Cloud protection disabled: $($cloudRules.Count) rules require it for optimal operation" + Write-Log -Level WARNING -Message "$($cloudRules.Count) ASR rules require cloud protection for full functionality" -Module $moduleName + + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - use config value + $continueWithoutCloud = Get-NonInteractiveValue -Module "ASR" -Key "continueWithoutCloud" -Default $true + + if (-not $continueWithoutCloud) { + Write-NonInteractiveDecision -Module $moduleName -Decision "Cloud protection required - aborting" + throw "ASR application cancelled (cloud protection required, continueWithoutCloud=false)" + } + Write-NonInteractiveDecision -Module $moduleName -Decision "Continuing without cloud protection (limited functionality)" + } + elseif (-not $Force -and -not $DryRun) { + # Interactive prompt for cloud protection + Write-Host "" + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " Cloud Protection Not Enabled!" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "$($cloudRules.Count) ASR rules require cloud-delivered protection for optimal functionality:" -ForegroundColor Yellow + Write-Host "" + + foreach ($cloudRule in $cloudRules) { + Write-Host " - $($cloudRule.Name)" -ForegroundColor Gray + } + + Write-Host "" + Write-Host "These rules will work in limited capacity without cloud protection." -ForegroundColor Yellow + Write-Host "" + Write-Host "Options:" -ForegroundColor Cyan + Write-Host " [C] Continue - Apply rules anyway (limited functionality)" -ForegroundColor Green + Write-Host " [A] Abort - Cancel ASR rule application" -ForegroundColor Yellow + Write-Host "" + + do { + $choice = Read-Host "Select option [C/A] (default: A)" + if ([string]::IsNullOrWhiteSpace($choice)) { $choice = "A" } + $choice = $choice.ToUpper() + + if ($choice -notin @('C', 'A')) { + Write-Host "" + Write-Host "Invalid input. Please enter C or A." -ForegroundColor Red + Write-Host "" + } + } while ($choice -notin @('C', 'A')) + + switch ($choice) { + "C" { + Write-Host "" + Write-Host "Continuing with cloud protection disabled" -ForegroundColor Yellow + Write-Log -Level INFO -Message "User chose to continue despite cloud protection disabled" -Module $moduleName + } + "A" { + Write-Host "" + Write-Host "ASR rule application cancelled by user" -ForegroundColor Yellow + Write-Log -Level INFO -Message "ASR application cancelled due to cloud protection requirement" -Module $moduleName + throw "ASR application cancelled by user due to cloud protection requirement" + } + } + Write-Host "" + } + elseif ($Force) { + # Force flag - continue silently + Write-Log -Level INFO -Message "Continuing despite cloud protection disabled (Force flag)" -Module $moduleName + } + } + + # Step 3a: Initialize and start module backup + if (-not $SkipBackup -and -not $DryRun) { + try { + Initialize-BackupSystem + $null = Start-ModuleBackup -ModuleName $moduleName + Write-Log -Level INFO -Message "Session backup initialized" -Module $moduleName + } + catch { + $result.Warnings += "Failed to initialize/start module backup: $_" + Write-Log -Level WARNING -Message "Failed to initialize/start module backup: $_" -Module $moduleName + } + } + + # Step 4: Create backup + if (-not $SkipBackup -and -not $DryRun) { + Write-Log -Level INFO -Message "Creating backup..." -Module $moduleName + + $backupResult = Backup-ASRRegistry + if ($backupResult.Errors.Count -gt 0) { + foreach ($err in $backupResult.Errors) { + $result.Warnings += $err + } + } + else { + # Register backup in session manifest + Complete-ModuleBackup -ItemsBackedUp 1 -Status "Success" + $result.BackupCreated = $true + } + } + + # Step 5: Apply ASR rules via PowerShell + # Note: Set-ASRViaPowerShell logs internally, no need to log here + $applyResult = Set-ASRViaPowerShell -Rules $asrRules -DryRun:$DryRun + + # In DryRun mode, no rules are actually applied, so keep RulesApplied = 0 + if (-not $DryRun) { + $result.RulesApplied = $applyResult.Applied + } + + # Add errors and warnings individually to avoid nested arrays + foreach ($err in $applyResult.Errors) { + $result.Errors += $err + } + foreach ($warn in $applyResult.Warnings) { + $result.Warnings += $warn + } + + # Count rule modes from actual system state + $mpPref = Get-MpPreference + $currentActions = $mpPref.AttackSurfaceReductionRules_Actions + if ($currentActions) { + $result.Details.BlockMode = ($currentActions | Where-Object { $_ -eq 1 }).Count + $result.Details.AuditMode = ($currentActions | Where-Object { $_ -eq 2 }).Count + $result.Details.DisabledMode = ($currentActions | Where-Object { $_ -eq 0 }).Count + } else { + # Fallback to array count + $result.Details.BlockMode = ($asrRules | Where-Object { $_.Action -eq 1 }).Count + $result.Details.AuditMode = ($asrRules | Where-Object { $_.Action -eq 2 }).Count + $result.Details.DisabledMode = ($asrRules | Where-Object { $_.Action -eq 0 }).Count + } + + # Step 6: Verification + if (-not $SkipVerify -and -not $DryRun) { + Write-Log -Level INFO -Message "Verifying applied ASR rules..." -Module $moduleName + + $verificationResult = Test-ASRCompliance -ExpectedRules $asrRules + $result.VerificationPassed = $verificationResult.Passed + + if (-not $verificationResult.Passed) { + $result.Warnings += "Verification found $($verificationResult.FailedCount) rules not applied correctly" + Write-Log -Level WARNING -Message "Verification found $($verificationResult.FailedCount) failed rules" -Module $moduleName + } + else { + Write-Log -Level INFO -Message "Verification passed - all $($verificationResult.CheckedCount) rules confirmed" -Module $moduleName + } + } + + # Log baseline overlap + $baselineRules = $asrRules | Where-Object { $_.BaselineStatus -in @("Block", "Audit") } + Write-Log -Level INFO -Message "Security Baseline overlap: $($baselineRules.Count) rules already in baseline" -Module $moduleName + + $newRules = $asrRules | Where-Object { $_.BaselineStatus -eq "Missing" } + if ($newRules.Count -gt 0) { + Write-Log -Level INFO -Message "Added $($newRules.Count) rules not in Security Baseline:" -Module $moduleName + foreach ($newRule in $newRules) { + Write-Log -Level INFO -Message " + $($newRule.Name)" -Module $moduleName + } + } + + $upgradedRules = $asrRules | Where-Object { $_.BaselineStatus -eq "Audit" -and $_.Action -eq 1 } + if ($upgradedRules.Count -gt 0) { + Write-Log -Level INFO -Message "Upgraded $($upgradedRules.Count) rules from Audit to Block:" -Module $moduleName + foreach ($upgradedRule in $upgradedRules) { + Write-Log -Level INFO -Message " [UPGRADE] $($upgradedRule.Name)" -Module $moduleName + } + } + + # Mark as successful if no critical errors + if ($result.Errors.Count -eq 0) { + $result.Success = $true + Write-Log -Level INFO -Message "ASR rules applied successfully" -Module $moduleName + } + else { + Write-Log -Level ERROR -Message "ASR application completed with $($result.Errors.Count) errors" -Module $moduleName + } + + } + catch { + $result.Success = $false + $result.Errors += $_.Exception.Message + Write-Log -Level ERROR -Message "ASR application failed: $($_.Exception.Message)" -Module $moduleName + } + } + + end { + $result.Duration = (Get-Date) - $startTime + + Write-Log -Level INFO -Message "ASR application completed in $($result.Duration.TotalSeconds) seconds" -Module $moduleName + + $blockCount = $result.Details.BlockMode + $auditCount = $result.Details.AuditMode + Write-Log -Level INFO -Message "Rules applied: $($result.RulesApplied) ($blockCount Block, $auditCount Audit)" -Module $moduleName + Write-Log -Level INFO -Message "Errors: $($result.Errors.Count), Warnings: $($result.Warnings.Count)" -Module $moduleName + + # Log warning details for transparency + if ($result.Warnings.Count -gt 0) { + foreach ($warn in $result.Warnings) { + Write-Log -Level INFO -Message " Warning: $warn" -Module $moduleName + } + } + + # GUI parsing marker for settings count (19 ASR rules) + Write-Log -Level SUCCESS -Message "Applied 19 settings" -Module "ASR" + + return $result + } +} diff --git a/Modules/AdvancedSecurity/AdvancedSecurity.psd1 b/Modules/AdvancedSecurity/AdvancedSecurity.psd1 new file mode 100644 index 0000000..b30da68 --- /dev/null +++ b/Modules/AdvancedSecurity/AdvancedSecurity.psd1 @@ -0,0 +1,73 @@ +@{ + # Module manifest for AdvancedSecurity + + # Version + ModuleVersion = '2.2.0' + + # Unique ID + GUID = 'e7f5a3d2-8c9b-4f1e-a6d3-9b2c8f4e5a1d' + + # Author + Author = 'NexusOne23' + + # Company + CompanyName = 'Open Source Project' + + # Copyright + Copyright = '(c) 2025 NexusOne23. Licensed under GPL-3.0.' + + # Description + Description = 'Advanced Security hardening beyond Microsoft Security Baseline: RDP hardening, WDigest protection, Admin Shares disable, Risky Ports/Services, Legacy TLS/WPAD/PSv2, SRP .lnk protection (CVE-2025-9491), Windows Update (3 simple GUI settings), Finger Protocol block, Wireless Display (Miracast) security. 38+ settings total with profile-based execution (Balanced/Enterprise/Maximum) and domain-safety checks plus full backup/restore.' + + # Minimum PowerShell version + PowerShellVersion = '5.1' + + # Root module + RootModule = 'AdvancedSecurity.psm1' + + # Functions to export + FunctionsToExport = @( + 'Invoke-AdvancedSecurity', + 'Test-AdvancedSecurity', + 'Restore-AdvancedSecuritySettings' + ) + + # Cmdlets to export + CmdletsToExport = @() + + # Variables to export + VariablesToExport = @() + + # Aliases to export + AliasesToExport = @() + + # Private data + PrivateData = @{ + PSData = @{ + Tags = @('Security', 'Hardening', 'Windows11', 'Advanced', 'RDP', 'Credentials', 'NetworkSecurity') + LicenseUri = '' + ProjectUri = '' + ReleaseNotes = @' +v2.2.0 (2025-12-08) +- Production release of AdvancedSecurity module +- 49 advanced hardening settings implemented (was 36) +- NEW: Wireless Display (Miracast) security hardening + - Default: Block receiving projections + require PIN (all profiles) + - Optional: Complete disable (blocks sending, mDNS, ports 7236/7250) + - Prevents screen interception attacks from network attackers +- Profile-based execution (Balanced/Enterprise/Maximum) +- RDP NLA enforcement + optional complete disable +- WDigest credential protection (backwards compatible) +- Administrative shares disable (domain-aware) +- Risky firewall ports closure (LLMNR, NetBIOS, UPnP/SSDP) +- Risky network services stop (SSDPSRV, upnphost, lmhosts) +- Legacy TLS 1.0/1.1 disable +- WPAD auto-discovery disable +- PowerShell v2 removal +- Full backup/restore capability +- WhatIf mode and change log export +- Compliance testing function +'@ + } + } +} diff --git a/Modules/AdvancedSecurity/AdvancedSecurity.psm1 b/Modules/AdvancedSecurity/AdvancedSecurity.psm1 new file mode 100644 index 0000000..e59e73f --- /dev/null +++ b/Modules/AdvancedSecurity/AdvancedSecurity.psm1 @@ -0,0 +1,65 @@ +# AdvancedSecurity Module Loader +# Version: 2.2.0 +# Description: Advanced Security Hardening - Beyond Microsoft Security Baseline + +# Get module path +$ModulePath = $PSScriptRoot + +# Load Private functions +$PrivateFunctions = @( + 'Enable-RdpNLA', + 'Set-WDigestProtection', + 'Disable-AdminShares', + 'Disable-RiskyPorts', + 'Stop-RiskyServices', + 'Disable-WPAD', + 'Disable-LegacyTLS', + 'Remove-PowerShellV2', + 'Block-FingerProtocol', + 'Set-SRPRules', + 'Set-WindowsUpdate', + 'Set-WirelessDisplaySecurity', + 'Set-DiscoveryProtocolsSecurity', + 'Set-FirewallShieldsUp', + 'Set-IPv6Security', + 'Test-RdpSecurity', + 'Test-WDigest', + 'Test-RiskyPorts', + 'Test-RiskyServices', + 'Test-AdminShares', + 'Test-SRPCompliance', + 'Test-WindowsUpdate', + 'Test-LegacyTLS', + 'Test-WPAD', + 'Test-PowerShellV2', + 'Test-FingerProtocol', + 'Test-WirelessDisplaySecurity', + 'Test-DiscoveryProtocolsSecurity', + 'Test-FirewallShieldsUp', + 'Test-IPv6Security', + 'Backup-AdvancedSecuritySettings' +) + +foreach ($function in $PrivateFunctions) { + $functionPath = Join-Path $ModulePath "Private\$function.ps1" + if (Test-Path $functionPath) { + . $functionPath + } +} + +# Load Public functions +$PublicFunctions = @( + 'Invoke-AdvancedSecurity', + 'Test-AdvancedSecurity', + 'Restore-AdvancedSecuritySettings' +) + +foreach ($function in $PublicFunctions) { + $functionPath = Join-Path $ModulePath "Public\$function.ps1" + if (Test-Path $functionPath) { + . $functionPath + } +} + +# Export only Public functions +Export-ModuleMember -Function $PublicFunctions diff --git a/Modules/AdvancedSecurity/Config/AdminShares.json b/Modules/AdvancedSecurity/Config/AdminShares.json new file mode 100644 index 0000000..40b438b --- /dev/null +++ b/Modules/AdvancedSecurity/Config/AdminShares.json @@ -0,0 +1,116 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "Administrative Shares Configuration", + "description": "Configuration for disabling administrative shares (C$, ADMIN$, etc.) to prevent lateral movement", + "version": "2.2.0", + + "Administrative_Shares": { + "description": "Disable automatic creation and remove existing administrative shares", + "risk_level": "CRITICAL", + "attack_vectors": [ + "Lateral movement in networks (WannaCry, NotPetya propagation)", + "Remote file access by attackers with stolen credentials", + "Pass-the-Hash attacks using admin shares", + "Automated malware propagation" + ], + + "shares_affected": { + "C$": "Root of C: drive", + "D$": "Root of D: drive (if exists)", + "E$": "Root of E: drive (if exists)", + "ADMIN$": "Windows directory (C:\\Windows)", + "IPC$": "Named pipes - CANNOT be removed (required by Windows)" + }, + + "registry_settings": { + "path": "HKLM:\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters", + "AutoShareWks": { + "description": "Disable automatic shares on Workstation (Home/Pro editions)", + "value": 0, + "type": "DWORD", + "default": 1 + }, + "AutoShareServer": { + "description": "Disable automatic shares on Server editions", + "value": 0, + "type": "DWORD", + "default": 1 + } + }, + + "firewall_protection": { + "description": "Block SMB on Public network profile", + "rule_name": "Block Admin Shares (NoID Privacy)", + "direction": "Inbound", + "protocol": "TCP", + "local_port": 445, + "profile": "Public", + "action": "Block" + }, + + "domain_safety": { + "enabled": true, + "description": "Automatically detect domain-joined systems and skip unless -Force", + "check": "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object PartOfDomain", + "warnings": [ + "Group Policy management may be affected", + "SCCM/Management tools may require admin shares", + "Remote administration tools may stop working" + ], + "force_required": true, + "enterprise_recommendation": "Test in staging environment before deployment" + } + }, + + "Profiles": { + "Balanced": { + "enabled": true, + "domain_check": true, + "force_required": false + }, + "Enterprise": { + "enabled": "conditional", + "domain_check": true, + "force_required": true, + "note": "Auto-disabled for domain-joined systems unless -Force" + }, + "Maximum": { + "enabled": true, + "domain_check": false, + "force_required": false, + "note": "Always enabled for maximum security" + } + }, + + "Impact": { + "positive": [ + "Prevents lateral movement in case of credential theft", + "Stops automated ransomware propagation", + "Blocks Pass-the-Hash attack vectors using admin shares" + ], + "negative": [ + "Remote administration tools may not work", + "Group Policy remote management affected", + "Some enterprise monitoring tools may require admin shares", + "SCCM and similar tools may need explicit shares" + ], + "recommendations": { + "home_users": "Recommended - high security benefit", + "enterprise": "Requires testing - may break management tools", + "workaround": "Create explicit shares for required management tools" + } + }, + + "Important_Notes": [ + "REQUIRES REBOOT to prevent share recreation", + "Shares will NOT be recreated after reboot (if registry set)", + "IPC$ cannot be disabled (required by Windows)", + "File sharing via explicit shares still works", + "Can be restored by setting AutoShareWks/AutoShareServer = 1 + reboot" + ], + + "Compatibility": { + "windows_versions": ["Windows 10", "Windows 11", "Windows Server 2016+"], + "tested": "Windows 11 25H2 (Nov 16, 2025)" + } +} diff --git a/Modules/AdvancedSecurity/Config/Credentials.json b/Modules/AdvancedSecurity/Config/Credentials.json new file mode 100644 index 0000000..e0c4103 --- /dev/null +++ b/Modules/AdvancedSecurity/Config/Credentials.json @@ -0,0 +1,78 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "Credential Protection Configuration", + "description": "Configuration for credential hardening including WDigest protection", + "version": "2.2.0", + + "WDigest_Protection": { + "description": "Prevent WDigest from storing plaintext passwords in LSASS memory", + "enabled": true, + "deprecated_in": "Windows 11 24H2", + "status": "Deprecated in Win11 24H2+ but kept for backwards compatibility and defense-in-depth", + + "registry_path": "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest", + "settings": { + "UseLogonCredential": { + "description": "Control whether WDigest stores credentials in memory", + "value": 0, + "type": "DWORD", + "values": { + "0": "Secure - Do NOT store plaintext credentials in memory", + "1": "Insecure - Store plaintext credentials in memory (VULNERABLE!)" + }, + "attack_prevention": [ + "Prevents Mimikatz from dumping plaintext passwords", + "Prevents Windows Credential Editor (WCE) attacks", + "Prevents other memory-dumping credential theft tools" + ], + "impact": "None - Modern systems (Win 8.1+) already default to 0" + } + }, + + "default_behavior": { + "Windows_7": 1, + "Windows_8": 1, + "Windows_8.1": 0, + "Windows_10": 0, + "Windows_11": 0, + "Windows_11_24H2_plus": "Setting ignored (deprecated)" + }, + + "rationale": { + "why_set_if_deprecated": [ + "Protects older Windows versions (Win7/8/Server 2008/2012)", + "Protects early Win10/11 builds that may not be fully patched", + "Defense-in-depth: Explicit is better than implicit", + "Ensures compatibility in mixed environments", + "No negative impact on Win11 24H2+ (setting is ignored)" + ] + }, + + "microsoft_advisory": { + "kb_article": "KB2871997", + "date": "May 2014", + "title": "Update to improve credentials protection and management", + "url": "https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2014-93434251-04ac-b7f3-52aa-9f951c14b649", + "baseline_removal": { + "version": "Windows 11 25H2 Security Baseline", + "reason": "Engineering teams deprecated this policy in Windows 11 24H2", + "url": "https://techcommunity.microsoft.com/blog/microsoft-security-baselines/windows-11-version-25h2-security-baseline/4456231" + } + } + }, + + "Profiles": { + "Balanced": true, + "Enterprise": true, + "Maximum": true + }, + + "Compatibility": { + "windows_versions": ["All Windows versions"], + "notes": [ + "Setting is ignored on Windows 11 24H2+ (deprecated)", + "No compatibility issues or breakage on any Windows version", + "Recommended for all profiles for defense-in-depth" + ] + } +} diff --git a/Modules/AdvancedSecurity/Config/Firewall.json b/Modules/AdvancedSecurity/Config/Firewall.json new file mode 100644 index 0000000..b3a03b0 --- /dev/null +++ b/Modules/AdvancedSecurity/Config/Firewall.json @@ -0,0 +1,20 @@ +{ + "Description": "Firewall Shields Up - Block all incoming connections on Public network", + "Purpose": "Extra protection in public WiFi networks (airports, cafes, hotels)", + "Note": "This goes BEYOND Microsoft Security Baseline", + + "ShieldsUp": { + "description": "Block ALL incoming connections on Public profile, including allowed apps", + "registry_path": "HKLM:\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile", + "value_name": "DoNotAllowExceptions", + "enabled_value": 1, + "disabled_value": 0, + "profiles": { + "Balanced": false, + "Enterprise": false, + "Maximum": true + }, + "warning": "When enabled, apps like Teams, Discord, Zoom cannot receive incoming calls on Public networks", + "recommendation": "Enable only for maximum security (Maximum / air-gapped profile)" + } +} diff --git a/Modules/AdvancedSecurity/Config/RDP.json b/Modules/AdvancedSecurity/Config/RDP.json new file mode 100644 index 0000000..35cf5a5 --- /dev/null +++ b/Modules/AdvancedSecurity/Config/RDP.json @@ -0,0 +1,64 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "title": "RDP Hardening Configuration", + "description": "Configuration for RDP (Remote Desktop Protocol) hardening including NLA enforcement and optional complete disable", + "version": "2.2.0", + + "NLA_Enforcement": { + "description": "Network Level Authentication (NLA) enforcement settings", + "enabled": true, + "registry_path": "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp", + "settings": { + "UserAuthentication": { + "description": "Require NLA (Network Level Authentication) before session establishment", + "value": 1, + "type": "DWORD", + "attack_prevention": "Prevents brute-force attacks before login screen appears", + "impact": "Minimal - NLA is Windows 7+ standard. May affect pre-Vista RDP clients." + }, + "SecurityLayer": { + "description": "Require SSL/TLS encryption for all RDP connections", + "value": 2, + "type": "DWORD", + "attack_prevention": "Forces SSL/TLS encryption, prevents plaintext RDP traffic", + "impact": "Minimal - SSL/TLS is standard since Windows Vista" + } + } + }, + + "Complete_Disable": { + "description": "Complete RDP disable for air-gapped/high-security environments", + "enabled_by_default": false, + "profiles": { + "Balanced": false, + "Enterprise": false, + "Maximum": "optional" + }, + "registry_path": "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server", + "settings": { + "fDenyTSConnections": { + "description": "Completely disable Remote Desktop", + "value": 1, + "type": "DWORD", + "attack_prevention": "Complete RDP attack surface removal", + "impact": "HIGH - Remote administration will not work. Windows automatically adjusts firewall rules." + } + }, + "requires": { + "force_parameter": true, + "domain_check": true, + "warning": "This will completely disable RDP. Remote administration will not be possible." + } + }, + + "Compatibility": { + "windows_versions": ["Windows 10", "Windows 11", "Windows Server 2016+"], + "minimum_rdp_client": "Windows Vista+", + "notes": [ + "NLA is standard since Windows Vista / Server 2008", + "Pre-Vista clients will not be able to connect with NLA enforcement", + "Complete disable affects all remote management via RDP", + "Domain-joined systems should NOT disable RDP without explicit -Force" + ] + } +} diff --git a/Modules/AdvancedSecurity/Config/SRP-Rules.json b/Modules/AdvancedSecurity/Config/SRP-Rules.json new file mode 100644 index 0000000..2dd16d9 --- /dev/null +++ b/Modules/AdvancedSecurity/Config/SRP-Rules.json @@ -0,0 +1,85 @@ +{ + "Description": "Software Restriction Policies (SRP) for CVE-2025-9491 Mitigation", + "Documentation": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-9491", + "CVE": "CVE-2025-9491", + "Threat": "Windows LNK Remote Code Execution", + "Status": "Zero-Day, Actively Exploited since 2017", + "Severity": "High (CVSS 7.0)", + + "SRPConfiguration": { + "DefaultLevel": 262144, + "Description": "Unrestricted - Allow all programs except explicitly blocked", + "TransparentEnabled": 1, + "ExecutableTypes": [ + ".ADE", ".ADP", ".BAS", ".BAT", ".CHM", ".CMD", ".COM", ".CPL", ".CRT", + ".EXE", ".HLP", ".HTA", ".INF", ".INS", ".ISP", ".LNK", ".MDB", ".MDE", + ".MSC", ".MSI", ".MSP", ".MST", ".OCX", ".PCD", ".PIF", ".REG", ".SCR", + ".SHS", ".URL", ".VB", ".WSC", ".WSF", ".WSH" + ] + }, + + "PathRules": [ + { + "Name": "Block LNK from Outlook Temp", + "Path": "%LOCALAPPDATA%\\Temp\\*.lnk", + "SecurityLevel": 0, + "Description": "Blocks .lnk files from Outlook email attachments to prevent CVE-2025-9491 exploitation. Outlook saves attachments to %LOCALAPPDATA%\\Temp\\Content.Outlook\\ before execution.", + "SaferFlags": 0, + "Enabled": true, + "AttackVector": "Email attachments (malicious.lnk via Outlook)", + "Impact": "Prevents execution of .lnk files from email attachments. Legitimate shortcuts from Start Menu/Desktop/Taskbar still work (different paths)." + }, + { + "Name": "Block LNK from Downloads", + "Path": "%USERPROFILE%\\Downloads\\*.lnk", + "SecurityLevel": 0, + "Description": "Blocks .lnk files from browser Downloads folder to prevent CVE-2025-9491 exploitation from web downloads.", + "SaferFlags": 0, + "Enabled": true, + "AttackVector": "Browser downloads (malicious.lnk from web)", + "Impact": "Prevents execution of .lnk files downloaded from internet. Move .lnk to another location to execute if needed." + } + ], + + "Windows11BugFix": { + "Description": "Windows 11 has a bug where SRP is disabled by presence of certain keys in HKLM\\SYSTEM\\CurrentControlSet\\Control\\Srp\\Gp", + "Action": "Remove RuleCount and LastWriteTime keys", + "RegistryPath": "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Srp\\Gp", + "KeysToRemove": ["RuleCount", "LastWriteTime"], + "Reason": "These keys cause SRP to be ignored on Windows 11. Removing them re-enables SRP functionality." + }, + + "RegistryPaths": { + "PolicyRoot": "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers", + "PathRules": "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\0\\Paths", + "Win11BugFix": "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Srp\\Gp" + }, + + "SecurityLevels": { + "Disallowed": 0, + "Unrestricted": 262144, + "Description": "0 = Block execution, 262144 = Allow execution" + }, + + "SafeScenarios": [ + "Start Menu shortcuts (C:\\ProgramData\\Microsoft\\Windows\\Start Menu)", + "Desktop shortcuts (C:\\Users\\\\Desktop)", + "Taskbar shortcuts (pinned applications)", + "Program Files shortcuts (C:\\Program Files)", + "System shortcuts (C:\\Windows)" + ], + + "BlockedScenarios": [ + "Outlook email attachments (%LOCALAPPDATA%\\Temp\\Content.Outlook)", + "Browser downloads (%USERPROFILE%\\Downloads)", + "Temporary Internet Files", + "Other Temp locations matching patterns" + ], + + "Testing": { + "VerifyBlockedPath": "%USERPROFILE%\\Downloads\\test.lnk", + "ExpectedResult": "Execution blocked with 'This program is blocked by group policy' message", + "VerifySafePath": "%USERPROFILE%\\Desktop\\test.lnk", + "ExpectedResult2": "Execution allowed (Desktop not in blocked path list)" + } +} diff --git a/Modules/AdvancedSecurity/Config/WindowsUpdate.json b/Modules/AdvancedSecurity/Config/WindowsUpdate.json new file mode 100644 index 0000000..7fab006 --- /dev/null +++ b/Modules/AdvancedSecurity/Config/WindowsUpdate.json @@ -0,0 +1,57 @@ +{ + "Description": "Simple Windows Update Configuration - MS Best Practice (GUI Settings Only)", + "Documentation": "Matches Windows Settings > Windows Update > Advanced options", + "Purpose": "Enable immediate updates from Microsoft using Windows built-in settings", + + "Settings": { + "1_ReceiveUpdatesImmediately": { + "Name": "Get the latest updates as soon as they're available", + "RegistryPath": "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate", + "Values": { + "AllowOptionalContent": { + "Type": "DWord", + "Value": 1, + "Description": "Policy: enable optional content & configuration updates immediately (grays out GUI toggle)" + }, + "SetAllowOptionalContent": { + "Type": "DWord", + "Value": 1, + "Description": "Policy: enforce AllowOptionalContent setting (managed by organization)" + } + }, + "GUIPath": "Settings > Windows Update > Advanced options > Get the latest updates as soon as they're available" + }, + + "2_MicrosoftUpdate": { + "Name": "Receive updates for other Microsoft products", + "RegistryPath": "HKLM:\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings", + "Values": { + "AllowMUUpdateService": { + "Type": "DWord", + "Value": 1, + "Description": "Get updates for Office, drivers, and other Microsoft products with Windows Update" + } + }, + "GUIPath": "Settings > Windows Update > Advanced options > Receive updates for other Microsoft products" + }, + + "3_DeliveryOptimization": { + "Name": "Downloads from other devices (DISABLED for privacy)", + "RegistryPath": "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization", + "Values": { + "DODownloadMode": { + "Type": "DWord", + "Value": 0, + "Description": "0 = HTTP only (Microsoft servers), no P2P, no LAN sharing" + } + }, + "GUIPath": "Settings > Windows Update > Advanced options > Delivery Optimization > Allow downloads from other devices = OFF" + } + }, + + "TotalRegistryKeys": 4, + "MSBestPractice": "These are the EXACT settings shown in Windows Settings GUI - no hidden schedules, no auto-reboot config", + "UserControl": "User keeps full control over installation timing via Windows Settings (except Setting 1 is enforced by policy if enabled)", + "NoInteractivePrompt": "No mode selection needed - simple ON/ON/OFF configuration", + "CRITICAL_NOTE": "Setting 1 uses Policies\\Microsoft\\Windows\\WindowsUpdate (AllowOptionalContent/SetAllowOptionalContent) and will appear as 'managed by organization'. Setting 2 MUST use UX\\Settings path (NOT Policies path) to avoid locking the Microsoft Update toggle." +} diff --git a/Modules/AdvancedSecurity/Private/Backup-AdvancedSecuritySettings.ps1 b/Modules/AdvancedSecurity/Private/Backup-AdvancedSecuritySettings.ps1 new file mode 100644 index 0000000..679077d --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Backup-AdvancedSecuritySettings.ps1 @@ -0,0 +1,380 @@ +function Backup-AdvancedSecuritySettings { + <# + .SYNOPSIS + Create a comprehensive backup of all Advanced Security settings + + .DESCRIPTION + Backs up all registry keys, services, firewall rules, and Windows features + that will be modified by the AdvancedSecurity module. + + This is called automatically by Invoke-AdvancedSecurity before applying changes. + + .EXAMPLE + Backup-AdvancedSecuritySettings + + .NOTES + Uses the Core/Rollback.ps1 backup system + #> + [CmdletBinding()] + param() + + try { + Write-Log -Level INFO -Message "Creating comprehensive backup of Advanced Security settings..." -Module "AdvancedSecurity" + + $backupCount = 0 + + # Start module backup session + $backupSession = Start-ModuleBackup -ModuleName "AdvancedSecurity" + + if (-not $backupSession) { + Write-Log -Level ERROR -Message "Failed to start backup session" -Module "AdvancedSecurity" + return $false + } + + # 1. RDP Settings + Write-Log -Level DEBUG -Message "Backing up RDP settings..." -Module "AdvancedSecurity" + $rdpBackup = Backup-RegistryKey -KeyPath "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -BackupName "RDP_Settings" + if ($rdpBackup) { $backupCount++ } + + # CRITICAL: Create JSON backup for RDP (Rollback fallback) + # .reg import often fails for RDP keys due to permissions, so we need values for PowerShell restore + try { + $rdpData = @{} + + # System Settings + $systemPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" + if (Test-Path $systemPath) { + $val = Get-ItemProperty -Path $systemPath -Name "fDenyTSConnections" -ErrorAction SilentlyContinue + if ($val) { $rdpData["System_fDenyTSConnections"] = $val.fDenyTSConnections } + } + + # Policy Settings + $policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" + if (Test-Path $policyPath) { + $val1 = Get-ItemProperty -Path $policyPath -Name "UserAuthentication" -ErrorAction SilentlyContinue + if ($val1) { $rdpData["Policy_UserAuthentication"] = $val1.UserAuthentication } + + $val2 = Get-ItemProperty -Path $policyPath -Name "SecurityLayer" -ErrorAction SilentlyContinue + if ($val2) { $rdpData["Policy_SecurityLayer"] = $val2.SecurityLayer } + } + + if ($rdpData.Count -gt 0) { + $rdpJson = $rdpData | ConvertTo-Json + $rdpJsonBackup = Register-Backup -Type "AdvancedSecurity" -Data $rdpJson -Name "RDP_Hardening" + if ($rdpJsonBackup) { + Write-Log -Level DEBUG -Message "Created RDP JSON backup for rollback fallback" -Module "AdvancedSecurity" + $backupCount++ + } + } + } + catch { + Write-Log -Level WARNING -Message "Failed to create RDP JSON backup: $_" -Module "AdvancedSecurity" + } + + # 2. WDigest Settings + Write-Log -Level DEBUG -Message "Backing up WDigest settings..." -Module "AdvancedSecurity" + $wdigestBackup = Backup-RegistryKey -KeyPath "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" -BackupName "WDigest_Settings" + if ($wdigestBackup) { $backupCount++ } + + # Discovery Protocol Settings (mDNS resolver) + Write-Log -Level DEBUG -Message "Backing up discovery protocol settings (mDNS)" -Module "AdvancedSecurity" + $mdnsBackup = Backup-RegistryKey -KeyPath "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" -BackupName "DiscoveryProtocols_DnscacheParameters" + if ($mdnsBackup) { $backupCount++ } + + # 3. Admin Shares Settings + Write-Log -Level DEBUG -Message "Backing up Admin Shares settings..." -Module "AdvancedSecurity" + $adminSharesBackup = Backup-RegistryKey -KeyPath "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -BackupName "AdminShares_Settings" + if ($adminSharesBackup) { $backupCount++ } + + # 4. TLS Settings + Write-Log -Level DEBUG -Message "Backing up TLS settings..." -Module "AdvancedSecurity" + $tlsVersions = @("TLS 1.0", "TLS 1.1") + $components = @("Server", "Client") + + foreach ($version in $tlsVersions) { + foreach ($component in $components) { + $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$version\$component" + $tlsBackup = Backup-RegistryKey -KeyPath $regPath -BackupName "TLS_${version}_${component}".Replace(" ", "_").Replace(".", "") + if ($tlsBackup) { $backupCount++ } + } + } + + # 5. WPAD Settings (3 paths: WinHttp for official MS key, Wpad for legacy, Internet Settings for AutoDetect) + Write-Log -Level DEBUG -Message "Backing up WPAD settings..." -Module "AdvancedSecurity" + + $wpadPaths = @( + "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp", # Official MS DisableWpad key + "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad", # Legacy WpadOverride + "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" # AutoDetect + ) + + foreach ($wpadPath in $wpadPaths) { + $pathName = $wpadPath.Split('\')[-1] + $wpadBackup = Backup-RegistryKey -KeyPath $wpadPath -BackupName "WPAD_${pathName}" + if ($wpadBackup) { $backupCount++ } + } + + # CRITICAL: Create JSON backup for WPAD (Rollback fallback) - all paths combined + try { + $wpadData = @{} + + foreach ($wpadPath in $wpadPaths) { + if (Test-Path $wpadPath) { + $wpadProps = Get-ItemProperty -Path $wpadPath -ErrorAction SilentlyContinue + + # Capture all relevant properties in format expected by Rollback.ps1 + # Format: "FullPath\ValueName" = Value + foreach ($prop in $wpadProps.PSObject.Properties) { + if ($prop.Name -notin @('PSPath','PSParentPath','PSChildName','PSDrive','PSProvider')) { + $fullKey = "$wpadPath\$($prop.Name)" + $wpadData[$fullKey] = $prop.Value + } + } + } + } + + if ($wpadData.Count -gt 0) { + $wpadJson = $wpadData | ConvertTo-Json + $wpadJsonBackup = Register-Backup -Type "AdvancedSecurity" -Data $wpadJson -Name "WPAD" + if ($wpadJsonBackup) { + Write-Log -Level DEBUG -Message "Created WPAD JSON backup for rollback fallback ($($wpadData.Count) values)" -Module "AdvancedSecurity" + $backupCount++ + } + } + } + catch { + Write-Log -Level WARNING -Message "Failed to create WPAD JSON backup: $_" -Module "AdvancedSecurity" + } + + # 6. Services (including WiFi Direct for Wireless Display and WS-Discovery) + Write-Log -Level DEBUG -Message "Backing up risky services state..." -Module "AdvancedSecurity" + # Note: Computer Browser (Browser) is deprecated in Win10/11 - not included + $services = @("SSDPSRV", "upnphost", "lmhosts", "WFDSConMgrSvc", "FDResPub", "fdPHost") + + foreach ($svc in $services) { + $svcBackup = Backup-ServiceConfiguration -ServiceName $svc + if ($svcBackup) { $backupCount++ } + } + + # 7. PowerShell v2 Feature State + Write-Log -Level DEBUG -Message "Backing up PowerShell v2 feature state..." -Module "AdvancedSecurity" + + # Canonical detection: use Windows Optional Feature state + $psv2Feature = $null + try { + $psv2Feature = Get-WindowsOptionalFeature -Online -FeatureName "MicrosoftWindowsPowerShellV2Root" -ErrorAction SilentlyContinue + } + catch { + $psv2Feature = $null + } + + if (-not $psv2Feature -or $psv2Feature.State -ne 'Enabled') { + # Feature not present or not enabled โ€“ nothing to back up + Write-Log -Level INFO -Message "PowerShell v2 optional feature not enabled/present - skipping feature backup" -Module "AdvancedSecurity" + } + else { + $psv2Data = @{ + FeatureName = $psv2Feature.FeatureName + State = $psv2Feature.State + DetectionMethod = "WindowsOptionalFeature" + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + } | ConvertTo-Json + + $psv2Backup = Register-Backup -Type "WindowsFeature" -Data $psv2Data -Name "PowerShellV2" + if ($psv2Backup) { $backupCount++ } + } + + # 8. Firewall Rules Snapshot + Write-Host "" + Write-Host " ============================================" -ForegroundColor Cyan + Write-Host " FIREWALL RULES BACKUP - PLEASE WAIT" -ForegroundColor Cyan + Write-Host " ============================================" -ForegroundColor Cyan + Write-Host " Creating snapshot for risky ports..." -ForegroundColor White + Write-Host " Ports: 79, 137-139, 1900, 2869, 5355, 3702, 5353, 5357, 5358" -ForegroundColor Gray + Write-Host "" + Write-Host " [!] This operation takes 60-120 seconds" -ForegroundColor Yellow + Write-Host " System is working - do not interrupt!" -ForegroundColor Yellow + Write-Host " ============================================" -ForegroundColor Cyan + Write-Host "" + Write-Log -Level INFO -Message "Backing up firewall rules snapshot for risky ports (79, 137, 138, 139, 1900, 2869, 5355, 3702, 5353, 5357, 5358)..." -Module "AdvancedSecurity" + $firewallRules = Get-NetFirewallRule | Where-Object { + $portFilter = $_ | Get-NetFirewallPortFilter + (($portFilter.LocalPort -in @(79, 137, 138, 139, 1900, 2869, 5355, 3702, 5353, 5357, 5358)) -or + ($portFilter.RemotePort -in @(79, 137, 138, 139, 1900, 2869, 5355, 3702, 5353, 5357, 5358))) -and + ($_.Direction -eq 'Inbound' -or $_.Direction -eq 'Outbound') + } | Select-Object Name, DisplayName, Enabled, Direction, Action + + $firewallData = @{ + Rules = $firewallRules + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + RuleCount = $firewallRules.Count + } | ConvertTo-Json -Depth 10 + + $firewallBackup = Register-Backup -Type "Firewall_Rules" -Data $firewallData -Name "RiskyPorts_Firewall" + if ($firewallBackup) { $backupCount++ } + + Write-Host " [OK] Firewall rules backup completed ($($firewallRules.Count) rules processed)" -ForegroundColor Green + Write-Host "" + + # 9. SMB Shares Snapshot + Write-Log -Level DEBUG -Message "Backing up SMB shares snapshot..." -Module "AdvancedSecurity" + + # Check if LanmanServer service is running (required for Get-SmbShare) + $serverService = Get-Service -Name "LanmanServer" -ErrorAction SilentlyContinue + if (-not $serverService -or $serverService.Status -ne 'Running') { + Write-Log -Level INFO -Message "LanmanServer service is not running - no SMB shares to backup" -Module "AdvancedSecurity" + $adminShares = @() + } + else { + try { + $adminShares = Get-SmbShare | Where-Object { $_.Name -match '^[A-Z]\$$|^ADMIN\$$' } | + Select-Object Name, Path, Description + } + catch { + Write-Log -Level INFO -Message "Could not query SMB shares: $($_.Exception.Message)" -Module "AdvancedSecurity" + $adminShares = @() + } + } + + $sharesData = @{ + Shares = $adminShares + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + ShareCount = $adminShares.Count + } | ConvertTo-Json -Depth 10 + + $sharesBackup = Register-Backup -Type "SMB_Shares" -Data $sharesData -Name "AdminShares" + if ($sharesBackup) { $backupCount++ } + + $netbiosAdapters = @() + try { + $netbiosAdapters = Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration -Filter "IPEnabled = TRUE" -ErrorAction SilentlyContinue + } + catch { + $netbiosAdapters = @() + } + if ($netbiosAdapters) { + $netbiosSnapshot = @() + foreach ($adapter in $netbiosAdapters) { + $netbiosSnapshot += [PSCustomObject]@{ + Description = $adapter.Description + Index = $adapter.Index + TcpipNetbiosOptions = $adapter.TcpipNetbiosOptions + } + } + if ($netbiosSnapshot.Count -gt 0) { + $netbiosJson = $netbiosSnapshot | ConvertTo-Json -Depth 5 + $netbiosBackup = Register-Backup -Type "AdvancedSecurity" -Data $netbiosJson -Name "NetBIOS_Adapters" + if ($netbiosBackup) { $backupCount++ } + } + } + + # 10. Windows Update Settings (3 simple GUI settings) + Write-Log -Level DEBUG -Message "Backing up Windows Update settings..." -Module "AdvancedSecurity" + + # Setting 1: Get latest updates immediately + $wuUXBackup = Backup-RegistryKey -KeyPath "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" -BackupName "WindowsUpdate_UX_Settings" + if ($wuUXBackup) { $backupCount++ } + + # Setting 1 Policy: Windows Update optional content/config updates + $wuPoliciesBackup = Backup-RegistryKey -KeyPath "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -BackupName "WindowsUpdate_Policies" + if ($wuPoliciesBackup) { $backupCount++ } + + # Setting 2: Microsoft Update for other products (moved to UX\Settings - same as Setting 1) + # No separate backup needed - already backed up in WindowsUpdate_UX_Settings + + # Setting 3: Delivery Optimization + $wuDOBackup = Backup-RegistryKey -KeyPath "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" -BackupName "WindowsUpdate_DeliveryOptimization" + if ($wuDOBackup) { $backupCount++ } + + # 11. SRP (Software Restriction Policies) Settings + Write-Log -Level DEBUG -Message "Backing up SRP settings..." -Module "AdvancedSecurity" + $srpBackup = Backup-RegistryKey -KeyPath "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" -BackupName "SRP_Settings" + if ($srpBackup) { $backupCount++ } + + # 12. CRITICAL: Create comprehensive JSON Pre-State Snapshot (counter Registry tattooing) + # This captures EXACT state of ALL AdvancedSecurity registry keys before hardening + Write-Log -Level INFO -Message "Creating AdvancedSecurity registry pre-state snapshot (JSON)..." -Module "AdvancedSecurity" + $preStateSnapshot = @() + + # All registry keys that AdvancedSecurity modifies + $allAdvSecKeys = @( + "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server", + "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services", + "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest", + "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters", + "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server", + "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client", + "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server", + "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client", + "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters", + "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp", # Official MS DisableWpad key + "HKLM:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad", # Legacy WpadOverride + "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings", # AutoDetect + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate", + "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect", # Wireless Display / Miracast + "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile", # Firewall Shields Up + "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" # IPv6 disable (mitm6 mitigation) + ) + + foreach ($keyPath in $allAdvSecKeys) { + if (Test-Path $keyPath) { + try { + # Get all properties for this key + $properties = Get-ItemProperty -Path $keyPath -ErrorAction Stop + $propertyNames = $properties.PSObject.Properties.Name | Where-Object { + $_ -notin @('PSPath', 'PSParentPath', 'PSChildName', 'PSProvider', 'PSDrive') + } + + foreach ($propName in $propertyNames) { + $propValue = $properties.$propName + + # Get value type + try { + $propType = (Get-Item $keyPath).GetValueKind($propName) + } + catch { + $propType = "String" # Default fallback + } + + $preStateSnapshot += [PSCustomObject]@{ + Path = $keyPath + Name = $propName + Value = $propValue + Type = $propType.ToString() + Exists = $true + } + } + } + catch { + Write-Log -Level DEBUG -Message "Could not read properties from $keyPath : $_" -Module "AdvancedSecurity" + } + } + # If key doesn't exist, we don't add it to snapshot (only existing values are tracked) + } + + # Save JSON snapshot + try { + $snapshotJson = $preStateSnapshot | ConvertTo-Json -Depth 5 + $result = Register-Backup -Type "AdvancedSecurity" -Data $snapshotJson -Name "AdvancedSecurity_PreState" + if ($result) { + $backupCount++ + Write-Log -Level SUCCESS -Message "AdvancedSecurity pre-state snapshot created ($($preStateSnapshot.Count) registry values)" -Module "AdvancedSecurity" + } + } + catch { + Write-Log -Level WARNING -Message "Failed to create AdvancedSecurity pre-state snapshot: $_" -Module "AdvancedSecurity" + } + + Write-Log -Level SUCCESS -Message "Advanced Security backup completed: $backupCount items backed up" -Module "AdvancedSecurity" + + return $backupCount + } + catch { + Write-Log -Level ERROR -Message "Failed to backup Advanced Security settings: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Block-FingerProtocol.ps1 b/Modules/AdvancedSecurity/Private/Block-FingerProtocol.ps1 new file mode 100644 index 0000000..c9b43c2 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Block-FingerProtocol.ps1 @@ -0,0 +1,107 @@ +function Block-FingerProtocol { + <# + .SYNOPSIS + Blocks outbound connections to TCP Port 79 (Finger protocol) via Windows Firewall + + .DESCRIPTION + Creates a Windows Firewall rule to block all outbound connections to TCP port 79, + preventing abuse of the finger.exe command in ClickFix malware campaigns. + + THREAT: ClickFix attacks use finger.exe to retrieve commands from remote servers + on port 79, which are then piped to cmd.exe for execution. + + MITIGATION: Block outbound port 79 to prevent finger.exe from reaching C2 servers. + + .PARAMETER DryRun + Preview changes without applying them + + .EXAMPLE + Block-FingerProtocol + Blocks outbound finger protocol connections + + .NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: Administrator privileges + + REFERENCES: + - https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ + - https://redteamnews.com/threat-intelligence/clickfix-malware-campaigns-resurrect-decades-old-finger-protocol-for-command-retrieval/ + #> + + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + try { + $ruleName = "NoID Privacy - Block Finger Protocol (Port 79)" + + Write-Log -Level INFO -Message "Checking for existing Finger protocol block rule..." -Module "AdvancedSecurity" + + # Check if rule already exists + $existingRule = Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue + + if ($existingRule) { + Write-Log -Level INFO -Message "Finger protocol block rule already exists" -Module "AdvancedSecurity" + + # Show user that protection is already active + Write-Host "" + Write-Host "Finger Protocol Block: Already Protected" -ForegroundColor Green + Write-Host " Rule: $ruleName" -ForegroundColor Gray + Write-Host " Status: Active (Outbound TCP port 79 blocked)" -ForegroundColor Gray + Write-Host " Protection: ClickFix malware using finger.exe" -ForegroundColor Gray + Write-Host "" + + return $true + } + + if ($DryRun) { + Write-Log -Level INFO -Message "[DRYRUN] Would create firewall rule to block outbound TCP port 79" -Module "AdvancedSecurity" + return $true + } + + Write-Log -Level INFO -Message "Creating Windows Firewall rule to block outbound finger protocol (TCP 79)..." -Module "AdvancedSecurity" + + # Create outbound firewall rule + $ruleParams = @{ + DisplayName = $ruleName + Description = "Blocks outbound connections to TCP port 79 (Finger protocol) to prevent ClickFix malware attacks. The finger.exe command is abused to retrieve malicious commands from remote servers." + Direction = "Outbound" + Action = "Block" + Protocol = "TCP" + RemotePort = 79 + Profile = "Any" + Enabled = "True" + ErrorAction = "Stop" + } + + New-NetFirewallRule @ruleParams | Out-Null + + # Verify rule was created + $verifyRule = Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue + + if ($verifyRule) { + Write-Log -Level SUCCESS -Message "Finger protocol (TCP port 79) outbound connections blocked" -Module "AdvancedSecurity" + Write-Log -Level INFO -Message "ClickFix malware campaigns using finger.exe are now mitigated" -Module "AdvancedSecurity" + + Write-Host "" + Write-Host "Firewall Rule Created:" -ForegroundColor Green + Write-Host "Name: $ruleName" -ForegroundColor Gray + Write-Host "Blocks: Outbound TCP port 79 (Finger protocol)" -ForegroundColor Gray + Write-Host "Protection: ClickFix malware using finger.exe" -ForegroundColor Gray + Write-Host "" + + return $true + } + else { + Write-Log -Level ERROR -Message "Firewall rule creation failed - verification unsuccessful" -Module "AdvancedSecurity" + return $false + } + } + catch { + Write-Log -Level ERROR -Message "Failed to create finger protocol block rule: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Disable-AdminShares.ps1 b/Modules/AdvancedSecurity/Private/Disable-AdminShares.ps1 new file mode 100644 index 0000000..45a198f --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Disable-AdminShares.ps1 @@ -0,0 +1,219 @@ +function Disable-AdminShares { + <# + .SYNOPSIS + Disable administrative shares (C$, ADMIN$, etc.) to prevent lateral movement + + .DESCRIPTION + Disables the automatic creation of administrative shares and removes existing shares. + Administrative shares (C$, D$, ADMIN$) are used by attackers for: + - Lateral movement (WannaCry, NotPetya propagation) + - Remote file access with stolen credentials + - Pass-the-Hash attacks + - Automated malware propagation + + CRITICAL: Includes domain-safety check. On domain-joined systems, admin shares + are often required for Group Policy, SCCM, and remote management tools. + + REQUIRES REBOOT to prevent share recreation. + + .PARAMETER Force + Force disable even on domain-joined systems (NOT RECOMMENDED for enterprise!) + + .EXAMPLE + Disable-AdminShares + Disables admin shares with domain-safety check + + .EXAMPLE + Disable-AdminShares -Force + Forces disable even on domain-joined systems (DANGEROUS!) + + .NOTES + Impact: + - Home/Workgroup: Highly recommended + - Enterprise Domain: May break management tools - TEST FIRST! + - IPC$ cannot be removed (required by Windows) + + Shares will NOT be recreated after reboot (if registry values set to 0). + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$Force + ) + + try { + Write-Log -Level INFO -Message "Configuring administrative shares disable..." -Module "AdvancedSecurity" + + # CRITICAL: Check if system is domain-joined + $computerSystem = Get-CimInstance -ClassName Win32_ComputerSystem + + if ($computerSystem.PartOfDomain -and -not $Force) { + Write-Log -Level WARNING -Message "Domain-joined system detected. Admin shares disable SKIPPED." -Module "AdvancedSecurity" + Write-Log -Level WARNING -Message "Admin shares are often required for:" -Module "AdvancedSecurity" + Write-Log -Level WARNING -Message " - Group Policy management" -Module "AdvancedSecurity" + Write-Log -Level WARNING -Message " - SCCM/Management tools" -Module "AdvancedSecurity" + Write-Log -Level WARNING -Message " - Remote administration" -Module "AdvancedSecurity" + Write-Log -Level WARNING -Message "Use -Force to override (NOT RECOMMENDED!)" -Module "AdvancedSecurity" + + Write-Host "" + Write-Host "================================================" -ForegroundColor Yellow + Write-Host " DOMAIN-JOINED SYSTEM DETECTED" -ForegroundColor Yellow + Write-Host "================================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "Administrative shares are often required for:" -ForegroundColor White + Write-Host " - Group Policy remote management" -ForegroundColor Gray + Write-Host " - SCCM and other management tools" -ForegroundColor Gray + Write-Host " - Remote administration via WMI/PowerShell" -ForegroundColor Gray + Write-Host "" + Write-Host "Skipping admin shares disable to prevent breakage." -ForegroundColor Green + Write-Host "Use -DisableAdminShares -Force to override (NOT RECOMMENDED)." -ForegroundColor Red + Write-Host "" + + return $true # Not an error, just skipped + } + + $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" + + # Check if LanmanServer service is running (required for Get-SmbShare) + $serverService = Get-Service -Name "LanmanServer" -ErrorAction SilentlyContinue + $serviceRunning = $serverService -and $serverService.Status -eq 'Running' + + # Backup current shares and registry settings + Write-Log -Level INFO -Message "Backing up current administrative shares..." -Module "AdvancedSecurity" + + if (-not $serviceRunning) { + # Server service not running - admin shares are already effectively disabled + Write-Log -Level INFO -Message "LanmanServer service is not running - admin shares already disabled" -Module "AdvancedSecurity" + $currentShares = @() + } + else { + try { + $currentShares = Get-SmbShare | Where-Object { $_.Name -match '^[A-Z]\$$|^ADMIN\$$' } | + Select-Object Name, Path, Description + } + catch { + Write-Log -Level INFO -Message "Could not query SMB shares: $($_.Exception.Message)" -Module "AdvancedSecurity" + $currentShares = @() + } + } + + $backupData = @{ + Shares = $currentShares + AutoShareWks = (Get-ItemProperty -Path $regPath -Name "AutoShareWks" -ErrorAction SilentlyContinue).AutoShareWks + AutoShareServer = (Get-ItemProperty -Path $regPath -Name "AutoShareServer" -ErrorAction SilentlyContinue).AutoShareServer + DomainJoined = $computerSystem.PartOfDomain + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + } + + # Register backup + $backupJson = $backupData | ConvertTo-Json -Depth 10 + Register-Backup -Type "AdminShares_Settings" -Data $backupJson -Name "AdminShares_Disable" + + Write-Log -Level INFO -Message "Backed up $($currentShares.Count) administrative shares" -Module "AdvancedSecurity" + + # Disable automatic creation + Write-Log -Level INFO -Message "Disabling automatic administrative share creation..." -Module "AdvancedSecurity" + + if (-not (Test-Path $regPath)) { + New-Item -Path $regPath -Force | Out-Null + } + + # Disable for Workstation (Home/Pro) + $existing = Get-ItemProperty -Path $regPath -Name "AutoShareWks" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "AutoShareWks" -Value 0 -Force | Out-Null + } else { + New-ItemProperty -Path $regPath -Name "AutoShareWks" -Value 0 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level SUCCESS -Message "Disabled AutoShareWks (Workstation shares)" -Module "AdvancedSecurity" + + # Disable for Server editions + $existing = Get-ItemProperty -Path $regPath -Name "AutoShareServer" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "AutoShareServer" -Value 0 -Force | Out-Null + } else { + New-ItemProperty -Path $regPath -Name "AutoShareServer" -Value 0 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level SUCCESS -Message "Disabled AutoShareServer (Server edition shares)" -Module "AdvancedSecurity" + + # Remove existing shares + Write-Log -Level INFO -Message "Removing existing administrative shares..." -Module "AdvancedSecurity" + + $removedCount = 0 + $skippedShares = @() + + foreach ($share in $currentShares) { + try { + Remove-SmbShare -Name $share.Name -Force -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Removed share: $($share.Name) ($($share.Path))" -Module "AdvancedSecurity" + $removedCount++ + } + catch { + # ADMIN$ and C$ cannot be removed while system is running (expected behavior) + # They will NOT be recreated after reboot due to registry settings + Write-Log -Level INFO -Message "Share $($share.Name) protected by system (will not be recreated after reboot)" -Module "AdvancedSecurity" + $skippedShares += $share.Name + } + } + + if ($skippedShares.Count -gt 0) { + Write-Log -Level INFO -Message "System-protected shares: $($skippedShares -join ', ') - Will NOT be recreated after reboot" -Module "AdvancedSecurity" + } + + Write-Log -Level SUCCESS -Message "Removed $removedCount administrative shares, $($skippedShares.Count) protected by system" -Module "AdvancedSecurity" + + # Add firewall protection for Public networks + Write-Log -Level INFO -Message "Adding firewall protection for SMB on Public networks..." -Module "AdvancedSecurity" + + $firewallRuleName = "Block Admin Shares - NoID Privacy" + + # Check if rule already exists + $existingRule = Get-NetFirewallRule -DisplayName $firewallRuleName -ErrorAction SilentlyContinue + + if ($existingRule) { + Write-Log -Level INFO -Message "Firewall rule already exists, updating..." -Module "AdvancedSecurity" + Remove-NetFirewallRule -DisplayName $firewallRuleName -ErrorAction SilentlyContinue + } + + # Create new firewall rule + New-NetFirewallRule -DisplayName $firewallRuleName ` + -Direction Inbound ` + -Protocol TCP ` + -LocalPort 445 ` + -Profile Public ` + -Action Block ` + -ErrorAction Stop | Out-Null + + Write-Log -Level SUCCESS -Message "Firewall rule created: Block SMB (port 445) on Public networks" -Module "AdvancedSecurity" + + Write-Host "" + Write-Host "================================================" -ForegroundColor Green + Write-Host " ADMINISTRATIVE SHARES DISABLED" -ForegroundColor Green + Write-Host "================================================" -ForegroundColor Green + Write-Host "" + Write-Host "Registry settings:" -ForegroundColor White + Write-Host " AutoShareWks: 0 (Disabled)" -ForegroundColor Gray + Write-Host " AutoShareServer: 0 (Disabled)" -ForegroundColor Gray + Write-Host "" + Write-Host "Removed shares: $removedCount" -ForegroundColor White + if ($skippedShares.Count -gt 0) { + Write-Host "Protected shares: $($skippedShares -join ', ') (cannot be removed while running)" -ForegroundColor Gray + } + Write-Host "Firewall: SMB blocked on Public networks" -ForegroundColor White + Write-Host "" + Write-Host "IMPORTANT: REBOOT REQUIRED" -ForegroundColor Yellow + + $exampleShares = if ($skippedShares.Count -gt 0) { $skippedShares -join ', ' } else { 'C$, ADMIN$' } + Write-Host "All admin shares (including $exampleShares) will NOT be recreated after reboot." -ForegroundColor Green + Write-Host "" + Write-Host "Note: IPC$ cannot be removed (required by Windows)" -ForegroundColor Gray + Write-Host "Note: Explicit file shares will still work" -ForegroundColor Gray + Write-Host "" + + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to disable administrative shares: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Disable-LegacyTLS.ps1 b/Modules/AdvancedSecurity/Private/Disable-LegacyTLS.ps1 new file mode 100644 index 0000000..234ae46 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Disable-LegacyTLS.ps1 @@ -0,0 +1,73 @@ +function Disable-LegacyTLS { + <# + .SYNOPSIS + Disable legacy TLS 1.0 and TLS 1.1 + + .DESCRIPTION + Disables TLS 1.0 and TLS 1.1 for both Client and Server to prevent + BEAST, CRIME, and other attacks. + + Attack Prevention: BEAST, CRIME, weak cipher suites + + Impact: May break old internal web applications that haven't been updated + + .EXAMPLE + Disable-LegacyTLS + #> + [CmdletBinding()] + param() + + try { + Write-Log -Level INFO -Message "Disabling legacy TLS 1.0 and TLS 1.1..." -Module "AdvancedSecurity" + + $tlsVersions = @("TLS 1.0", "TLS 1.1") + $components = @("Server", "Client") + + $setCount = 0 + + foreach ($version in $tlsVersions) { + foreach ($component in $components) { + $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$version\$component" + + # Create path if needed + if (-not (Test-Path $regPath)) { + New-Item -Path $regPath -Force | Out-Null + } + + # Disable TLS version + $existing = Get-ItemProperty -Path $regPath -Name "Enabled" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "Enabled" -Value 0 -Force | Out-Null + } else { + New-ItemProperty -Path $regPath -Name "Enabled" -Value 0 -PropertyType DWord -Force | Out-Null + } + + $existing = Get-ItemProperty -Path $regPath -Name "DisabledByDefault" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "DisabledByDefault" -Value 1 -Force | Out-Null + } else { + New-ItemProperty -Path $regPath -Name "DisabledByDefault" -Value 1 -PropertyType DWord -Force | Out-Null + } + + Write-Log -Level SUCCESS -Message "Disabled $version $component" -Module "AdvancedSecurity" + $setCount += 2 + } + } + + Write-Log -Level SUCCESS -Message "Legacy TLS disabled ($setCount registry keys set)" -Module "AdvancedSecurity" + Write-Host "" + Write-Host "Legacy TLS Disabled:" -ForegroundColor Green + Write-Host " TLS 1.0: Client + Server" -ForegroundColor Gray + Write-Host " TLS 1.1: Client + Server" -ForegroundColor Gray + Write-Host "" + Write-Host "WARNING: Old web applications may not work!" -ForegroundColor Yellow + Write-Host "Only TLS 1.2 and TLS 1.3 are now allowed." -ForegroundColor Gray + Write-Host "" + + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to disable legacy TLS: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Disable-RiskyPorts.ps1 b/Modules/AdvancedSecurity/Private/Disable-RiskyPorts.ps1 new file mode 100644 index 0000000..6402170 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Disable-RiskyPorts.ps1 @@ -0,0 +1,245 @@ +function Disable-RiskyPorts { + <# + .SYNOPSIS + Disable risky firewall ports (LLMNR, NetBIOS, UPnP/SSDP) + + .DESCRIPTION + Closes firewall ports that are commonly exploited for MITM attacks, + network enumeration, and credential theft: + + - LLMNR (Port 5355) - HIGH RISK: Responder poisoning, credential theft + - NetBIOS (Port 137-139) - MEDIUM RISK: Network enumeration + - UPnP/SSDP (Port 1900, 2869) - MEDIUM RISK: Port forwarding vulnerabilities + + Uses language-independent port-based filtering to avoid DisplayName issues. + + .PARAMETER SkipUPnP + Skip disabling UPnP/SSDP ports (for users who need DLNA/media streaming) + + .EXAMPLE + Disable-RiskyPorts + Disables all risky firewall ports including UPnP + + .EXAMPLE + Disable-RiskyPorts -SkipUPnP + Disables LLMNR and NetBIOS but keeps UPnP enabled + + .NOTES + Defense in Depth: Security Baseline disables protocols via registry, + but firewall rules may still be active. This function closes the ports + at the firewall level for additional protection. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$SkipUPnP + ) + + try { + Write-Log -Level INFO -Message "Disabling risky firewall ports..." -Module "AdvancedSecurity" + + $disabledRules = 0 + $errors = @() + + # PERFORMANCE: Get all firewall rules ONCE and cache port filters + Write-Log -Level INFO -Message "Loading firewall rules for analysis..." -Module "AdvancedSecurity" + $allRules = Get-NetFirewallRule | Where-Object { $_.Direction -eq 'Inbound' -and $_.Enabled -eq $true } + + # Pre-fetch port filters to avoid repeated Get-NetFirewallPortFilter calls + # NOTE: We cache both the rule and its ports so we can later filter ONLY + # ALLOW rules for disabling. NoID block rules must remain enabled. + $rulesWithPorts = @() + foreach ($rule in $allRules) { + $portFilter = $rule | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue + if ($portFilter) { + $rulesWithPorts += [PSCustomObject]@{ + Rule = $rule + LocalPort = $portFilter.LocalPort + RemotePort = $portFilter.RemotePort + } + } + } + + Write-Log -Level INFO -Message "Analyzed $($rulesWithPorts.Count) firewall rules with port filters" -Module "AdvancedSecurity" + + # Backup firewall rules + Write-Log -Level INFO -Message "Backing up firewall rules..." -Module "AdvancedSecurity" + $backupData = @{ + FirewallRules = $allRules | Select-Object Name, DisplayName, Enabled, Direction, Action + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + } + $backupJson = $backupData | ConvertTo-Json -Depth 10 + Register-Backup -Type "Firewall_Rules" -Data $backupJson -Name "RiskyPorts_Firewall" + + # 1. LLMNR (Port 5355 UDP) - HIGH RISK + Write-Log -Level INFO -Message "Disabling LLMNR firewall rules (Port 5355)..." -Module "AdvancedSecurity" + + try { + # Filter from pre-loaded cache (ONLY ALLOW rules - keep NoID block rules enabled) + $llmnrRules = $rulesWithPorts | Where-Object { + ($_.LocalPort -eq 5355 -or $_.RemotePort -eq 5355) -and $_.Rule.Action -eq 'Allow' + } | Select-Object -ExpandProperty Rule + + foreach ($rule in $llmnrRules) { + Disable-NetFirewallRule -Name $rule.Name -ErrorAction Stop + Write-Log -Level DEBUG -Message "Disabled LLMNR rule: $($rule.DisplayName)" -Module "AdvancedSecurity" + $disabledRules++ + } + + if ($llmnrRules.Count -eq 0) { + Write-Log -Level INFO -Message "No active LLMNR rules found (already disabled or not present)" -Module "AdvancedSecurity" + } + else { + Write-Log -Level SUCCESS -Message "Disabled $($llmnrRules.Count) LLMNR firewall rules" -Module "AdvancedSecurity" + } + } + catch { + $errors += "LLMNR: $_" + Write-Log -Level WARNING -Message "Failed to disable some LLMNR rules: $_" -Module "AdvancedSecurity" + } + + # 2. NetBIOS (Port 137-139) - MEDIUM RISK + Write-Log -Level INFO -Message "Disabling NetBIOS firewall rules (Port 137-139)..." -Module "AdvancedSecurity" + + try { + # Filter from pre-loaded cache (ONLY ALLOW rules - keep NoID block rules enabled) + $netbiosRules = $rulesWithPorts | Where-Object { + ($_.LocalPort -in @(137, 138, 139)) -or ($_.RemotePort -in @(137, 138, 139)) + } | Where-Object { $_.Rule.Action -eq 'Allow' } | Select-Object -ExpandProperty Rule + + foreach ($rule in $netbiosRules) { + Disable-NetFirewallRule -Name $rule.Name -ErrorAction Stop + Write-Log -Level DEBUG -Message "Disabled NetBIOS rule: $($rule.DisplayName)" -Module "AdvancedSecurity" + $disabledRules++ + } + + if ($netbiosRules.Count -eq 0) { + Write-Log -Level INFO -Message "No active NetBIOS rules found (already disabled or not present)" -Module "AdvancedSecurity" + } + else { + Write-Log -Level SUCCESS -Message "Disabled $($netbiosRules.Count) NetBIOS firewall rules" -Module "AdvancedSecurity" + } + } + catch { + $errors += "NetBIOS: $_" + Write-Log -Level WARNING -Message "Failed to disable some NetBIOS rules: $_" -Module "AdvancedSecurity" + } + + # Also disable NetBIOS over TCP/IP on all network adapters + Write-Log -Level INFO -Message "Disabling NetBIOS over TCP/IP on all adapters..." -Module "AdvancedSecurity" + + try { + $adapters = Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration -Filter "IPEnabled = TRUE" + $adaptedCount = 0 + + foreach ($adapter in $adapters) { + try { + $result = Invoke-CimMethod -InputObject $adapter -MethodName SetTcpipNetbios -Arguments @{TcpipNetbiosOptions = 2 } + if ($result.ReturnValue -eq 0) { + Write-Log -Level DEBUG -Message "Disabled NetBIOS on adapter: $($adapter.Description)" -Module "AdvancedSecurity" + $adaptedCount++ + } + } + catch { + Write-Log -Level WARNING -Message "Could not disable NetBIOS on adapter $($adapter.Description): $_" -Module "AdvancedSecurity" + } + } + + Write-Log -Level SUCCESS -Message "Disabled NetBIOS over TCP/IP on $adaptedCount adapters" -Module "AdvancedSecurity" + } + catch { + $errors += "NetBIOS TCP/IP: $_" + Write-Log -Level WARNING -Message "Failed to disable NetBIOS over TCP/IP: $_" -Module "AdvancedSecurity" + } + + # 3. UPnP/SSDP (Port 1900, 2869) - MEDIUM RISK (conditional) + if (-not $SkipUPnP) { + Write-Log -Level INFO -Message "Disabling UPnP/SSDP firewall rules (Port 1900, 2869)..." -Module "AdvancedSecurity" + + try { + # Filter from pre-loaded cache (ONLY ALLOW rules - keep NoID block rules enabled) + $upnpRules = $rulesWithPorts | Where-Object { + ($_.LocalPort -in @(1900, 2869)) -or ($_.RemotePort -in @(1900, 2869)) + } | Where-Object { $_.Rule.Action -eq 'Allow' } | Select-Object -ExpandProperty Rule + + foreach ($rule in $upnpRules) { + Disable-NetFirewallRule -Name $rule.Name -ErrorAction Stop + Write-Log -Level DEBUG -Message "Disabled UPnP/SSDP rule: $($rule.DisplayName)" -Module "AdvancedSecurity" + $disabledRules++ + } + + if ($upnpRules.Count -eq 0) { + Write-Log -Level INFO -Message "No active UPnP/SSDP rules found (already disabled or not present)" -Module "AdvancedSecurity" + } + else { + Write-Log -Level SUCCESS -Message "Disabled $($upnpRules.Count) UPnP/SSDP firewall rules" -Module "AdvancedSecurity" + } + } + catch { + $errors += "UPnP/SSDP: $_" + Write-Log -Level WARNING -Message "Failed to disable some UPnP/SSDP rules: $_" -Module "AdvancedSecurity" + } + + # Ensure a dedicated inbound block rule exists for SSDP (UDP 1900) + try { + $ssdpRuleName = "NoID Privacy - Block SSDP (UDP 1900)" + $existingSsdpRule = Get-NetFirewallRule -DisplayName $ssdpRuleName -ErrorAction SilentlyContinue + + if (-not $existingSsdpRule) { + New-NetFirewallRule -DisplayName $ssdpRuleName ` + -Direction Inbound ` + -Action Block ` + -Enabled True ` + -Protocol UDP ` + -LocalPort 1900 ` + -Profile Any ` + -ErrorAction Stop | Out-Null + Write-Log -Level SUCCESS -Message "Created SSDP block rule: $ssdpRuleName" -Module "AdvancedSecurity" + } + else { + Write-Log -Level INFO -Message "SSDP block rule already exists: $ssdpRuleName" -Module "AdvancedSecurity" + } + } + catch { + $errors += "SSDP BlockRule: $_" + Write-Log -Level WARNING -Message "Failed to ensure SSDP block rule: $_" -Module "AdvancedSecurity" + } + } + else { + Write-Log -Level INFO -Message "UPnP/SSDP blocking skipped (user choice for DLNA compatibility)" -Module "AdvancedSecurity" + } + + # Summary + if ($errors.Count -eq 0) { + if ($disabledRules -gt 0) { + Write-Log -Level SUCCESS -Message "Disabled $disabledRules risky firewall rules" -Module "AdvancedSecurity" + } + else { + Write-Log -Level SUCCESS -Message "No risky firewall rules required changes (system already protected at firewall level)" -Module "AdvancedSecurity" + } + Write-Host "" + Write-Host "Risky Firewall Ports Disabled: $disabledRules rules" -ForegroundColor Green + if ($disabledRules -eq 0) { + Write-Host " System already protected - no risky ALLOW rules were found for these ports:" -ForegroundColor Gray + } + Write-Host " - LLMNR (5355)" -ForegroundColor Gray + Write-Host " - NetBIOS (137-139)" -ForegroundColor Gray + if (-not $SkipUPnP) { + Write-Host " - UPnP/SSDP (1900, 2869)" -ForegroundColor Gray + } + else { + Write-Host " - UPnP/SSDP (1900, 2869) - SKIPPED" -ForegroundColor Yellow + } + Write-Host "" + return $true + } + else { + Write-Log -Level WARNING -Message "Completed with $($errors.Count) errors. Disabled $disabledRules rules." -Module "AdvancedSecurity" + return $true # Partial success is still success + } + } + catch { + Write-Log -Level ERROR -Message "Failed to disable risky ports: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Disable-WPAD.ps1 b/Modules/AdvancedSecurity/Private/Disable-WPAD.ps1 new file mode 100644 index 0000000..9f19ab6 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Disable-WPAD.ps1 @@ -0,0 +1,147 @@ +function Disable-WPAD { + <# + .SYNOPSIS + Disable WPAD (Web Proxy Auto-Discovery) to prevent proxy hijacking + + .DESCRIPTION + Disables WPAD auto-discovery to prevent MITM attacks and proxy hijacking. + Uses the official Microsoft-recommended registry key (DisableWpad) plus + browser-level AutoDetect settings for third-party app compatibility. + + Reference: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/disable-http-proxy-auth-features + + Attack Prevention: MITM attacks, proxy hijacking, credential theft + + .EXAMPLE + Disable-WPAD + #> + [CmdletBinding()] + param() + + try { + Write-Log -Level INFO -Message "Disabling WPAD (Web Proxy Auto-Discovery)..." -Module "AdvancedSecurity" + + # HKLM keys (machine-wide) + # Key 1: Official Microsoft-recommended key (Windows 10 1809+ / Server 2019+) + # Key 2: Legacy WpadOverride (for older compatibility) + # Key 3: AutoDetect for HKLM (browser-level setting) + $hklmKeys = @( + @{ + Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp" + Name = "DisableWpad" + Value = 1 + Description = "Official MS key - disables WPAD for all WinHTTP API calls" + }, + @{ + Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" + Name = "WpadOverride" + Value = 1 + Description = "Legacy override key" + }, + @{ + Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" + Name = "AutoDetect" + Value = 0 + Description = "Browser-level auto-detect (HKLM)" + } + ) + + # Backup HKLM keys + $backupData = @{} + foreach ($key in $hklmKeys) { + if (Test-Path $key.Path) { + $currentValue = (Get-ItemProperty -Path $key.Path -Name $key.Name -ErrorAction SilentlyContinue).($key.Name) + $backupData["$($key.Path)\$($key.Name)"] = $currentValue + } + } + + # Apply HKLM keys + $setCount = 0 + foreach ($key in $hklmKeys) { + if (-not (Test-Path $key.Path)) { + New-Item -Path $key.Path -Force | Out-Null + } + + $existing = Get-ItemProperty -Path $key.Path -Name $key.Name -ErrorAction SilentlyContinue + if ($null -ne $existing -and $null -ne $existing.($key.Name)) { + Set-ItemProperty -Path $key.Path -Name $key.Name -Value $key.Value -Force | Out-Null + } else { + New-ItemProperty -Path $key.Path -Name $key.Name -Value $key.Value -PropertyType DWord -Force | Out-Null + } + $setCount++ + } + + # HKCU key - must be set for ALL user profiles, not just current elevated admin + # When running as admin, HKCU points to admin's profile, not the logged-in user + # Solution: Iterate through all user profiles via HKU (HKEY_USERS) + $hkuPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" + $hkuName = "AutoDetect" + $hkuValue = 0 + + # Mount HKU if not already available + if (-not (Test-Path "HKU:")) { + New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS -ErrorAction SilentlyContinue | Out-Null + } + + # Get all user SIDs (excluding system accounts) + $userSIDs = Get-ChildItem -Path "HKU:\" -ErrorAction SilentlyContinue | + Where-Object { $_.PSChildName -match '^S-1-5-21-' -and $_.PSChildName -notmatch '_Classes$' } | + Select-Object -ExpandProperty PSChildName + + foreach ($sid in $userSIDs) { + $userKeyPath = "HKU:\$sid\$hkuPath" + try { + # Backup + if (Test-Path $userKeyPath) { + $currentValue = (Get-ItemProperty -Path $userKeyPath -Name $hkuName -ErrorAction SilentlyContinue).($hkuName) + $backupData["HKU\$sid\$hkuPath\$hkuName"] = $currentValue + } + + # Create path if not exists + if (-not (Test-Path $userKeyPath)) { + New-Item -Path $userKeyPath -Force | Out-Null + } + + # Always use Set-ItemProperty with -Type to ensure correct value type + # Remove existing value first to avoid type conflicts + Remove-ItemProperty -Path $userKeyPath -Name $hkuName -ErrorAction SilentlyContinue + New-ItemProperty -Path $userKeyPath -Name $hkuName -Value $hkuValue -PropertyType DWord -Force | Out-Null + + # Verify the value was set correctly + $verifyVal = (Get-ItemProperty -Path $userKeyPath -Name $hkuName -ErrorAction SilentlyContinue).($hkuName) + if ($verifyVal -eq $hkuValue) { + $setCount++ + Write-Log -Level DEBUG -Message "WPAD AutoDetect set for SID $sid (verified: $verifyVal)" -Module "AdvancedSecurity" + } + else { + Write-Log -Level WARNING -Message "WPAD AutoDetect verification failed for SID $sid (expected $hkuValue, got $verifyVal)" -Module "AdvancedSecurity" + } + } + catch { + Write-Log -Level DEBUG -Message "Could not set WPAD for SID $sid : $_" -Module "AdvancedSecurity" + } + } + + # Also set for .DEFAULT (applies to new users) + $defaultPath = "HKU:\.DEFAULT\$hkuPath" + try { + if (-not (Test-Path $defaultPath)) { + New-Item -Path $defaultPath -Force -ErrorAction SilentlyContinue | Out-Null + } + New-ItemProperty -Path $defaultPath -Name $hkuName -Value $hkuValue -PropertyType DWord -Force -ErrorAction SilentlyContinue | Out-Null + $setCount++ + } + catch { + Write-Log -Level DEBUG -Message "Could not set WPAD for .DEFAULT: $_" -Module "AdvancedSecurity" + } + + Register-Backup -Type "WPAD_Settings" -Data ($backupData | ConvertTo-Json) -Name "WPAD" + + Write-Log -Level SUCCESS -Message "WPAD disabled ($setCount registry keys set across all user profiles)" -Module "AdvancedSecurity" + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to disable WPAD: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Enable-RdpNLA.ps1 b/Modules/AdvancedSecurity/Private/Enable-RdpNLA.ps1 new file mode 100644 index 0000000..67e31df --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Enable-RdpNLA.ps1 @@ -0,0 +1,172 @@ +function Enable-RdpNLA { + <# + .SYNOPSIS + Enforce Network Level Authentication (NLA) for Remote Desktop Protocol + + .DESCRIPTION + HYBRID ENFORCEMENT APPROACH (Best of Security + Usability): + + LEVEL 1 - ENFORCED VIA POLICIES (admin cannot disable): + - NLA (Network Level Authentication) = REQUIRED + - SSL/TLS encryption = REQUIRED + Path: HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + + LEVEL 2 - USER CONTROL VIA SYSTEM (admin can change in Settings): + - RDP Enable/Disable = User choice + Path: HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server + + Attack Prevention: + - Prevents brute-force attacks before login screen appears + - Forces SSL/TLS encryption for RDP traffic (cannot be disabled) + - Requires authentication at network level (cannot be disabled) + + .PARAMETER DisableRDP + Optionally completely disable RDP (for air-gapped systems) + + .PARAMETER Force + Force RDP disable even on domain-joined systems (NOT RECOMMENDED) + + .EXAMPLE + Enable-RdpNLA + Enforces NLA and SSL/TLS for RDP + + .EXAMPLE + Enable-RdpNLA -DisableRDP -Force + Completely disables RDP (air-gapped mode) + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DisableRDP, + + [Parameter(Mandatory = $false)] + [switch]$Force + ) + + try { + Write-Log -Level INFO -Message "Configuring RDP hardening (Hybrid Enforcement)..." -Module "AdvancedSecurity" + + # POLICIES PATH (enforced - admin cannot change via GUI) + $policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" + + # SYSTEM PATH (user control - admin can change via Settings) + $systemPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" + + # Backup current settings from BOTH paths + $backupData = @{ + Policy_UserAuthentication = $null + Policy_SecurityLayer = $null + System_fDenyTSConnections = $null + } + + # Backup Policies path (if exists) + if (Test-Path $policyPath) { + $backupData.Policy_UserAuthentication = (Get-ItemProperty -Path $policyPath -Name "UserAuthentication" -ErrorAction SilentlyContinue).UserAuthentication + $backupData.Policy_SecurityLayer = (Get-ItemProperty -Path $policyPath -Name "SecurityLayer" -ErrorAction SilentlyContinue).SecurityLayer + } + + # Backup System path (if exists) + if (Test-Path $systemPath) { + $backupData.System_fDenyTSConnections = (Get-ItemProperty -Path $systemPath -Name "fDenyTSConnections" -ErrorAction SilentlyContinue).fDenyTSConnections + } + + # Register backup + $backupJson = $backupData | ConvertTo-Json -Depth 10 + Register-Backup -Type "RDP_Settings" -Data $backupJson -Name "RDP_Hardening" + + # ======================================== + # LEVEL 1: ENFORCE NLA + SSL/TLS (Policies) + # ======================================== + Write-Log -Level INFO -Message "LEVEL 1: Enforcing NLA + SSL/TLS via Policies (admin cannot disable)..." -Module "AdvancedSecurity" + + # Create Policies path if not exists + if (-not (Test-Path $policyPath)) { + New-Item -Path $policyPath -Force | Out-Null + Write-Log -Level DEBUG -Message "Created Policies registry path" -Module "AdvancedSecurity" + } + + # ENFORCE NLA (cannot be disabled by admin via GUI) + $existing = Get-ItemProperty -Path $policyPath -Name "UserAuthentication" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $policyPath -Name "UserAuthentication" -Value 1 -Force | Out-Null + } else { + New-ItemProperty -Path $policyPath -Name "UserAuthentication" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level SUCCESS -Message "NLA ENFORCED via Policies (UserAuthentication = 1)" -Module "AdvancedSecurity" + + # ENFORCE SSL/TLS (cannot be disabled by admin via GUI) + $existing = Get-ItemProperty -Path $policyPath -Name "SecurityLayer" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $policyPath -Name "SecurityLayer" -Value 2 -Force | Out-Null + } else { + New-ItemProperty -Path $policyPath -Name "SecurityLayer" -Value 2 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level SUCCESS -Message "SSL/TLS ENFORCED via Policies (SecurityLayer = 2)" -Module "AdvancedSecurity" + + # ======================================== + # LEVEL 2: RDP ENABLE/DISABLE (System - User Control) + # ======================================== + Write-Log -Level INFO -Message "LEVEL 2: Setting RDP enable/disable (user CAN change in Settings)..." -Module "AdvancedSecurity" + + # Create System path if not exists + if (-not (Test-Path $systemPath)) { + New-Item -Path $systemPath -Force | Out-Null + } + + if ($DisableRDP) { + # Check if domain-joined + $computerSystem = Get-CimInstance -ClassName Win32_ComputerSystem + + if ($computerSystem.PartOfDomain -and -not $Force) { + Write-Log -Level WARNING -Message "Domain-joined system detected. RDP disable skipped." -Module "AdvancedSecurity" + Write-Log -Level WARNING -Message "Use -Force to override (NOT RECOMMENDED for enterprise!)" -Module "AdvancedSecurity" + Write-Host "" + Write-Host "WARNING: Domain-joined system detected!" -ForegroundColor Yellow + Write-Host "Skipping RDP complete disable (may be required for management)." -ForegroundColor Yellow + Write-Host "Use -DisableRDP -Force to override (NOT RECOMMENDED)." -ForegroundColor Yellow + Write-Host "" + } + else { + # Set RDP DISABLED as default (user CAN re-enable) + $existing = Get-ItemProperty -Path $systemPath -Name "fDenyTSConnections" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $systemPath -Name "fDenyTSConnections" -Value 1 -Force | Out-Null + } else { + New-ItemProperty -Path $systemPath -Name "fDenyTSConnections" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level SUCCESS -Message "RDP DISABLED by default (user CAN re-enable via Settings)" -Module "AdvancedSecurity" + Write-Log -Level INFO -Message "Windows will automatically adjust RDP firewall rules" -Module "AdvancedSecurity" + + Write-Host "" + Write-Host "RDP Status: DISABLED by default" -ForegroundColor Yellow + Write-Host " You CAN re-enable RDP anytime via:" -ForegroundColor White + Write-Host " -> Settings > System > Remote Desktop > Enable Remote Desktop" -ForegroundColor Gray + Write-Host " [OK] NLA + SSL/TLS will remain ENFORCED (secure!)" -ForegroundColor Green + Write-Host "" + } + } + else { + # Set RDP ENABLED (with NLA+SSL enforced) + $existing = Get-ItemProperty -Path $systemPath -Name "fDenyTSConnections" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $systemPath -Name "fDenyTSConnections" -Value 0 -Force | Out-Null + } else { + New-ItemProperty -Path $systemPath -Name "fDenyTSConnections" -Value 0 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level SUCCESS -Message "RDP ENABLED with enforced NLA+SSL (user CAN disable via Settings)" -Module "AdvancedSecurity" + + Write-Host "" + Write-Host "RDP Status: ENABLED with enforced security" -ForegroundColor Green + Write-Host " [ENFORCED] NLA (Network Level Authentication)" -ForegroundColor Green + Write-Host " [ENFORCED] SSL/TLS encryption" -ForegroundColor Green + Write-Host " You CAN disable RDP anytime via Settings if not needed" -ForegroundColor White + Write-Host "" + } + + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to configure RDP hardening: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Remove-PowerShellV2.ps1 b/Modules/AdvancedSecurity/Private/Remove-PowerShellV2.ps1 new file mode 100644 index 0000000..1579d9c --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Remove-PowerShellV2.ps1 @@ -0,0 +1,98 @@ +function Remove-PowerShellV2 { + <# + .SYNOPSIS + Remove PowerShell v2 to prevent downgrade attacks + + .DESCRIPTION + Removes the PowerShell v2 Windows Feature to prevent downgrade attacks. + PowerShell v2 bypasses logging, AMSI, and Constrained Language Mode. + + Attack Prevention: Downgrade attacks, script logging bypass, AMSI bypass + + Impact: Legacy scripts using -Version 2 will not work + + .EXAMPLE + Remove-PowerShellV2 + #> + [CmdletBinding()] + param() + + try { + Write-Log -Level INFO -Message "Checking PowerShell v2 optional feature state..." -Module "AdvancedSecurity" + + # Canonical detection: use Windows Optional Feature state + $psv2Feature = $null + try { + $psv2Feature = Get-WindowsOptionalFeature -Online -FeatureName "MicrosoftWindowsPowerShellV2Root" -ErrorAction SilentlyContinue + } + catch { + $psv2Feature = $null + } + + if (-not $psv2Feature) { + # Feature is not available on this OS (e.g. removed in newer Windows 11 builds) + Write-Log -Level INFO -Message "PowerShell v2 optional feature not available on this OS (nothing to remove)" -Module "AdvancedSecurity" + return [PSCustomObject]@{ + Success = $true + Changed = $false + } + } + + if ($psv2Feature.State -ne 'Enabled') { + # Feature exists but is not enabled/installed + Write-Log -Level SUCCESS -Message "PowerShell v2 feature state: $($psv2Feature.State) - no removal required" -Module "AdvancedSecurity" + return [PSCustomObject]@{ + Success = $true + Changed = $false + } + } + + # PSv2 feature is enabled - proceed with backup and removal + Write-Log -Level DEBUG -Message "PowerShell v2 feature is ENABLED - preparing backup and removal via DISM..." -Module "AdvancedSecurity" + + # Backup current state + $backupData = @{ + FeatureName = $psv2Feature.FeatureName + State = $psv2Feature.State + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + } + Register-Backup -Type "WindowsFeature" -Data ($backupData | ConvertTo-Json) -Name "PowerShellV2" + + # Remove PowerShell v2 + Write-Log -Level WARNING -Message "Removing PowerShell v2 (this may take a moment)..." -Module "AdvancedSecurity" + Write-Host "" + Write-Host "Removing PowerShell v2..." -ForegroundColor Yellow + Write-Host "This may take up to 60 seconds..." -ForegroundColor Gray + Write-Host "" + + $result = Disable-WindowsOptionalFeature -Online -FeatureName "MicrosoftWindowsPowerShellV2Root" -NoRestart -ErrorAction Stop + + if ($result.RestartNeeded) { + Write-Log -Level WARNING -Message "PowerShell v2 removed - REBOOT REQUIRED to complete" -Module "AdvancedSecurity" + Write-Host "" + Write-Host "PowerShell v2 Removed!" -ForegroundColor Green + Write-Host "" + Write-Host "IMPORTANT: REBOOT REQUIRED" -ForegroundColor Yellow + Write-Host "Changes will take effect after reboot." -ForegroundColor Gray + Write-Host "" + } + else { + Write-Log -Level SUCCESS -Message "PowerShell v2 removed successfully" -Module "AdvancedSecurity" + Write-Host "" + Write-Host "PowerShell v2 Removed!" -ForegroundColor Green + Write-Host "" + } + + return [PSCustomObject]@{ + Success = $true + Changed = $true + } + } + catch { + Write-Log -Level ERROR -Message "Failed to remove PowerShell v2: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return [PSCustomObject]@{ + Success = $false + Changed = $false + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Set-DiscoveryProtocolsSecurity.ps1 b/Modules/AdvancedSecurity/Private/Set-DiscoveryProtocolsSecurity.ps1 new file mode 100644 index 0000000..8474f6c --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Set-DiscoveryProtocolsSecurity.ps1 @@ -0,0 +1,150 @@ +function Set-DiscoveryProtocolsSecurity { + <# + .SYNOPSIS + Completely hardens discovery protocols (WS-Discovery + mDNS) for air-gapped systems. + + .DESCRIPTION + This function is designed for the AdvancedSecurity **Maximum** profile. + + It applies the following changes: + - Disables OS-level mDNS client resolution + - Stops and disables WS-Discovery related services + - Adds explicit Windows Firewall BLOCK rules for WS-Discovery and mDNS ports + + Protocols/ports affected: + - WS-Discovery: UDP 3702, TCP 5357/5358 + - mDNS: UDP 5353 + + NOTE: Backup for services, registry and firewall rules is handled centrally by + Backup-AdvancedSecuritySettings and the Core rollback system. + + .PARAMETER DisableCompletely + When present, applies full discovery protocol hardening. Currently this + function is only called with -DisableCompletely in Maximum profile. + + .EXAMPLE + Set-DiscoveryProtocolsSecurity -DisableCompletely + # Completely disables WS-Discovery and mDNS on this host. + #> + [CmdletBinding()] + param( + [switch]$DisableCompletely + ) + + try { + Write-Log -Level INFO -Message "Applying discovery protocol security (WS-Discovery + mDNS)... DisableCompletely: $DisableCompletely" -Module "AdvancedSecurity" + + if (-not $DisableCompletely) { + Write-Log -Level INFO -Message "Set-DiscoveryProtocolsSecurity called without -DisableCompletely. No changes applied." -Module "AdvancedSecurity" + return $true + } + + $changesApplied = 0 + + # ============================= + # 1) Disable mDNS via DNS Client parameters + # ============================= + $dnsParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" + + if (-not (Test-Path $dnsParamsPath)) { + New-Item -Path $dnsParamsPath -Force | Out-Null + Write-Log -Level INFO -Message "Created registry key: $dnsParamsPath" -Module "AdvancedSecurity" + } + + $mdnsProps = Get-ItemProperty -Path $dnsParamsPath -ErrorAction SilentlyContinue + $currentEnableMdns = if ($mdnsProps) { $mdnsProps.EnableMDNS } else { $null } + + if ($currentEnableMdns -ne 0) { + New-ItemProperty -Path $dnsParamsPath -Name "EnableMDNS" -Value 0 -PropertyType DWord -Force | Out-Null + Write-Log -Level INFO -Message "Set EnableMDNS = 0 (Disable OS mDNS resolver)" -Module "AdvancedSecurity" + $changesApplied++ + } + + # ============================= + # 2) Stop and disable WS-Discovery related services + # ============================= + $wsdServices = @( + @{ Name = "FDResPub"; DisplayName = "Function Discovery Resource Publication" }, + @{ Name = "fdPHost"; DisplayName = "Function Discovery Provider Host" } + ) + + foreach ($svc in $wsdServices) { + $service = Get-Service -Name $svc.Name -ErrorAction SilentlyContinue + if (-not $service) { + Write-Log -Level INFO -Message "Service $($svc.Name) not found (may not be installed)" -Module "AdvancedSecurity" + continue + } + + if ($service.Status -eq 'Running') { + try { + Stop-Service -Name $svc.Name -Force -ErrorAction Stop + Write-Log -Level INFO -Message "Stopped service: $($svc.Name) ($($svc.DisplayName))" -Module "AdvancedSecurity" + $changesApplied++ + } + catch { + Write-Log -Level WARNING -Message "Failed to stop service $($svc.Name): $_" -Module "AdvancedSecurity" + } + } + + if ($service.StartType -ne 'Disabled') { + try { + Set-Service -Name $svc.Name -StartupType Disabled -ErrorAction Stop + Write-Log -Level INFO -Message "Set service $($svc.Name) StartupType = Disabled" -Module "AdvancedSecurity" + $changesApplied++ + } + catch { + Write-Log -Level WARNING -Message "Failed to set StartupType=Disabled for $($svc.Name): $_" -Module "AdvancedSecurity" + } + } + } + + # ============================= + # 3) Add firewall BLOCK rules for WS-Discovery and mDNS + # ============================= + $firewallRules = @( + @{ Name = "NoID-Block-WSD-UDP-3702"; DisplayName = "NoID Privacy - Block WS-Discovery UDP 3702"; Protocol = "UDP"; LocalPort = 3702 }, + @{ Name = "NoID-Block-WSD-TCP-5357"; DisplayName = "NoID Privacy - Block WS-Discovery HTTP TCP 5357"; Protocol = "TCP"; LocalPort = 5357 }, + @{ Name = "NoID-Block-WSD-TCP-5358"; DisplayName = "NoID Privacy - Block WS-Discovery HTTPS TCP 5358"; Protocol = "TCP"; LocalPort = 5358 }, + @{ Name = "NoID-Block-mDNS-UDP-5353"; DisplayName = "NoID Privacy - Block mDNS UDP 5353"; Protocol = "UDP"; LocalPort = 5353 } + ) + + foreach ($rule in $firewallRules) { + try { + $existing = Get-NetFirewallRule -Name $rule.Name -ErrorAction SilentlyContinue + if (-not $existing) { + New-NetFirewallRule -Name $rule.Name ` + -DisplayName $rule.DisplayName ` + -Direction Inbound ` + -Protocol $rule.Protocol ` + -LocalPort $rule.LocalPort ` + -Action Block ` + -Profile Any ` + -Enabled True | Out-Null + Write-Log -Level INFO -Message "Created firewall rule: $($rule.DisplayName)" -Module "AdvancedSecurity" + $changesApplied++ + } + else { + # Ensure rule is enabled and blocking + Set-NetFirewallRule -Name $rule.Name -Enabled True -Action Block -ErrorAction SilentlyContinue + Write-Log -Level DEBUG -Message "Firewall rule already exists and was enforced: $($rule.DisplayName)" -Module "AdvancedSecurity" + } + } + catch { + Write-Log -Level WARNING -Message "Failed to ensure firewall rule $($rule.DisplayName): $_" -Module "AdvancedSecurity" + } + } + + if ($changesApplied -eq 0) { + Write-Log -Level SUCCESS -Message "Discovery protocol security already configured (no changes needed)" -Module "AdvancedSecurity" + } + else { + Write-Log -Level SUCCESS -Message "Discovery protocol security applied ($changesApplied changes)" -Module "AdvancedSecurity" + } + + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to apply discovery protocol security (WS-Discovery/mDNS): $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Set-FirewallShieldsUp.ps1 b/Modules/AdvancedSecurity/Private/Set-FirewallShieldsUp.ps1 new file mode 100644 index 0000000..24275ec --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Set-FirewallShieldsUp.ps1 @@ -0,0 +1,66 @@ +function Set-FirewallShieldsUp { + <# + .SYNOPSIS + Enable "Shields Up" mode - Block ALL incoming connections on Public network + + .DESCRIPTION + Sets DoNotAllowExceptions=1 for PublicProfile firewall. + This blocks ALL incoming connections, even from allowed apps. + Goes BEYOND Microsoft Security Baseline. + + .PARAMETER Enable + Enable Shields Up mode (block all incoming on Public) + + .PARAMETER Disable + Disable Shields Up mode (allow configured exceptions) + #> + [CmdletBinding()] + param( + [switch]$Enable, + [switch]$Disable + ) + + $moduleName = "AdvancedSecurity" + $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" + $valueName = "DoNotAllowExceptions" + + try { + if ($Enable) { + Write-Log -Level INFO -Message "Enabling Firewall Shields Up mode (Public profile)..." -Module $moduleName + + # Ensure path exists + if (!(Test-Path $regPath)) { + New-Item -Path $regPath -Force | Out-Null + } + + # Set DoNotAllowExceptions = 1 + Set-ItemProperty -Path $regPath -Name $valueName -Value 1 -Type DWord -Force + + Write-Log -Level SUCCESS -Message "Firewall Shields Up ENABLED - All incoming connections blocked on Public network" -Module $moduleName + Write-Host "" + Write-Host " SHIELDS UP: Public network now blocks ALL incoming connections" -ForegroundColor Green + Write-Host " This includes allowed apps (Teams, Discord, etc. cannot receive calls)" -ForegroundColor Yellow + Write-Host "" + + return $true + } + elseif ($Disable) { + Write-Log -Level INFO -Message "Disabling Firewall Shields Up mode..." -Module $moduleName + + if (Test-Path $regPath) { + Set-ItemProperty -Path $regPath -Name $valueName -Value 0 -Type DWord -Force + } + + Write-Log -Level SUCCESS -Message "Firewall Shields Up disabled - Normal firewall exceptions apply" -Module $moduleName + return $true + } + else { + Write-Log -Level WARNING -Message "No action specified for Set-FirewallShieldsUp" -Module $moduleName + return $false + } + } + catch { + Write-Log -Level ERROR -Message "Failed to set Firewall Shields Up: $_" -Module $moduleName + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Set-IPv6Security.ps1 b/Modules/AdvancedSecurity/Private/Set-IPv6Security.ps1 new file mode 100644 index 0000000..5152d16 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Set-IPv6Security.ps1 @@ -0,0 +1,102 @@ +function Set-IPv6Security { + <# + .SYNOPSIS + Disable IPv6 to prevent DHCPv6/Router Solicitation attacks (mitm6) + + .DESCRIPTION + Disables IPv6 via registry to prevent: + - mitm6 attacks (DHCPv6 spoofing โ†’ DNS takeover โ†’ NTLM relay) + - IPv6 Router Advertisement spoofing + - DHCPv6 poisoning attacks + + This is the recommended mitigation per Fox-IT security research. + + WARNING: May break Exchange Server and some Active Directory features. + Only recommended for air-gapped or high-security systems. + + .PARAMETER DisableCompletely + If true, completely disables IPv6 (DisabledComponents = 0xFF) + + .EXAMPLE + Set-IPv6Security -DisableCompletely + + .NOTES + Registry: HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents + Value 0xFF = Disable all IPv6 components + + REBOOT REQUIRED for changes to take effect. + + References: + - https://blog.fox-it.com/2018/01/11/mitm6-compromising-ipv4-networks-via-ipv6/ + - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows + #> + [CmdletBinding()] + param( + [switch]$DisableCompletely + ) + + try { + if (-not $DisableCompletely) { + Write-Log -Level INFO -Message "IPv6 disable not requested - keeping default configuration" -Module "AdvancedSecurity" + return $true + } + + Write-Log -Level INFO -Message "Disabling IPv6 (mitm6 attack mitigation)..." -Module "AdvancedSecurity" + + $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" + + # Backup current value + $currentValue = Get-ItemProperty -Path $regPath -Name "DisabledComponents" -ErrorAction SilentlyContinue + $backupData = @{ + Path = $regPath + Name = "DisabledComponents" + PreviousValue = if ($currentValue) { $currentValue.DisabledComponents } else { "_NOT_SET" } + NewValue = 255 + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + } + $backupJson = $backupData | ConvertTo-Json -Depth 10 + Register-Backup -Type "Registry" -Data $backupJson -Name "IPv6_DisabledComponents" + + # Ensure registry path exists + if (-not (Test-Path $regPath)) { + New-Item -Path $regPath -Force | Out-Null + } + + # Set DisabledComponents to 0xFF (255) = Disable all IPv6 components + Set-ItemProperty -Path $regPath -Name "DisabledComponents" -Value 255 -Type DWord -Force + + Write-Log -Level SUCCESS -Message "IPv6 disabled (DisabledComponents = 0xFF)" -Module "AdvancedSecurity" + + # Verify + $verifyValue = (Get-ItemProperty -Path $regPath -Name "DisabledComponents" -ErrorAction SilentlyContinue).DisabledComponents + if ($verifyValue -eq 255) { + Write-Log -Level SUCCESS -Message "IPv6 disable verified - REBOOT REQUIRED" -Module "AdvancedSecurity" + + Write-Host "" + Write-Host "================================================" -ForegroundColor Yellow + Write-Host " IPv6 DISABLED (mitm6 Attack Mitigation)" -ForegroundColor Yellow + Write-Host "================================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "Registry: DisabledComponents = 0xFF (255)" -ForegroundColor White + Write-Host "" + Write-Host "Protection against:" -ForegroundColor Cyan + Write-Host " - DHCPv6 spoofing (mitm6 tool)" -ForegroundColor Gray + Write-Host " - IPv6 Router Advertisement attacks" -ForegroundColor Gray + Write-Host " - DNS takeover via fake DHCPv6 server" -ForegroundColor Gray + Write-Host " - NTLM credential relay attacks" -ForegroundColor Gray + Write-Host "" + Write-Host "REBOOT REQUIRED for changes to take effect!" -ForegroundColor Red + Write-Host "" + + return $true + } + else { + Write-Log -Level ERROR -Message "IPv6 disable verification failed" -Module "AdvancedSecurity" + return $false + } + } + catch { + Write-Log -Level ERROR -Message "Failed to disable IPv6: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Set-SRPRules.ps1 b/Modules/AdvancedSecurity/Private/Set-SRPRules.ps1 new file mode 100644 index 0000000..fe59a95 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Set-SRPRules.ps1 @@ -0,0 +1,192 @@ +function Set-SRPRules { + <# + .SYNOPSIS + Configures Software Restriction Policies (SRP) to block .lnk execution from Temp/Downloads + + .DESCRIPTION + Implements SRP rules to mitigate CVE-2025-9491 (Windows LNK Remote Code Execution). + + CRITICAL ZERO-DAY MITIGATION: + - CVE-2025-9491: Actively exploited since 2017 + - No patch available (Microsoft: "does not meet servicing threshold") + - ASR and SmartScreen do NOT protect against this + + SRP Rules Created: + 1. Block *.lnk from %LOCALAPPDATA%\Temp\* (Outlook attachments) + 2. Block *.lnk from %USERPROFILE%\Downloads\* (Browser downloads) + + Windows 11 Bug Fix: + - Removes buggy registry keys that disable SRP on Win11 + + .PARAMETER DryRun + Preview changes without applying them + + .EXAMPLE + Set-SRPRules + Applies SRP rules to block malicious .lnk execution + + .NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: Administrator privileges + + REFERENCES: + - CVE-2025-9491: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-9491 + - CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog + - SRP Documentation: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/software-restriction-policies + #> + + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + try { + $configPath = Join-Path $PSScriptRoot "..\Config\SRP-Rules.json" + + if (-not (Test-Path $configPath)) { + Write-Log -Level ERROR -Message "SRP-Rules.json not found: $configPath" -Module "AdvancedSecurity" + return $false + } + + $config = Get-Content $configPath -Raw | ConvertFrom-Json + + Write-Log -Level INFO -Message "Configuring Software Restriction Policies (SRP) for CVE-2025-9491..." -Module "AdvancedSecurity" + + if ($DryRun) { + Write-Log -Level INFO -Message "[DRYRUN] Would configure SRP with following rules:" -Module "AdvancedSecurity" + foreach ($rule in $config.PathRules) { + Write-Log -Level INFO -Message "[DRYRUN] - $($rule.Name): $($rule.Path)" -Module "AdvancedSecurity" + } + return $true + } + + # Step 1: Create SRP Policy Root + $policyRoot = $config.RegistryPaths.PolicyRoot + + if (-not (Test-Path $policyRoot)) { + Write-Log -Level INFO -Message "Creating SRP policy root: $policyRoot" -Module "AdvancedSecurity" + New-Item -Path $policyRoot -Force | Out-Null + } + + # Step 2: Set Default Level (Unrestricted) + Write-Log -Level INFO -Message "Setting SRP default level to Unrestricted (262144)" -Module "AdvancedSecurity" + + $existingDefaultLevel = Get-ItemProperty -Path $policyRoot -Name "DefaultLevel" -ErrorAction SilentlyContinue + if ($null -ne $existingDefaultLevel) { + Set-ItemProperty -Path $policyRoot -Name "DefaultLevel" -Value $config.SRPConfiguration.DefaultLevel -Force | Out-Null + } + else { + New-ItemProperty -Path $policyRoot -Name "DefaultLevel" -Value $config.SRPConfiguration.DefaultLevel -PropertyType DWord -Force | Out-Null + } + + # Step 3: Enable Transparent Enforcement + $existingTransparent = Get-ItemProperty -Path $policyRoot -Name "TransparentEnabled" -ErrorAction SilentlyContinue + if ($null -ne $existingTransparent) { + Set-ItemProperty -Path $policyRoot -Name "TransparentEnabled" -Value $config.SRPConfiguration.TransparentEnabled -Force | Out-Null + } + else { + New-ItemProperty -Path $policyRoot -Name "TransparentEnabled" -Value $config.SRPConfiguration.TransparentEnabled -PropertyType DWord -Force | Out-Null + } + + # Step 4: Create Path Rules + $pathRulesRoot = $config.RegistryPaths.PathRules + + if (-not (Test-Path $pathRulesRoot)) { + Write-Log -Level INFO -Message "Creating SRP path rules root: $pathRulesRoot" -Module "AdvancedSecurity" + New-Item -Path $pathRulesRoot -Force | Out-Null + } + + $rulesCreated = 0 + + foreach ($rule in $config.PathRules) { + if (-not $rule.Enabled) { + Write-Log -Level INFO -Message "Skipping disabled rule: $($rule.Name)" -Module "AdvancedSecurity" + continue + } + + # Generate GUID for rule + $ruleGuid = "{$([guid]::NewGuid().ToString())}" + $rulePath = Join-Path $pathRulesRoot $ruleGuid + + Write-Log -Level INFO -Message "Creating SRP rule: $($rule.Name)" -Module "AdvancedSecurity" + + # Create rule key + if (-not (Test-Path $rulePath)) { + New-Item -Path $rulePath -Force | Out-Null + } + + # Set ItemData (path pattern) + $existingItemData = Get-ItemProperty -Path $rulePath -Name "ItemData" -ErrorAction SilentlyContinue + if ($null -ne $existingItemData) { + Set-ItemProperty -Path $rulePath -Name "ItemData" -Value $rule.Path -Force | Out-Null + } + else { + New-ItemProperty -Path $rulePath -Name "ItemData" -Value $rule.Path -PropertyType ExpandString -Force | Out-Null + } + + # Set Description + $existingDescription = Get-ItemProperty -Path $rulePath -Name "Description" -ErrorAction SilentlyContinue + if ($null -ne $existingDescription) { + Set-ItemProperty -Path $rulePath -Name "Description" -Value $rule.Description -Force | Out-Null + } + else { + New-ItemProperty -Path $rulePath -Name "Description" -Value $rule.Description -PropertyType String -Force | Out-Null + } + + # Set SaferFlags + $existingSaferFlags = Get-ItemProperty -Path $rulePath -Name "SaferFlags" -ErrorAction SilentlyContinue + if ($null -ne $existingSaferFlags) { + Set-ItemProperty -Path $rulePath -Name "SaferFlags" -Value $rule.SaferFlags -Force | Out-Null + } + else { + New-ItemProperty -Path $rulePath -Name "SaferFlags" -Value $rule.SaferFlags -PropertyType DWord -Force | Out-Null + } + + $rulesCreated++ + Write-Log -Level SUCCESS -Message "SRP rule created: $($rule.Name) -> $($rule.Path)" -Module "AdvancedSecurity" + } + + # Step 5: Windows 11 Bug Fix + $bugFixPath = $config.RegistryPaths.Win11BugFix + + if (Test-Path $bugFixPath) { + Write-Log -Level INFO -Message "Applying Windows 11 SRP bug fix..." -Module "AdvancedSecurity" + + foreach ($keyName in $config.Windows11BugFix.KeysToRemove) { + $keyExists = Get-ItemProperty -Path $bugFixPath -Name $keyName -ErrorAction SilentlyContinue + + if ($null -ne $keyExists) { + Remove-ItemProperty -Path $bugFixPath -Name $keyName -Force -ErrorAction SilentlyContinue + Write-Log -Level SUCCESS -Message "Removed buggy key: $keyName (Windows 11 SRP fix)" -Module "AdvancedSecurity" + } + } + } + + Write-Log -Level SUCCESS -Message "SRP configuration completed: $rulesCreated rules created" -Module "AdvancedSecurity" + Write-Log -Level INFO -Message "CVE-2025-9491 mitigation active - .lnk files from Temp/Downloads now blocked" -Module "AdvancedSecurity" + + Write-Host "" + Write-Host "================================================" -ForegroundColor Green + Write-Host " SRP RULES CONFIGURED (CVE-2025-9491)" -ForegroundColor Green + Write-Host "================================================" -ForegroundColor Green + Write-Host "" + Write-Host "Zero-Day Protection: Windows LNK RCE (ACTIVELY EXPLOITED)" -ForegroundColor Yellow + Write-Host "" + Write-Host "Rules Created: $rulesCreated" -ForegroundColor Cyan + Write-Host "Protected Paths:" -ForegroundColor White + Write-Host " - Outlook Temp (%LOCALAPPDATA%\Temp\*.lnk)" -ForegroundColor Gray + Write-Host " - Downloads (%USERPROFILE%\Downloads\*.lnk)" -ForegroundColor Gray + Write-Host "" + Write-Host "Status: ACTIVE (malicious .lnk files blocked)" -ForegroundColor Green + Write-Host "CVE-2025-9491: MITIGATED" -ForegroundColor Green + Write-Host "" + + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to configure SRP rules: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Set-WDigestProtection.ps1 b/Modules/AdvancedSecurity/Private/Set-WDigestProtection.ps1 new file mode 100644 index 0000000..f87e787 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Set-WDigestProtection.ps1 @@ -0,0 +1,113 @@ +function Set-WDigestProtection { + <# + .SYNOPSIS + Disable WDigest credential caching to prevent plaintext password storage in LSASS + + .DESCRIPTION + Configures WDigest to NOT store plaintext credentials in LSASS memory. + Prevents Mimikatz, Windows Credential Editor (WCE), and other memory-dumping + tools from extracting plaintext passwords. + + Status: This setting is DEPRECATED in Windows 11 24H2+ (default is already secure), + but we set it explicitly for: + - Backwards compatibility with older Windows versions + - Defense-in-depth (explicit is better than implicit) + - Mixed environments with Win7/8/Server 2008/2012 + + No negative impact on modern systems (setting is ignored on Win11 24H2+). + + .EXAMPLE + Set-WDigestProtection + Sets UseLogonCredential = 0 to prevent plaintext credential storage + + .NOTES + Microsoft Security Advisory: KB2871997 (May 2014) + Deprecated in Windows 11 24H2 Security Baseline (September 2024) + + Default behavior: + - Windows 7/8/Server 2008/2012: UseLogonCredential = 1 (INSECURE!) + - Windows 8.1+: UseLogonCredential = 0 (Secure) + - Windows 11 24H2+: Setting ignored (hardcoded secure) + #> + [CmdletBinding()] + param() + + try { + Write-Log -Level INFO -Message "Configuring WDigest credential protection..." -Module "AdvancedSecurity" + + $wdigestRegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" + + # Check Windows version for informational logging + $osVersion = [System.Environment]::OSVersion.Version + $isWin11 = $osVersion.Major -ge 10 -and $osVersion.Build -ge 22000 + + if ($isWin11 -and $osVersion.Build -ge 26100) { + # Windows 11 24H2+ (Build 26100+) + Write-Log -Level INFO -Message "Windows 11 24H2+ detected - WDigest setting is deprecated but will be set for backwards compatibility" -Module "AdvancedSecurity" + } + + # Backup current setting + $currentValue = $null + if (Test-Path $wdigestRegPath) { + $currentValue = (Get-ItemProperty -Path $wdigestRegPath -Name "UseLogonCredential" -ErrorAction SilentlyContinue).UseLogonCredential + } + + $backupData = @{ + OriginalValue = $currentValue + RegistryPath = $wdigestRegPath + SettingName = "UseLogonCredential" + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + } + + # Register backup + $backupJson = $backupData | ConvertTo-Json -Depth 10 + Register-Backup -Type "WDigest_Settings" -Data $backupJson -Name "WDigest_Protection" + + # Create registry path if it doesn't exist + if (-not (Test-Path $wdigestRegPath)) { + Write-Log -Level INFO -Message "Creating WDigest registry path..." -Module "AdvancedSecurity" + New-Item -Path $wdigestRegPath -Force | Out-Null + } + + # Set UseLogonCredential = 0 (Secure - no plaintext in memory) + $existing = Get-ItemProperty -Path $wdigestRegPath -Name "UseLogonCredential" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $wdigestRegPath -Name "UseLogonCredential" -Value 0 -Force | Out-Null + } else { + New-ItemProperty -Path $wdigestRegPath -Name "UseLogonCredential" -Value 0 -PropertyType DWord -Force | Out-Null + } + + # Verify + $newValue = (Get-ItemProperty -Path $wdigestRegPath -Name "UseLogonCredential").UseLogonCredential + + if ($newValue -eq 0) { + if ($currentValue -eq 1) { + Write-Log -Level SUCCESS -Message "WDigest credential protection enabled (UseLogonCredential = 0)" -Module "AdvancedSecurity" + Write-Log -Level WARNING -Message "Previous value was 1 (INSECURE) - system was vulnerable to plaintext credential dumps!" -Module "AdvancedSecurity" + Write-Host "" + Write-Host "SECURITY IMPROVEMENT: WDigest was storing plaintext credentials!" -ForegroundColor Yellow + Write-Host "This has now been FIXED. Plaintext credential storage is disabled." -ForegroundColor Green + Write-Host "" + } + elseif ($null -eq $currentValue) { + Write-Log -Level SUCCESS -Message "WDigest credential protection configured (UseLogonCredential = 0)" -Module "AdvancedSecurity" + Write-Log -Level INFO -Message "WDigest setting was not previously configured (default varies by OS version)" -Module "AdvancedSecurity" + } + else { + # currentValue was already 0 + Write-Log -Level SUCCESS -Message "WDigest credential protection verified (UseLogonCredential = 0)" -Module "AdvancedSecurity" + Write-Log -Level INFO -Message "Setting was already correct (no change needed)" -Module "AdvancedSecurity" + } + + return $true + } + else { + Write-Log -Level ERROR -Message "Failed to verify WDigest setting (expected 0, got $newValue)" -Module "AdvancedSecurity" + return $false + } + } + catch { + Write-Log -Level ERROR -Message "Failed to configure WDigest protection: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Set-WindowsUpdate.ps1 b/Modules/AdvancedSecurity/Private/Set-WindowsUpdate.ps1 new file mode 100644 index 0000000..ca1c405 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Set-WindowsUpdate.ps1 @@ -0,0 +1,110 @@ +function Set-WindowsUpdate { + <# + .SYNOPSIS + Configures Windows Update using simple GUI-equivalent settings + + .DESCRIPTION + Applies 3 simple Windows Update settings that align with the Windows Settings GUI: + 1. Get the latest updates as soon as they're available (ON, enforced via policy) + 2. Receive updates for other Microsoft products (ON, user-toggleable) + 3. Delivery Optimization - Downloads from other devices (OFF, enforced via policy) + + NO forced schedules and NO auto-reboot policies are configured. + Installation timing remains user-controlled via the Windows Update GUI; where + policies are used, Windows clearly indicates that "Some settings are managed + by your organization". + + .PARAMETER DryRun + Preview changes without applying them + + .EXAMPLE + Set-WindowsUpdate + + .NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: Administrator privileges + Based on: Windows Settings > Windows Update > Advanced options + #> + + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + try { + $configPath = Join-Path $PSScriptRoot "..\Config\WindowsUpdate.json" + + if (-not (Test-Path $configPath)) { + Write-Log -Level ERROR -Message "WindowsUpdate.json not found: $configPath" -Module "AdvancedSecurity" + return $false + } + + $config = Get-Content $configPath -Raw | ConvertFrom-Json + + Write-Log -Level INFO -Message "Configuring Windows Update (3 simple GUI settings)..." -Module "AdvancedSecurity" + + if ($DryRun) { + Write-Log -Level INFO -Message "[DRYRUN] Would configure 3 Windows Update settings" -Module "AdvancedSecurity" + return $true + } + + $settingsApplied = 0 + + # Loop through all 3 settings from config + foreach ($settingKey in $config.Settings.PSObject.Properties.Name) { + $setting = $config.Settings.$settingKey + $regPath = $setting.RegistryPath + + # Ensure registry path exists + if (-not (Test-Path $regPath)) { + Write-Log -Level DEBUG -Message "Creating registry path: $regPath" -Module "AdvancedSecurity" + New-Item -Path $regPath -Force | Out-Null + } + + # Apply each value in this setting + foreach ($valueName in $setting.Values.PSObject.Properties.Name) { + $valueData = $setting.Values.$valueName + + # Always use New-ItemProperty with -Force to ensure correct type and value + # -Force will overwrite existing keys + New-ItemProperty -Path $regPath -Name $valueName -Value $valueData.Value -PropertyType DWord -Force | Out-Null + + Write-Log -Level SUCCESS -Message "$($setting.Name): $valueName = $($valueData.Value)" -Module "AdvancedSecurity" + $settingsApplied++ + } + } + + Write-Log -Level SUCCESS -Message "Windows Update configured: $settingsApplied registry keys set" -Module "AdvancedSecurity" + + # Restart Windows Update service to apply changes immediately + Write-Log -Level INFO -Message "Restarting Windows Update service to apply changes..." -Module "AdvancedSecurity" + try { + Restart-Service -Name wuauserv -Force -ErrorAction Stop | Out-Null + Write-Log -Level SUCCESS -Message "Windows Update service restarted successfully" -Module "AdvancedSecurity" + } + catch { + Write-Log -Level WARNING -Message "Could not restart Windows Update service: $($_.Exception.Message)" -Module "AdvancedSecurity" + } + + Write-Host "" + Write-Host "================================================" -ForegroundColor Green + Write-Host " Windows Update Configured (3 Settings)" -ForegroundColor Green + Write-Host "================================================" -ForegroundColor Green + Write-Host "" + Write-Host "[1] Get latest updates immediately: ON (Policy)" -ForegroundColor Gray + Write-Host "[2] Microsoft Update (Office, etc.): ON (User can toggle)" -ForegroundColor Gray + Write-Host "[3] P2P Delivery Optimization: OFF (Policy)" -ForegroundColor Gray + Write-Host "" + Write-Host "Installation timing remains user-controlled (no forced schedules, no auto-reboot policies)." -ForegroundColor White + Write-Host "Windows will indicate where settings are managed by policy in the GUI." -ForegroundColor White + Write-Host "" + + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to configure Windows Update: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Set-WirelessDisplaySecurity.ps1 b/Modules/AdvancedSecurity/Private/Set-WirelessDisplaySecurity.ps1 new file mode 100644 index 0000000..59a36e2 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Set-WirelessDisplaySecurity.ps1 @@ -0,0 +1,200 @@ +function Set-WirelessDisplaySecurity { + <# + .SYNOPSIS + Hardens Wireless Display (Miracast) settings to prevent screen interception attacks. + + .DESCRIPTION + Configures Windows Wireless Display policies to prevent attackers from: + - Setting up rogue Miracast receivers to capture your screen + - Using your PC as an unauthorized display receiver + - Intercepting screen content via mDNS spoofing + + Default (always applied): Blocks receiving projections, requires PIN for pairing + Full disable: Also blocks sending projections and mDNS discovery + + .PARAMETER DisableCompletely + If specified, completely disables all Wireless Display functionality. + Default: Only hardens (blocks receiving, requires PIN) but allows sending. + + .EXAMPLE + Set-WirelessDisplaySecurity + # Applies default hardening (blocks receiving, requires PIN) + + .EXAMPLE + Set-WirelessDisplaySecurity -DisableCompletely + # Completely disables all Wireless Display functionality + #> + [CmdletBinding()] + param( + [switch]$DisableCompletely + ) + + try { + Write-Log -Level INFO -Message "Applying Wireless Display security hardening (DisableCompletely: $DisableCompletely)..." -Module "AdvancedSecurity" + + $changesApplied = 0 + + # Registry path for Wireless Display policies + $connectPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect" + + # Create key if it doesn't exist + if (-not (Test-Path $connectPath)) { + New-Item -Path $connectPath -Force | Out-Null + Write-Log -Level INFO -Message "Created registry key: $connectPath" -Module "AdvancedSecurity" + } + + # ============================================ + # ALWAYS APPLIED (Default hardening for all profiles) + # ============================================ + + # 1. AllowProjectionToPC = 0 (Block receiving projections - prevents rogue receiver attacks) + $currentValue = Get-ItemProperty -Path $connectPath -Name "AllowProjectionToPC" -ErrorAction SilentlyContinue + if ($null -eq $currentValue -or $currentValue.AllowProjectionToPC -ne 0) { + Set-ItemProperty -Path $connectPath -Name "AllowProjectionToPC" -Value 0 -Type DWord -Force + Write-Log -Level INFO -Message "Set AllowProjectionToPC = 0 (Block receiving)" -Module "AdvancedSecurity" + $changesApplied++ + } + + # 2. RequirePinForPairing = 2 (Always require PIN - prevents unauthorized pairing) + $currentValue = Get-ItemProperty -Path $connectPath -Name "RequirePinForPairing" -ErrorAction SilentlyContinue + if ($null -eq $currentValue -or $currentValue.RequirePinForPairing -ne 2) { + Set-ItemProperty -Path $connectPath -Name "RequirePinForPairing" -Value 2 -Type DWord -Force + Write-Log -Level INFO -Message "Set RequirePinForPairing = 2 (Always require PIN)" -Module "AdvancedSecurity" + $changesApplied++ + } + + # ============================================ + # OPTIONAL: Complete disable (user choice) + # ============================================ + + if ($DisableCompletely) { + Write-Log -Level INFO -Message "Applying complete Wireless Display disable..." -Module "AdvancedSecurity" + + # 3. AllowProjectionFromPC = 0 (Block sending projections) + $currentValue = Get-ItemProperty -Path $connectPath -Name "AllowProjectionFromPC" -ErrorAction SilentlyContinue + if ($null -eq $currentValue -or $currentValue.AllowProjectionFromPC -ne 0) { + Set-ItemProperty -Path $connectPath -Name "AllowProjectionFromPC" -Value 0 -Type DWord -Force + Write-Log -Level INFO -Message "Set AllowProjectionFromPC = 0 (Block sending)" -Module "AdvancedSecurity" + $changesApplied++ + } + + # 4. AllowMdnsAdvertisement = 0 (Don't advertise as receiver) + $currentValue = Get-ItemProperty -Path $connectPath -Name "AllowMdnsAdvertisement" -ErrorAction SilentlyContinue + if ($null -eq $currentValue -or $currentValue.AllowMdnsAdvertisement -ne 0) { + Set-ItemProperty -Path $connectPath -Name "AllowMdnsAdvertisement" -Value 0 -Type DWord -Force + Write-Log -Level INFO -Message "Set AllowMdnsAdvertisement = 0 (No mDNS ads)" -Module "AdvancedSecurity" + $changesApplied++ + } + + # 5. AllowMdnsDiscovery = 0 (Don't discover receivers via mDNS) + $currentValue = Get-ItemProperty -Path $connectPath -Name "AllowMdnsDiscovery" -ErrorAction SilentlyContinue + if ($null -eq $currentValue -or $currentValue.AllowMdnsDiscovery -ne 0) { + Set-ItemProperty -Path $connectPath -Name "AllowMdnsDiscovery" -Value 0 -Type DWord -Force + Write-Log -Level INFO -Message "Set AllowMdnsDiscovery = 0 (No mDNS discovery)" -Module "AdvancedSecurity" + $changesApplied++ + } + + # 6. AllowProjectionFromPCOverInfrastructure = 0 (Block infrastructure projection) + $currentValue = Get-ItemProperty -Path $connectPath -Name "AllowProjectionFromPCOverInfrastructure" -ErrorAction SilentlyContinue + if ($null -eq $currentValue -or $currentValue.AllowProjectionFromPCOverInfrastructure -ne 0) { + Set-ItemProperty -Path $connectPath -Name "AllowProjectionFromPCOverInfrastructure" -Value 0 -Type DWord -Force + Write-Log -Level INFO -Message "Set AllowProjectionFromPCOverInfrastructure = 0" -Module "AdvancedSecurity" + $changesApplied++ + } + + # 7. AllowProjectionToPCOverInfrastructure = 0 (Block infrastructure receiving) + $currentValue = Get-ItemProperty -Path $connectPath -Name "AllowProjectionToPCOverInfrastructure" -ErrorAction SilentlyContinue + if ($null -eq $currentValue -or $currentValue.AllowProjectionToPCOverInfrastructure -ne 0) { + Set-ItemProperty -Path $connectPath -Name "AllowProjectionToPCOverInfrastructure" -Value 0 -Type DWord -Force + Write-Log -Level INFO -Message "Set AllowProjectionToPCOverInfrastructure = 0" -Module "AdvancedSecurity" + $changesApplied++ + } + + # 8. Block Miracast ports via Windows Firewall (7236, 7250) + $firewallRules = @( + @{ + Name = "NoID-Block-Miracast-TCP-7236" + DisplayName = "NoID Privacy - Block Miracast TCP 7236" + Direction = "Inbound" + Protocol = "TCP" + LocalPort = 7236 + }, + @{ + Name = "NoID-Block-Miracast-TCP-7250" + DisplayName = "NoID Privacy - Block Miracast TCP 7250" + Direction = "Inbound" + Protocol = "TCP" + LocalPort = 7250 + }, + @{ + Name = "NoID-Block-Miracast-UDP-7236" + DisplayName = "NoID Privacy - Block Miracast UDP 7236" + Direction = "Inbound" + Protocol = "UDP" + LocalPort = 7236 + }, + @{ + Name = "NoID-Block-Miracast-UDP-7250" + DisplayName = "NoID Privacy - Block Miracast UDP 7250" + Direction = "Inbound" + Protocol = "UDP" + LocalPort = 7250 + } + ) + + foreach ($rule in $firewallRules) { + $existingRule = Get-NetFirewallRule -Name $rule.Name -ErrorAction SilentlyContinue + if (-not $existingRule) { + New-NetFirewallRule -Name $rule.Name ` + -DisplayName $rule.DisplayName ` + -Direction $rule.Direction ` + -Protocol $rule.Protocol ` + -LocalPort $rule.LocalPort ` + -Action Block ` + -Profile Any ` + -Enabled True | Out-Null + Write-Log -Level INFO -Message "Created firewall rule: $($rule.DisplayName)" -Module "AdvancedSecurity" + $changesApplied++ + } + } + + # 9. Disable WiFi Direct Service (WFDSConMgrSvc) - CRITICAL for complete Miracast block + # Registry policies alone don't block WiFi Direct P2P discovery! + $wfdService = Get-Service -Name "WFDSConMgrSvc" -ErrorAction SilentlyContinue + if ($wfdService) { + if ($wfdService.Status -eq 'Running') { + Stop-Service -Name "WFDSConMgrSvc" -Force -ErrorAction SilentlyContinue + Write-Log -Level INFO -Message "Stopped WiFi Direct Service (WFDSConMgrSvc)" -Module "AdvancedSecurity" + } + + if ($wfdService.StartType -ne 'Disabled') { + Set-Service -Name "WFDSConMgrSvc" -StartupType Disabled -ErrorAction SilentlyContinue + Write-Log -Level INFO -Message "Disabled WiFi Direct Service (WFDSConMgrSvc) - survives reboot" -Module "AdvancedSecurity" + $changesApplied++ + } + } + + # 10. Disable WiFi Direct Virtual Adapters (immediate effect) + $wfdAdapters = Get-NetAdapter -InterfaceDescription "Microsoft Wi-Fi Direct Virtual*" -IncludeHidden -ErrorAction SilentlyContinue + if ($wfdAdapters) { + $wfdAdapters | Where-Object { $_.Status -ne 'Disabled' } | ForEach-Object { + Disable-NetAdapter -Name $_.Name -Confirm:$false -ErrorAction SilentlyContinue + Write-Log -Level INFO -Message "Disabled WiFi Direct adapter: $($_.Name)" -Module "AdvancedSecurity" + $changesApplied++ + } + } + } + + if ($changesApplied -eq 0) { + Write-Log -Level SUCCESS -Message "Wireless Display security already configured (no changes needed)" -Module "AdvancedSecurity" + } + else { + Write-Log -Level SUCCESS -Message "Wireless Display security applied ($changesApplied changes)" -Module "AdvancedSecurity" + } + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to apply Wireless Display security: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Stop-RiskyServices.ps1 b/Modules/AdvancedSecurity/Private/Stop-RiskyServices.ps1 new file mode 100644 index 0000000..44c03aa --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Stop-RiskyServices.ps1 @@ -0,0 +1,216 @@ +function Stop-RiskyServices { + <# + .SYNOPSIS + Stop and disable risky network services + + .DESCRIPTION + Stops and disables network services that pose security risks: + + - SSDPSRV (SSDP Discovery) - Port 1900 UDP + - upnphost (UPnP Device Host) - Port 2869 TCP + - lmhosts (TCP/IP NetBIOS Helper) - Port 139 TCP + + Defense in Depth: Firewall blocks external access, but services + still run and listen locally. Stopping services completely closes ports. + + Service Dependencies: + upnphost depends on SSDPSRV, so upnphost must be stopped FIRST. + + .EXAMPLE + Stop-RiskyServices + Stops all risky network services + + .NOTES + Impact: + - Smart home device auto-discovery may not work + - DLNA/casting features may require manual configuration + - NetBIOS name resolution disabled (already disabled via registry) + #> + [CmdletBinding()] + param() + + try { + Write-Log -Level INFO -Message "Stopping risky network services..." -Module "AdvancedSecurity" + + $services = @( + @{ + Name = "upnphost" + DisplayName = "UPnP Device Host" + Port = 2869 + Protocol = "TCP" + Risk = "MEDIUM" + Impact = "DLNA/casting features may require manual configuration" + }, + @{ + Name = "SSDPSRV" + DisplayName = "SSDP Discovery" + Port = 1900 + Protocol = "UDP" + Risk = "MEDIUM" + Impact = "Smart home device auto-discovery may not work" + }, + @{ + Name = "lmhosts" + DisplayName = "TCP/IP NetBIOS Helper" + Port = 139 + Protocol = "TCP" + Risk = "MEDIUM" + Impact = "NetBIOS name resolution disabled" + } + # Note: Computer Browser (Browser) service is DEPRECATED in Win10/11 + # It's tied to SMB1 which is not installed by default + # Removing from list to avoid errors on modern systems + ) + + # Backup service states + Write-Log -Level INFO -Message "Backing up service states..." -Module "AdvancedSecurity" + + $serviceBackup = @{} + foreach ($svc in $services) { + $service = Get-Service -Name $svc.Name -ErrorAction SilentlyContinue + if ($service) { + $serviceBackup[$svc.Name] = @{ + Status = $service.Status.ToString() + StartType = $service.StartType.ToString() + DisplayName = $service.DisplayName + } + } + } + + $backupData = @{ + Services = $serviceBackup + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + } + $backupJson = $backupData | ConvertTo-Json -Depth 10 + Register-Backup -Type "Services_State" -Data $backupJson -Name "RiskyServices" + + Write-Log -Level SUCCESS -Message "Backed up state of $($serviceBackup.Count) services" -Module "AdvancedSecurity" + + # Stop and disable services + $stoppedCount = 0 + $errors = @() + + # CRITICAL: Stop upnphost FIRST (it depends on SSDPSRV) + foreach ($svc in $services) { + Write-Log -Level INFO -Message "Processing service: $($svc.DisplayName) ($($svc.Name))..." -Module "AdvancedSecurity" + + $service = Get-Service -Name $svc.Name -ErrorAction SilentlyContinue + + if (-not $service) { + Write-Log -Level INFO -Message "Service $($svc.Name) not found (may not be installed)" -Module "AdvancedSecurity" + continue + } + + try { + # Stop service if running + if ($service.Status -eq 'Running') { + Write-Log -Level INFO -Message "Stopping $($svc.Name)..." -Module "AdvancedSecurity" + Stop-Service -Name $svc.Name -Force -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Stopped $($svc.Name)" -Module "AdvancedSecurity" + } + else { + Write-Log -Level INFO -Message "$($svc.Name) already stopped" -Module "AdvancedSecurity" + } + + # Disable service + Write-Log -Level INFO -Message "Disabling $($svc.Name)..." -Module "AdvancedSecurity" + Set-Service -Name $svc.Name -StartupType Disabled -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Disabled $($svc.Name) (StartupType = Disabled)" -Module "AdvancedSecurity" + + $stoppedCount++ + } + catch { + $errors += "$($svc.Name): $_" + Write-Log -Level WARNING -Message "Failed to stop/disable $($svc.Name): $_" -Module "AdvancedSecurity" + } + } + + # Verify ports are closed + Write-Log -Level INFO -Message "Verifying ports are closed..." -Module "AdvancedSecurity" + + Start-Sleep -Seconds 2 # Give services time to fully stop + + $portsClosed = @() + $portsStillOpen = @() + + # Check TCP ports + foreach ($port in @(139, 2869)) { + $listener = Get-NetTCPConnection -LocalPort $port -State Listen -ErrorAction SilentlyContinue + if (-not $listener) { + $portsClosed += "TCP $port" + Write-Log -Level SUCCESS -Message "Port TCP $port is CLOSED" -Module "AdvancedSecurity" + } + else { + $portsStillOpen += "TCP $port" + Write-Log -Level WARNING -Message "Port TCP $port is still LISTENING!" -Module "AdvancedSecurity" + } + } + + # Check UDP port 1900 + $udpListener = Get-NetUDPEndpoint -LocalPort 1900 -ErrorAction SilentlyContinue + if (-not $udpListener) { + $portsClosed += "UDP 1900" + Write-Log -Level SUCCESS -Message "Port UDP 1900 is CLOSED" -Module "AdvancedSecurity" + } + else { + $portsStillOpen += "UDP 1900" + Write-Log -Level WARNING -Message "Port UDP 1900 is still LISTENING locally. SSDP service is disabled and blocked by firewall; this listener is a known Windows behavior and not reachable from external networks." -Module "AdvancedSecurity" + } + + # Summary + Write-Host "" + Write-Host "================================================" -ForegroundColor Green + Write-Host " RISKY SERVICES STOPPED" -ForegroundColor Green + Write-Host "================================================" -ForegroundColor Green + Write-Host "" + Write-Host "Services stopped: $stoppedCount" -ForegroundColor White + foreach ($svc in $services) { + $service = Get-Service -Name $svc.Name -ErrorAction SilentlyContinue + if ($service) { + $status = if ($service.Status -eq 'Stopped') { "STOPPED" } else { $service.Status } + $startType = $service.StartType + Write-Host " $($svc.DisplayName): $status (StartType: $startType)" -ForegroundColor Gray + } + } + Write-Host "" + Write-Host "Ports closed: $($portsClosed.Count)" -ForegroundColor White + foreach ($port in $portsClosed) { + Write-Host " $port" -ForegroundColor Green + } + + if ($portsStillOpen.Count -gt 0) { + Write-Host "" + Write-Host "Ports still open: $($portsStillOpen.Count)" -ForegroundColor Yellow + foreach ($port in $portsStillOpen) { + Write-Host " $port" -ForegroundColor Yellow + } + if ($portsStillOpen -contains "UDP 1900") { + Write-Host "" + Write-Host "Note: UDP 1900 may still show a local listener, but SSDP is disabled and blocked by firewall. This is a known Windows behavior and not remotely reachable." -ForegroundColor Gray + } + } + + if ($errors.Count -gt 0) { + Write-Host "" + Write-Host "Errors: $($errors.Count)" -ForegroundColor Red + foreach ($errorMsg in $errors) { + Write-Host " $errorMsg" -ForegroundColor Red + } + } + + Write-Host "" + + if ($errors.Count -eq 0) { + Write-Log -Level SUCCESS -Message "All risky services stopped and disabled successfully" -Module "AdvancedSecurity" + return $true + } + else { + Write-Log -Level WARNING -Message "Completed with $($errors.Count) errors" -Module "AdvancedSecurity" + return $true # Partial success + } + } + catch { + Write-Log -Level ERROR -Message "Failed to stop risky services: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-AdminShares.ps1 b/Modules/AdvancedSecurity/Private/Test-AdminShares.ps1 new file mode 100644 index 0000000..4eab364 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-AdminShares.ps1 @@ -0,0 +1,100 @@ +function Test-AdminShares { + <# + .SYNOPSIS + Test administrative shares compliance + + .DESCRIPTION + Checks if administrative shares (C$, ADMIN$, etc.) are disabled + + .EXAMPLE + Test-AdminShares + #> + [CmdletBinding()] + param() + + try { + $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" + + $result = [PSCustomObject]@{ + Feature = "Admin Shares" + Status = "Unknown" + Details = @() + AutoShareWks = $null + AutoShareServer = $null + ActiveShares = @() + Compliant = $false + } + + # Check registry settings + if (Test-Path $regPath) { + $result.AutoShareWks = (Get-ItemProperty -Path $regPath -Name "AutoShareWks" -ErrorAction SilentlyContinue).AutoShareWks + $result.AutoShareServer = (Get-ItemProperty -Path $regPath -Name "AutoShareServer" -ErrorAction SilentlyContinue).AutoShareServer + + if ($result.AutoShareWks -eq 0 -and $result.AutoShareServer -eq 0) { + $result.Details += "Registry: AutoShareWks = 0, AutoShareServer = 0 (Disabled)" + } + else { + $result.Details += "Registry: AutoShareWks = $($result.AutoShareWks), AutoShareServer = $($result.AutoShareServer)" + } + } + + # Check for active admin shares (requires LanmanServer service) + $serverService = Get-Service -Name "LanmanServer" -ErrorAction SilentlyContinue + if (-not $serverService -or $serverService.Status -ne 'Running') { + # Server service is stopped/disabled - admin shares are effectively disabled + $result.Details += "LanmanServer service is not running (admin shares cannot exist)" + $adminShares = @() + } + else { + try { + $adminShares = Get-SmbShare | Where-Object { $_.Name -match '^[A-Z]\$$|^ADMIN\$$' } + } + catch { + # Get-SmbShare failed - treat as no shares + $result.Details += "Could not query SMB shares: $($_.Exception.Message)" + $adminShares = @() + } + } + $result.ActiveShares = $adminShares | Select-Object -ExpandProperty Name + + if ($adminShares.Count -eq 0) { + $result.Details += "No administrative shares found (C$, ADMIN$ removed)" + + if ($result.AutoShareWks -eq 0 -and $result.AutoShareServer -eq 0) { + $result.Status = "Secure" + $result.Compliant = $true + } + else { + $result.Status = "Partially Secure" + $result.Compliant = $false + $result.Details += "WARNING: Shares removed but AutoShare registry not set (will recreate on reboot!)" + } + } + else { + # Shares are present, check if Registry is configured to disable them + if ($result.AutoShareWks -eq 0 -and $result.AutoShareServer -eq 0) { + # Config is correct, just needs a reboot + $result.Status = "Pending Reboot" + $result.Compliant = $true + $result.Details += "Active admin shares: $($adminShares.Name -join ', ') (Will be removed after reboot)" + } + else { + # Config is NOT correct + $result.Status = "Insecure" + $result.Compliant = $false + $result.Details += "Active admin shares: $($adminShares.Name -join ', ')" + } + } + + return $result + } + catch { + Write-Log -Level ERROR -Message "Failed to test admin shares: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return [PSCustomObject]@{ + Feature = "Admin Shares" + Status = "Error" + Details = @("Failed to test: $_") + Compliant = $false + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-DiscoveryProtocolsSecurity.ps1 b/Modules/AdvancedSecurity/Private/Test-DiscoveryProtocolsSecurity.ps1 new file mode 100644 index 0000000..a503348 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-DiscoveryProtocolsSecurity.ps1 @@ -0,0 +1,121 @@ +function Test-DiscoveryProtocolsSecurity { + <# + .SYNOPSIS + Tests WS-Discovery and mDNS hardening state. + + .DESCRIPTION + Verifies that the following conditions are met: + - OS-level mDNS resolver disabled (EnableMDNS = 0) + - FDResPub and fdPHost services disabled and not running + - NoID firewall BLOCK rules for WS-Discovery and mDNS exist and are enabled + + Returns a PSCustomObject with detailed fields and an overall Compliant flag. + + .EXAMPLE + Test-DiscoveryProtocolsSecurity + #> + [CmdletBinding()] + param() + + $result = [PSCustomObject]@{ + EnableMDNS = $null + FDResPubDisabled = $false + FdPHostDisabled = $false + FirewallRulesPresent = $false + FirewallRulesEnabled = $false + Udp3702ListenersClosed = $null + Udp5353ListenersClosed = $null + Tcp5357ListenersClosed = $null + Tcp5358ListenersClosed = $null + Compliant = $false + } + + try { + # 1) Check mDNS registry flag + $dnsParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" + if (Test-Path $dnsParamsPath) { + $props = Get-ItemProperty -Path $dnsParamsPath -ErrorAction SilentlyContinue + if ($props.PSObject.Properties.Name -contains 'EnableMDNS') { + $result.EnableMDNS = $props.EnableMDNS + } + } + + # 2) Check services + $fdResPub = Get-Service -Name "FDResPub" -ErrorAction SilentlyContinue + if ($fdResPub) { + $result.FDResPubDisabled = ($fdResPub.StartType -eq 'Disabled' -and $fdResPub.Status -ne 'Running') + } + + $fdPHost = Get-Service -Name "fdPHost" -ErrorAction SilentlyContinue + if ($fdPHost) { + $result.FdPHostDisabled = ($fdPHost.StartType -eq 'Disabled' -and $fdPHost.Status -ne 'Running') + } + + # 3) Check firewall rules + $ruleNames = @( + "NoID-Block-WSD-UDP-3702", + "NoID-Block-WSD-TCP-5357", + "NoID-Block-WSD-TCP-5358", + "NoID-Block-mDNS-UDP-5353" + ) + + $rules = @() + foreach ($name in $ruleNames) { + $r = Get-NetFirewallRule -Name $name -ErrorAction SilentlyContinue + if ($r) { + $rules += $r + } + } + + if ($rules.Count -gt 0) { + $result.FirewallRulesPresent = ($rules.Count -eq $ruleNames.Count) + $result.FirewallRulesEnabled = ($rules | Where-Object { $_.Enabled -eq 'True' -and $_.Action -eq 'Block' }).Count -eq $ruleNames.Count + } + + # 4) Optional: check that ports are not listening + try { + $udp3702 = Get-NetUDPEndpoint -LocalPort 3702 -ErrorAction SilentlyContinue + $result.Udp3702ListenersClosed = (-not $udp3702) + } + catch { + $result.Udp3702ListenersClosed = $null + } + + try { + $udp5353 = Get-NetUDPEndpoint -LocalPort 5353 -ErrorAction SilentlyContinue + $result.Udp5353ListenersClosed = (-not $udp5353) + } + catch { + $result.Udp5353ListenersClosed = $null + } + + try { + $tcp5357 = Get-NetTCPConnection -LocalPort 5357 -State Listen -ErrorAction SilentlyContinue + $result.Tcp5357ListenersClosed = (-not $tcp5357) + } + catch { + $result.Tcp5357ListenersClosed = $null + } + + try { + $tcp5358 = Get-NetTCPConnection -LocalPort 5358 -State Listen -ErrorAction SilentlyContinue + $result.Tcp5358ListenersClosed = (-not $tcp5358) + } + catch { + $result.Tcp5358ListenersClosed = $null + } + + # Overall compliance: mDNS disabled, services disabled, firewall rules present+enabled + $mdnsOk = ($result.EnableMDNS -eq 0) + $servicesOk = $result.FDResPubDisabled -and $result.FdPHostDisabled + $firewallOk = $result.FirewallRulesPresent -and $result.FirewallRulesEnabled + + $result.Compliant = $mdnsOk -and $servicesOk -and $firewallOk + + return $result + } + catch { + Write-Log -Level ERROR -Message "Failed to test discovery protocol security (WS-Discovery/mDNS): $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $result + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-FingerProtocol.ps1 b/Modules/AdvancedSecurity/Private/Test-FingerProtocol.ps1 new file mode 100644 index 0000000..f0e7601 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-FingerProtocol.ps1 @@ -0,0 +1,57 @@ +function Test-FingerProtocol { + <# + .SYNOPSIS + Test if Finger Protocol (TCP 79) is blocked + + .DESCRIPTION + Verifies that the Windows Firewall rule blocking outbound TCP port 79 + is present and enabled. This prevents ClickFix malware attacks that + abuse finger.exe to retrieve commands from C2 servers. + + .OUTPUTS + PSCustomObject with compliance result + #> + [CmdletBinding()] + param() + + try { + $ruleName = "NoID Privacy - Block Finger Protocol (Port 79)" + + # Check if firewall rule exists and is enabled + $rule = Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue + + if ($rule) { + $isEnabled = $rule.Enabled -eq 'True' + $isBlocking = $rule.Action -eq 'Block' + $isOutbound = $rule.Direction -eq 'Outbound' + + $compliant = $isEnabled -and $isBlocking -and $isOutbound + + if ($compliant) { + $status = "Finger Protocol blocked (TCP 79 outbound)" + } + else { + $status = "Rule exists but misconfigured (Enabled: $isEnabled, Block: $isBlocking, Outbound: $isOutbound)" + } + } + else { + $compliant = $false + $status = "Firewall rule not found" + } + + return [PSCustomObject]@{ + Feature = "Finger Protocol Block" + Compliant = $compliant + Status = $status + Details = if ($rule) { "Rule: $ruleName" } else { "ClickFix malware protection not active" } + } + } + catch { + return [PSCustomObject]@{ + Feature = "Finger Protocol Block" + Compliant = $false + Status = "Error checking: $($_.Exception.Message)" + Details = $null + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-FirewallShieldsUp.ps1 b/Modules/AdvancedSecurity/Private/Test-FirewallShieldsUp.ps1 new file mode 100644 index 0000000..dbc2bb9 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-FirewallShieldsUp.ps1 @@ -0,0 +1,39 @@ +function Test-FirewallShieldsUp { + <# + .SYNOPSIS + Test if Firewall Shields Up mode is enabled + + .DESCRIPTION + Checks DoNotAllowExceptions value for PublicProfile firewall. + #> + [CmdletBinding()] + param() + + $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" + $valueName = "DoNotAllowExceptions" + + try { + $value = Get-ItemProperty -Path $regPath -Name $valueName -ErrorAction SilentlyContinue + + if ($null -eq $value -or $value.$valueName -ne 1) { + return @{ + Pass = $false + Message = "Shields Up NOT enabled (Public network allows configured exceptions)" + CurrentValue = if ($null -eq $value) { "Not Set" } else { $value.$valueName } + } + } + + return @{ + Pass = $true + Message = "Shields Up ENABLED (Public network blocks ALL incoming)" + CurrentValue = 1 + } + } + catch { + return @{ + Pass = $false + Message = "Error checking Shields Up: $_" + CurrentValue = "Error" + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-IPv6Security.ps1 b/Modules/AdvancedSecurity/Private/Test-IPv6Security.ps1 new file mode 100644 index 0000000..285f332 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-IPv6Security.ps1 @@ -0,0 +1,61 @@ +function Test-IPv6Security { + <# + .SYNOPSIS + Test IPv6 disable status (mitm6 attack mitigation) + + .DESCRIPTION + Checks if IPv6 is completely disabled via DisabledComponents registry value. + This is an OPTIONAL setting only available in Maximum profile. + + DisabledComponents = 0xFF (255) means IPv6 is completely disabled. + + .EXAMPLE + Test-IPv6Security + #> + [CmdletBinding()] + param() + + try { + $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" + $value = Get-ItemProperty -Path $regPath -Name "DisabledComponents" -ErrorAction SilentlyContinue + + if ($value -and $value.DisabledComponents -eq 255) { + return [PSCustomObject]@{ + Feature = "IPv6 Disable (mitm6 mitigation)" + Pass = $true + Compliant = $true + Message = "IPv6 DISABLED (DisabledComponents = 0xFF) - mitm6 protected" + Details = "IPv6 completely disabled - DHCPv6 spoofing attacks blocked" + } + } + elseif ($value -and $value.DisabledComponents -gt 0) { + return [PSCustomObject]@{ + Feature = "IPv6 Disable (mitm6 mitigation)" + Pass = $true + Compliant = $true + Message = "IPv6 PARTIALLY disabled (DisabledComponents = $($value.DisabledComponents))" + Details = "IPv6 partially disabled - some mitm6 protection" + } + } + else { + # IPv6 is enabled - this is OPTIONAL, so still "pass" but note it's not configured + return [PSCustomObject]@{ + Feature = "IPv6 Disable (mitm6 mitigation)" + Pass = $true # Optional feature - not a failure + Compliant = $true # Optional feature + Message = "IPv6 ENABLED (Optional - not configured)" + Details = "IPv6 enabled (default) - WPAD disabled provides partial mitm6 protection" + } + } + } + catch { + Write-Log -Level ERROR -Message "Failed to test IPv6 security: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return [PSCustomObject]@{ + Feature = "IPv6 Disable (mitm6 mitigation)" + Pass = $true # Don't fail on error for optional feature + Compliant = $true + Message = "Error checking IPv6 status" + Details = "Could not determine IPv6 status: $_" + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-LegacyTLS.ps1 b/Modules/AdvancedSecurity/Private/Test-LegacyTLS.ps1 new file mode 100644 index 0000000..d9136be --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-LegacyTLS.ps1 @@ -0,0 +1,75 @@ +function Test-LegacyTLS { + <# + .SYNOPSIS + Test Legacy TLS configuration compliance + + .DESCRIPTION + Verifies that TLS 1.0 and TLS 1.1 are disabled for both Client and Server. + + .OUTPUTS + PSCustomObject with compliance details + #> + [CmdletBinding()] + param() + + try { + $result = [PSCustomObject]@{ + Feature = "Legacy TLS (1.0/1.1)" + Status = "Unknown" + Details = @() + Compliant = $true + } + + $tlsVersions = @("TLS 1.0", "TLS 1.1") + $components = @("Server", "Client") + $nonCompliantCount = 0 + + foreach ($version in $tlsVersions) { + foreach ($component in $components) { + $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$version\$component" + + if (Test-Path $regPath) { + $enabled = (Get-ItemProperty -Path $regPath -Name "Enabled" -ErrorAction SilentlyContinue).Enabled + $disabledByDefault = (Get-ItemProperty -Path $regPath -Name "DisabledByDefault" -ErrorAction SilentlyContinue).DisabledByDefault + + if ($enabled -eq 0) { + # Compliant + } + elseif ($null -eq $enabled -and $disabledByDefault -eq 1) { + # Compliant (implicitly disabled) + } + else { + $result.Details += "$version $component is NOT disabled (Enabled=$enabled)" + $nonCompliantCount++ + } + } + else { + # Key missing usually means default (Enabled on old OS, Disabled on very new OS) + # For hardening, we expect explicit disable keys + $result.Details += "$version $component registry keys missing" + $nonCompliantCount++ + } + } + } + + if ($nonCompliantCount -eq 0) { + $result.Status = "Secure (Disabled)" + $result.Compliant = $true + } + else { + $result.Status = "Insecure ($nonCompliantCount issues)" + $result.Compliant = $false + } + + return $result + } + catch { + Write-Log -Level ERROR -Message "Failed to test Legacy TLS: $_" -Module "AdvancedSecurity" + return [PSCustomObject]@{ + Feature = "Legacy TLS (1.0/1.1)" + Status = "Error" + Details = @("Failed to test: $_") + Compliant = $false + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-PowerShellV2.ps1 b/Modules/AdvancedSecurity/Private/Test-PowerShellV2.ps1 new file mode 100644 index 0000000..176545c --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-PowerShellV2.ps1 @@ -0,0 +1,61 @@ +function Test-PowerShellV2 { + <# + .SYNOPSIS + Test PowerShell v2 status + + .DESCRIPTION + Verifies that the PowerShell v2 feature is disabled or not present. + + .OUTPUTS + PSCustomObject with compliance details + #> + [CmdletBinding()] + param() + + try { + $result = [PSCustomObject]@{ + Feature = "PowerShell v2 (Downgrade Attack)" + Status = "Unknown" + Details = @() + Compliant = $true + } + + $psv2Feature = $null + try { + $psv2Feature = Get-WindowsOptionalFeature -Online -FeatureName "MicrosoftWindowsPowerShellV2Root" -ErrorAction SilentlyContinue + } + catch { + $psv2Feature = $null + } + + if (-not $psv2Feature) { + # Feature not present on OS - Secure by default + $result.Status = "Secure (Not Present)" + $result.Compliant = $true + $result.Details += "Feature 'MicrosoftWindowsPowerShellV2Root' not found on this OS" + } + elseif ($psv2Feature.State -ne 'Enabled') { + # Feature present but disabled - Secure + $result.Status = "Secure (Disabled)" + $result.Compliant = $true + $result.Details += "Feature state: $($psv2Feature.State)" + } + else { + # Feature Enabled - Insecure + $result.Status = "Insecure (Enabled)" + $result.Compliant = $false + $result.Details += "PowerShell v2 is enabled (allows downgrade attacks)" + } + + return $result + } + catch { + Write-Log -Level ERROR -Message "Failed to test PowerShell v2: $_" -Module "AdvancedSecurity" + return [PSCustomObject]@{ + Feature = "PowerShell v2" + Status = "Error" + Details = @("Failed to test: $_") + Compliant = $false + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-RdpSecurity.ps1 b/Modules/AdvancedSecurity/Private/Test-RdpSecurity.ps1 new file mode 100644 index 0000000..64478d8 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-RdpSecurity.ps1 @@ -0,0 +1,96 @@ +function Test-RdpSecurity { + <# + .SYNOPSIS + Test RDP security hardening compliance + + .DESCRIPTION + Verifies that RDP is properly hardened: + - NLA (Network Level Authentication) is enforced + - SSL/TLS encryption is required + - Optionally checks if RDP is completely disabled + + .EXAMPLE + Test-RdpSecurity + Returns compliance status for RDP hardening + + .OUTPUTS + PSCustomObject with compliance details + #> + [CmdletBinding()] + param() + + try { + $rdpRegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" + $rdpServerPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" + + $result = [PSCustomObject]@{ + Feature = "RDP Security" + Status = "Unknown" + Details = @() + NLA_Enabled = $false + SSL_TLS_Enabled = $false + RDP_Disabled = $false + Compliant = $false + } + + # Check NLA + if (Test-Path $rdpRegPath) { + $userAuth = (Get-ItemProperty -Path $rdpRegPath -Name "UserAuthentication" -ErrorAction SilentlyContinue).UserAuthentication + $secLayer = (Get-ItemProperty -Path $rdpRegPath -Name "SecurityLayer" -ErrorAction SilentlyContinue).SecurityLayer + + if ($userAuth -eq 1) { + $result.NLA_Enabled = $true + $result.Details += "NLA enforced (UserAuthentication = 1)" + } + else { + $result.Details += "NLA NOT enforced (UserAuthentication = $userAuth)" + } + + if ($secLayer -eq 2) { + $result.SSL_TLS_Enabled = $true + $result.Details += "SSL/TLS enforced (SecurityLayer = 2)" + } + else { + $result.Details += "SSL/TLS NOT enforced (SecurityLayer = $secLayer)" + } + } + else { + $result.Details += "RDP registry path not found" + } + + # Check if RDP is completely disabled + if (Test-Path $rdpServerPath) { + $rdpDisabled = (Get-ItemProperty -Path $rdpServerPath -Name "fDenyTSConnections" -ErrorAction SilentlyContinue).fDenyTSConnections + + if ($rdpDisabled -eq 1) { + $result.RDP_Disabled = $true + $result.Details += "RDP completely disabled (fDenyTSConnections = 1)" + } + } + + # Determine compliance + if ($result.RDP_Disabled) { + $result.Status = "Secure (RDP Disabled)" + $result.Compliant = $true + } + elseif ($result.NLA_Enabled -and $result.SSL_TLS_Enabled) { + $result.Status = "Secure (NLA + SSL/TLS)" + $result.Compliant = $true + } + else { + $result.Status = "Insecure" + $result.Compliant = $false + } + + return $result + } + catch { + Write-Log -Level ERROR -Message "Failed to test RDP security: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return [PSCustomObject]@{ + Feature = "RDP Security" + Status = "Error" + Details = @("Failed to test: $_") + Compliant = $false + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-RiskyPorts.ps1 b/Modules/AdvancedSecurity/Private/Test-RiskyPorts.ps1 new file mode 100644 index 0000000..d76cece --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-RiskyPorts.ps1 @@ -0,0 +1,134 @@ +function Test-RiskyPorts { + <# + .SYNOPSIS + Test risky firewall ports compliance + + .DESCRIPTION + Checks if risky firewall ports (LLMNR, NetBIOS, UPnP/SSDP) are closed + + .EXAMPLE + Test-RiskyPorts + #> + [CmdletBinding()] + param() + + try { + $result = [PSCustomObject]@{ + Feature = "Risky Firewall Ports" + Status = "Unknown" + Details = @() + OpenPorts = @() + DisabledRules = 0 + EnabledRules = 0 + Compliant = $false + } + + $riskyPorts = @(5355, 137, 138, 139, 1900, 2869) + + # Detect NoID SSDP firewall block rule for UDP 1900 + $ssdpRuleName = "NoID Privacy - Block SSDP (UDP 1900)" + $ssdpBlockRule = Get-NetFirewallRule -DisplayName $ssdpRuleName -ErrorAction SilentlyContinue + $ssdpBlockActive = $false + if ($ssdpBlockRule -and $ssdpBlockRule.Enabled -eq 'True' -and $ssdpBlockRule.Action -eq 'Block') { + $ssdpBlockActive = $true + } + + # PERFORMANCE FIX: Batch query instead of per-rule queries + # Old approach: Get-NetFirewallRule | ForEach { Get-NetFirewallPortFilter } = 300 queries ร— 200ms = 60s! + # New approach: Get all port filters once, then filter = 2-3s total + + # Get all inbound firewall rules (pre-filter by direction) + $inboundRules = Get-NetFirewallRule -Direction Inbound -ErrorAction SilentlyContinue + + # Get all port filters in one batch query + $allPortFilters = @{} + Get-NetFirewallPortFilter -ErrorAction SilentlyContinue | ForEach-Object { + $allPortFilters[$_.InstanceID] = $_ + } + + # Now filter rules by risky ports (fast lookup) + $riskyRules = $inboundRules | Where-Object { + $portFilter = $allPortFilters[$_.InstanceID] + if ($portFilter) { + ($portFilter.LocalPort -in $riskyPorts) -or ($portFilter.RemotePort -in $riskyPorts) + } + else { + $false + } + } + + foreach ($rule in $riskyRules) { + if ($rule.Enabled -eq $true) { + $portFilter = $allPortFilters[$rule.InstanceID] + + if ($rule.Action -eq 'Allow') { + $result.EnabledRules++ + $result.Details += "WARNING: Allow rule '$($rule.DisplayName)' is ENABLED (Port: $($portFilter.LocalPort))" + } + else { + $result.Details += "INFO: Block rule '$($rule.DisplayName)' is ENABLED (Port: $($portFilter.LocalPort))" + } + } + else { + $result.DisabledRules++ + } + } + + # Check actual port listeners + foreach ($port in $riskyPorts) { + if ($port -in @(137, 138, 139, 2869)) { + # TCP ports + $listener = Get-NetTCPConnection -LocalPort $port -State Listen -ErrorAction SilentlyContinue + if ($listener) { + $result.OpenPorts += "TCP $port" + $result.Details += "OPEN: TCP port $port is LISTENING!" + } + } + else { + # UDP ports (5355, 1900) + $listener = Get-NetUDPEndpoint -LocalPort $port -ErrorAction SilentlyContinue + if ($listener) { + $result.OpenPorts += "UDP $port" + $result.Details += "OPEN: UDP port $port is LISTENING!" + } + } + } + + # Determine compliance + $udp1900Open = $result.OpenPorts -contains "UDP 1900" + $otherOpenPorts = $result.OpenPorts | Where-Object { $_ -ne "UDP 1900" } + + if ($result.OpenPorts.Count -eq 0 -and $result.EnabledRules -eq 0) { + # Ideal case: no listeners and no allow rules + $result.Status = "Secure" + $result.Compliant = $true + $result.Details += "All risky ports closed and firewall rules disabled" + } + elseif ($udp1900Open -and -not $otherOpenPorts -and $result.EnabledRules -eq 0 -and $ssdpBlockActive) { + # Only open endpoint is UDP 1900, but protected by NoID block rule (inbound) + $result.Status = "Secure (blocked by firewall)" + $result.Compliant = $true + $result.Details += "UDP 1900 is listening locally but inbound traffic is blocked by '$ssdpRuleName'" + } + elseif ($result.OpenPorts.Count -eq 0 -and $result.EnabledRules -gt 0) { + $result.Status = "Partially Secure" + $result.Compliant = $false + $result.Details += "Ports closed but $($result.EnabledRules) firewall rules still enabled" + } + else { + $result.Status = "Insecure" + $result.Compliant = $false + } + + return $result + } + catch { + Write-Log -Level ERROR -Message "Failed to test risky ports: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return [PSCustomObject]@{ + Feature = "Risky Firewall Ports" + Status = "Error" + Details = @("Failed to test: $_") + Compliant = $false + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-RiskyServices.ps1 b/Modules/AdvancedSecurity/Private/Test-RiskyServices.ps1 new file mode 100644 index 0000000..9a10669 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-RiskyServices.ps1 @@ -0,0 +1,89 @@ +function Test-RiskyServices { + <# + .SYNOPSIS + Test risky network services compliance + + .DESCRIPTION + Checks if risky network services (SSDPSRV, upnphost, lmhosts) are stopped and disabled + + .EXAMPLE + Test-RiskyServices + #> + [CmdletBinding()] + param() + + try { + $result = [PSCustomObject]@{ + Feature = "Risky Network Services" + Status = "Unknown" + Details = @() + RunningServices = @() + StoppedServices = @() + Compliant = $false + } + + # Note: Computer Browser (Browser) is deprecated in Win10/11 - not included + $services = @("SSDPSRV", "upnphost", "lmhosts") + + foreach ($svcName in $services) { + $service = Get-Service -Name $svcName -ErrorAction SilentlyContinue + + if (-not $service) { + $result.Details += "$svcName - Not found (service may not be installed)" + continue + } + + if ($service.Status -eq 'Running') { + $result.RunningServices += $svcName + $result.Details += "WARNING - $svcName is RUNNING (StartType: $($service.StartType))" + } + else { + $result.StoppedServices += $svcName + + if ($service.StartType -eq 'Disabled') { + $result.Details += "${svcName}: Stopped and Disabled" + } + else { + $result.Details += "WARNING: ${svcName} is stopped but StartType is $($service.StartType) (should be Disabled)" + } + } + } + + # Determine compliance + if ($result.RunningServices.Count -eq 0) { + $stoppedAndDisabled = $true + + foreach ($svcName in $services) { + $service = Get-Service -Name $svcName -ErrorAction SilentlyContinue + if ($service -and $service.StartType -ne 'Disabled') { + $stoppedAndDisabled = $false + break + } + } + + if ($stoppedAndDisabled) { + $result.Status = "Secure" + $result.Compliant = $true + } + else { + $result.Status = "Partially Secure" + $result.Compliant = $false + } + } + else { + $result.Status = "Insecure" + $result.Compliant = $false + } + + return $result + } + catch { + Write-Log -Level ERROR -Message "Failed to test risky services: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return [PSCustomObject]@{ + Feature = "Risky Network Services" + Status = "Error" + Details = @("Failed to test: $_") + Compliant = $false + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-SRPCompliance.ps1 b/Modules/AdvancedSecurity/Private/Test-SRPCompliance.ps1 new file mode 100644 index 0000000..25fb4a4 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-SRPCompliance.ps1 @@ -0,0 +1,126 @@ +function Test-SRPCompliance { + <# + .SYNOPSIS + Verifies Software Restriction Policies (SRP) configuration for CVE-2025-9491 + + .DESCRIPTION + Tests whether SRP rules are correctly configured to block .lnk execution from Temp/Downloads. + Returns compliance status for CVE-2025-9491 mitigation. + + .EXAMPLE + Test-SRPCompliance + + .OUTPUTS + PSCustomObject with compliance results + #> + + [CmdletBinding()] + param() + + try { + $configPath = Join-Path $PSScriptRoot "..\Config\SRP-Rules.json" + + if (-not (Test-Path $configPath)) { + return [PSCustomObject]@{ + Feature = "SRP Configuration" + Status = "Not Configured" + Compliant = $false + Details = "SRP-Rules.json not found" + } + } + + $config = Get-Content $configPath -Raw | ConvertFrom-Json + $policyRoot = $config.RegistryPaths.PolicyRoot + + # Check if SRP policy exists + if (-not (Test-Path $policyRoot)) { + Write-Log -Level WARNING -Message "SRP Check Failed: Policy root not found ($policyRoot)" -Module "AdvancedSecurity" + return [PSCustomObject]@{ + Feature = "SRP CVE-2025-9491" + Status = "Not Configured" + Compliant = $false + Details = "SRP policy root not found" + } + } + + # Check Default Level + $defaultLevel = Get-ItemProperty -Path $policyRoot -Name "DefaultLevel" -ErrorAction SilentlyContinue + if ($null -eq $defaultLevel -or $defaultLevel.DefaultLevel -ne 262144) { + Write-Log -Level WARNING -Message "SRP Check Failed: DefaultLevel is not Unrestricted (262144)" -Module "AdvancedSecurity" + return [PSCustomObject]@{ + Feature = "SRP CVE-2025-9491" + Status = "Misconfigured" + Compliant = $false + Details = "Default level not set to Unrestricted (262144)" + } + } + + # Check Path Rules + $pathRulesRoot = $config.RegistryPaths.PathRules + + if (-not (Test-Path $pathRulesRoot)) { + Write-Log -Level WARNING -Message "SRP Check Failed: PathRules root not found ($pathRulesRoot)" -Module "AdvancedSecurity" + return [PSCustomObject]@{ + Feature = "SRP CVE-2025-9491" + Status = "Incomplete" + Compliant = $false + Details = "Path rules not configured" + } + } + + # Count configured rules + $configuredRules = Get-ChildItem -Path $pathRulesRoot -ErrorAction SilentlyContinue + $ruleCount = if ($configuredRules) { $configuredRules.Count } else { 0 } + + # Check for Windows 11 bug + $bugFixPath = $config.RegistryPaths.Win11BugFix + $hasBuggyKeys = $false + + if (Test-Path $bugFixPath) { + foreach ($keyName in $config.Windows11BugFix.KeysToRemove) { + $keyExists = Get-ItemProperty -Path $bugFixPath -Name $keyName -ErrorAction SilentlyContinue + if ($null -ne $keyExists) { + $hasBuggyKeys = $true + break + } + } + } + + if ($hasBuggyKeys) { + Write-Log -Level WARNING -Message "SRP Check Failed: Windows 11 buggy keys present (RuleCount/LastWriteTime)" -Module "AdvancedSecurity" + return [PSCustomObject]@{ + Feature = "SRP CVE-2025-9491" + Status = "Windows 11 Bug Detected" + Compliant = $false + Details = "Buggy registry keys present (RuleCount/LastWriteTime) - SRP may not work" + } + } + + # All checks passed + if ($ruleCount -ge 2) { + return [PSCustomObject]@{ + Feature = "SRP CVE-2025-9491" + Status = "Protected" + Compliant = $true + Details = "$ruleCount path rules configured, Windows 11 bug fix applied" + } + } + else { + Write-Log -Level WARNING -Message "SRP Check Failed: Insufficient rules found ($ruleCount, expected 2+)" -Module "AdvancedSecurity" + return [PSCustomObject]@{ + Feature = "SRP CVE-2025-9491" + Status = "Incomplete" + Compliant = $false + Details = "Only $ruleCount path rules found (expected 2+)" + } + } + } + catch { + return [PSCustomObject]@{ + Feature = "SRP CVE-2025-9491" + Status = "Error" + Compliant = $false + Details = "Test failed: $_" + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-WDigest.ps1 b/Modules/AdvancedSecurity/Private/Test-WDigest.ps1 new file mode 100644 index 0000000..eec7eb9 --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-WDigest.ps1 @@ -0,0 +1,130 @@ +function Test-WDigest { + <# + .SYNOPSIS + Test WDigest credential protection compliance + + .DESCRIPTION + Verifies that WDigest is configured to NOT store plaintext credentials in LSASS memory. + Checks the UseLogonCredential registry value. + + Expected: UseLogonCredential = 0 (Secure) + Insecure: UseLogonCredential = 1 (Plaintext credentials in memory!) + + .EXAMPLE + Test-WDigest + Returns compliance status for WDigest protection + + .OUTPUTS + PSCustomObject with compliance details + #> + [CmdletBinding()] + param() + + try { + $wdigestRegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" + + $result = [PSCustomObject]@{ + Feature = "WDigest Protection" + Status = "Unknown" + Details = @() + UseLogonCredential = $null + Compliant = $false + Windows_Version = "" + Deprecated = $false + } + + # Get Windows version + $osVersion = [System.Environment]::OSVersion.Version + $isWin11 = $osVersion.Major -ge 10 -and $osVersion.Build -ge 22000 + $isWin11_24H2Plus = $isWin11 -and $osVersion.Build -ge 26100 + + if ($isWin11) { + $result.Windows_Version = "Windows 11 (Build $($osVersion.Build))" + if ($isWin11_24H2Plus) { + $result.Deprecated = $true + $result.Details += "Windows 11 24H2+ detected - WDigest setting is deprecated" + } + } + elseif ($osVersion.Major -eq 10) { + $result.Windows_Version = "Windows 10 (Build $($osVersion.Build))" + } + else { + $result.Windows_Version = "Windows $($osVersion.Major).$($osVersion.Minor) (Build $($osVersion.Build))" + } + + # Check registry value + if (Test-Path $wdigestRegPath) { + $useLogonCred = (Get-ItemProperty -Path $wdigestRegPath -Name "UseLogonCredential" -ErrorAction SilentlyContinue).UseLogonCredential + + if ($null -ne $useLogonCred) { + $result.UseLogonCredential = $useLogonCred + + if ($useLogonCred -eq 0) { + $result.Status = "Secure" + $result.Compliant = $true + $result.Details += "UseLogonCredential = 0 (Plaintext credentials NOT stored)" + + if ($result.Deprecated) { + $result.Details += "Note: Setting is deprecated but explicitly configured for backwards compatibility" + } + } + elseif ($useLogonCred -eq 1) { + $result.Status = "INSECURE!" + $result.Compliant = $false + $result.Details += "WARNING: UseLogonCredential = 1 (Plaintext credentials IN MEMORY!)" + $result.Details += "VULNERABLE to Mimikatz, WCE, and other credential dumping tools!" + } + else { + $result.Status = "Unknown Value" + $result.Compliant = $false + $result.Details += "UseLogonCredential = $useLogonCred (Unknown value)" + } + } + else { + # Value not set - default depends on OS version + if ($osVersion.Major -eq 6 -and $osVersion.Minor -le 2) { + # Windows 7/8 - default is 1 (INSECURE!) + $result.Status = "Insecure (Default)" + $result.Compliant = $false + $result.Details += "UseLogonCredential not set - Windows 7/8 default is 1 (INSECURE!)" + } + else { + # Windows 8.1+ - default is 0 (Secure) + $result.Status = "Secure (Default)" + $result.Compliant = $true + $result.Details += "UseLogonCredential not set - Windows 8.1+ default is 0 (Secure)" + + if ($result.Deprecated) { + $result.Details += "Windows 11 24H2+: Setting is hardcoded secure (deprecated)" + } + } + } + } + else { + # Registry path doesn't exist + if ($osVersion.Major -eq 6 -and $osVersion.Minor -le 2) { + # Windows 7/8 + $result.Status = "Insecure (No Config)" + $result.Compliant = $false + $result.Details += "WDigest registry path not found - Windows 7/8 default is INSECURE!" + } + else { + # Windows 8.1+ + $result.Status = "Secure (Default)" + $result.Compliant = $true + $result.Details += "WDigest registry path not found - Windows 8.1+ default is secure" + } + } + + return $result + } + catch { + Write-Log -Level ERROR -Message "Failed to test WDigest protection: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return [PSCustomObject]@{ + Feature = "WDigest Protection" + Status = "Error" + Details = @("Failed to test: $_") + Compliant = $false + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-WPAD.ps1 b/Modules/AdvancedSecurity/Private/Test-WPAD.ps1 new file mode 100644 index 0000000..2c974cd --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-WPAD.ps1 @@ -0,0 +1,88 @@ +function Test-WPAD { + <# + .SYNOPSIS + Test WPAD configuration compliance + + .DESCRIPTION + Verifies that Web Proxy Auto-Discovery (WPAD) is disabled using the official + Microsoft-recommended key plus legacy keys for compatibility. + + Reference: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/disable-http-proxy-auth-features + + .OUTPUTS + PSCustomObject with compliance details + #> + [CmdletBinding()] + param() + + try { + $result = [PSCustomObject]@{ + Feature = "WPAD (Proxy Auto-Discovery)" + Status = "Unknown" + Details = @() + Compliant = $true + } + + $wpadKeys = @( + @{ + Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp" + Name = "DisableWpad" + Expected = 1 + Description = "Official MS key (Win10 1809+)" + }, + @{ + Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" + Name = "WpadOverride" + Expected = 1 + Description = "Legacy override key" + }, + @{ + Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" + Name = "AutoDetect" + Expected = 0 + Description = "Browser-level HKLM" + } + ) + + $nonCompliantCount = 0 + + foreach ($key in $wpadKeys) { + if (Test-Path $key.Path) { + $val = (Get-ItemProperty -Path $key.Path -Name $key.Name -ErrorAction SilentlyContinue).($key.Name) + + if ($val -eq $key.Expected) { + # Compliant + } + else { + $result.Details += "$($key.Name) is NOT set to $($key.Expected) (Current: $val)" + $nonCompliantCount++ + } + } + else { + # Key missing + $result.Details += "Registry key missing: $($key.Path)" + $nonCompliantCount++ + } + } + + if ($nonCompliantCount -eq 0) { + $result.Status = "Secure (Disabled)" + $result.Compliant = $true + } + else { + $result.Status = "Insecure ($nonCompliantCount issues)" + $result.Compliant = $false + } + + return $result + } + catch { + Write-Log -Level ERROR -Message "Failed to test WPAD: $_" -Module "AdvancedSecurity" + return [PSCustomObject]@{ + Feature = "WPAD (Proxy Auto-Discovery)" + Status = "Error" + Details = @("Failed to test: $_") + Compliant = $false + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-WindowsUpdate.ps1 b/Modules/AdvancedSecurity/Private/Test-WindowsUpdate.ps1 new file mode 100644 index 0000000..f08e40d --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-WindowsUpdate.ps1 @@ -0,0 +1,91 @@ +function Test-WindowsUpdate { + <# + .SYNOPSIS + Verifies Windows Update configuration (3 simple GUI settings) + + .DESCRIPTION + Tests whether the 3 Windows Update GUI settings are properly configured: + 1. Get latest updates immediately + 2. Microsoft Update for other products + 3. Delivery Optimization disabled + + .EXAMPLE + Test-WindowsUpdate + + .OUTPUTS + PSCustomObject with compliance results + #> + + [CmdletBinding()] + param() + + try { + $configPath = Join-Path $PSScriptRoot "..\Config\WindowsUpdate.json" + + if (-not (Test-Path $configPath)) { + return [PSCustomObject]@{ + Feature = "Windows Update" + Status = "Not Configured" + Compliant = $false + Details = "WindowsUpdate.json not found" + } + } + + $config = Get-Content $configPath -Raw | ConvertFrom-Json + + $settingsConfigured = 0 + $settingsTotal = 0 + $details = @() + + # Check all 3 settings from config + foreach ($settingKey in $config.Settings.PSObject.Properties.Name) { + $setting = $config.Settings.$settingKey + $regPath = $setting.RegistryPath + + foreach ($valueName in $setting.Values.PSObject.Properties.Name) { + $valueData = $setting.Values.$valueName + $settingsTotal++ + + if (Test-Path $regPath) { + $actual = Get-ItemProperty -Path $regPath -Name $valueName -ErrorAction SilentlyContinue + + if ($null -ne $actual -and $actual.$valueName -eq $valueData.Value) { + $settingsConfigured++ + $details += "$($setting.Name): OK" + } + else { + $details += "$($setting.Name): NOT SET" + Write-Log -Level WARNING -Message "Windows Update Check Failed: $($setting.Name)" -Module "AdvancedSecurity" + if ($null -eq $actual) { + Write-Log -Level WARNING -Message " - Value '$valueName' not found in $regPath" -Module "AdvancedSecurity" + } else { + Write-Log -Level WARNING -Message " - Value '$valueName' mismatch. Expected: $($valueData.Value), Actual: $($actual.$valueName)" -Module "AdvancedSecurity" + } + } + } + else { + $details += "$($setting.Name): NOT SET (reg path missing)" + Write-Log -Level WARNING -Message "Windows Update Check Failed: $($setting.Name)" -Module "AdvancedSecurity" + Write-Log -Level WARNING -Message " - Registry Path Missing: $regPath" -Module "AdvancedSecurity" + } + } + } + + $compliant = ($settingsConfigured -eq $settingsTotal) + + return [PSCustomObject]@{ + Feature = "Windows Update" + Status = if ($compliant) { "Configured" } else { "Incomplete" } + Compliant = $compliant + Details = "$settingsConfigured/$settingsTotal settings OK. $(if ($details) { $details -join ', ' })" + } + } + catch { + return [PSCustomObject]@{ + Feature = "Windows Update" + Status = "Error" + Compliant = $false + Details = "Test failed: $_" + } + } +} diff --git a/Modules/AdvancedSecurity/Private/Test-WirelessDisplaySecurity.ps1 b/Modules/AdvancedSecurity/Private/Test-WirelessDisplaySecurity.ps1 new file mode 100644 index 0000000..8faa91e --- /dev/null +++ b/Modules/AdvancedSecurity/Private/Test-WirelessDisplaySecurity.ps1 @@ -0,0 +1,70 @@ +function Test-WirelessDisplaySecurity { + <# + .SYNOPSIS + Tests Wireless Display (Miracast) security configuration. + + .DESCRIPTION + Verifies that Wireless Display policies are configured securely: + - AllowProjectionToPC = 0 (blocking receiving) + - RequirePinForPairing = 2 (always require PIN) + - Optionally: Complete disable of all Wireless Display + + .EXAMPLE + Test-WirelessDisplaySecurity + #> + [CmdletBinding()] + param() + + try { + $connectPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect" + + $results = @{ + AllowProjectionToPC = $null + RequirePinForPairing = $null + AllowProjectionFromPC = $null + AllowMdnsAdvertisement = $null + AllowMdnsDiscovery = $null + WiFiDirectServiceDisabled = $null + Compliant = $false + FullyDisabled = $false + } + + if (Test-Path $connectPath) { + $props = Get-ItemProperty -Path $connectPath -ErrorAction SilentlyContinue + + # Check basic hardening (always required) + $results.AllowProjectionToPC = $props.AllowProjectionToPC + $results.RequirePinForPairing = $props.RequirePinForPairing + + # Check optional complete disable + $results.AllowProjectionFromPC = $props.AllowProjectionFromPC + $results.AllowMdnsAdvertisement = $props.AllowMdnsAdvertisement + $results.AllowMdnsDiscovery = $props.AllowMdnsDiscovery + + # Check WiFi Direct Service status (CRITICAL for complete block) + $wfdService = Get-Service -Name "WFDSConMgrSvc" -ErrorAction SilentlyContinue + $results.WiFiDirectServiceDisabled = ($null -eq $wfdService) -or ($wfdService.StartType -eq 'Disabled') + + # Basic compliance: receiving blocked + PIN required + $results.Compliant = ($results.AllowProjectionToPC -eq 0) -and ($results.RequirePinForPairing -eq 2) + + # Fully disabled: all settings at 0/2 AND WiFi Direct service disabled + $results.FullyDisabled = $results.Compliant -and + ($results.AllowProjectionFromPC -eq 0) -and + ($results.AllowMdnsAdvertisement -eq 0) -and + ($results.AllowMdnsDiscovery -eq 0) -and + $results.WiFiDirectServiceDisabled + } + else { + # Key doesn't exist = not hardened + $results.Compliant = $false + $results.FullyDisabled = $false + } + + return [PSCustomObject]$results + } + catch { + Write-Log -Level ERROR -Message "Failed to test Wireless Display security: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $null + } +} diff --git a/Modules/AdvancedSecurity/Public/Invoke-AdvancedSecurity.ps1 b/Modules/AdvancedSecurity/Public/Invoke-AdvancedSecurity.ps1 new file mode 100644 index 0000000..a94d70a --- /dev/null +++ b/Modules/AdvancedSecurity/Public/Invoke-AdvancedSecurity.ps1 @@ -0,0 +1,1141 @@ +function Invoke-AdvancedSecurity { + <# + .SYNOPSIS + Apply Advanced Security hardening based on selected profile + + .DESCRIPTION + Applies advanced security hardening settings beyond Microsoft Security Baseline. + + Features 3 profiles: + - Home: Safe defaults for home users and workstations + - Enterprise: Conservative approach with domain-safety checks + - Maximum: Maximum hardening for air-gapped/high-security environments + + Features implemented (v2.2.0): + - RDP NLA enforcement + optional complete disable + - WDigest credential protection + - Administrative shares disable (domain-aware) + - Risky firewall ports closure (LLMNR, NetBIOS, UPnP/SSDP) + - Risky network services stop + - Legacy TLS 1.0/1.1 disable + - WPAD auto-discovery disable + - PowerShell v2 removal + + .PARAMETER SecurityProfile + Security profile to apply: + - Home: Safe for home users and workstations (default) + - Enterprise: Safe for corporate environments + - Maximum: Maximum hardening for air-gapped systems + + .PARAMETER DisableRDP + Completely disable Remote Desktop Protocol (bypasses interactive prompt for Home profile, AirGapped always disables) + + .PARAMETER Force + Force operations that are normally skipped (e.g., admin shares on domain-joined systems) + + .PARAMETER WhatIf + Show what would be changed without actually applying changes + + .PARAMETER SkipBackup + Skip backup creation (NOT RECOMMENDED!) + + .PARAMETER DryRun + Preview changes without applying them (alias for WhatIf) + + .EXAMPLE + Invoke-AdvancedSecurity -SecurityProfile Home + Applies safe hardening for home users + + .EXAMPLE + Invoke-AdvancedSecurity -SecurityProfile Enterprise -WhatIf + Preview changes for enterprise environment + + .EXAMPLE + Invoke-AdvancedSecurity -SecurityProfile Maximum -DisableRDP -Force + Maximum hardening with RDP disable for air-gapped system + #> + [CmdletBinding(SupportsShouldProcess = $true)] + param( + [Parameter(Mandatory = $false)] + [ValidateSet('Balanced', 'Enterprise', 'Maximum')] + [string]$SecurityProfile = 'Balanced', + + [Parameter(Mandatory = $false)] + [switch]$DisableRDP, + + [Parameter(Mandatory = $false)] + [switch]$Force, + + [Parameter(Mandatory = $false)] + [switch]$DryRun, + + [Parameter(Mandatory = $false)] + [switch]$SkipBackup + ) + + try { + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host " ADVANCED SECURITY MODULE" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + + if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { + Write-Host "ERROR: Administrator rights required!" -ForegroundColor Red + Write-Host "Please run this script as Administrator." -ForegroundColor Yellow + Write-Host "" + return [PSCustomObject]@{ + Success = $false + ErrorMessage = "Administrator rights required" + } + } + + # Detect Domain membership EARLY for better recommendations + $computerSystem = Get-CimInstance -ClassName Win32_ComputerSystem + $isDomainJoined = $computerSystem.PartOfDomain + + # Profile Selection - NonInteractive or Interactive + if (-not $PSBoundParameters.ContainsKey('SecurityProfile')) { + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - use config value + $SecurityProfile = Get-NonInteractiveValue -Module "AdvancedSecurity" -Key "securityProfile" -Default "Home" + Write-NonInteractiveDecision -Module "AdvancedSecurity" -Decision "Security Profile" -Value $SecurityProfile + } + else { + # Interactive mode + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " SECURITY PROFILE SELECTION" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + + # Show domain status if applicable + if ($isDomainJoined) { + Write-Host "SYSTEM STATUS: Domain-joined" -ForegroundColor Yellow + Write-Host "Domain: $($computerSystem.Domain)" -ForegroundColor Gray + Write-Host "" + } + + Write-Host "Choose your security profile:" -ForegroundColor White + Write-Host "" + Write-Host " [1] Balanced" -ForegroundColor $(if (-not $isDomainJoined) { "Cyan" } else { "White" }) + Write-Host " - For: Home users, standalone workstations" -ForegroundColor Gray + Write-Host " - All security features enabled" -ForegroundColor Gray + Write-Host " - Domain-aware admin shares (asks on domain systems)" -ForegroundColor Gray + if (-not $isDomainJoined) { + Write-Host " (Recommended for your system)" -ForegroundColor Cyan + } + Write-Host "" + Write-Host " [2] Enterprise" -ForegroundColor $(if ($isDomainJoined) { "Cyan" } else { "White" }) + Write-Host " - For: Corporate/managed environments" -ForegroundColor Gray + Write-Host " - Keeps admin shares on domain (for IT management)" -ForegroundColor Gray + Write-Host " - Safe for business networks" -ForegroundColor Gray + if ($isDomainJoined) { + Write-Host " (Recommended for your domain system)" -ForegroundColor Cyan + } + Write-Host "" + Write-Host " [3] Maximum" -ForegroundColor White + Write-Host " - For: High-security environments" -ForegroundColor Gray + Write-Host " - Maximum hardening, no compromises" -ForegroundColor Gray + Write-Host " - RDP always disabled, Shields Up enabled" -ForegroundColor Gray + Write-Host "" + + $defaultChoice = if ($isDomainJoined) { '2' } else { '1' } + $profileChoice = Read-Host "Select profile [1-3] (default: $defaultChoice)" + + # Use default if empty + if ([string]::IsNullOrWhiteSpace($profileChoice)) { + $profileChoice = $defaultChoice + } + + switch ($profileChoice) { + '2' { $SecurityProfile = 'Enterprise'; Write-Host ""; Write-Host " Selected: Enterprise" -ForegroundColor Green } + '3' { $SecurityProfile = 'Maximum'; Write-Host ""; Write-Host " Selected: Maximum" -ForegroundColor Green } + default { $SecurityProfile = 'Balanced'; Write-Host ""; Write-Host " Selected: Balanced" -ForegroundColor Cyan } + } + Write-Log -Level DEBUG -Message "User selected AdvancedSecurity profile: $SecurityProfile" -Module "AdvancedSecurity" + Write-Host "" + } + } + + Write-Host "Profile: $SecurityProfile" -ForegroundColor White + Write-Host "" + + # Display profile info + switch ($SecurityProfile) { + 'Balanced' { + Write-Host "For: Home users, workstations" -ForegroundColor White + Write-Host " - RDP disable recommended (asks user, default: disable)" -ForegroundColor Gray + Write-Host " - UPnP/SSDP block recommended (asks user, default: block)" -ForegroundColor Gray + Write-Host " - WDigest, Admin Shares (domain-aware), Legacy TLS, PSv2" -ForegroundColor Gray + } + 'Enterprise' { + Write-Host "For: Corporate environments" -ForegroundColor White + Write-Host " - RDP hardening only (no disable), UPnP blocked" -ForegroundColor Gray + Write-Host " - Admin Shares kept on domain (for IT management)" -ForegroundColor Gray + Write-Host " - WDigest, LLMNR/NetBIOS, Legacy TLS, PSv2" -ForegroundColor Gray + } + 'Maximum' { + Write-Host "For: Air-gapped, high-security systems" -ForegroundColor White + Write-Host " - RDP always disabled (no remote access)" -ForegroundColor Gray + Write-Host " - Admin Shares forced, UPnP blocked, all protocols disabled" -ForegroundColor Gray + Write-Host " - Firewall Shields Up: Block ALL incoming on Public network" -ForegroundColor Gray + Write-Host " - WDigest, LLMNR/NetBIOS, Legacy TLS, PSv2" -ForegroundColor Gray + } + } + Write-Host "" + + # WARNING PROMPT: Inform about breaking changes + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " IMPORTANT NOTICES" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "This module will apply the following changes:" -ForegroundColor White + Write-Host "" + Write-Host " Security Hardening:" -ForegroundColor Green + Write-Host " + RDP hardening (NLA + SSL/TLS enforcement)" -ForegroundColor Gray + Write-Host " + WDigest protection (credential security)" -ForegroundColor Gray + + # Profile-specific protocol blocking info + if ($SecurityProfile -eq 'Balanced') { + Write-Host " + Risky protocols: LLMNR, NetBIOS blocked | UPnP/SSDP (asks user)" -ForegroundColor Gray + } + else { + Write-Host " + Risky protocols blocked (LLMNR, NetBIOS, UPnP/SSDP)" -ForegroundColor Gray + } + + Write-Host "" + Write-Host " Potential Breaking Changes:" -ForegroundColor Red + Write-Host " ! PowerShell v2 removal (REBOOT REQUIRED after completion)" -ForegroundColor Yellow + Write-Host " ! Legacy TLS 1.0/1.1 disabled (old devices may fail)" -ForegroundColor Yellow + + # Profile-specific UPnP warning + if ($SecurityProfile -eq 'Balanced') { + Write-Host " ! UPnP/SSDP may be blocked (you will be asked for DLNA compatibility)" -ForegroundColor Yellow + } + else { + Write-Host " ! UPnP/SSDP blocked (DLNA media streaming will not work)" -ForegroundColor Yellow + } + + Write-Host " ! NetBIOS blocked (\\HOSTNAME\ requires DNS or .local suffix)" -ForegroundColor Yellow + Write-Host "" + Write-Host " Devices that will still work:" -ForegroundColor Cyan + Write-Host " + Network printers (via IP or vendor software)" -ForegroundColor Gray + Write-Host " + NAS devices (via \\IP\ or manual mapping)" -ForegroundColor Gray + Write-Host " + Smart home devices (modern apps use mDNS/Cloud)" -ForegroundColor Gray + Write-Host " + Streaming services (Netflix, YouTube, Spotify, etc.)" -ForegroundColor Gray + Write-Host "" + + # Continue confirmation - auto-confirm in NonInteractive mode + if (-not (Test-NonInteractiveMode)) { + $continueChoice = Read-Host "Continue with hardening? [Y/N] (default: Y)" + + if ($continueChoice -eq 'N' -or $continueChoice -eq 'n') { + Write-Host "" + Write-Host "Hardening cancelled by user." -ForegroundColor Yellow + Write-Host "" + Write-Log -Level WARNING -Message "User cancelled AdvancedSecurity hardening at confirmation prompt" -Module "AdvancedSecurity" + return [PSCustomObject]@{ + Success = $false + ErrorMessage = "Cancelled by user" + } + } + } + + Write-Host "" + Write-Host "Proceeding with security hardening..." -ForegroundColor Green + Write-Host "" + + # Maximum: RDP is ALWAYS disabled (no prompt - air-gapped means no network!) + if (-not $PSBoundParameters.ContainsKey('DisableRDP') -and $SecurityProfile -eq 'Maximum') { + $DisableRDP = $true + Write-Log -Level INFO -Message "Profile 'Maximum': RDP will be completely disabled automatically" -Module "AdvancedSecurity" + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " REMOTE DESKTOP (RDP)" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + Write-Host " RDP will be COMPLETELY DISABLED (Air-gapped system)" -ForegroundColor Red + Write-Host " - No remote access on offline systems" -ForegroundColor Gray + Write-Host " - Hardening applied before disable" -ForegroundColor Gray + Write-Host "" + } + + # RDP Complete Disable - NonInteractive or Interactive (Home profile only for interactive) + # NOTE: RDP is ALWAYS hardened (NLA + SSL/TLS), this prompt is only for complete disable + # NonInteractive: ALWAYS read config value (respects user choice in any profile) + # Interactive: Only prompt for Home profile (Enterprise/AirGapped have fixed behavior) + if (-not $PSBoundParameters.ContainsKey('DisableRDP')) { + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - ALWAYS read config value (even for Enterprise) + # This respects explicit user choice in config.json + $configDisableRDP = Get-NonInteractiveValue -Module "AdvancedSecurity" -Key "disableRDP" -Default ($SecurityProfile -eq 'Balanced') + $DisableRDP = $configDisableRDP + Write-NonInteractiveDecision -Module "AdvancedSecurity" -Decision "RDP" -Value $(if ($DisableRDP) { "Disabled" } else { "Hardened only" }) + } + elseif ($SecurityProfile -eq 'Balanced') { + # Interactive mode + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " REMOTE DESKTOP (RDP) CONFIGURATION" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "RDP is a common target for ransomware and cyber attacks." -ForegroundColor White + Write-Host "" + Write-Host "Do you want to COMPLETELY DISABLE Remote Desktop (until you manually re-enable it in Settings)?" -ForegroundColor White + Write-Host "" + Write-Host " [Y] YES - Completely disable RDP (Recommended for security)" -ForegroundColor Cyan + Write-Host " - Maximum security - no RDP attack surface" -ForegroundColor Gray + Write-Host " - Recommended for home users who don't use remote access" -ForegroundColor Gray + Write-Host " - Can be re-enabled later if needed" -ForegroundColor Gray + Write-Host "" + Write-Host " [N] NO - Keep RDP hardened and enabled (For remote access)" -ForegroundColor White + Write-Host " - RDP remains usable with strong security" -ForegroundColor Gray + Write-Host " - Network Level Authentication + SSL/TLS enforced" -ForegroundColor Gray + Write-Host " - Useful if you need remote desktop access" -ForegroundColor Gray + Write-Host "" + + $rdpChoice = Read-Host "Disable RDP completely? [Y/N] (default: Y)" + + if ($rdpChoice -eq 'N' -or $rdpChoice -eq 'n') { + $DisableRDP = $false + Write-Host "" + Write-Host " RDP will be HARDENED and kept enabled" -ForegroundColor Cyan + Write-Log -Level INFO -Message "User decision: RDP will be hardened and kept enabled" -Module "AdvancedSecurity" + } + else { + $DisableRDP = $true + Write-Host "" + Write-Host " RDP will be HARDENED and then DISABLED (you can re-enable it later in Settings)" -ForegroundColor Green + Write-Log -Level INFO -Message "User decision: RDP will be hardened then completely disabled" -Module "AdvancedSecurity" + } + Write-Host "" + } + } + + # Admin Shares Force (only on domain-joined systems with Home profile) - NonInteractive or Interactive + # Enterprise profile automatically keeps admin shares on domain (no prompt) + if (-not $PSBoundParameters.ContainsKey('Force') -and $isDomainJoined -and $SecurityProfile -eq 'Balanced') { + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - use config value + $Force = Get-NonInteractiveValue -Module "AdvancedSecurity" -Key "forceAdminShares" -Default $false + Write-NonInteractiveDecision -Module "AdvancedSecurity" -Decision "Admin Shares on domain" -Value $(if ($Force) { "Disabled (forced)" } else { "Kept" }) + } + else { + # Interactive mode + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " ADMIN SHARES CONFIGURATION" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "WARNING: This system is DOMAIN-JOINED!" -ForegroundColor Red + Write-Host "" + Write-Host "Domain: $($computerSystem.Domain)" -ForegroundColor Gray + Write-Host "" + Write-Host "Admin Shares (C$, ADMIN$, IPC$) are often used by IT management tools." -ForegroundColor White + Write-Host "" + Write-Host "Do you want to DISABLE admin shares anyway?" -ForegroundColor White + Write-Host "" + Write-Host " [N] NO - Keep admin shares (Recommended for domain)" -ForegroundColor Cyan + Write-Host " - IT can still manage this computer remotely" -ForegroundColor Gray + Write-Host " - SCCM, PDQ Deploy, PowerShell Remoting work" -ForegroundColor Gray + Write-Host " - Other security features still applied" -ForegroundColor Gray + Write-Host "" + Write-Host " [Y] YES - Disable admin shares anyway" -ForegroundColor White + Write-Host " - Maximum security but may break management tools" -ForegroundColor Gray + Write-Host " - IT cannot access C$, ADMIN$ remotely" -ForegroundColor Gray + Write-Host " - May require manual intervention from IT" -ForegroundColor Gray + Write-Host "" + + $adminShareChoice = Read-Host "Disable admin shares on domain system? [Y/N] (default: N)" + + if ($adminShareChoice -eq 'Y' -or $adminShareChoice -eq 'y') { + $Force = $true + Write-Host "" + Write-Host " Admin Shares will be DISABLED (may break IT tools)" -ForegroundColor Red + Write-Log -Level INFO -Message "User decision: Admin shares will be DISABLED on domain system" -Module "AdvancedSecurity" + } + else { + $Force = $false + Write-Host "" + Write-Host " Admin Shares will be KEPT (safe for domain)" -ForegroundColor Cyan + Write-Log -Level INFO -Message "User decision: Admin shares will be KEPT on domain system" -Module "AdvancedSecurity" + } + Write-Host "" + } + } + + # UPnP/SSDP Configuration - NonInteractive or Interactive (Home profile only for interactive) + # NonInteractive: ALWAYS read config value (respects user choice in any profile) + # Interactive: Only prompt for Home profile (Enterprise/AirGapped always block) + $DisableUPnP = $true # Default for all profiles + + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - ALWAYS read config value (even for Enterprise/AirGapped) + # This respects explicit user choice in config.json + $DisableUPnP = Get-NonInteractiveValue -Module "AdvancedSecurity" -Key "disableUPnP" -Default $true + Write-NonInteractiveDecision -Module "AdvancedSecurity" -Decision "UPnP/SSDP" -Value $(if ($DisableUPnP) { "Blocked" } else { "Allowed" }) + } + elseif ($SecurityProfile -eq 'Balanced') { + # Interactive mode + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " UPnP/SSDP CONFIGURATION" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "UPnP (Universal Plug and Play) is used by some devices for auto-discovery." -ForegroundColor White + Write-Host "" + Write-Host "SECURITY RISK:" -ForegroundColor Red + Write-Host " - Port forwarding vulnerabilities (NAT-PMP attacks)" -ForegroundColor Gray + Write-Host " - DDoS amplification attacks" -ForegroundColor Gray + Write-Host " - Network enumeration by attackers" -ForegroundColor Gray + Write-Host "" + Write-Host "WHAT BREAKS:" -ForegroundColor Yellow + Write-Host " ! DLNA Media Streaming (legacy local network discovery)" -ForegroundColor Gray + Write-Host " ! Windows Media Player to TV/receiver" -ForegroundColor Gray + Write-Host " ! Some gaming console auto-discovery features" -ForegroundColor Gray + Write-Host "" + Write-Host "WHAT STILL WORKS:" -ForegroundColor Cyan + Write-Host " + Network printers (use mDNS, not UPnP)" -ForegroundColor Gray + Write-Host " + Media streaming apps (Netflix, YouTube, Spotify, etc.)" -ForegroundColor Gray + Write-Host " + Modern media servers (use app-based access, not DLNA)" -ForegroundColor Gray + Write-Host " + Smart Home apps (Hue, Google, Alexa use mDNS/Cloud)" -ForegroundColor Gray + Write-Host " + Manual IP configuration for any device" -ForegroundColor Gray + Write-Host "" + Write-Host "Do you want to BLOCK UPnP/SSDP for security?" -ForegroundColor White + Write-Host "" + Write-Host " [Y] YES - Block UPnP/SSDP (Recommended for security)" -ForegroundColor Cyan + Write-Host " - Prevents port forwarding attacks" -ForegroundColor Gray + Write-Host " - Blocks DDoS amplification" -ForegroundColor Gray + Write-Host " - DLNA streaming will not work (use modern apps instead)" -ForegroundColor Gray + Write-Host "" + Write-Host " [N] NO - Keep UPnP/SSDP enabled" -ForegroundColor White + Write-Host " - DLNA streaming works" -ForegroundColor Gray + Write-Host " - Gaming console auto-discovery works" -ForegroundColor Gray + Write-Host " - Accepts security risk" -ForegroundColor Gray + Write-Host "" + + $upnpChoice = Read-Host "Block UPnP/SSDP? [Y/N] (default: Y)" + + if ($upnpChoice -eq 'N' -or $upnpChoice -eq 'n') { + $DisableUPnP = $false + Write-Host "" + Write-Host " UPnP/SSDP will be KEPT enabled (DLNA works)" -ForegroundColor Yellow + Write-Log -Level INFO -Message "User decision: UPnP/SSDP will be KEPT enabled" -Module "AdvancedSecurity" + } + else { + $DisableUPnP = $true + Write-Host "" + Write-Host " UPnP/SSDP will be BLOCKED (security hardening)" -ForegroundColor Green + Write-Log -Level INFO -Message "User decision: UPnP/SSDP will be BLOCKED" -Module "AdvancedSecurity" + } + Write-Host "" + } + + # Wireless Display Configuration - Optional complete disable + # Default for ALL profiles: Block receiving + Require PIN (always applied) + # Optional: Complete disable (user choice like UPnP) + $DisableWirelessDisplayCompletely = $false # Default: only harden, allow sending + + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - use config value + $DisableWirelessDisplayCompletely = Get-NonInteractiveValue -Module "AdvancedSecurity" -Key "disableWirelessDisplay" -Default $false + Write-NonInteractiveDecision -Module "AdvancedSecurity" -Decision "Wireless Display" -Value $(if ($DisableWirelessDisplayCompletely) { "Completely Disabled" } else { "Hardened (sending allowed)" }) + } + else { + # Interactive mode + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " WIRELESS DISPLAY (MIRACAST) SECURITY" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "Wireless Display allows screen mirroring to TVs/projectors." -ForegroundColor White + Write-Host "" + Write-Host "DEFAULT HARDENING (always applied):" -ForegroundColor Cyan + Write-Host " + Block receiving projections (PC can't be used as display)" -ForegroundColor Gray + Write-Host " + Require PIN for all pairing (prevents rogue connections)" -ForegroundColor Gray + Write-Host " + Sending to displays STILL WORKS (presentations, TV mirroring)" -ForegroundColor Green + Write-Host "" + Write-Host "SECURITY RISK if not completely disabled:" -ForegroundColor Red + Write-Host " - Attacker in network can set up fake display to capture your screen" -ForegroundColor Gray + Write-Host " - Man-in-the-middle attacks on Miracast traffic (WPS PIN cracking)" -ForegroundColor Gray + Write-Host " - mDNS spoofing for rogue receiver discovery" -ForegroundColor Gray + Write-Host "" + Write-Host "WHAT BREAKS if completely disabled:" -ForegroundColor Yellow + Write-Host " ! Cannot mirror screen to TV/projector via Miracast" -ForegroundColor Gray + Write-Host " ! Windows + K shortcut won't find wireless displays" -ForegroundColor Gray + Write-Host " ! (HDMI/USB-C cables still work)" -ForegroundColor Gray + Write-Host "" + Write-Host "Do you want to COMPLETELY DISABLE Wireless Display?" -ForegroundColor White + Write-Host "" + Write-Host " [Y] YES - Complete disable (Maximum security)" -ForegroundColor Cyan + Write-Host " - All Miracast functionality blocked" -ForegroundColor Gray + Write-Host " - Ports 7236/7250 blocked" -ForegroundColor Gray + Write-Host " - Use HDMI/USB-C for presentations" -ForegroundColor Gray + Write-Host "" + Write-Host " [N] NO - Keep hardened only (Default, Recommended)" -ForegroundColor Green + Write-Host " - Can still send to TVs/projectors" -ForegroundColor Gray + Write-Host " - PC cannot receive/be misused as display" -ForegroundColor Gray + Write-Host " - PIN always required" -ForegroundColor Gray + Write-Host "" + + $wirelessChoice = Read-Host "Completely disable Wireless Display? [Y/N] (default: N)" + + if ($wirelessChoice -eq 'Y' -or $wirelessChoice -eq 'y') { + $DisableWirelessDisplayCompletely = $true + Write-Host "" + Write-Host " Wireless Display will be COMPLETELY DISABLED" -ForegroundColor Yellow + Write-Log -Level INFO -Message "User decision: Wireless Display completely disabled" -Module "AdvancedSecurity" + } + else { + $DisableWirelessDisplayCompletely = $false + Write-Host "" + Write-Host " Wireless Display will be HARDENED (sending still works)" -ForegroundColor Green + Write-Log -Level INFO -Message "User decision: Wireless Display hardened only" -Module "AdvancedSecurity" + } + Write-Host "" + } + + # Discovery Protocols (WS-Discovery + mDNS) Configuration - Maximum profile only + # This controls OS-level mDNS resolver and WS-Discovery service+firewall block. + $DisableDiscoveryProtocolsCompletely = $false + + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - use config value; effective only for Maximum profile + $DisableDiscoveryProtocolsCompletely = Get-NonInteractiveValue -Module "AdvancedSecurity" -Key "disableDiscoveryProtocols" -Default ($SecurityProfile -eq 'Maximum') + Write-NonInteractiveDecision -Module "AdvancedSecurity" -Decision "Discovery Protocols (WS-Discovery/mDNS, Maximum only)" -Value $(if ($DisableDiscoveryProtocolsCompletely) { "Completely Disabled" } else { "Default (Windows behavior)" }) + } + elseif ($SecurityProfile -eq 'Maximum') { + # Interactive prompt only for Maximum profile + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " DISCOVERY PROTOCOLS (WS-Discovery + mDNS)" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "WS-Discovery and mDNS are used for automatic device discovery (printers, TVs, scanners)." -ForegroundColor White + Write-Host "On high-security / air-gapped systems, these discovery protocols should be COMPLETELY DISABLED." -ForegroundColor White + Write-Host "" + Write-Host "SECURITY RISK:" -ForegroundColor Red + Write-Host " - Network mapping and lateral movement via WS-Discovery" -ForegroundColor Gray + Write-Host " - mDNS spoofing and fake devices on the local network" -ForegroundColor Gray + Write-Host "" + Write-Host "WHAT BREAKS IF DISABLED:" -ForegroundColor Yellow + Write-Host " ! Automatic discovery of network printers/TVs/scanners" -ForegroundColor Gray + Write-Host " ! Some legacy media streaming / casting workflows" -ForegroundColor Gray + Write-Host " ! Miracast display discovery (even if Miracast allowed above)" -ForegroundColor Gray + Write-Host "" + Write-Host "WHAT STILL WORKS:" -ForegroundColor Cyan + Write-Host " + Direct access via IP address (\\192.168.x.x or http://IP)" -ForegroundColor Gray + Write-Host " + Modern cloud-based apps (e.g. vendor apps, browser UIs)" -ForegroundColor Gray + Write-Host " + All outbound web traffic (browsing, streaming, etc.)" -ForegroundColor Gray + Write-Host "" + Write-Host "Do you want to COMPLETELY DISABLE WS-Discovery and mDNS on this system?" -ForegroundColor White + Write-Host "" + Write-Host " [Y] YES - Maximum security (Recommended for air-gapped / Maximum profile)" -ForegroundColor Cyan + Write-Host " - Disables OS mDNS resolver" -ForegroundColor Gray + Write-Host " - Disables WS-Discovery services" -ForegroundColor Gray + Write-Host " - Blocks WS-Discovery and mDNS ports in the firewall" -ForegroundColor Gray + Write-Host "" + Write-Host " [N] NO - Keep default discovery behavior" -ForegroundColor White + Write-Host " - Device discovery continues to work" -ForegroundColor Gray + Write-Host " - Higher attack surface (not recommended for Maximum profile)" -ForegroundColor Gray + Write-Host "" + + $discoveryChoice = Read-Host "Completely disable WS-Discovery and mDNS? [Y/N] (default: N)" + + if ($discoveryChoice -eq 'Y' -or $discoveryChoice -eq 'y') { + $DisableDiscoveryProtocolsCompletely = $true + Write-Host "" + Write-Host " Discovery protocols (WS-Discovery + mDNS) will be COMPLETELY DISABLED" -ForegroundColor Yellow + Write-Log -Level INFO -Message "User decision: Discovery protocols (WS-Discovery/mDNS) completely disabled on Maximum profile" -Module "AdvancedSecurity" + } + else { + $DisableDiscoveryProtocolsCompletely = $false + Write-Host "" + Write-Host " Discovery protocols will be KEPT enabled (device discovery works)" -ForegroundColor Green + Write-Log -Level INFO -Message "User decision: Discovery protocols (WS-Discovery/mDNS) kept enabled on Maximum profile" -Module "AdvancedSecurity" + } + Write-Host "" + } + + # IPv6 Disable Configuration - Maximum profile only (mitm6 attack mitigation) + $DisableIPv6Completely = $false + + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - use config value; effective only for Maximum profile + $DisableIPv6Completely = Get-NonInteractiveValue -Module "AdvancedSecurity" -Key "disableIPv6" -Default $false + if ($DisableIPv6Completely) { + Write-NonInteractiveDecision -Module "AdvancedSecurity" -Decision "IPv6 (mitm6 protection)" -Value "Completely Disabled" + } + } + elseif ($SecurityProfile -eq 'Maximum') { + # Interactive prompt only for Maximum profile + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " IPv6 SECURITY (mitm6 Attack Mitigation)" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "Windows sends DHCPv6 requests even when IPv6 is not configured." -ForegroundColor White + Write-Host "Attackers can exploit this to perform DNS takeover and credential theft." -ForegroundColor White + Write-Host "" + Write-Host "ATTACK SCENARIO (mitm6):" -ForegroundColor Red + Write-Host " 1. Attacker responds to DHCPv6 requests as fake server" -ForegroundColor Gray + Write-Host " 2. Attacker becomes DNS server for victim" -ForegroundColor Gray + Write-Host " 3. Combined with WPAD -> NTLM credentials stolen" -ForegroundColor Gray + Write-Host " 4. -> Domain compromise possible!" -ForegroundColor Gray + Write-Host "" + Write-Host "NOTE: WPAD is already disabled by this framework." -ForegroundColor Cyan + Write-Host " Disabling IPv6 provides additional defense-in-depth." -ForegroundColor Cyan + Write-Host "" + Write-Host "WHAT BREAKS IF IPv6 DISABLED:" -ForegroundColor Yellow + Write-Host " ! Exchange Server communication (if using IPv6)" -ForegroundColor Gray + Write-Host " ! Some Active Directory features" -ForegroundColor Gray + Write-Host " ! IPv6-only services and websites" -ForegroundColor Gray + Write-Host "" + Write-Host "RECOMMENDED FOR:" -ForegroundColor Cyan + Write-Host " + Air-gapped systems" -ForegroundColor Gray + Write-Host " + Standalone workstations (no Exchange/AD)" -ForegroundColor Gray + Write-Host " + High-security environments" -ForegroundColor Gray + Write-Host "" + Write-Host "Do you want to COMPLETELY DISABLE IPv6?" -ForegroundColor White + Write-Host "" + Write-Host " [Y] YES - Disable IPv6 (Maximum security)" -ForegroundColor Cyan + Write-Host " - Prevents mitm6 attacks completely" -ForegroundColor Gray + Write-Host " - REBOOT REQUIRED" -ForegroundColor Gray + Write-Host "" + Write-Host " [N] NO - Keep IPv6 enabled (Default)" -ForegroundColor Green + Write-Host " - WPAD already disabled (partial mitigation)" -ForegroundColor Gray + Write-Host " - IPv6 functionality preserved" -ForegroundColor Gray + Write-Host "" + + $ipv6Choice = Read-Host "Completely disable IPv6? [Y/N] (default: N)" + + if ($ipv6Choice -eq 'Y' -or $ipv6Choice -eq 'y') { + $DisableIPv6Completely = $true + Write-Host "" + Write-Host " IPv6 will be COMPLETELY DISABLED (REBOOT REQUIRED)" -ForegroundColor Yellow + Write-Log -Level INFO -Message "User decision: IPv6 completely disabled (mitm6 mitigation)" -Module "AdvancedSecurity" + } + else { + $DisableIPv6Completely = $false + Write-Host "" + Write-Host " IPv6 will be KEPT enabled (WPAD already disabled for partial protection)" -ForegroundColor Green + Write-Log -Level INFO -Message "User decision: IPv6 kept enabled (WPAD disabled provides partial mitm6 protection)" -Module "AdvancedSecurity" + } + Write-Host "" + } + + # Handle DryRun parameter (convert to WhatIf for ShouldProcess) + if ($DryRun) { + $WhatIfPreference = $true + } + + # WhatIf mode + if ($PSCmdlet.ShouldProcess("Advanced Security", "Apply $SecurityProfile hardening")) { + + # PHASE 1: BACKUP + Write-Host "[1/4] BACKUP - Creating restore point..." -ForegroundColor Cyan + + if (-not $SkipBackup) { + Write-Log -Level INFO -Message "Initializing backup system..." -Module "AdvancedSecurity" + $backupInit = Initialize-BackupSystem + + if (-not $backupInit) { + Write-Log -Level ERROR -Message "Failed to initialize backup system!" -Module "AdvancedSecurity" + Write-Host " ERROR: Backup system initialization failed!" -ForegroundColor Red + Write-Host " Use -SkipBackup to proceed without backup (NOT RECOMMENDED)" -ForegroundColor Yellow + Write-Host "" + return [PSCustomObject]@{ + Success = $false + ErrorMessage = "Backup system initialization failed" + } + } + + $backupResult = Backup-AdvancedSecuritySettings + + if ($backupResult) { + # Register backup in session manifest + Complete-ModuleBackup -ItemsBackedUp $backupResult -Status "Success" + + Write-Log -Level SUCCESS -Message "Backup completed: $backupResult items" -Module "AdvancedSecurity" + Write-Host " Backup completed ($backupResult items)" -ForegroundColor Green + } + else { + Write-Log -Level WARNING -Message "Backup may have failed - proceeding anyway" -Module "AdvancedSecurity" + Write-Host " WARNING: Backup may have issues" -ForegroundColor Yellow + } + } + else { + Write-Log -Level WARNING -Message "Backup SKIPPED by user request!" -Module "AdvancedSecurity" + Write-Host " Skipped (SkipBackup flag)" -ForegroundColor Yellow + } + Write-Host "" + + # PHASE 2: APPLY + Write-Host "[2/4] APPLY - Applying security hardening..." -ForegroundColor Cyan + Write-Host "" + + $appliedFeatures = @() + $failedFeatures = @() + + # Feature 1: RDP Hardening + Write-Host " RDP Security Hardening..." -ForegroundColor White -NoNewline + + try { + $rdpDisable = $false + + if ($SecurityProfile -eq 'Maximum' -and $DisableRDP) { + $rdpDisable = $true + } + elseif ($DisableRDP) { + Write-Log -Level INFO -Message "User explicitly requested full RDP disable in profile '$SecurityProfile' - applying complete disable with Force override" -Module "AdvancedSecurity" + $rdpDisable = $true + } + + $rdpResult = Enable-RdpNLA -DisableRDP:$rdpDisable -Force:$Force + + if ($rdpResult) { + Write-Host " OK" -ForegroundColor Green + $appliedFeatures += "RDP Hardening" + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "RDP Hardening" + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "RDP Hardening" + Write-Log -Level ERROR -Message "RDP hardening failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + + # Feature 2: WDigest Protection + Write-Host " WDigest Protection..." -ForegroundColor White -NoNewline + + try { + $wdigestResult = Set-WDigestProtection + + if ($wdigestResult) { + Write-Host " OK" -ForegroundColor Green + $appliedFeatures += "WDigest Protection" + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "WDigest Protection" + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "WDigest Protection" + Write-Log -Level ERROR -Message "WDigest protection failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + + # Feature 3: Administrative Shares + Write-Host " Admin Shares Disable..." -ForegroundColor White -NoNewline + + try { + # Enterprise profile: Auto-skip on domain (for IT management) + if ($SecurityProfile -eq 'Enterprise' -and $isDomainJoined -and -not $Force) { + Write-Host " SKIPPED (Enterprise + Domain)" -ForegroundColor Yellow + Write-Log -Level INFO -Message "Admin shares kept on domain (Enterprise profile)" -Module "AdvancedSecurity" + } + else { + $adminSharesForce = $false + + if ($SecurityProfile -eq 'Maximum') { + $adminSharesForce = $true + } + elseif ($Force) { + $adminSharesForce = $true + } + + $adminSharesResult = Disable-AdminShares -Force:$adminSharesForce + + if ($adminSharesResult) { + Write-Host " OK" -ForegroundColor Green + $appliedFeatures += "Admin Shares Disable" + } + else { + Write-Host " SKIPPED" -ForegroundColor Yellow + } + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Admin Shares Disable" + Write-Log -Level ERROR -Message "Admin shares disable failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + + # Feature 4: Risky Firewall Ports + Write-Host " Risky Ports Hardening..." -ForegroundColor White -NoNewline + + try { + # Pass SkipUPnP if user chose to keep UPnP enabled + $riskyPortsResult = Disable-RiskyPorts -SkipUPnP:(-not $DisableUPnP) + + if ($riskyPortsResult) { + Write-Host " OK" -ForegroundColor Green + $appliedFeatures += "Risky Firewall Ports" + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Risky Firewall Ports" + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Risky Firewall Ports" + Write-Log -Level ERROR -Message "Risky ports closure failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + + # Feature 5: Risky Network Services + Write-Host " Risky Services Stop..." -ForegroundColor White -NoNewline + + try { + $riskyServicesResult = Stop-RiskyServices + + if ($riskyServicesResult) { + Write-Host " OK" -ForegroundColor Green + $appliedFeatures += "Risky Network Services" + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Risky Network Services" + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Risky Network Services" + Write-Log -Level ERROR -Message "Risky services stop failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + + # Feature 6: WPAD Disable + Write-Host " WPAD Disable..." -ForegroundColor White -NoNewline + + try { + $wpadResult = Disable-WPAD + + if ($wpadResult) { + Write-Host " OK" -ForegroundColor Green + $appliedFeatures += "WPAD Disable" + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "WPAD Disable" + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "WPAD Disable" + Write-Log -Level ERROR -Message "WPAD disable failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + + # Feature 7: Legacy TLS Disable + Write-Host " Legacy TLS 1.0/1.1 Disable..." -ForegroundColor White -NoNewline + + try { + $tlsResult = Disable-LegacyTLS + + if ($tlsResult) { + Write-Host " OK" -ForegroundColor Green + $appliedFeatures += "Legacy TLS Disable" + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Legacy TLS Disable" + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Legacy TLS Disable" + Write-Log -Level ERROR -Message "Legacy TLS disable failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + + # Feature 8: PowerShell v2 Removal + Write-Host " PowerShell v2 Removal..." -ForegroundColor White -NoNewline + + $psv2Changed = $false + try { + $psv2Result = Remove-PowerShellV2 + + if ($psv2Result -and $psv2Result.Success) { + Write-Host " OK" -ForegroundColor Green + $appliedFeatures += "PowerShell v2 Removal" + if ($psv2Result.Changed) { + $psv2Changed = $true + } + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "PowerShell v2 Removal" + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "PowerShell v2 Removal" + Write-Log -Level ERROR -Message "PowerShell v2 removal failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + + # Feature 9: Finger Protocol + Write-Host " Finger Protocol Block..." -ForegroundColor White -NoNewline + + try { + $fingerResult = Block-FingerProtocol -DryRun:$DryRun + + if ($fingerResult) { + Write-Host " OK" -ForegroundColor Green + $appliedFeatures += "Finger Protocol Block" + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Finger Protocol Block" + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Finger Protocol Block" + Write-Log -Level ERROR -Message "Finger protocol block failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + + # Feature 10: SRP Rules (CVE-2025-9491) + Write-Host " SRP .lnk Protection (CVE-2025-9491)..." -ForegroundColor White -NoNewline + + try { + $srpResult = Set-SRPRules -DryRun:$DryRun + + if ($srpResult) { + Write-Host " OK" -ForegroundColor Green + $appliedFeatures += "SRP .lnk Protection (CVE-2025-9491)" + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "SRP .lnk Protection" + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "SRP .lnk Protection" + Write-Log -Level ERROR -Message "SRP configuration failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + + # Feature 11: Windows Update + Write-Host " Windows Update Config..." -ForegroundColor White -NoNewline + + try { + $wuResult = Set-WindowsUpdate -DryRun:$DryRun + + if ($wuResult) { + Write-Host " OK" -ForegroundColor Green + $appliedFeatures += "Windows Update (3 GUI settings)" + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Windows Update" + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Windows Update" + Write-Log -Level ERROR -Message "Windows Update configuration failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + + # Feature 12: Wireless Display Security + Write-Host " Wireless Display Security..." -ForegroundColor White -NoNewline + + try { + $wirelessDisplayResult = Set-WirelessDisplaySecurity -DisableCompletely:$DisableWirelessDisplayCompletely + + if ($wirelessDisplayResult) { + if ($DisableWirelessDisplayCompletely) { + Write-Host " OK (Fully Disabled)" -ForegroundColor Green + $appliedFeatures += "Wireless Display (Fully Disabled)" + } + else { + Write-Host " OK (Hardened)" -ForegroundColor Green + $appliedFeatures += "Wireless Display (Hardened)" + } + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Wireless Display Security" + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Wireless Display Security" + Write-Log -Level ERROR -Message "Wireless Display security failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + + # Feature 13: Discovery Protocols (WS-Discovery + mDNS) - Maximum only + if ($SecurityProfile -eq 'Maximum') { + Write-Host " Discovery Protocols (WS-Discovery + mDNS)..." -ForegroundColor White -NoNewline + + try { + if ($DisableDiscoveryProtocolsCompletely) { + $discoveryResult = Set-DiscoveryProtocolsSecurity -DisableCompletely + + if ($discoveryResult) { + Write-Host " OK (Disabled)" -ForegroundColor Green + $appliedFeatures += "Discovery Protocols (WS-Discovery + mDNS Disabled)" + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Discovery Protocols (WS-Discovery + mDNS)" + } + } + else { + Write-Host " SKIPPED" -ForegroundColor Yellow + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Discovery Protocols (WS-Discovery + mDNS)" + Write-Log -Level ERROR -Message "Discovery protocol security failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + } + + # Feature 14: Firewall Shields Up (Maximum only) + # Blocks ALL incoming connections on Public network, including allowed apps + if ($SecurityProfile -eq 'Maximum') { + Write-Host " Firewall Shields Up (Public)..." -ForegroundColor White -NoNewline + + try { + $shieldsUpResult = Set-FirewallShieldsUp -Enable + + if ($shieldsUpResult) { + Write-Host " OK" -ForegroundColor Green + $appliedFeatures += "Firewall Shields Up (Block ALL incoming on Public)" + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Firewall Shields Up" + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "Firewall Shields Up" + Write-Log -Level ERROR -Message "Firewall Shields Up failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + } + + # Feature 15: IPv6 Disable (Maximum only, optional) + # Prevents mitm6 attacks (DHCPv6 spoofing โ†’ DNS takeover โ†’ NTLM relay) + if ($SecurityProfile -eq 'Maximum' -and $DisableIPv6Completely) { + Write-Host " IPv6 Disable (mitm6 mitigation)..." -ForegroundColor White -NoNewline + + try { + $ipv6Result = Set-IPv6Security -DisableCompletely + + if ($ipv6Result) { + Write-Host " OK (REBOOT REQUIRED)" -ForegroundColor Green + $appliedFeatures += "IPv6 Disabled (mitm6 attack mitigation)" + } + else { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "IPv6 Disable" + } + } + catch { + Write-Host " FAILED" -ForegroundColor Red + $failedFeatures += "IPv6 Disable" + Write-Log -Level ERROR -Message "IPv6 disable failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + } + } + + Write-Host "" + + # PHASE 3: VERIFY + Write-Host "[3/4] VERIFY - Checking compliance..." -ForegroundColor Cyan + Write-Host "" + + if ($appliedFeatures.Count -gt 0) { + try { + $verifyResult = Test-AdvancedSecurity + + # Test-AdvancedSecurity now outputs full table + returns structured object + # No need to print summary here - it's already shown above + if ($verifyResult -and $verifyResult.Compliance -lt 100) { + # Log details to file for troubleshooting + Write-Log -Level WARNING -Message "Advanced Security Compliance: $($verifyResult.CompliantCount)/$($verifyResult.TotalChecks) passed ($($verifyResult.Compliance)%)" -Module "AdvancedSecurity" + + if ($verifyResult.Results) { + foreach ($test in $verifyResult.Results) { + if (-not $test.Compliant) { + Write-Log -Level WARNING -Message " [NON-COMPLIANT] $($test.Feature): $($test.Status) - $($test.Details)" -Module "AdvancedSecurity" + } + } + } + + Write-Host "" + Write-Host " Note: $($verifyResult.TotalChecks - $verifyResult.CompliantCount) check(s) non-compliant" -ForegroundColor Yellow + Write-Host " This may require reboot or additional configuration" -ForegroundColor Gray + } + elseif ($verifyResult) { + Write-Log -Level SUCCESS -Message "Advanced Security Compliance: 100% passed" -Module "AdvancedSecurity" + } + } + catch { + Write-Host " Verification skipped (error occurred)" -ForegroundColor Gray + } + } + else { + Write-Host " Skipped (no features applied)" -ForegroundColor Gray + } + Write-Host "" + + # PHASE 4: COMPLETE + Write-Host "[4/4] COMPLETE - Advanced security finished!" -ForegroundColor Green + Write-Host "" + + Write-Host "Profile: $SecurityProfile" -ForegroundColor White + Write-Host "Features: $($appliedFeatures.Count)/14 applied" -ForegroundColor $(if ($failedFeatures.Count -eq 0) { 'Green' } else { 'Yellow' }) + + if ($failedFeatures.Count -gt 0) { + Write-Host "Failed: $($failedFeatures.Count)" -ForegroundColor Red + } + + Write-Host "" + if ($psv2Changed) { + Write-Host "REBOOT REQUIRED for some changes (Admin Shares, PowerShell v2)" -ForegroundColor Yellow + } + else { + Write-Host "REBOOT REQUIRED for some changes (Admin Shares)" -ForegroundColor Yellow + } + Write-Host "" + + Write-Log -Level SUCCESS -Message "Advanced Security hardening completed: $($appliedFeatures.Count) features applied" -Module "AdvancedSecurity" + + # GUI parsing marker for settings count (50 advanced settings incl. Wireless Display + Discovery Protocols + IPv6) + Write-Log -Level SUCCESS -Message "Applied 50 settings" -Module "AdvancedSecurity" + + # Return structured result object + $hasFailures = $failedFeatures.Count -gt 0 + return [PSCustomObject]@{ + Success = -not $hasFailures + SecurityProfile = $SecurityProfile + FeaturesApplied = $appliedFeatures + FeaturesFailed = $failedFeatures + TotalFeatures = $appliedFeatures.Count + $failedFeatures.Count + Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + RebootRequired = $true + } + } + else { + Write-Host "WhatIf mode - no changes applied" -ForegroundColor Yellow + Write-Host "" + return [PSCustomObject]@{ + Success = $true + SecurityProfile = $SecurityProfile + Mode = "WhatIf" + Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + } + } + } + catch { + Write-Log -Level ERROR -Message "Advanced Security hardening failed: $_" -Module "AdvancedSecurity" -Exception $_.Exception + Write-Host "" + Write-Host "ERROR: Hardening failed!" -ForegroundColor Red + Write-Host $_.Exception.Message -ForegroundColor Gray + Write-Host "" + + # Return structured error object + return [PSCustomObject]@{ + Success = $false + SecurityProfile = $SecurityProfile + ErrorMessage = $_.Exception.Message + Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + } + } +} diff --git a/Modules/AdvancedSecurity/Public/Restore-AdvancedSecuritySettings.ps1 b/Modules/AdvancedSecurity/Public/Restore-AdvancedSecuritySettings.ps1 new file mode 100644 index 0000000..8a53196 --- /dev/null +++ b/Modules/AdvancedSecurity/Public/Restore-AdvancedSecuritySettings.ps1 @@ -0,0 +1,312 @@ +function Restore-AdvancedSecuritySettings { + <# + .SYNOPSIS + Restore Advanced Security settings from backup + + .DESCRIPTION + Restores custom Advanced Security settings that are not handled by the generic + registry/service restore logic. This includes: + - Firewall Rules (Risky Ports) + - Windows Features (PowerShell v2) + - SMB Shares (Admin Shares) + + .PARAMETER BackupFilePath + Path to the JSON backup file + + .OUTPUTS + Boolean indicating success + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [string]$BackupFilePath + ) + + if (-not (Test-Path $BackupFilePath)) { + Write-Log -Level ERROR -Message "Backup file not found: $BackupFilePath" -Module "AdvancedSecurity" + return $false + } + + try { + $filename = Split-Path $BackupFilePath -Leaf + Write-Log -Level INFO -Message "Processing Advanced Security backup: $filename" -Module "AdvancedSecurity" + + # Skip Empty Marker files - these are already processed by generic Empty Marker logic in Core/Rollback.ps1 + if ($filename -match "_EMPTY\.json$") { + Write-Log -Level DEBUG -Message "Skipping Empty Marker file (already processed): $filename" -Module "AdvancedSecurity" + return $true # Success - nothing to do here + } + + # Load backup data + $backupData = Get-Content -Path $BackupFilePath -Raw | ConvertFrom-Json + + # Determine backup type based on filename or content + if ($filename -match "RiskyPorts_Firewall") { + return Restore-FirewallRules -BackupData $backupData + } + elseif ($filename -match "PowerShellV2") { + return Restore-PowerShellV2 -BackupData $backupData + } + elseif ($filename -match "AdminShares") { + return Restore-AdminShares -BackupData $backupData + } + elseif ($filename -match "NetBIOS_Adapters") { + return Restore-NetBIOSAdapters -BackupData $backupData + } + elseif ($filename -match "RDP_Hardening") { + # RDP settings are already restored via the Smart JSON-Fallback mechanism in Rollback.ps1 + # This JSON backup serves as a fallback and doesn't require separate restore logic + Write-Log -Level DEBUG -Message "RDP_Hardening.json acknowledged (already handled by Smart JSON-Fallback)" -Module "AdvancedSecurity" + return $true + } + else { + Write-Log -Level WARNING -Message "Unknown Advanced Security backup type: $filename" -Module "AdvancedSecurity" + return $false + } + } + catch { + Write-Log -Level ERROR -Message "Failed to restore Advanced Security settings: $_" -Module "AdvancedSecurity" -Exception $_.Exception + return $false + } +} + +function Restore-FirewallRules { + param($BackupData) + + Write-Log -Level INFO -Message "Restoring firewall rules..." -Module "AdvancedSecurity" + + try { + # 1. Remove rules created by hardening (identified by Group or Name pattern) + # The hardening module creates rules with specific names/groups. + # Since we don't have the exact names of created rules stored in a "CreatedRules" list here, + # we rely on the fact that we are restoring the *previous* state. + + # However, for firewall rules, "restoring" usually means: + # 1. Deleting the BLOCK rules we added + # 2. Re-enabling any rules we disabled (if any) + + # The backup contains a SNAPSHOT of rules matching the risky ports. + # We should restore their state (Enabled/Disabled, Action). + + if ($BackupData.Rules) { + foreach ($rule in $BackupData.Rules) { + # Check if rule exists + $currentRule = Get-NetFirewallRule -Name $rule.Name -ErrorAction SilentlyContinue + + if ($currentRule) { + # Restore state + Set-NetFirewallRule -Name $rule.Name ` + -Enabled $rule.Enabled ` + -Action $rule.Action ` + -ErrorAction SilentlyContinue + + Write-Log -Level DEBUG -Message "Restored rule state: $($rule.Name)" -Module "AdvancedSecurity" + } + } + } + + # Also remove the specific block rules added by AdvancedSecurity + # These include: + # - Block Risky Port * (legacy patterns) + # - NoID Privacy - Block Finger Protocol (Port 79) + # - NoID Privacy - Block SSDP (UDP 1900) + # - Block Admin Shares - NoID Privacy (TCP 445 on Public profile) + $blockRules = Get-NetFirewallRule -DisplayName "Block Risky Port *" -ErrorAction SilentlyContinue + if ($blockRules) { + Remove-NetFirewallRule -InputObject $blockRules -ErrorAction SilentlyContinue + Write-Log -Level INFO -Message "Removed $($blockRules.Count) hardening block rules" -Module "AdvancedSecurity" + } + + # Remove Finger Protocol rule (corrected name with NoID prefix) + Remove-NetFirewallRule -DisplayName "NoID Privacy - Block Finger Protocol (Port 79)" -ErrorAction SilentlyContinue + + # Remove SSDP block rule (UDP 1900) + Remove-NetFirewallRule -DisplayName "NoID Privacy - Block SSDP (UDP 1900)" -ErrorAction SilentlyContinue + + # Remove WS-Discovery and mDNS block rules (Maximum profile discovery hardening) + Remove-NetFirewallRule -Name "NoID-Block-WSD-UDP-3702" -ErrorAction SilentlyContinue + Remove-NetFirewallRule -Name "NoID-Block-WSD-TCP-5357" -ErrorAction SilentlyContinue + Remove-NetFirewallRule -Name "NoID-Block-WSD-TCP-5358" -ErrorAction SilentlyContinue + Remove-NetFirewallRule -Name "NoID-Block-mDNS-UDP-5353" -ErrorAction SilentlyContinue + + # Remove Admin Shares SMB block rule (TCP 445 on Public profile) + Remove-NetFirewallRule -DisplayName "Block Admin Shares - NoID Privacy" -ErrorAction SilentlyContinue + + # Remove Miracast/Wireless Display block rules (Ports 7236, 7250) + Remove-NetFirewallRule -DisplayName "NoID Privacy - Block Miracast TCP 7236" -ErrorAction SilentlyContinue + Remove-NetFirewallRule -DisplayName "NoID Privacy - Block Miracast TCP 7250" -ErrorAction SilentlyContinue + Remove-NetFirewallRule -DisplayName "NoID Privacy - Block Miracast UDP 7236" -ErrorAction SilentlyContinue + Remove-NetFirewallRule -DisplayName "NoID Privacy - Block Miracast UDP 7250" -ErrorAction SilentlyContinue + + # Re-enable WiFi Direct Service (WFDSConMgrSvc) for Miracast functionality + $wfdService = Get-Service -Name "WFDSConMgrSvc" -ErrorAction SilentlyContinue + if ($wfdService -and $wfdService.StartType -eq 'Disabled') { + Set-Service -Name "WFDSConMgrSvc" -StartupType Manual -ErrorAction SilentlyContinue + Write-Log -Level INFO -Message "Re-enabled WiFi Direct Service (WFDSConMgrSvc)" -Module "AdvancedSecurity" + } + + # Re-enable WiFi Direct Virtual Adapters + Get-NetAdapter -InterfaceDescription "Microsoft Wi-Fi Direct Virtual*" -IncludeHidden -ErrorAction SilentlyContinue | + Where-Object { $_.Status -eq 'Disabled' } | + ForEach-Object { + Enable-NetAdapter -Name $_.Name -Confirm:$false -ErrorAction SilentlyContinue + Write-Log -Level INFO -Message "Re-enabled WiFi Direct adapter: $($_.Name)" -Module "AdvancedSecurity" + } + + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to restore firewall rules: $_" -Module "AdvancedSecurity" + return $false + } +} + +function Restore-PowerShellV2 { + param($BackupData) + + Write-Log -Level INFO -Message "Restoring PowerShell v2 state..." -Module "AdvancedSecurity" + + try { + $shouldEnable = ($BackupData.State -eq "Enabled") + + # Check current state + $psv2RegPath = "HKLM:\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" + $psv2EngineVersion = (Get-ItemProperty -Path $psv2RegPath -Name "PowerShellVersion" -ErrorAction SilentlyContinue).PowerShellVersion + $isEnabled = ($null -ne $psv2EngineVersion -and $psv2EngineVersion -like "2.*") + + if ($shouldEnable -and -not $isEnabled) { + Write-Log -Level INFO -Message "Re-enabling PowerShell v2 (via DISM)..." -Module "AdvancedSecurity" + Enable-WindowsOptionalFeature -Online -FeatureName "MicrosoftWindowsPowerShellV2Root" -NoRestart -ErrorAction Stop | Out-Null + } + elseif (-not $shouldEnable -and $isEnabled) { + Write-Log -Level INFO -Message "Disabling PowerShell v2 (via DISM)..." -Module "AdvancedSecurity" + Disable-WindowsOptionalFeature -Online -FeatureName "MicrosoftWindowsPowerShellV2Root" -NoRestart -ErrorAction Stop | Out-Null + } + else { + Write-Log -Level INFO -Message "PowerShell v2 state already matches backup ($($BackupData.State))" -Module "AdvancedSecurity" + } + + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to restore PowerShell v2: $_" -Module "AdvancedSecurity" + return $false + } +} + +function Restore-AdminShares { + # Note: No parameters needed - registry restore happens separately via Core\Rollback.ps1 + + Write-Log -Level INFO -Message "Restoring Admin Shares..." -Module "AdvancedSecurity" + + try { + # The backup contains a list of shares that existed. + # If we disabled them, they might be gone or the AutoShareServer/Wks registry keys were changed. + # Registry keys are handled by the generic Registry restore! + # So we mainly need to verify if we need to manually recreate shares or if registry restore + reboot is enough. + + # Changing AutoShareServer/AutoShareWks requires a reboot to take effect. + # So simply restoring the registry keys (which happens before this) should be sufficient for the next boot. + + # However, we can try to force re-creation if possible, but usually LanmanServer needs restart. + Write-Log -Level INFO -Message "Admin Shares settings restored via Registry. A reboot is required to fully restore shares." -Module "AdvancedSecurity" + + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to restore Admin Shares: $_" -Module "AdvancedSecurity" + return $false + } +} + +function Restore-NetBIOSAdapters { + <# + .SYNOPSIS + Restore NetBIOS over TCP/IP settings on network adapters + + .DESCRIPTION + Restores the TcpipNetbiosOptions setting on each network adapter + to its pre-hardening state. + + TcpipNetbiosOptions values: + - 0 = Default (use DHCP option) + - 1 = Enable NetBIOS over TCP/IP + - 2 = Disable NetBIOS over TCP/IP (set by hardening) + + .PARAMETER BackupData + JSON backup data containing adapter descriptions and their original TcpipNetbiosOptions + #> + param($BackupData) + + Write-Log -Level INFO -Message "Restoring NetBIOS over TCP/IP settings on network adapters..." -Module "AdvancedSecurity" + + try { + # BackupData can be an array directly or have a nested structure + $adaptersToRestore = if ($BackupData -is [Array]) { $BackupData } else { @($BackupData) } + + if ($adaptersToRestore.Count -eq 0) { + Write-Log -Level INFO -Message "No NetBIOS adapter settings to restore" -Module "AdvancedSecurity" + return $true + } + + $restoredCount = 0 + $failedCount = 0 + + # Get current adapters + $currentAdapters = Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration -Filter "IPEnabled = TRUE" -ErrorAction SilentlyContinue + + foreach ($backupAdapter in $adaptersToRestore) { + try { + # Find matching adapter by Index (most reliable) or Description + $targetAdapter = $currentAdapters | Where-Object { + $_.Index -eq $backupAdapter.Index -or + $_.Description -eq $backupAdapter.Description + } | Select-Object -First 1 + + if ($targetAdapter) { + $originalSetting = $backupAdapter.TcpipNetbiosOptions + + # Only restore if different from current + if ($targetAdapter.TcpipNetbiosOptions -ne $originalSetting) { + $result = Invoke-CimMethod -InputObject $targetAdapter -MethodName SetTcpipNetbios -Arguments @{TcpipNetbiosOptions = $originalSetting } + + if ($result.ReturnValue -eq 0) { + Write-Log -Level DEBUG -Message "Restored NetBIOS setting on adapter '$($targetAdapter.Description)' to $originalSetting" -Module "AdvancedSecurity" + $restoredCount++ + } + else { + Write-Log -Level WARNING -Message "SetTcpipNetbios returned $($result.ReturnValue) for adapter '$($targetAdapter.Description)'" -Module "AdvancedSecurity" + $failedCount++ + } + } + else { + Write-Log -Level DEBUG -Message "NetBIOS setting on adapter '$($targetAdapter.Description)' already matches backup ($originalSetting)" -Module "AdvancedSecurity" + $restoredCount++ + } + } + else { + Write-Log -Level WARNING -Message "Adapter not found for restore: Index=$($backupAdapter.Index), Description='$($backupAdapter.Description)'" -Module "AdvancedSecurity" + $failedCount++ + } + } + catch { + Write-Log -Level WARNING -Message "Failed to restore NetBIOS on adapter '$($backupAdapter.Description)': $_" -Module "AdvancedSecurity" + $failedCount++ + } + } + + if ($failedCount -eq 0) { + Write-Log -Level SUCCESS -Message "NetBIOS settings restored on $restoredCount adapter(s)" -Module "AdvancedSecurity" + return $true + } + else { + Write-Log -Level WARNING -Message "NetBIOS restore completed with issues: $restoredCount succeeded, $failedCount failed" -Module "AdvancedSecurity" + return $true # Still return true - partial success is acceptable + } + } + catch { + Write-Log -Level ERROR -Message "Failed to restore NetBIOS adapter settings: $_" -Module "AdvancedSecurity" + return $false + } +} diff --git a/Modules/AdvancedSecurity/Public/Test-AdvancedSecurity.ps1 b/Modules/AdvancedSecurity/Public/Test-AdvancedSecurity.ps1 new file mode 100644 index 0000000..973bcb6 --- /dev/null +++ b/Modules/AdvancedSecurity/Public/Test-AdvancedSecurity.ps1 @@ -0,0 +1,188 @@ +function Test-AdvancedSecurity { + <# + .SYNOPSIS + Test Advanced Security compliance + + .DESCRIPTION + Runs all compliance tests for Advanced Security hardening and returns + a comprehensive report of the current security posture. + + Tests include: + - RDP Security (NLA enforcement, SSL/TLS, disable status) + - WDigest Protection (credential caching disabled) + - Administrative Shares (disabled and removed) + - Risky Firewall Ports (LLMNR, NetBIOS, UPnP/SSDP closed) + - Risky Network Services (SSDPSRV, upnphost, lmhosts stopped) + - Discovery Protocols (WS-Discovery, mDNS) + + .EXAMPLE + Test-AdvancedSecurity + Runs all compliance tests and displays results + + .EXAMPLE + $results = Test-AdvancedSecurity + $results | Format-Table + + .OUTPUTS + Array of PSCustomObjects with compliance results + #> + [CmdletBinding()] + param() + + try { + Write-Host "" + Write-Host "============================================" -ForegroundColor Cyan + Write-Host " ADVANCED SECURITY COMPLIANCE TEST" -ForegroundColor Cyan + Write-Host "============================================" -ForegroundColor Cyan + Write-Host "" + + $results = @() + + # 1. RDP Security + Write-Host "Testing RDP Security..." -ForegroundColor Gray + $rdpTest = Test-RdpSecurity + $results += $rdpTest + + # 2. WDigest Protection + Write-Host "Testing WDigest Protection..." -ForegroundColor Gray + $wdigestTest = Test-WDigest + $results += $wdigestTest + + # 3. Admin Shares + Write-Host "Testing Administrative Shares..." -ForegroundColor Gray + $adminSharesTest = Test-AdminShares + $results += $adminSharesTest + + # 4. Legacy TLS + Write-Host "Testing Legacy TLS (1.0/1.1)..." -ForegroundColor Gray + $tlsTest = Test-LegacyTLS + $results += $tlsTest + + # 5. WPAD + Write-Host "Testing WPAD Configuration..." -ForegroundColor Gray + $wpadTest = Test-WPAD + $results += $wpadTest + + # 6. PowerShell v2 + Write-Host "Testing PowerShell v2 Status..." -ForegroundColor Gray + $psv2Test = Test-PowerShellV2 + $results += $psv2Test + + # 7. Risky Ports + Write-Host "Testing Risky Firewall Ports..." -ForegroundColor Gray + $riskyPortsTest = Test-RiskyPorts + $results += $riskyPortsTest + + # 8. Risky Services + Write-Host "Testing Risky Network Services..." -ForegroundColor Gray + $riskyServicesTest = Test-RiskyServices + $results += $riskyServicesTest + + # 9. SRP Configuration (CVE-2025-9491) + Write-Host "Testing SRP Configuration (CVE-2025-9491)..." -ForegroundColor Gray + $srpTest = Test-SRPCompliance + $results += $srpTest + + # 10. Windows Update Configuration + Write-Host "Testing Windows Update Configuration..." -ForegroundColor Gray + $wuTest = Test-WindowsUpdate + $results += $wuTest + + # 11. Finger Protocol Block + Write-Host "Testing Finger Protocol Block..." -ForegroundColor Gray + $fingerTest = Test-FingerProtocol + $results += $fingerTest + + # 12. Wireless Display Security + Write-Host "Testing Wireless Display Security..." -ForegroundColor Gray + $wirelessDisplayTest = Test-WirelessDisplaySecurity + if ($wirelessDisplayTest) { + $results += [PSCustomObject]@{ + Feature = "Wireless Display Security" + Compliant = $wirelessDisplayTest.Compliant + Details = if ($wirelessDisplayTest.FullyDisabled) { "Fully Disabled" } + elseif ($wirelessDisplayTest.Compliant) { "Hardened (receiving blocked, PIN required)" } + else { "NOT HARDENED - screen interception possible!" } + } + } + + # 13. Discovery Protocols (WS-Discovery + mDNS) - Maximum profile only + Write-Host "Testing Discovery Protocols (WS-Discovery + mDNS)..." -ForegroundColor Gray + $discoveryTest = Test-DiscoveryProtocolsSecurity + if ($discoveryTest) { + $results += [PSCustomObject]@{ + Feature = "Discovery Protocols (WS-Discovery + mDNS)" + Status = if ($discoveryTest.Compliant) { "Secure" } else { "Insecure" } + Details = "mDNS=" + $(if ($discoveryTest.EnableMDNS -eq 0) { "Disabled" } else { "Enabled/Not Set" }) + + "; Services: FDResPub=" + $discoveryTest.FDResPubDisabled + ", fdPHost=" + $discoveryTest.FdPHostDisabled + + "; FirewallRulesEnabled=" + $discoveryTest.FirewallRulesEnabled + Compliant = $discoveryTest.Compliant + } + } + + # 14. Firewall Shields Up (optional - Maximum profile only) + Write-Host "Testing Firewall Shields Up (Public)..." -ForegroundColor Gray + $shieldsUpTest = Test-FirewallShieldsUp + # Always pass - this is an optional hardening only for the Maximum (air-gapped) profile + $results += [PSCustomObject]@{ + Feature = "Firewall Shields Up (Public)" + Compliant = $shieldsUpTest.Pass + Details = $shieldsUpTest.Message + } + + # 15. IPv6 Disable (optional - Maximum profile only, mitm6 mitigation) + Write-Host "Testing IPv6 Security (mitm6 mitigation)..." -ForegroundColor Gray + $ipv6Test = Test-IPv6Security + # Always pass - this is an optional hardening only for the Maximum profile + $results += [PSCustomObject]@{ + Feature = "IPv6 Disable (mitm6 mitigation)" + Compliant = $ipv6Test.Pass + Details = $ipv6Test.Message + } + + # Summary + Write-Host "" + Write-Host "============================================" -ForegroundColor Cyan + Write-Host " COMPLIANCE SUMMARY" -ForegroundColor Cyan + Write-Host "============================================" -ForegroundColor Cyan + Write-Host "" + + $compliantCount = ($results | Where-Object { $_.Compliant -eq $true }).Count + $totalTests = $results.Count + $compliancePercent = [math]::Round(($compliantCount / $totalTests) * 100, 1) + + Write-Host "Total Tests: $totalTests" -ForegroundColor White + Write-Host "Compliant: $compliantCount" -ForegroundColor Green + Write-Host "Non-Compliant: $($totalTests - $compliantCount)" -ForegroundColor Red + Write-Host "Compliance: $compliancePercent%" -ForegroundColor $(if ($compliancePercent -ge 80) { 'Green' } elseif ($compliancePercent -ge 50) { 'Yellow' } else { 'Red' }) + Write-Host "" + + # Detailed results table + Write-Host "DETAILED RESULTS:" -ForegroundColor White + Write-Host "" + + $tableFormat = @{Expression = { $_.Feature }; Label = "Feature"; Width = 30 }, + @{Expression = { $_.Status }; Label = "Status"; Width = 20 }, + @{Expression = { if ($_.Compliant) { "[X]" }else { "[ ]" } }; Label = "Compliant"; Width = 10 } + + $results | Format-Table $tableFormat -AutoSize + + Write-Host "" + + # Return structured object with metadata for programmatic use + return [PSCustomObject]@{ + Results = $results + TotalChecks = $totalTests + CompliantCount = $compliantCount + Compliance = $compliancePercent + } + } + catch { + Write-Log -Level ERROR -Message "Failed to run compliance tests: $_" -Module "AdvancedSecurity" -Exception $_.Exception + Write-Host "" + Write-Host "ERROR: Failed to run compliance tests" -ForegroundColor Red + Write-Host $_.Exception.Message -ForegroundColor Gray + Write-Host "" + return $null + } +} diff --git a/Modules/AntiAI/AntiAI.psd1 b/Modules/AntiAI/AntiAI.psd1 new file mode 100644 index 0000000..a3c5f6d --- /dev/null +++ b/Modules/AntiAI/AntiAI.psd1 @@ -0,0 +1,35 @@ +@{ + RootModule = 'AntiAI.psm1' + ModuleVersion = '2.2.0' + GUID = 'f8e9d7c6-5b4a-3c2d-1e0f-9a8b7c6d5e4f' + Author = 'NexusOne23' + CompanyName = 'Open Source Project' + Copyright = '(c) 2025 NexusOne23. Licensed under GPL-3.0.' + Description = 'Comprehensive Windows 11 AI deactivation - Disables all 8+ AI features using official Microsoft policies (Recall, Copilot, Paint AI, Notepad AI, Click to Do, Settings Agent). Maximum compliance mode with enterprise-grade Recall protection.' + PowerShellVersion = '5.1' + + FunctionsToExport = @( + 'Invoke-AntiAI' + ) + + PrivateData = @{ + PSData = @{ + Tags = @('Windows11', 'AI', 'Privacy', 'Security', 'Recall', 'Copilot', 'AntiAI') + ProjectUri = 'https://github.com/yourusername/NoIDPrivacy' + ReleaseNotes = @' +v1.0.0 - Initial Release +- Disables 8+ Windows 11 AI features using official Microsoft policies +- Master switch: Blocks all generative AI models (Paint, Notepad, Photos, Clipchamp, Snipping Tool) +- Windows Recall: Complete deactivation (component removal + snapshots + data providers) +- Windows Recall: Enterprise protection (app/URI deny lists, storage limits) +- Windows Copilot: System-wide deactivation + hardware key remapping +- Click to Do: Screenshot analysis disabled +- Paint AI: Cocreator, Generative Fill, Image Creator disabled +- Notepad AI: Write, Summarize, Rewrite features disabled +- Settings Agent: AI-powered search in Settings disabled +- Full backup/restore capability +- Comprehensive compliance verification +'@ + } + } +} diff --git a/Modules/AntiAI/AntiAI.psm1 b/Modules/AntiAI/AntiAI.psm1 new file mode 100644 index 0000000..e8a065a --- /dev/null +++ b/Modules/AntiAI/AntiAI.psm1 @@ -0,0 +1,60 @@ +#Requires -Version 5.1 +#Requires -RunAsAdministrator + +<# +.SYNOPSIS + AntiAI Module Loader + +.DESCRIPTION + Disables all Windows 11 AI features using official Microsoft policies. + Includes Recall, Copilot, Paint AI, Notepad AI, Click to Do, Settings Agent, and Explorer AI Actions. + +.NOTES + Module: AntiAI + Version: 2.2.0 + Author: NoID Privacy +#> + +Set-StrictMode -Version Latest + +# Get module root path +$script:ModuleRoot = $PSScriptRoot + +# Import private functions +$privateFunctions = @( + 'Backup-AntiAISettings' + 'Restore-AntiAISettings' + 'Test-AntiAICompliance' + 'Set-SystemAIModels' + 'Disable-Recall' + 'Set-RecallProtection' + 'Disable-Copilot' + 'Disable-CopilotAdvanced' # NEW v2.2.0: URI handlers, Edge sidebar, Recall export + 'Disable-ClickToDo' + 'Disable-SettingsAgent' + 'Disable-ExplorerAI' # NEW: File Explorer AI Actions menu + 'Disable-NotepadAI' + 'Disable-PaintAI' +) + +foreach ($function in $privateFunctions) { + $functionPath = Join-Path $ModuleRoot "Private\$function.ps1" + if (Test-Path $functionPath) { + . $functionPath + } +} + +# Import public functions +$publicFunctions = @( + 'Invoke-AntiAI' +) + +foreach ($function in $publicFunctions) { + $functionPath = Join-Path $ModuleRoot "Public\$function.ps1" + if (Test-Path $functionPath) { + . $functionPath + } +} + +# Export public functions + Test-AntiAICompliance (needed for Invoke-AntiAI verification) +Export-ModuleMember -Function @($publicFunctions + 'Test-AntiAICompliance') diff --git a/Modules/AntiAI/Config/AntiAI-Settings.json b/Modules/AntiAI/Config/AntiAI-Settings.json new file mode 100644 index 0000000..91844a7 --- /dev/null +++ b/Modules/AntiAI/Config/AntiAI-Settings.json @@ -0,0 +1,419 @@ +{ + "ModuleName": "AntiAI", + "Version": "1.0.0", + "Description": "Maximum AI deactivation - Disables all 13 Windows 11 AI features using official Microsoft policies", + "Mode": "Maximum Compliance (Enterprise-Grade)", + "TotalFeatures": 13, + "TotalPolicies": 32, + + "Features": { + "1_GenerativeAI_Master": { + "Name": "Generative AI Master Switch", + "Description": "Blocks ALL apps from using Windows on-device generative AI models AND app-level generative AI access", + "Impact": "Disables generative AI in Notepad, Paint, Photos, Clipchamp, Snipping Tool, and all future apps. Also blocks app access to generative AI features.", + "CloudBased": false, + "Registry": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy": { + "LetAppsAccessSystemAIModels": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny - No app can access on-device generative AI models (0=User decides, 1=Force Allow, 2=Force Deny)" + }, + "LetAppsAccessGenerativeAI": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny - Block app access to generative AI features (Text & Image Generation in Settings)" + } + }, + "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\systemAIModels": { + "Value": { + "Type": "String", + "Value": "Deny", + "Description": "CapabilityAccessManager Workaround - Blocks Paint Generative Erase/Background Removal" + } + } + } + }, + + "2_Windows_Recall": { + "Name": "Windows Recall (Complete Deactivation + Enterprise Protection)", + "Description": "Takes continuous screenshots of EVERYTHING on your screen (passwords, banking, private messages) and stores them locally for AI-powered search. EXTREME privacy risk!", + "Impact": "Component completely removed from system, all snapshots deleted, background data providers disabled, apps/URLs protected", + "CloudBased": false, + "RequiresReboot": true, + "Registry": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsAI": { + "AllowRecallEnablement": { + "Type": "DWord", + "Value": 0, + "Description": "REMOVE Recall component from system + delete all existing snapshots (requires reboot)" + }, + "DisableAIDataAnalysis": { + "Type": "DWord", + "Value": 1, + "Description": "PREVENT saving new snapshots for Recall (Device-scope)" + } + }, + "HKCU:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsAI": { + "DisableAIDataAnalysis": { + "Type": "DWord", + "Value": 1, + "Description": "PREVENT saving new snapshots for Recall (User-scope)" + }, + "DisableRecallDataProviders": { + "Type": "DWord", + "Value": 1, + "Description": "DISABLE Recall background data providers (Enterprise/Education only)" + } + } + }, + "EnterpriseProtection": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsAI": { + "SetDenyAppListForRecall": { + "Type": "MultiString", + "Value": [ + "Microsoft.MicrosoftEdge_8wekyb3d8bbwe!App", + "Microsoft.WindowsTerminal_8wekyb3d8bbwe!App", + "KeePassXC_8wekyb3d8bbwe!KeePassXC", + "Microsoft.RemoteDesktop_8wekyb3d8bbwe!App" + ], + "Description": "Apps NEVER captured in snapshots (Browser for Banking, Terminal for Passwords, KeePass, RDP)" + }, + "SetDenyUriListForRecall": { + "Type": "MultiString", + "Value": [ + "*.bank.*", + "*.paypal.*", + "*.bankofamerica.*", + "mail.*", + "webmail.*", + "*password*", + "*login*" + ], + "Description": "Websites/URLs NEVER captured in snapshots (Banking, Email, Login pages)" + }, + "SetMaximumStorageDurationForRecallSnapshots": { + "Type": "DWord", + "Value": 30, + "Description": "Maximum snapshot retention: 30 days (Choices: 30/60/90/180 days, 0=OS default)" + }, + "SetMaximumStorageSpaceForRecallSnapshots": { + "Type": "DWord", + "Value": 10, + "Description": "Maximum snapshot storage: 10 GB (Choices: 10/25/50/75/100/150 GB, 0=OS default)" + } + } + } + }, + + "3_Windows_Copilot": { + "Name": "Windows Copilot (System-Wide AI Assistant - 4-Layer Defense)", + "Description": "Microsoft's AI assistant integrated into Windows (chat, suggestions, proactive recommendations)", + "Impact": "Copilot completely disabled in UI, taskbar, and search. Hardware Copilot key remapped to Notepad.", + "CloudBased": true, + "Registry": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsAI": { + "TurnOffWindowsCopilot": { + "Type": "DWord", + "Value": 1, + "Description": "DISABLE Copilot Layer 1 (WindowsAI HKLM)" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsCopilot": { + "TurnOffWindowsCopilot": { + "Type": "DWord", + "Value": 1, + "Description": "DISABLE Copilot Layer 2 (WindowsCopilot HKLM)" + }, + "ShowCopilotButton": { + "Type": "DWord", + "Value": 0, + "Description": "HIDE Copilot Layer 3 (Taskbar Button Hidden HKLM)" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Explorer": { + "DisableWindowsCopilot": { + "Type": "DWord", + "Value": 1, + "Description": "DISABLE Copilot Layer 4 (Explorer Integration HKLM)" + } + }, + "HKCU:\\Software\\Policies\\Microsoft\\Windows\\WindowsCopilot": { + "TurnOffWindowsCopilot": { + "Type": "DWord", + "Value": 1, + "Description": "DISABLE Windows Copilot User-scope (HKCU)" + }, + "ShowCopilotButton": { + "Type": "DWord", + "Value": 0, + "Description": "HIDE Copilot Button User-scope (HKCU)" + } + }, + "HKCU:\\Software\\Policies\\Microsoft\\Windows\\WindowsAI": { + "SetCopilotHardwareKey": { + "Type": "String", + "Value": "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App", + "Description": "REMAP hardware Copilot key to open Notepad instead" + } + } + } + }, + + "4_Click_to_Do": { + "Name": "Click to Do (Screenshot AI Analysis)", + "Description": "Takes on-demand screenshots and analyzes them with AI to suggest actions (copy text, search, call numbers)", + "Impact": "Screenshot analysis feature completely disabled", + "CloudBased": false, + "Registry": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsAI": { + "DisableClickToDo": { + "Type": "DWord", + "Value": 1, + "Description": "DISABLE Click to Do (no screenshot AI analysis, no action suggestions)" + } + }, + "HKCU:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsAI": { + "DisableClickToDo": { + "Type": "DWord", + "Value": 1, + "Description": "DISABLE Click to Do (User-scope)" + } + } + } + }, + + "5_Paint_Cocreator": { + "Name": "Paint Cocreator (Cloud-Based Image Generation)", + "Description": "Text-to-image generation using cloud AI (type description, AI creates artwork)", + "Impact": "Cocreator feature completely removed from Paint app", + "CloudBased": true, + "Registry": { + "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Paint": { + "DisableCocreator": { + "Type": "DWord", + "Value": 1, + "Description": "DISABLE Paint Cocreator (no AI-generated images from text prompts)" + } + } + } + }, + + "6_Paint_Generative_Fill": { + "Name": "Paint Generative Fill (Cloud-Based AI Editing)", + "Description": "AI-powered image editing (fill selected areas with AI-generated content)", + "Impact": "Generative Fill feature completely removed from Paint app", + "CloudBased": true, + "Registry": { + "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Paint": { + "DisableGenerativeFill": { + "Type": "DWord", + "Value": 1, + "Description": "DISABLE Paint Generative Fill (no AI-powered content-aware fill)" + } + } + } + }, + + "7_Paint_Image_Creator": { + "Name": "Paint Image Creator (Cloud-Based AI Art)", + "Description": "DALL-E powered AI art generator integrated into Paint", + "Impact": "Image Creator feature completely removed from Paint app", + "CloudBased": true, + "Registry": { + "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Paint": { + "DisableImageCreator": { + "Type": "DWord", + "Value": 1, + "Description": "DISABLE Paint Image Creator (no DALL-E AI art generation)" + } + } + } + }, + + "8_Notepad_AI": { + "Name": "Notepad AI (Copilot Integration - Write, Summarize, Rewrite)", + "Description": "GPT-powered AI features in Notepad (generate text, summarize content, rewrite paragraphs)", + "Impact": "All AI features completely removed from Notepad app", + "CloudBased": true, + "RequiresADMX": false, + "Note": "ADMX file (WindowsNotepad.admx) is NOT required - registry policy works without it. ADMX only provides GUI visibility in gpedit.msc.", + "Registry": { + "HKLM:\\SOFTWARE\\Policies\\WindowsNotepad": { + "DisableAIFeatures": { + "Type": "DWord", + "Value": 1, + "Description": "DISABLE all AI features in Notepad (Write, Summarize, Rewrite, Explain) - Microsoft official registry value name" + } + } + } + }, + + "9_Settings_Agent": { + "Name": "Settings Agent (AI-Powered Settings Search)", + "Description": "AI-enhanced natural language search in Windows Settings (understands questions like 'How do I change wallpaper?')", + "Impact": "AI search disabled, only classic keyword search remains", + "CloudBased": false, + "Registry": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsAI": { + "DisableSettingsAgent": { + "Type": "DWord", + "Value": 1, + "Description": "DISABLE Settings AI agent (fallback to classic search without natural language understanding)" + } + } + } + }, + + "10_Recall_Export_Block": { + "Name": "Recall Export Prevention (NEW - KB5055627)", + "Description": "Prevents users from exporting Recall snapshots to share with apps/websites (EEA compliance feature)", + "Impact": "Export functionality completely disabled, prevents data exfiltration", + "CloudBased": false, + "Registry": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsAI": { + "AllowRecallExport": { + "Type": "DWord", + "Value": 0, + "Description": "PREVENT Recall snapshot export (0=Disabled, 1=Allowed)" + } + } + } + }, + + "11_Copilot_URI_Handlers": { + "Name": "Copilot URI Protocol Handlers (Deep Link Block)", + "Description": "Blocks ms-copilot: and ms-edge-copilot: URI handlers that bypass policy restrictions", + "Impact": "Prevents launching Copilot via deep links, Start menu search, or third-party apps", + "CloudBased": false, + "URIHandlers": [ + "ms-copilot", + "ms-edge-copilot" + ], + "Note": "These handlers are in HKEY_CLASSES_ROOT and route Copilot requests to Edge" + }, + + "12_Edge_Copilot_Sidebar": { + "Name": "Microsoft Edge Copilot Sidebar (Browser AI)", + "Description": "Disables Copilot integration in Edge browser sidebar", + "Impact": "Edge sidebar and Copilot features completely disabled", + "CloudBased": true, + "Registry": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Edge": { + "EdgeSidebarEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "DISABLE Edge sidebar completely" + }, + "ShowHubsSidebar": { + "Type": "DWord", + "Value": 0, + "Description": "HIDE sidebar panel" + }, + "HubsSidebarEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "DISABLE Hubs sidebar" + }, + "CopilotPageContext": { + "Type": "DWord", + "Value": 0, + "Description": "PREVENT Copilot from accessing page content" + }, + "CopilotCDPPageContext": { + "Type": "DWord", + "Value": 0, + "Description": "PREVENT Copilot CDP page context" + } + } + } + }, + + "13_Region_Policy_Override": { + "Name": "IntegratedServicesRegionPolicySet.json Override", + "Description": "Modifies Windows regional policy file to disable Copilot globally (bypasses region restrictions)", + "Impact": "Copilot disabled at OS level regardless of region setting", + "CloudBased": false, + "FilePath": "C:\\Windows\\System32\\IntegratedServicesRegionPolicySet.json", + "Note": "Requires TakeOwnership of system file - changes 'Windows CoPilot' policy to disabled" + }, + + "14_Copilot_Network_Block": { + "Name": "Copilot Network Block (Hosts File)", + "Description": "Blocks Copilot cloud endpoints via hosts file redirect", + "Impact": "Web-based Copilot completely unreachable", + "CloudBased": true, + "HostsEntries": [ + "copilot.microsoft.com", + "www.bing.com/copilot", + "edgeservices.bing.com" + ], + "Note": "Optional aggressive blocking - may affect legitimate Bing searches" + }, + + "15_File_Explorer_AI_Actions": { + "Name": "File Explorer AI Actions Menu", + "Description": "Hides 'AI Actions' entry from File Explorer right-click context menu (image editing, text summarization, etc.)", + "Impact": "AI Actions menu entry removed from Explorer context menu", + "CloudBased": false, + "Registry": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Explorer": { + "HideAIActionsMenu": { + "Type": "DWord", + "Value": 1, + "Description": "HIDE AI Actions from File Explorer context menu" + } + } + } + } + }, + + "AutomaticallyBlockedByMasterSwitch": { + "Description": "These AI features are automatically blocked by the Generative AI Master Switch (no dedicated policies exist)", + "Features": [ + { + "Name": "Photos Generative Erase", + "Description": "AI-powered object removal from photos" + }, + { + "Name": "Photos Background Blur/Remove", + "Description": "AI background effects in Photos app" + }, + { + "Name": "Photos Auto-Categorization", + "Description": "AI-powered photo organization (Receipts, IDs, Screenshots, Notes)" + }, + { + "Name": "Snipping Tool AI-OCR", + "Description": "Text extraction and actions from screenshots" + }, + { + "Name": "Snipping Tool Quick Redact", + "Description": "AI-powered sensitive data redaction" + }, + { + "Name": "Clipchamp Auto Compose", + "Description": "AI-powered automatic video editing" + }, + { + "Name": "All Future Generative AI Apps", + "Description": "Any app that uses Windows generative AI models" + } + ] + }, + + "Summary": { + "TotalAIFeaturesDisabled": "13 features (10 dedicated + 3 advanced blocks + unlimited via master switch)", + "TotalPoliciesApplied": 32, + "RegistryKeysModified": 32, + "URIHandlersBlocked": 2, + "RequiresReboot": "Yes (for Recall component removal)", + "RequiresADMX": "No (all policies work via registry, no ADMX needed)", + "CloudAIBlocked": "All documented Windows 11 25H2 cloud-based AI features", + "OnDeviceAIBlocked": "All on-device generative AI models via systemAIModels API", + "EdgeAIBlocked": "Copilot sidebar, page context, all AI integrations", + "DeepLinksBlocked": "ms-copilot: and ms-edge-copilot: URI protocols", + "EnterpriseCompliance": "Maximum (Recall app/URI protection, storage limits, export block)", + "MSBestPractice": "Based on OFFICIAL Microsoft registry policies ONLY (no community workarounds)" + } +} diff --git a/Modules/AntiAI/Private/Disable-ClickToDo.ps1 b/Modules/AntiAI/Private/Disable-ClickToDo.ps1 new file mode 100644 index 0000000..2bb6c20 --- /dev/null +++ b/Modules/AntiAI/Private/Disable-ClickToDo.ps1 @@ -0,0 +1,97 @@ +#Requires -Version 5.1 + +<# +.SYNOPSIS + Disables Click to Do (screenshot AI analysis). + +.DESCRIPTION + Applies DisableClickToDo = 1 policy (Device and User scope). + + Click to Do takes on-demand screenshots and analyzes them with AI to suggest actions: + - Extract and copy text + - Search for selected content + - Call detected phone numbers + - Email detected addresses + + Disabling prevents all screenshot AI analysis and action suggestions. + +.EXAMPLE + Disable-ClickToDo +#> +function Disable-ClickToDo { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + Write-Log -Level DEBUG -Message "Disabling Click to Do (screenshot AI analysis)" -Module "AntiAI" + + $result = [PSCustomObject]@{ + Success = $false + Applied = 0 + Errors = @() + } + + try { + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would disable Click to Do (DisableClickToDo=1)" -Module "AntiAI" + $result.Applied++ + $result.Success = $true + return $result + } + + # Device-scope (HKLM) + $devicePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" + if (-not (Test-Path $devicePath)) { + New-Item -Path $devicePath -Force | Out-Null + Write-Log -Level DEBUG -Message "Created registry path: $devicePath" -Module "AntiAI" + } + + $existing = Get-ItemProperty -Path $devicePath -Name "DisableClickToDo" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $devicePath -Name "DisableClickToDo" -Value 1 -Force + } else { + New-ItemProperty -Path $devicePath -Name "DisableClickToDo" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set DisableClickToDo = 1 (Device-scope)" -Module "AntiAI" + $result.Applied++ + + # User-scope (HKCU) + $userPath = "HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" + if (-not (Test-Path $userPath)) { + New-Item -Path $userPath -Force | Out-Null + Write-Log -Level DEBUG -Message "Created registry path: $userPath" -Module "AntiAI" + } + + $existing = Get-ItemProperty -Path $userPath -Name "DisableClickToDo" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $userPath -Name "DisableClickToDo" -Value 1 -Force + } else { + New-ItemProperty -Path $userPath -Name "DisableClickToDo" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set DisableClickToDo = 1 (User-scope)" -Module "AntiAI" + $result.Applied++ + + # Verify + $deviceValues = Get-ItemProperty -Path $devicePath -ErrorAction SilentlyContinue + $userValues = Get-ItemProperty -Path $userPath -ErrorAction SilentlyContinue + + $verified = ($deviceValues.DisableClickToDo -eq 1) -and + ($userValues.DisableClickToDo -eq 1) + + if ($verified) { + Write-Log -Level DEBUG -Message "Verification SUCCESS: Click to Do disabled" -Module "AntiAI" + $result.Success = $true + } + else { + $result.Errors += "Verification FAILED: Click to Do policy not applied correctly" + } + } + catch { + $result.Errors += "Failed to disable Click to Do: $($_.Exception.Message)" + Write-Error $result.Errors[-1] + } + + return $result +} diff --git a/Modules/AntiAI/Private/Disable-Copilot.ps1 b/Modules/AntiAI/Private/Disable-Copilot.ps1 new file mode 100644 index 0000000..fe31569 --- /dev/null +++ b/Modules/AntiAI/Private/Disable-Copilot.ps1 @@ -0,0 +1,250 @@ +#Requires -Version 5.1 + +<# +.SYNOPSIS + Disables Windows Copilot system-wide (App Removal + Multi-Layer Policies). + +.DESCRIPTION + Complete Copilot removal for Windows 11 24H2/25H2+: + + LAYER 0: APP REMOVAL (NEW - Windows 11 24H2/25H2+) + - Removes Copilot AppX packages (current user, all users, provisioned) + - Prevents Copilot integration in Paint, Office, and other apps + - Microsoft Official: TurnOffWindowsCopilot policy is DEPRECATED in 24H2+ + - Reference: https://learn.microsoft.com/en-us/windows/client-management/manage-windows-copilot + + LEGACY LAYERS (for older Windows 11 versions): + - Layer 1-4: Registry policies (WindowsAI, WindowsCopilot, Explorer) + - Layer 5: Hardware key remap to Notepad + + Multi-layer approach ensures maximum compatibility across all Windows 11 versions. + +.PARAMETER DryRun + Simulates the operation without making changes. + +.EXAMPLE + Disable-Copilot + +.NOTES + Requires Administrator privileges. + Best Practice: Run with -Verbose to see detailed operation log. +#> +function Disable-Copilot { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + Write-Log -Level DEBUG -Message "Disabling Windows Copilot (multi-layer defense + app removal)" -Module "AntiAI" + + $result = [PSCustomObject]@{ + Success = $false + Applied = 0 + Errors = @() + CopilotAppRemoved = $false + } + + try { + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would disable Copilot (app removal + policies + hardware key)" -Module "AntiAI" + $result.Applied += 8 # 1 app removal + 2 HKLM policies + 1 ShowButton + 1 Explorer + 2 HKCU + 1 HW key + $result.CopilotAppRemoved = $true + $result.Success = $true + return $result + } + + # ============================================================================ + # LAYER 0: REMOVE COPILOT APP (Windows 11 24H2/25H2+) + # ============================================================================ + # Microsoft official: TurnOffWindowsCopilot policy is DEPRECATED in 24H2+ + # New method: Uninstall Copilot app completely (prevents in-app integration) + # Reference: https://learn.microsoft.com/en-us/windows/client-management/manage-windows-copilot + + Write-Log -Level DEBUG -Message "Layer 0: Removing Copilot app packages..." -Module "AntiAI" + + # Step 1: Remove for current user + $copilotPackages = Get-AppxPackage -Name "*Copilot*" -ErrorAction SilentlyContinue + if ($copilotPackages) { + foreach ($package in $copilotPackages) { + try { + Remove-AppxPackage -Package $package.PackageFullName -ErrorAction Stop + Write-Log -Level DEBUG -Message "Removed Copilot package: $($package.Name)" -Module "AntiAI" + $result.CopilotAppRemoved = $true + } + catch { + Write-Log -Level DEBUG -Message "Could not remove package $($package.Name): $($_.Exception.Message)" -Module "AntiAI" + } + } + } + + # Step 2: Remove for all users (requires admin) + $copilotAllUsers = Get-AppxPackage -AllUsers -Name "*Copilot*" -ErrorAction SilentlyContinue + if ($copilotAllUsers) { + foreach ($package in $copilotAllUsers) { + try { + Remove-AppxPackage -Package $package.PackageFullName -AllUsers -ErrorAction Stop + Write-Log -Level DEBUG -Message "Removed Copilot package (all users): $($package.Name)" -Module "AntiAI" + $result.CopilotAppRemoved = $true + } + catch { + Write-Log -Level DEBUG -Message "Could not remove package for all users: $($_.Exception.Message)" -Module "AntiAI" + } + } + } + + # Step 3: Remove provisioned packages (prevents reinstall for new users) + $provisionedCopilot = Get-AppxProvisionedPackage -Online -ErrorAction SilentlyContinue | + Where-Object { $_.PackageName -like "*Copilot*" } + if ($provisionedCopilot) { + foreach ($package in $provisionedCopilot) { + try { + Remove-AppxProvisionedPackage -Online -PackageName $package.PackageName -ErrorAction Stop | Out-Null + Write-Log -Level DEBUG -Message "Removed provisioned Copilot package: $($package.PackageName)" -Module "AntiAI" + $result.CopilotAppRemoved = $true + } + catch { + Write-Log -Level DEBUG -Message "Could not remove provisioned package: $($_.Exception.Message)" -Module "AntiAI" + } + } + } + + if ($result.CopilotAppRemoved) { + Write-Log -Level DEBUG -Message "Layer 0: Copilot app packages removed successfully" -Module "AntiAI" + $result.Applied++ + } + else { + Write-Log -Level DEBUG -Message "Layer 0: No Copilot app packages found (already removed or not installed)" -Module "AntiAI" + } + + # ============================================================================ + # LEGACY LAYERS: Registry policies (still needed for older Windows 11 versions) + # ============================================================================ + + # MULTI-LAYER COPILOT BLOCKING (SecurityBaseline Best Practice) + + # Layer 1: WindowsAI\TurnOffWindowsCopilot (HKLM - machine-wide) + $aiPolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" + if (-not (Test-Path $aiPolicyPath)) { + New-Item -Path $aiPolicyPath -Force | Out-Null + } + + $existing = Get-ItemProperty -Path $aiPolicyPath -Name "TurnOffWindowsCopilot" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $aiPolicyPath -Name "TurnOffWindowsCopilot" -Value 1 -Force | Out-Null + } else { + New-ItemProperty -Path $aiPolicyPath -Name "TurnOffWindowsCopilot" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Layer 1: WindowsAI\TurnOffWindowsCopilot (HKLM) = 1" -Module "AntiAI" + $result.Applied++ + + # Layer 2: WindowsCopilot\TurnOffWindowsCopilot (HKLM - legacy path) + $copilotPathHKLM = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot" + if (-not (Test-Path $copilotPathHKLM)) { + New-Item -Path $copilotPathHKLM -Force | Out-Null + } + + $existing = Get-ItemProperty -Path $copilotPathHKLM -Name "TurnOffWindowsCopilot" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $copilotPathHKLM -Name "TurnOffWindowsCopilot" -Value 1 -Force | Out-Null + } else { + New-ItemProperty -Path $copilotPathHKLM -Name "TurnOffWindowsCopilot" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Layer 2: WindowsCopilot\TurnOffWindowsCopilot (HKLM) = 1" -Module "AntiAI" + $result.Applied++ + + # Layer 3: ShowCopilotButton = 0 (Hide taskbar button) + $existing = Get-ItemProperty -Path $copilotPathHKLM -Name "ShowCopilotButton" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $copilotPathHKLM -Name "ShowCopilotButton" -Value 0 -Force | Out-Null + } else { + New-ItemProperty -Path $copilotPathHKLM -Name "ShowCopilotButton" -Value 0 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Layer 3: ShowCopilotButton (HKLM) = 0" -Module "AntiAI" + $result.Applied++ + + # Layer 4: Explorer\DisableWindowsCopilot (Block Explorer integration) + $explorerPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" + if (-not (Test-Path $explorerPath)) { + New-Item -Path $explorerPath -Force | Out-Null + } + + $existing = Get-ItemProperty -Path $explorerPath -Name "DisableWindowsCopilot" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $explorerPath -Name "DisableWindowsCopilot" -Value 1 -Force | Out-Null + } else { + New-ItemProperty -Path $explorerPath -Name "DisableWindowsCopilot" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Layer 4: Explorer\DisableWindowsCopilot (HKLM) = 1" -Module "AntiAI" + $result.Applied++ + + # User-scope policies (HKCU - additional protection) + $copilotPathHKCU = "HKCU:\Software\Policies\Microsoft\Windows\WindowsCopilot" + if (-not (Test-Path $copilotPathHKCU)) { + New-Item -Path $copilotPathHKCU -Force | Out-Null + } + + $existing = Get-ItemProperty -Path $copilotPathHKCU -Name "TurnOffWindowsCopilot" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $copilotPathHKCU -Name "TurnOffWindowsCopilot" -Value 1 -Force | Out-Null + } else { + New-ItemProperty -Path $copilotPathHKCU -Name "TurnOffWindowsCopilot" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "User-scope: WindowsCopilot\TurnOffWindowsCopilot (HKCU) = 1" -Module "AntiAI" + $result.Applied++ + + $existing = Get-ItemProperty -Path $copilotPathHKCU -Name "ShowCopilotButton" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $copilotPathHKCU -Name "ShowCopilotButton" -Value 0 -Force | Out-Null + } else { + New-ItemProperty -Path $copilotPathHKCU -Name "ShowCopilotButton" -Value 0 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "User-scope: ShowCopilotButton (HKCU) = 0" -Module "AntiAI" + $result.Applied++ + + # Layer 5: Remap hardware Copilot key to Notepad (neutralize dedicated key) + $aiPathHKCU = "HKCU:\Software\Policies\Microsoft\Windows\WindowsAI" + if (-not (Test-Path $aiPathHKCU)) { + New-Item -Path $aiPathHKCU -Force | Out-Null + } + + $notepadAUMID = "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App" + $existing = Get-ItemProperty -Path $aiPathHKCU -Name "SetCopilotHardwareKey" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $aiPathHKCU -Name "SetCopilotHardwareKey" -Value $notepadAUMID -Force | Out-Null + } else { + New-ItemProperty -Path $aiPathHKCU -Name "SetCopilotHardwareKey" -Value $notepadAUMID -PropertyType String -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Layer 5: Hardware Copilot key remapped to Notepad" -Module "AntiAI" + $result.Applied++ + + # Verify all layers + $aiHKLM = Get-ItemProperty -Path $aiPolicyPath -ErrorAction SilentlyContinue + $copilotHKLM = Get-ItemProperty -Path $copilotPathHKLM -ErrorAction SilentlyContinue + $explorerHKLM = Get-ItemProperty -Path $explorerPath -ErrorAction SilentlyContinue + $copilotHKCU = Get-ItemProperty -Path $copilotPathHKCU -ErrorAction SilentlyContinue + $aiHKCU = Get-ItemProperty -Path $aiPathHKCU -ErrorAction SilentlyContinue + + $verified = ($aiHKLM.TurnOffWindowsCopilot -eq 1) -and + ($copilotHKLM.TurnOffWindowsCopilot -eq 1) -and + ($copilotHKLM.ShowCopilotButton -eq 0) -and + ($explorerHKLM.DisableWindowsCopilot -eq 1) -and + ($copilotHKCU.TurnOffWindowsCopilot -eq 1) -and + ($copilotHKCU.ShowCopilotButton -eq 0) -and + ($aiHKCU.SetCopilotHardwareKey -eq $notepadAUMID) + + if ($verified) { + Write-Log -Level DEBUG -Message "Verification SUCCESS: All Copilot policies configured (MS official keys only)" -Module "AntiAI" + $result.Success = $true + } + else { + $result.Errors += "Verification FAILED: Not all Copilot policies applied correctly" + } + } + catch { + $result.Errors += "Failed to disable Copilot: $($_.Exception.Message)" + Write-Error $result.Errors[-1] + } + + return $result +} diff --git a/Modules/AntiAI/Private/Disable-CopilotAdvanced.ps1 b/Modules/AntiAI/Private/Disable-CopilotAdvanced.ps1 new file mode 100644 index 0000000..670d181 --- /dev/null +++ b/Modules/AntiAI/Private/Disable-CopilotAdvanced.ps1 @@ -0,0 +1,206 @@ +#Requires -Version 5.1 + +<# +.SYNOPSIS + Advanced Copilot blocking - URI handlers, Edge sidebar, region policy, network block. + +.DESCRIPTION + Multi-layer advanced Copilot blocking for Windows 11 24H2/25H2+: + + LAYER 1: RECALL EXPORT BLOCK (KB5055627) + - AllowRecallExport = 0 (prevents snapshot export) + + LAYER 2: URI PROTOCOL HANDLERS + - Blocks ms-copilot: and ms-edge-copilot: deep links + - Prevents Start menu search and third-party app launching + + LAYER 3: EDGE COPILOT SIDEBAR + - Disables sidebar completely + - Blocks page context access + - 5 registry policies + + LAYER 4: REGION POLICY OVERRIDE (Optional) + - Modifies IntegratedServicesRegionPolicySet.json + - Disables Copilot at OS level regardless of region + + LAYER 5: NETWORK BLOCK (Optional) + - Hosts file redirect for copilot endpoints + +.PARAMETER DryRun + Simulates the operation without making changes. + +.PARAMETER SkipNetworkBlock + Skip hosts file modification (less aggressive). + +.PARAMETER SkipRegionPolicy + Skip IntegratedServicesRegionPolicySet.json modification. + +.EXAMPLE + Disable-CopilotAdvanced + +.NOTES + Requires Administrator privileges. + Part of NoID Privacy AntiAI Module v2.2.0 +#> +function Disable-CopilotAdvanced { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + Write-Log -Level DEBUG -Message "Disabling Copilot (Advanced Layers)" -Module "AntiAI" + + $result = [PSCustomObject]@{ + Success = $false + Applied = 0 + Errors = @() + RecallExportBlocked = $false + URIHandlersBlocked = $false + EdgeSidebarDisabled = $false + } + + try { + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would apply advanced Copilot blocks" -Module "AntiAI" + $result.Applied = 3 # 3 official MS features: RecallExport, URIHandlers, EdgeSidebar + $result.Success = $true + return $result + } + + # ============================================================================ + # LAYER 1: RECALL EXPORT BLOCK (KB5055627 - NEW) + # ============================================================================ + Write-Log -Level DEBUG -Message "Layer 1: Blocking Recall Export..." -Module "AntiAI" + + $aiPolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" + if (-not (Test-Path $aiPolicyPath)) { + New-Item -Path $aiPolicyPath -Force | Out-Null + } + + try { + $existing = Get-ItemProperty -Path $aiPolicyPath -Name "AllowRecallExport" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $aiPolicyPath -Name "AllowRecallExport" -Value 0 -Force | Out-Null + } else { + New-ItemProperty -Path $aiPolicyPath -Name "AllowRecallExport" -Value 0 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "AllowRecallExport = 0 (export disabled)" -Module "AntiAI" + $result.RecallExportBlocked = $true + $result.Applied++ + } + catch { + Write-Log -Level WARNING -Message "Failed to set AllowRecallExport: $_" -Module "AntiAI" + $result.Errors += "AllowRecallExport: $_" + } + + # ============================================================================ + # LAYER 2: URI PROTOCOL HANDLERS (ms-copilot:, ms-edge-copilot:) + # ============================================================================ + Write-Log -Level DEBUG -Message "Layer 2: Blocking URI handlers..." -Module "AntiAI" + + $uriHandlers = @("ms-copilot", "ms-edge-copilot") + $uriBlocked = 0 + + foreach ($handler in $uriHandlers) { + $handlerPath = "Registry::HKEY_CLASSES_ROOT\$handler" + + try { + if (Test-Path $handlerPath) { + # Rename the key to disable it (preserves for restore) + $backupPath = "Registry::HKEY_CLASSES_ROOT\${handler}_DISABLED_BY_NOID" + + # Check if already disabled + if (-not (Test-Path $backupPath)) { + # Delete the original handler (blocks the protocol) + Remove-Item -Path $handlerPath -Recurse -Force -ErrorAction Stop + + # Create marker for restore + New-Item -Path $backupPath -Force | Out-Null + New-ItemProperty -Path $backupPath -Name "OriginallyExisted" -Value 1 -PropertyType DWord -Force | Out-Null + New-ItemProperty -Path $backupPath -Name "DisabledBy" -Value "NoID Privacy AntiAI" -PropertyType String -Force | Out-Null + New-ItemProperty -Path $backupPath -Name "DisabledAt" -Value (Get-Date -Format "o") -PropertyType String -Force | Out-Null + + Write-Log -Level DEBUG -Message "Blocked URI handler: $handler" -Module "AntiAI" + $uriBlocked++ + } + else { + Write-Log -Level DEBUG -Message "URI handler already blocked: $handler" -Module "AntiAI" + $uriBlocked++ + } + } + else { + Write-Log -Level DEBUG -Message "URI handler not found (already removed): $handler" -Module "AntiAI" + $uriBlocked++ + } + } + catch { + Write-Log -Level WARNING -Message "Failed to block URI handler $handler : $_" -Module "AntiAI" + $result.Errors += "URI $handler : $_" + } + } + + if ($uriBlocked -gt 0) { + $result.URIHandlersBlocked = $true + $result.Applied++ + } + + # ============================================================================ + # LAYER 3: EDGE COPILOT SIDEBAR + # ============================================================================ + Write-Log -Level DEBUG -Message "Layer 3: Disabling Edge Copilot Sidebar..." -Module "AntiAI" + + $edgePolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge" + if (-not (Test-Path $edgePolicyPath)) { + New-Item -Path $edgePolicyPath -Force | Out-Null + } + + $edgePolicies = @( + @{ Name = "EdgeSidebarEnabled"; Value = 0; Desc = "Edge sidebar" }, + @{ Name = "ShowHubsSidebar"; Value = 0; Desc = "Hubs sidebar visibility" }, + @{ Name = "HubsSidebarEnabled"; Value = 0; Desc = "Hubs sidebar" }, + @{ Name = "CopilotPageContext"; Value = 0; Desc = "Copilot page context" }, + @{ Name = "CopilotCDPPageContext"; Value = 0; Desc = "Copilot CDP context" } + ) + + $edgeApplied = 0 + foreach ($policy in $edgePolicies) { + try { + $existing = Get-ItemProperty -Path $edgePolicyPath -Name $policy.Name -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $edgePolicyPath -Name $policy.Name -Value $policy.Value -Force | Out-Null + } else { + New-ItemProperty -Path $edgePolicyPath -Name $policy.Name -Value $policy.Value -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Edge: $($policy.Name) = $($policy.Value)" -Module "AntiAI" + $edgeApplied++ + } + catch { + Write-Log -Level WARNING -Message "Failed to set Edge policy $($policy.Name): $_" -Module "AntiAI" + } + } + + if ($edgeApplied -eq $edgePolicies.Count) { + $result.EdgeSidebarDisabled = $true + $result.Applied++ + } + + # NOTE: Layer 4 (RegionPolicy) and Layer 5 (NetworkBlock) REMOVED + # Reason: NOT Microsoft Best Practice + # - IntegratedServicesRegionPolicySet.json: Community workaround, can break with updates + # - Hosts file blocking: "Not officially supported" per Microsoft Q&A + # We only use official Registry Policies as per MS documentation + + # Determine overall success + $result.Success = ($result.RecallExportBlocked -or $result.URIHandlersBlocked -or + $result.EdgeSidebarDisabled) -and ($result.Errors.Count -eq 0) + + Write-Log -Level DEBUG -Message "Advanced Copilot blocks applied: $($result.Applied)" -Module "AntiAI" + } + catch { + $result.Errors += "Critical error: $($_.Exception.Message)" + Write-Error $result.Errors[-1] + } + + return $result +} diff --git a/Modules/AntiAI/Private/Disable-ExplorerAI.ps1 b/Modules/AntiAI/Private/Disable-ExplorerAI.ps1 new file mode 100644 index 0000000..421d673 --- /dev/null +++ b/Modules/AntiAI/Private/Disable-ExplorerAI.ps1 @@ -0,0 +1,76 @@ +#Requires -Version 5.1 + +<# +.SYNOPSIS + Disables AI Actions in File Explorer context menu. + +.DESCRIPTION + Applies HideAIActionsMenu = 1 policy. + + File Explorer AI Actions provides AI-powered features in the right-click menu: + - Image editing with AI (background removal, effects) + - Text summarization + - AI-powered file actions + + Disabling removes the "AI Actions" entry from the File Explorer context menu. + +.EXAMPLE + Disable-ExplorerAI +#> +function Disable-ExplorerAI { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + Write-Log -Level DEBUG -Message "Disabling File Explorer AI Actions Menu" -Module "AntiAI" + + $result = [PSCustomObject]@{ + Success = $false + Applied = 0 + Errors = @() + } + + try { + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would disable Explorer AI Actions (HideAIActionsMenu=1)" -Module "AntiAI" + $result.Applied++ + $result.Success = $true + return $result + } + + $regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" + + if (-not (Test-Path $regPath)) { + New-Item -Path $regPath -Force | Out-Null + Write-Log -Level DEBUG -Message "Created registry path: $regPath" -Module "AntiAI" + } + + $existing = Get-ItemProperty -Path $regPath -Name "HideAIActionsMenu" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "HideAIActionsMenu" -Value 1 -Force + } else { + New-ItemProperty -Path $regPath -Name "HideAIActionsMenu" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set HideAIActionsMenu = 1 (AI Actions hidden from Explorer context menu)" -Module "AntiAI" + $result.Applied++ + + # Verify + $values = Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue + + if ($values.HideAIActionsMenu -eq 1) { + Write-Log -Level DEBUG -Message "Verification SUCCESS: Explorer AI Actions disabled" -Module "AntiAI" + $result.Success = $true + } + else { + $result.Errors += "Verification FAILED: Explorer AI Actions policy not applied" + } + } + catch { + $result.Errors += "Failed to disable Explorer AI Actions: $($_.Exception.Message)" + Write-Error $result.Errors[-1] + } + + return $result +} diff --git a/Modules/AntiAI/Private/Disable-NotepadAI.ps1 b/Modules/AntiAI/Private/Disable-NotepadAI.ps1 new file mode 100644 index 0000000..e900f96 --- /dev/null +++ b/Modules/AntiAI/Private/Disable-NotepadAI.ps1 @@ -0,0 +1,87 @@ +#Requires -Version 5.1 + +<# +.SYNOPSIS + Disables all AI features in Notepad (Write, Summarize, Rewrite, Explain). + +.DESCRIPTION + Applies DisableAIFeatures = 1 policy (Microsoft official registry value name). + + Notepad AI features (GPT-powered): + - Write: Generate text from prompts + - Summarize: Condense long text into key points + - Rewrite: Rephrase text in different styles (formal, casual, professional) + - Explain: Clarify complex text + + All features are cloud-based and require Copilot integration. + + WARNING: Requires WindowsNotepad.admx for Group Policy (not required for direct registry). + ADMX Download: https://download.microsoft.com/download/72ea16a9-4cc9-4032-945d-3a56a483d034/WindowsNotepadAdminTemplates.cab + +.EXAMPLE + Disable-NotepadAI +#> +function Disable-NotepadAI { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + Write-Log -Level DEBUG -Message "Disabling Notepad AI features (Write, Summarize, Rewrite, Explain)" -Module "AntiAI" + + $result = [PSCustomObject]@{ + Success = $false + Applied = 0 + Errors = @() + Warnings = @() + } + + try { + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would disable Notepad AI (DisableAIFeatures=1)" -Module "AntiAI" + $result.Applied++ + $result.Success = $true + return $result + } + + $regPath = "HKLM:\SOFTWARE\Policies\WindowsNotepad" + + if (-not (Test-Path $regPath)) { + New-Item -Path $regPath -Force | Out-Null + Write-Log -Level DEBUG -Message "Created registry path: $regPath" -Module "AntiAI" + } + + # CRITICAL: Value name is "DisableAIFeatures" (NOT "DisableAIFeaturesInNotepad") + # Microsoft official registry value name from WindowsNotepad ADMX + $existing = Get-ItemProperty -Path $regPath -Name "DisableAIFeatures" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "DisableAIFeatures" -Value 1 -Force + } else { + New-ItemProperty -Path $regPath -Name "DisableAIFeatures" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set DisableAIFeatures = 1 (All AI features disabled - Write/Summarize/Rewrite/Explain)" -Module "AntiAI" + $result.Applied++ + + # Note: WindowsNotepad.admx is NOT required - registry policy is fully effective without it + # ADMX only provides GUI visibility in gpedit.msc, which is irrelevant for scripted deployment + Write-Log -Level DEBUG -Message "Notepad AI disabled via registry policy (no ADMX required)" -Module "AntiAI" + + # Verify with correct value name + $values = Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue + + if ($values.DisableAIFeatures -eq 1) { + Write-Log -Level DEBUG -Message "Verification SUCCESS: Notepad AI disabled (DisableAIFeatures=1)" -Module "AntiAI" + $result.Success = $true + } + else { + $result.Errors += "Verification FAILED: Notepad AI policy not applied (DisableAIFeatures not set)" + } + } + catch { + $result.Errors += "Failed to disable Notepad AI: $($_.Exception.Message)" + Write-Error $result.Errors[-1] + } + + return $result +} diff --git a/Modules/AntiAI/Private/Disable-PaintAI.ps1 b/Modules/AntiAI/Private/Disable-PaintAI.ps1 new file mode 100644 index 0000000..15deeeb --- /dev/null +++ b/Modules/AntiAI/Private/Disable-PaintAI.ps1 @@ -0,0 +1,104 @@ +#Requires -Version 5.1 + +<# +.SYNOPSIS + Disables all AI features in Paint (Cocreator, Generative Fill, Image Creator). + +.DESCRIPTION + Applies 3 Paint AI policies: + 1. DisableCocreator = 1 (Text-to-image generation) + 2. DisableGenerativeFill = 1 (AI-powered content-aware fill) + 3. DisableImageCreator = 1 (DALL-E art generator) + + Paint AI features (cloud-based): + - Cocreator: Type description, AI generates artwork (e.g., "sunset over mountains") + - Generative Fill: Select area, AI fills with contextual content + - Image Creator: DALL-E powered AI art generation + + All features require internet connection and send data to Microsoft cloud. + +.EXAMPLE + Disable-PaintAI +#> +function Disable-PaintAI { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + Write-Log -Level DEBUG -Message "Disabling Paint AI features (Cocreator, Generative Fill, Image Creator)" -Module "AntiAI" + + $result = [PSCustomObject]@{ + Success = $false + Applied = 0 + Errors = @() + } + + try { + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would disable Paint AI (Cocreator, GenerativeFill, ImageCreator)" -Module "AntiAI" + $result.Applied += 3 + $result.Success = $true + return $result + } + + $regPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Paint" + + if (-not (Test-Path $regPath)) { + New-Item -Path $regPath -Force | Out-Null + Write-Log -Level DEBUG -Message "Created registry path: $regPath" -Module "AntiAI" + } + + # 1. Disable Cocreator (text-to-image) + $existing = Get-ItemProperty -Path $regPath -Name "DisableCocreator" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "DisableCocreator" -Value 1 -Force + } else { + New-ItemProperty -Path $regPath -Name "DisableCocreator" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set DisableCocreator = 1 (Text-to-image generation disabled)" -Module "AntiAI" + $result.Applied++ + + # 2. Disable Generative Fill (AI content-aware fill) + $existing = Get-ItemProperty -Path $regPath -Name "DisableGenerativeFill" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "DisableGenerativeFill" -Value 1 -Force + } else { + New-ItemProperty -Path $regPath -Name "DisableGenerativeFill" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set DisableGenerativeFill = 1 (AI content-aware fill disabled)" -Module "AntiAI" + $result.Applied++ + + # 3. Disable Image Creator (DALL-E art generator) + $existing = Get-ItemProperty -Path $regPath -Name "DisableImageCreator" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "DisableImageCreator" -Value 1 -Force + } else { + New-ItemProperty -Path $regPath -Name "DisableImageCreator" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set DisableImageCreator = 1 (DALL-E art generation disabled)" -Module "AntiAI" + $result.Applied++ + + # Verify + $values = Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue + + $verified = ($values.DisableCocreator -eq 1) -and + ($values.DisableGenerativeFill -eq 1) -and + ($values.DisableImageCreator -eq 1) + + if ($verified) { + Write-Log -Level DEBUG -Message "Verification SUCCESS: All Paint AI features disabled" -Module "AntiAI" + $result.Success = $true + } + else { + $result.Errors += "Verification FAILED: Not all Paint AI policies were applied" + } + } + catch { + $result.Errors += "Failed to disable Paint AI: $($_.Exception.Message)" + Write-Error $result.Errors[-1] + } + + return $result +} diff --git a/Modules/AntiAI/Private/Disable-Recall.ps1 b/Modules/AntiAI/Private/Disable-Recall.ps1 new file mode 100644 index 0000000..3e33505 --- /dev/null +++ b/Modules/AntiAI/Private/Disable-Recall.ps1 @@ -0,0 +1,120 @@ +#Requires -Version 5.1 + +<# +.SYNOPSIS + Disables Windows Recall completely (component removal + snapshots + data providers). + +.DESCRIPTION + Applies 3 core Recall policies: + 1. AllowRecallEnablement = 0 (Removes Recall component, deletes existing snapshots, requires reboot) + 2. DisableAIDataAnalysis = 1 (Prevents new snapshots - Device and User scope) + 3. DisableRecallDataProviders = 1 (Disables background data providers - Enterprise/Education) + + WARNING: Requires system reboot for Recall component removal to take effect! + +.EXAMPLE + Disable-Recall +#> +function Disable-Recall { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + Write-Log -Level DEBUG -Message "Disabling Windows Recall (component + snapshots + providers)" -Module "AntiAI" + + $result = [PSCustomObject]@{ + Success = $false + Applied = 0 + Errors = @() + RequiresReboot = $true + } + + try { + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would disable Recall (AllowRecallEnablement=0, DisableAIDataAnalysis=1)" -Module "AntiAI" + $result.Success = $true + return $result + } + + # Device-scope policies (HKLM) + $devicePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" + if (-not (Test-Path $devicePath)) { + New-Item -Path $devicePath -Force | Out-Null + Write-Log -Level DEBUG -Message "Created registry path: $devicePath" -Module "AntiAI" + } + + # 1. Remove Recall component (deletes bits + existing snapshots) + $existing = Get-ItemProperty -Path $devicePath -Name "AllowRecallEnablement" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $devicePath -Name "AllowRecallEnablement" -Value 0 -Force | Out-Null + } else { + New-ItemProperty -Path $devicePath -Name "AllowRecallEnablement" -Value 0 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set AllowRecallEnablement = 0 (Recall component will be removed on reboot)" -Module "AntiAI" + $result.Applied++ + + # 2. Disable AI data analysis (Device-scope) + $existing = Get-ItemProperty -Path $devicePath -Name "DisableAIDataAnalysis" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $devicePath -Name "DisableAIDataAnalysis" -Value 1 -Force | Out-Null + } else { + New-ItemProperty -Path $devicePath -Name "DisableAIDataAnalysis" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set DisableAIDataAnalysis = 1 (Device-scope - no new snapshots)" -Module "AntiAI" + $result.Applied++ + + # User-scope policies (HKCU) + $userPath = "HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" + if (-not (Test-Path $userPath)) { + New-Item -Path $userPath -Force | Out-Null + Write-Log -Level DEBUG -Message "Created registry path: $userPath" -Module "AntiAI" + } + + # 3. Disable AI data analysis (User-scope) + $existing = Get-ItemProperty -Path $userPath -Name "DisableAIDataAnalysis" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $userPath -Name "DisableAIDataAnalysis" -Value 1 -Force | Out-Null + } else { + New-ItemProperty -Path $userPath -Name "DisableAIDataAnalysis" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set DisableAIDataAnalysis = 1 (User-scope - no new snapshots)" -Module "AntiAI" + $result.Applied++ + + # 4. Disable Recall data providers (Enterprise/Education only, User-scope) + $existing = Get-ItemProperty -Path $userPath -Name "DisableRecallDataProviders" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $userPath -Name "DisableRecallDataProviders" -Value 1 -Force | Out-Null + } else { + New-ItemProperty -Path $userPath -Name "DisableRecallDataProviders" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set DisableRecallDataProviders = 1 (Background data providers disabled)" -Module "AntiAI" + $result.Applied++ + + # Verify + $deviceValues = Get-ItemProperty -Path $devicePath -ErrorAction SilentlyContinue + $userValues = Get-ItemProperty -Path $userPath -ErrorAction SilentlyContinue + + $verified = ($deviceValues.AllowRecallEnablement -eq 0) -and + ($deviceValues.DisableAIDataAnalysis -eq 1) -and + ($userValues.DisableAIDataAnalysis -eq 1) -and + ($userValues.DisableRecallDataProviders -eq 1) + + if ($verified) { + Write-Log -Level DEBUG -Message "Verification SUCCESS: All Recall policies applied" -Module "AntiAI" + Write-Host "" # Ensure warning appears on new line + Write-Warning "REBOOT REQUIRED to remove Recall component and delete existing snapshots!" + $result.Success = $true + } + else { + $result.Errors += "Verification FAILED: Not all Recall policies were applied correctly" + } + } + catch { + $result.Errors += "Failed to disable Recall: $($_.Exception.Message)" + Write-Error $result.Errors[-1] + } + + return $result +} diff --git a/Modules/AntiAI/Private/Disable-SettingsAgent.ps1 b/Modules/AntiAI/Private/Disable-SettingsAgent.ps1 new file mode 100644 index 0000000..840f5e1 --- /dev/null +++ b/Modules/AntiAI/Private/Disable-SettingsAgent.ps1 @@ -0,0 +1,77 @@ +#Requires -Version 5.1 + +<# +.SYNOPSIS + Disables Settings Agent (AI-powered Settings search). + +.DESCRIPTION + Applies DisableSettingsAgent = 1 policy. + + Settings Agent provides AI-enhanced natural language search in Windows Settings. + Examples of AI features: + - Understanding questions: "How do I change my wallpaper?" + - Contextual suggestions: "Change background" -> Desktop personalization + - Intelligent search results with natural language processing + + Disabling falls back to classic keyword search without AI understanding. + +.EXAMPLE + Disable-SettingsAgent +#> +function Disable-SettingsAgent { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + Write-Log -Level DEBUG -Message "Disabling Settings Agent (AI-powered search)" -Module "AntiAI" + + $result = [PSCustomObject]@{ + Success = $false + Applied = 0 + Errors = @() + } + + try { + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would disable Settings Agent (DisableAISettingsAgent=1)" -Module "AntiAI" + $result.Applied++ + $result.Success = $true + return $result + } + + $regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" + + if (-not (Test-Path $regPath)) { + New-Item -Path $regPath -Force | Out-Null + Write-Log -Level DEBUG -Message "Created registry path: $regPath" -Module "AntiAI" + } + + $existing = Get-ItemProperty -Path $regPath -Name "DisableSettingsAgent" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "DisableSettingsAgent" -Value 1 -Force + } else { + New-ItemProperty -Path $regPath -Name "DisableSettingsAgent" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set DisableSettingsAgent = 1 (AI search disabled, fallback to classic)" -Module "AntiAI" + $result.Applied++ + + # Verify + $values = Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue + + if ($values.DisableSettingsAgent -eq 1) { + Write-Log -Level DEBUG -Message "Verification SUCCESS: Settings Agent disabled" -Module "AntiAI" + $result.Success = $true + } + else { + $result.Errors += "Verification FAILED: Settings Agent policy not applied" + } + } + catch { + $result.Errors += "Failed to disable Settings Agent: $($_.Exception.Message)" + Write-Error $result.Errors[-1] + } + + return $result +} diff --git a/Modules/AntiAI/Private/Set-RecallProtection.ps1 b/Modules/AntiAI/Private/Set-RecallProtection.ps1 new file mode 100644 index 0000000..cd5ab56 --- /dev/null +++ b/Modules/AntiAI/Private/Set-RecallProtection.ps1 @@ -0,0 +1,130 @@ +#Requires -Version 5.1 + +<# +.SYNOPSIS + Applies enterprise-grade Recall protection (app/URI deny lists, storage limits). + +.DESCRIPTION + Configures 4 additional Recall policies for maximum data protection: + 1. SetDenyAppListForRecall - Apps never captured in snapshots (Browser, Terminal, Password managers, RDP) + 2. SetDenyUriListForRecall - Websites/URLs never captured (Banking, Email, Login pages) + 3. SetMaximumStorageDurationForRecallSnapshots - Max retention: 30 days + 4. SetMaximumStorageSpaceForRecallSnapshots - Max storage: 10 GB + + Note: These are additional protection layers BEYOND core Recall disable policies. + Even though Recall is disabled, these provide defense-in-depth. + +.EXAMPLE + Set-RecallProtection +#> +function Set-RecallProtection { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + Write-Log -Level DEBUG -Message "Applying Recall enterprise protection (deny lists + storage limits)" -Module "AntiAI" + + $result = [PSCustomObject]@{ + Success = $false + Applied = 0 + Errors = @() + } + + try { + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would set Recall protection (Deny lists + Storage limits)" -Module "AntiAI" + $result.Success = $true + return $result + } + + $regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" + + if (-not (Test-Path $regPath)) { + New-Item -Path $regPath -Force | Out-Null + Write-Log -Level DEBUG -Message "Created registry path: $regPath" -Module "AntiAI" + } + + # 1. App Deny List - Critical apps never captured in snapshots + $denyApps = @( + "Microsoft.MicrosoftEdge_8wekyb3d8bbwe!App", # Edge Browser (Banking, passwords) + "Microsoft.WindowsTerminal_8wekyb3d8bbwe!App", # Terminal (CLI passwords, keys) + "KeePassXC_8wekyb3d8bbwe!KeePassXC", # Password Manager + "Microsoft.RemoteDesktop_8wekyb3d8bbwe!App" # RDP (remote system access) + ) + + # Store as proper MultiString (string array) so policies are visible to compliance checks + $existing = Get-ItemProperty -Path $regPath -Name "SetDenyAppListForRecall" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "SetDenyAppListForRecall" -Value $denyApps -Force + } else { + New-ItemProperty -Path $regPath -Name "SetDenyAppListForRecall" -Value $denyApps -PropertyType MultiString -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set App Deny List: $($denyApps.Count) critical apps protected" -Module "AntiAI" + $result.Applied++ + + # 2. URI Deny List - Critical websites never captured in snapshots + $denyUris = @( + "*.bank.*", # All banking sites + "*.paypal.*", # Payment processor + "*.bankofamerica.*", # Major bank + "mail.*", # Email sites + "webmail.*", # Webmail sites + "*password*", # Any password-related pages + "*login*" # Any login pages + ) + + # Store as MultiString using string array + $existing = Get-ItemProperty -Path $regPath -Name "SetDenyUriListForRecall" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "SetDenyUriListForRecall" -Value $denyUris -Force + } else { + New-ItemProperty -Path $regPath -Name "SetDenyUriListForRecall" -Value $denyUris -PropertyType MultiString -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set URI Deny List: $($denyUris.Count) URL patterns protected" -Module "AntiAI" + $result.Applied++ + + # 3. Storage Duration Limit - Max 30 days retention + $existing = Get-ItemProperty -Path $regPath -Name "SetMaximumStorageDurationForRecallSnapshots" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "SetMaximumStorageDurationForRecallSnapshots" -Value 30 -Force + } else { + New-ItemProperty -Path $regPath -Name "SetMaximumStorageDurationForRecallSnapshots" -Value 30 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set max snapshot retention: 30 days" -Module "AntiAI" + $result.Applied++ + + # 4. Storage Space Limit - Max 10 GB + $existing = Get-ItemProperty -Path $regPath -Name "SetMaximumStorageSpaceForRecallSnapshots" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "SetMaximumStorageSpaceForRecallSnapshots" -Value 10 -Force + } else { + New-ItemProperty -Path $regPath -Name "SetMaximumStorageSpaceForRecallSnapshots" -Value 10 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set max snapshot storage: 10 GB" -Module "AntiAI" + $result.Applied++ + + # Verify + $values = Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue + + $verified = ($null -ne $values.SetDenyAppListForRecall) -and + ($null -ne $values.SetDenyUriListForRecall) -and + ($values.SetMaximumStorageDurationForRecallSnapshots -eq 30) -and + ($values.SetMaximumStorageSpaceForRecallSnapshots -eq 10) + + if ($verified) { + Write-Log -Level DEBUG -Message "Verification SUCCESS: All Recall protection policies applied" -Module "AntiAI" + $result.Success = $true + } + else { + $result.Errors += "Verification FAILED: Not all Recall protection policies were applied" + } + } + catch { + $result.Errors += "Failed to apply Recall protection: $($_.Exception.Message)" + Write-Error $result.Errors[-1] + } + + return $result +} diff --git a/Modules/AntiAI/Private/Set-SystemAIModels.ps1 b/Modules/AntiAI/Private/Set-SystemAIModels.ps1 new file mode 100644 index 0000000..acaddcb --- /dev/null +++ b/Modules/AntiAI/Private/Set-SystemAIModels.ps1 @@ -0,0 +1,118 @@ +#Requires -Version 5.1 + +<# +.SYNOPSIS + Sets the Generative AI Master Switch to block all apps from using AI models. + +.DESCRIPTION + Configures LetAppsAccessSystemAIModels = 2 (Force Deny) to prevent ALL apps from + accessing Windows on-device generative AI models (text and image generation). + + This master switch automatically blocks: + - Notepad AI (Write, Summarize, Rewrite) + - Paint AI (Cocreator, Generative Fill unless specifically disabled) + - Photos AI (Generative Erase, Background effects, Auto-categorization) + - Clipchamp AI (Auto Compose) + - Snipping Tool AI (OCR, Quick Redact) + - All future apps that use generative AI + +.EXAMPLE + Set-SystemAIModels +#> +function Set-SystemAIModels { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + Write-Log -Level DEBUG -Message "Setting Generative AI Master Switch (Force Deny all apps)" -Module "AntiAI" + + $result = [PSCustomObject]@{ + Success = $false + Applied = 0 + Errors = @() + } + + try { + # 1. Set AppPrivacy Master Switch + $regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" + + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would set $regPath\LetAppsAccessSystemAIModels = 2" -Module "AntiAI" + Write-Log -Level DEBUG -Message "[DRYRUN] Would set $regPath\LetAppsAccessGenerativeAI = 2" -Module "AntiAI" + Write-Log -Level DEBUG -Message "[DRYRUN] Would set CapabilityAccessManager\systemAIModels = Deny" -Module "AntiAI" + $result.Success = $true + return $result + } + + # Ensure registry path exists + if (-not (Test-Path $regPath)) { + New-Item -Path $regPath -Force | Out-Null + Write-Log -Level DEBUG -Message "Created registry path: $regPath" -Module "AntiAI" + } + + # Set master switch: 2 = Force Deny (no app can access generative AI) + $existing = Get-ItemProperty -Path $regPath -Name "LetAppsAccessSystemAIModels" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $regPath -Name "LetAppsAccessSystemAIModels" -Value 2 -Force + } else { + New-ItemProperty -Path $regPath -Name "LetAppsAccessSystemAIModels" -Value 2 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set LetAppsAccessSystemAIModels = 2 (Force Deny)" -Module "AntiAI" + $result.Applied++ + + # Set app-level Generative AI access: 2 = Force Deny (Text & Image Generation in Settings) + $existing2 = Get-ItemProperty -Path $regPath -Name "LetAppsAccessGenerativeAI" -ErrorAction SilentlyContinue + if ($null -ne $existing2) { + Set-ItemProperty -Path $regPath -Name "LetAppsAccessGenerativeAI" -Value 2 -Force + } else { + New-ItemProperty -Path $regPath -Name "LetAppsAccessGenerativeAI" -Value 2 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set LetAppsAccessGenerativeAI = 2 (Force Deny)" -Module "AntiAI" + $result.Applied++ + + # Verify AppPrivacy switches + $value = Get-ItemProperty -Path $regPath -Name "LetAppsAccessSystemAIModels" -ErrorAction SilentlyContinue + $value2 = Get-ItemProperty -Path $regPath -Name "LetAppsAccessGenerativeAI" -ErrorAction SilentlyContinue + if ($value.LetAppsAccessSystemAIModels -eq 2 -and $value2.LetAppsAccessGenerativeAI -eq 2) { + Write-Log -Level DEBUG -Message "Verification SUCCESS: Both AppPrivacy AI switches are Force Deny" -Module "AntiAI" + } + else { + $result.Errors += "Verification FAILED: AppPrivacy AI switches not set correctly" + } + + # 2. Set CapabilityAccessManager Deny (additional workaround for Paint Generative Erase/Background Removal) + $capabilityPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\systemAIModels" + + if (-not (Test-Path $capabilityPath)) { + New-Item -Path $capabilityPath -Force | Out-Null + Write-Log -Level DEBUG -Message "Created registry path: $capabilityPath" -Module "AntiAI" + } + + $existing = Get-ItemProperty -Path $capabilityPath -Name "Value" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $capabilityPath -Name "Value" -Value "Deny" -Force + } else { + New-ItemProperty -Path $capabilityPath -Name "Value" -Value "Deny" -PropertyType String -Force | Out-Null + } + Write-Log -Level DEBUG -Message "Set CapabilityAccessManager\systemAIModels = Deny (workaround for undocumented AI features)" -Module "AntiAI" + $result.Applied++ + + # Verify CapabilityAccessManager + $capValue = Get-ItemProperty -Path $capabilityPath -Name "Value" -ErrorAction SilentlyContinue + if ($capValue.Value -eq "Deny") { + Write-Log -Level DEBUG -Message "Verification SUCCESS: CapabilityAccessManager is Deny" -Module "AntiAI" + $result.Success = $true + } + else { + $result.Errors += "Verification FAILED: CapabilityAccessManager not set correctly" + } + } + catch { + $result.Errors += "Failed to set Generative AI Master Switch: $($_.Exception.Message)" + Write-Error $result.Errors[-1] + } + + return $result +} diff --git a/Modules/AntiAI/Private/Test-AntiAICompliance.ps1 b/Modules/AntiAI/Private/Test-AntiAICompliance.ps1 new file mode 100644 index 0000000..83be26e --- /dev/null +++ b/Modules/AntiAI/Private/Test-AntiAICompliance.ps1 @@ -0,0 +1,652 @@ +#Requires -Version 5.1 +#Requires -RunAsAdministrator + +<# +.SYNOPSIS + Verifies that all AntiAI policies are correctly applied. + +.DESCRIPTION + REGISTRY COMPLIANCE VERIFICATION (Self-Check + MS Policy Validation) + + This script performs TWO types of checks: + + A) SELF-CHECK (Primary): + Verifies that AntiAI module successfully set all intended registry keys: + - Generative AI Master Switch (LetAppsAccessSystemAIModels) + - Recall Core (AllowRecallEnablement, DisableAIDataAnalysis x2, DisableRecallDataProviders) + - Recall Protection (App/URI Deny Lists, Storage Duration/Space) + - Copilot (4-layer defense: WindowsAI, WindowsCopilot, ShowCopilotButton, Explorer, User-scope, Hardware Key) + - Click to Do (DisableClickToDo x2) + - Paint AI (DisableCocreator, DisableGenerativeFill, DisableImageCreator) + - Notepad AI (DisableAIFeatures) + - Settings Agent (DisableSettingsAgent) + + B) MS POLICY VALIDATION (Secondary): + Checks for additional Microsoft-official registry keys that AntiAI module does NOT set, + but which could indicate incomplete deactivation or MS policy changes: + - PolicyManager paths (alternative policy enforcement) + - Additional WindowsAI keys introduced in newer Windows builds + - Alternative Copilot/Recall paths + + IMPORTANT LIMITATIONS: + - This is a REGISTRY-ONLY check. It does NOT verify if AI features are functionally disabled. + - "PASS" means "registry keys are set correctly" NOT "AI features are 100% inactive". + - Microsoft may add new AI features or change registry paths in future Windows updates. + - Some AI features may still work via cloud APIs even with correct registry settings. + + For functional verification, test AI features manually after applying policies. + +.EXAMPLE + .\Test-AntiAICompliance.ps1 + Runs full compliance check and displays results. + +.NOTES + Author: NoID Privacy + Version: 2.2.0 (Extended validation) + Requires: Windows 11 24H2+, Administrator privileges +#> + +# Helper function to check registry value (must be outside main function) +function Test-RegistryValue { + param( + [string]$Path, + [string]$Name, + $ExpectedValue, + [string]$Description + ) + + $check = @{ + Description = $Description + Path = "$Path\$Name" + Expected = $ExpectedValue + Actual = $null + Status = "FAIL" + } + + try { + if (Test-Path $Path) { + $value = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue + if ($null -ne $value) { + $check.Actual = $value.$Name + + # Handle different value types + if ($ExpectedValue -is [array]) { + # MultiString comparison - verify arrays match + if ($check.Actual -is [array]) { + # Check if arrays have same length and all items match + if ($check.Actual.Count -eq $ExpectedValue.Count) { + $allMatch = $true + foreach ($expectedItem in $ExpectedValue) { + if ($check.Actual -notcontains $expectedItem) { + $allMatch = $false + break + } + } + $check.Status = if ($allMatch) { "PASS" } else { "FAIL" } + } + else { + # Different array lengths - still OK if all expected items are present + # (allows for extra items set by policy) + $allPresent = $true + foreach ($expectedItem in $ExpectedValue) { + if ($check.Actual -notcontains $expectedItem) { + $allPresent = $false + break + } + } + $check.Status = if ($allPresent) { "PASS" } else { "FAIL" } + } + } + else { + # Expected array but got single value or nothing + $check.Status = "FAIL" + } + } + else { + # Exact value comparison + $check.Status = if ($check.Actual -eq $ExpectedValue) { "PASS" } else { "FAIL" } + } + } + else { + $check.Actual = "NOT SET" + } + } + else { + $check.Actual = "PATH MISSING" + } + } + catch { + $check.Actual = "ERROR: $($_.Exception.Message)" + } + + return $check +} + +function Test-AntiAICompliance { + [CmdletBinding()] + param() + + $startTime = Get-Date + + Write-Host "`n========================================" -ForegroundColor Cyan + Write-Host " ANTIAI COMPLIANCE VERIFICATION v2.2" -ForegroundColor Cyan + Write-Host " Registry-Based Policy Check" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host " Checking 32 AI Deactivation Policies" -ForegroundColor Cyan + Write-Host " + Advanced Copilot Blocks + MS Validation" -ForegroundColor DarkGray + Write-Host "========================================`n" -ForegroundColor Cyan + + # Initialize results (TotalPolicies calculated dynamically) + $results = @{ + Passed = 0 + Failed = 0 + Warnings = 0 + Details = @() + MSConflicts = 0 + MSAligned = 0 + } + +Write-Host "[1/13] Checking Generative AI Master Switch..." -ForegroundColor Yellow +$check = Test-RegistryValue ` + -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" ` + -Name "LetAppsAccessSystemAIModels" ` + -ExpectedValue 2 ` + -Description "Generative AI Master (Force Deny all apps)" +$results.Details += $check +if ($check.Status -eq "PASS") { + Write-Host " PASS: Master switch blocks all generative AI" -ForegroundColor Green + $results.Passed++ +} +else { + Write-Host " FAIL: Expected 2 (Force Deny), got $($check.Actual)" -ForegroundColor Red + $results.Failed++ +} + +# Additional check for LetAppsAccessGenerativeAI (Text & Image Generation in Settings) +$genAICheck = Test-RegistryValue ` + -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy" ` + -Name "LetAppsAccessGenerativeAI" ` + -ExpectedValue 2 ` + -Description "Generative AI App Access (Force Deny)" +$results.Details += $genAICheck +if ($genAICheck.Status -eq "PASS") { + Write-Host " PASS: App access to generative AI blocked" -ForegroundColor Green + $results.Passed++ +} +else { + Write-Host " FAIL: LetAppsAccessGenerativeAI not set (may allow AI features)" -ForegroundColor Red + $results.Failed++ +} + +# Additional CapabilityAccessManager check (workaround for Paint Generative Erase/Background Removal) +$capCheck = Test-RegistryValue ` + -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\systemAIModels" ` + -Name "Value" ` + -ExpectedValue "Deny" ` + -Description "CapabilityAccessManager systemAIModels (Workaround)" +$results.Details += $capCheck +if ($capCheck.Status -eq "PASS") { + Write-Host " PASS: CapabilityAccessManager blocks AI capabilities" -ForegroundColor Green + $results.Passed++ +} +else { + Write-Host " FAIL: CapabilityAccessManager not set (may allow Paint Generative Erase/Background Removal)" -ForegroundColor Red + $results.Failed++ +} + +Write-Host "`n[2/13] Checking Recall Core Policies..." -ForegroundColor Yellow +$recallChecks = @( + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" -Name "AllowRecallEnablement" -ExpectedValue 0 -Description "Recall Component Removal"), + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" -Name "DisableAIDataAnalysis" -ExpectedValue 1 -Description "Recall Snapshots Disabled (Device)"), + (Test-RegistryValue -Path "HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" -Name "DisableAIDataAnalysis" -ExpectedValue 1 -Description "Recall Snapshots Disabled (User)"), + (Test-RegistryValue -Path "HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" -Name "DisableRecallDataProviders" -ExpectedValue 1 -Description "Recall Data Providers Disabled") +) +foreach ($check in $recallChecks) { + $results.Details += $check + if ($check.Status -eq "PASS") { + Write-Host " PASS: $($check.Description)" -ForegroundColor Green + $results.Passed++ + } + else { + Write-Host " FAIL: $($check.Description) - $($check.Actual)" -ForegroundColor Red + $results.Failed++ + } +} + +Write-Host "`n[3/13] Checking Recall Enterprise Protection..." -ForegroundColor Yellow +# Expected deny lists (must match Set-RecallProtection.ps1) +$expectedDenyApps = @( + "Microsoft.MicrosoftEdge_8wekyb3d8bbwe!App", + "Microsoft.WindowsTerminal_8wekyb3d8bbwe!App", + "KeePassXC_8wekyb3d8bbwe!KeePassXC", + "Microsoft.RemoteDesktop_8wekyb3d8bbwe!App" +) +$expectedDenyUris = @( + "*.bank.*", + "*.paypal.*", + "*.bankofamerica.*", + "mail.*", + "webmail.*", + "*password*", + "*login*" +) + +$protectionChecks = @( + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" -Name "SetDenyAppListForRecall" -ExpectedValue $expectedDenyApps -Description "App Deny List"), + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" -Name "SetDenyUriListForRecall" -ExpectedValue $expectedDenyUris -Description "URI Deny List"), + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" -Name "SetMaximumStorageDurationForRecallSnapshots" -ExpectedValue 30 -Description "Max Retention: 30 days"), + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" -Name "SetMaximumStorageSpaceForRecallSnapshots" -ExpectedValue 10 -Description "Max Storage: 10 GB") +) +foreach ($check in $protectionChecks) { + $results.Details += $check + if ($check.Status -eq "PASS") { + Write-Host " PASS: $($check.Description)" -ForegroundColor Green + $results.Passed++ + } + else { + Write-Host " WARN: $($check.Description) - $($check.Actual)" -ForegroundColor Yellow + $results.Warnings++ + } +} + +Write-Host "`n[4/13] Checking Windows Copilot (4-layer defense)..." -ForegroundColor Yellow +$copilotChecks = @( + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" -Name "TurnOffWindowsCopilot" -ExpectedValue 1 -Description "Copilot Layer 1 (WindowsAI HKLM)"), + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot" -Name "TurnOffWindowsCopilot" -ExpectedValue 1 -Description "Copilot Layer 2 (WindowsCopilot HKLM)"), + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot" -Name "ShowCopilotButton" -ExpectedValue 0 -Description "Copilot Layer 3 (Taskbar Button Hidden)"), + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Name "DisableWindowsCopilot" -ExpectedValue 1 -Description "Copilot Layer 4 (Explorer Integration)"), + (Test-RegistryValue -Path "HKCU:\Software\Policies\Microsoft\Windows\WindowsCopilot" -Name "TurnOffWindowsCopilot" -ExpectedValue 1 -Description "Copilot User-scope (HKCU)"), + (Test-RegistryValue -Path "HKCU:\Software\Policies\Microsoft\Windows\WindowsCopilot" -Name "ShowCopilotButton" -ExpectedValue 0 -Description "Copilot Button Hidden (User)"), + (Test-RegistryValue -Path "HKCU:\Software\Policies\Microsoft\Windows\WindowsAI" -Name "SetCopilotHardwareKey" -ExpectedValue "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App" -Description "Hardware Key Remapped to Notepad") +) +foreach ($check in $copilotChecks) { + $results.Details += $check + if ($check.Status -eq "PASS") { + Write-Host " PASS: $($check.Description)" -ForegroundColor Green + $results.Passed++ + } + else { + Write-Host " FAIL: $($check.Description) - $($check.Actual)" -ForegroundColor Red + $results.Failed++ + } +} + +Write-Host "`n[5/13] Checking Click to Do..." -ForegroundColor Yellow +$clickChecks = @( + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" -Name "DisableClickToDo" -ExpectedValue 1 -Description "Click to Do Disabled (Device)"), + (Test-RegistryValue -Path "HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" -Name "DisableClickToDo" -ExpectedValue 1 -Description "Click to Do Disabled (User)") +) +foreach ($check in $clickChecks) { + $results.Details += $check + if ($check.Status -eq "PASS") { + Write-Host " PASS: $($check.Description)" -ForegroundColor Green + $results.Passed++ + } + else { + Write-Host " FAIL: $($check.Description) - $($check.Actual)" -ForegroundColor Red + $results.Failed++ + } +} + +Write-Host "`n[6/13] Checking Paint AI..." -ForegroundColor Yellow +$paintChecks = @( + (Test-RegistryValue -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Paint" -Name "DisableCocreator" -ExpectedValue 1 -Description "Paint Cocreator Disabled"), + (Test-RegistryValue -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Paint" -Name "DisableGenerativeFill" -ExpectedValue 1 -Description "Paint Generative Fill Disabled"), + (Test-RegistryValue -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Paint" -Name "DisableImageCreator" -ExpectedValue 1 -Description "Paint Image Creator Disabled") +) +foreach ($check in $paintChecks) { + $results.Details += $check + if ($check.Status -eq "PASS") { + Write-Host " PASS: $($check.Description)" -ForegroundColor Green + $results.Passed++ + } + else { + Write-Host " FAIL: $($check.Description) - $($check.Actual)" -ForegroundColor Red + $results.Failed++ + } +} + +Write-Host "`n[7/13] Checking Notepad AI..." -ForegroundColor Yellow +$check = Test-RegistryValue ` + -Path "HKLM:\SOFTWARE\Policies\WindowsNotepad" ` + -Name "DisableAIFeatures" ` + -ExpectedValue 1 ` + -Description "Notepad AI Disabled (Write/Summarize/Rewrite)" +$results.Details += $check +if ($check.Status -eq "PASS") { + Write-Host " PASS: Notepad AI completely disabled" -ForegroundColor Green + $results.Passed++ +} +else { + Write-Host " FAIL: Expected 1, got $($check.Actual)" -ForegroundColor Red + $results.Failed++ +} + +Write-Host "`n[8/13] Checking Settings Agent..." -ForegroundColor Yellow +$check = Test-RegistryValue ` + -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" ` + -Name "DisableSettingsAgent" ` + -ExpectedValue 1 ` + -Description "Settings AI Agent Disabled" +$results.Details += $check +if ($check.Status -eq "PASS") { + Write-Host " PASS: Settings Agent disabled (classic search only)" -ForegroundColor Green + $results.Passed++ +} +else { + Write-Host " FAIL: Expected 1, got $($check.Actual)" -ForegroundColor Red + $results.Failed++ +} + +Write-Host "`n[9/13] Checking Explorer AI Actions..." -ForegroundColor Yellow +$check = Test-RegistryValue ` + -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" ` + -Name "HideAIActionsMenu" ` + -ExpectedValue 1 ` + -Description "Explorer AI Actions Hidden" +$results.Details += $check +if ($check.Status -eq "PASS") { + Write-Host " PASS: Explorer AI Actions menu hidden" -ForegroundColor Green + $results.Passed++ +} +else { + Write-Host " FAIL: Expected 1, got $($check.Actual)" -ForegroundColor Red + $results.Failed++ +} + +Write-Host "`n[10/13] Checking Recall Export Block (NEW)..." -ForegroundColor Yellow +$check = Test-RegistryValue ` + -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" ` + -Name "AllowRecallExport" ` + -ExpectedValue 0 ` + -Description "Recall Export Disabled" +$results.Details += $check +if ($check.Status -eq "PASS") { + Write-Host " PASS: Recall snapshot export blocked" -ForegroundColor Green + $results.Passed++ +} +else { + Write-Host " WARN: Recall export may be allowed (optional policy)" -ForegroundColor Yellow + $results.Warnings++ +} + +Write-Host "`n[11/13] Checking Edge Copilot Sidebar..." -ForegroundColor Yellow +$edgeCopilotChecks = @( + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge" -Name "EdgeSidebarEnabled" -ExpectedValue 0 -Description "Edge Sidebar Disabled"), + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge" -Name "ShowHubsSidebar" -ExpectedValue 0 -Description "Hubs Sidebar Hidden"), + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge" -Name "HubsSidebarEnabled" -ExpectedValue 0 -Description "Hubs Sidebar Disabled"), + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge" -Name "CopilotPageContext" -ExpectedValue 0 -Description "Copilot Page Context Blocked"), + (Test-RegistryValue -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge" -Name "CopilotCDPPageContext" -ExpectedValue 0 -Description "Copilot CDP Context Blocked") +) +foreach ($check in $edgeCopilotChecks) { + $results.Details += $check + if ($check.Status -eq "PASS") { + Write-Host " PASS: $($check.Description)" -ForegroundColor Green + $results.Passed++ + } + else { + Write-Host " WARN: $($check.Description) - $($check.Actual)" -ForegroundColor Yellow + $results.Warnings++ + } +} + +Write-Host "`n[12/13] Checking Recall Component Status..." -ForegroundColor Yellow + +# Check for Recall component status (Windows Optional Feature) +try { + $recallFeature = Get-WindowsOptionalFeature -Online -FeatureName "Recall" -ErrorAction SilentlyContinue + if ($null -ne $recallFeature) { + if ($recallFeature.State -eq "Disabled") { + Write-Host " PASS: Recall component is disabled" -ForegroundColor Green + } + else { + Write-Host " INFO: Recall component present but configured to be removed (reboot required)" -ForegroundColor Yellow + } + } + else { + Write-Host " PASS: Recall component not present on this system" -ForegroundColor Green + } +} +catch { + Write-Host " INFO: Cannot query Recall feature status" -ForegroundColor DarkGray +} + +Write-Host "`n[13/13] Checking MS Policy Validation (Conflict Scanner)..." -ForegroundColor Yellow + +$msConflicts = 0 +$msInfo = 0 + +try { + # PolicyManager paths (alternative policy enforcement used by Intune/MDM) + $policyManagerChecks = @( + @{ Path = "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\WindowsAI"; Name = "DisableAIDataAnalysis"; Desc = "Recall PolicyManager (MDM Current)" }, + @{ Path = "HKLM:\SOFTWARE\Microsoft\PolicyManager\default\WindowsAI"; Name = "DisableAIDataAnalysis"; Desc = "Recall PolicyManager (MDM Default)" } + ) + + foreach ($check in $policyManagerChecks) { + try { + if (Test-Path $check.Path) { + $prop = Get-ItemProperty -Path $check.Path -ErrorAction SilentlyContinue + if ($prop -and ($prop.PSObject.Properties.Name -contains $check.Name)) { + $value = $prop.($check.Name) + if ($null -ne $value) { + if ($value -eq 1) { + Write-Host " INFO: $($check.Desc) = 1 (aligned with AntiAI)" -ForegroundColor DarkGray + $msInfo++ + } + else { + Write-Host " WARN: $($check.Desc) = $value (may conflict with AntiAI!)" -ForegroundColor Yellow + $msConflicts++ + } + } + } + } + } + catch { + # Silently ignore if property doesn't exist or path is inaccessible + $null = $null + } + } + + # Check for alternative Copilot/Explorer keys (conflict detection) + $additionalMSKeys = @( + @{ Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer"; Name = "NoCopilotButton"; ExpectedValue = 1; Desc = "Explorer Copilot Button" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"; Name = "CopilotPageEnabled"; ExpectedValue = 0; Desc = "Edge Copilot Integration" } + ) + + foreach ($check in $additionalMSKeys) { + try { + if (Test-Path $check.Path) { + $prop = Get-ItemProperty -Path $check.Path -ErrorAction SilentlyContinue + if ($prop -and ($prop.PSObject.Properties.Name -contains $check.Name)) { + $value = $prop.($check.Name) + if ($null -ne $value) { + if ($value -eq $check.ExpectedValue) { + Write-Host " INFO: $($check.Desc) = $value (aligned with AntiAI)" -ForegroundColor DarkGray + $msInfo++ + } + else { + Write-Host " WARN: $($check.Desc) = $value (may conflict with AntiAI, expected $($check.ExpectedValue))" -ForegroundColor Yellow + $msConflicts++ + } + } + } + } + } + catch { + # Silently ignore if property doesn't exist or path is inaccessible + $null = $null + } + } + + if ($msConflicts -eq 0 -and $msInfo -eq 0) { + Write-Host " No alternative MS policies detected (clean configuration)" -ForegroundColor DarkGray + } + elseif ($msConflicts -gt 0) { + Write-Host " CONFLICTS DETECTED: $msConflicts MS policy conflict(s) found!" -ForegroundColor Yellow + } + else { + Write-Host " $msInfo additional MS policy/policies aligned with AntiAI" -ForegroundColor DarkGray + } + + Write-Host " NOTE: MS Policy Validation scans for conflicts with AntiAI configuration." -ForegroundColor DarkGray + Write-Host " Missing keys are OK - conflicts are reported as warnings." -ForegroundColor DarkGray +} +catch { + Write-Host " WARNING: MS Policy Validation encountered an error: $($_.Exception.Message)" -ForegroundColor Yellow + Write-Host " Continuing with self-check results only..." -ForegroundColor DarkGray +} + +# Store MS validation results +$results.MSConflicts = $msConflicts +$results.MSAligned = $msInfo + +# Calculate final results +$endTime = Get-Date +$duration = ($endTime - $startTime).TotalSeconds + +# TotalPolicies = Passed + Failed (Warnings are informational only) +$totalPolicies = $results.Passed + $results.Failed + +if ($totalPolicies -gt 0) { + $successRate = [math]::Round(($results.Passed / $totalPolicies) * 100, 1) +} +else { + $successRate = 0 +} + +# Derive overall status for programmatic use +if ($results.Failed -eq 0 -and $results.Passed -gt 0) { + # All checks passed (warnings are OK) + $overallStatus = "PASS" +} +elseif ($results.Passed -eq 0 -and $results.Failed -gt 0) { + # All checks failed - likely AntiAI module was never run + $overallStatus = "NOT_APPLIED" +} +elseif ($results.Failed -gt 0) { + # Some checks failed + $overallStatus = "FAIL" +} +else { + # Edge case: no checks run + $overallStatus = "NOT_APPLIED" +} + +$results["OverallStatus"] = $overallStatus +$results["TotalPolicies"] = $totalPolicies +$results["TotalChecks"] = $totalPolicies +$results["FailedChecks"] = $results.Failed +$results["DurationSeconds"] = [math]::Round($duration, 2) + +# Set exit code for programmatic use +# 0 = All checks passed, no MS conflicts +# 1 = Self-check failed (AntiAI policies not set correctly) +# 2 = Self-check passed but MS conflicts detected +$exitCode = 0 +if ($results.Failed -gt 0) { + $exitCode = 1 +} +elseif ($results.MSConflicts -gt 0) { + $exitCode = 2 +} +$results["ExitCode"] = $exitCode + +# Display summary +Write-Host "`n========================================" -ForegroundColor Cyan +Write-Host " COMPLIANCE SUMMARY" -ForegroundColor Cyan +Write-Host "========================================`n" -ForegroundColor Cyan + +# Self-Check Results +Write-Host "Self-Check (AntiAI Policies):" -ForegroundColor Cyan +Write-Host " Total Policies: $totalPolicies" -ForegroundColor White +Write-Host " Passed: " -NoNewline +Write-Host "$($results.Passed)" -ForegroundColor Green +Write-Host " Failed: " -NoNewline +if ($results.Failed -eq 0) { + Write-Host "$($results.Failed)" -ForegroundColor Green +} +else { + Write-Host "$($results.Failed)" -ForegroundColor Red +} +Write-Host " Warnings: " -NoNewline +if ($results.Warnings -eq 0) { + Write-Host "$($results.Warnings)" -ForegroundColor Green +} +else { + Write-Host "$($results.Warnings)" -ForegroundColor Yellow +} +Write-Host " Success Rate: " -NoNewline +if ($successRate -eq 100) { + Write-Host "$successRate%" -ForegroundColor Green +} +elseif ($successRate -ge 80) { + Write-Host "$successRate%" -ForegroundColor Yellow +} +else { + Write-Host "$successRate%" -ForegroundColor Red +} + +# MS Policy Validation Results +Write-Host "`nMS Policy Validation:" -ForegroundColor Cyan +Write-Host " Conflicts: " -NoNewline +if ($results.MSConflicts -eq 0) { + Write-Host "$($results.MSConflicts)" -ForegroundColor Green +} +else { + Write-Host "$($results.MSConflicts)" -ForegroundColor Yellow +} +Write-Host " Aligned: $($results.MSAligned)" -ForegroundColor White +Write-Host " Status: " -NoNewline +if ($results.MSConflicts -eq 0) { + Write-Host "NO CONFLICTS" -ForegroundColor Green +} +else { + Write-Host "CONFLICTS DETECTED" -ForegroundColor Yellow +} + +Write-Host "`nExecution:" -ForegroundColor Cyan +Write-Host " Duration: $([math]::Round($duration, 2)) seconds" -ForegroundColor White + +Write-Host "`nOverall Status: " -NoNewline +switch ($overallStatus) { + "PASS" { + if ($results.MSConflicts -eq 0) { + Write-Host "COMPLIANT - All checks passed, no conflicts (Exit Code: 0)" -ForegroundColor Green + } + else { + Write-Host "COMPLIANT - Registry OK, but MS conflicts detected (Exit Code: 2)" -ForegroundColor Yellow + } + } + "NOT_APPLIED" { + Write-Host "NOT APPLIED - AntiAI module has not been run yet (Exit Code: 1)" -ForegroundColor Yellow + } + default { + Write-Host "NON-COMPLIANT - Action required (Exit Code: 1)" -ForegroundColor Red + } +} + +Write-Host "`n========================================`n" -ForegroundColor Cyan + +# IMPORTANT DISCLAIMER +if ($overallStatus -eq "PASS") { + Write-Host " IMPORTANT: This check verifies REGISTRY COMPLIANCE ONLY." -ForegroundColor Yellow + Write-Host " It does NOT guarantee that AI features are functionally disabled." -ForegroundColor Yellow + Write-Host "" -ForegroundColor Yellow + Write-Host " Reasons why AI features might still work:" -ForegroundColor DarkGray + Write-Host " - Microsoft may use alternative/undocumented registry paths" -ForegroundColor DarkGray + Write-Host " - Cloud-based AI features bypass local policies" -ForegroundColor DarkGray + Write-Host " - Newer Windows builds may introduce new AI keys/features" -ForegroundColor DarkGray + Write-Host " - Apps may have hardcoded AI functionality" -ForegroundColor DarkGray + Write-Host "" -ForegroundColor Yellow + Write-Host " RECOMMENDATION: Manually test AI features after applying policies:" -ForegroundColor Yellow + Write-Host " - Open Notepad -> Check for AI/Copilot button" -ForegroundColor DarkGray + Write-Host " - Open Paint -> Check for Cocreator/Generative Fill" -ForegroundColor DarkGray + Write-Host " - Press Win+C -> Should NOT open Copilot" -ForegroundColor DarkGray + Write-Host " - Snipping Tool -> Check for AI OCR/Redact features" -ForegroundColor DarkGray + Write-Host "`n========================================`n" -ForegroundColor Cyan +} + + # Return results object + return $results +} diff --git a/Modules/AntiAI/Public/Invoke-AntiAI.ps1 b/Modules/AntiAI/Public/Invoke-AntiAI.ps1 new file mode 100644 index 0000000..6a970f6 --- /dev/null +++ b/Modules/AntiAI/Public/Invoke-AntiAI.ps1 @@ -0,0 +1,508 @@ +#Requires -Version 5.1 +#Requires -RunAsAdministrator + +<# +.SYNOPSIS + Disables all Windows 11 AI features using official Microsoft policies. + +.DESCRIPTION + Maximum AI deactivation module - Disables 8+ Windows 11 AI features: + + DEACTIVATED AI FEATURES: + 1. Generative AI Master Switch - Blocks ALL apps from using on-device AI models + 2. Windows Recall - Screenshots everything (EXTREME privacy risk!) - Component removed + 3. Windows Copilot - System AI assistant (chat, proactive suggestions) + 4. Click to Do - Screenshot AI analysis with action suggestions + 5. Paint Cocreator - Cloud-based text-to-image generation + 6. Paint Generative Fill - AI-powered image editing + 7. Paint Image Creator - DALL-E art generator + 8. Notepad AI - Write, Summarize, Rewrite features (GPT) + 9. Settings Agent - AI-powered Settings search + + AUTOMATICALLY BLOCKED (by Master Switch): + - Photos Generative Erase / Background effects + - Clipchamp Auto Compose + - Snipping Tool AI-OCR / Quick Redact + - All future generative AI apps + + RECALL ENTERPRISE PROTECTION (Maximum Compliance): + - App Deny List: Browser, Terminal, Password managers, RDP never captured + - URI Deny List: Banking, Email, Login pages never captured + - Storage Duration: Maximum 30 days retention + - Storage Space: Maximum 10 GB allocated + + Uses only official Microsoft policies (WindowsAI CSP, AppPrivacy, Paint, Notepad). + No registry hacks, 100% MS Best Practice compliant. + + WARNING: Recall component removal requires reboot! + +.PARAMETER SkipBackup + Skip backup creation (NOT RECOMMENDED - use only for testing) + +.PARAMETER DryRun + Preview actions without applying changes + +.EXAMPLE + Invoke-AntiAI + Disables all AI features with automatic backup. + +.EXAMPLE + Invoke-AntiAI -DryRun + Preview actions without applying changes. + +.NOTES + Author: NoID Privacy + Version: 2.2.0 + Requires: Windows 11 24H2 or later, Administrator privileges + Impact: All AI features completely disabled, reboot required +#> +function Invoke-AntiAI { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun, + + [Parameter(Mandatory = $false)] + [switch]$SkipBackup + ) + + $startTime = Get-Date + + Write-Host "" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host " ANTI-AI MODULE v2.2.0" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + Write-Host "Disables 13 AI features (32 policies):" -ForegroundColor White + Write-Host " - Generative AI Master Switch (blocks ALL AI models)" -ForegroundColor Gray + Write-Host " - Windows Recall + Export Block" -ForegroundColor Gray + Write-Host " - Windows Copilot (app + URI handlers + Edge sidebar)" -ForegroundColor Gray + Write-Host " - Click to Do, Paint AI (3), Notepad AI, Settings Agent" -ForegroundColor Gray + Write-Host " - Explorer AI Actions Menu" -ForegroundColor Gray + Write-Host "" + Write-Host "Uses 32 registry policies (+ URI handlers blocked separately)" -ForegroundColor Gray + Write-Host "REBOOT REQUIRED for Recall component removal" -ForegroundColor Yellow + Write-Host "" + + if ($DryRun) { + Write-Host "[DRY RUN MODE - Preview only, no changes]" -ForegroundColor Yellow + Write-Host "" + } + + # Initialize result tracking (PSCustomObject for Framework compatibility) + $result = [PSCustomObject]@{ + Success = $false + TotalFeatures = 13 # 10 Original + 3 Advanced (RecallExport, URIHandlers, EdgeSidebar) + Applied = 0 + Failed = 0 + Warnings = @() + Errors = @() + RequiresReboot = $false + VerificationPassed = $null + StartTime = $startTime + EndTime = $null + Duration = $null + } + + # BAVR Pattern: Backup, Apply (9 features), Verify, Complete + # No step counting during apply - clean sequential output + + try { + # Core/Rollback.ps1 is loaded by Framework.ps1 - DO NOT load again here + # Loading it twice would reset $script:BackupBasePath and break the backup system! + + # Initialize Session-based backup system + $moduleBackupPath = $null + + # PHASE 1: BACKUP + Write-Host "[1/4] BACKUP - Creating restore point..." -ForegroundColor Cyan + + if (-not $SkipBackup -and -not $DryRun) { + try { + Initialize-BackupSystem + $moduleBackupPath = Start-ModuleBackup -ModuleName "AntiAI" + Write-Host " Backup initialized: $moduleBackupPath" -ForegroundColor Green + Write-Host "" + } + catch { + Write-Host " WARNING: Backup failed - continuing without backup (RISKY!)" -ForegroundColor Yellow + Write-Host "" + $result.Warnings += "Backup initialization failed: $_" + } + } + else { + if ($DryRun) { + Write-Host " Skipped (DryRun mode)" -ForegroundColor Gray + } + else { + Write-Host " Skipped (SkipBackup flag)" -ForegroundColor Yellow + } + Write-Host "" + } + + # Capture AntiAI pre-state for precise restore (32 policies) + if ($moduleBackupPath -and -not $DryRun) { + try { + $antiAIPreState = @() + + $antiAIPreTargets = @( + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy"; Name = "LetAppsAccessSystemAIModels"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy"; Name = "LetAppsAccessGenerativeAI"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\systemAIModels"; Name = "Value"; Type = "String" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "AllowRecallEnablement"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "DisableAIDataAnalysis"; Type = "DWord" }, + @{ Path = "HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "DisableAIDataAnalysis"; Type = "DWord" }, + @{ Path = "HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "DisableRecallDataProviders"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "SetDenyAppListForRecall"; Type = "MultiString" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "SetDenyUriListForRecall"; Type = "MultiString" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "SetMaximumStorageDurationForRecallSnapshots"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "SetMaximumStorageSpaceForRecallSnapshots"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "TurnOffWindowsCopilot"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot"; Name = "TurnOffWindowsCopilot"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot"; Name = "ShowCopilotButton"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer"; Name = "DisableWindowsCopilot"; Type = "DWord" }, + @{ Path = "HKCU:\Software\Policies\Microsoft\Windows\WindowsCopilot"; Name = "TurnOffWindowsCopilot"; Type = "DWord" }, + @{ Path = "HKCU:\Software\Policies\Microsoft\Windows\WindowsCopilot"; Name = "ShowCopilotButton"; Type = "DWord" }, + @{ Path = "HKCU:\Software\Policies\Microsoft\Windows\WindowsAI"; Name = "SetCopilotHardwareKey"; Type = "String" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "DisableClickToDo"; Type = "DWord" }, + @{ Path = "HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "DisableClickToDo"; Type = "DWord" }, + @{ Path = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Paint"; Name = "DisableCocreator"; Type = "DWord" }, + @{ Path = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Paint"; Name = "DisableGenerativeFill"; Type = "DWord" }, + @{ Path = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Paint"; Name = "DisableImageCreator"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\WindowsNotepad"; Name = "DisableAIFeatures"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "DisableSettingsAgent"; Type = "DWord" }, + # NEW v2.2.0: Advanced Copilot Blocking + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "AllowRecallExport"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"; Name = "EdgeSidebarEnabled"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"; Name = "ShowHubsSidebar"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"; Name = "HubsSidebarEnabled"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"; Name = "CopilotPageContext"; Type = "DWord" }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"; Name = "CopilotCDPPageContext"; Type = "DWord" }, + # NEW: File Explorer AI Actions Menu + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer"; Name = "HideAIActionsMenu"; Type = "DWord" } + ) + + foreach ($t in $antiAIPreTargets) { + $entry = [PSCustomObject]@{ + Path = $t.Path + Name = $t.Name + Type = $t.Type + Exists = $false + Value = $null + } + + try { + if (Test-Path $t.Path) { + $prop = Get-ItemProperty -Path $t.Path -Name $t.Name -ErrorAction SilentlyContinue + if ($null -ne $prop -and $prop.PSObject.Properties.Name -contains $t.Name) { + $entry.Exists = $true + $entry.Value = $prop.$($t.Name) + } + } + } + catch { + # Ignore read errors, entry remains Exists = $false + $null = $null + } + + $antiAIPreState += $entry + } + + $preStatePath = Join-Path $moduleBackupPath "AntiAI_PreState.json" + $antiAIPreState | ConvertTo-Json -Depth 5 | Out-File -FilePath $preStatePath -Encoding UTF8 -Force + Write-Log -Level DEBUG -Message "AntiAI pre-state snapshot saved: $preStatePath" -Module "AntiAI" + } + catch { + Write-Log -Level WARNING -Message "Failed to capture AntiAI pre-state snapshot: $_" -Module "AntiAI" + } + } + + # PHASE 2: APPLY + Write-Host "[2/4] APPLY - Disabling AI features..." -ForegroundColor Cyan + Write-Host "" + + # Feature 1: Generative AI Master Switch + Write-Host " Generative AI Master Switch..." -ForegroundColor White -NoNewline + $masterResult = Set-SystemAIModels -DryRun:$DryRun + if ($masterResult.Success) { + Write-Host " OK" -ForegroundColor Green + $result.Applied++ + } + else { + Write-Host " FAILED" -ForegroundColor Red + $result.Failed++ + $result.Errors += $masterResult.Errors + } + + # Feature 2: Windows Recall (Core + Protection) + Write-Host " Windows Recall (component removal)..." -ForegroundColor White -NoNewline + $recallResult = Disable-Recall -DryRun:$DryRun + if ($recallResult.Success) { + Write-Host " OK" -ForegroundColor Green + $result.Applied++ + $result.RequiresReboot = $true + } + else { + Write-Host " FAILED" -ForegroundColor Red + $result.Failed++ + $result.Errors += $recallResult.Errors + } + + Write-Host " Recall Enterprise Protection..." -ForegroundColor White -NoNewline + $protectionResult = Set-RecallProtection -DryRun:$DryRun + if ($protectionResult.Success) { + Write-Host " OK" -ForegroundColor Green + } + else { + Write-Host " WARNING" -ForegroundColor Yellow + $result.Warnings += "Recall protection incomplete but core disable succeeded" + } + + # Feature 3: Windows Copilot + if ($moduleBackupPath -and -not $DryRun) { + # CRITICAL: Create JSON backup for Explorer Advanced HKLM (Protected Key) + # .reg import often fails for this key due to permissions/ownership + try { + $expPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" + if (Test-Path $expPath) { + $expVal = Get-ItemProperty -Path $expPath -Name "ShowCopilotButton" -ErrorAction SilentlyContinue + if ($expVal) { + $expData = @{ "ShowCopilotButton" = $expVal.ShowCopilotButton } + $expJson = $expData | ConvertTo-Json + Register-Backup -Type "AntiAI" -Data $expJson -Name "Explorer_Advanced_Device_JSON" | Out-Null + } + } + } catch { + Write-Host " WARNING: Failed to create JSON backup for Explorer Advanced: $_" -ForegroundColor Yellow + } + } + + Write-Host " Windows Copilot..." -ForegroundColor White -NoNewline + $copilotResult = Disable-Copilot -DryRun:$DryRun + if ($copilotResult.Success) { + Write-Host " OK" -ForegroundColor Green + $result.Applied++ + } + else { + Write-Host " FAILED" -ForegroundColor Red + $result.Failed++ + $result.Errors += $copilotResult.Errors + } + + # Feature 4: Click to Do + Write-Host " Click to Do..." -ForegroundColor White -NoNewline + $clickResult = Disable-ClickToDo -DryRun:$DryRun + if ($clickResult.Success) { + Write-Host " OK" -ForegroundColor Green + $result.Applied++ + } + else { + Write-Host " FAILED" -ForegroundColor Red + $result.Failed++ + $result.Errors += $clickResult.Errors + } + + # Feature 5-7: Paint AI (3 features) + Write-Host " Paint AI (Cocreator, Fill, Creator)..." -ForegroundColor White -NoNewline + $paintResult = Disable-PaintAI -DryRun:$DryRun + if ($paintResult.Success) { + Write-Host " OK" -ForegroundColor Green + $result.Applied += 3 + } + else { + Write-Host " FAILED" -ForegroundColor Red + $result.Failed += 3 + $result.Errors += $paintResult.Errors + } + + # Feature 8: Notepad AI + Write-Host " Notepad AI..." -ForegroundColor White -NoNewline + $notepadResult = Disable-NotepadAI -DryRun:$DryRun + if ($notepadResult.Success) { + Write-Host " OK" -ForegroundColor Green + $result.Applied++ + } + else { + Write-Host " FAILED" -ForegroundColor Red + $result.Failed++ + $result.Errors += $notepadResult.Errors + } + + # Feature 9: Settings Agent + Write-Host " Settings Agent..." -ForegroundColor White -NoNewline + $settingsResult = Disable-SettingsAgent -DryRun:$DryRun + if ($settingsResult.Success) { + Write-Host " OK" -ForegroundColor Green + $result.Applied++ + } + else { + Write-Host " FAILED" -ForegroundColor Red + $result.Failed++ + $result.Errors += $settingsResult.Errors + } + + # Feature 10: Explorer AI Actions Menu + Write-Host " Explorer AI Actions..." -ForegroundColor White -NoNewline + $explorerResult = Disable-ExplorerAI -DryRun:$DryRun + if ($explorerResult.Success) { + Write-Host " OK" -ForegroundColor Green + $result.Applied++ + } + else { + Write-Host " FAILED" -ForegroundColor Red + $result.Failed++ + $result.Errors += $explorerResult.Errors + } + + # ============================================================================ + # ADVANCED COPILOT BLOCKING (NEW v2.2.0) + # ============================================================================ + Write-Host "" + Write-Host " [Advanced Copilot Blocks]" -ForegroundColor Cyan + + # Feature 11-15: Advanced Copilot Blocking + Write-Host " Advanced Copilot Blocks..." -ForegroundColor White -NoNewline + $advancedResult = Disable-CopilotAdvanced -DryRun:$DryRun + + if ($advancedResult.Success) { + Write-Host " OK" -ForegroundColor Green + + # Count actual features applied (not layers) + $advancedFeaturesApplied = 0 + if ($advancedResult.RecallExportBlocked) { + Write-Host " - Recall Export blocked" -ForegroundColor Gray + $advancedFeaturesApplied++ + } + if ($advancedResult.URIHandlersBlocked) { + Write-Host " - URI handlers (ms-copilot:) blocked" -ForegroundColor Gray + $advancedFeaturesApplied++ + } + if ($advancedResult.EdgeSidebarDisabled) { + Write-Host " - Edge Copilot sidebar disabled" -ForegroundColor Gray + $advancedFeaturesApplied++ + } + $result.Applied += $advancedFeaturesApplied + } + else { + Write-Host " PARTIAL" -ForegroundColor Yellow + $result.Warnings += "Some advanced Copilot blocks may have failed" + if ($advancedResult.Errors.Count -gt 0) { + $result.Errors += $advancedResult.Errors + } + } + + Write-Host "" + + # Register backup in session manifest + # Note: Only Explorer Advanced JSON backup + PreState snapshot are created + # PreState snapshot covers all 32 policies precisely + if ($moduleBackupPath) { + Complete-ModuleBackup -ItemsBackedUp 2 -Status "Success" + } + + # PHASE 3: VERIFY + Write-Host "[3/4] VERIFY - Checking compliance..." -ForegroundColor Cyan + + if (-not $DryRun -and $result.Failed -eq 0) { + try { + $complianceResult = Test-AntiAICompliance + + if ($complianceResult.OverallStatus -eq "PASS") { + Write-Host " All $($complianceResult.TotalChecks) compliance checks passed" -ForegroundColor Green + $result.VerificationPassed = $true + } + else { + Write-Host " WARNING: $($complianceResult.FailedChecks)/$($complianceResult.TotalChecks) checks failed" -ForegroundColor Yellow + $result.VerificationPassed = $false + $result.Warnings += "Some compliance checks failed - policies may not be fully effective" + } + } + catch { + Write-Host " WARNING: Verification failed - $($_.Exception.Message)" -ForegroundColor Yellow + $result.Warnings += "Compliance verification skipped due to error" + $result.VerificationPassed = $null + } + } + else { + if ($DryRun) { + Write-Host " Skipped (DryRun mode)" -ForegroundColor Gray + } + else { + Write-Host " Skipped (errors occurred)" -ForegroundColor Yellow + } + $result.VerificationPassed = $null + } + Write-Host "" + + # Calculate final status + $result.Success = ($result.Failed -eq 0) + $result.EndTime = Get-Date + $result.Duration = ($result.EndTime - $result.StartTime).TotalSeconds + + # PHASE 4: COMPLETE + Write-Host "[4/4] COMPLETE - AI hardening finished!" -ForegroundColor Green + Write-Host "" + + Write-Host "Status: " -NoNewline + if ($result.Success) { + Write-Host "SUCCESS - All AI features disabled!" -ForegroundColor Green + } + else { + Write-Host "COMPLETED WITH ERRORS" -ForegroundColor Yellow + } + + Write-Host "Features: $($result.Applied)/$($result.TotalFeatures) disabled" -ForegroundColor $(if ($result.Failed -eq 0) { 'Green' } else { 'Yellow' }) + Write-Host "Errors: $($result.Failed)" -ForegroundColor $(if ($result.Failed -eq 0) { 'Green' } else { 'Red' }) + Write-Host "Warnings: $($result.Warnings.Count)" -ForegroundColor $(if ($result.Warnings.Count -eq 0) { 'Green' } else { 'Yellow' }) + + if ($null -ne $result.VerificationPassed) { + Write-Host "Verification: " -NoNewline + if ($result.VerificationPassed) { + Write-Host "PASSED - All policies verified" -ForegroundColor Green + } + else { + Write-Host "FAILED - Some policies not verified" -ForegroundColor Yellow + } + } + + Write-Host "Duration: $([math]::Round($result.Duration, 2)) seconds" -ForegroundColor Cyan + + if ($moduleBackupPath) { + Write-Host "Backup: $moduleBackupPath" -ForegroundColor Cyan + Write-Host "Items Backed: 2 items (PreState snapshot + Explorer JSON)" -ForegroundColor Cyan + } + elseif (-not $SkipBackup -and -not $DryRun) { + Write-Host "Backup: FAILED" -ForegroundColor Red + } + else { + Write-Host "Backup: SKIPPED" -ForegroundColor Yellow + } + + if ($result.RequiresReboot) { + Write-Host "`nREBOOT REQUIRED: " -NoNewline -ForegroundColor Red + Write-Host "Recall component removal needs system restart!" -ForegroundColor Yellow + } + + if ($result.Errors.Count -gt 0) { + Write-Host "" + Write-Host "Errors:" -ForegroundColor Red + foreach ($err in $result.Errors) { + Write-Host " - $err" -ForegroundColor Red + } + } + + Write-Host "" + + # GUI parsing marker for settings count (32 registry policies) + Write-Log -Level SUCCESS -Message "Applied 32 settings" -Module "AntiAI" + + # Return result object as PSCustomObject (Framework expects this type) + return [PSCustomObject]$result + } + catch { + $result.Success = $false + $result.Errors += "Critical error: $($_.Exception.Message)" + Write-Error "AntiAI module failed: $($_.Exception.Message)" + return [PSCustomObject]$result + } +} diff --git a/Modules/DNS/Config/DNS.json b/Modules/DNS/Config/DNS.json new file mode 100644 index 0000000..7df2f53 --- /dev/null +++ b/Modules/DNS/Config/DNS.json @@ -0,0 +1,38 @@ +{ + "DoHPolicy": { + "Mode": "REQUIRE", + "Description": "DNS-over-HTTPS enforcement mode", + "Options": { + "REQUIRE": { + "Value": 3, + "Description": "REQUIRE DoH (no unencrypted fallback) - Maximum security", + "BestFor": "Home users, single-network systems, maximum privacy", + "Warning": "May cause connectivity issues in corporate networks, captive portals, or mobile hotspots" + }, + "ALLOW": { + "Value": 2, + "Description": "ALLOW DoH (fallback to UDP if DoH fails) - Balanced", + "BestFor": "VPN users, mobile devices, multi-network systems, enterprise environments", + "Warning": "Less secure - DNS queries may fall back to unencrypted UDP" + }, + "PROHIBIT": { + "Value": 1, + "Description": "PROHIBIT DoH (disable encrypted DNS) - Not recommended", + "BestFor": "Legacy systems, specific enterprise requirements only", + "Warning": "All DNS queries will be unencrypted" + } + }, + "Recommendation": "Use REQUIRE for home networks, ALLOW for VPN/mobile/enterprise" + }, + "AllowFallbackToUdp": { + "REQUIRE": false, + "ALLOW": true, + "PROHIBIT": true + }, + "Notes": [ + "REQUIRE mode (default): Best privacy, but may break in corporate/captive portal networks or with VPNs", + "ALLOW mode: Good balance for VPN users, mobile users and enterprise environments", + "Users with VPNs or on multiple networks should choose ALLOW mode", + "PROHIBIT mode is NOT recommended - only for specific legacy requirements" + ] +} diff --git a/Modules/DNS/Config/Providers.json b/Modules/DNS/Config/Providers.json new file mode 100644 index 0000000..71f6037 --- /dev/null +++ b/Modules/DNS/Config/Providers.json @@ -0,0 +1,140 @@ +{ + "version": "1.0.0", + "providers": { + "cloudflare": { + "name": "Cloudflare", + "description": "Fastest global DNS resolver with strong privacy", + "ipv4": { + "primary": "1.1.1.1", + "secondary": "1.0.0.1" + }, + "ipv6": { + "primary": "2606:4700:4700::1111", + "secondary": "2606:4700:4700::1001" + }, + "doh": { + "template": "https://cloudflare-dns.com/dns-query", + "supported": true + }, + "ratings": { + "speed": 5, + "privacy": 4, + "security": 4, + "filtering": 2 + }, + "features": [ + "Minimal logging (25h retention, anonymized IPs)", + "DNSSEC validation (server-side)", + "Fastest anycast network globally (150+ locations)", + "KPMG-audited privacy practices", + "Malware blocking available (1.1.1.2 variant)", + "Adult content blocking available (1.1.1.3 variant)" + ], + "jurisdiction": "USA (GDPR-compliant, strong privacy commitments)", + "best_for": "Maximum speed with audited privacy", + "documentation": "https://developers.cloudflare.com/1.1.1.1/" + }, + "quad9": { + "name": "Quad9", + "description": "Non-profit DNS with Swiss privacy and threat blocking", + "ipv4": { + "primary": "9.9.9.9", + "secondary": "149.112.112.112" + }, + "ipv6": { + "primary": "2620:fe::fe", + "secondary": "2620:fe::9" + }, + "doh": { + "template": "https://dns.quad9.net/dns-query", + "supported": true + }, + "ratings": { + "speed": 4, + "privacy": 5, + "security": 5, + "filtering": 4 + }, + "features": [ + "Zero logging (no IP or query data stored)", + "Swiss Data Protection Act enforcement", + "Threat intelligence from 20+ sources (97% blocking rate)", + "DNSSEC validation (server-side)", + "Non-profit, no data monetization", + "150+ locations in 90 countries" + ], + "jurisdiction": "Switzerland (Zuerich) - Strongest privacy laws", + "best_for": "Maximum privacy and security under Swiss law", + "documentation": "https://quad9.net/" + }, + "adguard": { + "name": "AdGuard DNS", + "description": "EU-based DNS with comprehensive ad and tracker blocking", + "ipv4": { + "primary": "94.140.14.14", + "secondary": "94.140.15.15" + }, + "ipv6": { + "primary": "2a10:50c0::ad1:ff", + "secondary": "2a10:50c0::ad2:ff" + }, + "doh": { + "template": "https://dns.adguard-dns.com/dns-query", + "supported": true + }, + "ratings": { + "speed": 4, + "privacy": 4, + "security": 4, + "filtering": 5 + }, + "features": [ + "Comprehensive ad and tracker blocking", + "Analytics and telemetry blocking", + "DNSSEC validation (server-side)", + "GDPR compliant (EU jurisdiction)", + "No-logging policy (not independently audited)", + "Family-friendly filtering options available" + ], + "jurisdiction": "Cyprus (Limassol) - EU, GDPR compliance", + "best_for": "Maximum ad/tracker blocking with EU privacy", + "documentation": "https://adguard-dns.io/" + } + }, + "default_provider": "quad9", + "rating_descriptions": { + "speed": { + "5": "Exceptional - Fastest global performance", + "4": "Excellent - Very fast response times", + "3": "Good - Adequate performance", + "2": "Fair - Slower than average", + "1": "Poor - Slow response times" + }, + "privacy": { + "5": "Exceptional - Zero logging, strong jurisdiction, independently audited", + "4": "Excellent - Minimal logging, good privacy policies", + "3": "Good - Some logging, reasonable policies", + "2": "Fair - Extensive logging", + "1": "Poor - Privacy concerns" + }, + "security": { + "5": "Exceptional - Multiple threat feeds, DNSSEC, automatic blocking", + "4": "Excellent - DNSSEC validation, basic threat protection", + "3": "Good - DNSSEC only", + "2": "Fair - Limited security features", + "1": "Poor - No security features" + }, + "filtering": { + "5": "Exceptional - Comprehensive ad, tracker, and malware blocking", + "4": "Excellent - Malware and phishing blocking", + "3": "Good - Basic filtering available", + "2": "Fair - Limited filtering options", + "1": "Poor - No filtering" + } + }, + "notes": { + "dnssec": "All providers perform server-side DNSSEC validation. No client-side NRPT configuration required.", + "doh": "DNS over HTTPS (DoH) encrypts DNS queries for privacy. Fallback to unencrypted DNS is disabled for security.", + "ipv6": "IPv6 addresses are always configured alongside IPv4. Windows will use IPv6 when available." + } +} diff --git a/Modules/DNS/DNS.psd1 b/Modules/DNS/DNS.psd1 new file mode 100644 index 0000000..2f6b5a0 --- /dev/null +++ b/Modules/DNS/DNS.psd1 @@ -0,0 +1,38 @@ +@{ + # Module manifest for DNS module + + RootModule = 'DNS.psm1' + ModuleVersion = '2.2.0' + GUID = 'a8f7b3c9-4e5d-4a2b-9c1d-8f3e5a7b9c2d' + Author = 'NexusOne23' + CompanyName = 'Open Source Project' + Copyright = '(c) 2025 NexusOne23. Licensed under GPL-3.0.' + Description = 'Secure DNS configuration module with DoH support for Cloudflare, Quad9, and AdGuard DNS providers' + + PowerShellVersion = '5.1' + + # Functions to export from this module + FunctionsToExport = @( + 'Invoke-DNSConfiguration', + 'Get-DNSStatus', + 'Restore-DNSSettings' + ) + + # Cmdlets to export from this module + CmdletsToExport = @() + + # Variables to export from this module + VariablesToExport = @() + + # Aliases to export from this module + AliasesToExport = @() + + PrivateData = @{ + PSData = @{ + Tags = @('DNS', 'DoH', 'Security', 'Privacy', 'Cloudflare', 'Quad9', 'AdGuard') + LicenseUri = '' + ProjectUri = '' + ReleaseNotes = 'Initial release with DoH support for 3 major DNS providers' + } + } +} diff --git a/Modules/DNS/DNS.psm1 b/Modules/DNS/DNS.psm1 new file mode 100644 index 0000000..ceb834c --- /dev/null +++ b/Modules/DNS/DNS.psm1 @@ -0,0 +1,43 @@ +#Requires -Version 5.1 +#Requires -RunAsAdministrator + +<# +.SYNOPSIS + DNS Configuration Module for NoID Privacy + +.DESCRIPTION + Provides secure DNS configuration with DNS over HTTPS (DoH) support. + Supports Cloudflare, Quad9, and AdGuard DNS providers with automatic + backup and restore capabilities. + +.NOTES + Author: NoID Privacy + Version: 2.2.0 + Requires: PowerShell 5.1+, Administrator privileges +#> + +# Module-level variables +$script:ModuleName = "DNS" +$script:ModuleRoot = $PSScriptRoot +$PrivatePath = "$PSScriptRoot\Private" + +# Get module functions +$Private = @(Get-ChildItem -Path $PrivatePath -Filter "*.ps1" -ErrorAction SilentlyContinue) +$Public = @(Get-ChildItem -Path "$PSScriptRoot\Public" -Filter "*.ps1" -ErrorAction SilentlyContinue) + +# Dot source the functions +foreach ($import in @($Private + $Public)) { + try { + . $import.FullName + } + catch { + Write-Host "ERROR: Failed to import function $($import.FullName): $_" -ForegroundColor Red + } +} + +# Export public functions +Export-ModuleMember -Function $Public.BaseName + +# Alias for naming consistency (non-breaking change) +New-Alias -Name 'Invoke-DNS' -Value 'Invoke-DNSConfiguration' -Force +Export-ModuleMember -Alias 'Invoke-DNS' diff --git a/Modules/DNS/Private/Backup-DNSSettings.ps1 b/Modules/DNS/Private/Backup-DNSSettings.ps1 new file mode 100644 index 0000000..e7c08fb --- /dev/null +++ b/Modules/DNS/Private/Backup-DNSSettings.ps1 @@ -0,0 +1,300 @@ +function Backup-DNSSettings { + <# + .SYNOPSIS + Backup current DNS settings for all physical network adapters + + .DESCRIPTION + Creates a comprehensive backup of DNS configuration including: + - Current DNS server addresses (IPv4 and IPv6) + - DHCP status (was DNS obtained from DHCP?) + - DoH configuration + - Adapter interface information + + Backup is stored using the framework's rollback system. + + .PARAMETER DryRun + Show what would be backed up without actually creating backup + + .EXAMPLE + Backup-DNSSettings + Creates backup of current DNS settings + + .OUTPUTS + System.String - Path to backup file or $null if failed + + .NOTES + DHCP awareness is critical for correct rollback behavior + #> + + [CmdletBinding()] + param( + [Parameter()] + [switch]$DryRun + ) + + try { + Write-Log -Level INFO -Message "Backing up DNS settings..." -Module $script:ModuleName + + # Get all physical adapters + $adapters = @(Get-PhysicalAdapters) # Force array + + if ($adapters.Count -eq 0) { + Write-Log -Level WARNING -Message "No physical adapters found to backup" -Module $script:ModuleName + return $null + } + + Write-Log -Level DEBUG -Message "Found $($adapters.Count) adapter(s) to backup" -Module $script:ModuleName + + # Get netsh global DoH state + $netshGlobalDoh = $null + try { + $netshResult = netsh dnsclient show global 2>&1 | Out-String + if ($netshResult -match "DoH\s*:\s*(\w+)") { + $netshGlobalDoh = $matches[1] + Write-Log -Level DEBUG -Message "netsh global DoH state: $netshGlobalDoh" -Module $script:ModuleName + } + } + catch { + Write-Log -Level DEBUG -Message "Could not retrieve netsh global DoH state: $_" -Module $script:ModuleName + } + + # Get all netsh DoH encryption entries + $netshDohEntries = @() + try { + $netshEncryption = netsh dnsclient show encryption 2>&1 | Out-String + # Parse netsh output for DoH servers + # Format: "Server: X.X.X.X | Template: https://... | Auto-upgrade: yes | UDP fallback: no" + $lines = $netshEncryption -split "`n" + foreach ($line in $lines) { + if ($line -match "Server:\s*(\S+)") { + $server = $matches[1] + $template = $null + $autoupgrade = $null + $udpfallback = $null + + if ($netshEncryption -match "Server:\s*$([regex]::Escape($server)).*?Template:\s*(\S+)") { + $template = $matches[1] + } + if ($netshEncryption -match "Server:\s*$([regex]::Escape($server)).*?Auto-upgrade:\s*(\w+)") { + $autoupgrade = $matches[1] + } + if ($netshEncryption -match "Server:\s*$([regex]::Escape($server)).*?UDP fallback:\s*(\w+)") { + $udpfallback = $matches[1] + } + + if ($template) { + $netshDohEntries += @{ + Server = $server + Template = $template + AutoUpgrade = $autoupgrade + UdpFallback = $udpfallback + } + Write-Log -Level DEBUG -Message "Found netsh DoH entry: $server" -Module $script:ModuleName + } + } + } + } + catch { + Write-Log -Level DEBUG -Message "Could not retrieve netsh DoH entries: $_" -Module $script:ModuleName + } + + $dohEntries = @() + try { + $allDoh = Get-DnsClientDohServerAddress -ErrorAction SilentlyContinue + if ($allDoh) { + foreach ($entry in $allDoh) { + if ($entry.ServerAddress -and $entry.DohTemplate) { + $dohEntries += @{ + ServerAddress = $entry.ServerAddress + DohTemplate = $entry.DohTemplate + AllowFallbackToUdp = $entry.AllowFallbackToUdp + AutoUpgrade = $entry.AutoUpgrade + } + } + } + Write-Log -Level DEBUG -Message "Backed up $($dohEntries.Count) DoH entries from Get-DnsClientDohServerAddress" -Module $script:ModuleName + } + } + catch { + Write-Log -Level DEBUG -Message "Could not retrieve DoH entries via Get-DnsClientDohServerAddress: $_" -Module $script:ModuleName + } + + # Get DoH Policy Registry settings + $dohPolicySettings = @{} + try { + $dnsClientPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" + if (Test-Path $dnsClientPath) { + $dohPolicy = (Get-ItemProperty -Path $dnsClientPath -Name "DoHPolicy" -ErrorAction SilentlyContinue).DoHPolicy + if ($null -ne $dohPolicy) { + $dohPolicySettings['DoHPolicy'] = $dohPolicy + } + } + + $dnsParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" + if (Test-Path $dnsParamsPath) { + $enableAutoDoh = (Get-ItemProperty -Path $dnsParamsPath -Name "EnableAutoDoh" -ErrorAction SilentlyContinue).EnableAutoDoh + if ($null -ne $enableAutoDoh) { + $dohPolicySettings['EnableAutoDoh'] = $enableAutoDoh + } + + # NOTE: Global DohFlags no longer used (we use per-adapter DohFlags instead) + # Kept for backward compatibility with old backups, but not written anymore + } + + Write-Log -Level DEBUG -Message "Backed up DoH policy settings: $($dohPolicySettings.Count) keys" -Module $script:ModuleName + } + catch { + Write-Log -Level DEBUG -Message "Could not retrieve DoH policy settings: $_" -Module $script:ModuleName + } + + $backupData = @{ + Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + ComputerName = $env:COMPUTERNAME + NetshGlobalDoh = $netshGlobalDoh + NetshDohEntries = $netshDohEntries + DohEntries = $dohEntries + DohPolicySettings = $dohPolicySettings + Adapters = @() + } + + foreach ($adapter in $adapters) { + Write-Log -Level DEBUG -Message "Backing up adapter: $($adapter.Name)" -Module $script:ModuleName + + # Get current DNS configuration + $dnsConfig = Get-DnsClientServerAddress -InterfaceIndex $adapter.InterfaceIndex -ErrorAction SilentlyContinue + + # Collect DNS addresses first + $ipv4Addresses = @() + $ipv6Addresses = @() + + foreach ($config in $dnsConfig) { + if ($config.AddressFamily -eq 2) { # IPv4 + if ($config.ServerAddresses.Count -gt 0) { + $ipv4Addresses = $config.ServerAddresses + } + } + elseif ($config.AddressFamily -eq 23) { # IPv6 + if ($config.ServerAddresses.Count -gt 0 -and + $config.ServerAddresses -notcontains "fec0:0:0:ffff::1" -and + $config.ServerAddresses -notcontains "fec0:0:0:ffff::2" -and + $config.ServerAddresses -notcontains "fec0:0:0:ffff::3") { + # Only if not DHCP placeholder addresses + $ipv6Addresses = $config.ServerAddresses + } + } + } + + # CRITICAL FIX: Determine DHCP status AFTER collecting all addresses + # DNS is from DHCP only if NO addresses are configured (neither IPv4 nor IPv6) + $isDHCP = ($ipv4Addresses.Count -eq 0) -and ($ipv6Addresses.Count -eq 0) + + # Get DoH configuration for this adapter's DNS servers + $dohConfig = @() + try { + $allDohServers = Get-DnsClientDohServerAddress -ErrorAction SilentlyContinue + if ($allDohServers) { + foreach ($dohServer in $allDohServers) { + if ($ipv4Addresses -contains $dohServer.ServerAddress -or + $ipv6Addresses -contains $dohServer.ServerAddress) { + $dohConfig += @{ + ServerAddress = $dohServer.ServerAddress + DohTemplate = $dohServer.DohTemplate + AllowFallbackToUdp = $dohServer.AllowFallbackToUdp + AutoUpgrade = $dohServer.AutoUpgrade + } + } + } + } + } + catch { + Write-Log -Level DEBUG -Message "Could not retrieve DoH configuration: $_" -Module $script:ModuleName + } + + # Get DohFlags registry settings for this adapter + $dohFlags = @{} + try { + $interfaceGuid = $adapter.InterfaceGuid + $dohFlagsBasePath = "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$interfaceGuid\DohInterfaceSettings\Doh" + + if (Test-Path $dohFlagsBasePath) { + # Check each DNS server IP + $allDnsIPs = $ipv4Addresses + $ipv6Addresses + foreach ($dnsIP in $allDnsIPs) { + $dohFlagsPath = "$dohFlagsBasePath\$dnsIP" + if (Test-Path $dohFlagsPath) { + $flagValue = (Get-ItemProperty -Path $dohFlagsPath -Name "DohFlags" -ErrorAction SilentlyContinue).DohFlags + if ($null -ne $flagValue) { + $dohFlags[$dnsIP] = $flagValue + Write-Log -Level DEBUG -Message "Found DohFlags for $dnsIP : $flagValue" -Module $script:ModuleName + } + } + } + } + } + catch { + Write-Log -Level DEBUG -Message "Could not retrieve DohFlags: $_" -Module $script:ModuleName + } + + # Get DHCP DNS Override setting for this adapter + $dhcpOverrideDisabled = $null + try { + $dnsClient = Get-DnsClient -InterfaceIndex $adapter.InterfaceIndex -ErrorAction SilentlyContinue + if ($dnsClient) { + $dhcpOverrideDisabled = (-not $dnsClient.RegisterThisConnectionsAddress) + Write-Log -Level DEBUG -Message "DHCP Override disabled: $dhcpOverrideDisabled" -Module $script:ModuleName + } + } + catch { + Write-Log -Level DEBUG -Message "Could not retrieve DHCP override setting: $_" -Module $script:ModuleName + } + + $adapterBackup = @{ + InterfaceIndex = $adapter.InterfaceIndex + InterfaceAlias = $adapter.Name + InterfaceDescription = $adapter.InterfaceDescription + InterfaceGuid = $adapter.InterfaceGuid + Status = $adapter.Status + IsDHCP = $isDHCP + IPv4Addresses = $ipv4Addresses + IPv6Addresses = $ipv6Addresses + DoHConfiguration = $dohConfig + DohFlags = $dohFlags + DhcpOverrideDisabled = $dhcpOverrideDisabled + } + + $backupData.Adapters += $adapterBackup + + $statusText = if ($isDHCP) { "DHCP" } else { "Static" } + $dnsText = if ($isDHCP) { "from DHCP" } else { "$($ipv4Addresses.Count) IPv4, $($ipv6Addresses.Count) IPv6" } + Write-Log -Level INFO -Message " - $($adapter.Name): $statusText ($dnsText)" -Module $script:ModuleName + } + + if ($DryRun) { + Write-Log -Level INFO -Message "[DRYRUN] Would backup DNS settings for $($adapters.Count) adapter(s)" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] - netsh global DoH state" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] - netsh DoH encryption entries" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] - DoH Policy Registry (DoHPolicy, EnableAutoDoh, DohFlags)" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] - Per-adapter DohFlags registry" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] - DHCP DNS override settings" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] - DNS server addresses" -Module $script:ModuleName + return "DRYRUN" + } + + # Convert to JSON and save using rollback system + $backupJson = $backupData | ConvertTo-Json -Depth 10 + $backupFile = Register-Backup -Type "DNS" -Data $backupJson + + if ($backupFile) { + Write-Log -Level SUCCESS -Message "DNS settings backed up successfully" -Module $script:ModuleName + return $backupFile + } + else { + Write-Log -Level ERROR -Message "Failed to register DNS backup" -Module $script:ModuleName + return $null + } + } + catch { + Write-ErrorLog -Message "Failed to backup DNS settings" -Module $script:ModuleName -ErrorRecord $_ + return $null + } +} diff --git a/Modules/DNS/Private/Disable-DHCPDnsOverride.ps1 b/Modules/DNS/Private/Disable-DHCPDnsOverride.ps1 new file mode 100644 index 0000000..8790c9d --- /dev/null +++ b/Modules/DNS/Private/Disable-DHCPDnsOverride.ps1 @@ -0,0 +1,65 @@ +function Disable-DHCPDnsOverride { + <# + .SYNOPSIS + Prevent DHCP from overriding manually configured DNS servers + + .DESCRIPTION + Sets adapter to NOT register its DNS address and ignore DHCP-provided DNS servers. + This ensures your static DNS configuration (e.g., Cloudflare with DoH) cannot be overridden. + + .PARAMETER InterfaceIndex + Network adapter interface index + + .PARAMETER DryRun + Show what would be configured without applying changes + + .EXAMPLE + Disable-DHCPDnsOverride -InterfaceIndex 12 + + .NOTES + Uses Set-DnsClient cmdlet (PowerShell Best Practice) + #> + + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [int]$InterfaceIndex, + + [Parameter()] + [switch]$DryRun + ) + + try { + $adapter = Get-NetAdapter -InterfaceIndex $InterfaceIndex -ErrorAction Stop + $adapterName = $adapter.Name + + Write-Log -Level DEBUG -Message "Preventing DHCP DNS override on adapter: $adapterName" -Module $script:ModuleName + + if ($DryRun) { + Write-Log -Level INFO -Message "[DRYRUN] Would disable DHCP DNS override on $adapterName" -Module $script:ModuleName + return $true + } + + # Set RegisterThisConnectionsAddress = $false to prevent DHCP from overriding DNS + Set-DnsClient -InterfaceIndex $InterfaceIndex ` + -RegisterThisConnectionsAddress $false ` + -ErrorAction Stop + + Write-Log -Level SUCCESS -Message "DHCP DNS override disabled on $adapterName" -Module $script:ModuleName + + # Verify + $dnsClient = Get-DnsClient -InterfaceIndex $InterfaceIndex -ErrorAction SilentlyContinue + if ($dnsClient.RegisterThisConnectionsAddress -eq $false) { + Write-Log -Level DEBUG -Message "Verification passed: DHCP cannot override DNS" -Module $script:ModuleName + return $true + } + else { + Write-Log -Level WARNING -Message "Verification failed: DHCP override not disabled" -Module $script:ModuleName + return $false + } + } + catch { + Write-ErrorLog -Message "Failed to disable DHCP DNS override on adapter $InterfaceIndex" -Module $script:ModuleName -ErrorRecord $_ + return $false + } +} diff --git a/Modules/DNS/Private/Enable-DoH.ps1 b/Modules/DNS/Private/Enable-DoH.ps1 new file mode 100644 index 0000000..bb3b902 --- /dev/null +++ b/Modules/DNS/Private/Enable-DoH.ps1 @@ -0,0 +1,119 @@ +function Enable-DoH { + <# + .SYNOPSIS + Enable DNS over HTTPS (DoH) for specified DNS servers + + .DESCRIPTION + Configures DNS over HTTPS encryption for privacy and security. + Uses Microsoft Best Practice: Add-DnsClientDohServerAddress cmdlet. + + CRITICAL SECURITY SETTINGS: + - AllowFallbackToUdp = $False (prevents fallback to unencrypted DNS) + - AutoUpgrade = $True (automatically uses DoH when available) + + .PARAMETER ServerAddress + DNS server IP address (IPv4 or IPv6) + + .PARAMETER DohTemplate + HTTPS URL template for DoH queries + + .PARAMETER DryRun + Show what would be configured without applying changes + + .EXAMPLE + Enable-DoH -ServerAddress "1.1.1.1" -DohTemplate "https://cloudflare-dns.com/dns-query" + + .OUTPUTS + System.Boolean - $true if successful, $false otherwise + + .NOTES + Requires Windows 11 or Windows Server 2022+ for native DoH support + Fallback to unencrypted DNS is DISABLED for security + #> + + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$ServerAddress, + + [Parameter(Mandatory = $true)] + [string]$DohTemplate, + + [Parameter()] + [switch]$DryRun + ) + + try { + Write-Log -Level DEBUG -Message "Configuring DoH for $ServerAddress" -Module $script:ModuleName + + # Determine AllowFallbackToUdp based on DoH mode + $allowFallback = if ($script:DoHMode -eq "ALLOW") { $True } else { $False } + $fallbackText = if ($allowFallback) { "True (fallback allowed)" } else { "False (no fallback)" } + + if ($DryRun) { + Write-Log -Level INFO -Message "[DRYRUN] Would enable DoH for $ServerAddress" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] Template: $DohTemplate" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] AllowFallbackToUdp: $fallbackText" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] AutoUpgrade: True" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] Method: PowerShell cmdlet + netsh (dual registration)" -Module $script:ModuleName + return $true + } + + # Register DoH for this DNS server (overwrites existing if present) + Write-Log -Level DEBUG -Message "Registering DoH server: $ServerAddress" -Module "DNS" + + # METHOD 1: PowerShell cmdlet (modern API) + try { + Add-DnsClientDohServerAddress -ServerAddress $ServerAddress ` + -DohTemplate $DohTemplate ` + -AllowFallbackToUdp $allowFallback ` + -AutoUpgrade $True ` + -ErrorAction Stop + Write-Log -Level DEBUG -Message "PowerShell cmdlet registration successful" -Module "DNS" + } + catch { + Write-Log -Level DEBUG -Message "PowerShell cmdlet failed (expected on some builds): $_" -Module "DNS" + } + + # METHOD 2: netsh (critical for actual enforcement - what v1.0 uses!) + $udpFallbackMode = if ($allowFallback) { "yes" } else { "no" } + try { + $netshResult = netsh dnsclient add encryption ` + server=$ServerAddress ` + dohtemplate=$DohTemplate ` + autoupgrade=yes ` + udpfallback=$udpFallbackMode 2>&1 + + if ($LASTEXITCODE -eq 0) { + Write-Log -Level DEBUG -Message "netsh registration successful for $ServerAddress" -Module "DNS" + } + else { + Write-Log -Level DEBUG -Message "netsh returned exit code $LASTEXITCODE : $netshResult" -Module "DNS" + } + } + catch { + Write-Log -Level DEBUG -Message "netsh registration failed: $_" -Module "DNS" + } + + Write-Log -Level DEBUG -Message "Successfully registered DoH for $ServerAddress" -Module "DNS" + + Write-Log -Level SUCCESS -Message "DoH enabled for $ServerAddress" -Module $script:ModuleName + Write-Log -Level DEBUG -Message " Template: $DohTemplate" -Module $script:ModuleName + Write-Log -Level DEBUG -Message " Fallback: $(if ($allowFallback) { 'ENABLED (ALLOW mode)' } else { 'DISABLED (REQUIRE mode)' })" -Module $script:ModuleName + + return $true + } + catch { + # DoH might not be supported on older Windows versions + $errorMessage = $_.Exception.Message + + if ($errorMessage -like "*not recognized*" -or $errorMessage -like "*does not exist*") { + Write-Log -Level WARNING -Message "DoH not supported on this Windows version (requires Windows 11 or Server 2022+)" -Module $script:ModuleName + Write-Log -Level INFO -Message "DNS will work without encryption - consider upgrading Windows for DoH support" -Module $script:ModuleName + return $false + } + + Write-ErrorLog -Message "Failed to enable DoH for $ServerAddress" -Module $script:ModuleName -ErrorRecord $_ + return $false + } +} diff --git a/Modules/DNS/Private/Get-PhysicalAdapters.ps1 b/Modules/DNS/Private/Get-PhysicalAdapters.ps1 new file mode 100644 index 0000000..3954a0a --- /dev/null +++ b/Modules/DNS/Private/Get-PhysicalAdapters.ps1 @@ -0,0 +1,150 @@ +function Get-PhysicalAdapters { + <# + .SYNOPSIS + Get physical network adapters (LAN/WLAN) excluding virtual adapters + + .DESCRIPTION + Retrieves physical network adapters using multi-layer filtering to exclude: + - Virtual adapters (Hyper-V, VMware, VirtualBox) + - VPN adapters (TAP, OpenVPN, WireGuard, Cisco, etc.) + - Tunnel adapters (Teredo, 6to4, ISATAP) + - Loopback adapters + + Uses Microsoft Best Practice: Get-NetAdapter with -Physical switch + and additional filtering based on InterfaceDescription patterns. + + .PARAMETER IncludeDisabled + Include disabled adapters in results + + .EXAMPLE + Get-PhysicalAdapters + Returns all active physical network adapters + + .EXAMPLE + Get-PhysicalAdapters -IncludeDisabled + Returns all physical adapters including disabled ones + + .OUTPUTS + Microsoft.Management.Infrastructure.CimInstance#ROOT/StandardCimv2/MSFT_NetAdapter + + .NOTES + Uses Get-NetAdapter -Physical for primary filtering (Microsoft Best Practice) + Additional filtering excludes known virtual adapter patterns + #> + + [CmdletBinding()] + param( + [Parameter()] + [switch]$IncludeDisabled + ) + + try { + Write-Log -Level DEBUG -Message "Retrieving physical network adapters..." -Module $script:ModuleName + + # Layer 1: Get physical adapters only (Microsoft Best Practice) + $adapters = Get-NetAdapter -Physical -ErrorAction Stop + + # Layer 2: Filter by status if required + if (-not $IncludeDisabled) { + # Allow 'Up' (Connected) and 'Disconnected' (Cable unplugged) + # Only filter out 'Disabled' (Administratively down) or 'Not Present' + $adapters = $adapters | Where-Object { $_.Status -eq "Up" -or $_.Status -eq "Disconnected" } + Write-Log -Level DEBUG -Message "Filtering to active/disconnected adapters (excluding disabled)" -Module $script:ModuleName + } + + # Layer 3: Exclude virtual adapter patterns (COMPREHENSIVE!) + # NOTE: We distinguish between HOST-side and GUEST-side virtual adapters: + # - HOST-side (vEthernet, VMware Network Adapter VMnet*) โ†’ EXCLUDE + # - GUEST-side (Microsoft Hyper-V Network Adapter in VM) โ†’ KEEP! + $virtualPatterns = @( + # Host-side virtualization adapters (NOT guest adapters!) + '*vEthernet*', # Hyper-V HOST virtual switch + '*VMware Network Adapter*', # VMware HOST adapters (VMnet1, VMnet8) + '*VirtualBox Host-Only*', # VirtualBox HOST-only adapter + '*Virtual*Adapter*', # Generic virtual adapters + '*Container*', '*WSL*', '*Docker*', + # Generic VPN protocols + '*VPN*', '*OpenVPN*', '*WireGuard*', '*TAP*', + '*L2TP*', '*IKEv2*', '*RAS*', '*PPTP*', + # Consumer VPN vendors + '*NordVPN*', '*NordLynx*', '*ExpressVPN*', '*ProtonVPN*', '*Mullvad*', + # Enterprise VPN vendors + '*Cisco*', '*Pulse*', '*FortiClient*', + '*Palo Alto*', '*PANGP*', # Palo Alto GlobalProtect (no "VPN" in name!) + '*F5*', '*Checkpoint*', '*Check Point*', '*Sonicwall*', '*Juniper*', + # Tunnel adapters + '*Tunnel*', '*Teredo*', '*6to4*', '*ISATAP*', '*Loopback*' + ) + + # Layer 4: Check for active Windows VPN connections + $activeVpnConnections = @() + try { + $vpnConns = Get-VpnConnection -ErrorAction SilentlyContinue + $activeVpnConnections = $vpnConns | Where-Object { $_.ConnectionStatus -eq 'Connected' } + } + catch { + Write-Log -Level DEBUG -Message "Get-VpnConnection not available or failed: $_" -Module $script:ModuleName + } + + $filteredAdapters = @($adapters | Where-Object { + $description = $_.InterfaceDescription + $name = $_.Name + $skipAdapter = $false + $skipReason = "" + + # Check if adapter matches any virtual pattern + foreach ($pattern in $virtualPatterns) { + if ($description -like $pattern -or $name -like $pattern) { + $skipAdapter = $true + $skipReason = "Pattern match: $pattern" + break + } + } + + # Check if InterfaceType is Tunnel (131) + if (-not $skipAdapter -and $_.InterfaceType -eq 131) { + $skipAdapter = $true + $skipReason = "InterfaceType = 131 (Tunnel)" + } + + # Check MediaType for Tunnel + if (-not $skipAdapter -and $_.MediaType -match "Tunnel") { + $skipAdapter = $true + $skipReason = "MediaType contains 'Tunnel'" + } + + # Check for native Windows VPN connection + if (-not $skipAdapter -and $activeVpnConnections) { + $currentAdapterAlias = $_.InterfaceAlias + $matchingVpn = $activeVpnConnections | Where-Object { $_.InterfaceAlias -eq $currentAdapterAlias } + if ($matchingVpn) { + $skipAdapter = $true + $skipReason = "Native Windows VPN active: $($matchingVpn.Name)" + } + } + + if ($skipAdapter) { + Write-Log -Level DEBUG -Message "Excluding adapter: $name - $skipReason" -Module $script:ModuleName + } + + -not $skipAdapter + }) # Close @( array wrapper + + if ($filteredAdapters.Count -eq 0) { + Write-Log -Level WARNING -Message "No physical network adapters found" -Module $script:ModuleName + return @() + } + + Write-Log -Level DEBUG -Message "Found $($filteredAdapters.Count) physical network adapter(s)" -Module $script:ModuleName + + foreach ($adapter in $filteredAdapters) { + Write-Log -Level DEBUG -Message " - $($adapter.Name) ($($adapter.InterfaceDescription)) [Status: $($adapter.Status)]" -Module $script:ModuleName + } + + return $filteredAdapters # Already wrapped as array in line 83 + } + catch { + Write-ErrorLog -Message "Failed to retrieve physical network adapters" -Module $script:ModuleName -ErrorRecord $_ + return @() + } +} diff --git a/Modules/DNS/Private/Reset-DnsState.ps1 b/Modules/DNS/Private/Reset-DnsState.ps1 new file mode 100644 index 0000000..570797c --- /dev/null +++ b/Modules/DNS/Private/Reset-DnsState.ps1 @@ -0,0 +1,106 @@ +function Reset-DnsState { + <# + .SYNOPSIS + Cleans up ALL DoH entries from ALL known providers + .DESCRIPTION + Deletes all DoH registrations (Cloudflare, AdGuard, NextDNS, Quad9) + and removes per-adapter DoH registry keys to ensure clean state. + + CRITICAL: This prevents stale DoH entries from previous providers + from interfering with new provider settings. + .PARAMETER KeepAdapterDns + If specified, keeps current DNS server addresses on adapters. + Otherwise resets adapters to automatic DHCP DNS. + #> + [CmdletBinding()] + param( + [switch]$KeepAdapterDns + ) + + Write-Log -Level DEBUG -Message "Cleaning up DNS state (all providers)..." -Module "DNS" + + # 1. Clear network caches FIRST (remove stale mappings before any changes) + Write-Log -Level DEBUG -Message "Clearing DNS, ARP and NetBIOS caches..." -Module "DNS" + + # DNS cache + ipconfig /flushdns 2>$null | Out-Null + + # ARP cache (use netsh - more reliable than arp -d * on international Windows) + netsh interface ip delete arpcache 2>$null | Out-Null + + # NetBIOS name cache + nbtstat -R 2>$null | Out-Null + + # 2. Delete ALL known DoH server registrations + $allKnownIps = @( + # Cloudflare (Standard) + '1.1.1.1', '1.0.0.1', '2606:4700:4700::1111', '2606:4700:4700::1001', + # Cloudflare (Family - Malware blocking) + '1.1.1.2', '1.0.0.2', '2606:4700:4700::1112', '2606:4700:4700::1002', + # Cloudflare (Family - Malware + Adult blocking) + '1.1.1.3', '1.0.0.3', '2606:4700:4700::1113', '2606:4700:4700::1003', + # AdGuard + '94.140.14.14', '94.140.15.15', '2a10:50c0::ad1:ff', '2a10:50c0::ad2:ff', + # NextDNS + '45.90.28.0', '45.90.30.0', '2a07:a8c0::', '2a07:a8c1::', + # Quad9 + '9.9.9.9', '149.112.112.112', '2620:fe::fe', '2620:fe::9' + ) | Select-Object -Unique + + foreach ($ip in $allKnownIps) { + if ([string]::IsNullOrWhiteSpace($ip)) { continue } + try { + netsh dnsclient delete encryption server=$ip 2>$null | Out-Null + Write-Log -Level DEBUG -Message " Deleted DoH entry: $ip" -Module "DNS" + } + catch { + # Ignore - entry might not exist + $null = $null + } + } + + # 3. Clean per-adapter DoH registry keys (all GUIDs) + # CRITICAL: We clean these because Enable-DoH + manual DohFlags setting will recreate them + $basePath = 'HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters' + if (Test-Path $basePath) { + Get-ChildItem $basePath -ErrorAction SilentlyContinue | ForEach-Object { + $adapterPath = $_.PSPath + + # Remove DohInterfaceSettings (contains both Doh and Doh6 branches) + if (Test-Path "$adapterPath\DohInterfaceSettings") { + Remove-Item "$adapterPath\DohInterfaceSettings" -Recurse -Force -ErrorAction SilentlyContinue + Write-Log -Level DEBUG -Message " Cleaned DoH registry: $($_.PSChildName)" -Module "DNS" + } + } + } + + # 4. Optional: Reset adapters to automatic DHCP DNS + $adapterWasReset = $false + if (-not $KeepAdapterDns) { + Write-Log -Level DEBUG -Message "Resetting adapters to automatic DNS..." -Module "DNS" + $adaptersToReset = Get-DnsClient -ErrorAction SilentlyContinue | + Where-Object { $_.InterfaceOperationalStatus -eq 'Up' } + + foreach ($adapter in $adaptersToReset) { + try { + Set-DnsClientServerAddress -InterfaceAlias $adapter.InterfaceAlias ` + -ResetServerAddresses -ErrorAction Stop + Write-Log -Level DEBUG -Message " Reset: $($adapter.InterfaceAlias)" -Module "DNS" + $adapterWasReset = $true + } + catch { + Write-Log -Level DEBUG -Message " Failed to reset: $($adapter.InterfaceAlias)" -Module "DNS" + } + } + } + + # 5. Clear caches AGAIN if adapter was reset (DHCP may have created new cache entries) + if ($adapterWasReset) { + Write-Log -Level DEBUG -Message "Clearing caches again after adapter reset..." -Module "DNS" + ipconfig /flushdns 2>$null | Out-Null + netsh interface ip delete arpcache 2>$null | Out-Null + nbtstat -R 2>$null | Out-Null + } + + Write-Log -Level DEBUG -Message "DNS state cleanup complete" -Module $script:ModuleName +} diff --git a/Modules/DNS/Private/Set-DNSServers.ps1 b/Modules/DNS/Private/Set-DNSServers.ps1 new file mode 100644 index 0000000..84c2c81 --- /dev/null +++ b/Modules/DNS/Private/Set-DNSServers.ps1 @@ -0,0 +1,183 @@ +function Set-DNSServers { + <# + .SYNOPSIS + Set DNS server addresses on network adapter + + .DESCRIPTION + Configures DNS server addresses (IPv4 and IPv6) on specified network adapter. + Uses Microsoft Best Practice: Set-DnsClientServerAddress with -Validate parameter. + + Always configures both IPv4 and IPv6 addresses. Windows will use IPv6 when available, + and fall back to IPv4 otherwise. + + .PARAMETER InterfaceIndex + Network adapter interface index + + .PARAMETER IPv4Primary + Primary IPv4 DNS server address + + .PARAMETER IPv4Secondary + Secondary IPv4 DNS server address + + .PARAMETER IPv6Primary + Primary IPv6 DNS server address + + .PARAMETER IPv6Secondary + Secondary IPv6 DNS server address + + .PARAMETER Validate + Validate DNS servers are reachable before applying (recommended) + + .PARAMETER DryRun + Show what would be configured without applying changes + + .EXAMPLE + Set-DNSServers -InterfaceIndex 12 -IPv4Primary "1.1.1.1" -IPv4Secondary "1.0.0.1" ` + -IPv6Primary "2606:4700:4700::1111" -IPv6Secondary "2606:4700:4700::1001" -Validate + + .OUTPUTS + System.Boolean - $true if successful, $false otherwise + + .NOTES + Uses Set-DnsClientServerAddress cmdlet (PowerShell Best Practice) + NEVER uses netsh (deprecated legacy method) + #> + + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [int]$InterfaceIndex, + + [Parameter(Mandatory = $true)] + [string]$IPv4Primary, + + [Parameter(Mandatory = $true)] + [string]$IPv4Secondary, + + [Parameter(Mandatory = $true)] + [string]$IPv6Primary, + + [Parameter(Mandatory = $true)] + [string]$IPv6Secondary, + + [Parameter()] + [switch]$Validate, + + [Parameter()] + [switch]$DryRun + ) + + try { + $adapter = Get-NetAdapter -InterfaceIndex $InterfaceIndex -ErrorAction Stop + $adapterName = $adapter.Name + + Write-Log -Level INFO -Message "Configuring DNS servers on adapter: $adapterName" -Module $script:ModuleName + + # Prepare IPv4 addresses array + $ipv4Addresses = @($IPv4Primary, $IPv4Secondary) + + # Prepare IPv6 addresses array + $ipv6Addresses = @($IPv6Primary, $IPv6Secondary) + + Write-Log -Level DEBUG -Message " IPv4: $($ipv4Addresses -join ', ')" -Module $script:ModuleName + Write-Log -Level DEBUG -Message " IPv6: $($ipv6Addresses -join ', ')" -Module $script:ModuleName + + if ($DryRun) { + Write-Log -Level INFO -Message "[DRYRUN] Would configure DNS servers on $adapterName" -Module $script:ModuleName + return $true + } + + # Configure IPv4 DNS servers with retry logic (fixes 0x80004005 errors) + Write-Log -Level DEBUG -Message "Setting IPv4 DNS servers..." -Module $script:ModuleName + + $ipv4Params = @{ + InterfaceIndex = $InterfaceIndex + ServerAddresses = $ipv4Addresses + ErrorAction = 'Stop' + } + + if ($Validate) { + $ipv4Params['Validate'] = $true + Write-Log -Level DEBUG -Message "Validation enabled for IPv4 DNS servers" -Module $script:ModuleName + } + + # Retry logic with fast retries (adapter stabilization or offline detection) + $maxRetries = 3 + $retryDelay = 1 # Fast 1-second retries (no exponential backoff needed) + + for ($attempt = 1; $attempt -le $maxRetries; $attempt++) { + try { + Set-DnsClientServerAddress @ipv4Params + Write-Log -Level SUCCESS -Message "IPv4 DNS servers configured: $($ipv4Addresses -join ', ')" -Module $script:ModuleName + break + } + catch { + if ($attempt -lt $maxRetries) { + Write-Log -Level DEBUG -Message "Attempt $attempt failed, retrying... ($($_.Exception.Message))" -Module $script:ModuleName + Start-Sleep -Seconds $retryDelay + } + else { + # Fallback to netsh if CIM fails (General Error fix - often happens when offline) + Write-Log -Level DEBUG -Message "PowerShell cmdlet failed, using netsh fallback..." -Module $script:ModuleName + + try { + # Use netsh for IPv4 configuration + $netshResult = & netsh interface ip set dns name="$adapterName" source=static address=$IPv4Primary validate=no 2>&1 + + if ($LASTEXITCODE -eq 0) { + # Add secondary DNS + $null = & netsh interface ip add dns name="$adapterName" address=$IPv4Secondary index=2 validate=no 2>&1 + + Write-Log -Level SUCCESS -Message "IPv4 DNS configured via netsh fallback: $($ipv4Addresses -join ', ')" -Module $script:ModuleName + break # Success, exit retry loop + } + else { + throw "Netsh fallback also failed: $netshResult" + } + } + catch { + throw "All DNS configuration methods failed: $_" + } + } + } + } + + # Configure IPv6 DNS servers + # Note: IPv6 configuration uses the same cmdlet with IPv6 addresses + Write-Log -Level DEBUG -Message "Setting IPv6 DNS servers..." -Module $script:ModuleName + + # For IPv6, we need to configure it separately + # Get the IPv6 interface + $ipv6Interface = Get-NetAdapter -InterfaceIndex $InterfaceIndex | + Get-NetAdapterBinding -ComponentID ms_tcpip6 -ErrorAction SilentlyContinue + + if ($ipv6Interface -and $ipv6Interface.Enabled) { + try { + # Set IPv6 DNS using netsh as PowerShell cmdlet doesn't support dual-stack properly + # NOTE: This is one of the few cases where netsh is still needed for IPv6 + $primaryResult = & netsh interface ipv6 set dnsservers name="$adapterName" source=static address=$IPv6Primary validate=no 2>&1 + $secondaryResult = & netsh interface ipv6 add dnsservers name="$adapterName" address=$IPv6Secondary index=2 validate=no 2>&1 + + if ($LASTEXITCODE -eq 0) { + Write-Log -Level SUCCESS -Message "IPv6 DNS servers configured: $($ipv6Addresses -join ', ')" -Module $script:ModuleName + } + else { + Write-Log -Level WARNING -Message "IPv6 DNS configuration had issues (non-fatal): $primaryResult $secondaryResult" -Module $script:ModuleName + } + } + catch { + Write-Log -Level WARNING -Message "Could not configure IPv6 DNS (non-fatal): $_" -Module $script:ModuleName + } + } + else { + Write-Log -Level INFO -Message "IPv6 binding is disabled on this adapter - skipping IPv6 DNS server assignment (IPv4 + DoH templates will still be used)" -Module $script:ModuleName + } + + # Configuration complete - Windows cmdlets verify automatically + return $true + } + catch { + Write-ErrorLog -Message "Failed to set DNS servers on interface $InterfaceIndex" -Module $script:ModuleName -ErrorRecord $_ + return $false + } +} diff --git a/Modules/DNS/Private/Set-DoHPolicy.ps1 b/Modules/DNS/Private/Set-DoHPolicy.ps1 new file mode 100644 index 0000000..d3f9761 --- /dev/null +++ b/Modules/DNS/Private/Set-DoHPolicy.ps1 @@ -0,0 +1,113 @@ +function Set-DoHPolicy { + <# + .SYNOPSIS + Enforce DNS-over-HTTPS (DoH) system-wide according to the selected mode + + .DESCRIPTION + Sets Windows registry keys to enforce DoH policy based on $script:DoHMode: + - DoHPolicy = 3 (REQUIRE DoH - mandatory encryption, no fallback) + - DoHPolicy = 2 (ALLOW DoH - encryption preferred, fallback to UDP allowed) + - EnableAutoDoh = 2 (Enable automatic DoH upgrade) + - netsh global doh = yes + + DoHPolicy values: 0=Default, 1=Prohibit, 2=Allow, 3=Require + + In REQUIRE mode this prevents Windows from silently falling back to + unencrypted DNS on port 53. In ALLOW mode, encrypted DoH is still used + for supported servers, but fallback to classic DNS is permitted for + VPN/mobile/enterprise scenarios. + + .PARAMETER DryRun + Show what would be configured without applying changes + + .EXAMPLE + Set-DoHPolicy + + .NOTES + Requires Administrator privileges + Based on Microsoft DNS Client documentation + #> + + [CmdletBinding()] + param( + [Parameter()] + [switch]$DryRun + ) + + try { + # Determine DoH mode (REQUIRE or ALLOW) + $dohModeValue = if ($script:DoHMode -eq "ALLOW") { 2 } else { 3 } + $dohModeText = if ($script:DoHMode -eq "ALLOW") { "ALLOW (with fallback)" } else { "REQUIRE (no fallback)" } + + Write-Log -Level INFO -Message "Enforcing DoH policy ($dohModeText)" -Module $script:ModuleName + + if ($DryRun) { + Write-Log -Level INFO -Message "[DRYRUN] Would set DoH policy to $dohModeText" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] DoHPolicy = $dohModeValue ($($script:DoHMode))" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] EnableAutoDoh = 2 (enforce)" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] DohFlags = 1 (use DoH)" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] netsh global doh = yes" -Module $script:ModuleName + return $true + } + + # Registry path for DNS Client settings + $dnsClientPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" + $dnsParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" + + # Ensure policy path exists + if (-not (Test-Path $dnsClientPath)) { + New-Item -Path $dnsClientPath -Force | Out-Null + Write-Log -Level DEBUG -Message "Created registry path: $dnsClientPath" -Module $script:ModuleName + } + + # CRITICAL ORDER: netsh FIRST (may reset registry values), then Registry entries AFTER + # This ensures Registry values persist and are not overwritten by netsh + + # 1. FIRST: Activate DoH globally via netsh (this may reset EnableAutoDoh!) + try { + netsh dnsclient set global doh=yes 2>&1 | Out-Null + + if ($LASTEXITCODE -eq 0) { + Write-Log -Level DEBUG -Message "netsh global DoH activated" -Module $script:ModuleName + } + else { + Write-Log -Level WARNING -Message "netsh global DoH returned exit code $LASTEXITCODE" -Module $script:ModuleName + } + } + catch { + Write-Log -Level WARNING -Message "Could not activate global DoH via netsh: $_" -Module $script:ModuleName + } + + # 2. SECOND: EnableAutoDoh = 2 (Enable automatic DoH) - AFTER netsh! + if (-not (Test-Path $dnsParamsPath)) { + New-Item -Path $dnsParamsPath -Force | Out-Null + } + $existing = Get-ItemProperty -Path $dnsParamsPath -Name "EnableAutoDoh" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $dnsParamsPath -Name "EnableAutoDoh" -Value 2 -Force | Out-Null + } else { + New-ItemProperty -Path $dnsParamsPath -Name "EnableAutoDoh" -Value 2 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level SUCCESS -Message "Set EnableAutoDoh = 2 (Automatic DoH enabled)" -Module $script:ModuleName + + # 3. THIRD: DoHPolicy = 2 (ALLOW) or 3 (REQUIRE) - LAST for highest priority + # Values: 0=Default, 1=Prohibit, 2=Allow, 3=Require + $existing = Get-ItemProperty -Path $dnsClientPath -Name "DoHPolicy" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $dnsClientPath -Name "DoHPolicy" -Value $dohModeValue -Force | Out-Null + } else { + New-ItemProperty -Path $dnsClientPath -Name "DoHPolicy" -Value $dohModeValue -PropertyType DWord -Force | Out-Null + } + Write-Log -Level SUCCESS -Message "Set DoHPolicy = $dohModeValue ($dohModeText)" -Module $script:ModuleName + + # NOTE: Global DohFlags removed - we use per-adapter DohFlags instead (set in Invoke-DNSConfiguration) + # Per-adapter DohFlags are more reliable and prevent conflicts + + Write-Log -Level SUCCESS -Message "DoH policy verified: $dohModeText" -Module $script:ModuleName + return $true + } + catch { + Write-ErrorLog -Message "Failed to set DoH policy" -Module $script:ModuleName -ErrorRecord $_ + return $false + } +} diff --git a/Modules/DNS/Private/Test-DNSConnectivity.ps1 b/Modules/DNS/Private/Test-DNSConnectivity.ps1 new file mode 100644 index 0000000..cd8d67c --- /dev/null +++ b/Modules/DNS/Private/Test-DNSConnectivity.ps1 @@ -0,0 +1,117 @@ +function Test-DNSConnectivity { + <# + .SYNOPSIS + Test DNS server connectivity and resolution + + .DESCRIPTION + Validates that DNS servers are: + 1. Reachable on port 53 (UDP/TCP) + 2. Able to resolve domain names + 3. Responding with valid answers + + Tests both IPv4 and IPv6 connectivity if applicable. + + .PARAMETER ServerAddress + DNS server IP address to test + + .PARAMETER TestDomain + Domain name to use for resolution test (default: microsoft.com) + + .EXAMPLE + Test-DNSConnectivity -ServerAddress "1.1.1.1" + + .EXAMPLE + Test-DNSConnectivity -ServerAddress "2606:4700:4700::1111" -TestDomain "google.com" + + .OUTPUTS + PSCustomObject with test results + + .NOTES + Uses Test-NetConnection for reachability + Uses Resolve-DnsName for resolution testing + #> + + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$ServerAddress, + + [Parameter()] + [string]$TestDomain = "microsoft.com" + ) + + $result = [PSCustomObject]@{ + ServerAddress = $ServerAddress + Reachable = $false + CanResolve = $false + ResponseTime = $null + ErrorMessage = $null + } + + try { + Write-Log -Level DEBUG -Message "Testing DNS connectivity: $ServerAddress" -Module $script:ModuleName + + # Test 1: Port 53 reachability (fast TCP check without noisy Test-NetConnection output) + Write-Log -Level DEBUG -Message " Testing port 53 reachability (TCP)..." -Module $script:ModuleName + + $portTest = $false + try { + $tcpClient = New-Object System.Net.Sockets.TcpClient + try { + $async = $tcpClient.BeginConnect($ServerAddress, 53, $null, $null) + # Wait up to 3 seconds for TCP connect + if ($async.AsyncWaitHandle.WaitOne(3000, $false) -and $tcpClient.Connected) { + $portTest = $true + } + } + finally { + $tcpClient.Close() + } + } + catch { + $portTest = $false + } + + if ($portTest) { + $result.Reachable = $true + Write-Log -Level DEBUG -Message " Port 53: Reachable" -Module $script:ModuleName + } + else { + $result.ErrorMessage = "Port 53 not reachable (system may be offline)" + Write-Log -Level DEBUG -Message " Port 53: NOT reachable (system may be offline)" -Module $script:ModuleName + return $result + } + + # Test 2: DNS resolution + Write-Log -Level DEBUG -Message " Testing DNS resolution for $TestDomain..." -Module $script:ModuleName + + $resolveStart = Get-Date + $dnsResult = Resolve-DnsName -Name $TestDomain -Server $ServerAddress -DnsOnly -ErrorAction Stop + $resolveEnd = Get-Date + + $result.ResponseTime = ($resolveEnd - $resolveStart).TotalMilliseconds + + if ($dnsResult -and $dnsResult.Count -gt 0) { + $result.CanResolve = $true + Write-Log -Level DEBUG -Message " DNS resolution: OK ($([math]::Round($result.ResponseTime, 2))ms)" -Module $script:ModuleName + } + else { + $result.ErrorMessage = "No DNS response received" + Write-Log -Level WARNING -Message " DNS resolution: FAILED (no response)" -Module $script:ModuleName + } + } + catch { + $result.ErrorMessage = $_.Exception.Message + Write-Log -Level WARNING -Message " Connectivity test failed: $($_.Exception.Message)" -Module $script:ModuleName + } + + # Log summary + if ($result.Reachable -and $result.CanResolve) { + Write-Log -Level SUCCESS -Message "DNS server $ServerAddress is functional" -Module $script:ModuleName + } + else { + Write-Log -Level WARNING -Message "DNS server $ServerAddress has issues: $($result.ErrorMessage)" -Module $script:ModuleName + } + + return $result +} diff --git a/Modules/DNS/Public/Get-DNSStatus.ps1 b/Modules/DNS/Public/Get-DNSStatus.ps1 new file mode 100644 index 0000000..1abee72 --- /dev/null +++ b/Modules/DNS/Public/Get-DNSStatus.ps1 @@ -0,0 +1,197 @@ +function Get-DNSStatus { + <# + .SYNOPSIS + Get current DNS configuration status + + .DESCRIPTION + Retrieves and displays current DNS configuration for all physical network adapters: + - DNS server addresses (IPv4 and IPv6) + - DNS over HTTPS (DoH) status + - DHCP vs Static configuration + - Adapter status + + .PARAMETER Detailed + Show detailed information including DoH templates and provider ratings + + .EXAMPLE + Get-DNSStatus + Display current DNS configuration + + .EXAMPLE + Get-DNSStatus -Detailed + Display detailed DNS configuration with DoH information + + .OUTPUTS + PSCustomObject with DNS configuration status + + .NOTES + Non-intrusive status check - does not modify configuration + #> + + [CmdletBinding()] + param( + [Parameter()] + [switch]$Detailed + ) + + try { + $moduleName = "DNS" + + Write-Log -Level INFO -Message " " -Module $moduleName + Write-Log -Level INFO -Message "========================================" -Module $moduleName + Write-Log -Level INFO -Message "DNS STATUS CHECK" -Module $moduleName + Write-Log -Level INFO -Message "========================================" -Module $moduleName + Write-Log -Level INFO -Message " " -Module $moduleName + + # Load provider configuration for identification + $configPath = Join-Path $PSScriptRoot "..\Config\Providers.json" + $providersConfig = $null + + if (Test-Path $configPath) { + $providersConfig = Get-Content -Path $configPath -Raw | ConvertFrom-Json + } + + # Get physical adapters + $adapters = @(Get-PhysicalAdapters -IncludeDisabled) # Force array + + if ($adapters.Count -eq 0) { + Write-Log -Level WARNING -Message "No physical network adapters found" -Module $moduleName + return $null + } + + Write-Log -Level INFO -Message "Found $($adapters.Count) physical network adapter(s)" -Module $moduleName + Write-Log -Level INFO -Message " " -Module $moduleName + + $statusResults = @() + + foreach ($adapter in $adapters) { + Write-Log -Level INFO -Message "Adapter: $($adapter.Name)" -Module $moduleName + Write-Log -Level INFO -Message " Description: $($adapter.InterfaceDescription)" -Module $moduleName + Write-Log -Level INFO -Message " Status: $($adapter.Status)" -Module $moduleName + + # Get DNS configuration + $dnsConfig = Get-DnsClientServerAddress -InterfaceIndex $adapter.InterfaceIndex -ErrorAction SilentlyContinue + + $ipv4Addresses = @() + $ipv6Addresses = @() + $isDHCP = $false + + foreach ($config in $dnsConfig) { + if ($config.AddressFamily -eq 2) { # IPv4 + if ($config.ServerAddresses.Count -eq 0) { + $isDHCP = $true + } + else { + $ipv4Addresses = $config.ServerAddresses + } + } + elseif ($config.AddressFamily -eq 23) { # IPv6 + if ($config.ServerAddresses.Count -gt 0) { + # Filter out DHCP placeholder addresses + $ipv6Addresses = $config.ServerAddresses | Where-Object { + $_ -notlike "fec0:0:0:ffff*" + } + } + } + } + + # Determine configuration type + $configType = if ($isDHCP) { "DHCP" } else { "Static" } + Write-Log -Level INFO -Message " Configuration: $configType" -Module $moduleName + + # Display IPv4 + if ($ipv4Addresses.Count -gt 0) { + Write-Log -Level INFO -Message " IPv4 DNS Servers:" -Module $moduleName + foreach ($ipv4 in $ipv4Addresses) { + Write-Log -Level INFO -Message " - $ipv4" -Module $moduleName + } + + # Try to identify provider + if ($providersConfig) { + $identifiedProvider = $null + foreach ($providerProp in $providersConfig.providers.PSObject.Properties) { + $provider = $providerProp.Value + if ($ipv4Addresses -contains $provider.ipv4.primary) { + $identifiedProvider = $provider.name + break + } + } + + if ($identifiedProvider) { + Write-Log -Level INFO -Message " Detected Provider: $identifiedProvider" -Module $moduleName + } + } + } + else { + Write-Log -Level INFO -Message " IPv4 DNS Servers: None configured (using DHCP)" -Module $moduleName + } + + # Display IPv6 + if ($ipv6Addresses.Count -gt 0) { + Write-Log -Level INFO -Message " IPv6 DNS Servers:" -Module $moduleName + foreach ($ipv6 in $ipv6Addresses) { + Write-Log -Level INFO -Message " - $ipv6" -Module $moduleName + } + } + else { + Write-Log -Level INFO -Message " IPv6 DNS Servers: None configured" -Module $moduleName + } + + # Check DoH status + $dohServers = @() + try { + $allDohServers = Get-DnsClientDohServerAddress -ErrorAction SilentlyContinue + if ($allDohServers) { + foreach ($dohServer in $allDohServers) { + if ($ipv4Addresses -contains $dohServer.ServerAddress) { + $dohServers += $dohServer + } + } + } + } + catch { + # DoH not supported or not configured + $null = $null + } + + if ($dohServers.Count -gt 0) { + Write-Log -Level SUCCESS -Message " DNS over HTTPS (DoH): ENABLED" -Module $moduleName + + if ($Detailed) { + foreach ($doh in $dohServers) { + Write-Log -Level INFO -Message " Server: $($doh.ServerAddress)" -Module $moduleName + Write-Log -Level INFO -Message " Template: $($doh.DohTemplate)" -Module $moduleName + Write-Log -Level INFO -Message " Fallback to UDP: $($doh.AllowFallbackToUdp)" -Module $moduleName + Write-Log -Level INFO -Message " Auto-upgrade: $($doh.AutoUpgrade)" -Module $moduleName + } + } + } + else { + Write-Log -Level WARNING -Message " DNS over HTTPS (DoH): DISABLED" -Module $moduleName + } + + Write-Log -Level INFO -Message " " -Module $moduleName + + # Add to results + $statusResults += [PSCustomObject]@{ + AdapterName = $adapter.Name + AdapterDescription = $adapter.InterfaceDescription + Status = $adapter.Status + ConfigurationType = $configType + IPv4Addresses = $ipv4Addresses + IPv6Addresses = $ipv6Addresses + DoHEnabled = ($dohServers.Count -gt 0) + DoHServers = $dohServers + } + } + + Write-Log -Level INFO -Message "========================================" -Module $moduleName + Write-Log -Level INFO -Message " " -Module $moduleName + + return $statusResults + } + catch { + Write-ErrorLog -Message "Failed to retrieve DNS status" -Module "DNS" -ErrorRecord $_ + return $null + } +} diff --git a/Modules/DNS/Public/Invoke-DNSConfiguration.ps1 b/Modules/DNS/Public/Invoke-DNSConfiguration.ps1 new file mode 100644 index 0000000..9242b09 --- /dev/null +++ b/Modules/DNS/Public/Invoke-DNSConfiguration.ps1 @@ -0,0 +1,722 @@ +function Get-CurrentDNSProvider { + <# + .SYNOPSIS + Detect the current DNS provider based on configured DNS servers + #> + [CmdletBinding()] + param() + + try { + # Get DNS servers from active adapters + $adapters = Get-NetAdapter -Physical | Where-Object { $_.Status -eq 'Up' } + foreach ($adapter in $adapters) { + $dnsServers = Get-DnsClientServerAddress -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 -ErrorAction SilentlyContinue + if ($dnsServers -and $dnsServers.ServerAddresses) { + $primaryDNS = $dnsServers.ServerAddresses | Select-Object -First 1 + + # Match against known providers + switch -Regex ($primaryDNS) { + '^1\.1\.1\.' { return "Cloudflare" } + '^1\.0\.0\.' { return "Cloudflare" } + '^9\.9\.9\.' { return "Quad9" } + '^149\.112\.' { return "Quad9" } + '^94\.140\.14\.' { return "AdGuard" } + '^94\.140\.15\.' { return "AdGuard" } + } + } + } + return $null # Could not detect provider + } + catch { + Write-Log -Level WARNING -Message "Failed to detect current DNS provider: $_" -Module "DNS" + return $null + } +} + +function Invoke-DNSConfiguration { + <# + .SYNOPSIS + Configure secure DNS with DNS over HTTPS (DoH) + + .DESCRIPTION + Configures secure DNS on all physical network adapters with: + - DNS server addresses (IPv4 and IPv6) + - DNS over HTTPS (DoH) encryption + - Automatic backup for rollback + + Supports three DNS providers: + - Quad9: Security-focused, Swiss privacy (default) + - Cloudflare: Fastest resolver, privacy-focused + - AdGuard: Ad/tracker blocking, EU jurisdiction + + All providers perform server-side DNSSEC validation. + + .PARAMETER Provider + DNS provider to use: Quad9, Cloudflare, or AdGuard (default: Quad9) + + .PARAMETER DryRun + Show what would be configured without applying changes + + .PARAMETER Force + Skip connectivity tests and apply configuration anyway + + .EXAMPLE + Invoke-DNSConfiguration + Configure Quad9 DNS (default, security-focused) on all adapters + + .EXAMPLE + Invoke-DNSConfiguration -Provider Cloudflare + Configure Cloudflare DNS (fastest) on all adapters + + .EXAMPLE + Invoke-DNSConfiguration -Provider AdGuard -DryRun + Test AdGuard DNS (ad-blocking) configuration without applying + + .OUTPUTS + PSCustomObject with configuration results + + .NOTES + Requires Administrator privileges + Creates automatic backup for rollback + Uses PowerShell Best Practice cmdlets (not netsh) + #> + + [CmdletBinding()] + param( + [Parameter()] + [ValidateSet('Cloudflare', 'Quad9', 'AdGuard', 'KEEP')] + [string]$Provider, + + [Parameter()] + [switch]$DryRun, + + [Parameter()] + [switch]$Force + ) + + begin { + $moduleName = "DNS" + $startTime = Get-Date + + # Core/Rollback.ps1 is loaded by Framework.ps1 - DO NOT load again here + # Loading it twice would reset $script:BackupBasePath and break the backup system! + + # Provider selection - NonInteractive or Interactive + if (-not $Provider) { + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - use config values + $Provider = Get-NonInteractiveValue -Module "DNS" -Key "provider" -Default "Quad9" + $script:DoHMode = Get-NonInteractiveValue -Module "DNS" -Key "dohMode" -Default "REQUIRE" + + # Handle "KEEP" provider - detect current DNS and preserve it + if ($Provider -eq "KEEP") { + $detectedProvider = Get-CurrentDNSProvider + if ($detectedProvider) { + $Provider = $detectedProvider + Write-Log -Level INFO -Message "KEEP mode: Detected current provider as $Provider" -Module $moduleName + } else { + $Provider = "Quad9" + Write-Log -Level WARNING -Message "KEEP mode: Could not detect provider, defaulting to Quad9" -Module $moduleName + } + } + + Write-NonInteractiveDecision -Module $moduleName -Decision "DNS Provider" -Value $Provider + Write-NonInteractiveDecision -Module $moduleName -Decision "DoH Mode" -Value $script:DoHMode + } + else { + # Interactive mode + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host " DNS PROVIDER SELECTION" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + + Write-Host "[1] Quad9 (9.9.9.9) - RECOMMENDED FOR SECURITY" -ForegroundColor Green + Write-Host " PRIMARY STRENGTH: Security + Privacy (Malware Blocking)" -ForegroundColor Cyan + Write-Host " Speed 4/5 | Privacy 5/5 | Security 5/5 | Filtering 4/5" -ForegroundColor Gray + Write-Host " - Blocks malware/phishing domains automatically" -ForegroundColor Gray + Write-Host " - Swiss jurisdiction (strongest privacy laws)" -ForegroundColor Gray + Write-Host "" + + Write-Host "[2] Cloudflare (1.1.1.1) - RECOMMENDED FOR SPEED" -ForegroundColor Yellow + Write-Host " PRIMARY STRENGTH: Speed (Fastest Resolver)" -ForegroundColor Cyan + Write-Host " Speed 5/5 | Privacy 4/5 | Security 4/5 | Filtering 2/5" -ForegroundColor Gray + Write-Host " - Global performance leader" -ForegroundColor Gray + Write-Host " - Minimal logging (25h anonymized)" -ForegroundColor Gray + Write-Host "" + + Write-Host "[3] AdGuard DNS (94.140.14.14) - RECOMMENDED FOR AD-BLOCKING" -ForegroundColor Yellow + Write-Host " PRIMARY STRENGTH: Ad-Blocking + Tracker Protection" -ForegroundColor Cyan + Write-Host " Speed 4/5 | Privacy 4/5 | Security 4/5 | Filtering 5/5" -ForegroundColor Gray + Write-Host " - Blocks ads and trackers at DNS level" -ForegroundColor Gray + Write-Host " - Family-friendly options available" -ForegroundColor Gray + Write-Host "" + + Write-Host "[0] Skip DNS configuration" -ForegroundColor Gray + Write-Host " Keep current system DNS" -ForegroundColor Gray + Write-Host "" + + do { + $selection = Read-Host "Select provider [1-3, 0=Skip, default: 1]" + if ([string]::IsNullOrWhiteSpace($selection)) { $selection = "1" } + + if ($selection -notin @('0', '1', '2', '3')) { + Write-Host "" + Write-Host "Invalid input. Please enter 0, 1, 2, or 3." -ForegroundColor Red + Write-Host "" + } + } while ($selection -notin @('0', '1', '2', '3')) + + $Provider = switch ($selection) { + "1" { "Quad9" } + "2" { "Cloudflare" } + "3" { "AdGuard" } + "0" { $null } + } + + if ($null -eq $Provider) { + Write-Host "" + Write-Host "DNS configuration skipped" -ForegroundColor Gray + Write-Host "" + return [PSCustomObject]@{ + Success = $true + Provider = "Skipped" + AdaptersConfigured = 0 + DoHEnabled = $false + BackupCreated = $false + Errors = @() + Warnings = @("DNS configuration skipped by user") + Duration = (Get-Date) - $startTime + } + } + + Write-Host "" + Write-Host "Selected: $Provider" -ForegroundColor Green + Write-Host "" + Write-Log -Level DEBUG -Message "User selected DNS provider: $Provider" -Module $moduleName + + # DoH Mode Selection (REQUIRE vs ALLOW) + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host " DNS-over-HTTPS (DoH) MODE" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + Write-Host "Choose DoH encryption mode:" -ForegroundColor White + Write-Host "" + + Write-Host "[1] REQUIRE Mode (Recommended)" -ForegroundColor Green + Write-Host " - Maximum security: NO unencrypted fallback" -ForegroundColor Gray + Write-Host " - Best for: Home networks, single-location systems" -ForegroundColor Gray + Write-Host " - Warning: May break in corporate networks or captive portals" -ForegroundColor Yellow + Write-Host "" + + Write-Host "[2] ALLOW Mode (Mobile/Enterprise/VPN)" -ForegroundColor Yellow + Write-Host " - Balanced: Falls back to UDP if DoH unavailable" -ForegroundColor Gray + Write-Host " - Best for: VPN users, mobile devices, enterprise networks" -ForegroundColor Gray + Write-Host " - Warning: Less secure (unencrypted fallback possible)" -ForegroundColor Yellow + Write-Host "" + + do { + $dohSelection = Read-Host "Select DoH mode [1/2, default: 1]" + if ([string]::IsNullOrWhiteSpace($dohSelection)) { $dohSelection = "1" } + + if ($dohSelection -notin @('1', '2')) { + Write-Host "" + Write-Host "Invalid input. Please enter 1 or 2." -ForegroundColor Red + Write-Host "" + } + } while ($dohSelection -notin @('1', '2')) + + $script:DoHMode = switch ($dohSelection) { + "1" { "REQUIRE" } + "2" { "ALLOW" } + } + + Write-Host "" + if ($script:DoHMode -eq "REQUIRE") { + Write-Host "DoH Mode: REQUIRE (Maximum Security)" -ForegroundColor Green + } + else { + Write-Host "DoH Mode: ALLOW (Mobile/Enterprise Compatible)" -ForegroundColor Yellow + } + Write-Host "" + Write-Log -Level DEBUG -Message "User selected DoH mode: $script:DoHMode" -Module $moduleName + } + } + else { + # Provider specified via parameter - handle KEEP and get DoHMode + if ($Provider -eq "KEEP") { + # Detect current DNS provider and preserve it (only used by GUI) + $detectedProvider = Get-CurrentDNSProvider + if ($detectedProvider) { + $Provider = $detectedProvider + Write-Log -Level INFO -Message "KEEP mode: Detected current provider as $Provider" -Module $moduleName + } else { + $Provider = "Quad9" + Write-Log -Level WARNING -Message "KEEP mode: Could not detect provider, defaulting to Quad9" -Module $moduleName + } + } + + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - read DoHMode from config + $script:DoHMode = Get-NonInteractiveValue -Module "DNS" -Key "dohMode" -Default "REQUIRE" + Write-NonInteractiveDecision -Module $moduleName -Decision "DNS Provider" -Value $Provider + Write-NonInteractiveDecision -Module $moduleName -Decision "DoH Mode" -Value $script:DoHMode + } + else { + # Interactive CLI - default to REQUIRE when Provider is passed directly + $script:DoHMode = "REQUIRE" + } + } + + # Initialize Session-based backup system + $moduleBackupPath = $null + if (-not $DryRun) { + try { + Initialize-BackupSystem + $moduleBackupPath = Start-ModuleBackup -ModuleName "DNS" + Write-Log -Level INFO -Message "Session backup initialized: $moduleBackupPath" -Module $moduleName + } + catch { + Write-Log -Level WARNING -Message "Failed to initialize backup system: $_" -Module $moduleName + Write-Log -Level WARNING -Message "Continuing without backup (RISKY!)" -Module $moduleName + } + } + else { + Write-Log -Level INFO -Message "Skipping backup initialization (DryRun mode)" -Module $moduleName + } + + # Initialize result object + $result = [PSCustomObject]@{ + Success = $false + Provider = $Provider + AdaptersConfigured = 0 + DoHEnabled = $false + BackupCreated = $false + VerificationPassed = $false + Errors = @() + Warnings = @() + Duration = $null + } + + Write-Log -Level INFO -Message " " -Module $moduleName + Write-Log -Level INFO -Message "========================================" -Module $moduleName + Write-Log -Level INFO -Message "DNS CONFIGURATION" -Module $moduleName + Write-Log -Level INFO -Message "========================================" -Module $moduleName + Write-Log -Level INFO -Message "Provider: $Provider" -Module $moduleName + Write-Log -Level INFO -Message "Mode: $(if ($DryRun) { 'DRY RUN' } else { 'APPLY' })" -Module $moduleName + Write-Log -Level INFO -Message " " -Module $moduleName + } + + process { + try { + # Load provider configuration + $configPath = Join-Path $PSScriptRoot "..\Config\Providers.json" + + if (-not (Test-Path $configPath)) { + throw "Provider configuration file not found: $configPath" + } + + $providersConfig = Get-Content -Path $configPath -Raw | ConvertFrom-Json + $providerKey = $Provider.ToLower() + $providerConfig = $providersConfig.providers.$providerKey + + if (-not $providerConfig) { + throw "Provider configuration not found for: $Provider" + } + + # Display provider information + Write-Log -Level INFO -Message "DNS PROVIDER DETAILS:" -Module $moduleName + Write-Log -Level INFO -Message " Name: $($providerConfig.name)" -Module $moduleName + Write-Log -Level INFO -Message " Description: $($providerConfig.description)" -Module $moduleName + Write-Log -Level INFO -Message " Best for: $($providerConfig.best_for)" -Module $moduleName + Write-Log -Level INFO -Message " " -Module $moduleName + Write-Log -Level INFO -Message " RATINGS:" -Module $moduleName + Write-Log -Level INFO -Message " Speed: $($providerConfig.ratings.speed)/5" -Module $moduleName + Write-Log -Level INFO -Message " Privacy: $($providerConfig.ratings.privacy)/5" -Module $moduleName + Write-Log -Level INFO -Message " Security: $($providerConfig.ratings.security)/5" -Module $moduleName + Write-Log -Level INFO -Message " Filtering: $($providerConfig.ratings.filtering)/5" -Module $moduleName + Write-Log -Level INFO -Message " " -Module $moduleName + Write-Log -Level INFO -Message " FEATURES:" -Module $moduleName + foreach ($feature in $providerConfig.features) { + Write-Log -Level INFO -Message " - $feature" -Module $moduleName + } + Write-Log -Level INFO -Message " " -Module $moduleName + Write-Log -Level INFO -Message " Jurisdiction: $($providerConfig.jurisdiction)" -Module $moduleName + Write-Log -Level INFO -Message " " -Module $moduleName + + # Quick connectivity test (unless forced or dry-run) + if (-not $Force -and -not $DryRun) { + Write-Log -Level INFO -Message "Testing DNS connectivity (quick check)..." -Module $moduleName + + $primaryTest = Test-DNSConnectivity -ServerAddress $providerConfig.ipv4.primary + + if (-not $primaryTest.Reachable) { + # Non-fatal: TCP port 53 not reachable (may be firewall or VPN), but UDP DNS usually works + $result.Warnings += "DNS pre-check skipped (TCP 53 not reachable) - configuration will proceed" + Write-Log -Level INFO -Message "DNS connectivity pre-check failed (TCP 53 blocked or timeout) - this is often normal with firewalls/VPNs. DNS will be configured anyway." -Module $moduleName + } + elseif (-not $primaryTest.CanResolve) { + # Can reach DNS but cannot resolve - still non-fatal + Write-Log -Level INFO -Message "DNS server reachable, configuration will proceed" -Module $moduleName + } + else { + # All good + Write-Log -Level SUCCESS -Message "DNS connectivity verified" -Module $moduleName + } + + Write-Log -Level INFO -Message " " -Module $moduleName + } + + # CRITICAL FIX: Create backup BEFORE cleaning DNS state + # Bug: Reset-DnsState deletes DoH/Policy entries, so backup must happen first + # to capture the actual pre-apply state (not the cleaned state) + if (-not $DryRun) { + Write-Log -Level INFO -Message "Creating backup of current DNS settings..." -Module $moduleName + + $backupFile = Backup-DNSSettings + + if ($backupFile) { + # Register backup in session manifest + Complete-ModuleBackup -ItemsBackedUp 1 -Status "Success" + + $result.BackupCreated = $true + Write-Log -Level SUCCESS -Message "Backup created successfully" -Module $moduleName + } + else { + $result.Warnings += "Could not create backup" + Write-Log -Level WARNING -Message "Backup creation failed - continuing without backup" -Module $moduleName + } + + Write-Log -Level INFO -Message " " -Module $moduleName + } + + # CRITICAL: Clean ALL previous DNS state (prevents interference from old providers/VPNs) + if (-not $DryRun) { + Write-Log -Level INFO -Message "Cleaning up previous DNS state..." -Module $moduleName + Reset-DnsState -KeepAdapterDns + + # Wait for adapter state to stabilize after cleanup (prevents 0x80004005 errors) + Start-Sleep -Seconds 3 + } + else { + Write-Log -Level INFO -Message "[DRY RUN] Skipping DNS state cleanup (Reset-DnsState)" -Module $moduleName + } + + # Get physical adapters (aggressive VPN/VM filtering) + $adapters = @(Get-PhysicalAdapters) # Force array to ensure .Count works + + if ($adapters.Count -eq 0) { + # No physical adapters found - skip gracefully (VM or unusual config) + Write-Host "" + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " DNS Module Skipped" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "No physical network adapters found." -ForegroundColor Cyan + Write-Host "" + Write-Host "This can happen in:" -ForegroundColor Yellow + Write-Host " - Virtual machines with unusual network config" -ForegroundColor Gray + Write-Host " - Systems with all adapters disabled" -ForegroundColor Gray + Write-Host " - Enterprise environments with special setups" -ForegroundColor Gray + Write-Host "" + Write-Host "This is NOT an error - DNS configuration will be skipped." -ForegroundColor Green + Write-Host "" + + Write-Log -Level WARNING -Message "DNS skipped: No physical network adapters found" -Module $moduleName + + $result.Success = $true # Not an error - intentional skip + $result.Warnings += "DNS skipped: No physical network adapters found. Check adapter configuration if this is unexpected." + + return $result + } + + Write-Log -Level INFO -Message "Configuring $($adapters.Count) network adapter(s)" -Module $moduleName + Write-Log -Level INFO -Message " " -Module $moduleName + + # GLOBAL DOH ENFORCEMENT (before per-adapter config) + # This ensures Windows GUI shows "Encrypted" and forces DoH globally + # CRITICAL ORDER: netsh FIRST (may reset EnableAutoDoh), then Registry AFTER + if (-not $DryRun -and $providerConfig.doh.supported) { + Write-Log -Level INFO -Message "Enabling global DoH enforcement..." -Module $moduleName + + try { + $dnsParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" + + # 1. FIRST: Set global DoH via netsh (this may reset EnableAutoDoh!) + $netshResult = netsh dnsclient set global doh=yes 2>&1 + if ($LASTEXITCODE -eq 0) { + Write-Log -Level DEBUG -Message " netsh global DoH enabled" -Module $moduleName + } + else { + Write-Log -Level DEBUG -Message " netsh global DoH: $netshResult (exit code: $LASTEXITCODE)" -Module $moduleName + } + + # 2. SECOND: Set EnableAutoDoh = 2 AFTER netsh (so it persists!) + if (-not (Test-Path $dnsParamsPath)) { + New-Item -Path $dnsParamsPath -Force | Out-Null + } + + $existing = Get-ItemProperty -Path $dnsParamsPath -Name "EnableAutoDoh" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $dnsParamsPath -Name "EnableAutoDoh" -Value 2 -Force | Out-Null + } + else { + New-ItemProperty -Path $dnsParamsPath -Name "EnableAutoDoh" -Value 2 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message " EnableAutoDoh = 2 (Force encrypted DNS)" -Module $moduleName + + Write-Log -Level SUCCESS -Message "Global DoH enforcement enabled" -Module $moduleName + } + catch { + Write-Log -Level WARNING -Message "Could not enable global DoH enforcement: $_" -Module $moduleName + $result.Warnings += "Global DoH enforcement failed (non-critical)" + } + + Write-Log -Level INFO -Message " " -Module $moduleName + } + + # Configure each adapter + Write-Log -Level INFO -Message "Configuring DNS servers..." -Module $moduleName + Write-Log -Level INFO -Message " " -Module $moduleName + + $configuredCount = 0 + $dohSuccessCount = 0 + + foreach ($adapter in $adapters) { + Write-Log -Level INFO -Message "Configuring adapter: $($adapter.Name)" -Module $moduleName + + # Set DNS servers (IPv4 + IPv6) + $dnsResult = Set-DNSServers -InterfaceIndex $adapter.InterfaceIndex ` + -IPv4Primary $providerConfig.ipv4.primary ` + -IPv4Secondary $providerConfig.ipv4.secondary ` + -IPv6Primary $providerConfig.ipv6.primary ` + -IPv6Secondary $providerConfig.ipv6.secondary ` + -Validate:(-not $Force) ` + -DryRun:$DryRun + + if ($dnsResult) { + $configuredCount++ + Write-Log -Level SUCCESS -Message "DNS servers configured on $($adapter.Name)" -Module $moduleName + + # Enable DoH for IPv4 and IPv6 addresses so ALL queries are encrypted + if (-not $DryRun -and $providerConfig.doh.supported) { + Write-Log -Level DEBUG -Message "Enabling DoH (IPv4 + IPv6)..." -Module $moduleName + + # Register DoH endpoints for IPv4 servers + $dohPrimaryV4 = Enable-DoH -ServerAddress $providerConfig.ipv4.primary ` + -DohTemplate $providerConfig.doh.template + $dohSecondaryV4 = Enable-DoH -ServerAddress $providerConfig.ipv4.secondary ` + -DohTemplate $providerConfig.doh.template + + # Register DoH endpoints for IPv6 servers (Windows supports DoH for IPv6 as well) + $dohPrimaryV6 = Enable-DoH -ServerAddress $providerConfig.ipv6.primary ` + -DohTemplate $providerConfig.doh.template + $dohSecondaryV6 = Enable-DoH -ServerAddress $providerConfig.ipv6.secondary ` + -DohTemplate $providerConfig.doh.template + + if ($dohPrimaryV4 -and $dohSecondaryV4 -and $dohPrimaryV6 -and $dohSecondaryV6) { + Write-Log -Level SUCCESS -Message "DoH enabled on $($adapter.Name) for IPv4 and IPv6" -Module $moduleName + + # TRICK #4: IPv6-FIRST HACK to force Windows DoH validation + # Windows needs to see IPv6 servers first to recognize them as DoH-capable + try { + # Check if adapter has IPv6 enabled + $ipv6Binding = Get-NetAdapterBinding -InterfaceAlias $adapter.Name ` + -ComponentID ms_tcpip6 -ErrorAction SilentlyContinue + $ipv6Enabled = $ipv6Binding -and $ipv6Binding.Enabled + + if ($ipv6Enabled) { + Write-Log -Level DEBUG -Message "IPv6-First hack: Setting IPv6 servers first..." -Module $moduleName + + # Temporarily set IPv6 FIRST + $ipv6Servers = @($providerConfig.ipv6.primary, $providerConfig.ipv6.secondary) + $ipv4Servers = @($providerConfig.ipv4.primary, $providerConfig.ipv4.secondary) + + Set-DnsClientServerAddress -InterfaceAlias $adapter.Name ` + -ServerAddresses ($ipv6Servers + $ipv4Servers) -ErrorAction Stop + + # Wait for Windows to validate IPv6 DoH + Write-Log -Level DEBUG -Message "Waiting 5 seconds for IPv6 DoH validation..." -Module $moduleName + Start-Sleep -Seconds 5 + + # Reset to IPv4-first (faster for most users) + Write-Log -Level DEBUG -Message "Resetting DNS order (IPv4 first for speed)..." -Module $moduleName + Set-DnsClientServerAddress -InterfaceAlias $adapter.Name ` + -ServerAddresses ($ipv4Servers + $ipv6Servers) -ErrorAction Stop + } + } + catch { + Write-Log -Level DEBUG -Message "IPv6-First hack failed (non-critical): $_" -Module $moduleName + } + + # TRICK #5: Set DohFlags registry keys (ENCRYPTED ONLY!) + # This is what makes Windows GUI show "Encrypted" instead of "Unencrypted" + Write-Log -Level DEBUG -Message "Setting DoH encryption flags (DohFlags)..." -Module $moduleName + + try { + $adapterGuid = $adapter.InterfaceGuid + + # IPv4 Servers -> Doh branch + foreach ($ip in @($providerConfig.ipv4.primary, $providerConfig.ipv4.secondary)) { + try { + $regPath = "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$adapterGuid\DohInterfaceSettings\Doh\$ip" + if (-not (Test-Path $regPath)) { + New-Item -Path $regPath -Force -ErrorAction Stop | Out-Null + } + New-ItemProperty -Path $regPath -Name 'DohFlags' -Value 1 -PropertyType QWord -Force -ErrorAction Stop | Out-Null + Write-Log -Level DEBUG -Message " DohFlags set: $ip (Encrypted Only)" -Module $moduleName + } + catch { + Write-Log -Level DEBUG -Message " Failed to set DohFlags for $ip : $_" -Module $moduleName + } + } + + # IPv6 Servers -> Doh6 branch (DIFFERENT from IPv4!) + foreach ($ip in @($providerConfig.ipv6.primary, $providerConfig.ipv6.secondary)) { + try { + $basePath = "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$adapterGuid\DohInterfaceSettings\Doh6" + $ipPath = "$basePath\$ip" + + if (-not (Test-Path $basePath)) { + New-Item -Path $basePath -Force -ErrorAction Stop | Out-Null + } + + if (-not (Test-Path $ipPath)) { + New-Item -Path $ipPath -Force -ErrorAction Stop | Out-Null + } + + New-ItemProperty -Path $ipPath -Name 'DohFlags' -Value 1 -PropertyType QWord -Force -ErrorAction Stop | Out-Null + Write-Log -Level DEBUG -Message " DohFlags set: $ip (Encrypted Only, Doh6)" -Module $moduleName + } + catch { + Write-Log -Level DEBUG -Message " Failed to set DohFlags for $ip : $_" -Module $moduleName + } + } + + $dohSuccessCount++ + Write-Log -Level SUCCESS -Message "DoH encryption enforced on $($adapter.Name) (all servers, DohFlags set)" -Module $moduleName + } + catch { + $result.Warnings += "DoH flags could not be set on $($adapter.Name) - DNS may not show as encrypted in UI" + Write-Log -Level WARNING -Message "DoH flags configuration had issues on $($adapter.Name)" -Module $moduleName + } + + # DHCP DNS Override Protection + if (-not $DryRun) { + $dhcpDisabled = Disable-DHCPDnsOverride -InterfaceIndex $adapter.InterfaceIndex -DryRun:$false + if (-not $dhcpDisabled) { + $result.Warnings += "Could not disable DHCP DNS override on $($adapter.Name)" + } + } + else { + Write-Log -Level INFO -Message "[DRY RUN] Skipping DHCP DNS override protection on $($adapter.Name)" -Module $moduleName + } + } + else { + $result.Warnings += "DoH could not be enabled on $($adapter.Name)" + Write-Log -Level WARNING -Message "DoH configuration had issues on $($adapter.Name)" -Module $moduleName + } + } + } + else { + $result.Errors += "Failed to configure $($adapter.Name)" + Write-Log -Level ERROR -Message "Failed to configure $($adapter.Name)" -Module $moduleName + } + + Write-Log -Level INFO -Message " " -Module $moduleName + } + + # CRITICAL: Set global DoH policy according to selected mode (REQUIRE or ALLOW) + if (-not $DryRun -and $dohSuccessCount -gt 0) { + $modeDescription = if ($script:DoHMode -eq "ALLOW") { "ALLOW mode (fallback permitted)" } else { "REQUIRE mode (no fallback)" } + Write-Log -Level INFO -Message "Enforcing global DoH policy ($modeDescription)..." -Module $moduleName + $policySet = Set-DoHPolicy + if ($policySet) { + $successDesc = if ($script:DoHMode -eq "ALLOW") { "Global DoH policy: ALLOW mode active (fallback allowed by design)" } else { "Global DoH policy: REQUIRE mode active (no unencrypted fallback)" } + Write-Log -Level SUCCESS -Message $successDesc -Module $moduleName + } + else { + $result.Warnings += "Could not set global DoH policy - DoH may fall back to unencrypted" + } + } + + $result.AdaptersConfigured = $configuredCount + $result.DoHEnabled = ($dohSuccessCount -gt 0) + + # Final status + if ($configuredCount -eq $adapters.Count) { + $result.Success = $true + Write-Log -Level SUCCESS -Message "DNS configuration completed successfully" -Module $moduleName + Write-Log -Level INFO -Message "Configured $configuredCount of $($adapters.Count) adapter(s)" -Module $moduleName + + if ($result.DoHEnabled) { + Write-Log -Level SUCCESS -Message "DNS over HTTPS (DoH) is active - DNS queries are encrypted" -Module $moduleName + } + } + else { + Write-Log -Level WARNING -Message "DNS configuration completed with errors" -Module $moduleName + Write-Log -Level WARNING -Message "Configured $configuredCount of $($adapters.Count) adapter(s)" -Module $moduleName + } + + # Mark verification as passed (individual functions already verified) + if (-not $DryRun -and $result.Success) { + $result.VerificationPassed = $true + } + } + catch { + $result.Success = $false + $result.Errors += $_.Exception.Message + Write-ErrorLog -Message "DNS configuration failed" -Module $moduleName -ErrorRecord $_ + } + } + + end { + $result.Duration = (Get-Date) - $startTime + + # Flush DNS cache for immediate effect (only on success) + if ($result.Success -and -not $DryRun) { + Write-Log -Level INFO -Message "Flushing DNS resolver cache for immediate effect..." -Module $moduleName + try { + Clear-DnsClientCache -ErrorAction Stop + Write-Log -Level SUCCESS -Message "DNS cache cleared successfully" -Module $moduleName + } + catch { + Write-Log -Level WARNING -Message "Could not flush DNS cache: $_" -Module $moduleName + # Non-critical: continue anyway + } + } + + Write-Log -Level INFO -Message " " -Module $moduleName + Write-Log -Level INFO -Message "========================================" -Module $moduleName + Write-Log -Level INFO -Message "CONFIGURATION SUMMARY" -Module $moduleName + Write-Log -Level INFO -Message "========================================" -Module $moduleName + Write-Log -Level INFO -Message "Provider: $($result.Provider)" -Module $moduleName + Write-Log -Level INFO -Message "Adapters configured: $($result.AdaptersConfigured)" -Module $moduleName + Write-Log -Level INFO -Message "DoH enabled: $(if ($result.DoHEnabled) { 'Yes' } else { 'No' })" -Module $moduleName + Write-Log -Level INFO -Message "Backup created: $(if ($result.BackupCreated) { 'Yes' } else { 'No' })" -Module $moduleName + Write-Log -Level INFO -Message "Duration: $([math]::Round($result.Duration.TotalSeconds, 2)) seconds" -Module $moduleName + + if ($result.Warnings.Count -gt 0) { + Write-Log -Level INFO -Message "Warnings: $($result.Warnings.Count)" -Module $moduleName + foreach ($warn in $result.Warnings) { + Write-Log -Level INFO -Message " Warning: $warn" -Module $moduleName + } + } + + if ($result.Errors.Count -gt 0) { + Write-Log -Level INFO -Message "Errors: $($result.Errors.Count)" -Module $moduleName + foreach ($err in $result.Errors) { + Write-Log -Level ERROR -Message " Error: $err" -Module $moduleName + } + } + + Write-Log -Level INFO -Message "========================================" -Module $moduleName + Write-Log -Level INFO -Message " " -Module $moduleName + + # GUI parsing marker for settings count + Write-Log -Level SUCCESS -Message "Applied 5 settings" -Module $moduleName + + return $result + } +} diff --git a/Modules/DNS/Public/Restore-DNSSettings.ps1 b/Modules/DNS/Public/Restore-DNSSettings.ps1 new file mode 100644 index 0000000..1467bfb --- /dev/null +++ b/Modules/DNS/Public/Restore-DNSSettings.ps1 @@ -0,0 +1,501 @@ +function Restore-DNSSettings { + <# + .SYNOPSIS + Restore DNS settings from backup + + .DESCRIPTION + Restores DNS configuration from backup file including: + - DNS server addresses (IPv4 and IPv6) + - DHCP configuration (if applicable) + - DoH configuration removal + + CRITICAL: Properly handles DHCP vs static DNS restoration. + + .PARAMETER BackupFilePath + Path to backup file created by Backup-DNSSettings + + .PARAMETER DryRun + Show what would be restored without applying changes + + .EXAMPLE + Restore-DNSSettings -BackupFilePath "C:\Rollback\DNS_20250116_030000.json" + + .OUTPUTS + System.Boolean - $true if successful, $false otherwise + + .NOTES + Uses Set-DnsClientServerAddress with -ResetServerAddresses for DHCP restore + Uses Remove-DnsClientDohServerAddress to clean up DoH configuration + #> + + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$BackupFilePath, + + [Parameter()] + [switch]$DryRun + ) + + try { + if (-not (Test-Path $BackupFilePath)) { + Write-Log -Level ERROR -Message "Backup file not found: $BackupFilePath" -Module $script:ModuleName + return $false + } + + Write-Log -Level INFO -Message "Restoring DNS settings from backup..." -Module $script:ModuleName + + # Load backup data + $backupJson = Get-Content -Path $BackupFilePath -Raw -ErrorAction Stop + $backupData = $backupJson | ConvertFrom-Json + + Write-Log -Level INFO -Message "Backup from: $($backupData.Timestamp)" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "Restoring $($backupData.Adapters.Count) adapter(s)" -Module $script:ModuleName + + # First: Clean all current netsh DoH entries + if (-not $DryRun) { + Write-Log -Level DEBUG -Message "Cleaning current netsh DoH entries..." -Module $script:ModuleName + try { + # Get all current DoH entries + $currentDohServers = Get-DnsClientDohServerAddress -ErrorAction SilentlyContinue + foreach ($dohServer in $currentDohServers) { + try { + # Remove via netsh (more reliable than PowerShell cmdlet) + netsh dnsclient delete encryption server=$($dohServer.ServerAddress) 2>&1 | Out-Null + Write-Log -Level DEBUG -Message " Removed netsh DoH entry: $($dohServer.ServerAddress)" -Module $script:ModuleName + } + catch { + Write-Log -Level DEBUG -Message " Could not remove netsh DoH entry: $($dohServer.ServerAddress)" -Module $script:ModuleName + } + } + } + catch { + Write-Log -Level DEBUG -Message "Could not clean netsh DoH entries: $_" -Module $script:ModuleName + } + + # Clean all current DohFlags registry entries (both Doh and Doh6) + Write-Log -Level DEBUG -Message "Cleaning current DohFlags registry entries..." -Module $script:ModuleName + try { + $dohFlagsBasePath = "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters" + if (Test-Path $dohFlagsBasePath) { + Get-ChildItem $dohFlagsBasePath -ErrorAction SilentlyContinue | ForEach-Object { + $adapterPath = $_.PSPath + + # Remove entire DohInterfaceSettings (contains both Doh and Doh6 branches) + if (Test-Path "$adapterPath\DohInterfaceSettings") { + Remove-Item "$adapterPath\DohInterfaceSettings" -Recurse -Force -ErrorAction SilentlyContinue + Write-Log -Level DEBUG -Message " Cleaned DohInterfaceSettings for adapter: $($_.PSChildName)" -Module $script:ModuleName + } + } + } + } + catch { + Write-Log -Level DEBUG -Message "Could not clean DohFlags entries: $_" -Module $script:ModuleName + } + } + + # Restore DoH Policy Registry settings + if ($backupData.DohPolicySettings -and $backupData.DohPolicySettings.Count -gt 0) { + if ($DryRun) { + Write-Log -Level INFO -Message "[DRYRUN] Would restore $($backupData.DohPolicySettings.Count) DoH policy settings" -Module $script:ModuleName + } + else { + Write-Log -Level DEBUG -Message "Restoring DoH policy settings..." -Module $script:ModuleName + + try { + # Restore DoHPolicy + if ($backupData.DohPolicySettings.ContainsKey('DoHPolicy')) { + $dnsClientPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" + if (-not (Test-Path $dnsClientPath)) { + New-Item -Path $dnsClientPath -Force | Out-Null + } + $existing = Get-ItemProperty -Path $dnsClientPath -Name "DoHPolicy" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $dnsClientPath -Name "DoHPolicy" -Value $backupData.DohPolicySettings['DoHPolicy'] -Force + } else { + New-ItemProperty -Path $dnsClientPath -Name "DoHPolicy" -Value $backupData.DohPolicySettings['DoHPolicy'] -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message " Restored DoHPolicy = $($backupData.DohPolicySettings['DoHPolicy'])" -Module $script:ModuleName + } + else { + # Remove DoHPolicy if it wasn't set before + $dnsClientPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" + if (Test-Path $dnsClientPath) { + Remove-ItemProperty -Path $dnsClientPath -Name "DoHPolicy" -ErrorAction SilentlyContinue + Write-Log -Level DEBUG -Message " Removed DoHPolicy (was not set in backup)" -Module $script:ModuleName + + # CLEANUP: Remove key if empty (created by us) + $keyContent = Get-ChildItem $dnsClientPath -ErrorAction SilentlyContinue + $keyProps = Get-ItemProperty $dnsClientPath -ErrorAction SilentlyContinue + # Count properties (exclude PS metadata like PSPath, etc.) + $propCount = ($keyProps.PSObject.Properties | Where-Object { $_.Name -notin @('PSPath','PSParentPath','PSChildName','PSDrive','PSProvider') }).Count + + if (($null -eq $keyContent -or $keyContent.Count -eq 0) -and $propCount -eq 0) { + Remove-Item $dnsClientPath -Force -ErrorAction SilentlyContinue + Write-Log -Level DEBUG -Message " Removed empty registry key: $dnsClientPath" -Module $script:ModuleName + } + } + } + + # Restore EnableAutoDoh + if ($backupData.DohPolicySettings.ContainsKey('EnableAutoDoh')) { + $dnsParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" + $existing = Get-ItemProperty -Path $dnsParamsPath -Name "EnableAutoDoh" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $dnsParamsPath -Name "EnableAutoDoh" -Value $backupData.DohPolicySettings['EnableAutoDoh'] -Force + } else { + New-ItemProperty -Path $dnsParamsPath -Name "EnableAutoDoh" -Value $backupData.DohPolicySettings['EnableAutoDoh'] -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message " Restored EnableAutoDoh = $($backupData.DohPolicySettings['EnableAutoDoh'])" -Module $script:ModuleName + } + else { + # Remove EnableAutoDoh if it wasn't set before + $dnsParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" + Remove-ItemProperty -Path $dnsParamsPath -Name "EnableAutoDoh" -ErrorAction SilentlyContinue + Write-Log -Level DEBUG -Message " Removed EnableAutoDoh (was not set in backup)" -Module $script:ModuleName + + # CLEANUP: Remove key if empty (unlikely for Parameters, but safe to check) + if (Test-Path $dnsParamsPath) { + $keyContent = Get-ChildItem $dnsParamsPath -ErrorAction SilentlyContinue + $keyProps = Get-ItemProperty $dnsParamsPath -ErrorAction SilentlyContinue + $propCount = ($keyProps.PSObject.Properties | Where-Object { $_.Name -notin @('PSPath','PSParentPath','PSChildName','PSDrive','PSProvider') }).Count + + if (($null -eq $keyContent -or $keyContent.Count -eq 0) -and $propCount -eq 0) { + Remove-Item $dnsParamsPath -Force -ErrorAction SilentlyContinue + Write-Log -Level DEBUG -Message " Removed empty registry key: $dnsParamsPath" -Module $script:ModuleName + } + } + } + + # Restore DohFlags (global) + if ($backupData.DohPolicySettings.ContainsKey('DohFlags')) { + $dnsParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" + $existing = Get-ItemProperty -Path $dnsParamsPath -Name "DohFlags" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $dnsParamsPath -Name "DohFlags" -Value $backupData.DohPolicySettings['DohFlags'] -Force + } else { + New-ItemProperty -Path $dnsParamsPath -Name "DohFlags" -Value $backupData.DohPolicySettings['DohFlags'] -PropertyType DWord -Force | Out-Null + } + Write-Log -Level DEBUG -Message " Restored DohFlags (global) = $($backupData.DohPolicySettings['DohFlags'])" -Module $script:ModuleName + } + else { + # Remove DohFlags if it wasn't set before + $dnsParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" + Remove-ItemProperty -Path $dnsParamsPath -Name "DohFlags" -ErrorAction SilentlyContinue + Write-Log -Level DEBUG -Message " Removed DohFlags (global) (was not set in backup)" -Module $script:ModuleName + } + } + catch { + Write-Log -Level WARNING -Message "Could not restore DoH policy settings: $_" -Module $script:ModuleName + } + } + } + else { + # No DoH policy settings in backup - remove them + if (-not $DryRun) { + Write-Log -Level DEBUG -Message "No DoH policy settings in backup - removing current settings" -Module $script:ModuleName + try { + $dnsClientPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" + if (Test-Path $dnsClientPath) { + Remove-ItemProperty -Path $dnsClientPath -Name "DoHPolicy" -ErrorAction SilentlyContinue + } + $dnsParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" + Remove-ItemProperty -Path $dnsParamsPath -Name "EnableAutoDoh" -ErrorAction SilentlyContinue + Remove-ItemProperty -Path $dnsParamsPath -Name "DohFlags" -ErrorAction SilentlyContinue + } + catch { + Write-Log -Level DEBUG -Message "Could not remove DoH policy settings: $_" -Module $script:ModuleName + } + } + } + + # Restore netsh global DoH state + if ($backupData.NetshGlobalDoh) { + if ($DryRun) { + Write-Log -Level INFO -Message "[DRYRUN] Would restore netsh global DoH: $($backupData.NetshGlobalDoh)" -Module $script:ModuleName + } + else { + Write-Log -Level DEBUG -Message "Restoring netsh global DoH state: $($backupData.NetshGlobalDoh)" -Module $script:ModuleName + try { + netsh dnsclient set global doh=$($backupData.NetshGlobalDoh) 2>&1 | Out-Null + Write-Log -Level DEBUG -Message " netsh global DoH restored" -Module $script:ModuleName + } + catch { + Write-Log -Level WARNING -Message "Could not restore netsh global DoH: $_" -Module $script:ModuleName + } + } + } + else { + # If no global DoH state in backup, it means it wasn't configured or we couldn't read it. + # Since we enable it in Apply, we should disable it here to be safe. + if (-not $DryRun) { + Write-Log -Level DEBUG -Message "No global DoH state in backup - resetting to default (doh=no)" -Module $script:ModuleName + try { + netsh dnsclient set global doh=no 2>&1 | Out-Null + Write-Log -Level DEBUG -Message " netsh global DoH reset to 'no'" -Module $script:ModuleName + } + catch { + Write-Log -Level WARNING -Message "Could not reset netsh global DoH: $_" -Module $script:ModuleName + } + } + } + + # Restore netsh DoH entries + if ($backupData.DohEntries -and $backupData.DohEntries.Count -gt 0) { + if ($DryRun) { + Write-Log -Level INFO -Message "[DRYRUN] Would restore $($backupData.DohEntries.Count) DoH entries from snapshot" -Module $script:ModuleName + } + else { + Write-Log -Level DEBUG -Message "Restoring $($backupData.DohEntries.Count) DoH entries from snapshot..." -Module $script:ModuleName + foreach ($entry in $backupData.DohEntries) { + $server = $entry.ServerAddress + $template = $entry.DohTemplate + if (-not $server -or -not $template) { + continue + } + try { + try { + Add-DnsClientDohServerAddress -ServerAddress $server ` + -DohTemplate $template ` + -AllowFallbackToUdp ([bool]$entry.AllowFallbackToUdp) ` + -AutoUpgrade ([bool]$entry.AutoUpgrade) ` + -ErrorAction Stop + } + catch { + Write-Log -Level DEBUG -Message " Add-DnsClientDohServerAddress failed for ${server}: $_" -Module $script:ModuleName + } + + $udpFallback = if ($entry.AllowFallbackToUdp) { 'yes' } else { 'no' } + $autoupgrade = if ($entry.AutoUpgrade) { 'yes' } else { 'no' } + + netsh dnsclient add encryption ` + server=$server ` + dohtemplate=$template ` + autoupgrade=$autoupgrade ` + udpfallback=$udpFallback 2>&1 | Out-Null + + Write-Log -Level DEBUG -Message " Restored DoH entry: $server" -Module $script:ModuleName + } + catch { + Write-Log -Level WARNING -Message "Could not restore DoH entry for ${server}: $_" -Module $script:ModuleName + } + } + } + } + elseif ($backupData.NetshDohEntries -and $backupData.NetshDohEntries.Count -gt 0) { + if ($DryRun) { + Write-Log -Level INFO -Message "[DRYRUN] Would restore $($backupData.NetshDohEntries.Count) netsh DoH entries" -Module $script:ModuleName + } + else { + Write-Log -Level DEBUG -Message "Restoring $($backupData.NetshDohEntries.Count) netsh DoH entries..." -Module $script:ModuleName + foreach ($entry in $backupData.NetshDohEntries) { + try { + $autoupgrade = if ($entry.AutoUpgrade -eq 'yes') { 'yes' } else { 'no' } + $udpfallback = if ($entry.UdpFallback -eq 'yes') { 'yes' } else { 'no' } + + netsh dnsclient add encryption ` + server=$($entry.Server) ` + dohtemplate=$($entry.Template) ` + autoupgrade=$autoupgrade ` + udpfallback=$udpfallback 2>&1 | Out-Null + + Write-Log -Level DEBUG -Message " Restored netsh DoH: $($entry.Server)" -Module $script:ModuleName + } + catch { + Write-Log -Level WARNING -Message "Could not restore netsh DoH for $($entry.Server): $_" -Module $script:ModuleName + } + } + } + } + + $success = $true + + foreach ($adapterBackup in $backupData.Adapters) { + $adapterName = $adapterBackup.InterfaceAlias + $interfaceIndex = $adapterBackup.InterfaceIndex + + Write-Log -Level INFO -Message "Restoring adapter: $adapterName" -Module $script:ModuleName + + # Verify adapter still exists + $adapter = Get-NetAdapter -InterfaceIndex $interfaceIndex -ErrorAction SilentlyContinue + if (-not $adapter) { + Write-Log -Level WARNING -Message " Adapter no longer exists - skipping" -Module $script:ModuleName + continue + } + + if ($DryRun) { + if ($adapterBackup.IsDHCP) { + Write-Log -Level INFO -Message "[DRYRUN] Would reset $adapterName to DHCP" -Module $script:ModuleName + } + else { + Write-Log -Level INFO -Message "[DRYRUN] Would restore static DNS on $adapterName" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] IPv4: $($adapterBackup.IPv4Addresses -join ', ')" -Module $script:ModuleName + Write-Log -Level DEBUG -Message "[DRYRUN] IPv6: $($adapterBackup.IPv6Addresses -join ', ')" -Module $script:ModuleName + if ($adapterBackup.DohFlags -and $adapterBackup.DohFlags.Count -gt 0) { + Write-Log -Level DEBUG -Message "[DRYRUN] DohFlags: $($adapterBackup.DohFlags.Count) registry entries" -Module $script:ModuleName + } + if ($null -ne $adapterBackup.DhcpOverrideDisabled) { + $overrideStatus = if ($adapterBackup.DhcpOverrideDisabled) { "disabled" } else { "enabled" } + Write-Log -Level DEBUG -Message "[DRYRUN] DHCP Override: $overrideStatus" -Module $script:ModuleName + } + } + continue + } + + # Remove DoH configuration first (if any) + if ($adapterBackup.DoHConfiguration.Count -gt 0) { + Write-Log -Level DEBUG -Message " Removing DoH configuration..." -Module $script:ModuleName + + foreach ($dohConfig in $adapterBackup.DoHConfiguration) { + try { + Remove-DnsClientDohServerAddress -ServerAddress $dohConfig.ServerAddress -ErrorAction SilentlyContinue + Write-Log -Level DEBUG -Message " Removed DoH for $($dohConfig.ServerAddress)" -Module $script:ModuleName + } + catch { + Write-Log -Level DEBUG -Message " Could not remove DoH for $($dohConfig.ServerAddress): $_" -Module $script:ModuleName + } + } + } + + # Restore DNS configuration + if ($adapterBackup.IsDHCP) { + # Reset to DHCP + Write-Log -Level INFO -Message " Resetting to DHCP..." -Module $script:ModuleName + + try { + Set-DnsClientServerAddress -InterfaceIndex $interfaceIndex -ResetServerAddresses -ErrorAction Stop + Write-Log -Level SUCCESS -Message " DNS reset to DHCP successfully" -Module $script:ModuleName + } + catch { + Write-Log -Level ERROR -Message " Failed to reset to DHCP: $_" -Module $script:ModuleName + $success = $false + } + } + else { + # Restore static DNS + Write-Log -Level INFO -Message " Restoring static DNS..." -Module $script:ModuleName + + # Restore IPv4 + if ($adapterBackup.IPv4Addresses.Count -gt 0) { + try { + Set-DnsClientServerAddress -InterfaceIndex $interfaceIndex ` + -ServerAddresses $adapterBackup.IPv4Addresses ` + -ErrorAction Stop + Write-Log -Level SUCCESS -Message " IPv4 DNS restored: $($adapterBackup.IPv4Addresses -join ', ')" -Module $script:ModuleName + } + catch { + Write-Log -Level ERROR -Message " Failed to restore IPv4 DNS: $_" -Module $script:ModuleName + $success = $false + } + } + + # Restore IPv6 (if was configured) + if ($adapterBackup.IPv6Addresses.Count -gt 0) { + try { + # Use netsh for IPv6 (PowerShell cmdlet limitation) + $primaryIPv6 = $adapterBackup.IPv6Addresses[0] + & netsh interface ipv6 set dnsservers name="$adapterName" source=static address=$primaryIPv6 validate=no 2>&1 | Out-Null + + if ($adapterBackup.IPv6Addresses.Count -gt 1) { + $secondaryIPv6 = $adapterBackup.IPv6Addresses[1] + & netsh interface ipv6 add dnsservers name="$adapterName" address=$secondaryIPv6 index=2 validate=no 2>&1 | Out-Null + } + + Write-Log -Level SUCCESS -Message " IPv6 DNS restored: $($adapterBackup.IPv6Addresses -join ', ')" -Module $script:ModuleName + } + catch { + Write-Log -Level WARNING -Message " Could not restore IPv6 DNS (non-fatal): $_" -Module $script:ModuleName + } + } + + # Restore DoH configuration (if was configured) + if ($adapterBackup.DoHConfiguration.Count -gt 0) { + Write-Log -Level DEBUG -Message " Restoring DoH configuration..." -Module $script:ModuleName + + foreach ($dohConfig in $adapterBackup.DoHConfiguration) { + try { + Add-DnsClientDohServerAddress -ServerAddress $dohConfig.ServerAddress ` + -DohTemplate $dohConfig.DohTemplate ` + -AllowFallbackToUdp $dohConfig.AllowFallbackToUdp ` + -AutoUpgrade $dohConfig.AutoUpgrade ` + -ErrorAction Stop + Write-Log -Level DEBUG -Message " Restored DoH for $($dohConfig.ServerAddress)" -Module $script:ModuleName + } + catch { + Write-Log -Level DEBUG -Message " Could not restore DoH for $($dohConfig.ServerAddress): $_" -Module $script:ModuleName + } + } + } + + # Restore DohFlags registry settings (if was configured) + if ($adapterBackup.DohFlags -and $adapterBackup.DohFlags.Count -gt 0) { + Write-Log -Level DEBUG -Message " Restoring DohFlags registry settings..." -Module $script:ModuleName + + $interfaceGuid = $adapterBackup.InterfaceGuid + if (-not $interfaceGuid) { + # Fallback: get current GUID + $currentAdapter = Get-NetAdapter -InterfaceIndex $interfaceIndex -ErrorAction SilentlyContinue + $interfaceGuid = $currentAdapter.InterfaceGuid + } + + if ($interfaceGuid) { + foreach ($dnsIP in $adapterBackup.DohFlags.Keys) { + try { + $flagValue = $adapterBackup.DohFlags[$dnsIP] + $dohFlagsPath = "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$interfaceGuid\DohInterfaceSettings\Doh\$dnsIP" + + # Create path if needed + if (-not (Test-Path $dohFlagsPath)) { + New-Item -Path $dohFlagsPath -Force -ErrorAction Stop | Out-Null + } + + # Restore DohFlags value + New-ItemProperty -Path $dohFlagsPath -Name "DohFlags" -Value $flagValue -PropertyType QWORD -Force -ErrorAction Stop | Out-Null + Write-Log -Level DEBUG -Message " Restored DohFlags for $dnsIP = $flagValue" -Module $script:ModuleName + } + catch { + Write-Log -Level DEBUG -Message " Could not restore DohFlags for $dnsIP : $_" -Module $script:ModuleName + } + } + } + else { + Write-Log -Level WARNING -Message " Could not restore DohFlags: Interface GUID not available" -Module $script:ModuleName + } + } + + # Restore DHCP DNS Override setting + if ($null -ne $adapterBackup.DhcpOverrideDisabled) { + Write-Log -Level DEBUG -Message " Restoring DHCP DNS override setting..." -Module $script:ModuleName + + try { + # DhcpOverrideDisabled=true means RegisterThisConnectionsAddress=false + $registerThisConnection = -not $adapterBackup.DhcpOverrideDisabled + + Set-DnsClient -InterfaceIndex $interfaceIndex ` + -RegisterThisConnectionsAddress $registerThisConnection ` + -ErrorAction Stop + + $statusText = if ($adapterBackup.DhcpOverrideDisabled) { "disabled" } else { "enabled" } + Write-Log -Level DEBUG -Message " DHCP DNS override: $statusText" -Module $script:ModuleName + } + catch { + Write-Log -Level WARNING -Message " Could not restore DHCP override setting: $_" -Module $script:ModuleName + } + } + } + } + + if ($success) { + Write-Log -Level SUCCESS -Message "DNS settings restored successfully" -Module $script:ModuleName + } + else { + Write-Log -Level WARNING -Message "DNS settings restored with some errors" -Module $script:ModuleName + } + + return $success + } + catch { + Write-ErrorLog -Message "Failed to restore DNS settings from backup" -Module $script:ModuleName -ErrorRecord $_ + return $false + } +} diff --git a/Modules/EdgeHardening/Config/EdgePolicies.json b/Modules/EdgeHardening/Config/EdgePolicies.json new file mode 100644 index 0000000..fc2b924 --- /dev/null +++ b/Modules/EdgeHardening/Config/EdgePolicies.json @@ -0,0 +1,150 @@ +๏ปฟ[ + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "SitePerProcess", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "AuthSchemes", + "Type": "REG_SZ", + "Data": "ntlm,negotiate" + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "NativeMessagingUserLevelHosts", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "SmartScreenEnabled", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "PreventSmartScreenPromptOverride", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "PreventSmartScreenPromptOverrideForFiles", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "SSLErrorOverrideAllowed", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "SmartScreenPuaEnabled", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "BasicAuthOverHttpEnabled", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "InternetExplorerIntegrationReloadInIEModeAllowed", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "SharedArrayBufferUnrestrictedAccessAllowed", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "BrowserLegacyExtensionPointsBlockingEnabled", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "InternetExplorerModeToolbarButtonEnabled", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "TyposquattingCheckerEnabled", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "InternetExplorerIntegrationZoneIdentifierMhtFileAllowed", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "DynamicCodeSettings", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "ApplicationBoundEncryptionEnabled", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "EnableUnsafeSwiftShader", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "PersonalizationReportingEnabled", + "Type": "REG_DWORD", + "Data": 0, + "Description": "CRITICAL: Prevent browsing history, favorites sent to Microsoft" + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "DiagnosticData", + "Type": "REG_DWORD", + "Data": 0, + "Description": "Disable Edge telemetry/diagnostic data" + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "TrackingPrevention", + "Type": "REG_DWORD", + "Data": 2, + "Description": "Balanced tracking prevention (won't break websites)" + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge", + "ValueName": "EdgeShoppingAssistantEnabled", + "Type": "REG_DWORD", + "Data": 0, + "Description": "Disable shopping assistant/price tracking" + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge\\ExtensionInstallBlocklist", + "ValueName": "**delvals.", + "Type": "REG_SZ", + "Data": " " + }, + { + "KeyName": "[Software\\Policies\\Microsoft\\Edge\\ExtensionInstallBlocklist", + "ValueName": "1", + "Type": "REG_SZ", + "Data": "*" + } +] diff --git a/Modules/EdgeHardening/Config/Summary.json b/Modules/EdgeHardening/Config/Summary.json new file mode 100644 index 0000000..ec5c1c6 --- /dev/null +++ b/Modules/EdgeHardening/Config/Summary.json @@ -0,0 +1,9 @@ +๏ปฟ{ + "TotalEdgePolicies": 20, + "ParsedDate": "2025-11-17 10:30:01", + "BaselineVersion": "Edge v139", + "RegistryPaths": [ + "[Software\\Policies\\Microsoft\\Edge", + "[Software\\Policies\\Microsoft\\Edge\\ExtensionInstallBlocklist" + ] +} diff --git a/Modules/EdgeHardening/EdgeHardening.psd1 b/Modules/EdgeHardening/EdgeHardening.psd1 new file mode 100644 index 0000000..d452df5 --- /dev/null +++ b/Modules/EdgeHardening/EdgeHardening.psd1 @@ -0,0 +1,66 @@ +@{ + # Script module or binary module file associated with this manifest + RootModule = 'EdgeHardening.psm1' + + # Version number of this module + ModuleVersion = '2.2.0' + + # ID used to uniquely identify this module + GUID = '8e3f4c2a-9b1d-4e7a-a2c5-6f8b3d9e1a4c' + + # Author of this module + Author = 'NexusOne23' + + # Company or vendor of this module + CompanyName = 'Open Source Project' + + # Copyright statement for this module + Copyright = '(c) 2025 NexusOne23. Licensed under GPL-3.0.' + + # Description of the functionality provided by this module + Description = 'Microsoft Edge Security Hardening based on MS Edge v139 Security Baseline. Applies 20 security policies to harden Microsoft Edge browser using native PowerShell (no LGPO.exe dependency). Includes SmartScreen enforcement, site isolation, SSL/TLS hardening, extension blocking, and IE mode restrictions.' + + # Minimum version of the PowerShell engine required by this module + PowerShellVersion = '5.1' + + # Modules that must be imported into the global environment prior to importing this module + RequiredModules = @() + + # Functions to export from this module + FunctionsToExport = @( + 'Invoke-EdgeHardening', + 'Test-EdgeHardening' + ) + + # Cmdlets to export from this module + CmdletsToExport = @() + + # Variables to export from this module + VariablesToExport = @() + + # Aliases to export from this module + AliasesToExport = @() + + # Private data to pass to the module specified in RootModule/ModuleToProcess + PrivateData = @{ + PSData = @{ + Tags = @('Security', 'Edge', 'Browser', 'Hardening', 'Baseline', 'Windows11', 'Privacy') + LicenseUri = '' + ProjectUri = '' + ReleaseNotes = @" +v2.2.0 - Production Release +- Microsoft Edge v139 Security Baseline implementation +- 20 security policies (native PowerShell, no LGPO.exe) +- SmartScreen enforcement with override prevention +- Site isolation (SitePerProcess) enabled +- SSL/TLS error override blocking +- Extension blocklist (block all by default) +- IE Mode restrictions +- Spectre/Meltdown mitigations (SharedArrayBuffer) +- Application-bound encryption +- Backup and restore functionality +- Compliance testing +"@ + } + } +} diff --git a/Modules/EdgeHardening/EdgeHardening.psm1 b/Modules/EdgeHardening/EdgeHardening.psm1 new file mode 100644 index 0000000..a31eb64 --- /dev/null +++ b/Modules/EdgeHardening/EdgeHardening.psm1 @@ -0,0 +1,62 @@ +#Requires -Version 5.1 +#Requires -RunAsAdministrator + +<# +.SYNOPSIS + EdgeHardening Module Loader + +.DESCRIPTION + Loads all private and public functions for the EdgeHardening module. + Applies Microsoft Edge v139+ Security Baseline using native PowerShell. + + NO EXTERNAL DEPENDENCIES: + - No LGPO.exe required + - Native PowerShell Set-ItemProperty + - Built-in Windows tools only + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+, Administrator privileges +#> + +# Module variables +$script:ModuleName = "EdgeHardening" +$script:ModuleRoot = $PSScriptRoot + +# Load Private functions +$privateFunctions = @( + 'Set-EdgePolicies.ps1', + 'Test-EdgePolicies.ps1', + 'Backup-EdgePolicies.ps1', + 'Restore-EdgePolicies.ps1' +) + +foreach ($function in $privateFunctions) { + $functionPath = Join-Path $PSScriptRoot "Private\$function" + if (Test-Path $functionPath) { + . $functionPath + } + else { + Write-Host "WARNING: [$script:ModuleName] Private function not found: $function" -ForegroundColor Yellow + } +} + +# Load Public functions +$publicFunctions = @( + 'Invoke-EdgeHardening.ps1', + 'Test-EdgeHardening.ps1' +) + +foreach ($function in $publicFunctions) { + $functionPath = Join-Path $PSScriptRoot "Public\$function" + if (Test-Path $functionPath) { + . $functionPath + } + else { + Write-Host "WARNING: [$script:ModuleName] Public function not found: $function" -ForegroundColor Yellow + } +} + +# Module loaded successfully +Write-Verbose "[$script:ModuleName] Module loaded successfully from: $PSScriptRoot" diff --git a/Modules/EdgeHardening/Private/Backup-EdgePolicies.ps1 b/Modules/EdgeHardening/Private/Backup-EdgePolicies.ps1 new file mode 100644 index 0000000..aa00e89 --- /dev/null +++ b/Modules/EdgeHardening/Private/Backup-EdgePolicies.ps1 @@ -0,0 +1,151 @@ +<# +.SYNOPSIS + Backup current Microsoft Edge policy settings + +.DESCRIPTION + Creates backup of existing Edge policy registry keys before applying baseline. + Integrates with Core Rollback system (Backup-RegistryKey). + +.PARAMETER BackupName + Name for this backup (default: auto-generated timestamp) + +.OUTPUTS + PSCustomObject with backup status and path + +.NOTES + Backs up: HKLM:\Software\Policies\Microsoft\Edge (entire subtree) +#> + +function Backup-EdgePolicies { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [string]$BackupName + ) + + $result = [PSCustomObject]@{ + Success = $false + BackupPath = $null + KeysBackedUp = 0 + Errors = @() + } + + try { + Write-Log -Level DEBUG -Message "Backing up Edge policy settings..." -Module "EdgeHardening" + + # Edge policy root path + $edgePolicyPath = "HKLM:\Software\Policies\Microsoft\Edge" + + # Check if Backup-RegistryKey is available (from Core/Rollback.ps1) + if (-not (Get-Command Backup-RegistryKey -ErrorAction SilentlyContinue)) { + Write-Warning "Backup-RegistryKey not available - using standalone backup" + + # Fallback: Export to .reg file + if (-not $BackupName) { + $BackupName = "EdgePolicies_$(Get-Date -Format 'yyyyMMdd_HHmmss')" + } + + $backupFolder = Join-Path $env:TEMP "NoIDPrivacy_Backups" + if (-not (Test-Path $backupFolder)) { + New-Item -Path $backupFolder -ItemType Directory -Force | Out-Null + } + + $backupFile = Join-Path $backupFolder "$BackupName.reg" + + if (Test-Path $edgePolicyPath) { + # Export using reg.exe (built-in) + $regPath = "HKLM\Software\Policies\Microsoft\Edge" + $process = Start-Process -FilePath "reg.exe" ` + -ArgumentList "export `"$regPath`" `"$backupFile`" /y" ` + -Wait ` + -NoNewWindow ` + -PassThru + + if ($process.ExitCode -eq 0) { + $result.Success = $true + $result.BackupPath = $backupFile + $result.KeysBackedUp = 1 + Write-Log -Level DEBUG -Message "Standalone backup created: $backupFile" -Module "EdgeHardening" + } + else { + $result.Errors += "reg.exe export failed with exit code: $($process.ExitCode)" + } + } + else { + # No existing Edge policies - nothing to backup + $result.Success = $true + $result.KeysBackedUp = 0 + Write-Log -Level DEBUG -Message "No existing Edge policies to backup" -Module "EdgeHardening" + } + } + else { + $backupResult = Backup-RegistryKey -KeyPath $edgePolicyPath -BackupName "EdgeHardening" + + if ($backupResult) { + if ($backupResult -match "_EMPTY\.json$") { + Write-Log -Level INFO -Message "Edge policy key does not exist - Created Empty Marker for cleanup" -Module "EdgeHardening" + $result.Success = $true + $result.KeysBackedUp = 0 + } + else { + $result.Success = $true + $result.BackupPath = $backupResult + $result.KeysBackedUp = 1 + Write-Log -Level DEBUG -Message "Edge policies backed up via Core Rollback system: $backupResult" -Module "EdgeHardening" + + try { + $preStateEntries = @() + if (Test-Path $edgePolicyPath) { + $keysToSnapshot = @() + $keysToSnapshot += $edgePolicyPath + $childKeys = Get-ChildItem -Path $edgePolicyPath -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.PSIsContainer } + foreach ($child in $childKeys) { + $keysToSnapshot += $child.PSPath + } + + foreach ($key in $keysToSnapshot) { + try { + $properties = Get-ItemProperty -Path $key -ErrorAction Stop + $propertyNames = $properties.PSObject.Properties.Name | Where-Object { $_ -notin @('PSPath', 'PSParentPath', 'PSChildName', 'PSProvider', 'PSDrive') } + foreach ($propName in $propertyNames) { + $propValue = $properties.$propName + $propType = (Get-Item $key).GetValueKind($propName) + $preStateEntries += [PSCustomObject]@{ + Path = $key + Name = $propName + Value = $propValue + Type = $propType.ToString() + } + } + } + catch { + Write-Log -Level DEBUG -Message "Could not read properties from $key : $_" -Module "EdgeHardening" + } + } + } + + $backupFolder = [System.IO.Path]::GetDirectoryName($backupResult) + $preStatePath = Join-Path $backupFolder "EdgeHardening_PreState.json" + $preStateEntries | ConvertTo-Json -Depth 5 | Set-Content -Path $preStatePath -Encoding UTF8 + Write-Log -Level INFO -Message "Edge policy pre-state snapshot created ($($preStateEntries.Count) registry values)" -Module "EdgeHardening" + } + catch { + Write-Log -Level WARNING -Message "Failed to create EdgeHardening pre-state snapshot: $_" -Module "EdgeHardening" + } + } + } + else { + $result.Success = $true + $result.KeysBackedUp = 0 + Write-Log -Level DEBUG -Message "Backup-RegistryKey returned null (unexpected but handled)" -Module "EdgeHardening" + } + } + + } + catch { + $result.Errors += "Backup failed: $($_.Exception.Message)" + Write-Log -Level DEBUG -Message "Backup failed: $_" -Module "EdgeHardening" + } + + return $result +} diff --git a/Modules/EdgeHardening/Private/Restore-EdgePolicies.ps1 b/Modules/EdgeHardening/Private/Restore-EdgePolicies.ps1 new file mode 100644 index 0000000..1f840a3 --- /dev/null +++ b/Modules/EdgeHardening/Private/Restore-EdgePolicies.ps1 @@ -0,0 +1,71 @@ +<# +.SYNOPSIS + Restore Microsoft Edge policy settings from backup + +.DESCRIPTION + Restores Edge policies from a previous backup. + Integrates with Core Rollback system or standalone .reg file. + +.PARAMETER BackupPath + Path to backup file or backup ID (for Core Rollback system) + +.OUTPUTS + PSCustomObject with restore status + +.NOTES + Restores: HKLM:\Software\Policies\Microsoft\Edge +#> + +function Restore-EdgePolicies { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$BackupPath + ) + + $result = [PSCustomObject]@{ + Success = $false + KeysRestored = 0 + Errors = @() + } + + try { + Write-Log -Level DEBUG -Message "Restoring Edge policy settings from: $BackupPath" -Module "EdgeHardening" + + # Check if it's a .reg file (standalone backup) + if ($BackupPath -like "*.reg" -and (Test-Path $BackupPath)) { + Write-Log -Level DEBUG -Message "Restoring from .reg file..." -Module "EdgeHardening" + + # Import using reg.exe (built-in) + $process = Start-Process -FilePath "reg.exe" ` + -ArgumentList "import `"$BackupPath`"" ` + -Wait ` + -NoNewWindow ` + -PassThru + + if ($process.ExitCode -eq 0) { + $result.Success = $true + $result.KeysRestored = 1 + Write-Log -Level DEBUG -Message "Standalone backup restored successfully" -Module "EdgeHardening" + } + else { + $result.Errors += "reg.exe import failed with exit code: $($process.ExitCode)" + } + } + else { + # Try Core Rollback system + Write-Warning "Restore from Core Rollback system not yet fully implemented" + Write-Warning "Please use Framework's Invoke-Rollback for full restore" + + # Placeholder for future integration + $result.Errors += "Please use Invoke-Rollback from Framework for integrated restore" + } + + } + catch { + $result.Errors += "Restore failed: $($_.Exception.Message)" + Write-Log -Level DEBUG -Message "Restore failed: $_" -Module "EdgeHardening" + } + + return $result +} diff --git a/Modules/EdgeHardening/Private/Set-EdgePolicies.ps1 b/Modules/EdgeHardening/Private/Set-EdgePolicies.ps1 new file mode 100644 index 0000000..0548327 --- /dev/null +++ b/Modules/EdgeHardening/Private/Set-EdgePolicies.ps1 @@ -0,0 +1,185 @@ +<# +.SYNOPSIS + Apply Microsoft Edge security policies from parsed baseline JSON + +.DESCRIPTION + Native PowerShell implementation - no LGPO.exe dependency. + Applies 20 Microsoft Edge v139 Security Baseline policies directly to registry. + + Policies include: + - SmartScreen enforcement (no override) + - Site isolation (SitePerProcess) + - SSL/TLS error override blocking + - Extension blocklist (block all) + - IE Mode restrictions + - Spectre mitigations (SharedArrayBuffer) + - Application-bound encryption + +.PARAMETER EdgePoliciesPath + Path to EdgePolicies.json (default: module ParsedSettings folder) + +.PARAMETER DryRun + Preview changes without applying + +.PARAMETER AllowExtensions + Skip ExtensionInstallBlocklist policy (allows users to install any extensions) + Default: Block all extensions (Microsoft Security Baseline) + +.OUTPUTS + PSCustomObject with applied count and errors + +.NOTES + Applies policies to: HKLM:\Software\Policies\Microsoft\Edge + Requires Administrator privileges +#> + +function Set-EdgePolicies { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [string]$EdgePoliciesPath, + + [Parameter(Mandatory = $false)] + [switch]$DryRun, + + [Parameter(Mandatory = $false)] + [switch]$AllowExtensions + ) + + $result = [PSCustomObject]@{ + Applied = 0 + Skipped = 0 + Errors = @() + } + + # Default path if not specified + if (-not $EdgePoliciesPath) { + $modulePath = Split-Path -Parent $PSScriptRoot + $EdgePoliciesPath = Join-Path $modulePath "Config\EdgePolicies.json" + } + + if (-not (Test-Path $EdgePoliciesPath)) { + $result.Errors += "EdgePolicies.json not found: $EdgePoliciesPath" + return $result + } + + try { + Write-Log -Level DEBUG -Message "Applying Microsoft Edge security policies..." -Module "EdgeHardening" + + $edgePolicies = Get-Content -Path $EdgePoliciesPath -Raw | ConvertFrom-Json + + if ($edgePolicies.Count -eq 0) { + Write-Log -Level DEBUG -Message "No Edge policies to apply" -Module "EdgeHardening" + return $result + } + + # Calculate actual policy count that will be applied + # Total JSON entries vary - dynamically count from loaded policies + # Extension blocklist (2 entries: **delvals + blocklist value) skipped if AllowExtensions + # **delvals GPO markers always skipped + $actualPolicyCount = ($edgePolicies | Where-Object { + $_.ValueName -notlike "**delvals*" -and + (-not $AllowExtensions -or $_.KeyName -notlike "*ExtensionInstallBlocklist*") + }).Count + + Write-Host " Applying $actualPolicyCount Edge security policies..." -ForegroundColor Cyan + + if ($AllowExtensions) { + Write-Host " Note: Extension blocklist will be skipped (AllowExtensions specified)" -ForegroundColor Yellow + } + + foreach ($policy in $edgePolicies) { + try { + # Parse key path: [Software\Policies\... -> HKLM:\Software\Policies\... + $keyPath = $policy.KeyName -replace '^\[', '' -replace '\]$', '' + + # All Edge policies are under HKLM + $fullPath = "HKLM:\$keyPath" + + # Skip ExtensionInstallBlocklist if AllowExtensions is specified + if ($AllowExtensions -and $keyPath -like "*ExtensionInstallBlocklist*") { + Write-Log -Level DEBUG -Message "Skipping ExtensionInstallBlocklist (AllowExtensions specified): $($policy.ValueName)" -Module "EdgeHardening" + $result.Skipped++ + continue + } + + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would set: $fullPath\$($policy.ValueName) = $($policy.Data) ($($policy.Type))" -Module "EdgeHardening" + $result.Applied++ + continue + } + + # Ensure parent key exists + if (-not (Test-Path $fullPath)) { + New-Item -Path $fullPath -Force -ErrorAction Stop | Out-Null + Write-Log -Level DEBUG -Message "Created registry path: $fullPath" -Module "EdgeHardening" + } + + # Handle special GPO deletion markers + if ($policy.ValueName -like "**delvals.*") { + # This is a GPO marker to delete all values in this key before setting new ones + # We'll skip this as we're setting explicit values + Write-Log -Level DEBUG -Message "Skipping GPO deletion marker: $($policy.ValueName)" -Module "EdgeHardening" + $result.Skipped++ + continue + } + + # Convert registry type + $regType = switch ($policy.Type) { + "REG_DWORD" { "DWord" } + "REG_SZ" { "String" } + "REG_EXPAND_SZ" { "ExpandString" } + "REG_BINARY" { "Binary" } + "REG_MULTI_SZ" { "MultiString" } + default { + Write-Log -Level DEBUG -Message "Unknown registry type: $($policy.Type) for $($policy.ValueName)" -Module "EdgeHardening" + "String" + } + } + + # Apply setting (create or update with correct type) + $existingValue = Get-ItemProperty -Path $fullPath -Name $policy.ValueName -ErrorAction SilentlyContinue + + if ($null -ne $existingValue) { + # Value exists - update it (type is preserved) + Set-ItemProperty -Path $fullPath ` + -Name $policy.ValueName ` + -Value $policy.Data ` + -Force ` + -ErrorAction Stop | Out-Null + } + else { + # Value does not exist - create it with proper type + New-ItemProperty -Path $fullPath ` + -Name $policy.ValueName ` + -Value $policy.Data ` + -PropertyType $regType ` + -Force ` + -ErrorAction Stop | Out-Null + } + + Write-Log -Level DEBUG -Message "Applied: $($policy.ValueName) = $($policy.Data) ($regType)" -Module "EdgeHardening" + $result.Applied++ + + } + catch { + $result.Errors += "Failed to set $($policy.KeyName)\$($policy.ValueName): $($_.Exception.Message)" + Write-Log -Level WARNING -Message "Failed to set $($policy.KeyName)\$($policy.ValueName): $_" -Module "EdgeHardening" + Write-Host " [ERROR] $($policy.ValueName): $($_.Exception.Message)" -ForegroundColor Red + } + } + + Write-Log -Level DEBUG -Message "Applied $($result.Applied) Edge policies (Skipped: $($result.Skipped))" -Module "EdgeHardening" + Write-Host " Completed: $($result.Applied) Edge policies applied" -ForegroundColor Green + + if ($result.Skipped -gt 0) { + Write-Host " Note: $($result.Skipped) GPO markers skipped (expected)" -ForegroundColor Gray + } + } + catch { + $result.Errors += "Edge policy application failed: $($_.Exception.Message)" + Write-Log -Level DEBUG -Message "Edge policy application failed: $_" -Module "EdgeHardening" + } + + return $result +} diff --git a/Modules/EdgeHardening/Private/Test-EdgePolicies.ps1 b/Modules/EdgeHardening/Private/Test-EdgePolicies.ps1 new file mode 100644 index 0000000..54f5922 --- /dev/null +++ b/Modules/EdgeHardening/Private/Test-EdgePolicies.ps1 @@ -0,0 +1,187 @@ +<# +.SYNOPSIS + Test Microsoft Edge security policies compliance + +.DESCRIPTION + Verifies that all Edge v139 Security Baseline policies are correctly applied. + Returns detailed compliance status for each policy. + + NOTE: Supports optional policies that count as SUCCESS even if not applied: + - GPO deletion markers (**delvals) - infrastructure, not a real policy + - ExtensionInstallBlocklist - optional based on -AllowExtensions flag + +.PARAMETER EdgePoliciesPath + Path to EdgePolicies.json (default: module ParsedSettings folder) + +.OUTPUTS + PSCustomObject with compliance status and details + +.NOTES + Checks registry values against expected baseline values + Treats optional policies as SUCCESS if not set (user choice) +#> + +function Test-EdgePolicies { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [string]$EdgePoliciesPath + ) + + # Default path if not specified + if (-not $EdgePoliciesPath) { + $modulePath = Split-Path -Parent $PSScriptRoot + $EdgePoliciesPath = Join-Path $modulePath "Config\EdgePolicies.json" + } + + if (-not (Test-Path $EdgePoliciesPath)) { + return [PSCustomObject]@{ + Compliant = $false + Message = "EdgePolicies.json not found: $EdgePoliciesPath" + Details = @() + } + } + + try { + $edgePolicies = Get-Content -Path $EdgePoliciesPath -Raw | ConvertFrom-Json + + $compliantCount = 0 + $nonCompliantCount = 0 + $details = @() + + foreach ($policy in $edgePolicies) { + # Parse key path first + $keyPath = $policy.KeyName -replace '^\[', '' -replace '\]$', '' + $fullPath = "HKLM:\$keyPath" + + # Determine if this policy is optional + $isOptional = $false + + # GPO deletion markers are optional (infrastructure, not real policies) + if ($policy.ValueName -like "**delvals.*") { + $compliantCount++ + $details += [PSCustomObject]@{ + Policy = $policy.ValueName + Expected = "GPO Marker" + Actual = "Skipped" + Status = "Compliant (Ignored)" + Compliant = $true + Optional = $true + } + continue + } + + $isOptional = $false + + # ExtensionInstallBlocklist is optional ONLY if key doesn't exist + # (meaning user chose -AllowExtensions, so it was skipped) + # If key exists, it MUST be compliant (user chose to block extensions) + if ($policy.ValueName -eq "1" -and $policy.KeyName -like "*ExtensionInstallBlocklist*") { + if (-not (Test-Path $fullPath)) { + $isOptional = $true # User chose -AllowExtensions + } + # else: Key exists, so it must be compliant (not optional) + } + + $policyCompliant = $false + $actualValue = $null + $status = "Not Set" + + try { + if (Test-Path $fullPath) { + $regValue = Get-ItemProperty -Path $fullPath -Name $policy.ValueName -ErrorAction Stop + $actualValue = $regValue.$($policy.ValueName) + + # Compare values + if ($policy.Type -eq "REG_DWORD") { + $policyCompliant = ([int]$actualValue -eq [int]$policy.Data) + } + elseif ($policy.Type -eq "REG_MULTI_SZ") { + # Compare arrays + $expected = $policy.Data + $policyCompliant = ($null -eq (Compare-Object $actualValue $expected)) + } + else { + $policyCompliant = ($actualValue -eq $policy.Data) + } + + $status = if ($policyCompliant) { "Compliant" } else { "Non-Compliant (Wrong Value)" } + + if (-not $policyCompliant) { + Write-Log -Level WARNING -Message "Policy Check Failed: $($policy.ValueName)" -Module "EdgeHardening" + Write-Log -Level WARNING -Message " - Key: $fullPath" -Module "EdgeHardening" + Write-Log -Level WARNING -Message " - Expected: $($policy.Data)" -Module "EdgeHardening" + Write-Log -Level WARNING -Message " - Actual: $actualValue" -Module "EdgeHardening" + } + } + else { + # Key doesn't exist + if ($isOptional) { + # Optional policy not set = SUCCESS (user choice) + $policyCompliant = $true + $status = "Compliant (Optional - Not Set)" + } + else { + $status = "Non-Compliant (Key Not Found)" + Write-Log -Level WARNING -Message "Policy Check Failed: $($policy.ValueName)" -Module "EdgeHardening" + Write-Log -Level WARNING -Message " - Key Not Found: $fullPath" -Module "EdgeHardening" + } + } + } + catch { + # Value doesn't exist in existing key + if ($isOptional) { + # Optional policy not set = SUCCESS (user choice) + $policyCompliant = $true + $status = "Compliant (Optional - Not Set)" + } + else { + $status = "Non-Compliant (Value Not Found)" + Write-Log -Level WARNING -Message "Policy Check Failed: $($policy.ValueName)" -Module "EdgeHardening" + Write-Log -Level WARNING -Message " - Key exists but Value missing: $fullPath\$($policy.ValueName)" -Module "EdgeHardening" + } + } + + if ($policyCompliant) { + $compliantCount++ + } + else { + $nonCompliantCount++ + } + + $details += [PSCustomObject]@{ + Policy = $policy.ValueName + Expected = $policy.Data + Actual = $actualValue + Status = $status + Compliant = $policyCompliant + Optional = $isOptional + } + } + + # Total policies = all 20 entries in JSON + $totalPolicies = $compliantCount + $nonCompliantCount + $compliancePercentage = if ($totalPolicies -gt 0) { + [math]::Round(($compliantCount / $totalPolicies) * 100, 1) + } + else { + 0 + } + + return [PSCustomObject]@{ + Compliant = ($nonCompliantCount -eq 0) + Message = "Edge Security: $compliantCount/$totalPolicies policies compliant ($compliancePercentage%)" + CompliantCount = $compliantCount + NonCompliantCount = $nonCompliantCount + CompliancePercentage = $compliancePercentage + Details = $details + } + } + catch { + return [PSCustomObject]@{ + Compliant = $false + Message = "Edge policy compliance test failed: $($_.Exception.Message)" + Details = @() + } + } +} diff --git a/Modules/EdgeHardening/Public/Invoke-EdgeHardening.ps1 b/Modules/EdgeHardening/Public/Invoke-EdgeHardening.ps1 new file mode 100644 index 0000000..e049409 --- /dev/null +++ b/Modules/EdgeHardening/Public/Invoke-EdgeHardening.ps1 @@ -0,0 +1,383 @@ +<# +.SYNOPSIS + Apply Microsoft Edge v139 Security Baseline + +.DESCRIPTION + Applies all 20 Microsoft Edge Security Baseline policies using native PowerShell: + - SmartScreen enforcement (no override allowed) + - Site isolation (SitePerProcess) for process-per-site security + - SSL/TLS error override blocking + - Extension blocklist (blocks all extensions by default) + - IE Mode restrictions + - Spectre/Meltdown mitigations (SharedArrayBuffer) + - Application-bound encryption + - Authentication scheme restrictions + - PUA (Potentially Unwanted Applications) detection + + Uses ONLY native Windows tools: + - PowerShell for Registry (Set-ItemProperty) + - NO EXTERNAL DEPENDENCIES - no LGPO.exe needed! + +.PARAMETER DryRun + Preview changes without applying them + +.PARAMETER SkipBackup + Skip backup creation (not recommended) + +.PARAMETER SkipVerify + Skip post-application verification + +.PARAMETER AllowExtensions + Allow users to install browser extensions (skips ExtensionInstallBlocklist) + Default: Block all extensions (Microsoft Security Baseline) + +.EXAMPLE + Invoke-EdgeHardening + Apply all Edge baseline settings with full backup and verification + +.EXAMPLE + Invoke-EdgeHardening -DryRun + Preview what changes would be made + + .EXAMPLE + Invoke-EdgeHardening -AllowExtensions + Apply Edge hardening but allow users to install browser extensions + +.OUTPUTS + PSCustomObject with results including success status and any errors + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+, Administrator privileges + + IMPORTANT: This applies Microsoft's recommended security baseline. + Some policies may impact browser functionality: + - All extensions are blocked by default (can be adjusted via GPO) + - IE Mode is restricted + - SSL error overrides are prevented +#> + +function Invoke-EdgeHardening { + [CmdletBinding(SupportsShouldProcess)] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun, + + [Parameter(Mandatory = $false)] + [switch]$SkipBackup, + + [Parameter(Mandatory = $false)] + [switch]$SkipVerify, + + [Parameter(Mandatory = $false)] + [switch]$AllowExtensions + ) + + begin { + # Helper function: Use Write-Log if available (framework), else Write-Log -Level DEBUG -Message + function Write-ModuleLog { + param([string]$Level, [string]$Message, [string]$Module = "EdgeHardening") + + if (Get-Command Write-Log -ErrorAction SilentlyContinue) { + Write-Log -Level $Level -Message $Message -Module $Module + } + else { + switch ($Level) { + "ERROR" { Write-Host "ERROR: $Message" -ForegroundColor Red } + "WARNING" { Write-Host "WARNING: $Message" -ForegroundColor Yellow } + default { Write-Log -Level DEBUG -Message $Message } + } + } + } + + $moduleName = "EdgeHardening" + $startTime = Get-Date + + # Initialize result object + $result = [PSCustomObject]@{ + ModuleName = $moduleName + Success = $false + PoliciesApplied = 0 + Errors = @() + BackupCreated = $false + ComplianceVerified = $false + CompliancePercent = 0 + Duration = $null + } + } + + process { + try { + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host " EDGE HARDENING MODULE" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + Write-Host "Applies Microsoft Edge v139+ Security Baseline" -ForegroundColor White + Write-Host " - SmartScreen enforcement, Site isolation" -ForegroundColor Gray + Write-Host " - SSL/TLS hardening, Extension blocklist (optional)" -ForegroundColor Gray + Write-Host " - Tracking Prevention, Privacy policies, PUA protection" -ForegroundColor Gray + Write-Host "" + + # Extensions Policy - NonInteractive or Interactive + if (-not $PSBoundParameters.ContainsKey('AllowExtensions')) { + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - use config value + $AllowExtensions = Get-NonInteractiveValue -Module "EdgeHardening" -Key "allowExtensions" -Default $true + Write-NonInteractiveDecision -Module $moduleName -Decision "Browser extensions" -Value $(if ($AllowExtensions) { "Allowed" } else { "Blocked" }) + } + else { + # Interactive mode + Write-Host "========================================" -ForegroundColor Yellow + Write-Host " BROWSER EXTENSIONS POLICY" -ForegroundColor Yellow + Write-Host "========================================" -ForegroundColor Yellow + Write-Host "" + Write-Host "Microsoft Security Baseline blocks ALL browser extensions by default." -ForegroundColor White + Write-Host "" + Write-Host "Do you want to ALLOW browser extensions?" -ForegroundColor White + Write-Host "" + Write-Host " [Y] YES - Allow extensions (User Friendly)" -ForegroundColor Cyan + Write-Host " - Users can install browser extensions" -ForegroundColor Gray + Write-Host " - Useful for password managers, ad blockers, etc." -ForegroundColor Gray + Write-Host " - Less secure (extension vulnerabilities possible)" -ForegroundColor Gray + Write-Host "" + Write-Host " [N] NO - Block ALL extensions (MS Recommended)" -ForegroundColor White + Write-Host " - Maximum security - no extension attack surface" -ForegroundColor Gray + Write-Host " - Prevents malicious/compromised extensions" -ForegroundColor Gray + Write-Host " - Microsoft Security Baseline default" -ForegroundColor Gray + Write-Host "" + + $extensionChoice = Read-Host "Allow browser extensions? [Y/N] (default: Y)" + + if ($extensionChoice -eq 'N' -or $extensionChoice -eq 'n') { + $AllowExtensions = $false + Write-Host "" + Write-Host " ALL extensions will be BLOCKED (Maximum Security)" -ForegroundColor Cyan + Write-ModuleLog -Level "INFO" -Message "User decision: Browser extensions BLOCKED (Microsoft Security Baseline default)" + } + else { + $AllowExtensions = $true + Write-Host "" + Write-Host " Extensions will be ALLOWED" -ForegroundColor Green + Write-ModuleLog -Level "INFO" -Message "User decision: Browser extensions ALLOWED" + } + Write-Host "" + } + } + + Write-ModuleLog -Level "INFO" -Message "Starting Edge hardening..." + + # Validate Edge is installed (check App Paths instead of EdgeUpdate key) + $edgeAppPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe" + $edgeInstalled = $false + $edgeVersion = "Unknown" + + if (Test-Path $edgeAppPath) { + try { + $edgeExePath = (Get-ItemProperty -Path $edgeAppPath -ErrorAction Stop).'(default)' + if (Test-Path $edgeExePath) { + $edgeInstalled = $true + $edgeVersion = (Get-Item $edgeExePath -ErrorAction SilentlyContinue).VersionInfo.FileVersion + Write-ModuleLog -Level "INFO" -Message "Microsoft Edge detected: v$edgeVersion" + } + } + catch { + # Edge key exists but cannot read - assume installed + $edgeInstalled = $true + } + } + + if (-not $edgeInstalled) { + Write-ModuleLog -Level "WARNING" -Message "Microsoft Edge may not be installed (msedge.exe not found)" + Write-Host " WARNING: Microsoft Edge installation not detected" -ForegroundColor Yellow + Write-Host " Policies will still be applied for when Edge is installed" -ForegroundColor Yellow + Write-Host "" + } + + # PHASE 1: BACKUP + Write-Host "[1/4] BACKUP - Creating restore point..." -ForegroundColor Cyan + + if (-not $SkipBackup -and -not $DryRun) { + if ($PSCmdlet.ShouldProcess("Edge Policies", "Create Backup")) { + Write-ModuleLog -Level "INFO" -Message "Creating backup of Edge policies..." + + # Initialize session-based backup system + try { + Initialize-BackupSystem + $null = Start-ModuleBackup -ModuleName $moduleName + Write-ModuleLog -Level "INFO" -Message "Session backup initialized" + } + catch { + Write-ModuleLog -Level "WARNING" -Message "Failed to initialize session backup: $_" + } + + $backupResult = Backup-EdgePolicies + + if ($backupResult.Success) { + # Register backup in session manifest + Complete-ModuleBackup -ItemsBackedUp $backupResult.KeysBackedUp -Status "Success" + + $result.BackupCreated = $true + Write-Host " Backup completed ($($backupResult.KeysBackedUp) keys)" -ForegroundColor Green + } + else { + Write-ModuleLog -Level "WARNING" -Message "Backup failed: $($backupResult.Errors -join '; ')" + Write-Host " WARNING: Backup failed - continuing anyway" -ForegroundColor Yellow + $result.Errors += $backupResult.Errors + } + } + } + else { + Write-Host " Skipped (SkipBackup flag)" -ForegroundColor Yellow + } + Write-Host "" + + # PHASE 2: APPLY + Write-Host "[2/4] APPLY - Configuring Edge policies..." -ForegroundColor Cyan + + if ($PSCmdlet.ShouldProcess("Edge Security Baseline", "Apply Policies")) { + Write-ModuleLog -Level "INFO" -Message "Applying Edge v139 baseline policies..." + + $policyResult = Set-EdgePolicies -DryRun:$DryRun -AllowExtensions:$AllowExtensions + + if ($policyResult.Applied -gt 0) { + $result.PoliciesApplied = $policyResult.Applied + Write-Host "" + + if ($DryRun) { + Write-Host " [DRYRUN] Would apply $($policyResult.Applied) policies" -ForegroundColor Yellow + } + } + + if ($policyResult.Errors.Count -gt 0) { + Write-ModuleLog -Level "WARNING" -Message "Policy application had errors: $($policyResult.Errors -join '; ')" + $result.Errors += $policyResult.Errors + } + + Write-Host "" + } + + # PHASE 3: VERIFY + Write-Host "[3/4] VERIFY - Checking compliance..." -ForegroundColor Cyan + + if (-not $SkipVerify -and -not $DryRun) { + if ($PSCmdlet.ShouldProcess("Edge Policies", "Verify Compliance")) { + Write-ModuleLog -Level "INFO" -Message "Verifying Edge policy compliance..." + + $verifyResult = Test-EdgePolicies + + if ($verifyResult.Compliant) { + $result.ComplianceVerified = $true + $result.CompliancePercent = $verifyResult.CompliancePercentage + Write-Host " Verification: $($verifyResult.Message)" -ForegroundColor Green + } + else { + # Still verified, just not 100% compliant + $result.ComplianceVerified = $true # Changed: We DID verify, just not perfect + $result.CompliancePercent = $verifyResult.CompliancePercentage + Write-Host " Verification: $($verifyResult.Message)" -ForegroundColor Yellow + Write-ModuleLog -Level "WARNING" -Message "Compliance verification: $($verifyResult.Message)" + + # Show non-compliant policies + $nonCompliant = $verifyResult.Details | Where-Object { -not $_.Compliant } + if ($nonCompliant.Count -gt 0 -and $nonCompliant.Count -le 5) { + Write-Host " Non-compliant policies:" -ForegroundColor Yellow + foreach ($policy in $nonCompliant) { + Write-Host " - $($policy.Policy): Expected=$($policy.Expected), Actual=$($policy.Actual)" -ForegroundColor Gray + } + } + } + Write-Host "" + } + } + else { + Write-Host " Skipped (SkipVerify flag)" -ForegroundColor Gray + } + Write-Host "" + + # Mark success + $result.Success = ($result.PoliciesApplied -gt 0) + + # PHASE 4: COMPLETE + Write-Host "[4/4] COMPLETE - Edge hardening finished!" -ForegroundColor Green + Write-Host "" + + # Check for Skipped policies (e.g., delvals GPO marker, extension blocklist) + $skippedCount = if ($policyResult.Skipped) { $policyResult.Skipped } else { 0 } + + # Total is dynamic: Applied + Skipped = Total in JSON + $totalPoliciesInBaseline = $result.PoliciesApplied + $skippedCount + + # Success logic: Green if no errors occurred (skips are allowed/expected for GPO markers) + $isCleanRun = ($result.Errors.Count -eq 0) + + Write-Host "Policies: $($result.PoliciesApplied) applied ($skippedCount skipped, Total: $totalPoliciesInBaseline)" -ForegroundColor $(if ($isCleanRun) { 'Green' } else { 'Yellow' }) + Write-Host "Backup: $(if ($result.BackupCreated) { 'Created' } else { 'Skipped' })" -ForegroundColor $(if ($result.BackupCreated) { 'Green' } else { 'Yellow' }) + + # Verification summary with percentage for partial compliance + if ($result.ComplianceVerified) { + if ($result.CompliancePercent -eq 100) { + Write-Host "Verification: PASSED (100%)" -ForegroundColor Green + } + else { + Write-Host "Verification: Partial ($($result.CompliancePercent)%)" -ForegroundColor Yellow + } + } + elseif ($SkipVerify) { + Write-Host "Verification: Skipped" -ForegroundColor Gray + } + else { + Write-Host "Verification: Not run" -ForegroundColor Yellow + } + + if ($result.Errors.Count -gt 0) { + Write-Host "Errors: $($result.Errors.Count)" -ForegroundColor Red + } + + Write-Host "" + + if ($result.Success) { + Write-ModuleLog -Level "INFO" -Message "Edge hardening completed successfully" + + # GUI parsing marker for settings count (24 Edge policies) + Write-Log -Level SUCCESS -Message "Applied 24 settings" -Module "EdgeHardening" + } + else { + Write-ModuleLog -Level "WARNING" -Message "Edge hardening completed with warnings" + } + + Write-Host "" + Write-Host " IMPORTANT NOTES:" -ForegroundColor Yellow + + if ($AllowExtensions) { + Write-Host " - Extensions: ALLOWED (user can install any extension)" -ForegroundColor Cyan + } + else { + Write-Host " - Extensions: BLOCKED (use -AllowExtensions to enable)" -ForegroundColor Gray + } + + Write-Host " - SSL error overrides are prevented" -ForegroundColor Gray + Write-Host " - IE Mode has restrictions applied" -ForegroundColor Gray + Write-Host " - Changes take effect on next Edge restart" -ForegroundColor Gray + Write-Host "" + + } + catch { + $result.Success = $false + $result.Errors += "Edge hardening failed: $($_.Exception.Message)" + Write-ModuleLog -Level "ERROR" -Message "Edge hardening failed: $_" + Write-Host "" + Write-Host " ERROR: Edge hardening failed" -ForegroundColor Red + Write-Host " $($_.Exception.Message)" -ForegroundColor Red + Write-Host "" + } + finally { + $result.Duration = (Get-Date) - $startTime + } + } + + end { + return $result + } +} diff --git a/Modules/EdgeHardening/Public/Test-EdgeHardening.ps1 b/Modules/EdgeHardening/Public/Test-EdgeHardening.ps1 new file mode 100644 index 0000000..98c327a --- /dev/null +++ b/Modules/EdgeHardening/Public/Test-EdgeHardening.ps1 @@ -0,0 +1,110 @@ +<# +.SYNOPSIS + Test Microsoft Edge security baseline compliance + +.DESCRIPTION + Public wrapper for Test-EdgePolicies. + Verifies all Edge v139+ Security Baseline policies are correctly applied. + Returns user-friendly compliance report. + +.PARAMETER Detailed + Show detailed policy-by-policy results + +.EXAMPLE + Test-EdgeHardening + Run compliance check with summary + +.EXAMPLE + Test-EdgeHardening -Detailed + Show detailed policy-by-policy compliance status + +.OUTPUTS + PSCustomObject with compliance status and details + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Can be run without Administrator privileges +#> + +function Test-EdgeHardening { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$Detailed + ) + + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host " Edge Security Compliance Test" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + + try { + # Run compliance test + $testResult = Test-EdgePolicies + + # Display summary + Write-Host " Testing Microsoft Edge v139 Security Baseline..." -ForegroundColor White + Write-Host "" + + if ($testResult.Compliant) { + Write-Host " Status: COMPLIANT" -ForegroundColor Green + Write-Host " $($testResult.Message)" -ForegroundColor Green + } + else { + Write-Host " Status: NON-COMPLIANT" -ForegroundColor Yellow + Write-Host " $($testResult.Message)" -ForegroundColor Yellow + } + + Write-Host "" + + # Show details if requested + if ($Detailed -and $testResult.Details) { + Write-Host " Policy Details:" -ForegroundColor White + Write-Host " " + ("-" * 70) -ForegroundColor Gray + + foreach ($detail in $testResult.Details) { + $statusColor = if ($detail.Compliant) { "Green" } else { "Yellow" } + $statusSymbol = if ($detail.Compliant) { "[X]" } else { "[ ]" } + + Write-Host " $statusSymbol " -ForegroundColor $statusColor -NoNewline + Write-Host "$($detail.Policy)" -ForegroundColor White + + if (-not $detail.Compliant) { + Write-Host " Expected: $($detail.Expected)" -ForegroundColor Gray + Write-Host " Actual: $($detail.Actual)" -ForegroundColor Gray + } + } + + Write-Host "" + } + + # Show summary statistics + if ($testResult.PSObject.Properties.Name -contains 'CompliantCount') { + Write-Host " Summary:" -ForegroundColor White + Write-Host " - Compliant: $($testResult.CompliantCount)" -ForegroundColor Green + Write-Host " - Non-Compliant: $($testResult.NonCompliantCount)" -ForegroundColor $(if ($testResult.NonCompliantCount -gt 0) { "Yellow" } else { "Green" }) + Write-Host " - Compliance: $($testResult.CompliancePercentage)%" -ForegroundColor White + Write-Host "" + } + + if (-not $testResult.Compliant) { + Write-Host " Recommendation: Run Invoke-EdgeHardening to apply baseline" -ForegroundColor Yellow + Write-Host "" + } + + return $testResult + } + catch { + Write-Host " ERROR: Compliance test failed" -ForegroundColor Red + Write-Host " $($_.Exception.Message)" -ForegroundColor Red + Write-Host "" + + return [PSCustomObject]@{ + Compliant = $false + Message = "Test failed: $($_.Exception.Message)" + Details = @() + } + } +} diff --git a/Modules/Privacy/Config/Bloatware-Map.json b/Modules/Privacy/Config/Bloatware-Map.json new file mode 100644 index 0000000..3390007 --- /dev/null +++ b/Modules/Privacy/Config/Bloatware-Map.json @@ -0,0 +1,26 @@ +{ + "Description": "Mapping between internal app names (Remove-Bloatware) and Winget Store IDs for automated restoration", + "Version": "1.2", + "LastVerified": "2025-12-08", + "Notes": "Store IDs verified against winget msstore source. Xbox system components (Xbox.TCUI, XboxSpeechToTextOverlay) are restored via Gaming Services / Xbox Game Bar where possible. XboxIdentityProvider uses a dedicated Store ID. Empty IDs = not available in winget catalog.", + "Mappings": { + "Microsoft.BingNews": "9WZDNCRFHVFW", + "Microsoft.BingWeather": "9WZDNCRFJ3Q2", + "Microsoft.MicrosoftSolitaireCollection": "", + "Microsoft.MicrosoftStickyNotes": "9NBLGGH4QGHW", + "Microsoft.GamingApp": "9MV0B5HZVK9Z", + "Microsoft.XboxApp": "9MV0B5HZVK9Z", + "Microsoft.XboxGamingOverlay": "9NZKPSTSNW4P", + "Microsoft.XboxIdentityProvider": "9WZDNCRD1HKW", + "Microsoft.ZuneMusic": "9WZDNCRFJ3PT", + "Microsoft.ZuneVideo": "9WZDNCRFJ3PT", + "Microsoft.WindowsFeedbackHub": "9NBLGGH4R32N", + "Microsoft.GetHelp": "9PKDZBMV1H3T", + "Microsoft.Getstarted": "", + "Microsoft.MixedReality.Portal": "9NG1H8B3ZC7M", + "Microsoft.People": "", + "Microsoft.YourPhone": "9NMPJ99VJBWV", + "Clipchamp.Clipchamp": "9P1J8S7CCWWT", + "SpotifyAB.SpotifyMusic": "9NCBCSZSJRSB" + } +} diff --git a/Modules/Privacy/Config/Bloatware.json b/Modules/Privacy/Config/Bloatware.json new file mode 100644 index 0000000..2cec8a3 --- /dev/null +++ b/Modules/Privacy/Config/Bloatware.json @@ -0,0 +1,119 @@ +{ + "Description": "Bloatware removal configuration with hybrid approach: Policy-based for Win11 25H2+ ENT/EDU, classic PowerShell for others", + + "PolicyMethod": { + "Description": "Policy-based removal for Windows 11 25H2+ Enterprise/Education (MS Official)", + "Enabled": true, + "RegistryPath": "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\RemoveDefaultMicrosoftStorePackages", + "CSPPath": "./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/RemoveDefaultMicrosoftStorePackages", + "MinBuild": 26100, + "SupportedEditions": ["Enterprise", "Education"], + "Apps": { + "BingNews": true, + "BingWeather": true, + "Clipchamp": false, + "Copilot": false, + "GamingApp": true, + "MediaPlayer": false, + "MicrosoftOfficeHub": false, + "MicrosoftSolitaireCollection": true, + "MicrosoftStickyNotes": true, + "MSTeams": false, + "OutlookForWindows": false, + "Paint": false, + "Photos": false, + "QuickAssist": false, + "ScreenSketch": false, + "Todo": false, + "WindowsCalculator": false, + "WindowsCamera": false, + "WindowsFeedbackHub": true, + "WindowsNotepad": false, + "WindowsSoundRecorder": false, + "WindowsTerminal": false, + "XboxGamingOverlay": true, + "XboxIdentityProvider": true, + "XboxSpeechToTextOverlay": false, + "XboxTCUI": false + }, + "AppMapping": { + "BingNews": "Microsoft.BingNews", + "BingWeather": "Microsoft.BingWeather", + "Clipchamp": "Clipchamp.Clipchamp", + "Copilot": "Microsoft.Copilot", + "GamingApp": "Microsoft.GamingApp", + "MediaPlayer": "Microsoft.ZuneMusic", + "MicrosoftOfficeHub": "Microsoft.MicrosoftOfficeHub", + "MicrosoftSolitaireCollection": "Microsoft.MicrosoftSolitaireCollection", + "MicrosoftStickyNotes": "Microsoft.MicrosoftStickyNotes", + "MSTeams": "MicrosoftTeams", + "OutlookForWindows": "Microsoft.OutlookForWindows", + "Paint": "Microsoft.Paint", + "Photos": "Microsoft.Windows.Photos", + "QuickAssist": "Microsoft.QuickAssist", + "ScreenSketch": "Microsoft.ScreenSketch", + "Todo": "Microsoft.Todos", + "WindowsCalculator": "Microsoft.WindowsCalculator", + "WindowsCamera": "Microsoft.WindowsCamera", + "WindowsFeedbackHub": "Microsoft.WindowsFeedbackHub", + "WindowsNotepad": "Microsoft.WindowsNotepad", + "WindowsSoundRecorder": "Microsoft.WindowsSoundRecorder", + "WindowsTerminal": "Microsoft.WindowsTerminal", + "XboxGamingOverlay": "Microsoft.XboxGamingOverlay", + "XboxIdentityProvider": "Microsoft.XboxIdentityProvider", + "XboxSpeechToTextOverlay": "Microsoft.XboxSpeechToTextOverlay", + "XboxTCUI": "Microsoft.Xbox.TCUI" + } + }, + + "ClassicMethod": { + "Description": "PowerShell-based removal for older versions or Pro edition", + "RemoveApps": [ + "Microsoft.BingNews", + "Microsoft.BingWeather", + "Microsoft.MicrosoftSolitaireCollection", + "Microsoft.MicrosoftStickyNotes", + "Microsoft.GamingApp", + "Microsoft.XboxApp", + "Microsoft.XboxGamingOverlay", + "Microsoft.XboxIdentityProvider", + "Microsoft.XboxSpeechToTextOverlay", + "Microsoft.Xbox.TCUI", + "Microsoft.ZuneMusic", + "Microsoft.ZuneVideo", + "Microsoft.WindowsFeedbackHub", + "Microsoft.GetHelp", + "Microsoft.Getstarted", + "Microsoft.MixedReality.Portal", + "Microsoft.People", + "Microsoft.YourPhone", + "Clipchamp.Clipchamp", + "SpotifyAB.SpotifyMusic", + "*CandyCrush*", + "Disney.*", + "Facebook.*", + "TikTok.TikTok" + ], + "ProtectedApps": [ + "Microsoft.WindowsStore", + "Microsoft.WindowsCalculator", + "Microsoft.Windows.Photos", + "Microsoft.DesktopAppInstaller", + "Microsoft.ScreenSketch", + "Microsoft.Paint", + "Microsoft.WindowsNotepad", + "Microsoft.WindowsTerminal", + "Microsoft.WindowsCamera", + "Microsoft.WindowsSoundRecorder", + "Microsoft.StorePurchaseApp", + "Microsoft.HEIFImageExtension", + "Microsoft.HEVCVideoExtension", + "Microsoft.WebpImageExtension", + "Microsoft.VP9VideoExtensions", + "Microsoft.WebMediaExtensions", + "Microsoft.AV1VideoExtension", + "Microsoft.MPEG2VideoExtension", + "Microsoft.RawImageExtension" + ] + } +} diff --git a/Modules/Privacy/Config/OneDrive.json b/Modules/Privacy/Config/OneDrive.json new file mode 100644 index 0000000..2c794fc --- /dev/null +++ b/Modules/Privacy/Config/OneDrive.json @@ -0,0 +1,43 @@ +{ + "OneDrivePolicies": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\OneDrive": { + "EnableFeedbackAndSupport": { + "Type": "DWord", + "Value": 0, + "Description": "Disable feedback and support uploads from OneDrive client" + }, + "EnableSyncAdminReports": { + "Type": "DWord", + "Value": 0, + "Description": "Disable sync health reporting telemetry" + }, + "DisablePersonalSync": { + "Type": "DWord", + "Value": 0, + "Description": "Allow personal OneDrive (0=Enabled, 1=Disabled)" + }, + "PreventNetworkTrafficPreUserSignIn": { + "Type": "DWord", + "Value": 1, + "Description": "Prevent network traffic before user signs in" + } + } + }, + + "StorePolicies": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\WindowsStore": { + "RemoveWindowsStore": { + "Type": "DWord", + "Value": 0, + "Description": "Keep Store enabled (needed for app updates)" + }, + "DisableOSUpgrade": { + "Type": "DWord", + "Value": 1, + "Description": "Block Store upgrade offers (Windows Update still works)" + } + } + }, + + "Description": "OneDrive: Personal + Business functional with telemetry off. Store: Enabled with upgrade prompts blocked. App auto-updates remain enabled." +} diff --git a/Modules/Privacy/Config/Privacy-MSRecommended.json b/Modules/Privacy/Config/Privacy-MSRecommended.json new file mode 100644 index 0000000..547dd83 --- /dev/null +++ b/Modules/Privacy/Config/Privacy-MSRecommended.json @@ -0,0 +1,326 @@ +{ + "Mode": "MSRecommended", + "Description": "Balanced Privacy - Disables telemetry/ads/tracking, but lets USER decide on functional features", + "BestFor": "Production, business, MDM environments - maximum compatibility", + "Warnings": [ + "AllowTelemetry=1: Required diagnostic data (MS minimum)", + "Settings Sync: Defaults OFF, user can enable", + "All AppPrivacy: User decides (all apps work normally)", + "Services: All running (MDM/Intune compatible)" + ], + + "DataCollection": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection": { + "AllowTelemetry": { + "Type": "DWord", + "Value": 1, + "Description": "Required diagnostic data only (MS recommended)" + }, + "LimitDiagnosticLogCollection": { + "Type": "DWord", + "Value": 1, + "Description": "Limit additional diagnostic log collection" + }, + "DoNotShowFeedbackNotifications": { + "Type": "DWord", + "Value": 1, + "Description": "No feedback popups" + }, + "DisableOneSettingsDownloads": { + "Type": "DWord", + "Value": 1, + "Description": "Block dynamic config downloads from Microsoft" + } + } + }, + + "Personalization": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent": { + "DisableTailoredExperiencesWithDiagnosticData": { + "Type": "DWord", + "Value": 1, + "Description": "No personalized tips from diagnostic data" + }, + "DisableWindowsSpotlightFeatures": { + "Type": "DWord", + "Value": 1, + "Description": "Disable all Windows Spotlight features" + }, + "DisableWindowsSpotlightOnSettings": { + "Type": "DWord", + "Value": 1, + "Description": "No Spotlight on Settings page" + }, + "DisableWindowsSpotlightOnActionCenter": { + "Type": "DWord", + "Value": 1, + "Description": "No Spotlight on Action Center" + }, + "DisableThirdPartySuggestions": { + "Type": "DWord", + "Value": 1, + "Description": "No third-party suggestions" + }, + "DisableSpotlightCollectionOnDesktop": { + "Type": "DWord", + "Value": 1, + "Description": "No Spotlight collection on desktop" + }, + "DisableCloudOptimizedContent": { + "Type": "DWord", + "Value": 1, + "Description": "No cloud-optimized content/tips from Microsoft" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo": { + "DisabledByGroupPolicy": { + "Type": "DWord", + "Value": 1, + "Description": "Disable Advertising ID (via Group Policy)" + } + }, + "HKCU:\\Software\\Policies\\Microsoft\\Windows\\Explorer": { + "DisableSoftLanding": { + "Type": "DWord", + "Value": 1, + "Description": "No tips and suggestions bubbles" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced": { + "Start_IrisRecommendations": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Start Menu app recommendations/ads" + }, + "ShowSyncProviderNotifications": { + "Type": "DWord", + "Value": 0, + "Description": "Disable OneDrive/Sync provider ads in Explorer" + } + } + }, + + "SearchAndCloud": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search": { + "DisableWebSearch": { + "Type": "DWord", + "Value": 1, + "Description": "No web search in Start menu" + }, + "ConnectedSearchUseWeb": { + "Type": "DWord", + "Value": 0, + "Description": "No connected search to web" + }, + "AllowCloudSearch": { + "Type": "DWord", + "Value": 0, + "Description": "No cloud search" + }, + "AllowCortana": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Cortana (legacy, Win11 has no Cortana)" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Search": { + "BingSearchEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Bing search integration (user-level)" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\SearchSettings": { + "IsDynamicSearchBoxEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Search Highlights (trending topics, news)" + } + } + }, + + "InputAndSync": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\InputPersonalization": { + "AllowInputPersonalization": { + "Type": "DWord", + "Value": 0, + "Description": "No cloud-based input personalization" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System": { + "EnableActivityFeed": { + "Type": "DWord", + "Value": 0, + "Description": "Disable activity feed" + }, + "PublishUserActivities": { + "Type": "DWord", + "Value": 0, + "Description": "Don't publish user activities" + }, + "UploadUserActivities": { + "Type": "DWord", + "Value": 0, + "Description": "Don't upload user activities to cloud" + }, + "AllowCrossDeviceClipboard": { + "Type": "DWord", + "Value": 0, + "Description": "Disable cloud clipboard sync between devices (USER PROMPT in MSRecommended)", + "RequiresPrompt": true + }, + "AllowClipboardHistory": { + "Type": "DWord", + "Value": 1, + "Description": "Allow local clipboard history (Win+V works)" + } + }, + "HKCU:\\SOFTWARE\\Microsoft\\InputPersonalization": { + "RestrictImplicitTextCollection": { + "Type": "DWord", + "Value": 1, + "Description": "Block typing data collection" + }, + "RestrictImplicitInkCollection": { + "Type": "DWord", + "Value": 1, + "Description": "Block inking/handwriting data collection" + } + }, + "HKCU:\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore": { + "HarvestContacts": { + "Type": "DWord", + "Value": 0, + "Description": "Don't harvest contacts for personalization" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\SettingSync": { + "DisableSettingSync": { + "Type": "DWord", + "Value": 2, + "Description": "Settings sync default off, but user can enable (0=Force On, 1=Force Off, 2=User decides, default off)" + }, + "DisableSettingSyncUserOverride": { + "Type": "DWord", + "Value": 0, + "Description": "Allow user to override sync settings (0=User can change, 1=User locked)" + } + } + }, + + "LocationAndAppPrivacy": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\LocationAndSensors": { + "DisableLocation": { + "Type": "DWord", + "Value": 0, + "Description": "Location services enabled (user can control)" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy": { + "LetAppsAccessLocation": { + "Type": "DWord", + "Value": 0, + "Description": "User decides location access (0=User decides, 1=Force Allow, 2=Force Deny)" + }, + "LetAppsAccessRadios": { + "Type": "DWord", + "Value": 0, + "Description": "User decides radio (Bluetooth/WiFi) access" + }, + "LetAppsAccessCallHistory": { + "Type": "DWord", + "Value": 0, + "Description": "User decides call history access" + }, + "LetAppsAccessMicrophone": { + "Type": "DWord", + "Value": 0, + "Description": "User decides microphone access (for Teams/Zoom)" + }, + "LetAppsAccessCamera": { + "Type": "DWord", + "Value": 0, + "Description": "User decides camera access (for video apps)" + }, + "LetAppsAccessContacts": { + "Type": "DWord", + "Value": 0, + "Description": "User decides contacts access" + }, + "LetAppsAccessCalendar": { + "Type": "DWord", + "Value": 0, + "Description": "User decides calendar access" + }, + "LetAppsAccessEmail": { + "Type": "DWord", + "Value": 0, + "Description": "User decides email access" + }, + "LetAppsAccessMessaging": { + "Type": "DWord", + "Value": 0, + "Description": "User decides messaging access" + }, + "LetAppsAccessNotifications": { + "Type": "DWord", + "Value": 0, + "Description": "User decides notification access" + }, + "LetAppsAccessTrustedDevices": { + "Type": "DWord", + "Value": 0, + "Description": "User decides trusted devices access" + }, + "LetAppsSyncWithDevices": { + "Type": "DWord", + "Value": 0, + "Description": "User decides device sync" + }, + "LetAppsGetDiagnosticInfo": { + "Type": "DWord", + "Value": 0, + "Description": "User decides app diagnostics access" + }, + "LetAppsActivateWithVoice": { + "Type": "DWord", + "Value": 0, + "Description": "User decides voice activation access" + }, + "LetAppsAccessAccountInfo": { + "Type": "DWord", + "Value": 0, + "Description": "User decides account info access" + }, + "LetAppsAccessPhone": { + "Type": "DWord", + "Value": 0, + "Description": "User decides phone calls access" + }, + "LetAppsAccessTasks": { + "Type": "DWord", + "Value": 0, + "Description": "User decides tasks access" + }, + "LetAppsAccessGraphicsCaptureProgrammatic": { + "Type": "DWord", + "Value": 0, + "Description": "User decides screenshot/screen recording access" + }, + "LetAppsAccessGraphicsCaptureWithoutBorder": { + "Type": "DWord", + "Value": 0, + "Description": "User decides screenshot border access" + }, + "LetAppsAccessGenerativeAI": { + "Type": "DWord", + "Value": 0, + "Description": "User decides generative AI access" + } + } + }, + + "Services": [], + + "ScheduledTasks": [] +} diff --git a/Modules/Privacy/Config/Privacy-Paranoid.json b/Modules/Privacy/Config/Privacy-Paranoid.json new file mode 100644 index 0000000..f80a40d --- /dev/null +++ b/Modules/Privacy/Config/Privacy-Paranoid.json @@ -0,0 +1,458 @@ +{ + "Mode": "Paranoid", + "Description": "Hardcore privacy - Works on all editions (NOT recommended for production)", + "BestFor": "Air-gapped, kiosk systems, extreme privacy requirements only", + "Warnings": [ + "AllowTelemetry=0: Enterprise/Education only (Pro falls back to Required=1)", + "Force Deny ALL: Mic, Camera, Location, Contacts, Calendar, etc.", + "BREAKS: Teams, Zoom, Skype, and ALL video conferencing!", + "WerSvc disabled: NO error reporting, support severely limited", + "Scheduled tasks disabled: CEIP, AppExperience, DiskDiagnostic", + "NOT recommended for production - use only in controlled environments" + ], + + "DataCollection": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection": { + "AllowTelemetry": { + "Type": "DWord", + "Value": 0, + "Description": "Diagnostic data OFF" + }, + "LimitDiagnosticLogCollection": { + "Type": "DWord", + "Value": 1, + "Description": "Limit additional diagnostic log collection" + }, + "DoNotShowFeedbackNotifications": { + "Type": "DWord", + "Value": 1, + "Description": "No feedback popups" + }, + "DisableOneSettingsDownloads": { + "Type": "DWord", + "Value": 1, + "Description": "Block dynamic config downloads from Microsoft" + } + } + }, + + "Personalization": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent": { + "DisableTailoredExperiencesWithDiagnosticData": { + "Type": "DWord", + "Value": 1, + "Description": "No personalized tips from diagnostic data" + }, + "DisableWindowsSpotlightFeatures": { + "Type": "DWord", + "Value": 1, + "Description": "Disable all Windows Spotlight features" + }, + "DisableWindowsSpotlightOnSettings": { + "Type": "DWord", + "Value": 1, + "Description": "No Spotlight on Settings page" + }, + "DisableWindowsSpotlightOnActionCenter": { + "Type": "DWord", + "Value": 1, + "Description": "No Spotlight on Action Center" + }, + "DisableThirdPartySuggestions": { + "Type": "DWord", + "Value": 1, + "Description": "No third-party suggestions" + }, + "DisableSpotlightCollectionOnDesktop": { + "Type": "DWord", + "Value": 1, + "Description": "No Spotlight collection on desktop" + }, + "DisableCloudOptimizedContent": { + "Type": "DWord", + "Value": 1, + "Description": "No cloud-optimized content/tips from Microsoft" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo": { + "DisabledByGroupPolicy": { + "Type": "DWord", + "Value": 1, + "Description": "Disable Advertising ID (via Group Policy)" + } + }, + "HKCU:\\Software\\Policies\\Microsoft\\Windows\\Explorer": { + "DisableSoftLanding": { + "Type": "DWord", + "Value": 1, + "Description": "No tips and suggestions bubbles" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Explorer": { + "DisableGraphRecentItems": { + "Type": "DWord", + "Value": 1, + "Description": "Disable cloud file metadata in Explorer (Recent, Recommended, Insights from MS account)" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced": { + "Start_IrisRecommendations": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Start Menu app recommendations/ads" + }, + "ShowSyncProviderNotifications": { + "Type": "DWord", + "Value": 0, + "Description": "Disable OneDrive/Sync provider ads in Explorer" + }, + "Start_TrackProgs": { + "Type": "DWord", + "Value": 0, + "Description": "Disable app launch tracking for Start/Search improvements" + } + }, + "HKCU:\\Control Panel\\International\\User Profile": { + "HttpAcceptLanguageOptOut": { + "Type": "DWord", + "Value": 1, + "Description": "Disable websites accessing language list" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\ContentDeliveryManager": { + "ContentDeliveryAllowed": { + "Type": "DWord", + "Value": 0, + "Description": "Disable content delivery (suggested content)" + }, + "SubscribedContent-338393Enabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable suggested content in Settings app" + }, + "SubscribedContent-353694Enabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable suggested content in Settings app" + }, + "SubscribedContent-353696Enabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable suggested content in Settings app" + }, + "SubscribedContentEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable all subscribed content" + }, + "SystemPaneSuggestionsEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable system pane suggestions" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\SystemSettings\\AccountNotifications": { + "EnableAccountNotifications": { + "Type": "DWord", + "Value": 0, + "Description": "Disable notifications in Settings app" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\UserProfileEngagement": { + "ScoobeSystemSettingEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable 'Get the most out of Windows' suggestions" + } + } + }, + + "SearchAndCloud": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search": { + "DisableWebSearch": { + "Type": "DWord", + "Value": 1, + "Description": "No web search in Start menu" + }, + "ConnectedSearchUseWeb": { + "Type": "DWord", + "Value": 0, + "Description": "No connected search to web" + }, + "AllowCloudSearch": { + "Type": "DWord", + "Value": 0, + "Description": "No cloud search" + }, + "AllowCortana": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Cortana (legacy)" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Search": { + "BingSearchEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Bing search integration (user-level)" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\SearchSettings": { + "IsDynamicSearchBoxEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Search Highlights (trending topics, news)" + } + } + }, + + "InputAndSync": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\InputPersonalization": { + "AllowInputPersonalization": { + "Type": "DWord", + "Value": 0, + "Description": "No cloud-based input personalization" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System": { + "EnableActivityFeed": { + "Type": "DWord", + "Value": 0, + "Description": "Disable activity feed" + }, + "PublishUserActivities": { + "Type": "DWord", + "Value": 0, + "Description": "Don't publish user activities" + }, + "UploadUserActivities": { + "Type": "DWord", + "Value": 0, + "Description": "Don't upload user activities to cloud" + }, + "AllowCrossDeviceClipboard": { + "Type": "DWord", + "Value": 0, + "Description": "Disable cloud clipboard sync between devices" + }, + "AllowClipboardHistory": { + "Type": "DWord", + "Value": 0, + "Description": "Disable clipboard history (Win+V) - PARANOID ONLY" + }, + "EnableCdp": { + "Type": "DWord", + "Value": 0, + "Description": "Disable cross-device experiences (Continue on PC)" + } + }, + "HKCU:\\SOFTWARE\\Microsoft\\InputPersonalization": { + "RestrictImplicitTextCollection": { + "Type": "DWord", + "Value": 1, + "Description": "Block typing data collection" + }, + "RestrictImplicitInkCollection": { + "Type": "DWord", + "Value": 1, + "Description": "Block inking/handwriting data collection" + } + }, + "HKCU:\\SOFTWARE\\Microsoft\\Personalization\\Settings": { + "AcceptedPrivacyPolicy": { + "Type": "DWord", + "Value": 0, + "Description": "Disable inking/typing personalization toggle in Settings" + } + }, + "HKCU:\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore": { + "HarvestContacts": { + "Type": "DWord", + "Value": 0, + "Description": "Don't harvest contacts for personalization" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\SettingSync": { + "DisableSettingSync": { + "Type": "DWord", + "Value": 1, + "Description": "Disable settings sync" + }, + "DisableSettingSyncUserOverride": { + "Type": "DWord", + "Value": 1, + "Description": "User cannot override sync disable" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Dsh": { + "AllowNewsAndInterests": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Widgets/News and Interests" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\FindMyDevice": { + "AllowFindMyDevice": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Find My Device tracking - PARANOID ONLY" + } + } + }, + + "LocationAndAppPrivacy": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\LocationAndSensors": { + "DisableLocation": { + "Type": "DWord", + "Value": 1, + "Description": "Disable location services" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy": { + "LetAppsAccessLocation": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny location access for apps" + }, + "LetAppsAccessRadios": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny radio access for apps" + }, + "LetAppsAccessCallHistory": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny call history access" + }, + "LetAppsAccessMicrophone": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny microphone (BREAKS Teams/Zoom/Skype!)" + }, + "LetAppsAccessCamera": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny camera (BREAKS video conferencing!)" + }, + "LetAppsAccessContacts": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny contacts access" + }, + "LetAppsAccessCalendar": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny calendar access" + }, + "LetAppsAccessNotifications": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny notification access for apps - PARANOID ONLY" + }, + "LetAppsAccessEmail": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny email access" + }, + "LetAppsAccessMessaging": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny messaging access" + }, + "LetAppsAccessTrustedDevices": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny trusted devices access" + }, + "LetAppsSyncWithDevices": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny device sync" + }, + "LetAppsGetDiagnosticInfo": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny app diagnostics access" + }, + "LetAppsActivateWithVoice": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny voice activation access" + }, + "LetAppsAccessAccountInfo": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny account info access" + }, + "LetAppsAccessPhone": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny phone calls access" + }, + "LetAppsAccessTasks": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny tasks access" + }, + "LetAppsAccessGraphicsCaptureProgrammatic": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny screenshot/screen recording access" + }, + "LetAppsAccessGraphicsCaptureWithoutBorder": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny screenshot border access" + }, + "LetAppsAccessGenerativeAI": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny generative AI access" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\appDiagnostics": { + "Value": { + "Type": "String", + "Value": "Deny", + "Description": "Deny app diagnostics access (UI toggle)" + } + }, + "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\appDiagnostics": { + "Value": { + "Type": "String", + "Value": "Deny", + "Description": "Deny app diagnostics access system-wide (UI toggle)" + } + } + }, + + "Services": [ + { + "Name": "DiagTrack", + "DisplayName": "Connected User Experiences and Telemetry", + "StartupType": "Disabled", + "Description": "Telemetry service - disabled in Paranoid mode" + }, + { + "Name": "dmwappushservice", + "DisplayName": "Device Management Wireless Application Protocol (WAP) Push message Routing Service", + "StartupType": "Disabled", + "Description": "WAP Push service - disabled in Paranoid mode" + }, + { + "Name": "WerSvc", + "DisplayName": "Windows Error Reporting Service", + "StartupType": "Disabled", + "Description": "Error reporting service - DISABLED IN PARANOID (breaks error analysis!)" + } + ], + + "ScheduledTasks": [ + "\\Microsoft\\Windows\\Application Experience\\Microsoft Compatibility Appraiser", + "\\Microsoft\\Windows\\Application Experience\\ProgramDataUpdater", + "\\Microsoft\\Windows\\Application Experience\\StartupAppTask", + "\\Microsoft\\Windows\\Customer Experience Improvement Program\\Consolidator", + "\\Microsoft\\Windows\\Customer Experience Improvement Program\\UsbCeip", + "\\Microsoft\\Windows\\DiskDiagnostic\\Microsoft-Windows-DiskDiagnosticDataCollector" + ] +} diff --git a/Modules/Privacy/Config/Privacy-Strict.json b/Modules/Privacy/Config/Privacy-Strict.json new file mode 100644 index 0000000..5f22f7b --- /dev/null +++ b/Modules/Privacy/Config/Privacy-Strict.json @@ -0,0 +1,437 @@ +{ + "Mode": "Strict", + "Description": "Maximum privacy - Works on all editions (Pro/Enterprise/Education)", + "BestFor": "Privacy-focused home users, small business without MDM", + "Warnings": [ + "AllowTelemetry=0: Enterprise/Education only (Pro falls back to Required=1)", + "Force Deny: Location, App-Diagnose, Generative AI", + "All other permissions: User decides (Teams/Zoom work!)", + "Services disabled: DiagTrack + dmwappushservice (no MDM!)", + "Win+V clipboard: Works (local only, no cloud sync)" + ], + + "DataCollection": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection": { + "AllowTelemetry": { + "Type": "DWord", + "Value": 0, + "Description": "Diagnostic data OFF (Enterprise/Edu only, Pro falls back to Required)" + }, + "LimitDiagnosticLogCollection": { + "Type": "DWord", + "Value": 1, + "Description": "Limit additional diagnostic log collection" + }, + "DoNotShowFeedbackNotifications": { + "Type": "DWord", + "Value": 1, + "Description": "No feedback popups" + }, + "DisableOneSettingsDownloads": { + "Type": "DWord", + "Value": 1, + "Description": "Block dynamic config downloads from Microsoft" + } + } + }, + + "Personalization": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent": { + "DisableTailoredExperiencesWithDiagnosticData": { + "Type": "DWord", + "Value": 1, + "Description": "No personalized tips from diagnostic data" + }, + "DisableWindowsSpotlightFeatures": { + "Type": "DWord", + "Value": 1, + "Description": "Disable all Windows Spotlight features" + }, + "DisableWindowsSpotlightOnSettings": { + "Type": "DWord", + "Value": 1, + "Description": "No Spotlight on Settings page" + }, + "DisableWindowsSpotlightOnActionCenter": { + "Type": "DWord", + "Value": 1, + "Description": "No Spotlight on Action Center" + }, + "DisableThirdPartySuggestions": { + "Type": "DWord", + "Value": 1, + "Description": "No third-party suggestions" + }, + "DisableSpotlightCollectionOnDesktop": { + "Type": "DWord", + "Value": 1, + "Description": "No Spotlight collection on desktop" + }, + "DisableCloudOptimizedContent": { + "Type": "DWord", + "Value": 1, + "Description": "No cloud-optimized content/tips from Microsoft" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo": { + "DisabledByGroupPolicy": { + "Type": "DWord", + "Value": 1, + "Description": "Disable Advertising ID (via Group Policy)" + } + }, + "HKCU:\\Software\\Policies\\Microsoft\\Windows\\Explorer": { + "DisableSoftLanding": { + "Type": "DWord", + "Value": 1, + "Description": "No tips and suggestions bubbles" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Explorer": { + "DisableGraphRecentItems": { + "Type": "DWord", + "Value": 1, + "Description": "Disable cloud file metadata in Explorer (Recent, Recommended, Insights from MS account)" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced": { + "Start_IrisRecommendations": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Start Menu app recommendations/ads" + }, + "ShowSyncProviderNotifications": { + "Type": "DWord", + "Value": 0, + "Description": "Disable OneDrive/Sync provider ads in Explorer" + }, + "Start_TrackProgs": { + "Type": "DWord", + "Value": 0, + "Description": "Disable app launch tracking for Start/Search improvements" + } + }, + "HKCU:\\Control Panel\\International\\User Profile": { + "HttpAcceptLanguageOptOut": { + "Type": "DWord", + "Value": 1, + "Description": "Disable websites accessing language list" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\ContentDeliveryManager": { + "ContentDeliveryAllowed": { + "Type": "DWord", + "Value": 0, + "Description": "Disable content delivery (suggested content)" + }, + "SubscribedContent-338393Enabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable suggested content in Settings app" + }, + "SubscribedContent-353694Enabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable suggested content in Settings app" + }, + "SubscribedContent-353696Enabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable suggested content in Settings app" + }, + "SubscribedContentEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable all subscribed content" + }, + "SystemPaneSuggestionsEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable system pane suggestions" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\SystemSettings\\AccountNotifications": { + "EnableAccountNotifications": { + "Type": "DWord", + "Value": 0, + "Description": "Disable notifications in Settings app" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\UserProfileEngagement": { + "ScoobeSystemSettingEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable 'Get the most out of Windows' suggestions" + } + } + }, + + "SearchAndCloud": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search": { + "DisableWebSearch": { + "Type": "DWord", + "Value": 1, + "Description": "No web search in Start menu" + }, + "ConnectedSearchUseWeb": { + "Type": "DWord", + "Value": 0, + "Description": "No connected search to web" + }, + "AllowCloudSearch": { + "Type": "DWord", + "Value": 0, + "Description": "No cloud search" + }, + "AllowCortana": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Cortana (legacy)" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Search": { + "BingSearchEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Bing search integration (user-level)" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\SearchSettings": { + "IsDynamicSearchBoxEnabled": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Search Highlights (trending topics, news)" + } + } + }, + + "InputAndSync": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\InputPersonalization": { + "AllowInputPersonalization": { + "Type": "DWord", + "Value": 0, + "Description": "No cloud-based input personalization" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System": { + "EnableActivityFeed": { + "Type": "DWord", + "Value": 0, + "Description": "Disable activity feed" + }, + "PublishUserActivities": { + "Type": "DWord", + "Value": 0, + "Description": "Don't publish user activities" + }, + "UploadUserActivities": { + "Type": "DWord", + "Value": 0, + "Description": "Don't upload user activities to cloud" + }, + "AllowCrossDeviceClipboard": { + "Type": "DWord", + "Value": 0, + "Description": "Disable cloud clipboard sync between devices" + }, + "AllowClipboardHistory": { + "Type": "DWord", + "Value": 1, + "Description": "Allow local clipboard history (Win+V works, no cloud sync)" + }, + "EnableCdp": { + "Type": "DWord", + "Value": 0, + "Description": "Disable cross-device experiences (Continue on PC)" + } + }, + "HKCU:\\SOFTWARE\\Microsoft\\InputPersonalization": { + "RestrictImplicitTextCollection": { + "Type": "DWord", + "Value": 1, + "Description": "Block typing data collection" + }, + "RestrictImplicitInkCollection": { + "Type": "DWord", + "Value": 1, + "Description": "Block inking/handwriting data collection" + } + }, + "HKCU:\\SOFTWARE\\Microsoft\\Personalization\\Settings": { + "AcceptedPrivacyPolicy": { + "Type": "DWord", + "Value": 0, + "Description": "Disable inking/typing personalization toggle in Settings" + } + }, + "HKCU:\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore": { + "HarvestContacts": { + "Type": "DWord", + "Value": 0, + "Description": "Don't harvest contacts for personalization" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\SettingSync": { + "DisableSettingSync": { + "Type": "DWord", + "Value": 1, + "Description": "Disable settings sync" + }, + "DisableSettingSyncUserOverride": { + "Type": "DWord", + "Value": 1, + "Description": "User cannot override sync disable" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Dsh": { + "AllowNewsAndInterests": { + "Type": "DWord", + "Value": 0, + "Description": "Disable Widgets/News and Interests" + } + } + }, + + "LocationAndAppPrivacy": { + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\LocationAndSensors": { + "DisableLocation": { + "Type": "DWord", + "Value": 1, + "Description": "Disable location services" + } + }, + "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy": { + "LetAppsAccessLocation": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny location access for apps" + }, + "LetAppsAccessRadios": { + "Type": "DWord", + "Value": 0, + "Description": "User decides radio (Bluetooth/WiFi) access" + }, + "LetAppsAccessCallHistory": { + "Type": "DWord", + "Value": 0, + "Description": "User decides call history access" + }, + "LetAppsAccessMicrophone": { + "Type": "DWord", + "Value": 0, + "Description": "User decides microphone access (keeps Teams/Zoom working)" + }, + "LetAppsAccessCamera": { + "Type": "DWord", + "Value": 0, + "Description": "User decides camera access (keeps video conferencing working)" + }, + "LetAppsAccessContacts": { + "Type": "DWord", + "Value": 0, + "Description": "User decides contacts access" + }, + "LetAppsAccessCalendar": { + "Type": "DWord", + "Value": 0, + "Description": "User decides calendar access" + }, + "LetAppsAccessEmail": { + "Type": "DWord", + "Value": 0, + "Description": "User decides email access" + }, + "LetAppsAccessMessaging": { + "Type": "DWord", + "Value": 0, + "Description": "User decides messaging access" + }, + "LetAppsAccessNotifications": { + "Type": "DWord", + "Value": 0, + "Description": "User decides notification access" + }, + "LetAppsAccessTrustedDevices": { + "Type": "DWord", + "Value": 0, + "Description": "User decides trusted devices access" + }, + "LetAppsSyncWithDevices": { + "Type": "DWord", + "Value": 0, + "Description": "User decides device sync" + }, + "LetAppsGetDiagnosticInfo": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny app diagnostics access" + }, + "LetAppsActivateWithVoice": { + "Type": "DWord", + "Value": 0, + "Description": "User decides voice activation access" + }, + "LetAppsAccessAccountInfo": { + "Type": "DWord", + "Value": 0, + "Description": "User decides account info access" + }, + "LetAppsAccessPhone": { + "Type": "DWord", + "Value": 0, + "Description": "User decides phone calls access" + }, + "LetAppsAccessTasks": { + "Type": "DWord", + "Value": 0, + "Description": "User decides tasks access" + }, + "LetAppsAccessGraphicsCaptureProgrammatic": { + "Type": "DWord", + "Value": 0, + "Description": "User decides screenshot/screen recording access" + }, + "LetAppsAccessGraphicsCaptureWithoutBorder": { + "Type": "DWord", + "Value": 0, + "Description": "User decides screenshot border access" + }, + "LetAppsAccessGenerativeAI": { + "Type": "DWord", + "Value": 2, + "Description": "Force Deny generative AI access" + } + }, + "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\appDiagnostics": { + "Value": { + "Type": "String", + "Value": "Deny", + "Description": "Deny app diagnostics access (UI toggle)" + } + }, + "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\appDiagnostics": { + "Value": { + "Type": "String", + "Value": "Deny", + "Description": "Deny app diagnostics access system-wide (UI toggle)" + } + } + }, + + "Services": [ + { + "Name": "DiagTrack", + "DisplayName": "Connected User Experiences and Telemetry", + "StartupType": "Disabled", + "Description": "Telemetry service - disabled in Strict mode" + }, + { + "Name": "dmwappushservice", + "DisplayName": "Device Management Wireless Application Protocol (WAP) Push message Routing Service", + "StartupType": "Disabled", + "Description": "WAP Push service - disabled in Strict mode" + } + ], + + "ScheduledTasks": [] +} diff --git a/Modules/Privacy/Privacy.psd1 b/Modules/Privacy/Privacy.psd1 new file mode 100644 index 0000000..e3c6192 --- /dev/null +++ b/Modules/Privacy/Privacy.psd1 @@ -0,0 +1,30 @@ +@{ + RootModule = 'Privacy.psm1' + ModuleVersion = '2.2.0' + GUID = 'a9f7c8d3-2e5b-4a1f-9c3d-7e8f5a6b2c4d' + Author = 'NexusOne23' + CompanyName = 'Open Source Project' + Copyright = '(c) 2025 NexusOne23. Licensed under GPL-3.0.' + Description = 'Privacy & Telemetry hardening module with Bloatware removal and OneDrive configuration. Supports 3 modes: MSRecommended (default), Strict (maximum privacy, apps still work), and Paranoid (hardcore).' + + PowerShellVersion = '5.1' + + FunctionsToExport = @( + 'Invoke-PrivacyHardening', + 'Restore-Bloatware', + 'Test-PrivacyCompliance' + ) + + CmdletsToExport = @() + VariablesToExport = @() + AliasesToExport = @() + + PrivateData = @{ + PSData = @{ + Tags = @('Privacy', 'Telemetry', 'Bloatware', 'OneDrive', 'Windows11', 'Security') + LicenseUri = 'https://github.com/yourusername/NoIDPrivacyPro/blob/main/LICENSE' + ProjectUri = 'https://github.com/yourusername/NoIDPrivacyPro' + ReleaseNotes = 'Initial release - Privacy module with 3-mode support' + } + } +} diff --git a/Modules/Privacy/Privacy.psm1 b/Modules/Privacy/Privacy.psm1 new file mode 100644 index 0000000..180c4c0 --- /dev/null +++ b/Modules/Privacy/Privacy.psm1 @@ -0,0 +1,71 @@ +#Requires -Version 5.1 +#Requires -RunAsAdministrator + +<# +.SYNOPSIS + Privacy & Telemetry hardening module loader + +.DESCRIPTION + Loads all Privacy module functions for Windows 11 telemetry control, + personalization settings, bloatware removal, and OneDrive configuration. + + Supports 3 operating modes: + - MSRecommended: Fully supported by Microsoft (default) + - Strict: Maximum privacy (AllowTelemetry=0 only on Enterprise/Education, other settings work everywhere) + - Paranoid: Hardcore mode (not recommended) + +.NOTES + Module: Privacy + Version: 2.2.0 + Author: NoID Privacy +#> + +# Get module root path +$script:ModuleRoot = $PSScriptRoot + +# Import private functions +$privateFunctions = @( + 'Backup-PrivacySettings', + 'Restore-PrivacySettings', + 'Set-TelemetrySettings', + 'Set-PersonalizationSettings', + 'Set-AppPrivacySettings', + 'Set-OneDriveSettings', + 'Set-PolicyBasedAppRemoval', + 'Disable-TelemetryServices', + 'Disable-TelemetryTasks', + 'Remove-Bloatware' +) + +foreach ($function in $privateFunctions) { + $functionPath = Join-Path $ModuleRoot "Private\$function.ps1" + if (Test-Path $functionPath) { + . $functionPath + } +} + +# Import Test-PrivacyCompliance (located in module root) +$testCompliancePath = Join-Path $ModuleRoot "Test-PrivacyCompliance.ps1" +if (Test-Path $testCompliancePath) { + . $testCompliancePath +} + +# Import public functions +$publicFunctions = @( + 'Invoke-PrivacyHardening', + 'Restore-Bloatware' +) + +foreach ($function in $publicFunctions) { + $functionPath = Join-Path $ModuleRoot "Public\$function.ps1" + if (Test-Path $functionPath) { + . $functionPath + } +} + +# Export public functions + Test-PrivacyCompliance (needed for Invoke-PrivacyHardening verification) +Export-ModuleMember -Function @($publicFunctions + 'Test-PrivacyCompliance') + +# Alias for naming consistency (non-breaking change) +New-Alias -Name 'Invoke-Privacy' -Value 'Invoke-PrivacyHardening' -Force +Export-ModuleMember -Alias 'Invoke-Privacy' diff --git a/Modules/Privacy/Private/Backup-PrivacySettings.ps1 b/Modules/Privacy/Private/Backup-PrivacySettings.ps1 new file mode 100644 index 0000000..1ba31fe --- /dev/null +++ b/Modules/Privacy/Private/Backup-PrivacySettings.ps1 @@ -0,0 +1,179 @@ +function Backup-PrivacySettings { + <# + .SYNOPSIS + Backup all privacy-related settings using Session-based backup system + + .DESCRIPTION + Creates a complete backup of all settings that will be modified by the Privacy module: + - Registry keys (all categories) + - Service startup types + - Scheduled task states + - Installed AppxPackages list + + Uses Core/Rollback.ps1 Register-Backup for Session-based backup. + + .EXAMPLE + Backup-PrivacySettings + #> + [CmdletBinding()] + param() + + try { + Write-Log -Level INFO -Message "Starting privacy settings backup (Session-based)..." -Module "Privacy" + + # Registry keys to backup using Core/Rollback.ps1 + $registryKeys = @( + # HKLM Policy Keys + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Search", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer", + "HKLM:\SOFTWARE\Policies\Microsoft\InputPersonalization", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\SettingSync", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors", + "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppPrivacy", + "HKLM:\SOFTWARE\Policies\Microsoft\OneDrive", + "HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore", + "HKLM:\SOFTWARE\Policies\Microsoft\Dsh", + "HKLM:\SOFTWARE\Policies\Microsoft\FindMyDevice", + "HKLM:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics", + # HKCU User Keys + "HKCU:\Software\Policies\Microsoft\Windows\Explorer", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo", + # NEW: Anti-Advertising & Search Settings (v2.2.0) + "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\SearchSettings", + "HKCU:\Control Panel\International\User Profile", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\SystemSettings\AccountNotifications", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement", + "HKCU:\SOFTWARE\Microsoft\Personalization\Settings", + # NEW: Input Personalization Settings (v2.2.0 - FIX missing HKCU backup) + "HKCU:\SOFTWARE\Microsoft\InputPersonalization", + "HKCU:\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore", + "HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics" + ) + + # Backup registry keys using Session system (.reg files for reference) + $backupCount = 0 + foreach ($key in $registryKeys) { + $keyName = $key -replace "[:\\]", "_" -replace "^HKLM_", "" -replace "^HKCU_", "USER_" + try { + $result = Backup-RegistryKey -KeyPath $key -BackupName $keyName + if ($result) { + $backupCount++ + Write-Log -Level DEBUG -Message "Backed up registry key: $key" -Module "Privacy" + } + } catch { + Write-Log -Level WARNING -Message "Failed to backup registry key $key : $_" -Module "Privacy" + } + } + + # CRITICAL: Create JSON snapshot of all registry values for precise restore + # This counters GPO tattooing and ensures values not in backup get deleted + Write-Log -Level INFO -Message "Creating Privacy registry pre-state snapshot (JSON)..." -Module "Privacy" + $preStateSnapshot = @() + + foreach ($key in $registryKeys) { + if (Test-Path $key) { + try { + $properties = Get-ItemProperty -Path $key -ErrorAction Stop + $propertyNames = $properties.PSObject.Properties.Name | Where-Object { $_ -notin @('PSPath', 'PSParentPath', 'PSChildName', 'PSProvider') } + + foreach ($propName in $propertyNames) { + $propValue = $properties.$propName + $propType = (Get-Item $key).GetValueKind($propName) + + $preStateSnapshot += [PSCustomObject]@{ + Path = $key + Name = $propName + Value = $propValue + Type = $propType.ToString() + Exists = $true + } + } + } catch { + Write-Log -Level DEBUG -Message "Could not read properties from $key : $_" -Module "Privacy" + } + } + } + + # Save JSON snapshot + try { + $snapshotJson = $preStateSnapshot | ConvertTo-Json -Depth 5 + $result = Register-Backup -Type "Privacy" -Data $snapshotJson -Name "Privacy_PreState" + if ($result) { + $backupCount++ + Write-Log -Level SUCCESS -Message "Privacy pre-state snapshot created ($($preStateSnapshot.Count) registry values)" -Module "Privacy" + } + } catch { + Write-Log -Level WARNING -Message "Failed to create Privacy pre-state snapshot: $_" -Module "Privacy" + } + + # Backup service states using Session system + $services = @("DiagTrack", "dmwappushservice", "WerSvc") + foreach ($serviceName in $services) { + try { + $result = Backup-ServiceConfiguration -ServiceName $serviceName + if ($result) { + $backupCount++ + Write-Log -Level DEBUG -Message "Backed up service: $serviceName" -Module "Privacy" + } + } catch { + Write-Log -Level WARNING -Message "Failed to backup service $serviceName : $_" -Module "Privacy" + } + } + + # Backup scheduled task states using Session system + $tasks = @( + "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser", + "\Microsoft\Windows\Application Experience\ProgramDataUpdater", + "\Microsoft\Windows\Application Experience\StartupAppTask", + "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator", + "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip", + "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" + ) + + foreach ($taskPath in $tasks) { + try { + $result = Backup-ScheduledTask -TaskPath $taskPath + if ($result) { + $backupCount++ + Write-Log -Level DEBUG -Message "Backed up task: $taskPath" -Module "Privacy" + } + # If $result is $null, task doesn't exist (already logged as DEBUG by Backup-ScheduledTask) + } catch { + Write-Log -Level WARNING -Message "Unexpected error backing up task: $taskPath - $_" -Module "Privacy" + } + } + + # Backup installed AppxPackages list for bloatware restore reference + try { + $installedApps = Get-AppxPackage -AllUsers | Select-Object Name, Version, PackageFullName, Publisher + $appBackupData = @{ + BackupDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + AppsCount = $installedApps.Count + Apps = $installedApps + } + + $appBackupJson = $appBackupData | ConvertTo-Json -Depth 5 + $result = Register-Backup -Type "AppxPackages" -Data $appBackupJson -Name "InstalledApps" + if ($result) { + $backupCount++ + Write-Log -Level INFO -Message "Backed up installed AppxPackages list ($($installedApps.Count) apps)" -Module "Privacy" + } + } catch { + Write-Log -Level WARNING -Message "Failed to backup AppxPackages list: $_" -Module "Privacy" + } + + Write-Log -Level SUCCESS -Message "Privacy settings backup completed ($backupCount items backed up)" -Module "Privacy" + return $backupCount + + } catch { + Write-Log -Level ERROR -Message "Failed to backup privacy settings: $_" -Module "Privacy" + return $false + } +} diff --git a/Modules/Privacy/Private/Disable-TelemetryServices.ps1 b/Modules/Privacy/Private/Disable-TelemetryServices.ps1 new file mode 100644 index 0000000..cbbe2c0 --- /dev/null +++ b/Modules/Privacy/Private/Disable-TelemetryServices.ps1 @@ -0,0 +1,22 @@ +function Disable-TelemetryServices { + [CmdletBinding()] + param([Parameter(Mandatory = $true)][array]$Services) + + try { + Write-Log -Level INFO -Message "Disabling telemetry services..." -Module "Privacy" + + foreach ($serviceConfig in $Services) { + $service = Get-Service -Name $serviceConfig.Name -ErrorAction SilentlyContinue + if ($service) { + Stop-Service -Name $serviceConfig.Name -Force -ErrorAction SilentlyContinue + Set-Service -Name $serviceConfig.Name -StartupType Disabled -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Disabled service: $($serviceConfig.Name)" -Module "Privacy" + } + } + + return $true + } catch { + Write-Log -Level ERROR -Message "Failed to disable services: $_" -Module "Privacy" + return $false + } +} diff --git a/Modules/Privacy/Private/Disable-TelemetryTasks.ps1 b/Modules/Privacy/Private/Disable-TelemetryTasks.ps1 new file mode 100644 index 0000000..cb95f1f --- /dev/null +++ b/Modules/Privacy/Private/Disable-TelemetryTasks.ps1 @@ -0,0 +1,22 @@ +function Disable-TelemetryTasks { + [CmdletBinding()] + param([Parameter(Mandatory = $true)][array]$Tasks) + + try { + Write-Log -Level INFO -Message "Disabling scheduled tasks..." -Module "Privacy" + + foreach ($taskPath in $Tasks) { + try { + Disable-ScheduledTask -TaskPath (Split-Path $taskPath -Parent) -TaskName (Split-Path $taskPath -Leaf) -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Disabled task: $taskPath" -Module "Privacy" + } catch { + Write-Log -Level WARNING -Message "Task not found or cannot disable: $taskPath" -Module "Privacy" + } + } + + return $true + } catch { + Write-Log -Level ERROR -Message "Failed to disable tasks: $_" -Module "Privacy" + return $false + } +} diff --git a/Modules/Privacy/Private/Remove-Bloatware.ps1 b/Modules/Privacy/Private/Remove-Bloatware.ps1 new file mode 100644 index 0000000..e085a51 --- /dev/null +++ b/Modules/Privacy/Private/Remove-Bloatware.ps1 @@ -0,0 +1,361 @@ +function Remove-Bloatware { + <# + .SYNOPSIS + Remove bloatware apps using best method for current Windows version + + .DESCRIPTION + Hybrid approach: + - Windows 11 25H2+ Enterprise/Education: Uses policy-based removal (MS recommended) + - Other versions/editions: Uses classic PowerShell removal + + .PARAMETER Method + Force specific method: Auto (default), Policy, or Classic + + .EXAMPLE + Remove-Bloatware + Remove-Bloatware -Method Policy + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [ValidateSet("Auto", "Policy", "Classic")] + [string]$Method = "Auto" + ) + + try { + Write-Log -Level INFO -Message "Starting bloatware removal..." -Module "Privacy" + + # Load configuration + $configPath = Join-Path $PSScriptRoot "..\Config\Bloatware.json" + $config = Get-Content $configPath -Raw | ConvertFrom-Json + + # Determine method if Auto + if ($Method -eq "Auto") { + # Check OS version and edition + $osInfo = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" + $displayVersion = $osInfo.DisplayVersion + $currentBuild = [int]$osInfo.CurrentBuild + + # Get edition - try Get-WindowsEdition first, fallback to registry + try { + $osEdition = (Get-WindowsEdition -Online -ErrorAction Stop).Edition + } + catch { + # Fallback to registry if Get-WindowsEdition fails + $osEdition = $osInfo.EditionID + if (-not $osEdition) { + $osEdition = (Get-ComputerInfo -Property WindowsEditionId -ErrorAction SilentlyContinue).WindowsEditionId + } + } + + Write-Log -Level INFO -Message "Detected: Windows $displayVersion (Build $currentBuild), Edition: $osEdition" -Module "Privacy" + + # Check if policy-based removal is supported + $policySupported = $false + if ($currentBuild -ge $config.PolicyMethod.MinBuild) { + foreach ($supportedEdition in $config.PolicyMethod.SupportedEditions) { + if ($osEdition -like "*$supportedEdition*") { + $policySupported = $true + break + } + } + } + + if ($policySupported) { + $Method = "Policy" + Write-Log -Level INFO -Message "Policy-based removal supported - using official MS method" -Module "Privacy" + } + else { + $Method = "Classic" + Write-Log -Level INFO -Message "Policy-based removal not supported - using classic PowerShell method" -Module "Privacy" + if ($currentBuild -lt $config.PolicyMethod.MinBuild) { + Write-Log -Level INFO -Message "Reason: Build $currentBuild < $($config.PolicyMethod.MinBuild) (25H2)" -Module "Privacy" + } + else { + Write-Log -Level INFO -Message "Reason: Edition '$osEdition' not in supported list (Enterprise/Education only)" -Module "Privacy" + } + } + } + + # Execute selected method + if ($Method -eq "Policy") { + return Remove-BloatwarePolicy + } + else { + return Remove-BloatwareClassic + } + + } + catch { + Write-Log -Level ERROR -Message "Failed to remove bloatware: $_" -Module "Privacy" + return $false + } +} + +function Remove-BloatwarePolicy { + <# + .SYNOPSIS + Remove apps using policy-based method (Win11 25H2+ ENT/EDU) + #> + [CmdletBinding()] + param() + + try { + Write-Host "`n============================================" -ForegroundColor Cyan + Write-Host " POLICY-BASED APP REMOVAL (MS OFFICIAL)" -ForegroundColor Cyan + Write-Host "============================================`n" -ForegroundColor Cyan + + $result = Set-PolicyBasedAppRemoval + + if ($result) { + Write-Log -Level SUCCESS -Message "Policy-based bloatware removal configured successfully" -Module "Privacy" + } + + return $result + + } + catch { + Write-Log -Level ERROR -Message "Policy-based removal failed: $_" -Module "Privacy" + return $false + } +} + +function Remove-BloatwareClassic { + <# + .SYNOPSIS + Remove apps using classic PowerShell method + #> + [CmdletBinding()] + param() + + try { + Write-Host "`n============================================" -ForegroundColor Cyan + Write-Host " CLASSIC POWERSHELL APP REMOVAL" -ForegroundColor Cyan + Write-Host "============================================`n" -ForegroundColor Cyan + + $configPath = Join-Path $PSScriptRoot "..\Config\Bloatware.json" + $config = Get-Content $configPath -Raw | ConvertFrom-Json + + $classicMethod = $config.ClassicMethod + $removed = 0 + $failed = 0 + $removedApps = @() # Track removed apps for user info + + # Performance Optimization: Get all apps once instead of calling for each pattern + # This reduces execution time from ~30 seconds to ~3 seconds (10x faster!) + Write-Host " Enumerating installed apps..." -ForegroundColor Gray + $allInstalledApps = @(Get-AppxPackage -AllUsers -ErrorAction SilentlyContinue) + Write-Host " Found $($allInstalledApps.Count) installed apps" -ForegroundColor Gray + + Write-Host " Enumerating provisioned packages..." -ForegroundColor Gray + try { + $allProvisionedApps = @(Get-AppxProvisionedPackage -Online -ErrorAction Stop) + Write-Host " Found $($allProvisionedApps.Count) provisioned packages`n" -ForegroundColor Gray + } + catch { + $allProvisionedApps = @() + Write-Log -Level WARNING -Message "Failed to enumerate provisioned packages: $_" -Module "Privacy" + } + + # Apps that CANNOT be reinstalled via winget - skip completely + # Xbox Gaming apps and Solitaire are not in winget msstore catalog + $nonRestorableApps = @( + 'Microsoft.Xbox.TCUI', + 'Microsoft.XboxSpeechToTextOverlay', + 'Microsoft.MicrosoftSolitaireCollection' + ) + + foreach ($appPattern in $classicMethod.RemoveApps) { + # Skip apps that cannot be reinstalled via winget (Xbox Gaming apps, Solitaire) + if ($nonRestorableApps -contains $appPattern) { + Write-Log -Level INFO -Message "Skipping non-restorable app: $appPattern (not in winget msstore)" -Module "Privacy" + continue + } + + # Check if app is protected + $isProtected = $false + foreach ($protectedApp in $classicMethod.ProtectedApps) { + if ($appPattern -like $protectedApp) { + $isProtected = $true + break + } + } + + if ($isProtected) { + Write-Log -Level INFO -Message "Skipping protected app: $appPattern" -Module "Privacy" + continue + } + + # Filter from cached list (fast!) instead of calling Get-AppxPackage again + $apps = @($allInstalledApps | Where-Object { $_.Name -like $appPattern }) + foreach ($app in $apps) { + if ($classicMethod.ProtectedApps -notcontains $app.Name) { + try { + Remove-AppxPackage -Package $app.PackageFullName -AllUsers -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Removed: $($app.Name)" -Module "Privacy" + Write-Host " [OK] $($app.Name)" -ForegroundColor Green + $removedApps += $app.Name # Track for user info + $removed++ + } + catch { + Write-Log -Level WARNING -Message "Failed to remove $($app.Name): $_" -Module "Privacy" + Write-Host " [FAIL] $($app.Name)" -ForegroundColor Red + $failed++ + } + } + } + + # Filter provisioned apps from cached list (fast!) + $provisionedApps = @($allProvisionedApps | Where-Object { $_.DisplayName -like $appPattern }) + foreach ($app in $provisionedApps) { + # ========================================================================= + # LEGACY: Skip deprovisioning for Xbox framework components + # ========================================================================= + # NOTE: Xbox.TCUI and XboxSpeechToTextOverlay are NO LONGER in the removal + # list because they are non-removable framework components that CANNOT be + # reinstalled once removed. This code remains as a safety measure in case + # someone manually adds them back to the JSON. + # ========================================================================= + $skipDeprovision = @( + 'Microsoft.Xbox.TCUI', + 'Microsoft.XboxSpeechToTextOverlay' + ) + + if ($skipDeprovision -contains $app.DisplayName) { + Write-Log -Level INFO -Message "Skipping deprovision for $($app.DisplayName) (allows restore via Gaming Services)" -Module "Privacy" + continue + } + + # Double-check: Verify package still exists before removal attempt + # This prevents "path not found" errors when Remove-AppxPackage -AllUsers already removed the provisioned package + $stillExists = Get-AppxProvisionedPackage -Online -ErrorAction SilentlyContinue | Where-Object { $_.PackageName -eq $app.PackageName } + + if ($stillExists) { + try { + Remove-AppxProvisionedPackage -Online -PackageName $app.PackageName -ErrorAction Stop | Out-Null + Write-Log -Level SUCCESS -Message "Removed provisioned: $($app.DisplayName)" -Module "Privacy" + Write-Host " [OK] Provisioned: $($app.DisplayName)" -ForegroundColor Green + } + catch { + Write-Log -Level WARNING -Message "Failed to remove provisioned $($app.DisplayName): $_" -Module "Privacy" + } + } + # else: Already removed by Remove-AppxPackage -AllUsers, skip silently + } + } + + Write-Host "`n============================================" -ForegroundColor Cyan + Write-Host " BLOATWARE REMOVAL COMPLETE" -ForegroundColor Cyan + Write-Host "============================================" -ForegroundColor Cyan + Write-Host " Removed: $removed apps" -ForegroundColor Green + if ($failed -gt 0) { + Write-Host " Failed: $failed apps" -ForegroundColor Red + } + elseif ($removed -eq 0) { + Write-Host " System already clean - no matching bloatware apps found" -ForegroundColor Green + } + Write-Host "" + + Write-Log -Level SUCCESS -Message "Classic bloatware removal complete ($removed removed, $failed failed)" -Module "Privacy" + + # --------------------------------------------------------- + # Generate Restore Metadata for Winget + # --------------------------------------------------------- + # Winget Store IDs for app restoration (verified 2025-12-08 against msstore source) + # Empty string = not available in winget catalog (user must reinstall manually) + # Xbox system components are handled via Gaming Services installation + $wingetMap = @{ + "Microsoft.BingNews" = "9WZDNCRFHVFW" + "Microsoft.BingWeather" = "9WZDNCRFJ3Q2" + "Microsoft.MicrosoftSolitaireCollection" = "" # Not in winget catalog + "Microsoft.MicrosoftStickyNotes" = "9NBLGGH4QGHW" + "Microsoft.GamingApp" = "9MV0B5HZVK9Z" + "Microsoft.XboxApp" = "9MV0B5HZVK9Z" + "Microsoft.XboxGamingOverlay" = "9NZKPSTSNW4P" + "Microsoft.XboxIdentityProvider" = "9WZDNCRD1HKW" # Dedicated Store ID (Xbox Identity Provider) + "Microsoft.XboxSpeechToTextOverlay" = "" # Framework component - NOT removed + "Microsoft.Xbox.TCUI" = "" # Framework component - NOT removed + "Microsoft.ZuneMusic" = "9WZDNCRFJ3PT" + "Microsoft.ZuneVideo" = "9WZDNCRFJ3PT" + "Microsoft.WindowsFeedbackHub" = "9NBLGGH4R32N" + "Microsoft.GetHelp" = "9PKDZBMV1H3T" + "Microsoft.Getstarted" = "" # Not in winget catalog + "Microsoft.MixedReality.Portal" = "9NG1H8B3ZC7M" + "Microsoft.People" = "" # Not in winget catalog + "Microsoft.YourPhone" = "9NMPJ99VJBWV" + "Clipchamp.Clipchamp" = "9P1J8S7CCWWT" + "SpotifyAB.SpotifyMusic" = "9NCBCSZSJRSB" + } + + $restoreList = @() + foreach ($app in $removedApps) { + $wingetId = "" + if ($wingetMap.ContainsKey($app)) { + $wingetId = $wingetMap[$app] + } + # Fallback: try to use package name if it looks like a valid ID + elseif ($app -match '^[a-zA-Z0-9]+\.[a-zA-Z0-9]+$') { + $wingetId = $app + } + + $restoreList += @{ + AppName = $app + WingetId = $wingetId + } + } + + if ($restoreList.Count -gt 0) { + try { + $restoreData = @{ + Apps = $restoreList + Timestamp = Get-Date -Format "o" + } + + # Use Register-Backup from Rollback core + if (Get-Command Register-Backup -ErrorAction SilentlyContinue) { + # Note: We save it directly to module backup folder with specific name expected by Restore-Bloatware + # Register-Backup usually creates timestamped names in Type folders + # Here we need a specific file in the Privacy backup root + + # Get current backup path for Privacy module + # We assume Start-ModuleBackup was called and context is set, or we find it + # But Register-Backup handles paths. Let's use Register-Backup with specific name. + # Restore-Bloatware expects "REMOVED_APPS_WINGET.json" in the backup root. + # Register-Backup creates "Type/Name.json". + + # Workaround: We write the file directly to the backup location if we can find it + # But we don't have easy access to the current backup path here except via Register-Backup return value? + # Let's use Register-Backup with Type="" (root) if possible, or just "Privacy"? + # No, Restore-Bloatware looks in $BackupPath (which is the module backup folder). + + # Let's write to a temp file and register it? No. + # Let's rely on Register-Backup creating "Privacy/REMOVED_APPS_WINGET.json" + # If we pass Type=".", it might work? + + # CRITICAL: Suppress output to prevent pipeline contamination (would make $bloatwareResult an array instead of single object) + [void](Register-Backup -Type "." -Data ($restoreData | ConvertTo-Json -Depth 5) -Name "REMOVED_APPS_WINGET") + } + } + catch { + Write-Log -Level WARNING -Message "Failed to save removed apps list for restore: $_" -Module "Privacy" + } + } + # --------------------------------------------------------- + + # Return list of removed apps for user info + return [PSCustomObject]@{ + Success = $true + RemovedApps = $removedApps + Count = $removed + } + + } + catch { + Write-Log -Level ERROR -Message "Classic removal failed: $_" -Module "Privacy" + return [PSCustomObject]@{ + Success = $false + RemovedApps = @() + Count = 0 + } + } +} diff --git a/Modules/Privacy/Private/Set-AppPrivacySettings.ps1 b/Modules/Privacy/Private/Set-AppPrivacySettings.ps1 new file mode 100644 index 0000000..30c90bc --- /dev/null +++ b/Modules/Privacy/Private/Set-AppPrivacySettings.ps1 @@ -0,0 +1,59 @@ +function Set-AppPrivacySettings { + [CmdletBinding()] + param([Parameter(Mandatory = $true)][PSCustomObject]$Config) + + try { + Write-Log -Level INFO -Message "Applying App Privacy + Search + Sync settings..." -Module "Privacy" + + # Search & Cloud + foreach ($keyPath in $Config.SearchAndCloud.PSObject.Properties.Name) { + if (!(Test-Path $keyPath)) { New-Item -Path $keyPath -Force | Out-Null } + foreach ($valueName in $Config.SearchAndCloud.$keyPath.PSObject.Properties.Name) { + $valueData = $Config.SearchAndCloud.$keyPath.$valueName + $existing = Get-ItemProperty -Path $keyPath -Name $valueName -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $keyPath -Name $valueName -Value $valueData.Value -Force | Out-Null + } else { + $propType = if ($valueData.Type -eq "DWord") { "DWord" } else { "String" } + New-ItemProperty -Path $keyPath -Name $valueName -Value $valueData.Value -PropertyType $propType -Force | Out-Null + } + } + } + + # Input & Sync + foreach ($keyPath in $Config.InputAndSync.PSObject.Properties.Name) { + if (!(Test-Path $keyPath)) { New-Item -Path $keyPath -Force | Out-Null } + foreach ($valueName in $Config.InputAndSync.$keyPath.PSObject.Properties.Name) { + $valueData = $Config.InputAndSync.$keyPath.$valueName + $existing = Get-ItemProperty -Path $keyPath -Name $valueName -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $keyPath -Name $valueName -Value $valueData.Value -Force | Out-Null + } else { + $propType = if ($valueData.Type -eq "DWord") { "DWord" } else { "String" } + New-ItemProperty -Path $keyPath -Name $valueName -Value $valueData.Value -PropertyType $propType -Force | Out-Null + } + } + } + + # Location & App Privacy + foreach ($keyPath in $Config.LocationAndAppPrivacy.PSObject.Properties.Name) { + if (!(Test-Path $keyPath)) { New-Item -Path $keyPath -Force | Out-Null } + foreach ($valueName in $Config.LocationAndAppPrivacy.$keyPath.PSObject.Properties.Name) { + $valueData = $Config.LocationAndAppPrivacy.$keyPath.$valueName + $existing = Get-ItemProperty -Path $keyPath -Name $valueName -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $keyPath -Name $valueName -Value $valueData.Value -Force | Out-Null + } else { + $propType = if ($valueData.Type -eq "DWord") { "DWord" } else { "String" } + New-ItemProperty -Path $keyPath -Name $valueName -Value $valueData.Value -PropertyType $propType -Force | Out-Null + } + } + } + + Write-Log -Level SUCCESS -Message "App Privacy settings applied" -Module "Privacy" + return $true + } catch { + Write-Log -Level ERROR -Message "Failed: $_" -Module "Privacy" + return $false + } +} diff --git a/Modules/Privacy/Private/Set-OneDriveSettings.ps1 b/Modules/Privacy/Private/Set-OneDriveSettings.ps1 new file mode 100644 index 0000000..6dbd1d4 --- /dev/null +++ b/Modules/Privacy/Private/Set-OneDriveSettings.ps1 @@ -0,0 +1,45 @@ +function Set-OneDriveSettings { + [CmdletBinding()] + param() + + try { + Write-Log -Level INFO -Message "Applying OneDrive + Store settings..." -Module "Privacy" + + $configPath = Join-Path $PSScriptRoot "..\Config\OneDrive.json" + $config = Get-Content $configPath -Raw | ConvertFrom-Json + + foreach ($keyPath in $config.OneDrivePolicies.PSObject.Properties.Name) { + if (!(Test-Path $keyPath)) { New-Item -Path $keyPath -Force | Out-Null } + foreach ($valueName in $config.OneDrivePolicies.$keyPath.PSObject.Properties.Name) { + $valueData = $config.OneDrivePolicies.$keyPath.$valueName + $existing = Get-ItemProperty -Path $keyPath -Name $valueName -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $keyPath -Name $valueName -Value $valueData.Value -Force | Out-Null + } else { + $propType = if ($valueData.Type -eq "DWord") { "DWord" } else { "String" } + New-ItemProperty -Path $keyPath -Name $valueName -Value $valueData.Value -PropertyType $propType -Force | Out-Null + } + } + } + + foreach ($keyPath in $config.StorePolicies.PSObject.Properties.Name) { + if (!(Test-Path $keyPath)) { New-Item -Path $keyPath -Force | Out-Null } + foreach ($valueName in $config.StorePolicies.$keyPath.PSObject.Properties.Name) { + $valueData = $config.StorePolicies.$keyPath.$valueName + $existing = Get-ItemProperty -Path $keyPath -Name $valueName -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $keyPath -Name $valueName -Value $valueData.Value -Force | Out-Null + } else { + $propType = if ($valueData.Type -eq "DWord") { "DWord" } else { "String" } + New-ItemProperty -Path $keyPath -Name $valueName -Value $valueData.Value -PropertyType $propType -Force | Out-Null + } + } + } + + Write-Log -Level SUCCESS -Message "OneDrive + Store settings applied" -Module "Privacy" + return $true + } catch { + Write-Log -Level ERROR -Message "Failed: $_" -Module "Privacy" + return $false + } +} diff --git a/Modules/Privacy/Private/Set-PersonalizationSettings.ps1 b/Modules/Privacy/Private/Set-PersonalizationSettings.ps1 new file mode 100644 index 0000000..1f9077a --- /dev/null +++ b/Modules/Privacy/Private/Set-PersonalizationSettings.ps1 @@ -0,0 +1,28 @@ +function Set-PersonalizationSettings { + [CmdletBinding()] + param([Parameter(Mandatory = $true)][PSCustomObject]$Config) + + try { + Write-Log -Level INFO -Message "Applying personalization settings..." -Module "Privacy" + + foreach ($keyPath in $Config.Personalization.PSObject.Properties.Name) { + if (!(Test-Path $keyPath)) { New-Item -Path $keyPath -Force | Out-Null } + foreach ($valueName in $Config.Personalization.$keyPath.PSObject.Properties.Name) { + $valueData = $Config.Personalization.$keyPath.$valueName + $existing = Get-ItemProperty -Path $keyPath -Name $valueName -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $keyPath -Name $valueName -Value $valueData.Value -Force | Out-Null + } else { + $propType = if ($valueData.Type -eq "DWord") { "DWord" } else { "String" } + New-ItemProperty -Path $keyPath -Name $valueName -Value $valueData.Value -PropertyType $propType -Force | Out-Null + } + } + } + + Write-Log -Level SUCCESS -Message "Personalization settings applied" -Module "Privacy" + return $true + } catch { + Write-Log -Level ERROR -Message "Failed: $_" -Module "Privacy" + return $false + } +} diff --git a/Modules/Privacy/Private/Set-PolicyBasedAppRemoval.ps1 b/Modules/Privacy/Private/Set-PolicyBasedAppRemoval.ps1 new file mode 100644 index 0000000..f816ed2 --- /dev/null +++ b/Modules/Privacy/Private/Set-PolicyBasedAppRemoval.ps1 @@ -0,0 +1,117 @@ +function Set-PolicyBasedAppRemoval { + <# + .SYNOPSIS + Configure policy-based inbox app removal for Windows 11 25H2+ Enterprise/Education + + .DESCRIPTION + Uses Microsoft's official RemoveDefaultMicrosoftStorePackages policy to remove + preinstalled apps at the policy level. This is the recommended method for Win11 25H2+. + + Registry structure: + HKLM\SOFTWARE\Policies\Microsoft\Windows\Appx\RemoveDefaultMicrosoftStorePackages + Enabled = 1 (DWORD) + (subkey) + RemovedPackage = 1 (DWORD) + + .EXAMPLE + Set-PolicyBasedAppRemoval + + .NOTES + Requires Windows 11 25H2+ Enterprise or Education edition + Apps are removed at next sign-in or OOBE + While policy is active, removed apps cannot be reinstalled + #> + [CmdletBinding()] + param() + + try { + Write-Log -Level INFO -Message "Configuring policy-based inbox app removal..." -Module "Privacy" + + # Load configuration + $configPath = Join-Path $PSScriptRoot "..\Config\Bloatware.json" + $config = Get-Content $configPath -Raw | ConvertFrom-Json + + $policyMethod = $config.PolicyMethod + $policyConfiguredApps = @() # Track apps configured for removal + $registryPath = $policyMethod.RegistryPath + + # Create root policy key if not exists + if (!(Test-Path $registryPath)) { + New-Item -Path $registryPath -Force | Out-Null + Write-Log -Level INFO -Message "Created policy key: $registryPath" -Module "Privacy" + } + + # Enable the policy + $existing = Get-ItemProperty -Path $registryPath -Name "Enabled" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $registryPath -Name "Enabled" -Value 1 -Force | Out-Null + } else { + New-ItemProperty -Path $registryPath -Name "Enabled" -Value 1 -PropertyType DWord -Force | Out-Null + } + Write-Log -Level SUCCESS -Message "Policy enabled: RemoveDefaultMicrosoftStorePackages" -Module "Privacy" + + # Configure each app + $appsToRemove = @() + foreach ($appId in $policyMethod.Apps.PSObject.Properties.Name) { + $shouldRemove = $policyMethod.Apps.$appId + + if ($shouldRemove) { + # Create subkey for app + $appKeyPath = Join-Path $registryPath $appId + if (!(Test-Path $appKeyPath)) { + New-Item -Path $appKeyPath -Force | Out-Null + } + + # Set RemovedPackage flag + $existing = Get-ItemProperty -Path $appKeyPath -Name "RemovedPackage" -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $appKeyPath -Name "RemovedPackage" -Value 1 -Force | Out-Null + } else { + New-ItemProperty -Path $appKeyPath -Name "RemovedPackage" -Value 1 -PropertyType DWord -Force | Out-Null + } + + $packageName = $policyMethod.AppMapping.$appId + Write-Log -Level SUCCESS -Message "Marked for removal: $appId ($packageName)" -Module "Privacy" + $appsToRemove += $appId + $policyConfiguredApps += $packageName # Track readable app name + } else { + # Ensure app is NOT marked for removal (defensive) + $appKeyPath = Join-Path $registryPath $appId + if (Test-Path $appKeyPath) { + Remove-Item -Path $appKeyPath -Recurse -Force + Write-Log -Level INFO -Message "Ensured NOT removed: $appId" -Module "Privacy" + } + } + } + + Write-Host "`n============================================" -ForegroundColor Cyan + Write-Host " POLICY-BASED APP REMOVAL CONFIGURED" -ForegroundColor Cyan + Write-Host "============================================" -ForegroundColor Cyan + Write-Host "`nApps marked for removal: $($appsToRemove.Count)" -ForegroundColor Green + foreach ($app in $appsToRemove) { + Write-Host " - $app" -ForegroundColor Gray + } + Write-Host "`nNOTE: Apps will be removed at:" -ForegroundColor Yellow + Write-Host " - Next user sign-in" -ForegroundColor Gray + Write-Host " - OOBE (new device setup)" -ForegroundColor Gray + Write-Host " - After OS upgrade" -ForegroundColor Gray + Write-Host "`nWhile policy is active, removed apps CANNOT be reinstalled.`n" -ForegroundColor Yellow + + Write-Log -Level SUCCESS -Message "Policy-based app removal configured successfully" -Module "Privacy" + + # Return list of configured apps for user info + return [PSCustomObject]@{ + Success = $true + RemovedApps = $policyConfiguredApps + Count = $appsToRemove.Count + } + + } catch { + Write-Log -Level ERROR -Message "Failed to configure policy-based app removal: $_" -Module "Privacy" + return [PSCustomObject]@{ + Success = $false + RemovedApps = @() + Count = 0 + } + } +} diff --git a/Modules/Privacy/Private/Set-TelemetrySettings.ps1 b/Modules/Privacy/Private/Set-TelemetrySettings.ps1 new file mode 100644 index 0000000..10a4af6 --- /dev/null +++ b/Modules/Privacy/Private/Set-TelemetrySettings.ps1 @@ -0,0 +1,53 @@ +function Set-TelemetrySettings { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [PSCustomObject]$Config + ) + + try { + Write-Log -Level INFO -Message "Applying telemetry settings ($($Config.Mode) mode)..." -Module "Privacy" + + # Debug: Check if DataCollection exists + if (-not $Config.DataCollection) { + Write-Log -Level ERROR -Message "DataCollection is NULL or empty in config!" -Module "Privacy" + Write-Log -Level DEBUG -Message "Config properties: $($Config.PSObject.Properties.Name -join ', ')" -Module "Privacy" + return $false + } + + $keyCount = @($Config.DataCollection.PSObject.Properties.Name).Count + Write-Log -Level DEBUG -Message "DataCollection has $keyCount registry keys to process" -Module "Privacy" + + foreach ($keyPath in $Config.DataCollection.PSObject.Properties.Name) { + $key = $keyPath + $values = $Config.DataCollection.$keyPath + + if (!(Test-Path $key)) { + New-Item -Path $key -Force | Out-Null + Write-Log -Level INFO -Message "Created registry key: $key" -Module "Privacy" + } + + foreach ($valueName in $values.PSObject.Properties.Name) { + $valueData = $values.$valueName + $existing = Get-ItemProperty -Path $key -Name $valueName -ErrorAction SilentlyContinue + if ($null -ne $existing) { + Set-ItemProperty -Path $key -Name $valueName -Value $valueData.Value -Force | Out-Null + } else { + $propType = switch ($valueData.Type) { + "DWord" { "DWord" } + "String" { "String" } + default { "DWord" } + } + New-ItemProperty -Path $key -Name $valueName -Value $valueData.Value -PropertyType $propType -Force | Out-Null + } + Write-Log -Level INFO -Message "Set $key\$valueName = $($valueData.Value) ($($valueData.Description))" -Module "Privacy" + } + } + + Write-Log -Level SUCCESS -Message "Telemetry settings applied successfully" -Module "Privacy" + return $true + } catch { + Write-Log -Level ERROR -Message "Failed to apply telemetry settings: $_" -Module "Privacy" + return $false + } +} diff --git a/Modules/Privacy/Public/Invoke-PrivacyHardening.ps1 b/Modules/Privacy/Public/Invoke-PrivacyHardening.ps1 new file mode 100644 index 0000000..757ff5d --- /dev/null +++ b/Modules/Privacy/Public/Invoke-PrivacyHardening.ps1 @@ -0,0 +1,507 @@ +function Invoke-PrivacyHardening { + <# + .SYNOPSIS + Apply privacy hardening with telemetry control, bloatware removal, and OneDrive configuration + + .DESCRIPTION + Interactive privacy hardening module with 3 operating modes: + - MSRecommended (default): Fully supported by Microsoft + - Strict: Maximum privacy for Enterprise/Edu + - Paranoid: Hardcore mode (not recommended) + + Follows Backup-Apply-Verify-Restore pattern for safety. + + .PARAMETER Mode + Privacy mode: MSRecommended, Strict, or Paranoid + + .PARAMETER DryRun + Show what would be done without making changes + + .EXAMPLE + Invoke-PrivacyHardening + + .EXAMPLE + Invoke-PrivacyHardening -Mode Strict + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [ValidateSet("MSRecommended", "Strict", "Paranoid")] + [string]$Mode, + + [Parameter(Mandatory = $false)] + [switch]$DryRun, + + [Parameter(Mandatory = $false)] + $RemoveBloatware + ) + + try { + # Core/Rollback.ps1 is loaded by Framework.ps1 - DO NOT load again here + # Loading it twice would reset $script:BackupBasePath and break the backup system! + + Write-Log -Level INFO -Message "Starting Privacy Hardening Module..." -Module "Privacy" + + # Mode selection - NonInteractive or Interactive + $modeConfirmed = $false + if (!$Mode) { + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - use config value + $Mode = Get-NonInteractiveValue -Module "Privacy" -Key "mode" -Default "MSRecommended" + Write-NonInteractiveDecision -Module "Privacy" -Decision "Privacy Mode" -Value $Mode + $modeConfirmed = $true + } + else { + # Interactive mode + while (-not $modeConfirmed) { + Write-Host "`n============================================" -ForegroundColor Cyan + Write-Host " PRIVACY HARDENING - MODE SELECTION" -ForegroundColor Cyan + Write-Host "============================================`n" -ForegroundColor Cyan + + Write-Host "Mode 1: MSRecommended (DEFAULT)" -ForegroundColor Green + Write-Host " - Fully supported by Microsoft" -ForegroundColor Gray + Write-Host " - AllowTelemetry = Required (1)" -ForegroundColor Gray + Write-Host " - Services NOT disabled" -ForegroundColor Gray + Write-Host " - AppPrivacy: User decides (all apps work)" -ForegroundColor Gray + Write-Host " - Best for: Production, business, MDM environments`n" -ForegroundColor Gray + + Write-Host "Mode 2: Strict" -ForegroundColor Yellow + Write-Host " - Maximum privacy (all editions)" -ForegroundColor Gray + Write-Host " - AllowTelemetry = Off (Enterprise/Edu only, Pro falls back)" -ForegroundColor Gray + Write-Host " - Services: DiagTrack + dmwappushservice disabled" -ForegroundColor Gray + Write-Host " - Force Deny: Location, App-Diagnose, Generative AI" -ForegroundColor Gray + Write-Host " - All other permissions: User decides (Teams/Zoom work!)" -ForegroundColor Gray + Write-Host " - Win+V clipboard: Works (local only, no cloud)" -ForegroundColor Gray + Write-Host " - Best for: Privacy-focused home users, small business`n" -ForegroundColor Gray + + Write-Host "Mode 3: Paranoid" -ForegroundColor Red + Write-Host " - Hardcore (NOT recommended)" -ForegroundColor Gray + Write-Host " - Everything from Strict + WerSvc disabled" -ForegroundColor Gray + Write-Host " - Tasks disabled (CEIP, AppExperience)" -ForegroundColor Gray + Write-Host " - Force Deny: ALL permissions (Mic, Camera, etc.)" -ForegroundColor Gray + Write-Host " - WARNING: BREAKS Teams/Zoom/Skype!" -ForegroundColor Red + Write-Host " - Best for: Air-gapped, kiosk, extreme privacy only`n" -ForegroundColor Gray + + do { + $modeSelection = Read-Host "Select mode [1-3, default: 1]" + if ([string]::IsNullOrWhiteSpace($modeSelection)) { $modeSelection = "1" } + + if ($modeSelection -notin @('1', '2', '3')) { + Write-Host "" + Write-Host "Invalid input. Please enter 1, 2, or 3." -ForegroundColor Red + Write-Host "" + } + } while ($modeSelection -notin @('1', '2', '3')) + + $Mode = switch ($modeSelection) { + "1" { "MSRecommended" } + "2" { "Strict" } + "3" { "Paranoid" } + } + Write-Host "`nSelected mode: $Mode`n" -ForegroundColor Cyan + Write-Log -Level DEBUG -Message "User selected privacy mode: $Mode" -Module "Privacy" + + # Load configuration for warnings + $configPath = Join-Path $PSScriptRoot "..\Config\Privacy-$Mode.json" + if (!(Test-Path $configPath)) { + Write-Log -Level ERROR -Message "Configuration file not found: $configPath" -Module "Privacy" + return [PSCustomObject]@{ Success = $false; Mode = $Mode; Error = "Config not found" } + } + + $privacyConfig = Get-Content $configPath -Raw | ConvertFrom-Json + + # Display warnings and confirm + if ($privacyConfig.Warnings.Count -gt 0) { + Write-Host "WARNINGS for $Mode mode:" -ForegroundColor Yellow + foreach ($warning in $privacyConfig.Warnings) { + Write-Host " - $warning" -ForegroundColor Yellow + } + Write-Host "" + + do { + $confirm = Read-Host "Do you want to continue? [Y/N] (default: Y)" + if ([string]::IsNullOrWhiteSpace($confirm)) { $confirm = "Y" } + $confirm = $confirm.ToUpper() + + if ($confirm -notin @('Y', 'N')) { + Write-Host "" + Write-Host "Invalid input. Please enter Y or N." -ForegroundColor Red + Write-Host "" + } + } while ($confirm -notin @('Y', 'N')) + + if ($confirm -eq "Y") { + $modeConfirmed = $true + } + else { + # Loop back to mode selection + $modeConfirmed = $false + Write-Host "" + Write-Host "Returning to mode selection..." -ForegroundColor Cyan + Write-Host "" + } + } + else { + # No warnings - confirm automatically + $modeConfirmed = $true + } + } + } + } + + # ALWAYS load config fresh when Mode is provided as parameter (NonInteractive/GUI mode) + # This fixes issues where stale/empty $config variable from previous runs caused problems + $configPath = Join-Path $PSScriptRoot "..\Config\Privacy-$Mode.json" + if (!(Test-Path $configPath)) { + Write-Log -Level ERROR -Message "Configuration file not found: $configPath" -Module "Privacy" + return [PSCustomObject]@{ Success = $false; Mode = $Mode; Error = "Config not found" } + } + + # Force fresh load - don't rely on potentially stale $config variable + $privacyConfig = Get-Content $configPath -Raw | ConvertFrom-Json + Write-Log -Level INFO -Message "Privacy config loaded: $configPath" -Module "Privacy" + + # Add Mode to config object + if ($privacyConfig.PSObject.Properties.Name -contains 'Mode') { + $privacyConfig.PSObject.Properties.Remove('Mode') + } + $privacyConfig | Add-Member -NotePropertyName 'Mode' -NotePropertyValue $Mode -Force + Write-Log -Level INFO -Message "Privacy mode: $($privacyConfig.Mode)" -Module "Privacy" + + # Use $privacyConfig instead of $config to avoid any scope issues + $config = $privacyConfig + + # MSRecommended only: Prompt for Cloud Clipboard (AllowCrossDeviceClipboard) + if ($Mode -eq "MSRecommended") { + $disableCloudClipboard = $null + + if (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - use config value if provided + $configCloudClipboard = Get-NonInteractiveValue -Module "Privacy" -Key "disableCloudClipboard" -Default $true + $disableCloudClipboard = if ($configCloudClipboard) { "Y" } else { "N" } + Write-NonInteractiveDecision -Module "Privacy" -Decision "Disable Cloud Clipboard" -Value $(if ($disableCloudClipboard -eq "Y") { "Yes" } else { "No" }) + } + else { + # Interactive prompt + Write-Host "`n============================================" -ForegroundColor Cyan + Write-Host " CLOUD CLIPBOARD SETTING" -ForegroundColor Cyan + Write-Host "============================================" -ForegroundColor Cyan + Write-Host "" + Write-Host "Cloud Clipboard syncs your clipboard between devices via Microsoft Cloud." -ForegroundColor Gray + Write-Host "This can be convenient but sends clipboard data (including passwords)" -ForegroundColor Gray + Write-Host "through Microsoft servers." -ForegroundColor Gray + Write-Host "" + Write-Host " Y = Disable Cloud Clipboard (recommended for privacy)" -ForegroundColor Green + Write-Host " N = Keep Cloud Clipboard enabled (for multi-device workflow)" -ForegroundColor Yellow + Write-Host "" + + do { + $disableCloudClipboard = Read-Host "Disable Cloud Clipboard? [Y/N] (default: Y)" + if ([string]::IsNullOrWhiteSpace($disableCloudClipboard)) { $disableCloudClipboard = "Y" } + $disableCloudClipboard = $disableCloudClipboard.ToUpper() + + if ($disableCloudClipboard -notin @('Y', 'N')) { + Write-Host "" + Write-Host "Invalid input. Please enter Y or N." -ForegroundColor Red + Write-Host "" + } + } while ($disableCloudClipboard -notin @('Y', 'N')) + } + + # Apply decision: if user wants to KEEP cloud clipboard, change the value to 1 + if ($disableCloudClipboard -eq "N") { + Write-Log -Level INFO -Message "User chose to KEEP Cloud Clipboard enabled" -Module "Privacy" + # Modify the config value to allow cloud clipboard + $systemPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" + if ($config.InputAndSync.PSObject.Properties.Name -contains $systemPath) { + $config.InputAndSync.$systemPath.AllowCrossDeviceClipboard.Value = 1 + } + } + else { + Write-Log -Level INFO -Message "User chose to DISABLE Cloud Clipboard" -Module "Privacy" + } + } + + if ($DryRun) { + Write-Log -Level INFO -Message "DRY RUN MODE - No changes will be made" -Module "Privacy" + return [PSCustomObject]@{ Success = $true; Mode = $Mode; VerificationPassed = $null } + } + + # PHASE 1: Initialize Session-based backup + Write-Host "`n[1/4] BACKUP - Initializing Session-based backup..." -ForegroundColor Cyan + $moduleBackupPath = $null + try { + Initialize-BackupSystem + $moduleBackupPath = Start-ModuleBackup -ModuleName "Privacy" + Write-Log -Level INFO -Message "Session backup initialized: $moduleBackupPath" -Module "Privacy" + } + catch { + Write-Log -Level WARNING -Message "Failed to initialize backup system: $_" -Module "Privacy" + Write-Log -Level WARNING -Message "Continuing without backup (RISKY!)" -Module "Privacy" + } + + # Create backup using Backup-PrivacySettings (uses Register-Backup internally) + if ($moduleBackupPath) { + Write-Host "Creating comprehensive backup..." -ForegroundColor Cyan + $backupResult = Backup-PrivacySettings + if ($backupResult -eq $false) { + Write-Log -Level ERROR -Message "Backup failed. Aborting operation." -Module "Privacy" + return [PSCustomObject]@{ Success = $false; Mode = $Mode; Error = "Backup failed" } + } + + # Register backup in session manifest + Complete-ModuleBackup -ItemsBackedUp $backupResult -Status "Success" + + Write-Log -Level INFO -Message "Backup completed: $backupResult items backed up" -Module "Privacy" + } + + # PHASE 2: APPLY + Write-Host "`n[2/4] APPLY - Applying privacy settings..." -ForegroundColor Cyan + + # Debug: Log config state before applying + Write-Log -Level DEBUG -Message "Config object type: $($config.GetType().FullName)" -Module "Privacy" + Write-Log -Level DEBUG -Message "Config properties: $($config.PSObject.Properties.Name -join ', ')" -Module "Privacy" + Write-Log -Level DEBUG -Message "Config.DataCollection type: $($config.DataCollection.GetType().FullName)" -Module "Privacy" + + # Apply settings + $results = @() + $results += Set-TelemetrySettings -Config $config + $results += Set-PersonalizationSettings -Config $config + $results += Set-AppPrivacySettings -Config $config + $results += Set-OneDriveSettings + + # Services (Strict/Paranoid only) + if ($config.Services.Count -gt 0) { + $results += Disable-TelemetryServices -Services $config.Services + } + + # Tasks (Paranoid only) + if ($config.ScheduledTasks.Count -gt 0) { + $results += Disable-TelemetryTasks -Tasks $config.ScheduledTasks + } + + # Bloatware removal + Write-Host "`n============================================" -ForegroundColor Cyan + Write-Host " BLOATWARE REMOVAL" -ForegroundColor Cyan + Write-Host "============================================" -ForegroundColor Cyan + Write-Host "" + Write-Host "CAN REMOVE (up to 24 apps, depending on edition and what is installed):" -ForegroundColor Yellow + Write-Host " - Games & Xbox: Solitaire, Xbox apps, Candy Crush, etc." -ForegroundColor Gray + Write-Host " - News & Weather: Bing News, Bing Weather, etc." -ForegroundColor Gray + Write-Host " - Others: Feedback Hub, Sticky Notes, Get Help, etc." -ForegroundColor Gray + Write-Host "" + Write-Host "WILL KEEP (protected):" -ForegroundColor Green + Write-Host " - Store, Calculator, Photos, Paint, Terminal" -ForegroundColor Gray + Write-Host " - All codec extensions (HEIF, WebP, AV1)" -ForegroundColor Gray + Write-Host "" + Write-Host "NOTE: Most removed apps can be auto-restored during session restore via winget" -ForegroundColor Cyan + Write-Host " where mappings exist. All removed apps are also listed in the backup folder" -ForegroundColor Cyan + Write-Host " so you can always reinstall them manually from the Microsoft Store if needed." -ForegroundColor Cyan + Write-Host "" + + if ($null -ne $RemoveBloatware) { + # Convert parameter to Y/N string (defensive: accept Boolean, String, or Number) + if ($RemoveBloatware -is [bool]) { + $removeBloatware = if ($RemoveBloatware) { "Y" } else { "N" } + } + elseif ($RemoveBloatware -is [string]) { + $removeBloatware = if ($RemoveBloatware -eq "Y" -or $RemoveBloatware -eq "yes" -or $RemoveBloatware -eq "true" -or $RemoveBloatware -eq "1") { "Y" } else { "N" } + } + elseif ($RemoveBloatware -is [int]) { + $removeBloatware = if ($RemoveBloatware -ne 0) { "Y" } else { "N" } + } + else { + # Unknown type - default to N + $removeBloatware = "N" + } + Write-Host "Using parameter for bloatware removal: $removeBloatware" -ForegroundColor Cyan + } + elseif (Test-NonInteractiveMode) { + # NonInteractive mode (GUI) - use config value + $configRemoveBloatware = Get-NonInteractiveValue -Module "Privacy" -Key "removeBloatware" -Default $true + $removeBloatware = if ($configRemoveBloatware) { "Y" } else { "N" } + Write-NonInteractiveDecision -Module "Privacy" -Decision "Bloatware removal" -Value $(if ($removeBloatware -eq "Y") { "Yes" } else { "No" }) + } + else { + do { + $removeBloatware = Read-Host "Continue with bloatware removal? [Y/N] (default: Y)" + if ([string]::IsNullOrWhiteSpace($removeBloatware)) { $removeBloatware = "Y" } + $removeBloatware = $removeBloatware.ToUpper() + + if ($removeBloatware -notin @('Y', 'N')) { + Write-Host "" + Write-Host "Invalid input. Please enter Y or N." -ForegroundColor Red + Write-Host "" + } + } while ($removeBloatware -notin @('Y', 'N')) + } + + if ($removeBloatware -eq "Y") { + Write-Log -Level DEBUG -Message "User selected: Remove bloatware apps" -Module "Privacy" + $bloatwareResult = Remove-Bloatware + if ($bloatwareResult.Success) { + if ($bloatwareResult.Count -gt 0) { + Write-Log -Level SUCCESS -Message "Bloatware removal completed ($($bloatwareResult.Count) apps)" -Module "Privacy" + } + else { + Write-Log -Level SUCCESS -Message "Bloatware removal completed - no matching apps found (system already clean)" -Module "Privacy" + Write-Host "`n System already clean - no matching bloatware apps found" -ForegroundColor Green + } + + # Save list of removed apps to backup folder for user reference + if ($moduleBackupPath -and $bloatwareResult.RemovedApps.Count -gt 0) { + try { + $bloatwareListPath = Join-Path $moduleBackupPath "REMOVED_APPS_LIST.txt" + $listContent = @() + $listContent += "================================================================" + $listContent += " REMOVED APPS - NoID Privacy v2.2.0" + $listContent += " Session: $(Split-Path $moduleBackupPath -Leaf)" + $listContent += " Date: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" + $listContent += "================================================================" + $listContent += "" + $listContent += "The following apps were removed by the Privacy module:" + $listContent += "" + foreach ($app in $bloatwareResult.RemovedApps) { + $listContent += " - $app" + } + $listContent += "" + $listContent += "================================================================" + $listContent += " HOW APPS ARE RESTORED" + $listContent += "================================================================" + $listContent += "" + $listContent += "Most removed apps will be automatically reinstalled during a" + $listContent += "session restore via 'winget' where mappings exist. This file" + $listContent += "serves as a complete reference of what was removed and can be" + $listContent += "used for manual reinstall if any apps remain missing." + $listContent += "" + $listContent += "If you need to reinstall apps manually from Microsoft Store:" + $listContent += "" + $listContent += "1. Open Microsoft Store (Windows key + S, search 'Store')" + $listContent += "2. Search for the app name (e.g., 'Xbox', 'Solitaire')" + $listContent += "3. Click 'Get' or 'Install' to reinstall" + $listContent += "" + + $listContent | Out-File -FilePath $bloatwareListPath -Encoding UTF8 -Force + Write-Log -Level INFO -Message "Removed apps list saved: $bloatwareListPath" -Module "Privacy" + Write-Host "`n [INFO] List of removed apps saved to backup folder" -ForegroundColor Cyan + Write-Host " $bloatwareListPath" -ForegroundColor Gray + } + catch { + Write-Log -Level WARNING -Message "Failed to save removed apps list: $_" -Module "Privacy" + } + + try { + $bloatwareMapPath = Join-Path $PSScriptRoot "..\Config\Bloatware-Map.json" + if (Test-Path $bloatwareMapPath) { + $bloatwareMap = Get-Content $bloatwareMapPath -Raw | ConvertFrom-Json + $mappings = $bloatwareMap.Mappings + $appsForJson = @() + foreach ($appName in ($bloatwareResult.RemovedApps | Sort-Object -Unique)) { + $wingetId = $null + if ($mappings -and ($mappings.PSObject.Properties.Name -contains $appName)) { + $wingetId = $mappings.$appName + Write-Log -Level INFO -Message "Winget mapping found for $appName -> $wingetId" -Module "Privacy" + } else { + # Special handling for Xbox framework components + if ($appName -match "Xbox\.TCUI|XboxIdentityProvider|XboxSpeechToTextOverlay") { + Write-Log -Level INFO -Message "$appName is a framework component - will be automatically restored when Gaming Services is installed (no user prompt required)" -Module "Privacy" + } + else { + Write-Log -Level WARNING -Message "No winget ID mapping for '$appName' - app may not be auto-restored (system component or manual reinstall required)" -Module "Privacy" + } + } + $appsForJson += [PSCustomObject]@{ + AppName = $appName + WingetId = $wingetId + } + } + if ($appsForJson.Count -gt 0) { + $restoreInfo = [PSCustomObject]@{ + Version = "1.0" + GeneratedAt = Get-Date -Format "o" + Apps = $appsForJson + } + $restoreInfoPath = Join-Path $moduleBackupPath "REMOVED_APPS_WINGET.json" + $restoreInfo | ConvertTo-Json -Depth 5 | Out-File -FilePath $restoreInfoPath -Encoding UTF8 -Force + Write-Log -Level INFO -Message "Winget restore metadata saved: $restoreInfoPath" -Module "Privacy" + } + } + else { + Write-Log -Level WARNING -Message "Bloatware-Map.json not found - skipping winget restore metadata" -Module "Privacy" + } + } + catch { + Write-Log -Level WARNING -Message "Failed to save winget restore metadata: $_" -Module "Privacy" + } + } + } + } + else { + Write-Host "`n [SKIPPED] Bloatware removal - keeping all apps" -ForegroundColor Yellow + Write-Log -Level DEBUG -Message "User selected: Keep bloatware apps" -Module "Privacy" + } + + # PHASE 3: VERIFY (informational only - not blocking) + Write-Host "`n[3/4] VERIFY - Checking applied settings..." -ForegroundColor Cyan + $verifyResult = Test-PrivacyCompliance -Config $config + + $verificationPassed = $true # Always pass - verification is informational + if ($verifyResult -is [PSCustomObject]) { + # Show result + $pct = $verifyResult.Percentage + if ($pct -ge 80) { + Write-Host " Compliance: $($verifyResult.Passed)/$($verifyResult.TotalChecks) checks passed ($pct%)" -ForegroundColor Green + Write-Log -Level SUCCESS -Message "Verification: $pct% compliance ($($verifyResult.Passed)/$($verifyResult.TotalChecks))" -Module "Privacy" + } + else { + Write-Host " Compliance: $($verifyResult.Passed)/$($verifyResult.TotalChecks) checks passed ($pct%)" -ForegroundColor Yellow + Write-Log -Level INFO -Message "Verification: $pct% compliance - some policies may be overridden by Group Policy" -Module "Privacy" + } + # Note: Failed checks are often due to GPO overrides or HKCU permission issues + # These are not critical - the settings were applied, just may not stick + if ($verifyResult.Failed -gt 0) { + Write-Log -Level INFO -Message "Note: $($verifyResult.Failed) setting(s) could not be verified (may be GPO-controlled or permission-restricted)" -Module "Privacy" + } + } + elseif ($verifyResult) { + Write-Log -Level SUCCESS -Message "Verification passed" -Module "Privacy" + } + else { + Write-Log -Level INFO -Message "Verification skipped" -Module "Privacy" + } + + # PHASE 4: COMPLETE + Write-Host "`n[4/4] COMPLETE - Privacy hardening finished!" -ForegroundColor Green + if ($moduleBackupPath) { + Write-Host "`nBackup location: $moduleBackupPath" -ForegroundColor Gray + Write-Host "This backup is part of your NoID Privacy session folder under Backups\\Session_\\Privacy\\" -ForegroundColor Gray + } + Write-Host "" + + Write-Log -Level SUCCESS -Message "Privacy hardening completed successfully in $Mode mode" -Module "Privacy" + + # GUI parsing marker for settings count (dynamically calculated) + $registryCount = if ($verifyResult -and $verifyResult.TotalChecks) { $verifyResult.TotalChecks } else { 0 } + $bloatwareCount = if ($bloatwareResult -and $bloatwareResult.Count) { $bloatwareResult.Count } else { 0 } + $totalApplied = $registryCount + $bloatwareCount + Write-Log -Level SUCCESS -Message "Applied $totalApplied settings" -Module "Privacy" + + # Return result object for consistency with other modules + return [PSCustomObject]@{ + Success = $true + Mode = $Mode + VerificationPassed = $verificationPassed + } + + } + catch { + Write-Log -Level ERROR -Message "Privacy hardening failed: $_" -Module "Privacy" + return [PSCustomObject]@{ + Success = $false + Mode = $Mode + BackupPath = $null + VerificationPassed = $false + Error = $_.Exception.Message + } + } +} diff --git a/Modules/Privacy/Public/Restore-Bloatware.ps1 b/Modules/Privacy/Public/Restore-Bloatware.ps1 new file mode 100644 index 0000000..fd55fc6 --- /dev/null +++ b/Modules/Privacy/Public/Restore-Bloatware.ps1 @@ -0,0 +1,293 @@ +function Restore-Bloatware { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$BackupPath + ) + + try { + # List of apps that CANNOT be restored via winget (no package available in msstore catalog) + # These will be removed during Apply, but user must reinstall manually from Microsoft Store + # Verified 2025-12-08: These specific apps have no winget msstore package + # Note: Xbox.TCUI, XboxSpeechToTextOverlay, and Solitaire are intentionally NOT removed during Apply + # (they cannot be reinstalled via winget once removed - must use Store manually) + $nonRestorableApps = @( + [PSCustomObject]@{ AppName = "Microsoft.Getstarted"; DisplayName = "Tips" } + # Microsoft.MicrosoftSolitaireCollection - NOW SKIPPED during Apply (not listed here) + [PSCustomObject]@{ AppName = "Microsoft.People"; DisplayName = "People" } + ) + + Write-Log -Level INFO -Message "Checking for removed apps to restore via winget..." -Module "Privacy" + + $restoreInfoPath = Join-Path $BackupPath "REMOVED_APPS_WINGET.json" + if (-not (Test-Path $restoreInfoPath)) { + Write-Log -Level INFO -Message "No removed apps restore info found at $restoreInfoPath - skipping app restore" -Module "Privacy" + return [PSCustomObject]@{ + Success = $true + NonRestorableApps = @() + } + } + + $restoreInfo = Get-Content $restoreInfoPath -Raw | ConvertFrom-Json + $apps = @($restoreInfo.Apps) + + if (-not $apps -or $apps.Count -eq 0) { + Write-Log -Level INFO -Message "Removed apps list is empty - nothing to restore" -Module "Privacy" + return [PSCustomObject]@{ + Success = $true + NonRestorableApps = @() + } + } + + # Filter out non-restorable apps before attempting restore + $nonRestorableAppNames = $nonRestorableApps.AppName + $skippedNonRestorableApps = @($apps | Where-Object { $nonRestorableAppNames -contains $_.AppName }) + $appsToRestore = @($apps | Where-Object { $nonRestorableAppNames -notcontains $_.AppName }) + + $appsWithWinget = $appsToRestore | Where-Object { $_.WingetId -and $_.WingetId -ne "" } + $appsWithoutWinget = $appsToRestore | Where-Object { -not $_.WingetId -or $_.WingetId -eq "" } + + if (-not $appsWithWinget -or $appsWithWinget.Count -eq 0) { + Write-Log -Level INFO -Message "No apps with valid WingetId to restore - skipping winget restore" -Module "Privacy" + + # Map skipped apps to display names + $skippedDisplayNames = @() + foreach ($skipped in $skippedNonRestorableApps) { + $displayName = ($nonRestorableApps | Where-Object { $_.AppName -eq $skipped.AppName }).DisplayName + if ($displayName) { $skippedDisplayNames += $displayName } + } + + return [PSCustomObject]@{ + Success = $true + NonRestorableApps = $skippedDisplayNames + } + } + + $wingetCmd = Get-Command winget -ErrorAction SilentlyContinue + if (-not $wingetCmd) { + Write-Log -Level WARNING -Message "winget not found - cannot automatically restore removed apps" -Module "Privacy" + + # Map skipped apps to display names + $skippedDisplayNames = @() + foreach ($skipped in $skippedNonRestorableApps) { + $displayName = ($nonRestorableApps | Where-Object { $_.AppName -eq $skipped.AppName }).DisplayName + if ($displayName) { $skippedDisplayNames += $displayName } + } + + return [PSCustomObject]@{ + Success = $true + NonRestorableApps = $skippedDisplayNames + } + } + + # Force reset winget sources to ensure msstore is available + try { + Write-Log -Level INFO -Message "Resetting winget sources to ensure msstore availability..." -Module "Privacy" + Start-Process -FilePath "winget" -ArgumentList @("source", "reset", "--force") -Wait -NoNewWindow -ErrorAction SilentlyContinue | Out-Null + } catch { $null = $null } # Ignore winget reset errors + + Write-Host "" + Write-Host "============================================" -ForegroundColor Cyan + Write-Host " RESTORING REMOVED APPS VIA WINGET" -ForegroundColor Cyan + Write-Host "============================================" -ForegroundColor Cyan + Write-Host " Apps scheduled for reinstall: $($appsWithWinget.Count)" -ForegroundColor Green + Write-Host "" + + # Filter out hidden Xbox system components from "manual reinstall" list + # These are handled automatically by Gaming Services / Xbox Game Bar install where possible + $hiddenXboxApps = @( + "Microsoft.Xbox.TCUI", + "Microsoft.XboxSpeechToTextOverlay" + ) + + $appsManualReinstall = @($appsWithoutWinget | Where-Object { $hiddenXboxApps -notcontains $_.AppName }) + $appsHandledByGamingServices = @($appsWithoutWinget | Where-Object { $hiddenXboxApps -contains $_.AppName }) + + if ($appsManualReinstall -and $appsManualReinstall.Count -gt 0) { + Write-Host " NOTE: $($appsManualReinstall.Count) app(s) cannot be auto-restored (system components)" -ForegroundColor Yellow + Write-Log -Level INFO -Message ("Apps without WingetId (manual reinstall required): " + ($appsManualReinstall.AppName -join ", ")) -Module "Privacy" + } + + if ($appsHandledByGamingServices.Count -gt 0) { + Write-Log -Level INFO -Message "Hidden Xbox components will be restored via Gaming Services: $($appsHandledByGamingServices.AppName -join ", ")" -Module "Privacy" + } + + $successCount = 0 + $failCount = 0 + + # SPECIAL HANDLING: Xbox/Gaming apps require Gaming Services to be installed first + # This prevents user prompts when opening Gaming App for the first time + $gamingApps = @($appsWithWinget | Where-Object { $_.AppName -match "Xbox|Gaming" }) + if ($gamingApps.Count -gt 0) { + # CRITICAL: Remove Deprovisioned registry keys for Xbox framework components + # These keys block Windows from reinstalling these apps even via Gaming Services + Write-Host " [>] Removing Xbox deprovisioned blocks (if any)..." -ForegroundColor Cyan + $deprovisionedPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned" + $xboxDeprovisionedApps = @( + "Microsoft.Xbox.TCUI_8wekyb3d8bbwe", + "Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe", + "Microsoft.XboxGamingOverlay_8wekyb3d8bbwe", + "Microsoft.XboxIdentityProvider_8wekyb3d8bbwe", + "Microsoft.GamingApp_8wekyb3d8bbwe" + ) + foreach ($appKey in $xboxDeprovisionedApps) { + $keyPath = Join-Path $deprovisionedPath $appKey + if (Test-Path $keyPath) { + try { + Remove-Item -Path $keyPath -Force -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Removed deprovisioned block: $appKey" -Module "Privacy" + Write-Host " [OK] Unblocked: $appKey" -ForegroundColor Green + } + catch { + Write-Log -Level WARNING -Message "Failed to remove deprovisioned key for $appKey : $_" -Module "Privacy" + } + } + } + + Write-Host " [>] Detected Xbox/Gaming apps - installing Gaming Services first..." -ForegroundColor Cyan + Write-Log -Level INFO -Message "Installing Gaming Services (framework) to prevent user prompts" -Module "Privacy" + + try { + # Gaming Services Store ID: 9MWPM2CQNLHN + $proc = Start-Process -FilePath "winget" -ArgumentList @("install", "--id", "9MWPM2CQNLHN", "--accept-package-agreements", "--accept-source-agreements", "--silent") -Wait -NoNewWindow -PassThru -ErrorAction Stop + + # Check for Success (0) OR Already Installed (-1978335189 / 0x8A15002B) + if ($proc.ExitCode -eq 0 -or $proc.ExitCode -eq -1978335189) { + if ($proc.ExitCode -eq -1978335189) { + Write-Host " [OK] Gaming Services (already installed)" -ForegroundColor Green + Write-Log -Level SUCCESS -Message "Gaming Services already present - Xbox framework ready" -Module "Privacy" + } else { + Write-Host " [OK] Gaming Services installed" -ForegroundColor Green + Write-Log -Level SUCCESS -Message "Gaming Services installed" -Module "Privacy" + } + } + else { + Write-Host " [WARN] Gaming Services install had issues - Gaming apps may prompt on first launch" -ForegroundColor Yellow + Write-Log -Level WARNING -Message "Gaming Services install failed (ExitCode: $($proc.ExitCode)) - continuing anyway" -Module "Privacy" + } + } + catch { + Write-Log -Level WARNING -Message "Could not install Gaming Services: $_" -Module "Privacy" + } + + Write-Host "" + } + + foreach ($app in $appsWithWinget) { + $id = $app.WingetId + $name = $app.AppName + + Write-Host " [>] Installing $name ($id)..." -ForegroundColor White + + try { + # STEP 1: Check if app exists in winget catalog first (avoid unnecessary install attempts) + $searchStdout = Join-Path $env:TEMP "winget_search_$([guid]::NewGuid()).txt" + $searchStderr = Join-Path $env:TEMP "winget_search_err_$([guid]::NewGuid()).txt" + + $searchProc = Start-Process -FilePath "winget" ` + -ArgumentList @("search", "--id", $id, "--exact") ` + -Wait -NoNewWindow -PassThru ` + -RedirectStandardOutput $searchStdout ` + -RedirectStandardError $searchStderr ` + -ErrorAction Stop + + # Cleanup temp files + Remove-Item $searchStdout, $searchStderr -Force -ErrorAction SilentlyContinue + + # ExitCode -1978335212 = No package found + if ($searchProc.ExitCode -eq -1978335212 -or $searchProc.ExitCode -ne 0) { + Write-Host " [SKIP] $name (not available in winget catalog)" -ForegroundColor DarkGray + Write-Log -Level INFO -Message "App not available in winget catalog: $name ($id) - skipping" -Module "Privacy" + $failCount++ # Count as "failed" for summary, but not a real error + continue + } + + # STEP 2: App exists - proceed with installation + $proc = Start-Process -FilePath "winget" -ArgumentList @("install", "--id", $id, "--exact", "--source", "msstore", "--accept-package-agreements", "--accept-source-agreements", "--silent") -Wait -NoNewWindow -PassThru -ErrorAction Stop + + if ($proc.ExitCode -eq 0 -or $proc.ExitCode -eq -1978335189) { + if ($proc.ExitCode -eq -1978335189) { + Write-Host " [OK] $name (already installed)" -ForegroundColor Green + Write-Log -Level SUCCESS -Message "App already installed (winget): $name ($id)" -Module "Privacy" + } else { + Write-Host " [OK] $name" -ForegroundColor Green + Write-Log -Level SUCCESS -Message "Restored app via winget: $name ($id)" -Module "Privacy" + } + $successCount++ + } + else { + # Installation failed despite app being available + Write-Host " [FAIL] $name (ExitCode: $($proc.ExitCode))" -ForegroundColor Yellow + Write-Log -Level WARNING -Message "Failed to restore app via winget: $name ($id) ExitCode=$($proc.ExitCode)" -Module "Privacy" + $failCount++ + } + } + catch { + Write-Host " [FAIL] $name (exception)" -ForegroundColor Red + Write-Log -Level WARNING -Message "Exception when restoring app via winget: $name ($id) - $_" -Module "Privacy" + $failCount++ + } + } + + Write-Host "" + Write-Host " Winget restore summary: $successCount succeeded, $failCount failed" -ForegroundColor Cyan + + # Collect ALL non-restorable apps for user notification: + # 1. Apps explicitly in $nonRestorableApps list (known to not be in winget catalog) + # 2. Apps that have no WingetId (excluding Xbox system components handled by Gaming Services) + $allNonRestorableDisplayNames = @() + + # Add apps from $nonRestorableApps that were actually removed + foreach ($skipped in $skippedNonRestorableApps) { + $displayName = ($nonRestorableApps | Where-Object { $_.AppName -eq $skipped.AppName }).DisplayName + if ($displayName) { $allNonRestorableDisplayNames += $displayName } + } + + # Add apps without WingetId (that are not Xbox system components) + foreach ($app in $appsManualReinstall) { + # Use AppName as display name since we don't have a mapping + $allNonRestorableDisplayNames += $app.AppName + } + + # Add hidden Xbox system components that are still missing after Gaming Services / Xbox Game Bar restore + foreach ($app in $appsHandledByGamingServices) { + $pkg = $null + try { + $pkg = Get-AppxPackage -AllUsers -Name $app.AppName -ErrorAction SilentlyContinue + } + catch { + $pkg = $null + } + + if (-not $pkg) { + switch ($app.AppName) { + "Microsoft.XboxSpeechToTextOverlay" { + $allNonRestorableDisplayNames += "Xbox Speech-to-Text Overlay (install/repair Gaming Services + Xbox Game Bar from Microsoft Store)" + } + "Microsoft.Xbox.TCUI" { + $allNonRestorableDisplayNames += "Xbox Game UI (Xbox.TCUI - install/repair Gaming Services + Xbox Game Bar from Microsoft Store)" + } + } + } + } + + if ($failCount -gt 0) { + return [PSCustomObject]@{ + Success = $false + NonRestorableApps = $allNonRestorableDisplayNames + } + } + + return [PSCustomObject]@{ + Success = $true + NonRestorableApps = $allNonRestorableDisplayNames + } + } + catch { + Write-Log -Level ERROR -Message "Failed to restore apps via winget: $_" -Module "Privacy" + return [PSCustomObject]@{ + Success = $false + NonRestorableApps = @() + } + } +} diff --git a/Modules/Privacy/Test-PrivacyCompliance.ps1 b/Modules/Privacy/Test-PrivacyCompliance.ps1 new file mode 100644 index 0000000..52f97ca --- /dev/null +++ b/Modules/Privacy/Test-PrivacyCompliance.ps1 @@ -0,0 +1,176 @@ +function Test-PrivacyCompliance { + <# + .SYNOPSIS + Verify privacy settings compliance + + .DESCRIPTION + Checks if all privacy settings were applied correctly according to the selected mode + + .PARAMETER Config + Configuration object to verify against + + .EXAMPLE + Test-PrivacyCompliance -Config $config + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [PSCustomObject]$Config + ) + + try { + Write-Log -Level INFO -Message "Verifying privacy settings compliance..." -Module "Privacy" + + $compliant = $true + $totalChecks = 0 + $passed = 0 + $failed = @() + + # Verify registry settings from Privacy config + $categories = @("DataCollection", "Personalization", "SearchAndCloud", "InputAndSync", "LocationAndAppPrivacy") + + foreach ($category in $categories) { + if ($Config.PSObject.Properties.Name -contains $category) { + foreach ($keyPath in $Config.$category.PSObject.Properties.Name) { + foreach ($valueName in $Config.$category.$keyPath.PSObject.Properties.Name) { + $totalChecks++ + $expected = $Config.$category.$keyPath.$valueName.Value + + try { + $actual = (Get-ItemProperty -Path $keyPath -Name $valueName -ErrorAction Stop).$valueName + if ($actual -eq $expected) { + $passed++ + } else { + $failMsg = "MISMATCH: $keyPath\$valueName = $actual (expected: $expected)" + Write-Log -Level WARNING -Message $failMsg -Module "Privacy" + $failed += $failMsg + $compliant = $false + } + } catch { + $failMsg = "NOT FOUND: $keyPath\$valueName (expected: $expected)" + Write-Log -Level WARNING -Message $failMsg -Module "Privacy" + $failed += $failMsg + $compliant = $false + } + } + } + } + } + + # Also verify OneDrive.json settings (6 additional settings) + $oneDriveConfigPath = Join-Path $PSScriptRoot "Config\OneDrive.json" + if (Test-Path $oneDriveConfigPath) { + $oneDriveConfig = Get-Content $oneDriveConfigPath -Raw | ConvertFrom-Json + $oneDriveCategories = @("OneDrivePolicies", "StorePolicies") + + foreach ($category in $oneDriveCategories) { + if ($oneDriveConfig.PSObject.Properties.Name -contains $category) { + foreach ($keyPath in $oneDriveConfig.$category.PSObject.Properties.Name) { + foreach ($valueName in $oneDriveConfig.$category.$keyPath.PSObject.Properties.Name) { + $totalChecks++ + $expected = $oneDriveConfig.$category.$keyPath.$valueName.Value + + try { + $actual = (Get-ItemProperty -Path $keyPath -Name $valueName -ErrorAction Stop).$valueName + if ($actual -eq $expected) { + $passed++ + } else { + $failMsg = "MISMATCH: $keyPath\$valueName = $actual (expected: $expected)" + Write-Log -Level WARNING -Message $failMsg -Module "Privacy" + $failed += $failMsg + $compliant = $false + } + } catch { + $failMsg = "NOT FOUND: $keyPath\$valueName (expected: $expected)" + Write-Log -Level WARNING -Message $failMsg -Module "Privacy" + $failed += $failMsg + $compliant = $false + } + } + } + } + } + } + + # Verify services + if ($Config.Services.Count -gt 0) { + foreach ($svc in $Config.Services) { + $totalChecks++ + $service = Get-Service -Name $svc.Name -ErrorAction SilentlyContinue + if ($service -and $service.StartType -eq "Disabled") { + $passed++ + } else { + $failMsg = "SERVICE: $($svc.Name) not disabled (current: $($service.StartType))" + Write-Log -Level WARNING -Message $failMsg -Module "Privacy" + $failed += $failMsg + $compliant = $false + } + } + } + + # Verify scheduled tasks + if ($Config.ScheduledTasks.Count -gt 0) { + foreach ($taskPath in $Config.ScheduledTasks) { + $totalChecks++ + $taskName = Split-Path $taskPath -Leaf + $taskFolder = Split-Path $taskPath -Parent + + $task = Get-ScheduledTask -TaskName $taskName -TaskPath $taskFolder -ErrorAction SilentlyContinue + + if ($task) { + if ($task.State -eq "Disabled") { + $passed++ + } else { + $failMsg = "TASK: $taskPath not disabled (current: $($task.State))" + Write-Log -Level WARNING -Message $failMsg -Module "Privacy" + $failed += $failMsg + $compliant = $false + } + } else { + # Task not found - effectively disabled/removed + $passed++ + } + } + } + + # Avoid division by zero if no checks were performed + if ($totalChecks -eq 0) { + Write-Log -Level WARNING -Message "No compliance checks could be performed (config may be empty or incompatible)" -Module "Privacy" + return [PSCustomObject]@{ + Compliant = $true + TotalChecks = 0 + Passed = 0 + Failed = 0 + Percentage = 100 + FailedChecks = @() + } + } + + $percentage = [math]::Round(($passed / $totalChecks) * 100, 1) + Write-Log -Level INFO -Message "Compliance check: $passed/$totalChecks checks passed ($percentage%)" -Module "Privacy" + + if ($compliant) { + Write-Log -Level SUCCESS -Message "Privacy settings are fully compliant" -Module "Privacy" + } else { + Write-Log -Level WARNING -Message "Some privacy settings are not compliant - $($failed.Count) issue(s) found" -Module "Privacy" + # Log each failed check individually + foreach ($fail in $failed) { + Write-Log -Level WARNING -Message " - $fail" -Module "Privacy" + } + } + + # Return detailed result object instead of just boolean + return [PSCustomObject]@{ + Compliant = $compliant + TotalChecks = $totalChecks + Passed = $passed + Failed = ($totalChecks - $passed) + Percentage = $percentage + FailedChecks = $failed + } + + } catch { + Write-Log -Level ERROR -Message "Compliance verification failed: $_" -Module "Privacy" + return $false + } +} diff --git a/Modules/SecurityBaseline/Config/BitLockerPolicies.json b/Modules/SecurityBaseline/Config/BitLockerPolicies.json new file mode 100644 index 0000000..67fdcbb --- /dev/null +++ b/Modules/SecurityBaseline/Config/BitLockerPolicies.json @@ -0,0 +1,36 @@ +{ + "Description": "BitLocker removable drive encryption policies", + "Documentation": "https://learn.microsoft.com/en-us/windows/security/information-protection/bitlocker/", + + "RemovableDriveProtection": { + "RDVDenyWriteAccess": { + "Description": "Deny write access to removable drives not protected by BitLocker", + "Behavior": { + "When_Enabled_1": "USB drives are READ-ONLY until encrypted. Shows prompt: 'Encrypt this drive with BitLocker?'", + "When_Disabled_0": "USB drives work normally (no prompt, no encryption requirement)" + }, + "DefaultValue": 0, + "RecommendedFor": { + "HomeUsers": 0, + "Enterprise": 1, + "HighSecurity": 1 + }, + "SecurityImpact": { + "DataExfiltrationRisk": "HIGH if disabled - USB drives can be used without encryption", + "MalwareRisk": "MEDIUM - ASR and Defender still scan USB drives", + "Usability": "HIGH impact - users expect normal USB behavior" + }, + "AlternativeSecurity": [ + "ASR Rules block executable content from USB", + "Defender Antivirus scans removable drives (DisableRemovableDriveScanning=0)", + "Users can still manually encrypt with BitLocker (right-click โ†’ Turn on BitLocker)" + ] + } + }, + + "ApplyBehavior": { + "Interactive": true, + "PromptUser": true, + "PromptMessage": "BitLocker USB Protection:\n\nDo you want to require BitLocker encryption for USB drives?\n\nYES: USB drives will be READ-ONLY until encrypted (shows encryption prompt)\nNO: USB drives work normally (manual encryption available)\n\nRecommended for HOME USERS: NO\nRecommended for ENTERPRISE: YES" + } +} diff --git a/Modules/SecurityBaseline/ParsedSettings/AuditPolicies.json b/Modules/SecurityBaseline/ParsedSettings/AuditPolicies.json new file mode 100644 index 0000000..a8369a8 --- /dev/null +++ b/Modules/SecurityBaseline/ParsedSettings/AuditPolicies.json @@ -0,0 +1,163 @@ +๏ปฟ[ + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Credential Validation", + "SubcategoryGUID": "{0cce923f-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success and Failure", + "SettingValue": "3" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Security Group Management", + "SubcategoryGUID": "{0cce9237-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success", + "SettingValue": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit User Account Management", + "SubcategoryGUID": "{0cce9235-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success and Failure", + "SettingValue": "3" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit PNP Activity", + "SubcategoryGUID": "{0cce9248-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success", + "SettingValue": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Process Creation", + "SubcategoryGUID": "{0cce922b-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success", + "SettingValue": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Account Lockout", + "SubcategoryGUID": "{0cce9217-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Failure", + "SettingValue": "2" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Group Membership", + "SubcategoryGUID": "{0cce9249-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success", + "SettingValue": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Logon", + "SubcategoryGUID": "{0cce9215-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success and Failure", + "SettingValue": "3" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Other Logon/Logoff Events", + "SubcategoryGUID": "{0cce921c-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success and Failure", + "SettingValue": "3" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Special Logon", + "SubcategoryGUID": "{0cce921b-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success", + "SettingValue": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Detailed File Share", + "SubcategoryGUID": "{0cce9244-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Failure", + "SettingValue": "2" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit File Share", + "SubcategoryGUID": "{0cce9224-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success and Failure", + "SettingValue": "3" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Other Object Access Events", + "SubcategoryGUID": "{0cce9227-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success and Failure", + "SettingValue": "3" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Removable Storage", + "SubcategoryGUID": "{0cce9245-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success and Failure", + "SettingValue": "3" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Audit Policy Change", + "SubcategoryGUID": "{0cce922f-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success", + "SettingValue": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Authentication Policy Change", + "SubcategoryGUID": "{0cce9230-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success", + "SettingValue": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit MPSSVC Rule-Level Policy Change", + "SubcategoryGUID": "{0cce9232-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success and Failure", + "SettingValue": "3" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Other Policy Change Events", + "SubcategoryGUID": "{0cce9234-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Failure", + "SettingValue": "2" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Sensitive Privilege Use", + "SubcategoryGUID": "{0cce9228-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success", + "SettingValue": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Other System Events", + "SubcategoryGUID": "{0cce9214-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success and Failure", + "SettingValue": "3" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Security State Change", + "SubcategoryGUID": "{0cce9210-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success", + "SettingValue": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit Security System Extension", + "SubcategoryGUID": "{0cce9211-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success", + "SettingValue": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "Subcategory": "Audit System Integrity", + "SubcategoryGUID": "{0cce9212-69ae-11d9-bed3-505054503030}", + "InclusionSetting": "Success and Failure", + "SettingValue": "3" + } +] diff --git a/Modules/SecurityBaseline/ParsedSettings/Computer-RegistryPolicies.json b/Modules/SecurityBaseline/ParsedSettings/Computer-RegistryPolicies.json new file mode 100644 index 0000000..d4cd041 --- /dev/null +++ b/Modules/SecurityBaseline/ParsedSettings/Computer-RegistryPolicies.json @@ -0,0 +1,2313 @@ +๏ปฟ[ + { + "GPO": "MSFT Windows 11 25H2 - BitLocker", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\FVE", + "ValueName": "UseEnhancedPin", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - BitLocker", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\FVE", + "ValueName": "RDVDenyCrossOrg", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - BitLocker", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\FVE", + "ValueName": "DisableExternalDMAUnderLock", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - BitLocker", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Power\\PowerSettings\\abfc2519-3608-4c2a-94ea-171b0ed546ab", + "ValueName": "DCSettingIndex", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - BitLocker", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Power\\PowerSettings\\abfc2519-3608-4c2a-94ea-171b0ed546ab", + "ValueName": "ACSettingIndex", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - BitLocker", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceInstall\\Restrictions", + "ValueName": "DenyDeviceClasses", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - BitLocker", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceInstall\\Restrictions", + "ValueName": "DenyDeviceClassesRetroactive", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - BitLocker", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceInstall\\Restrictions\\DenyDeviceClasses", + "ValueName": "**delvals.", + "Type": "REG_SZ", + "Data": " " + }, + { + "GPO": "MSFT Windows 11 25H2 - BitLocker", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceInstall\\Restrictions\\DenyDeviceClasses", + "ValueName": "1", + "Type": "REG_SZ", + "Data": "{d48179be-ec20-11d1-b6b8-00c04fa372a7}" + }, + { + "GPO": "MSFT Windows 11 25H2 - BitLocker", + "KeyName": "[System\\CurrentControlSet\\Policies\\Microsoft\\FVE", + "ValueName": "RDVDenyWriteAccess", + "Type": "REG_DWORD", + "Data": 0, + "Comment": "HOME USER DEFAULT: Allow USB write access. Enterprise users: Change to 1 for encryption enforcement with prompt. User can still manually encrypt via right-click โ†’ Turn on BitLocker." + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender", + "ValueName": "PUAProtection", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender", + "ValueName": "DisableLocalAdminMerge", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender", + "ValueName": "HideExclusionsFromLocalAdmins", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender", + "ValueName": "DisableRoutinelyTakingAction", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Features", + "ValueName": "PassiveRemediation", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\MpEngine", + "ValueName": "MpCloudBlockLevel", + "Type": "REG_DWORD", + "Data": 2 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\MpEngine", + "ValueName": "MpBafsExtendedTimeout", + "Type": "REG_DWORD", + "Data": 50 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\NIS", + "ValueName": "EnableConvertWarnToBlock", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", + "ValueName": "DisableIOAVProtection", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", + "ValueName": "DisableRealtimeMonitoring", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", + "ValueName": "DisableScriptScanning", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", + "ValueName": "DisableBehaviorMonitoring", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", + "ValueName": "RealtimeScanDirection", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", + "ValueName": "DisableOnAccessProtection", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", + "ValueName": "DisableScanOnRealtimeEnable", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", + "ValueName": "OobeEnableRtpAndSigUpdate", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Reporting", + "ValueName": "EnableDynamicSignatureDroppedEventReporting", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Scan", + "ValueName": "DisableRemovableDriveScanning", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Scan", + "ValueName": "QuickScanIncludeExclusions", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Spynet", + "ValueName": "SpynetReporting", + "Type": "REG_DWORD", + "Data": 2 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Spynet", + "ValueName": "DisableBlockAtFirstSeen", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Spynet", + "ValueName": "SubmitSamplesConsent", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR", + "ValueName": "ExploitGuard_ASR_Rules", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "3b576869-a4ec-4529-8536-b80a7769e899", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "d4f940ab-401b-4efc-aadc-ad5f3c50688a", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "5beb7efe-fd9a-4556-801d-275e5ffc04cc", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "d3e037e1-3eb8-44c8-a917-57927947596d", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "26190899-1602-49e8-8b27-eb1d0a1ce869", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "c1db55ab-c21a-4637-bb3f-a12568109d35", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "e6db77e5-3df2-4cf1-b95a-636979351e5b", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "56a863a9-875e-4185-98a7-b882c64b5ce5", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\ASR\\Rules", + "ValueName": "d1e49aac-8f56-4280-b9ba-993a6d77406c", + "Type": "REG_SZ", + "Data": "2" + }, + { + "GPO": "MSFT Windows 11 25H2 - Defender Antivirus", + "KeyName": "[Software\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\Network Protection", + "ValueName": "EnableNetworkProtection", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Ext", + "ValueName": "RunThisTimeEnabled", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Ext", + "ValueName": "VersionCheckEnabled", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Download", + "ValueName": "RunInvalidSignatures", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Download", + "ValueName": "CheckExeSignatures", + "Type": "REG_SZ", + "Data": "yes" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main", + "ValueName": "Isolation64Bit", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main", + "ValueName": "DisableEPMCompat", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main", + "ValueName": "Isolation", + "Type": "REG_SZ", + "Data": "PMEM" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main", + "ValueName": "DisableInternetExplorerLaunchViaCOM", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_DISABLE_MK_PROTOCOL", + "ValueName": "(Reserved)", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_DISABLE_MK_PROTOCOL", + "ValueName": "iexplore.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_DISABLE_MK_PROTOCOL", + "ValueName": "explorer.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_MIME_HANDLING", + "ValueName": "explorer.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_MIME_HANDLING", + "ValueName": "iexplore.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_MIME_HANDLING", + "ValueName": "(Reserved)", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_MIME_SNIFFING", + "ValueName": "explorer.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_MIME_SNIFFING", + "ValueName": "iexplore.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_MIME_SNIFFING", + "ValueName": "(Reserved)", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_RESTRICT_ACTIVEXINSTALL", + "ValueName": "(Reserved)", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_RESTRICT_ACTIVEXINSTALL", + "ValueName": "explorer.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_RESTRICT_ACTIVEXINSTALL", + "ValueName": "iexplore.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_RESTRICT_FILEDOWNLOAD", + "ValueName": "(Reserved)", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_RESTRICT_FILEDOWNLOAD", + "ValueName": "iexplore.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_RESTRICT_FILEDOWNLOAD", + "ValueName": "explorer.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_SECURITYBAND", + "ValueName": "(Reserved)", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_SECURITYBAND", + "ValueName": "iexplore.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_SECURITYBAND", + "ValueName": "explorer.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_WINDOW_RESTRICTIONS", + "ValueName": "iexplore.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_WINDOW_RESTRICTIONS", + "ValueName": "(Reserved)", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_WINDOW_RESTRICTIONS", + "ValueName": "explorer.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_ZONE_ELEVATION", + "ValueName": "(Reserved)", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_ZONE_ELEVATION", + "ValueName": "explorer.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_ZONE_ELEVATION", + "ValueName": "iexplore.exe", + "Type": "REG_SZ", + "Data": "1" + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter", + "ValueName": "PreventOverrideAppRepUnknown", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter", + "ValueName": "PreventOverride", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter", + "ValueName": "EnabledV9", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Restrictions", + "ValueName": "NoCrashDetection", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Security", + "ValueName": "DisableSecuritySettingsCheck", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Security\\ActiveX", + "ValueName": "BlockNonAdminActiveXInstall", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\AxInstaller", + "ValueName": "OnlyUseAXISForActiveXInstall", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", + "ValueName": "Security_zones_map_edit", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", + "ValueName": "Security_options_edit", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", + "ValueName": "Security_HKLM_only", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", + "ValueName": "CertificateRevocation", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", + "ValueName": "PreventIgnoreCertErrors", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", + "ValueName": "WarnOnBadCertRecving", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", + "ValueName": "EnableSSL3Fallback", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", + "ValueName": "SecureProtocols", + "Type": "REG_DWORD", + "Data": 2560 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\0", + "ValueName": "1C00", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\1", + "ValueName": "1C00", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\2", + "ValueName": "1C00", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\3", + "ValueName": "2301", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4", + "ValueName": "2301", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\4", + "ValueName": "1C00", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap", + "ValueName": "UNCAsIntranet", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0", + "ValueName": "1C00", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0", + "ValueName": "270C", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1", + "ValueName": "270C", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1", + "ValueName": "1201", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1", + "ValueName": "1C00", + "Type": "REG_DWORD", + "Data": 65536 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2", + "ValueName": "1C00", + "Type": "REG_DWORD", + "Data": 65536 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2", + "ValueName": "270C", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2", + "ValueName": "1201", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "2001", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "2102", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1802", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "160A", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1201", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1406", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1804", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "2200", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1209", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1206", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1809", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "2500", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "2103", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1606", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "2402", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "2004", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1C00", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1001", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1A00", + "Type": "REG_DWORD", + "Data": 65536 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "2708", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1004", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "120b", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1407", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1409", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "270C", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1607", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "2709", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "2101", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "2301", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "1806", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "120c", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3", + "ValueName": "140C", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1608", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1201", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1001", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1607", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "120b", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1809", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1004", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1606", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1407", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "160A", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1406", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "2102", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "2004", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "2200", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "2000", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1402", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1803", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "2402", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1400", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1A00", + "Type": "REG_DWORD", + "Data": 196608 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "2001", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "2500", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1409", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1C00", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1209", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "270C", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1206", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "2708", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1802", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "2103", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "2709", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1405", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "2101", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "2301", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1200", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1804", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "1806", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "120c", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Internet Explorer 11 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4", + "ValueName": "140C", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\WcmSvc\\wifinetworkmanager\\config", + "ValueName": "AutoConnectAllowedOEM", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\CredUI", + "ValueName": "EnumerateAdministrators", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", + "ValueName": "NoDriveTypeAutoRun", + "Type": "REG_DWORD", + "Data": 255 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", + "ValueName": "NoWebServices", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", + "ValueName": "NoAutorun", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\LAPS", + "ValueName": "BackupDirectory", + "Type": "REG_DWORD", + "Data": 2 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\LAPS", + "ValueName": "ADPasswordEncryptionEnabled", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\LAPS", + "ValueName": "ADBackupDSRMPassword", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", + "ValueName": "MSAOptional", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", + "ValueName": "DisableAutomaticRestartSignOn", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", + "ValueName": "LocalAccountTokenFilterPolicy", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", + "ValueName": "EnableMPR", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Audit", + "ValueName": "ProcessCreationIncludeCmdLine_Enabled", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\CredSSP\\Parameters", + "ValueName": "AllowEncryptionOracle", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\KDC\\Parameters", + "ValueName": "PKINITHashAlgorithmConfigurationEnabled", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\KDC\\Parameters", + "ValueName": "PKINITSHA1", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\KDC\\Parameters", + "ValueName": "PKINITSHA256", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\KDC\\Parameters", + "ValueName": "PKINITSHA384", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\KDC\\Parameters", + "ValueName": "PKINITSHA512", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters", + "ValueName": "PKInitHashAlgorithmConfigurationEnabled", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters", + "ValueName": "PKInitSHA1", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters", + "ValueName": "PKInitSHA256", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters", + "ValueName": "PKInitSHA384", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters", + "ValueName": "PKInitSHA512", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Biometrics\\FacialFeatures", + "ValueName": "EnhancedAntiSpoofing", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Feeds", + "ValueName": "DisableEnclosureDownload", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Power\\PowerSettings\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51", + "ValueName": "DCSettingIndex", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Power\\PowerSettings\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51", + "ValueName": "ACSettingIndex", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\AppPrivacy", + "ValueName": "LetAppsActivateWithVoiceAboveLock", + "Type": "REG_DWORD", + "Data": 2 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\Bowser", + "ValueName": "EnableMailslots", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CloudContent", + "ValueName": "DisableWindowsConsumerFeatures", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CredentialsDelegation", + "ValueName": "AllowProtectedCreds", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\EventLog\\Application", + "ValueName": "MaxSize", + "Type": "REG_DWORD", + "Data": 32768 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\EventLog\\Security", + "ValueName": "MaxSize", + "Type": "REG_DWORD", + "Data": 196608 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\EventLog\\System", + "ValueName": "MaxSize", + "Type": "REG_DWORD", + "Data": 32768 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\Explorer", + "ValueName": "NoAutoplayfornonVolume", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\Explorer", + "ValueName": "DisableMotWOnInsecurePathCopy", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\GameDVR", + "ValueName": "AllowGameDVR", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\Installer", + "ValueName": "AlwaysInstallElevated", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\Installer", + "ValueName": "EnableUserControl", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\Kernel DMA Protection", + "ValueName": "DeviceEnumerationPolicy", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanServer", + "ValueName": "AuditClientDoesNotSupportEncryption", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanServer", + "ValueName": "AuditClientDoesNotSupportSigning", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanServer", + "ValueName": "AuditInsecureGuestLogon", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanServer", + "ValueName": "EnableAuthRateLimiter", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanServer", + "ValueName": "MaxSmb2Dialect", + "Type": "REG_DWORD", + "Data": 785 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanServer", + "ValueName": "MinSmb2Dialect", + "Type": "REG_DWORD", + "Data": 768 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanServer", + "ValueName": "InvalidAuthenticationDelayTimeInMs", + "Type": "REG_DWORD", + "Data": 2000 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanWorkstation", + "ValueName": "AllowInsecureGuestAuth", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanWorkstation", + "ValueName": "AuditInsecureGuestLogon", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanWorkstation", + "ValueName": "AuditServerDoesNotSupportEncryption", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanWorkstation", + "ValueName": "AuditServerDoesNotSupportSigning", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanWorkstation", + "ValueName": "MaxSmb2Dialect", + "Type": "REG_DWORD", + "Data": 785 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanWorkstation", + "ValueName": "MinSmb2Dialect", + "Type": "REG_DWORD", + "Data": 768 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\LanmanWorkstation", + "ValueName": "RequireEncryption", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\Network Connections", + "ValueName": "NC_ShowSharedAccessUI", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\NetworkProvider", + "ValueName": "EnableMailslots", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths", + "ValueName": "\\\\*\\SYSVOL", + "Type": "REG_SZ", + "Data": "RequireMutualAuthentication=1,RequireIntegrity=1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\NetworkProvider\\HardenedPaths", + "ValueName": "\\\\*\\NETLOGON", + "Type": "REG_SZ", + "Data": "RequireMutualAuthentication=1,RequireIntegrity=1" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\Personalization", + "ValueName": "NoLockScreenCamera", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\Personalization", + "ValueName": "NoLockScreenSlideshow", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", + "ValueName": "EnableScriptBlockLogging", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", + "ValueName": "**del.EnableScriptBlockInvocationLogging", + "Type": "REG_SZ", + "Data": " " + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\Sudo", + "ValueName": "Enabled", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\System", + "ValueName": "AllowDomainPINLogon", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\System", + "ValueName": "EnumerateLocalUsers", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\System", + "ValueName": "EnableSmartScreen", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\System", + "ValueName": "ShellSmartScreenLevel", + "Type": "REG_SZ", + "Data": "Block" + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\System", + "ValueName": "AllowCustomSSPsAPs", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\System", + "ValueName": "RunAsPPL", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\WcmSvc\\GroupPolicy", + "ValueName": "fBlockNonDomain", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\Windows Search", + "ValueName": "AllowIndexingEncryptedStoresOrItems", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\WinRM\\Client", + "ValueName": "AllowDigest", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\WinRM\\Client", + "ValueName": "AllowUnencryptedTraffic", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\WinRM\\Client", + "ValueName": "AllowBasic", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\WinRM\\Service", + "ValueName": "AllowUnencryptedTraffic", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\WinRM\\Service", + "ValueName": "DisableRunAs", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\WinRM\\Service", + "ValueName": "AllowBasic", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\WTDS\\Components", + "ValueName": "NotifyMalicious", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\WTDS\\Components", + "ValueName": "NotifyPasswordReuse", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\WTDS\\Components", + "ValueName": "NotifyUnsafeApp", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\WTDS\\Components", + "ValueName": "ServiceEnabled", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\DNSClient", + "ValueName": "EnableMulticast", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\DNSClient", + "ValueName": "EnableNetbios", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Printers", + "ValueName": "DisableWebPnPDownload", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Printers", + "ValueName": "RedirectionGuardPolicy", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Printers", + "ValueName": "CopyFilesPolicy", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Printers\\PointAndPrint", + "ValueName": "RestrictDriverInstallationToAdministrators", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Printers\\RPC", + "ValueName": "RpcUseNamedPipeProtocol", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Printers\\RPC", + "ValueName": "RpcAuthentication", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Printers\\RPC", + "ValueName": "RpcProtocols", + "Type": "REG_DWORD", + "Data": 5 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Printers\\RPC", + "ValueName": "ForceKerberosForRpc", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Printers\\RPC", + "ValueName": "RpcTcpPort", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Rpc", + "ValueName": "RestrictRemoteClients", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Terminal Services", + "ValueName": "**del.fUseMailto", + "Type": "REG_SZ", + "Data": " " + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Terminal Services", + "ValueName": "fAllowToGetHelp", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Terminal Services", + "ValueName": "**del.fAllowFullControl", + "Type": "REG_SZ", + "Data": " " + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Terminal Services", + "ValueName": "**del.MaxTicketExpiry", + "Type": "REG_SZ", + "Data": " " + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Terminal Services", + "ValueName": "**del.MaxTicketExpiryUnits", + "Type": "REG_SZ", + "Data": " " + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Terminal Services", + "ValueName": "MinEncryptionLevel", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Terminal Services", + "ValueName": "fPromptForPassword", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Terminal Services", + "ValueName": "fDisableCdm", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Terminal Services", + "ValueName": "DisablePasswordSaving", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\Windows NT\\Terminal Services", + "ValueName": "fEncryptRPCTraffic", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall", + "ValueName": "PolicyVersion", + "Type": "REG_DWORD", + "Data": 538 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile", + "ValueName": "DefaultOutboundAction", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile", + "ValueName": "DisableNotifications", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile", + "ValueName": "EnableFirewall", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile", + "ValueName": "DefaultInboundAction", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\Logging", + "ValueName": "LogDroppedPackets", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\Logging", + "ValueName": "LogFileSize", + "Type": "REG_DWORD", + "Data": 16384 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\Logging", + "ValueName": "LogSuccessfulConnections", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile", + "ValueName": "EnableFirewall", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile", + "ValueName": "DisableNotifications", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile", + "ValueName": "DefaultInboundAction", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile", + "ValueName": "DefaultOutboundAction", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile\\Logging", + "ValueName": "LogSuccessfulConnections", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile\\Logging", + "ValueName": "LogDroppedPackets", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile\\Logging", + "ValueName": "LogFileSize", + "Type": "REG_DWORD", + "Data": 16384 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile", + "ValueName": "DefaultOutboundAction", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile", + "ValueName": "EnableFirewall", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile", + "ValueName": "DisableNotifications", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile", + "ValueName": "AllowLocalIPsecPolicyMerge", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile", + "ValueName": "AllowLocalPolicyMerge", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile", + "ValueName": "DefaultInboundAction", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\Logging", + "ValueName": "LogFileSize", + "Type": "REG_DWORD", + "Data": 16384 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\Logging", + "ValueName": "LogDroppedPackets", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\Logging", + "ValueName": "LogSuccessfulConnections", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[Software\\Policies\\Microsoft\\WindowsInkWorkspace", + "ValueName": "AllowWindowsInkWorkspace", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[SYSTEM\\CurrentControlSet\\Control\\Lsa", + "ValueName": "RunAsPPL", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[SYSTEM\\CurrentControlSet\\Control\\Print", + "ValueName": "RpcAuthnLevelPrivacyEnabled", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[SYSTEM\\CurrentControlSet\\Control\\Session Manager\\kernel", + "ValueName": "DisableExceptionChainValidation", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[SYSTEM\\CurrentControlSet\\Policies\\EarlyLaunch", + "ValueName": "DriverLoadPolicy", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters", + "ValueName": "SMB1", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[SYSTEM\\CurrentControlSet\\Services\\MrxSmb10", + "ValueName": "Start", + "Type": "REG_DWORD", + "Data": 4 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[SYSTEM\\CurrentControlSet\\Services\\Netbt\\Parameters", + "ValueName": "NoNameReleaseOnDemand", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[SYSTEM\\CurrentControlSet\\Services\\Netbt\\Parameters", + "ValueName": "NodeType", + "Type": "REG_DWORD", + "Data": 2 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters", + "ValueName": "EnableICMPRedirect", + "Type": "REG_DWORD", + "Data": 0 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters", + "ValueName": "DisableIPSourceRouting", + "Type": "REG_DWORD", + "Data": 2 + }, + { + "GPO": "MSFT Windows 11 25H2 - Computer", + "KeyName": "[SYSTEM\\CurrentControlSet\\Services\\Tcpip6\\Parameters", + "ValueName": "DisableIPSourceRouting", + "Type": "REG_DWORD", + "Data": 2 + }, + { + "GPO": "MSFT Windows 11 25H2 - Credential Guard", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard", + "ValueName": "EnableVirtualizationBasedSecurity", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Credential Guard", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard", + "ValueName": "RequirePlatformSecurityFeatures", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Credential Guard", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard", + "ValueName": "HypervisorEnforcedCodeIntegrity", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Credential Guard", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard", + "ValueName": "HVCIMATRequired", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Credential Guard", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard", + "ValueName": "LsaCfgFlags", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Credential Guard", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard", + "ValueName": "MachineIdentityIsolation", + "Type": "REG_DWORD", + "Data": 3 + }, + { + "GPO": "MSFT Windows 11 25H2 - Credential Guard", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard", + "ValueName": "ConfigureSystemGuardLaunch", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - Credential Guard", + "KeyName": "[SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard", + "ValueName": "ConfigureKernelShadowStacksLaunch", + "Type": "REG_DWORD", + "Data": 1 + } +] diff --git a/Modules/SecurityBaseline/ParsedSettings/SecurityTemplates.json b/Modules/SecurityBaseline/ParsedSettings/SecurityTemplates.json new file mode 100644 index 0000000..fa9207a --- /dev/null +++ b/Modules/SecurityBaseline/ParsedSettings/SecurityTemplates.json @@ -0,0 +1,118 @@ +๏ปฟ{ + "MSFT Internet Explorer 11 - Computer": { + "Unicode": { + "Unicode": "yes" + }, + "Version": { + "Revision": "1", + "signature": "\"$CHICAGO$\"" + } + }, + "MSFT Windows 11 25H2 - Domain Security": { + "System Access": { + "AllowAdministratorLockout": "1", + "ResetLockoutCount": "10", + "LockoutBadCount": "10", + "PasswordComplexity": "1", + "LockoutDuration": "10", + "PasswordHistorySize": "24", + "ClearTextPassword": "0", + "MinimumPasswordLength": "14" + }, + "Registry Values": { + + }, + "Version": { + "Revision": "1", + "signature": "\"$CHICAGO$\"" + }, + "Unicode": { + "Unicode": "yes" + } + }, + "MSFT Windows 11 25H2 - BitLocker": { + "Unicode": { + "Unicode": "yes" + }, + "Version": { + "Revision": "1", + "signature": "\"$CHICAGO$\"" + } + }, + "MSFT Windows 11 25H2 - Computer": { + "Service General Setting": { + "XboxGipSvc": "StartupType=Disabled", + "XblAuthManager": "StartupType=Disabled", + "XblGameSave": "StartupType=Disabled", + "XboxNetApiSvc": "StartupType=Disabled" + }, + "Registry Values": { + "MACHINE\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\\EnablePlainTextPassword": "4,0", + "MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ScRemoveOption": "1,\"1\"", + "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableInstallerDetection": "4,1", + "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\DisablePasswordChange": "4,0", + "MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\ProtectionMode": "4,1", + "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableSecureUIAPaths": "4,1", + "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\RestrictAnonymousSAM": "4,1", + "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\NTLMMinServerSec": "4,537395200", + "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorUser": "4,0", + "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\RestrictAnonymous": "4,1", + "MACHINE\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\Parameters\\RequireSecuritySignature": "4,1", + "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\allownullsessionfallback": "4,0", + "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\LmCompatibilityLevel": "4,5", + "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\requiresignorseal": "4,1", + "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\NTLMMinClientSec": "4,537395200", + "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\SCENoApplyLegacyAuditPolicy": "4,1", + "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\TypeOfAdminApprovalMode": "4,2", + "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorEnhancedAdmin": "4,1", + "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\requiresecuritysignature": "4,1", + "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\requirestrongkey": "4,1", + "MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters\\RestrictNullSessAccess": "4,1", + "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\sealsecurechannel": "4,1", + "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\RestrictRemoteSAM": "1,\"O:BAG:BAD:(A;;RC;;;BA)\"", + "MACHINE\\System\\CurrentControlSet\\Services\\LDAP\\LDAPClientIntegrity": "4,1", + "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA": "4,1", + "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableVirtualization": "4,1", + "MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\LimitBlankPasswordUse": "4,1", + "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\FilterAdministratorToken": "4,1", + "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin": "4,2", + "MACHINE\\System\\CurrentControlSet\\Services\\Netlogon\\Parameters\\signsecurechannel": "4,1", + "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\InactivityTimeoutSecs": "4,900" + }, + "Version": { + "Revision": "1", + "signature": "\"$CHICAGO$\"" + }, + "Privilege Rights": { + "SeDebugPrivilege": "*S-1-5-32-544", + "SeManageVolumePrivilege": "*S-1-5-32-544", + "SeDenyRemoteInteractiveLogonRight": "*S-1-5-113", + "SeTcbPrivilege": "", + "SeRemoteShutdownPrivilege": "*S-1-5-32-544", + "SeBackupPrivilege": "*S-1-5-32-544", + "SeLoadDriverPrivilege": "*S-1-5-32-544", + "SeLockMemoryPrivilege": "", + "SeCreatePagefilePrivilege": "*S-1-5-32-544", + "SeSystemEnvironmentPrivilege": "*S-1-5-32-544", + "SeCreateTokenPrivilege": "", + "SeSecurityPrivilege": "*S-1-5-32-544", + "SeTakeOwnershipPrivilege": "*S-1-5-32-544", + "SeCreateGlobalPrivilege": "*S-1-5-20,*S-1-5-19,*S-1-5-6,*S-1-5-32-544", + "SeRestorePrivilege": "*S-1-5-32-544", + "SeNetworkLogonRight": "*S-1-5-32-555,*S-1-5-32-544", + "SeProfileSingleProcessPrivilege": "*S-1-5-32-544", + "SeEnableDelegationPrivilege": "", + "SeImpersonatePrivilege": "*S-1-5-6,*S-1-5-99-216390572-1995538116-3857911515-2404958512-2623887229,*S-1-5-20,*S-1-5-19,*S-1-5-32-544", + "SeCreatePermanentPrivilege": "", + "SeInteractiveLogonRight": "*S-1-5-32-545,*S-1-5-32-544", + "SeDenyNetworkLogonRight": "*S-1-5-113", + "SeTrustedCredManAccessPrivilege": "" + }, + "Unicode": { + "Unicode": "yes" + }, + "System Access": { + "LSAAnonymousNameLookup": "0" + } + } +} diff --git a/Modules/SecurityBaseline/ParsedSettings/Summary.json b/Modules/SecurityBaseline/ParsedSettings/Summary.json new file mode 100644 index 0000000..d15b104 --- /dev/null +++ b/Modules/SecurityBaseline/ParsedSettings/Summary.json @@ -0,0 +1,10 @@ +๏ปฟ{ + "TotalSecuritySettings": 79, + "TotalSecuritySettingsApplied": 67, + "MetadataEntriesSkipped": 12, + "TotalRegistrySettings": 335, + "TotalAuditPolicies": 23, + "TotalSettingsParsed": 437, + "TotalSettingsApplied": 425, + "Note": "Security Template count (79) includes INF metadata (Unicode/Version). Applied count (67) excludes metadata." +} diff --git a/Modules/SecurityBaseline/ParsedSettings/User-RegistryPolicies.json b/Modules/SecurityBaseline/ParsedSettings/User-RegistryPolicies.json new file mode 100644 index 0000000..9b6578a --- /dev/null +++ b/Modules/SecurityBaseline/ParsedSettings/User-RegistryPolicies.json @@ -0,0 +1,37 @@ +๏ปฟ[ + { + "GPO": "MSFT Windows 11 25H2 - User", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CloudContent", + "ValueName": "DisableThirdPartySuggestions", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Windows 11 25H2 - User", + "KeyName": "[Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications", + "ValueName": "NoToastApplicationNotificationOnLockScreen", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - User", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Control Panel", + "ValueName": "FormSuggest Passwords", + "Type": "REG_DWORD", + "Data": 1 + }, + { + "GPO": "MSFT Internet Explorer 11 - User", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main", + "ValueName": "FormSuggest PW Ask", + "Type": "REG_SZ", + "Data": "no" + }, + { + "GPO": "MSFT Internet Explorer 11 - User", + "KeyName": "[Software\\Policies\\Microsoft\\Internet Explorer\\Main", + "ValueName": "FormSuggest Passwords", + "Type": "REG_SZ", + "Data": "no" + } +] diff --git a/Modules/SecurityBaseline/Private/Backup-AuditPolicies.ps1 b/Modules/SecurityBaseline/Private/Backup-AuditPolicies.ps1 new file mode 100644 index 0000000..b37c7fd --- /dev/null +++ b/Modules/SecurityBaseline/Private/Backup-AuditPolicies.ps1 @@ -0,0 +1,66 @@ +<# +.SYNOPSIS + Backup current audit policies + +.DESCRIPTION + Uses auditpol.exe to export current audit policy configuration. + Backs up all Advanced Audit Policy settings. + +.PARAMETER BackupPath + Path where backup CSV will be saved + +.OUTPUTS + PSCustomObject with backup status + +.NOTES + Uses auditpol.exe /backup command +#> + +function Backup-AuditPolicies { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$BackupPath + ) + + $result = [PSCustomObject]@{ + Success = $false + BackupPath = $BackupPath + Errors = @() + } + + try { + Write-Log -Level DEBUG -Message "Backing up audit policies via auditpol.exe..." -Module "SecurityBaseline" + + # Export current audit settings + $auditpolArgs = @( + "/backup", + "/file:`"$BackupPath`"" + ) + + $process = Start-Process -FilePath "auditpol.exe" ` + -ArgumentList $auditpolArgs ` + -Wait ` + -NoNewWindow ` + -PassThru ` + -RedirectStandardOutput (Join-Path $env:TEMP "auditpol_backup_stdout.txt") ` + -RedirectStandardError (Join-Path $env:TEMP "auditpol_backup_stderr.txt") + + if ($process.ExitCode -eq 0) { + $result.Success = $true + Write-Log -Level DEBUG -Message "Audit policies backup saved to: $BackupPath" -Module "SecurityBaseline" + } + else { + $stderr = Get-Content (Join-Path $env:TEMP "auditpol_backup_stderr.txt") -Raw -ErrorAction SilentlyContinue + $result.Errors += "auditpol backup failed with exit code $($process.ExitCode): $stderr" + Write-Error "auditpol backup failed: $stderr" + } + + } + catch { + $result.Errors += "Audit policies backup failed: $_" + Write-Error "Audit policies backup failed: $_" + } + + return $result +} diff --git a/Modules/SecurityBaseline/Private/Backup-RegistryPolicies.ps1 b/Modules/SecurityBaseline/Private/Backup-RegistryPolicies.ps1 new file mode 100644 index 0000000..c1013bd --- /dev/null +++ b/Modules/SecurityBaseline/Private/Backup-RegistryPolicies.ps1 @@ -0,0 +1,200 @@ +<# +.SYNOPSIS + Backup all registry policies that will be modified by Security Baseline + +.DESCRIPTION + Creates a backup of all registry keys/values that will be modified. + Backup is stored in JSON format for easy restore. + +.PARAMETER ComputerPoliciesPath + Path to Computer-RegistryPolicies.json (list of keys to backup) + +.PARAMETER UserPoliciesPath + Path to User-RegistryPolicies.json (list of keys to backup) + +.PARAMETER BackupPath + Path where backup JSON will be saved + +.OUTPUTS + PSCustomObject with backup status and path + +.NOTES + Backs up CURRENT values before any changes are made +#> + +function Backup-RegistryPolicies { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [string]$ComputerPoliciesPath, + + [Parameter(Mandatory = $false)] + [string]$UserPoliciesPath, + + [Parameter(Mandatory = $true)] + [string]$BackupPath + ) + + $result = [PSCustomObject]@{ + Success = $false + BackupPath = $BackupPath + ItemsBackedUp = 0 + Errors = @() + } + + $backup = @{ + Timestamp = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss") + Computer = @() + User = @() + } + + try { + # Backup Computer policies (HKLM) + if ($ComputerPoliciesPath -and (Test-Path $ComputerPoliciesPath)) { + Write-Log -Level DEBUG -Message "Backing up Computer registry policies..." -Module "SecurityBaseline" + + $computerPolicies = Get-Content -Path $ComputerPoliciesPath -Raw | ConvertFrom-Json + + foreach ($policy in $computerPolicies) { + try { + # Parse key path + $keyPath = $policy.KeyName -replace '^\[', '' -replace '\]$', '' + + # Determine registry root + if ($keyPath -match '^(SOFTWARE|SYSTEM)\\') { + $fullPath = "HKLM:\$keyPath" + } + else { + continue + } + + # Read current value + if (Test-Path $fullPath) { + try { + $currentValue = Get-ItemProperty -Path $fullPath -Name $policy.ValueName -ErrorAction Stop + + $backup.Computer += [PSCustomObject]@{ + KeyName = $policy.KeyName + ValueName = $policy.ValueName + Type = $policy.Type + OriginalValue = $currentValue.$($policy.ValueName) + Exists = $true + } + + $result.ItemsBackedUp++ + } + catch { + # Value doesn't exist - backup as non-existent + $backup.Computer += [PSCustomObject]@{ + KeyName = $policy.KeyName + ValueName = $policy.ValueName + Type = $policy.Type + OriginalValue = $null + Exists = $false + } + + $result.ItemsBackedUp++ + } + } + else { + # Key doesn't exist - backup as non-existent + $backup.Computer += [PSCustomObject]@{ + KeyName = $policy.KeyName + ValueName = $policy.ValueName + Type = $policy.Type + OriginalValue = $null + Exists = $false + KeyExists = $false + } + + $result.ItemsBackedUp++ + } + } + catch { + $result.Errors += "Failed to backup $($policy.KeyName)\$($policy.ValueName): $_" + } + } + + Write-Log -Level DEBUG -Message "Backed up $($backup.Computer.Count) Computer registry values" -Module "SecurityBaseline" + } + + # Backup User policies (HKCU) + if ($UserPoliciesPath -and (Test-Path $UserPoliciesPath)) { + Write-Log -Level DEBUG -Message "Backing up User registry policies..." -Module "SecurityBaseline" + + $userPolicies = Get-Content -Path $UserPoliciesPath -Raw | ConvertFrom-Json + + foreach ($policy in $userPolicies) { + try { + # Parse key path + $keyPath = $policy.KeyName -replace '^\[', '' -replace '\]$', '' + + if ($keyPath -match '^SOFTWARE\\') { + $fullPath = "HKCU:\$keyPath" + } + else { + continue + } + + # Read current value + if (Test-Path $fullPath) { + try { + $currentValue = Get-ItemProperty -Path $fullPath -Name $policy.ValueName -ErrorAction Stop + + $backup.User += [PSCustomObject]@{ + KeyName = $policy.KeyName + ValueName = $policy.ValueName + Type = $policy.Type + OriginalValue = $currentValue.$($policy.ValueName) + Exists = $true + } + + $result.ItemsBackedUp++ + } + catch { + $backup.User += [PSCustomObject]@{ + KeyName = $policy.KeyName + ValueName = $policy.ValueName + Type = $policy.Type + OriginalValue = $null + Exists = $false + } + + $result.ItemsBackedUp++ + } + } + else { + $backup.User += [PSCustomObject]@{ + KeyName = $policy.KeyName + ValueName = $policy.ValueName + Type = $policy.Type + OriginalValue = $null + Exists = $false + KeyExists = $false + } + + $result.ItemsBackedUp++ + } + } + catch { + $result.Errors += "Failed to backup User $($policy.KeyName)\$($policy.ValueName): $_" + } + } + + Write-Log -Level DEBUG -Message "Backed up $($backup.User.Count) User registry values" -Module "SecurityBaseline" + } + + # Save backup to JSON + $backup | ConvertTo-Json -Depth 5 | Out-File -FilePath $BackupPath -Encoding UTF8 -Force + + $result.Success = $true + Write-Log -Level DEBUG -Message "Registry backup saved to: $BackupPath" -Module "SecurityBaseline" + + } + catch { + $result.Errors += "Registry backup failed: $_" + Write-Error "Registry backup failed: $_" + } + + return $result +} diff --git a/Modules/SecurityBaseline/Private/Backup-SecurityTemplate.ps1 b/Modules/SecurityBaseline/Private/Backup-SecurityTemplate.ps1 new file mode 100644 index 0000000..a20744b --- /dev/null +++ b/Modules/SecurityBaseline/Private/Backup-SecurityTemplate.ps1 @@ -0,0 +1,87 @@ +<# +.SYNOPSIS + Backup current security template settings + +.DESCRIPTION + Uses secedit.exe to export current security settings to INF file. + Backs up: + - Password Policies + - Account Policies + - User Rights Assignments + - Security Options + - Event Log Settings + +.PARAMETER BackupPath + Path where backup INF will be saved + +.OUTPUTS + PSCustomObject with backup status + +.NOTES + Uses secedit.exe /export command +#> + +function Backup-SecurityTemplate { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$BackupPath + ) + + $result = [PSCustomObject]@{ + Success = $false + BackupPath = $BackupPath + Errors = @() + } + + # Initialize temp file paths + $dbFile = $null + $logFile = $null + + try { + Write-Log -Level DEBUG -Message "Backing up security template via secedit.exe..." -Module "SecurityBaseline" + + # Create temp paths + $dbFile = Join-Path $env:TEMP "secedit_backup_$(Get-Date -Format 'yyyyMMddHHmmss').sdb" + $logFile = Join-Path $env:TEMP "secedit_backup_$(Get-Date -Format 'yyyyMMddHHmmss').log" + + # Export current settings + $seceditArgs = @( + "/export", + "/cfg", "`"$BackupPath`"", + "/log", "`"$logFile`"", + "/quiet" + ) + + $process = Start-Process -FilePath "secedit.exe" ` + -ArgumentList $seceditArgs ` + -Wait ` + -NoNewWindow ` + -PassThru + + if ($process.ExitCode -eq 0) { + $result.Success = $true + Write-Log -Level DEBUG -Message "Security template backup saved to: $BackupPath" -Module "SecurityBaseline" + } + else { + $logContent = Get-Content $logFile -Raw -ErrorAction SilentlyContinue + $result.Errors += "secedit export failed with exit code $($process.ExitCode): $logContent" + Write-Error "secedit export failed: $logContent" + } + } + catch { + $result.Errors += "Security template backup failed: $_" + Write-Error "Security template backup failed: $_" + } + finally { + # ALWAYS cleanup temp files (even on error) + if ($dbFile -and (Test-Path $dbFile)) { + Remove-Item $dbFile -Force -ErrorAction SilentlyContinue + } + if ($logFile -and (Test-Path $logFile)) { + Remove-Item $logFile -Force -ErrorAction SilentlyContinue + } + } + + return $result +} diff --git a/Modules/SecurityBaseline/Private/Backup-XboxTask.ps1 b/Modules/SecurityBaseline/Private/Backup-XboxTask.ps1 new file mode 100644 index 0000000..c94891b --- /dev/null +++ b/Modules/SecurityBaseline/Private/Backup-XboxTask.ps1 @@ -0,0 +1,81 @@ +<# +.SYNOPSIS + Backup Xbox XblGameSave Standby Task state + +.DESCRIPTION + Backs up the current state (Enabled/Disabled/Ready) of the Xbox XblGameSave + Standby Task before it is modified by the Security Baseline. + + Saves to JSON file containing: + - Task existence status + - Task state (if exists) + - Timestamp + +.PARAMETER BackupPath + Path where backup JSON will be saved + +.OUTPUTS + PSCustomObject with backup status + +.NOTES + Part of BAVR (Backup-Apply-Verify-Restore) workflow +#> + +function Backup-XboxTask { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$BackupPath + ) + + $result = [PSCustomObject]@{ + Success = $false + BackupPath = $BackupPath + Errors = @() + } + + try { + # Note: "Backing up..." message already logged by caller (Invoke-SecurityBaseline) + $taskPath = "\Microsoft\XblGameSave\" + $taskName = "XblGameSaveTask" + + # Check if task exists + $task = Get-ScheduledTask -TaskPath $taskPath -TaskName $taskName -ErrorAction SilentlyContinue + + if (-not $task) { + Write-Log -Level DEBUG -Message "Xbox task not found (not installed) - backing up non-existent state" -Module "SecurityBaseline" + + $backupData = @{ + Timestamp = Get-Date -Format "o" + TaskPath = $taskPath + TaskName = $taskName + Exists = $false + State = $null + } + } + else { + Write-Log -Level DEBUG -Message "Xbox task found - State: $($task.State)" -Module "SecurityBaseline" + + $backupData = @{ + Timestamp = Get-Date -Format "o" + TaskPath = $taskPath + TaskName = $taskName + Exists = $true + State = $task.State.ToString() + } + } + + # Save backup to JSON + $backupData | ConvertTo-Json -Depth 3 | Out-File -FilePath $BackupPath -Encoding UTF8 -Force + + $result.Success = $true + Write-Log -Level DEBUG -Message "Xbox task state backed up to: $BackupPath" -Module "SecurityBaseline" + + } + catch { + $result.Errors += "Xbox task backup failed: $_" + Write-Error "Xbox task backup failed: $_" + } + + return $result +} diff --git a/Modules/SecurityBaseline/Private/Disable-XboxTask.ps1 b/Modules/SecurityBaseline/Private/Disable-XboxTask.ps1 new file mode 100644 index 0000000..4f866fb --- /dev/null +++ b/Modules/SecurityBaseline/Private/Disable-XboxTask.ps1 @@ -0,0 +1,67 @@ +<# +.SYNOPSIS + Disable Xbox XblGameSave Standby Task + +.DESCRIPTION + Disables the Xbox XblGameSave Standby Task which runs in the background + even if Xbox features are disabled. This is a privacy/security measure. + + Task: \Microsoft\XblGameSave\XblGameSaveTask + +.PARAMETER DryRun + Preview changes without applying + +.OUTPUTS + PSCustomObject with Success status + +.NOTES + Part of Microsoft Security Baseline recommendation +#> + +function Disable-XboxTask { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + $result = [PSCustomObject]@{ + Success = $false + TaskDisabled = $false + Errors = @() + } + + try { + $taskPath = "\Microsoft\XblGameSave\" + $taskName = "XblGameSaveTask" + + # Check if task exists + $task = Get-ScheduledTask -TaskPath $taskPath -TaskName $taskName -ErrorAction SilentlyContinue + + if (-not $task) { + Write-Log -Level DEBUG -Message "Xbox task not found (probably not installed)" -Module "SecurityBaseline" + $result.Success = $true + return $result + } + + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would disable task: $taskPath$taskName" -Module "SecurityBaseline" + $result.Success = $true + return $result + } + + # Disable the task + Disable-ScheduledTask -TaskPath $taskPath -TaskName $taskName -ErrorAction Stop | Out-Null + + $result.Success = $true + $result.TaskDisabled = $true + Write-Log -Level DEBUG -Message "Disabled Xbox task: $taskPath$taskName" -Module "SecurityBaseline" + + } + catch { + $result.Errors += "Failed to disable Xbox task: $($_.Exception.Message)" + Write-Warning "Failed to disable Xbox task: $_" + } + + return $result +} diff --git a/Modules/SecurityBaseline/Private/Restore-AuditPolicies.ps1 b/Modules/SecurityBaseline/Private/Restore-AuditPolicies.ps1 new file mode 100644 index 0000000..60cc592 --- /dev/null +++ b/Modules/SecurityBaseline/Private/Restore-AuditPolicies.ps1 @@ -0,0 +1,69 @@ +<# +.SYNOPSIS + Restore audit policies from backup + +.DESCRIPTION + Uses auditpol.exe to import audit policy configuration from backup CSV. + +.PARAMETER BackupPath + Path to backup CSV file created by Backup-AuditPolicies + +.OUTPUTS + PSCustomObject with restore status + +.NOTES + Uses auditpol.exe /restore command +#> + +function Restore-AuditPolicies { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$BackupPath + ) + + $result = [PSCustomObject]@{ + Success = $false + Errors = @() + } + + if (-not (Test-Path $BackupPath)) { + $result.Errors += "Backup file not found: $BackupPath" + return $result + } + + try { + Write-Log -Level DEBUG -Message "Restoring audit policies from: $BackupPath" -Module "SecurityBaseline" + + # Restore audit settings + $auditpolArgs = @( + "/restore", + "/file:`"$BackupPath`"" + ) + + $process = Start-Process -FilePath "auditpol.exe" ` + -ArgumentList $auditpolArgs ` + -Wait ` + -NoNewWindow ` + -PassThru ` + -RedirectStandardOutput (Join-Path $env:TEMP "auditpol_restore_stdout.txt") ` + -RedirectStandardError (Join-Path $env:TEMP "auditpol_restore_stderr.txt") + + if ($process.ExitCode -eq 0) { + $result.Success = $true + Write-Log -Level DEBUG -Message "Audit policies restored successfully" -Module "SecurityBaseline" + } + else { + $stderr = Get-Content (Join-Path $env:TEMP "auditpol_restore_stderr.txt") -Raw -ErrorAction SilentlyContinue + $result.Errors += "auditpol restore failed with exit code $($process.ExitCode): $stderr" + Write-Error "auditpol restore failed: $stderr" + } + + } + catch { + $result.Errors += "Audit policies restore failed: $_" + Write-Error "Audit policies restore failed: $_" + } + + return $result +} diff --git a/Modules/SecurityBaseline/Private/Restore-RegistryPolicies.ps1 b/Modules/SecurityBaseline/Private/Restore-RegistryPolicies.ps1 new file mode 100644 index 0000000..81dee8b --- /dev/null +++ b/Modules/SecurityBaseline/Private/Restore-RegistryPolicies.ps1 @@ -0,0 +1,231 @@ +<# +.SYNOPSIS + Restore registry policies from backup + +.DESCRIPTION + Restores all registry keys/values from a backup JSON file. + Handles non-existent keys/values correctly. + +.PARAMETER BackupPath + Path to backup JSON file created by Backup-RegistryPolicies + +.OUTPUTS + PSCustomObject with restore status + +.NOTES + Restores ORIGINAL values including deletions if keys didn't exist before +#> + +function Restore-RegistryPolicies { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$BackupPath + ) + + $result = [PSCustomObject]@{ + Success = $false + ItemsRestored = 0 + Errors = @() + } + + if (-not (Test-Path $BackupPath)) { + $result.Errors += "Backup file not found: $BackupPath" + return $result + } + + try { + Write-Log -Level DEBUG -Message "Loading backup from: $BackupPath" -Module "SecurityBaseline" + $backup = Get-Content -Path $BackupPath -Raw | ConvertFrom-Json + + # Restore Computer policies (HKLM) + if ($backup.Computer) { + Write-Log -Level DEBUG -Message "Restoring $($backup.Computer.Count) Computer registry values..." -Module "SecurityBaseline" + + foreach ($item in $backup.Computer) { + try { + # Parse key path + $keyPath = $item.KeyName -replace '^\[', '' -replace '\]$', '' + + if ($keyPath -match '^(SOFTWARE|SYSTEM)\\') { + $fullPath = "HKLM:\$keyPath" + } + else { + continue + } + + # Handle restoration based on original state + # CRITICAL FIX: **del* values are GPO DELETE markers - they should NOT be restored! + # These markers instruct GPO to delete a value. If we restore them, verification fails + # because verification expects these values to be DELETED (not present). + if ($item.ValueName -like "**del*" -or $item.ValueName -like "**delvals*") { + # DELETE marker - ensure value is deleted (not restored) + if (Test-Path $fullPath) { + try { + Remove-ItemProperty -Path $fullPath -Name $item.ValueName -ErrorAction SilentlyContinue + Write-Log -Level DEBUG -Message "Removed DELETE marker: $fullPath\$($item.ValueName)" -Module "SecurityBaseline" + } + catch { $null = $null } + } + } + elseif ($item.Exists -eq $false) { + # Item didn't exist before - delete it + if (Test-Path $fullPath) { + try { + Remove-ItemProperty -Path $fullPath -Name $item.ValueName -ErrorAction Stop + Write-Log -Level DEBUG -Message "Removed: $fullPath\$($item.ValueName)" -Module "SecurityBaseline" + } + catch { + # Value doesn't exist anymore - that's fine + $null = $null + } + } + } + else { + # Item existed - restore original value + if (-not (Test-Path $fullPath)) { + New-Item -Path $fullPath -Force | Out-Null + } + + # Convert type + $regType = switch ($item.Type) { + "REG_DWORD" { "DWord" } + "REG_SZ" { "String" } + "REG_EXPAND_SZ" { "ExpandString" } + "REG_BINARY" { "Binary" } + "REG_MULTI_SZ" { "MultiString" } + default { "String" } + } + + # Restore value (create or update with correct type) + $existingValue = Get-ItemProperty -Path $fullPath -Name $item.ValueName -ErrorAction SilentlyContinue + + if ($null -ne $existingValue) { + # Value exists - update it + Set-ItemProperty -Path $fullPath ` + -Name $item.ValueName ` + -Value $item.OriginalValue ` + -Force ` + -ErrorAction Stop + } + else { + # Value does not exist - create it with proper type + New-ItemProperty -Path $fullPath ` + -Name $item.ValueName ` + -Value $item.OriginalValue ` + -PropertyType $regType ` + -Force ` + -ErrorAction Stop | Out-Null + } + + Write-Log -Level DEBUG -Message "Restored: $fullPath\$($item.ValueName) = $($item.OriginalValue)" -Module "SecurityBaseline" + } + + $result.ItemsRestored++ + } + catch { + $result.Errors += "Failed to restore $($item.KeyName)\$($item.ValueName): $_" + } + } + } + + # Restore User policies (HKCU) + if ($backup.User) { + Write-Log -Level DEBUG -Message "Restoring $($backup.User.Count) User registry values..." -Module "SecurityBaseline" + + foreach ($item in $backup.User) { + try { + # Parse key path + $keyPath = $item.KeyName -replace '^\[', '' -replace '\]$', '' + + if ($keyPath -match '^SOFTWARE\\') { + $fullPath = "HKCU:\$keyPath" + } + else { + continue + } + + # Handle restoration based on original state + # CRITICAL FIX: **del* values are GPO DELETE markers - they should NOT be restored! + if ($item.ValueName -like "**del*" -or $item.ValueName -like "**delvals*") { + # DELETE marker - ensure value is deleted (not restored) + if (Test-Path $fullPath) { + try { + Remove-ItemProperty -Path $fullPath -Name $item.ValueName -ErrorAction SilentlyContinue + Write-Log -Level DEBUG -Message "Removed DELETE marker: $fullPath\$($item.ValueName)" -Module "SecurityBaseline" + } + catch { $null = $null } + } + } + elseif ($item.Exists -eq $false) { + # Item didn't exist before - delete it + if (Test-Path $fullPath) { + try { + Remove-ItemProperty -Path $fullPath -Name $item.ValueName -ErrorAction Stop + Write-Log -Level DEBUG -Message "Removed: $fullPath\$($item.ValueName)" -Module "SecurityBaseline" + } + catch { + # Value doesn't exist anymore - that's fine + $null = $null + } + } + } + else { + # Item existed - restore original value + if (-not (Test-Path $fullPath)) { + New-Item -Path $fullPath -Force | Out-Null + } + + # Convert type + $regType = switch ($item.Type) { + "REG_DWORD" { "DWord" } + "REG_SZ" { "String" } + "REG_EXPAND_SZ" { "ExpandString" } + "REG_BINARY" { "Binary" } + "REG_MULTI_SZ" { "MultiString" } + default { "String" } + } + + # Restore value (create or update with correct type) + $existingValue = Get-ItemProperty -Path $fullPath -Name $item.ValueName -ErrorAction SilentlyContinue + + if ($null -ne $existingValue) { + # Value exists - update it + Set-ItemProperty -Path $fullPath ` + -Name $item.ValueName ` + -Value $item.OriginalValue ` + -Force ` + -ErrorAction Stop + } + else { + # Value does not exist - create it with proper type + New-ItemProperty -Path $fullPath ` + -Name $item.ValueName ` + -Value $item.OriginalValue ` + -PropertyType $regType ` + -Force ` + -ErrorAction Stop | Out-Null + } + + Write-Log -Level DEBUG -Message "Restored: $fullPath\$($item.ValueName) = $($item.OriginalValue)" -Module "SecurityBaseline" + } + + $result.ItemsRestored++ + } + catch { + $result.Errors += "Failed to restore User $($item.KeyName)\$($item.ValueName): $_" + } + } + } + + $result.Success = ($result.Errors.Count -eq 0) + Write-Log -Level DEBUG -Message "Registry restore complete: $($result.ItemsRestored) items restored" -Module "SecurityBaseline" + + } + catch { + $result.Errors += "Registry restore failed: $_" + Write-Error "Registry restore failed: $_" + } + + return $result +} diff --git a/Modules/SecurityBaseline/Private/Restore-SecurityTemplate.ps1 b/Modules/SecurityBaseline/Private/Restore-SecurityTemplate.ps1 new file mode 100644 index 0000000..08fe4e8 --- /dev/null +++ b/Modules/SecurityBaseline/Private/Restore-SecurityTemplate.ps1 @@ -0,0 +1,93 @@ +<# +.SYNOPSIS + Restore security template from backup + +.DESCRIPTION + Uses secedit.exe to import security settings from backup INF file. + +.PARAMETER BackupPath + Path to backup INF file created by Backup-SecurityTemplate + +.OUTPUTS + PSCustomObject with restore status + +.NOTES + Uses secedit.exe /configure command +#> + +function Restore-SecurityTemplate { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$BackupPath + ) + + $result = [PSCustomObject]@{ + Success = $false + Errors = @() + } + + if (-not (Test-Path $BackupPath)) { + $result.Errors += "Backup file not found: $BackupPath" + return $result + } + + # Initialize temp file paths + $dbFile = $null + $logFile = $null + + try { + Write-Log -Level DEBUG -Message "Restoring security template from: $BackupPath" -Module "SecurityBaseline" + + # Create temp paths + $dbFile = Join-Path $env:TEMP "secedit_restore_$(Get-Date -Format 'yyyyMMddHHmmss').sdb" + $logFile = Join-Path $env:TEMP "secedit_restore_$(Get-Date -Format 'yyyyMMddHHmmss').log" + + # Apply backup settings + $seceditArgs = @( + "/configure", + "/db", "`"$dbFile`"", + "/cfg", "`"$BackupPath`"", + "/log", "`"$logFile`"", + "/quiet" + ) + + $process = Start-Process -FilePath "secedit.exe" ` + -ArgumentList $seceditArgs ` + -Wait ` + -NoNewWindow ` + -PassThru + + if ($process.ExitCode -eq 0) { + $result.Success = $true + Write-Log -Level DEBUG -Message "Security template restored successfully" -Module "SecurityBaseline" + } + elseif ($process.ExitCode -in 1,3,4) { + # Exit Code 1/3/4 often indicates warnings (e.g. SID mapping issues) but successful application of other settings + # We should NOT fail the entire restore process for this. + $logContent = Get-Content $logFile -Raw -ErrorAction SilentlyContinue + $result.Success = $true # Treat as success with warnings + Write-Log -Level INFO -Message "Security template restored (Exit Code $($process.ExitCode)). Minor SID mapping warnings ignored." -Module "SecurityBaseline" + } + else { + $logContent = Get-Content $logFile -Raw -ErrorAction SilentlyContinue + $result.Errors += "secedit restore failed with exit code $($process.ExitCode): $logContent" + Write-Error "secedit restore failed: $logContent" + } + } + catch { + $result.Errors += "Security template restore failed: $_" + Write-Error "Security template restore failed: $_" + } + finally { + # ALWAYS cleanup temp files (even on error) + if ($dbFile -and (Test-Path $dbFile)) { + Remove-Item $dbFile -Force -ErrorAction SilentlyContinue + } + if ($logFile -and (Test-Path $logFile)) { + Remove-Item $logFile -Force -ErrorAction SilentlyContinue + } + } + + return $result +} diff --git a/Modules/SecurityBaseline/Private/Restore-XboxTask.ps1 b/Modules/SecurityBaseline/Private/Restore-XboxTask.ps1 new file mode 100644 index 0000000..c5fe8f1 --- /dev/null +++ b/Modules/SecurityBaseline/Private/Restore-XboxTask.ps1 @@ -0,0 +1,92 @@ +<# +.SYNOPSIS + Restore Xbox XblGameSave Standby Task state + +.DESCRIPTION + Restores the Xbox XblGameSave Standby Task to its original state + from backup created by Backup-XboxTask. + + Handles three scenarios: + - Task did not exist before: Do nothing + - Task was Disabled: Keep it disabled (no action needed) + - Task was Ready/Running: Re-enable it + +.PARAMETER BackupPath + Path to backup JSON file created by Backup-XboxTask + +.OUTPUTS + PSCustomObject with restore status + +.NOTES + Part of BAVR (Backup-Apply-Verify-Restore) workflow +#> + +function Restore-XboxTask { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$BackupPath + ) + + $result = [PSCustomObject]@{ + Success = $false + Errors = @() + } + + if (-not (Test-Path $BackupPath)) { + $result.Errors += "Backup file not found: $BackupPath" + return $result + } + + try { + Write-Log -Level DEBUG -Message "Restoring Xbox task state from: $BackupPath" -Module "SecurityBaseline" + + # Load backup + $backupData = Get-Content $BackupPath -Raw | ConvertFrom-Json + + # If task did not exist before, do nothing + if (-not $backupData.Exists) { + Write-Log -Level DEBUG -Message "Xbox task did not exist before hardening - no restore needed" -Module "SecurityBaseline" + $result.Success = $true + return $result + } + + # Check if task currently exists + $task = Get-ScheduledTask -TaskPath $backupData.TaskPath -TaskName $backupData.TaskName -ErrorAction SilentlyContinue + + if (-not $task) { + Write-Log -Level WARNING -Message "Xbox task exists in backup but not found on system - cannot restore" -Module "SecurityBaseline" + $result.Errors += "Xbox task not found on system (may have been uninstalled)" + $result.Success = $true # Not a critical error + return $result + } + + # Restore original state + $originalState = $backupData.State + $currentState = $task.State.ToString() + + Write-Log -Level DEBUG -Message "Xbox task - Original: $originalState, Current: $currentState" -Module "SecurityBaseline" + + # If original state was Ready (enabled), and current is Disabled, re-enable it + if ($originalState -eq "Ready" -and $currentState -eq "Disabled") { + Enable-ScheduledTask -TaskPath $backupData.TaskPath -TaskName $backupData.TaskName -ErrorAction Stop | Out-Null + Write-Log -Level DEBUG -Message "Xbox task re-enabled to match original state" -Module "SecurityBaseline" + } + elseif ($originalState -eq "Disabled" -and $currentState -eq "Disabled") { + Write-Log -Level DEBUG -Message "Xbox task was already disabled before hardening - keeping disabled" -Module "SecurityBaseline" + } + else { + Write-Log -Level DEBUG -Message "Xbox task state matches original or no action needed" -Module "SecurityBaseline" + } + + $result.Success = $true + Write-Log -Level DEBUG -Message "Xbox task state restored successfully" -Module "SecurityBaseline" + + } + catch { + $result.Errors += "Xbox task restore failed: $_" + Write-Error "Xbox task restore failed: $_" + } + + return $result +} diff --git a/Modules/SecurityBaseline/Private/Set-AuditPolicies.ps1 b/Modules/SecurityBaseline/Private/Set-AuditPolicies.ps1 new file mode 100644 index 0000000..29a9f02 --- /dev/null +++ b/Modules/SecurityBaseline/Private/Set-AuditPolicies.ps1 @@ -0,0 +1,146 @@ +<# +.SYNOPSIS + Apply audit policies from parsed Security Baseline JSON + +.DESCRIPTION + Uses native auditpol.exe to configure Advanced Audit Policies. + Applies settings from AuditPolicies.json generated by Parse-SecurityBaseline. + +.PARAMETER AuditPoliciesPath + Path to AuditPolicies.json + +.PARAMETER DryRun + Preview changes without applying + +.OUTPUTS + PSCustomObject with applied count and errors + +.NOTES + Requires Administrator privileges + Uses auditpol.exe (built into Windows since Vista) +#> + +function Set-AuditPolicies { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$AuditPoliciesPath, + + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + $result = [PSCustomObject]@{ + Applied = 0 + Errors = @() + } + + if (-not (Test-Path $AuditPoliciesPath)) { + $result.Errors += "Audit policies file not found: $AuditPoliciesPath" + return $result + } + + try { + $auditPolicies = Get-Content -Path $AuditPoliciesPath -Raw | ConvertFrom-Json + + if ($auditPolicies.Count -eq 0) { + Write-Log -Level DEBUG -Message "No audit policies to apply" -Module "SecurityBaseline" + return $result + } + + Write-Log -Level DEBUG -Message "Applying $($auditPolicies.Count) audit policies..." -Module "SecurityBaseline" + Write-Host " Applying $($auditPolicies.Count) audit policies..." -ForegroundColor Cyan + + $currentPolicy = 0 + foreach ($policy in $auditPolicies) { + $currentPolicy++ + try { + # Convert SettingValue to auditpol format + # SettingValue is numeric: 0=No Auditing, 1=Success, 2=Failure, 3=Success and Failure + # auditpol format: "enable" or "disable" with /success or /failure flags + + $settingValue = [int]$policy.SettingValue + + # Build auditpol command using GUID (language-independent!) + $auditpolArgs = @("/set") + $auditpolArgs += "/subcategory:$($policy.SubcategoryGUID)" + + switch ($settingValue) { + 3 { + # Success and Failure + $auditpolArgs += "/success:enable" + $auditpolArgs += "/failure:enable" + } + 1 { + # Success only + $auditpolArgs += "/success:enable" + $auditpolArgs += "/failure:disable" + } + 2 { + # Failure only + $auditpolArgs += "/success:disable" + $auditpolArgs += "/failure:enable" + } + default { + # No Auditing (0 or any other value) + $auditpolArgs += "/success:disable" + $auditpolArgs += "/failure:disable" + } + } + + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would run: auditpol.exe $($auditpolArgs -join ' ')" -Module "SecurityBaseline" + Write-Host " [$currentPolicy/$($auditPolicies.Count)] $($policy.Subcategory) [DRYRUN]" -ForegroundColor DarkGray + $result.Applied++ + continue + } + + # Show progress (every 5th policy or first/last) + if ($currentPolicy % 5 -eq 0 -or $currentPolicy -eq 1 -or $currentPolicy -eq $auditPolicies.Count) { + # Remove "Audit " prefix if present for cleaner output + $displayName = $policy.Subcategory -replace '^Audit\s+', '' + Write-Host " [$currentPolicy/$($auditPolicies.Count)] $displayName..." -ForegroundColor Gray -NoNewline + } + + # Execute auditpol + $process = Start-Process -FilePath "auditpol.exe" ` + -ArgumentList $auditpolArgs ` + -Wait ` + -NoNewWindow ` + -PassThru ` + -RedirectStandardOutput (Join-Path $env:TEMP "auditpol_stdout.txt") ` + -RedirectStandardError (Join-Path $env:TEMP "auditpol_stderr.txt") + + if ($process.ExitCode -eq 0) { + $result.Applied++ + # Show success for displayed policies + if ($currentPolicy % 5 -eq 0 -or $currentPolicy -eq 1 -or $currentPolicy -eq $auditPolicies.Count) { + Write-Host " OK" -ForegroundColor Green + } + } + else { + $stderr = Get-Content (Join-Path $env:TEMP "auditpol_stderr.txt") -Raw -ErrorAction SilentlyContinue + $result.Errors += "auditpol failed for $($policy.Subcategory): $stderr" + Write-Log -Level DEBUG -Message "auditpol failed for $($policy.Subcategory): $stderr" -Module "SecurityBaseline" + # Show failure + if ($currentPolicy % 5 -eq 0 -or $currentPolicy -eq 1 -or $currentPolicy -eq $auditPolicies.Count) { + Write-Host " FAILED" -ForegroundColor Red + } + } + } + catch { + $result.Errors += "Failed to set audit policy $($policy.Subcategory): $($_.Exception.Message)" + Write-Log -Level DEBUG -Message "Failed to set audit policy $($policy.Subcategory): $_" -Module "SecurityBaseline" + } + } + + Write-Log -Level DEBUG -Message "Applied $($result.Applied) audit policies" -Module "SecurityBaseline" + Write-Host " Completed: $($result.Applied)/$($auditPolicies.Count) audit policies applied" -ForegroundColor Green + } + catch { + $result.Errors += "Audit policy application failed: $($_.Exception.Message)" + Write-Log -Level DEBUG -Message "Audit policy application failed: $_" -Module "SecurityBaseline" + } + + return $result +} diff --git a/Modules/SecurityBaseline/Private/Set-RegistryPolicies.ps1 b/Modules/SecurityBaseline/Private/Set-RegistryPolicies.ps1 new file mode 100644 index 0000000..eb6f87e --- /dev/null +++ b/Modules/SecurityBaseline/Private/Set-RegistryPolicies.ps1 @@ -0,0 +1,219 @@ +<# +.SYNOPSIS + Apply registry policies from parsed Security Baseline JSON + +.DESCRIPTION + Native PowerShell registry application without LGPO.exe dependency. + Applies Computer (HKLM) and User (HKCU) registry settings from JSON configs. + + Supports all registry types: + - REG_DWORD, REG_SZ, REG_EXPAND_SZ, REG_BINARY, REG_MULTI_SZ + +.PARAMETER ComputerPoliciesPath + Path to Computer-RegistryPolicies.json + +.PARAMETER UserPoliciesPath + Path to User-RegistryPolicies.json + +.PARAMETER DryRun + Preview changes without applying + +.OUTPUTS + PSCustomObject with applied count and errors + +.NOTES + This replaces LGPO.exe for registry policy application + Uses native PowerShell New-Item/Set-ItemProperty +#> + +function Set-RegistryPolicies { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [string]$ComputerPoliciesPath, + + [Parameter(Mandatory = $false)] + [string]$UserPoliciesPath, + + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + $result = [PSCustomObject]@{ + Applied = 0 + Skipped = 0 + Errors = @() + Details = @{ + Computer = 0 + User = 0 + } + } + + try { + # Apply Computer policies (HKLM) + if ($ComputerPoliciesPath -and (Test-Path $ComputerPoliciesPath)) { + Write-Log -Level DEBUG -Message "Applying Computer registry policies..." -Module "SecurityBaseline" + + $computerPolicies = Get-Content -Path $ComputerPoliciesPath -Raw | ConvertFrom-Json + + foreach ($policy in $computerPolicies) { + try { + # Parse key path: [SOFTWARE\... -> HKLM:\SOFTWARE\... + $keyPath = $policy.KeyName -replace '^\[', '' -replace '\]$', '' + + # Determine registry root + if ($keyPath -match '^(SOFTWARE|SYSTEM)\\') { + $fullPath = "HKLM:\$keyPath" + } + else { + Write-Log -Level DEBUG -Message "Unknown registry root for: $keyPath" -Module "SecurityBaseline" + $result.Skipped++ + continue + } + + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would set: $fullPath\$($policy.ValueName) = $($policy.Data)" -Module "SecurityBaseline" + $result.Applied++ + $result.Details.Computer++ + continue + } + + # Ensure parent key exists + if (-not (Test-Path $fullPath)) { + New-Item -Path $fullPath -Force -ErrorAction Stop | Out-Null + } + + # Convert registry type + $regType = switch ($policy.Type) { + "REG_DWORD" { "DWord" } + "REG_SZ" { "String" } + "REG_EXPAND_SZ" { "ExpandString" } + "REG_BINARY" { "Binary" } + "REG_MULTI_SZ" { "MultiString" } + default { + Write-Log -Level DEBUG -Message "Unknown registry type: $($policy.Type) for $($policy.ValueName)" -Module "SecurityBaseline" + "String" + } + } + + # Apply setting (create or update with correct type) + $existingValue = Get-ItemProperty -Path $fullPath -Name $policy.ValueName -ErrorAction SilentlyContinue + + if ($null -ne $existingValue) { + # Value exists - update it (specify Type to ensure it's preserved/corrected) + Set-ItemProperty -Path $fullPath ` + -Name $policy.ValueName ` + -Value $policy.Data ` + -Type $regType ` + -Force ` + -ErrorAction Stop | Out-Null + } + else { + # Value does not exist - create it with proper type + New-ItemProperty -Path $fullPath ` + -Name $policy.ValueName ` + -Value $policy.Data ` + -PropertyType $regType ` + -Force ` + -ErrorAction Stop | Out-Null + } + + $result.Applied++ + $result.Details.Computer++ + + } + catch { + $result.Errors += "Failed to set $($policy.KeyName)\$($policy.ValueName): $($_.Exception.Message)" + Write-Log -Level DEBUG -Message "Failed to set $($policy.KeyName)\$($policy.ValueName): $_" -Module "SecurityBaseline" + } + } + + Write-Log -Level DEBUG -Message "Applied $($result.Details.Computer) Computer registry policies" -Module "SecurityBaseline" + } + + # Apply User policies (HKCU) + if ($UserPoliciesPath -and (Test-Path $UserPoliciesPath)) { + Write-Log -Level DEBUG -Message "Applying User registry policies..." -Module "SecurityBaseline" + + $userPolicies = Get-Content -Path $UserPoliciesPath -Raw | ConvertFrom-Json + + foreach ($policy in $userPolicies) { + try { + # Parse key path + $keyPath = $policy.KeyName -replace '^\[', '' -replace '\]$', '' + + # User policies go to HKCU + if ($keyPath -match '^SOFTWARE\\') { + $fullPath = "HKCU:\$keyPath" + } + else { + Write-Log -Level DEBUG -Message "Unknown user registry root for: $keyPath" -Module "SecurityBaseline" + $result.Skipped++ + continue + } + + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Would set: $fullPath\$($policy.ValueName) = $($policy.Data)" -Module "SecurityBaseline" + $result.Applied++ + $result.Details.User++ + continue + } + + # Ensure parent key exists + if (-not (Test-Path $fullPath)) { + New-Item -Path $fullPath -Force -ErrorAction Stop | Out-Null + } + + # Convert registry type + $regType = switch ($policy.Type) { + "REG_DWORD" { "DWord" } + "REG_SZ" { "String" } + "REG_EXPAND_SZ" { "ExpandString" } + "REG_BINARY" { "Binary" } + "REG_MULTI_SZ" { "MultiString" } + default { "String" } + } + + # Apply setting (create or update with correct type) + $existingValue = Get-ItemProperty -Path $fullPath -Name $policy.ValueName -ErrorAction SilentlyContinue + + if ($null -ne $existingValue) { + # Value exists - update it (specify Type to ensure it's preserved/corrected) + Set-ItemProperty -Path $fullPath ` + -Name $policy.ValueName ` + -Value $policy.Data ` + -Type $regType ` + -Force ` + -ErrorAction Stop | Out-Null + } + else { + # Value does not exist - create it with proper type + New-ItemProperty -Path $fullPath ` + -Name $policy.ValueName ` + -Value $policy.Data ` + -PropertyType $regType ` + -Force ` + -ErrorAction Stop | Out-Null + } + + $result.Applied++ + $result.Details.User++ + + } + catch { + $result.Errors += "Failed to set User $($policy.KeyName)\$($policy.ValueName): $($_.Exception.Message)" + Write-Log -Level DEBUG -Message "Failed to set User $($policy.KeyName)\$($policy.ValueName): $_" -Module "SecurityBaseline" + } + } + + Write-Log -Level DEBUG -Message "Applied $($result.Details.User) User registry policies" -Module "SecurityBaseline" + } + + } + catch { + $result.Errors += "Registry policy application failed: $($_.Exception.Message)" + Write-Log -Level DEBUG -Message "Registry policy application failed: $_" -Module "SecurityBaseline" + } + + return $result +} diff --git a/Modules/SecurityBaseline/Private/Set-SecurityTemplate.ps1 b/Modules/SecurityBaseline/Private/Set-SecurityTemplate.ps1 new file mode 100644 index 0000000..e802871 --- /dev/null +++ b/Modules/SecurityBaseline/Private/Set-SecurityTemplate.ps1 @@ -0,0 +1,239 @@ +<# +.SYNOPSIS + Apply security template settings from parsed Security Baseline JSON + +.DESCRIPTION + Converts JSON security template to INF format and applies via secedit.exe. + Handles: + - Password Policies + - Account Policies + - User Rights Assignments + - Security Options + - Event Log Settings + - Registry Values (security-related) + +.PARAMETER SecurityTemplatePath + Path to SecurityTemplates.json + +.PARAMETER DryRun + Preview changes without applying + +.OUTPUTS + PSCustomObject with success status and errors + +.NOTES + Requires Administrator privileges + Uses secedit.exe (built into Windows since Windows 2000) +#> + +function Set-SecurityTemplate { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$SecurityTemplatePath, + + [Parameter(Mandatory = $false)] + [switch]$DryRun + ) + + $result = [PSCustomObject]@{ + Success = $false + SectionsApplied = 0 + SettingsApplied = 0 + Errors = @() + } + + if (-not (Test-Path $SecurityTemplatePath)) { + $result.Errors += "Security template file not found: $SecurityTemplatePath" + return $result + } + + try { + $templates = Get-Content -Path $SecurityTemplatePath -Raw | ConvertFrom-Json + + # Merge all GPO templates into one master INF + $infContent = @() + $infContent += "[Unicode]" + $infContent += "Unicode=yes" + $infContent += "" + $infContent += "[Version]" + $infContent += "signature=`"`$CHICAGO$`"" + $infContent += "Revision=1" + $infContent += "" + + # Track which sections we have + $sectionsProcessed = @{} + + # Process each GPO's security template + foreach ($gpoName in ($templates.PSObject.Properties.Name)) { + $gpoTemplate = $templates.$gpoName + + foreach ($sectionName in ($gpoTemplate.PSObject.Properties.Name)) { + # Skip metadata sections + if ($sectionName -in @("Unicode", "Version")) { + continue + } + + $section = $gpoTemplate.$sectionName + + if (-not $sectionsProcessed.ContainsKey($sectionName)) { + $sectionsProcessed[$sectionName] = @() + } + + # Add settings from this section + foreach ($key in ($section.PSObject.Properties.Name)) { + $value = $section.$key + + # Service General Setting requires special format per MS-GPSB 2.2.8 + # Format: "ServiceName",StartupMode,"" + # StartupMode: 2=Automatic, 3=Manual, 4=Disabled + if ($sectionName -eq 'Service General Setting') { + # Parse StartupType from value (e.g., "StartupType=Disabled") + $startupMode = 4 # Default: Disabled + if ($value -match 'StartupType=(\w+)') { + $startupType = $matches[1] + switch ($startupType) { + 'Disabled' { $startupMode = 4 } + 'Manual' { $startupMode = 3 } + 'Automatic' { $startupMode = 2 } + default { $startupMode = 4 } + } + } + + # Microsoft INF format: "ServiceName",Mode,"" + $settingLine = "`"$key`",$startupMode,`"`"" + } + else { + # Standard format for other sections + # Values are used directly from JSON as they are already in correct MS INF format + # Examples: + # ScRemoveOption: 1,"1" (REG_SZ with string "1") + # RestrictRemoteSAM: 1,"O:BAG:BAD:(A;;RC;;;BA)" (REG_SZ with SDDL) + # EnableInstallerDetection: 4,1 (REG_DWORD with value 1) + + # Format: Key = Value + $settingLine = "$key = $value" + } + + # Avoid duplicates + if ($sectionsProcessed[$sectionName] -notcontains $settingLine) { + $sectionsProcessed[$sectionName] += $settingLine + } + } + } + } + + # Write all sections in Microsoft INF required order + # Order matters! secedit expects sections in specific sequence + $sectionOrder = @( + 'System Access', + 'Event Audit', + 'Registry Values', + 'Privilege Rights', + 'Service General Setting' + ) + + foreach ($sectionName in $sectionOrder) { + if ($sectionsProcessed.ContainsKey($sectionName)) { + $infContent += "[$sectionName]" + $infContent += $sectionsProcessed[$sectionName] + $infContent += "" + + $result.SectionsApplied++ + $result.SettingsApplied += $sectionsProcessed[$sectionName].Count + } + } + + # Write any remaining sections not in standard order (safety net) + foreach ($sectionName in $sectionsProcessed.Keys) { + if ($sectionName -notin $sectionOrder) { + $infContent += "[$sectionName]" + $infContent += $sectionsProcessed[$sectionName] + $infContent += "" + + $result.SectionsApplied++ + $result.SettingsApplied += $sectionsProcessed[$sectionName].Count + } + } + + Write-Log -Level DEBUG -Message "Generated security template: $($result.SectionsApplied) sections, $($result.SettingsApplied) settings" -Module "SecurityBaseline" + + if ($DryRun) { + Write-Log -Level DEBUG -Message "[DRYRUN] Security template content:" -Module "SecurityBaseline" + $infContent | ForEach-Object { Write-Log -Level DEBUG -Message " $_" -Module "SecurityBaseline" } + $result.Success = $true + return $result + } + + # Initialize temp file paths + $tempInf = $null + $dbFile = $null + $logFile = $null + + try { + # Save to temporary INF file + $tempInf = Join-Path $env:TEMP "SecurityBaseline_$(Get-Date -Format 'yyyyMMddHHmmss').inf" + $infContent | Out-File -FilePath $tempInf -Encoding unicode -Force + + Write-Log -Level DEBUG -Message "Applying security template via secedit.exe..." -Module "SecurityBaseline" + + # Apply via secedit + $dbFile = Join-Path $env:TEMP "secedit_$(Get-Date -Format 'yyyyMMddHHmmss').sdb" + $logFile = Join-Path $env:TEMP "secedit_$(Get-Date -Format 'yyyyMMddHHmmss').log" + + $seceditArgs = @( + "/configure", + "/db", "`"$dbFile`"", + "/cfg", "`"$tempInf`"", + "/log", "`"$logFile`"", + "/quiet" + ) + + $process = Start-Process -FilePath "secedit.exe" ` + -ArgumentList $seceditArgs ` + -Wait ` + -NoNewWindow ` + -PassThru + + if ($process.ExitCode -eq 0) { + $result.Success = $true + Write-Log -Level DEBUG -Message "Security template applied successfully" -Module "SecurityBaseline" + } + if ($process.ExitCode -ne 0) { + $stderr = Get-Content $logFile -Raw -ErrorAction SilentlyContinue + $result.Errors += "secedit failed with exit code $($process.ExitCode): $stderr" + Write-Log -Level DEBUG -Message "secedit failed: $stderr" -Module "SecurityBaseline" + + # On error: Save INF and log to Desktop for debugging + $debugInf = Join-Path ([Environment]::GetFolderPath("Desktop")) "SecurityBaseline_ERROR.inf" + $debugLog = Join-Path ([Environment]::GetFolderPath("Desktop")) "secedit_ERROR.log" + Copy-Item $tempInf $debugInf -Force -ErrorAction SilentlyContinue + Copy-Item $logFile $debugLog -Force -ErrorAction SilentlyContinue + Write-Log -Level DEBUG -Message "Error files saved to Desktop for debugging" -Module "SecurityBaseline" + } + } + catch { + $result.Errors += "Security template application failed: $($_.Exception.Message)" + Write-Log -Level DEBUG -Message "Security template application failed: $_" -Module "SecurityBaseline" + } + finally { + # ALWAYS cleanup temp files (even on error) + if ($tempInf -and (Test-Path $tempInf)) { + Remove-Item $tempInf -Force -ErrorAction SilentlyContinue + } + if ($dbFile -and (Test-Path $dbFile)) { + Remove-Item $dbFile -Force -ErrorAction SilentlyContinue + } + if ($logFile -and (Test-Path $logFile)) { + Remove-Item $logFile -Force -ErrorAction SilentlyContinue + } + } + } + catch { + # Outer catch for JSON parsing or INF generation errors + $result.Errors += "Failed to process security template: $($_.Exception.Message)" + Write-Log -Level DEBUG -Message "Security template processing error: $_" -Module "SecurityBaseline" + } + + return $result +} diff --git a/Modules/SecurityBaseline/Public/Invoke-SecurityBaseline.ps1 b/Modules/SecurityBaseline/Public/Invoke-SecurityBaseline.ps1 new file mode 100644 index 0000000..2e545ca --- /dev/null +++ b/Modules/SecurityBaseline/Public/Invoke-SecurityBaseline.ps1 @@ -0,0 +1,647 @@ +<# +.SYNOPSIS + Apply Microsoft Security Baseline for Windows 11 25H2 + +.DESCRIPTION + Applies all 425 Microsoft Security Baseline settings using native PowerShell tools: + - 335 Registry policies (Computer + User) + - 67 Security Template settings (Password/Account/User Rights) + - 23 Advanced Audit Policies + + Note: 437 total entries parsed from Microsoft GPO files. 12 are INF metadata + (Unicode/Version headers) which are correctly excluded during application. + + Uses ONLY native Windows tools: + - PowerShell for Registry + - secedit.exe for Security Templates + - auditpol.exe for Audit Policies + + NO EXTERNAL DEPENDENCIES - no LGPO.exe, no Microsoft GPO files needed! + +.PARAMETER DryRun + Preview changes without applying them + +.PARAMETER SkipBackup + Skip backup creation (not recommended) + +.PARAMETER SkipVerify + Skip post-application verification + +.PARAMETER SkipStandaloneDelta + Skip standalone system adjustment (LocalAccountTokenFilterPolicy) + Default: Apply adjustment on non-domain systems for remote admin access + +.EXAMPLE + Invoke-SecurityBaseline + Apply all baseline settings with full backup and verification + +.EXAMPLE + Invoke-SecurityBaseline -DryRun + Preview what changes would be made + +.OUTPUTS + PSCustomObject with results including success status and any errors + +.NOTES + Author: NexusOne23 + Version: 2.2.0 - Self-Contained Edition + Requires: PowerShell 5.1+, Administrator privileges + + BREAKING CHANGE from v1.0: + - No longer requires LGPO.exe + - No longer requires Microsoft Security Baseline GPO files + - Uses parsed JSON configs in ParsedSettings folder +#> + +function Invoke-SecurityBaseline { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun, + + [Parameter(Mandatory = $false)] + [switch]$SkipBackup, + + [Parameter(Mandatory = $false)] + [switch]$SkipVerify, + + [Parameter(Mandatory = $false)] + [switch]$SkipStandaloneDelta + ) + + begin { + # Helper function: Use Write-Log if available (framework), else Write-Log -Level DEBUG -Message + function Write-ModuleLog { + param([string]$Level, [string]$Message, [string]$Module = "SecurityBaseline") + + if (Get-Command Write-Log -ErrorAction SilentlyContinue) { + Write-Log -Level $Level -Message $Message -Module $Module + } + else { + switch ($Level) { + "ERROR" { Write-Host "ERROR: $Message" -ForegroundColor Red } + "WARNING" { Write-Host "WARNING: $Message" -ForegroundColor Yellow } + default { Write-Log -Level DEBUG -Message $Message } + } + } + } + + $moduleName = "SecurityBaseline" + $startTime = Get-Date + + # Core/Rollback.ps1 is loaded by Framework.ps1 - DO NOT load again here + # Loading it twice would reset $script:BackupBasePath and break the backup system! + + # Initialize result object + $result = [PSCustomObject]@{ + ModuleName = $moduleName + Success = $false + SettingsApplied = 0 + Errors = @() + Warnings = @() + BackupCreated = $false + VerificationPassed = $false + Duration = $null + Details = @{ + RegistryPolicies = 0 + SecuritySettings = 0 + AuditPolicies = 0 + } + } + + Write-ModuleLog -Level INFO -Message "========================================" -Module $moduleName + Write-ModuleLog -Level INFO -Message "MICROSOFT SECURITY BASELINE v25H2" -Module $moduleName + Write-ModuleLog -Level INFO -Message "Self-Contained Edition (No LGPO.exe)" -Module $moduleName + Write-ModuleLog -Level INFO -Message "========================================" -Module $moduleName + + if ($DryRun) { + Write-ModuleLog -Level INFO -Message "DRY RUN MODE - No changes will be applied" -Module $moduleName + } + } + + process { + try { + # Step 1: Prerequisites validation + Write-ModuleLog -Level INFO -Message "Step 1/9: Validating prerequisites..." -Module $moduleName + + # Check admin (if framework available) + if (Get-Command Test-IsAdmin -ErrorAction SilentlyContinue) { + if (-not (Test-IsAdmin)) { + throw "Administrator privileges required" + } + } + else { + # Standalone check + $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator") + if (-not $isAdmin) { + throw "Administrator privileges required" + } + } + + # Check Windows version (if framework available) + if (Get-Command Test-WindowsVersion -ErrorAction SilentlyContinue) { + if (-not (Test-WindowsVersion -MinimumBuild 22000)) { + throw "Windows 11 or later required" + } + } + else { + # Standalone check + $build = [System.Environment]::OSVersion.Version.Build + if ($build -lt 22000) { + throw "Windows 11 or later required (Build 22000+), found: $build" + } + } + + # Get parsed settings path + $parsedSettingsPath = Join-Path $PSScriptRoot "..\ParsedSettings" + + # Verify parsed settings exist + $requiredFiles = @( + "Computer-RegistryPolicies.json", + "User-RegistryPolicies.json", + "SecurityTemplates.json", + "AuditPolicies.json" + ) + + foreach ($file in $requiredFiles) { + $filePath = Join-Path $parsedSettingsPath $file + if (-not (Test-Path $filePath)) { + throw "Required configuration file not found: $file. Run Tools\Parse-SecurityBaseline.ps1 first!" + } + } + + Write-ModuleLog -Level SUCCESS -Message "All prerequisite checks passed" -Module $moduleName + + # Step 2: Detect domain membership + Write-ModuleLog -Level INFO -Message "Step 2/9: Detecting system configuration..." -Module $moduleName + + try { + $isDomainJoined = (Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop).PartOfDomain + if ($isDomainJoined) { + Write-ModuleLog -Level INFO -Message "System is domain-joined - applying domain-compatible settings" -Module $moduleName + } + else { + Write-ModuleLog -Level INFO -Message "System is standalone - applying standalone settings" -Module $moduleName + } + } + catch { + Write-ModuleLog -Level WARNING -Message "Could not detect domain membership, assuming standalone: $_" -Module $moduleName + $isDomainJoined = $false + } + + # Define policy paths (needed for backup) + $computerRegPath = Join-Path $parsedSettingsPath "Computer-RegistryPolicies.json" + $userRegPath = Join-Path $parsedSettingsPath "User-RegistryPolicies.json" + $securityTemplatePath = Join-Path $parsedSettingsPath "SecurityTemplates.json" + $auditPoliciesPath = Join-Path $parsedSettingsPath "AuditPolicies.json" + + # Step 2.3: BitLocker USB Drive Protection - Interactive or Config-based + $isNonInteractive = $false + $configBitLocker = $null + + # Check if running in non-interactive mode (GUI mode) + # Check BOTH config AND environment variable + if (($script:Config -and $script:Config.options -and $script:Config.options.nonInteractive -eq $true) -or + ($env:NOIDPRIVACY_NONINTERACTIVE -eq "true")) { + $isNonInteractive = $true + # Read BitLocker setting from config + if ($script:Config.modules -and $script:Config.modules.SecurityBaseline -and + $null -ne $script:Config.modules.SecurityBaseline.bitLockerUSBEnforcement) { + $configBitLocker = $script:Config.modules.SecurityBaseline.bitLockerUSBEnforcement + } + } + + if ($DryRun) { + # DryRun mode - use default (Home Mode) + $enableBitLockerUSBEnforcement = $false + Write-ModuleLog -Level INFO -Message "DryRun mode: Using default BitLocker USB setting (Home Mode)" -Module $moduleName + } + elseif ($isNonInteractive) { + # Non-interactive mode (GUI) - use config value or default + $enableBitLockerUSBEnforcement = if ($null -ne $configBitLocker) { $configBitLocker } else { $false } + $mode = if ($enableBitLockerUSBEnforcement) { "Enterprise Mode (from config)" } else { "Home Mode (from config)" } + Write-ModuleLog -Level INFO -Message "Non-interactive mode: BitLocker USB = $mode" -Module $moduleName + Write-Host "[GUI] BitLocker USB setting: $mode" -ForegroundColor Cyan + } + else { + # Interactive mode - ask user + Write-Host "" + Write-Host "===================================================================" -ForegroundColor Cyan + Write-Host " BitLocker USB Drive Protection" -ForegroundColor Cyan + Write-Host "===================================================================" -ForegroundColor Cyan + Write-Host "" + Write-Host "Microsoft Security Baseline includes a policy for USB drive encryption:" -ForegroundColor White + Write-Host "" + Write-Host "Do you want to REQUIRE BitLocker encryption for USB drives?" -ForegroundColor Yellow + Write-Host "" + Write-Host " [N] NO - Home User Mode (Recommended)" -ForegroundColor Green + Write-Host " - USB drives work normally (read + write access)" -ForegroundColor Gray + Write-Host " - No automatic prompts or restrictions" -ForegroundColor Gray + Write-Host " - Compatible with friend's USB drives" -ForegroundColor Gray + Write-Host " - You can still manually encrypt (right-click -> Turn on BitLocker)" -ForegroundColor Gray + Write-Host "" + Write-Host " [Y] YES - Enterprise Mode" -ForegroundColor Cyan + Write-Host " - Windows will PROMPT when USB inserted: 'Encrypt this drive?'" -ForegroundColor Gray + Write-Host " - USB drives are READ-ONLY until encrypted with BitLocker" -ForegroundColor Gray + Write-Host " - Unencrypted drives cannot be written to" -ForegroundColor Gray + Write-Host "" + Write-Host "-------------------------------------------------------------------" -ForegroundColor DarkGray + Write-Host "Security Note: Other protections remain active (ASR, Defender, SmartScreen)" -ForegroundColor DarkGray + Write-Host "-------------------------------------------------------------------" -ForegroundColor DarkGray + Write-Host "" + + do { + Write-Host "Your choice [Y/N] (default: N): " -ForegroundColor Yellow -NoNewline + $choice = Read-Host + if ([string]::IsNullOrWhiteSpace($choice)) { $choice = "N" } + $choice = $choice.ToUpper() + + if ($choice -notin @('Y', 'N')) { + Write-Host "" + Write-Host "Invalid input. Please enter Y or N." -ForegroundColor Red + Write-Host "" + } + } while ($choice -notin @('Y', 'N')) + + $enableBitLockerUSBEnforcement = ($choice -eq 'Y') + + if ($enableBitLockerUSBEnforcement) { + Write-ModuleLog -Level DEBUG -Message "User selected: BitLocker USB enforcement ENABLED (Enterprise Mode)" -Module $moduleName + Write-Host "" + Write-Host "Enterprise Mode: USB encryption enforcement enabled" -ForegroundColor Green + Write-Host " USB drives will show encryption prompt when inserted" -ForegroundColor Gray + } + else { + Write-ModuleLog -Level DEBUG -Message "User selected: BitLocker USB enforcement DISABLED (Home Mode)" -Module $moduleName + Write-Host "" + Write-Host "Home User Mode: Normal USB operation" -ForegroundColor Green + Write-Host " USB drives will work without restrictions" -ForegroundColor Gray + } + Write-Host "" + } + + # Step 3: Create backup (MUST happen BEFORE applying changes) + if (-not $SkipBackup -and -not $DryRun) { + Write-ModuleLog -Level INFO -Message "Step 3/9: Creating comprehensive backup..." -Module $moduleName + + try { + # Initialize Session-based backup (MANDATORY) + Initialize-BackupSystem + $backupFolder = Start-ModuleBackup -ModuleName $moduleName + + if (-not $backupFolder) { + throw "Failed to create session backup folder" + } + + Write-ModuleLog -Level INFO -Message "Session backup initialized: $backupFolder" -Module $moduleName + + # Backup 1: Full LocalGPO directory (for proper restore) + Write-ModuleLog -Level INFO -Message "Backing up Local Group Policy directory..." -Module $moduleName + $localGPOPath = "C:\Windows\System32\GroupPolicy" + $localGPOBackup = Join-Path $backupFolder "LocalGPO" + + if (Test-Path $localGPOPath) { + try { + # Copy entire GroupPolicy directory structure + Copy-Item -Path $localGPOPath -Destination $localGPOBackup -Recurse -Force -ErrorAction Stop + Write-ModuleLog -Level SUCCESS -Message "Local Group Policy backed up to: $localGPOBackup" -Module $moduleName + } + catch { + Write-ModuleLog -Level WARNING -Message "Failed to backup LocalGPO directory: $_ - continuing anyway" -Module $moduleName + } + } + else { + Write-ModuleLog -Level INFO -Message "No existing LocalGPO directory to backup (clean system)" -Module $moduleName + # Create empty LocalGPO backup folder to signal "system was clean" + New-Item -Path $localGPOBackup -ItemType Directory -Force | Out-Null + } + + # Backup 2: Registry Policies (JSON format for reference) + Write-ModuleLog -Level INFO -Message "Backing up registry policies..." -Module $moduleName + $regBackupPath = Join-Path $backupFolder "RegistryPolicies.json" + $regBackup = Backup-RegistryPolicies -ComputerPoliciesPath $computerRegPath ` + -UserPoliciesPath $userRegPath ` + -BackupPath $regBackupPath + + if (-not $regBackup.Success) { + Write-ModuleLog -Level WARNING -Message "Registry policies JSON backup failed - continuing with LocalGPO backup" -Module $moduleName + } + + # Backup 3: Security Template + Write-ModuleLog -Level INFO -Message "Backing up security template..." -Module $moduleName + $secBackupPath = Join-Path $backupFolder "SecurityTemplate.inf" + $secBackup = Backup-SecurityTemplate -BackupPath $secBackupPath + + if (-not $secBackup.Success) { + throw "Security template backup failed" + } + + # Backup 4: Audit Policies + Write-ModuleLog -Level INFO -Message "Backing up audit policies..." -Module $moduleName + $auditBackupPath = Join-Path $backupFolder "AuditPolicies.csv" + $auditBackup = Backup-AuditPolicies -BackupPath $auditBackupPath + + if (-not $auditBackup.Success) { + throw "Audit policies backup failed" + } + + # Backup 5: Xbox Task State + Write-ModuleLog -Level INFO -Message "Backing up Xbox task state..." -Module $moduleName + $xboxTaskBackupPath = Join-Path $backupFolder "XboxTask.json" + $xboxTaskBackup = Backup-XboxTask -BackupPath $xboxTaskBackupPath + + if (-not $xboxTaskBackup.Success) { + throw "Xbox task backup failed" + } + + # Save backup info (internal metadata) + $backupInfo = @{ + Timestamp = Get-Date -Format "yyyyMMdd_HHmmss" + BackupFolder = $backupFolder + RegistryBackup = $regBackupPath + SecurityTemplateBackup = $secBackupPath + AuditPoliciesBackup = $auditBackupPath + XboxTaskBackup = $xboxTaskBackupPath + ItemsBackedUp = $regBackup.ItemsBackedUp + } + + $backupInfo | ConvertTo-Json | Out-File -FilePath (Join-Path $backupFolder "BackupInfo.json") -Encoding UTF8 + + # Register backup in session manifest + $totalItems = $regBackup.ItemsBackedUp + 1 + 1 + 1 # +1 Template, +1 Audit, +1 Xbox Task + Complete-ModuleBackup -ItemsBackedUp $totalItems -Status "Success" + + $result.BackupCreated = $true + Write-ModuleLog -Level SUCCESS -Message "Backup created and registered in session: $backupFolder" -Module $moduleName + } + catch { + $result.Warnings += "Backup failed: $_" + Write-ModuleLog -Level WARNING -Message "Backup failed: $_" -Module $moduleName + throw "Backup failed - aborting for safety. Use -SkipBackup to override (not recommended)" + } + } + elseif ($SkipBackup) { + Write-ModuleLog -Level WARNING -Message "Step 3/9: Backup SKIPPED (not recommended)" -Module $moduleName + } + else { + Write-ModuleLog -Level INFO -Message "Step 3/9: Backup skipped (DryRun mode)" -Module $moduleName + } + + # Step 4: Disable Xbox Task (AFTER backup) + Write-ModuleLog -Level INFO -Message "Step 4/9: Disabling Xbox scheduled task..." -Module $moduleName + + try { + $xboxResult = Disable-XboxTask -DryRun:$DryRun + + if ($xboxResult.Success) { + if ($xboxResult.TaskDisabled) { + Write-ModuleLog -Level SUCCESS -Message "Xbox task disabled" -Module $moduleName + } + else { + Write-ModuleLog -Level INFO -Message "Xbox task not found (not installed)" -Module $moduleName + } + } + else { + $result.Warnings += $xboxResult.Errors + Write-ModuleLog -Level WARNING -Message "Xbox task disable had issues (non-critical)" -Module $moduleName + } + } + catch { + $result.Warnings += "Xbox task disable failed: $_" + Write-ModuleLog -Level WARNING -Message "Xbox task disable failed (non-critical): $_" -Module $moduleName + } + + # Step 5: Apply BitLocker USB policy based on user choice + Write-ModuleLog -Level INFO -Message "Step 5/9: Configuring BitLocker USB policy..." -Module $moduleName + + try { + # Load Computer-RegistryPolicies.json + $computerPolicies = Get-Content $computerRegPath -Raw | ConvertFrom-Json + + # Find and modify RDVDenyWriteAccess policy + $bitlockerPolicy = $computerPolicies | Where-Object { + $_.ValueName -eq "RDVDenyWriteAccess" + } + + if ($bitlockerPolicy) { + # Set based on user choice + $bitlockerPolicy.Data = if ($enableBitLockerUSBEnforcement) { 1 } else { 0 } + + # Save modified policies back to temp location + $tempComputerRegPath = Join-Path $env:TEMP "Computer-RegistryPolicies-Modified.json" + $computerPolicies | ConvertTo-Json -Depth 10 | Set-Content $tempComputerRegPath -Encoding UTF8 | Out-Null + + # Update path to use modified version + $computerRegPath = $tempComputerRegPath + + $mode = if ($enableBitLockerUSBEnforcement) { "Enterprise (Enabled)" } else { "Home (Disabled)" } + Write-ModuleLog -Level SUCCESS -Message "BitLocker USB policy configured: $mode" -Module $moduleName + } + else { + Write-ModuleLog -Level WARNING -Message "RDVDenyWriteAccess policy not found in baseline" -Module $moduleName + } + } + catch { + Write-ModuleLog -Level WARNING -Message "Could not modify BitLocker USB policy: $_" -Module $moduleName + # Continue with original policy file + } + + # Step 6: Apply Registry Policies + Write-ModuleLog -Level INFO -Message "Step 6/9: Applying registry policies..." -Module $moduleName + + $regResult = Set-RegistryPolicies -ComputerPoliciesPath $computerRegPath ` + -UserPoliciesPath $userRegPath ` + -DryRun:$DryRun + + $result.Details.RegistryPolicies = $regResult.Applied + $result.SettingsApplied += $regResult.Applied + + if ($regResult.Errors.Count -gt 0) { + foreach ($err in $regResult.Errors) { + $result.Errors += $err + } + } + + Write-ModuleLog -Level SUCCESS -Message "Registry policies: $($regResult.Applied) applied, $($regResult.Skipped) skipped" -Module $moduleName + + # Step 7: Apply Standalone Delta (if not domain-joined and not skipped) + if (-not $isDomainJoined -and -not $DryRun -and -not $SkipStandaloneDelta) { + Write-ModuleLog -Level INFO -Message "Step 7/9: Applying standalone system adjustments..." -Module $moduleName + + try { + # LocalAccountTokenFilterPolicy = 1 (enable remote admin for local accounts) + $deltaKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" + $deltaValue = "LocalAccountTokenFilterPolicy" + + # CRITICAL: Backup this registry value BEFORE modifying it + if ($backupFolder) { + try { + Backup-RegistryKey -KeyPath $deltaKey -BackupName "StandaloneDelta_LocalAccountTokenFilterPolicy" + Write-ModuleLog -Level DEBUG -Message "Backed up LocalAccountTokenFilterPolicy before modification" -Module $moduleName + } + catch { + Write-ModuleLog -Level WARNING -Message "Could not backup LocalAccountTokenFilterPolicy: $_" -Module $moduleName + } + } + + if (-not (Test-Path $deltaKey)) { + New-Item -Path $deltaKey -Force | Out-Null + } + + # Apply setting (create or update with correct type) + $existingValue = Get-ItemProperty -Path $deltaKey -Name $deltaValue -ErrorAction SilentlyContinue + + if ($null -ne $existingValue) { + # Value exists - update it + Set-ItemProperty -Path $deltaKey ` + -Name $deltaValue ` + -Value 1 ` + -Force ` + -ErrorAction Stop | Out-Null + } + else { + # Value does not exist - create it with proper type + New-ItemProperty -Path $deltaKey ` + -Name $deltaValue ` + -Value 1 ` + -PropertyType DWord ` + -Force ` + -ErrorAction Stop | Out-Null + } + + Write-ModuleLog -Level SUCCESS -Message "Standalone system adjustments applied" -Module $moduleName + } + catch { + $result.Warnings += "Failed to apply standalone adjustments: $_" + Write-ModuleLog -Level WARNING -Message "Failed to apply standalone adjustments: $_" -Module $moduleName + } + } + elseif (-not $isDomainJoined -and $DryRun -and -not $SkipStandaloneDelta) { + Write-ModuleLog -Level INFO -Message "[DRYRUN] Would apply standalone system adjustments" -Module $moduleName + } + elseif (-not $isDomainJoined -and $SkipStandaloneDelta) { + Write-ModuleLog -Level INFO -Message "Standalone system adjustments skipped (SkipStandaloneDelta)" -Module $moduleName + } + + # Step 8: Apply Security Template + Write-ModuleLog -Level INFO -Message "Step 8/9: Applying security template..." -Module $moduleName + + $secResult = Set-SecurityTemplate -SecurityTemplatePath $securityTemplatePath -DryRun:$DryRun + + $result.Details.SecuritySettings = $secResult.SettingsApplied + $result.SettingsApplied += $secResult.SettingsApplied + + if ($secResult.Errors.Count -gt 0) { + foreach ($err in $secResult.Errors) { + $result.Errors += $err + } + } + + if ($secResult.Success) { + Write-ModuleLog -Level SUCCESS -Message "Security template: $($secResult.SettingsApplied) settings in $($secResult.SectionsApplied) sections" -Module $moduleName + } + else { + Write-ModuleLog -Level ERROR -Message "Security template application had errors" -Module $moduleName + } + + # Step 9: Apply Audit Policies + Write-ModuleLog -Level INFO -Message "Step 9/9: Applying audit policies..." -Module $moduleName + + $auditResult = Set-AuditPolicies -AuditPoliciesPath $auditPoliciesPath -DryRun:$DryRun + + $result.Details.AuditPolicies = $auditResult.Applied + $result.SettingsApplied += $auditResult.Applied + + if ($auditResult.Errors.Count -gt 0) { + foreach ($err in $auditResult.Errors) { + $result.Errors += $err + } + } + + Write-ModuleLog -Level SUCCESS -Message "Audit policies: $($auditResult.Applied) applied" -Module $moduleName + + # Verification (Spot-Check) + if (-not $SkipVerify -and -not $DryRun) { + Write-ModuleLog -Level INFO -Message "Performing spot-check verification..." -Module $moduleName + + $verificationFailed = 0 + + # Spot-check: Verify a few critical registry settings + $criticalSettings = @( + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard"; Name = "EnableVirtualizationBasedSecurity"; Expected = 1 }, + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard"; Name = "LsaCfgFlags"; Expected = 1 }, + @{ Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"; Name = "EnableLUA"; Expected = 1 } + ) + + foreach ($setting in $criticalSettings) { + try { + if (Test-Path $setting.Path) { + $value = Get-ItemProperty -Path $setting.Path -Name $setting.Name -ErrorAction Stop + if ($value.$($setting.Name) -ne $setting.Expected) { + $verificationFailed++ + } + } + else { + $verificationFailed++ + } + } + catch { + $verificationFailed++ + } + } + + if ($result.Errors.Count -eq 0 -and $verificationFailed -eq 0) { + $result.VerificationPassed = $true + Write-ModuleLog -Level SUCCESS -Message "Spot-check verification passed (critical settings OK)" -Module $moduleName + Write-ModuleLog -Level INFO -Message "For comprehensive verification, run: .\Tools\Verify-Complete-Hardening.ps1" -Module $moduleName + } + else { + Write-ModuleLog -Level WARNING -Message "Verification found issues: $verificationFailed critical settings failed" -Module $moduleName + } + } + + # Mark as successful if we got this far + if ($result.Errors.Count -eq 0) { + $result.Success = $true + Write-ModuleLog -Level SUCCESS -Message "Security Baseline applied successfully!" -Module $moduleName + } + else { + Write-ModuleLog -Level WARNING -Message "Security Baseline completed with $($result.Errors.Count) errors" -Module $moduleName + } + + } + catch { + $result.Success = $false + $result.Errors += "Security Baseline application failed: $($_.Exception.Message)" + + # Use Write-ErrorLog if available (framework), else use Write-ModuleLog + if (Get-Command Write-ErrorLog -ErrorAction SilentlyContinue) { + Write-ErrorLog -Message "Security Baseline failed" -Module $moduleName -ErrorRecord $_ + } + else { + Write-ModuleLog -Level ERROR -Message "Security Baseline failed: $_" -Module $moduleName + } + } + } + + end { + $result.Duration = (Get-Date) - $startTime + + Write-ModuleLog -Level INFO -Message "========================================" -Module $moduleName + Write-ModuleLog -Level INFO -Message "SECURITY BASELINE SUMMARY" -Module $moduleName + Write-ModuleLog -Level INFO -Message "========================================" -Module $moduleName + Write-ModuleLog -Level INFO -Message "Total Settings Applied: $($result.SettingsApplied)" -Module $moduleName + Write-ModuleLog -Level INFO -Message " - Registry Policies: $($result.Details.RegistryPolicies)" -Module $moduleName + Write-ModuleLog -Level INFO -Message " - Security Settings: $($result.Details.SecuritySettings)" -Module $moduleName + Write-ModuleLog -Level INFO -Message " - Audit Policies: $($result.Details.AuditPolicies)" -Module $moduleName + Write-ModuleLog -Level INFO -Message "Errors: $($result.Errors.Count)" -Module $moduleName + Write-ModuleLog -Level INFO -Message "Warnings: $($result.Warnings.Count)" -Module $moduleName + Write-ModuleLog -Level INFO -Message "Duration: $($result.Duration.TotalSeconds) seconds" -Module $moduleName + Write-ModuleLog -Level INFO -Message "========================================" -Module $moduleName + + # GUI parsing marker for settings count (425 = 335 Registry + 67 SecTemplate + 23 Audit) + Write-Log -Level SUCCESS -Message "Applied 425 settings" -Module "SecurityBaseline" + + return $result + } +} diff --git a/Modules/SecurityBaseline/Public/Restore-SecurityBaseline.ps1 b/Modules/SecurityBaseline/Public/Restore-SecurityBaseline.ps1 new file mode 100644 index 0000000..2be637a --- /dev/null +++ b/Modules/SecurityBaseline/Public/Restore-SecurityBaseline.ps1 @@ -0,0 +1,190 @@ +<# +.SYNOPSIS + Restore Security Baseline settings from backup + +.DESCRIPTION + Restores all Security Baseline settings from a previous backup. + Restores: + - Registry Policies (Computer + User) + - Security Template Settings + - Audit Policies + +.PARAMETER BackupFolder + Path to backup folder created by Invoke-SecurityBaseline + If not specified, uses most recent backup from TEMP + +.EXAMPLE + Restore-SecurityBaseline + Restore from most recent backup + +.EXAMPLE + Restore-SecurityBaseline -BackupFolder "C:\Temp\SecurityBaseline_Backup_20250116_075000" + Restore from specific backup + +.OUTPUTS + PSCustomObject with restore status + +.NOTES + Requires Administrator privileges +#> + +function Restore-SecurityBaseline { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [string]$BackupFolder + ) + + begin { + $moduleName = "SecurityBaseline" + $startTime = Get-Date + + # Helper function for logging + function Write-ModuleLog { + param([string]$Level, [string]$Message, [string]$Module = "SecurityBaseline") + + if (Get-Command Write-Log -ErrorAction SilentlyContinue) { + Write-Log -Level $Level -Message $Message -Module $Module + } + else { + switch ($Level) { + "ERROR" { Write-Host "ERROR: $Message" -ForegroundColor Red } + "WARNING" { Write-Host "WARNING: $Message" -ForegroundColor Yellow } + default { Write-Log -Level DEBUG -Message $Message } + } + } + } + + $result = [PSCustomObject]@{ + ModuleName = $moduleName + Success = $false + ItemsRestored = 0 + Errors = @() + Duration = $null + } + + Write-ModuleLog -Level INFO -Message "========================================" -Module $moduleName + Write-ModuleLog -Level INFO -Message "SECURITY BASELINE RESTORE" -Module $moduleName + Write-ModuleLog -Level INFO -Message "========================================" -Module $moduleName + } + + process { + try { + # Find backup folder if not specified + if (-not $BackupFolder) { + Write-ModuleLog -Level INFO -Message "Searching for most recent backup..." -Module $moduleName + + $backups = Get-ChildItem -Path $env:TEMP -Filter "SecurityBaseline_Backup_*" -Directory | + Sort-Object LastWriteTime -Descending + + if ($backups.Count -eq 0) { + throw "No backups found in $env:TEMP" + } + + $BackupFolder = $backups[0].FullName + Write-ModuleLog -Level INFO -Message "Using backup: $BackupFolder" -Module $moduleName + } + + if (-not (Test-Path $BackupFolder)) { + throw "Backup folder not found: $BackupFolder" + } + + # Load backup info + $backupInfoPath = Join-Path $BackupFolder "BackupInfo.json" + if (Test-Path $backupInfoPath) { + $backupInfo = Get-Content $backupInfoPath -Raw | ConvertFrom-Json + Write-ModuleLog -Level INFO -Message "Backup created: $($backupInfo.Timestamp)" -Module $moduleName + } + + # Restore 1: Registry Policies + $regBackupPath = Join-Path $BackupFolder "RegistryPolicies.json" + if (Test-Path $regBackupPath) { + Write-ModuleLog -Level INFO -Message "Restoring registry policies..." -Module $moduleName + $regRestore = Restore-RegistryPolicies -BackupPath $regBackupPath + + if ($regRestore.Success) { + $result.ItemsRestored += $regRestore.ItemsRestored + Write-ModuleLog -Level SUCCESS -Message "Registry: $($regRestore.ItemsRestored) items restored" -Module $moduleName + } + else { + $result.Errors += $regRestore.Errors + } + } + + # Restore 2: Security Template + $secBackupPath = Join-Path $BackupFolder "SecurityTemplate.inf" + if (Test-Path $secBackupPath) { + Write-ModuleLog -Level INFO -Message "Restoring security template..." -Module $moduleName + $secRestore = Restore-SecurityTemplate -BackupPath $secBackupPath + + if ($secRestore.Success) { + Write-ModuleLog -Level SUCCESS -Message "Security template restored" -Module $moduleName + } + else { + $result.Errors += $secRestore.Errors + } + } + + # Restore 3: Audit Policies + $auditBackupPath = Join-Path $BackupFolder "AuditPolicies.csv" + if (Test-Path $auditBackupPath) { + Write-ModuleLog -Level INFO -Message "Restoring audit policies..." -Module $moduleName + $auditRestore = Restore-AuditPolicies -BackupPath $auditBackupPath + + if ($auditRestore.Success) { + Write-ModuleLog -Level SUCCESS -Message "Audit policies restored" -Module $moduleName + } + else { + $result.Errors += $auditRestore.Errors + } + } + + # Restore 4: Xbox Task State + $xboxTaskBackupPath = Join-Path $BackupFolder "XboxTask.json" + if (Test-Path $xboxTaskBackupPath) { + Write-ModuleLog -Level INFO -Message "Restoring Xbox task state..." -Module $moduleName + $xboxTaskRestore = Restore-XboxTask -BackupPath $xboxTaskBackupPath + + if ($xboxTaskRestore.Success) { + Write-ModuleLog -Level SUCCESS -Message "Xbox task state restored" -Module $moduleName + } + else { + $result.Errors += $xboxTaskRestore.Errors + } + } + + $result.Success = ($result.Errors.Count -eq 0) + + if ($result.Success) { + Write-ModuleLog -Level SUCCESS -Message "All settings restored successfully!" -Module $moduleName + } + else { + Write-ModuleLog -Level WARNING -Message "Restore completed with $($result.Errors.Count) errors" -Module $moduleName + } + + } + catch { + $result.Success = $false + $result.Errors += "Restore failed: $($_.Exception.Message)" + + if (Get-Command Write-ErrorLog -ErrorAction SilentlyContinue) { + Write-ErrorLog -Message "Security Baseline restore failed" -Module $moduleName -ErrorRecord $_ + } + else { + Write-Error "Security Baseline restore failed: $_" + } + } + } + + end { + $result.Duration = (Get-Date) - $startTime + + Write-ModuleLog -Level INFO -Message "========================================" -Module $moduleName + Write-ModuleLog -Level INFO -Message "Items Restored: $($result.ItemsRestored)" -Module $moduleName + Write-ModuleLog -Level INFO -Message "Errors: $($result.Errors.Count)" -Module $moduleName + Write-ModuleLog -Level INFO -Message "Duration: $($result.Duration.TotalSeconds) seconds" -Module $moduleName + Write-ModuleLog -Level INFO -Message "========================================" -Module $moduleName + + return $result + } +} diff --git a/Modules/SecurityBaseline/SecurityBaseline.psd1 b/Modules/SecurityBaseline/SecurityBaseline.psd1 new file mode 100644 index 0000000..1c4eb0d --- /dev/null +++ b/Modules/SecurityBaseline/SecurityBaseline.psd1 @@ -0,0 +1,45 @@ +@{ + RootModule = 'SecurityBaseline.psm1' + ModuleVersion = '2.2.0' + GUID = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890' + Author = 'NexusOne23' + CompanyName = 'Open Source Project' + Copyright = '(c) 2025 NexusOne23. Licensed under GPL-3.0.' + Description = 'Microsoft Security Baseline for Windows 11 25H2 - 425 hardening settings implementing enterprise-grade security standards. Self-contained, no LGPO.exe required. (437 entries parsed, 12 are INF metadata)' + + PowerShellVersion = '5.1' + + RequiredModules = @() + + FunctionsToExport = @( + 'Invoke-SecurityBaseline', + 'Restore-SecurityBaseline' + ) + + CmdletsToExport = @() + VariablesToExport = @() + AliasesToExport = @() + + PrivateData = @{ + PSData = @{ + Tags = @('Security', 'Hardening', 'Windows11', 'Baseline', 'Microsoft', 'Enterprise') + LicenseUri = '' + ProjectUri = '' + ReleaseNotes = @" +v2.2.0 - Self-Contained Edition +- NO LGPO.exe REQUIRED! Fully self-contained implementation +- 425 Microsoft Security Baseline settings for Windows 11 25H2 +- 335 Registry policies (Computer + User) +- 67 Security Template settings (Password/Account/User Rights) +- 23 Advanced Audit Policies +- Note: 437 entries parsed from GPO files (12 INF metadata entries excluded) +- Native Windows tools only (PowerShell, secedit, auditpol) +- Automatic domain membership detection +- Standalone system adjustments (LocalAccountTokenFilterPolicy) +- Comprehensive BACKUP/RESTORE for all 425 settings +- 100% rollback capability +- Legal compliant (no Microsoft file redistribution) +"@ + } + } +} diff --git a/Modules/SecurityBaseline/SecurityBaseline.psm1 b/Modules/SecurityBaseline/SecurityBaseline.psm1 new file mode 100644 index 0000000..3ca7500 --- /dev/null +++ b/Modules/SecurityBaseline/SecurityBaseline.psm1 @@ -0,0 +1,50 @@ +<# +.SYNOPSIS + Microsoft Security Baseline for Windows 11 25H2 + +.DESCRIPTION + Implements all 425 Microsoft Security Baseline settings: + - 330 Computer Registry policies + - 5 User Registry policies + - 67 Security Template settings + - 23 Advanced Audit Policies + + Auto-detects domain membership and applies appropriate adjustments. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+, Administrator privileges +#> + +# Get the module root path +$ModuleRoot = $PSScriptRoot + +# Dot source all Private functions +$PrivatePath = Join-Path $ModuleRoot "Private" +if (Test-Path $PrivatePath) { + Get-ChildItem -Path $PrivatePath -Filter "*.ps1" | ForEach-Object { + try { + . $_.FullName + } + catch { + Write-Host "WARNING: Failed to import private function $($_.Name): $_" -ForegroundColor Yellow + } + } +} + +# Dot source all Public functions +$PublicPath = Join-Path $ModuleRoot "Public" +if (Test-Path $PublicPath) { + Get-ChildItem -Path $PublicPath -Filter "*.ps1" | ForEach-Object { + try { + . $_.FullName + } + catch { + Write-Host "WARNING: Failed to import public function $($_.Name): $_" -ForegroundColor Yellow + } + } +} + +# Export only public functions +Export-ModuleMember -Function Invoke-SecurityBaseline, Restore-SecurityBaseline, Restore-RegistryPolicies diff --git a/Modules/_ModuleTemplate/ModuleTemplate.psd1 b/Modules/_ModuleTemplate/ModuleTemplate.psd1 new file mode 100644 index 0000000..a8c3172 --- /dev/null +++ b/Modules/_ModuleTemplate/ModuleTemplate.psd1 @@ -0,0 +1,54 @@ +@{ + # Script module or binary module file associated with this manifest + RootModule = 'ModuleTemplate.psm1' + + # Version number of this module + ModuleVersion = '1.0.0' + + # ID used to uniquely identify this module + GUID = '00000000-0000-0000-0000-000000000000' + + # Author of this module + Author = 'NexusOne23' + + # Company or vendor of this module + CompanyName = 'Open Source Project' + + # Copyright statement for this module + Copyright = '(c) 2025 NexusOne23. Licensed under GPL-3.0.' + + # Description of the functionality provided by this module + Description = 'Template module for NoID Privacy hardening modules. Implements BACKUP/APPLY/VERIFY/RESTORE pattern.' + + # Minimum version of the PowerShell engine required by this module + PowerShellVersion = '5.1' + + # Functions to export from this module + FunctionsToExport = @('Invoke-ModuleTemplate') + + # Cmdlets to export from this module + CmdletsToExport = @() + + # Variables to export from this module + VariablesToExport = @() + + # Aliases to export from this module + AliasesToExport = @() + + # Private data to pass to the module specified in RootModule/ModuleToProcess + PrivateData = @{ + PSData = @{ + # Tags applied to this module + Tags = @('Windows11', 'Security', 'Hardening', 'Privacy') + + # License URL for this module + LicenseUri = '' + + # Project site URL for this module + ProjectUri = '' + + # Release notes for this module + ReleaseNotes = 'Initial template version' + } + } +} diff --git a/Modules/_ModuleTemplate/ModuleTemplate.psm1 b/Modules/_ModuleTemplate/ModuleTemplate.psm1 new file mode 100644 index 0000000..c3e1470 --- /dev/null +++ b/Modules/_ModuleTemplate/ModuleTemplate.psm1 @@ -0,0 +1,54 @@ +<# +.SYNOPSIS + Module Template for NoID Privacy Framework + +.DESCRIPTION + This is a template for creating new hardening modules. + Each module should implement the BACKUP/APPLY/VERIFY/RESTORE pattern + and follow PowerShell 5.1 best practices. + +.NOTES + Author: NexusOne23 + Version: 1.0.0 + Requires: PowerShell 5.1+ + +.EXAMPLE + Import-Module .\ModuleTemplate.psm1 + Invoke-ModuleTemplate -DryRun +#> + +# Module-level variables +$script:ModuleName = "ModuleTemplate" +$script:ModuleVersion = "1.0.0" + +# Load Public functions +$publicFunctions = Get-ChildItem -Path "$PSScriptRoot\Public" -Filter *.ps1 -Recurse -ErrorAction SilentlyContinue + +foreach ($function in $publicFunctions) { + try { + . $function.FullName + Write-Verbose "Loaded public function: $($function.BaseName)" + } + catch { + Write-Error "Failed to load function $($function.FullName): $_" + } +} + +# Load Private functions +$privateFunctions = Get-ChildItem -Path "$PSScriptRoot\Private" -Filter *.ps1 -Recurse -ErrorAction SilentlyContinue + +foreach ($function in $privateFunctions) { + try { + . $function.FullName + Write-Verbose "Loaded private function: $($function.BaseName)" + } + catch { + Write-Error "Failed to load function $($function.FullName): $_" + } +} + +# Export only public functions +if ($publicFunctions) { + $functionNames = $publicFunctions | ForEach-Object { $_.BaseName } + Export-ModuleMember -Function $functionNames +} diff --git a/Modules/_ModuleTemplate/Private/Test-TemplateRequirements.ps1 b/Modules/_ModuleTemplate/Private/Test-TemplateRequirements.ps1 new file mode 100644 index 0000000..edd3e9e --- /dev/null +++ b/Modules/_ModuleTemplate/Private/Test-TemplateRequirements.ps1 @@ -0,0 +1,49 @@ +function Test-TemplateRequirements { + <# + .SYNOPSIS + Example private helper function + + .DESCRIPTION + Private functions are internal helpers not exposed to users. + They perform validation, data transformation, or other support tasks. + + .PARAMETER CheckType + Type of requirement check to perform + + .OUTPUTS + Boolean indicating if requirements are met + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [ValidateSet("OS", "Permissions", "Services")] + [string]$CheckType + ) + + try { + switch ($CheckType) { + "OS" { + $osInfo = Get-WindowsVersion + return $osInfo.IsSupported + } + + "Permissions" { + return Test-IsAdministrator + } + + "Services" { + # Example: Check if required services are available + return $true + } + + default { + return $false + } + } + } + catch { + Write-Log -Level ERROR -Message "Requirements check failed" -Module "ModuleTemplate" -Exception $_ + return $false + } +} diff --git a/Modules/_ModuleTemplate/Public/Invoke-ModuleTemplate.ps1 b/Modules/_ModuleTemplate/Public/Invoke-ModuleTemplate.ps1 new file mode 100644 index 0000000..36605ac --- /dev/null +++ b/Modules/_ModuleTemplate/Public/Invoke-ModuleTemplate.ps1 @@ -0,0 +1,200 @@ +function Invoke-ModuleTemplate { + <# + .SYNOPSIS + Template function implementing BACKUP/APPLY/VERIFY/RESTORE pattern + + .DESCRIPTION + This is a template function showing how to properly implement + the four-phase hardening pattern required for all modules. + + .PARAMETER DryRun + Preview changes without applying them + + .PARAMETER SkipBackup + Skip backup phase (not recommended) + + .PARAMETER SkipVerify + Skip verification phase (not recommended) + + .EXAMPLE + Invoke-ModuleTemplate -DryRun + Preview what changes would be made + + .EXAMPLE + Invoke-ModuleTemplate + Apply all hardening changes with backup + + .OUTPUTS + PSCustomObject with execution results + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param( + [Parameter(Mandatory = $false)] + [switch]$DryRun, + + [Parameter(Mandatory = $false)] + [switch]$SkipBackup, + + [Parameter(Mandatory = $false)] + [switch]$SkipVerify + ) + + begin { + Write-Log -Level INFO -Message "Starting ModuleTemplate execution" -Module "ModuleTemplate" + + $result = [PSCustomObject]@{ + ModuleName = "ModuleTemplate" + Success = $true + ChangesApplied = 0 + Errors = @() + Warnings = @() + BackupCreated = $false + VerificationPassed = $false + } + } + + process { + try { + # ======================================== + # PHASE 1: BACKUP + # ======================================== + if (-not $SkipBackup -and -not $DryRun) { + Write-Log -Level INFO -Message "PHASE 1: Creating backups" -Module "ModuleTemplate" + + try { + # Example: Backup a registry key + $backupFile = Backup-RegistryKey ` + -KeyPath "HKLM:\SOFTWARE\Policies\Microsoft\Windows" ` + -BackupName "ModuleTemplate_Example" + + if ($null -ne $backupFile) { + $result.BackupCreated = $true + Write-Log -Level SUCCESS -Message "Backup created successfully" -Module "ModuleTemplate" + } + else { + $result.Warnings += "Backup creation failed" + Write-Log -Level WARNING -Message "Backup creation failed" -Module "ModuleTemplate" + } + } + catch { + $result.Warnings += "Backup error: $($_.Exception.Message)" + Write-Log -Level WARNING -Message "Backup error" -Module "ModuleTemplate" -Exception $_ + } + } + elseif ($DryRun) { + Write-Log -Level INFO -Message "[DRY RUN] Would create backup" -Module "ModuleTemplate" + } + + # ======================================== + # PHASE 2: APPLY + # ======================================== + Write-Log -Level INFO -Message "PHASE 2: Applying changes" -Module "ModuleTemplate" + + if ($DryRun) { + Write-Log -Level INFO -Message "[DRY RUN] Would apply the following changes:" -Module "ModuleTemplate" + Write-Log -Level INFO -Message "[DRY RUN] - Example registry key modification" -Module "ModuleTemplate" + Write-Log -Level INFO -Message "[DRY RUN] - Example service configuration" -Module "ModuleTemplate" + } + else { + # Example: Apply a registry setting + $registrySuccess = Set-RegistryValue ` + -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Example" ` + -Name "ExampleSetting" ` + -Value 1 ` + -Type "DWord" ` + -BackupName "ModuleTemplate_Registry" + + if ($registrySuccess) { + $result.ChangesApplied++ + Write-Log -Level SUCCESS -Message "Registry setting applied" -Module "ModuleTemplate" + } + else { + $result.Errors += "Failed to apply registry setting" + Write-Log -Level ERROR -Message "Failed to apply registry setting" -Module "ModuleTemplate" + } + + # Example: Configure a service + if (Test-ServiceExists -ServiceName "ExampleService") { + $serviceSuccess = Set-ServiceStartupType ` + -ServiceName "ExampleService" ` + -StartupType "Disabled" ` + -BackupName "ModuleTemplate_Service" + + if ($serviceSuccess) { + $result.ChangesApplied++ + Write-Log -Level SUCCESS -Message "Service configured" -Module "ModuleTemplate" + } + else { + $result.Errors += "Failed to configure service" + Write-Log -Level ERROR -Message "Failed to configure service" -Module "ModuleTemplate" + } + } + } + + # ======================================== + # PHASE 3: VERIFY + # ======================================== + if (-not $SkipVerify) { + Write-Log -Level INFO -Message "PHASE 3: Verifying changes" -Module "ModuleTemplate" + + if ($DryRun) { + Write-Log -Level INFO -Message "[DRY RUN] Would verify all settings" -Module "ModuleTemplate" + $result.VerificationPassed = $true + } + else { + # Example: Verify registry setting + $actualValue = Get-RegistryValue ` + -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Example" ` + -Name "ExampleSetting" ` + -DefaultValue 0 + + if ($actualValue -eq 1) { + Write-Log -Level SUCCESS -Message "Registry setting verified" -Module "ModuleTemplate" + $result.VerificationPassed = $true + } + else { + $result.VerificationPassed = $false + $result.Errors += "Verification failed: Registry setting not applied correctly" + Write-Log -Level ERROR -Message "Verification failed" -Module "ModuleTemplate" + } + } + } + + # ======================================== + # PHASE 4: RESTORE (Only if errors occurred) + # ======================================== + if ($result.Errors.Count -gt 0 -and -not $DryRun) { + Write-Log -Level WARNING -Message "PHASE 4: Errors detected, initiating rollback" -Module "ModuleTemplate" + + # Restore from backup would go here + # This is handled by the Rollback.ps1 module + Write-Log -Level INFO -Message "Run Restore-AllBackups to undo changes" -Module "ModuleTemplate" + } + + } + catch { + $result.Success = $false + $result.Errors += $_.Exception.Message + Write-Log -Level ERROR -Message "Module execution failed" -Module "ModuleTemplate" -Exception $_ + } + } + + end { + # Final status + if ($result.Errors.Count -eq 0) { + Write-Log -Level SUCCESS -Message "ModuleTemplate completed successfully" -Module "ModuleTemplate" + $result.Success = $true + } + else { + Write-Log -Level ERROR -Message "ModuleTemplate completed with errors" -Module "ModuleTemplate" + $result.Success = $false + } + + Write-Log -Level INFO -Message "Changes applied: $($result.ChangesApplied)" -Module "ModuleTemplate" + Write-Log -Level INFO -Message "Errors: $($result.Errors.Count)" -Module "ModuleTemplate" + Write-Log -Level INFO -Message "Warnings: $($result.Warnings.Count)" -Module "ModuleTemplate" + + return $result + } +} diff --git a/NoIDPrivacy-Interactive.ps1 b/NoIDPrivacy-Interactive.ps1 new file mode 100644 index 0000000..bd12871 --- /dev/null +++ b/NoIDPrivacy-Interactive.ps1 @@ -0,0 +1,980 @@ +<# +.SYNOPSIS + NoID Privacy - Interactive Menu Interface + +.DESCRIPTION + User-friendly interactive menu for Windows 11 security hardening with: + - Visual menu navigation + - Clear status feedback + - Automatic backups before changes + - Easy restore and verification + - Guided workflow + LINK + https://github.com/NexusOne23/noid-privacy + +.NOTES + DISCLAIMER: + This software is provided "as is" without warranty of any kind. + By using this software, you agree that the authors are not liable for any damages + resulting from its use. USE AT YOUR OWN RISK. + + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+, Administrator + For CLI mode use: NoIDPrivacy.ps1 -Module +#> + +#Requires -Version 5.1 +#Requires -RunAsAdministrator + +# No parameters - interactive mode only + +$ErrorActionPreference = 'Stop' +$Host.UI.RawUI.WindowTitle = "NoID Privacy v2.2.0" + +# Set script root path (required by modules to load configs) +$script:RootPath = $PSScriptRoot + +# ============================================================================ +# COLOR FUNCTIONS +# ============================================================================ + +function Write-ColorText { + param( + [string]$Text, + [string]$Color = 'White', + [switch]$NoNewline + ) + + if ($NoColor) { + if ($NoNewline) { Write-Host $Text -NoNewline } + else { Write-Host $Text } + } + else { + if ($NoNewline) { Write-Host $Text -ForegroundColor $Color -NoNewline } + else { Write-Host $Text -ForegroundColor $Color } + } +} + +function Write-Header { + param([string]$Text) + + Write-Host "" + Write-ColorText "====================================================================" -Color Cyan + # Pad the header text so it fully overwrites any residual characters on the console line + Write-ColorText (" $Text".PadRight(68)) -Color Cyan + Write-ColorText "====================================================================" -Color Cyan + Write-Host "" +} + +function Write-Step { + param( + [string]$Text, + [string]$Status = "INFO" + ) + + $symbol = switch ($Status) { + "SUCCESS" { "[+]"; $color = "Green" } + "ERROR" { "[-]"; $color = "Red" } + "WARNING" { "[!]"; $color = "Yellow" } + "INFO" { "[>]"; $color = "Cyan" } + "WAIT" { "[.]"; $color = "Gray" } + default { "[ ]"; $color = "White" } + } + + Write-ColorText $symbol -Color $color -NoNewline + Write-Host " $Text" +} + +function Write-Banner { + Clear-Host + Write-Host "" + Write-Host " ========================================" -ForegroundColor Cyan + Write-Host " NoID Privacy v2.2.0 " -ForegroundColor Cyan + Write-Host " ========================================" -ForegroundColor Cyan + Write-Host "" + Write-Host " Professional Windows 11 Security & Privacy Hardening Framework" -ForegroundColor Gray + # Dynamic environment line: fixed product version, live Windows build + PowerShell version + try { + $os = Get-CimInstance Win32_OperatingSystem -ErrorAction SilentlyContinue + } + catch { + $os = $null + } + + $osBuild = if ($os) { $os.BuildNumber } else { $null } + $psVersion = $PSVersionTable.PSVersion.ToString() + + $envLine = " Version 2.2.0" + if ($osBuild) { + $envLine += " | Windows Build $osBuild" + } + else { + $envLine += " | Windows 11+" + } + $envLine += " | PowerShell $psVersion" + + Write-Host $envLine -ForegroundColor DarkGray + Write-Host "" +} + +# ============================================================================ +# PROGRESS FUNCTIONS +# ============================================================================ + +function Show-Progress { + param( + [string]$Activity, + [string]$Status, + [int]$PercentComplete + ) + + if (-not $Quiet) { + Write-Progress -Activity $Activity -Status $Status -PercentComplete $PercentComplete + } +} + +function Show-ModuleProgress { + param( + [string]$Module, + [int]$Current, + [int]$Total, + [string]$Status = "Processing" + ) + + $percent = [math]::Round(($Current / $Total) * 100) + Show-Progress -Activity "Applying $Module" -Status "$Status ($Current/$Total)" -PercentComplete $percent +} + +# ============================================================================ +# SYSTEM INFO FUNCTION +# ============================================================================ + +function Show-SystemInfo { + Write-Header "SYSTEM INFORMATION" + + try { + $os = Get-CimInstance Win32_OperatingSystem + $cs = Get-CimInstance Win32_ComputerSystem + + Write-ColorText " Computer Name: " -Color Gray -NoNewline + Write-ColorText $cs.Name -Color White + + Write-ColorText " OS Version: " -Color Gray -NoNewline + Write-ColorText "$($os.Caption) Build $($os.BuildNumber)" -Color White + + Write-ColorText " PowerShell: " -Color Gray -NoNewline + Write-ColorText "$($PSVersionTable.PSVersion)" -Color White + + Write-ColorText " Administrator: " -Color Gray -NoNewline + $isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) + $adminStatus = if ($isAdmin) { "Yes [+]" } else { "No [-]" } + $adminColor = if ($isAdmin) { "Green" } else { "Red" } + Write-ColorText $adminStatus -Color $adminColor + + Write-ColorText " Domain Joined: " -Color Gray -NoNewline + $isDomain = $cs.PartOfDomain + $domainStatus = if ($isDomain) { "Yes" } else { "No (Standalone)" } + $domainColor = if ($isDomain) { "Yellow" } else { "Cyan" } + Write-ColorText $domainStatus -Color $domainColor + + Write-Host "" + + # Security Status + Write-ColorText " Security Status:" -Color Yellow + + # Check VBS + try { + $vbs = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue + if ($vbs) { + Write-ColorText " VBS Enabled: " -Color Gray -NoNewline + $vbsStatus = if ($vbs.VirtualizationBasedSecurityStatus -eq 2) { "Yes [+]" } else { "No [-]" } + $vbsColor = if ($vbs.VirtualizationBasedSecurityStatus -eq 2) { "Green" } else { "Red" } + Write-ColorText $vbsStatus -Color $vbsColor + } + } + catch { + # VBS status could not be determined - not critical for menu display + Write-ColorText " VBS Enabled: " -Color Gray -NoNewline + Write-ColorText "Unknown" -Color Yellow + } + + # Check Defender + try { + $defender = Get-MpComputerStatus -ErrorAction SilentlyContinue + if ($defender) { + Write-ColorText " Defender Active: " -Color Gray -NoNewline + $defenderStatus = if ($defender.AntivirusEnabled) { "Yes [+]" } else { "No [-]" } + $defenderColor = if ($defender.AntivirusEnabled) { "Green" } else { "Red" } + Write-ColorText $defenderStatus -Color $defenderColor + } + } + catch { + # Defender status could not be determined - not critical for menu display + Write-ColorText " Defender Active: " -Color Gray -NoNewline + Write-ColorText "Unknown" -Color Yellow + } + + Write-Host "" + } + catch { + Write-Step "Failed to retrieve system information" -Status ERROR + } + + Write-Host "" + Write-ColorText "====================================================================" -Color Cyan + Write-ColorText " Press any key to return to the main menu..." -Color White + Write-ColorText "====================================================================" -Color Cyan + Write-Host "" + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + Write-Host "" +} + +# ============================================================================ +# REBOOT PROMPT FUNCTION +# ============================================================================ + +function Invoke-RebootPrompt { + <# + .SYNOPSIS + Prompts user for system reboot with countdown + + .PARAMETER Context + Context for reboot: 'Hardening' or 'Restore' + #> + param( + [Parameter(Mandatory = $false)] + [ValidateSet('Hardening', 'Restore')] + [string]$Context = 'Hardening' + ) + + Write-Host "" + Write-ColorText "====================================================================" -Color Cyan + Write-ColorText " SYSTEM REBOOT RECOMMENDED" -Color Yellow + Write-ColorText "====================================================================" -Color Cyan + Write-Host "" + + if ($Context -eq 'Hardening') { + Write-ColorText " The applied security changes require a system reboot to take full effect." -Color White + Write-Host "" + Write-ColorText " Changes that may require reboot:" -Color Gray + Write-Host "" + Write-ColorText " - Registry Policies" -Color Yellow -NoNewline + Write-ColorText " (Security settings and configurations)" -Color Gray + Write-ColorText " - Windows Services" -Color Yellow -NoNewline + Write-ColorText " (Startup type and state changes)" -Color Gray + Write-ColorText " - Windows Features" -Color Yellow -NoNewline + Write-ColorText " (PowerShell v2, optional components)" -Color Gray + Write-ColorText " - Network Settings" -Color Yellow -NoNewline + Write-ColorText " (Admin Shares, NetBIOS, Firewall rules)" -Color Gray + Write-Host "" + Write-ColorText " All applied changes are active but become " -Color Gray -NoNewline + Write-ColorText "fully effective after reboot." -Color White + Write-Host "" + Write-Host "" + Write-ColorText " To verify full compliance after reboot, run:" -Color White + Write-ColorText " .\Tools\Verify-Complete-Hardening.ps1" -Color Cyan + } + else { + # Restore context + Write-ColorText " RECOMMENDED: Reboot after restore" -Color White + Write-Host "" + Write-ColorText " Some security settings require a reboot to be fully activated:" -Color Gray + Write-Host "" + Write-ColorText " - Group Policy changes (processed but not fully active)" -Color Gray + Write-ColorText " - Security Template settings (user rights, audit)" -Color Gray + Write-ColorText " - Registry policies affecting boot-time services" -Color Gray + Write-Host "" + Write-ColorText " While gpupdate has processed the restored policies, a reboot" -Color Gray + Write-ColorText " ensures complete activation of all security settings." -Color Gray + } + + Write-Host "" + Write-ColorText "====================================================================" -Color Cyan + Write-Host "" + + # Prompt user with validation loop + do { + Write-ColorText " Reboot now? [Y/N] (default: Y): " -Color White -NoNewline + $choice = Read-Host + if ([string]::IsNullOrWhiteSpace($choice)) { $choice = "Y" } + $choice = $choice.Trim().ToUpper() + + if ($choice -notin @('Y', 'N')) { + Write-Host "" + Write-ColorText " Invalid input. Please enter Y or N." -Color Red + Write-Host "" + } + } while ($choice -notin @('Y', 'N')) + + if ($choice -eq 'Y') { + Write-Host "" + Write-Step "Initiating system reboot in 10 seconds..." -Status WARNING + Write-ColorText " Press Ctrl+C to cancel" -Color Gray + Write-Host "" + + # Countdown from 10 + for ($i = 10; $i -gt 0; $i--) { + Write-ColorText " Rebooting in $i seconds..." -Color Yellow + Start-Sleep -Seconds 1 + } + + Write-Host "" + Write-Step "Rebooting system now..." -Status SUCCESS + Write-Host "" + + # Reboot + Restart-Computer -Force + } + else { + Write-Host "" + Write-Step "Reboot deferred" -Status WARNING + Write-Host "" + Write-ColorText " IMPORTANT: Please reboot manually at your earliest convenience." -Color White + Write-ColorText " The hardening will not be fully effective until after reboot." -Color Gray + Write-Host "" + + if ($Context -eq 'Hardening') { + Write-ColorText " To verify after reboot, run:" -Color White + Write-ColorText " .\Tools\Verify-Complete-Hardening.ps1" -Color Cyan + Write-Host "" + } + } +} + +# ============================================================================ +# BACKUP LIST FUNCTION +# ============================================================================ + +function Show-BackupList { + Write-Header "AVAILABLE BACKUP SESSIONS" + + $backupPath = Join-Path $PSScriptRoot "Backups" + + # Get sessions using new Rollback.ps1 function + try { + # Force result to array to handle single-session case correctly + if (Test-Path $backupPath) { + $sessions = @(Get-BackupSessions -BackupDirectory $backupPath) + } else { + $sessions = @() + } + } + catch { + Write-Step "Failed to load backup sessions: $_" -Status ERROR + Write-Host "" + return $null + } + + # Single check for no sessions (whether folder doesn't exist or is empty) + if ($sessions.Count -eq 0) { + Write-Step "No backup sessions found" -Status WARNING + Write-Host "" + return $null + } + + Write-ColorText " Found $($sessions.Count) backup session(s):" -Color Cyan + Write-Host "" + + for ($i = 0; $i -lt $sessions.Count; $i++) { + $session = $sessions[$i] + + try { + $age = (Get-Date) - $session.Timestamp + $ageStr = if ($age.TotalHours -lt 1) { "$([math]::Round($age.TotalMinutes)) minutes ago" } + elseif ($age.TotalDays -lt 1) { "$([math]::Round($age.TotalHours)) hours ago" } + else { "$([math]::Round($age.TotalDays)) days ago" } + } + catch { + $ageStr = "unknown age" + } + + Write-ColorText " [$($i+1)] " -Color Yellow -NoNewline + Write-ColorText "$($session.SessionId)" -Color White -NoNewline + Write-ColorText " ($ageStr)" -Color Gray + + Write-ColorText " " -Color Gray -NoNewline + Write-ColorText "> Modules: " -Color DarkGray -NoNewline + if ($session.Modules -and $session.Modules.Count -gt 0) { + Write-ColorText ($session.Modules.name -join ", ") -Color Cyan + } + else { + Write-ColorText "No modules" -Color Red + } + + Write-ColorText " " -Color Gray -NoNewline + Write-ColorText "> Total Items: " -Color DarkGray -NoNewline + Write-ColorText "$($session.TotalItems)" -Color Green + + Write-Host "" + } + + Write-Host "" + + # Ensure we return an array (even for single item) + return @($sessions) +} + +# ============================================================================ +# MAIN MENU +# ============================================================================ + +function Show-MainMenu { + Write-Banner + Write-Header "MAIN MENU" + + Write-ColorText " [A]" -Color Green -NoNewline + Write-Host " Apply Security Hardening" + Write-ColorText " " -Color Gray -NoNewline + Write-ColorText "> Automatic backup before changes" -Color DarkGray + Write-ColorText " " -Color Gray -NoNewline + Write-ColorText "> Comprehensive verification" -Color DarkGray + Write-ColorText " " -Color Gray -NoNewline + Write-ColorText "> Detailed progress tracking" -Color DarkGray + Write-Host "" + + Write-ColorText " [V]" -Color Cyan -NoNewline + Write-Host " Verify Current Settings" + Write-ColorText " " -Color Gray -NoNewline + Write-ColorText "> Check all 630+ hardening settings" -Color DarkGray + Write-ColorText " " -Color Gray -NoNewline + Write-ColorText "> Detailed compliance report" -Color DarkGray + Write-Host "" + + Write-ColorText " [R]" -Color Yellow -NoNewline + Write-Host " Restore from Backup" + Write-ColorText " " -Color Gray -NoNewline + Write-ColorText "> Rollback to previous state" -Color DarkGray + Write-ColorText " " -Color Gray -NoNewline + Write-ColorText "> Complete system restoration" -Color DarkGray + Write-Host "" + + Write-ColorText " [I]" -Color Magenta -NoNewline + Write-Host " System Information" + Write-ColorText " " -Color Gray -NoNewline + Write-ColorText "> OS, Build, Security Status" -Color DarkGray + Write-Host "" + + Write-ColorText " [X]" -Color Red -NoNewline + Write-Host " Exit" + Write-Host "" + + Write-ColorText "====================================================================" -Color Cyan + Write-Host "" + Write-ColorText " Select [A/V/R/I/X]: " -Color White -NoNewline +} + +# ============================================================================ +# MODULE SELECTION MENU +# ============================================================================ + +function Show-ModuleMenu { + Write-Banner + Write-Header "SELECT MODULES TO APPLY" + + $modules = @( + [PSCustomObject]@{ Key = "1"; Name = "SecurityBaseline"; Description = "Microsoft Security Baseline (425 settings)"; Enabled = $true } + [PSCustomObject]@{ Key = "2"; Name = "ASR"; Description = "Attack Surface Reduction (19 rules)"; Enabled = $true } + [PSCustomObject]@{ Key = "3"; Name = "DNS"; Description = "Secure DNS with DoH (Cloudflare/Quad9/AdGuard)"; Enabled = $true } + [PSCustomObject]@{ Key = "4"; Name = "Privacy"; Description = "Telemetry & Privacy hardening (3 modes)"; Enabled = $true } + [PSCustomObject]@{ Key = "5"; Name = "AntiAI"; Description = "Disable Windows AI features (13 features, 32 policies)"; Enabled = $true } + [PSCustomObject]@{ Key = "6"; Name = "EdgeHardening"; Description = "Secure Microsoft Edge browser (24 policies)"; Enabled = $true } + [PSCustomObject]@{ Key = "7"; Name = "AdvancedSecurity"; Description = "15 security features (50 settings): RDP/Credentials/Ports/TLS/WPAD/PSv2/SRP/WinUpdate/WirelessDisplay/Discovery/IPv6"; Enabled = $true } + ) + + foreach ($module in $modules) { + if ($module.Enabled) { + Write-ColorText " [$($module.Key)]" -Color Green -NoNewline + } + else { + Write-ColorText " [$($module.Key)]" -Color DarkGray -NoNewline + } + + Write-Host " $($module.Name)" + Write-ColorText " " -Color Gray -NoNewline + + if ($module.Enabled) { + Write-ColorText "> $($module.Description)" -Color White + } + else { + Write-ColorText "> $($module.Description) " -Color DarkGray -NoNewline + Write-ColorText "(Not yet implemented)" -Color DarkRed + } + } + + Write-Host "" + Write-ColorText " [99]" -Color Yellow -NoNewline + Write-Host " ALL MODULES (WIZARD) - Interactive setup for all modules" + Write-Host "" + Write-ColorText " [0]" -Color Red -NoNewline + Write-Host " Back to Main Menu" + Write-Host "" + + Write-ColorText "====================================================================" -Color Cyan + Write-Host "" + Write-ColorText " Select module [1-7, 99, 0]: " -Color White -NoNewline + + return $modules +} + +# ============================================================================ +# APPLY HARDENING WORKFLOW +# ============================================================================ + +function Invoke-HardeningWorkflow { + param([string[]]$SelectedModules) + + Write-Banner + Write-Header "SECURITY HARDENING WORKFLOW" + + # Phase 1: Pre-flight checks + Write-Step "Running pre-flight checks..." -Status INFO + + if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { + Write-Step "Administrator privileges required" -Status ERROR + return + } + Write-Step "Administrator privileges confirmed" -Status SUCCESS + + # Phase 2: Call real Framework + Write-Host "" + Write-Step "Initializing NoID Privacy Framework..." -Status INFO + Write-ColorText " " -Color Gray -NoNewline + Write-ColorText "> Automatic backup will be created before changes" -Color DarkGray + Write-Host "" + + try { + # Determine which modules to execute - ensure proper string array + [string[]]$modulesToRun = @($SelectedModules) + + # Debug output to verify correct module names + Write-Step "Modules to apply: $($modulesToRun -join ', ')" -Status INFO + + # Call the real framework via NoIDPrivacy.ps1 + $frameworkScript = Join-Path $PSScriptRoot "NoIDPrivacy.ps1" + + if (-not (Test-Path $frameworkScript)) { + Write-Step "Framework script not found: $frameworkScript" -Status ERROR + return + } + + # Execute framework (always with verbose logging for full support trace) + Write-Step "Executing hardening modules..." -Status INFO + Write-Host "" + + $allSucceeded = $true + + # FIX: Call framework ONCE with all modules instead of separate calls + # This ensures single backup session and single log file + if ($modulesToRun.Count -eq 7) { + # All modules selected - use "All" for single unified session + Write-Step "Running ALL modules in unified session..." -Status INFO + & $frameworkScript -Module All -VerboseLogging + if ($LASTEXITCODE -ne 0) { + $allSucceeded = $false + } + } + elseif ($modulesToRun.Count -eq 1) { + # Single module + Write-Step "Running module: $($modulesToRun[0])" -Status INFO + & $frameworkScript -Module $modulesToRun[0] -VerboseLogging + if ($LASTEXITCODE -ne 0) { + $allSucceeded = $false + } + } + else { + # Multiple but not all modules - must run separately (Framework doesn't support partial list) + # TODO: Future enhancement - add -Modules parameter to Framework for partial lists + foreach ($mod in $modulesToRun) { + Write-Step "Running module: $mod" -Status INFO + & $frameworkScript -Module $mod -VerboseLogging + if ($LASTEXITCODE -ne 0) { + $allSucceeded = $false + } + Write-Host "" + } + } + Write-Host "" + + # Display results + Write-Host "" + Write-Header "HARDENING COMPLETE" + + if ($allSucceeded) { + Write-ColorText " Status: " -Color Gray -NoNewline + Write-ColorText "SUCCESS [+]" -Color Green + } + else { + Write-ColorText " Status: " -Color Gray -NoNewline + Write-ColorText "FAILED [-]" -Color Red + } + + Write-ColorText " Modules Applied: " -Color Gray -NoNewline + Write-ColorText "$($modulesToRun.Count)" -Color White + + Write-Host "" + + if ($allSucceeded) { + Write-ColorText " Your system is now hardened with enterprise-grade security!" -Color Green + } + else { + Write-ColorText " Some modules had warnings or were skipped. Check details above." -Color Yellow + Write-ColorText " Most security settings were still applied successfully." -Color White + } + + Write-Host "" + + # Always prompt for reboot (even with warnings/skips, changes were made) + Invoke-RebootPrompt -Context 'Hardening' + + Write-Host "" + } + catch { + Write-Host "" + Write-Step "Fatal error: $($_.Exception.Message)" -Status ERROR + Write-Host "" + } +} + +# ============================================================================ +# VERIFY WORKFLOW +# ============================================================================ + +function Invoke-VerifyWorkflow { + Write-Banner + Write-Header "SETTINGS VERIFICATION" + + Write-Step "Running comprehensive verification..." -Status INFO + Write-Host "" + + try { + # Call the real verification script + $verifyScript = Join-Path $PSScriptRoot "Tools\Verify-Complete-Hardening.ps1" + + if (Test-Path $verifyScript) { + # Discard return value so that 'True' / 'False' is not printed to console + $null = & $verifyScript + } + else { + Write-Step "Verification script not found: $verifyScript" -Status ERROR + } + } + catch { + Write-Step "Verification failed: $($_.Exception.Message)" -Status ERROR + } + + Write-Host "" +} + +# ============================================================================ +# RESTORE WORKFLOW +# ============================================================================ + +function Invoke-RestoreWorkflow { + $sessions = Show-BackupList + + # Show-BackupList already displays warning if no sessions found + if (-not $sessions -or $sessions.Count -eq 0) { + Start-Sleep -Seconds 2 + return + } + + # Force as array to ensure Count property exists + $sessions = @($sessions) + + Write-ColorText " Enter session number to restore [1-$($sessions.Count)] or 0 to cancel: " -Color White -NoNewline + $selection = Read-Host + + # Trim whitespace + $selection = $selection.Trim() + + if ($selection -eq "0" -or [string]::IsNullOrWhiteSpace($selection)) { + return + } + + # Try to parse as integer + try { + $index = [int]$selection - 1 + } + catch { + Write-Step "Invalid selection - please enter a number" -Status ERROR + Start-Sleep -Seconds 2 + return + } + + if ($index -lt 0 -or $index -ge $sessions.Count) { + Write-Step "Invalid selection - please enter a number between 1 and $($sessions.Count)" -Status ERROR + Start-Sleep -Seconds 2 + return + } + + $selectedSession = $sessions[$index] + + # Determine available modules in this session + $availableModules = @() + if ($selectedSession.Modules) { + $availableModules = @($selectedSession.Modules) + } + + $restoreMode = "A" # A = All modules, M = Selected modules + $selectedModuleNames = @() + + if ($availableModules.Count -gt 0) { + Write-Host "" + Write-Header "RESTORE MODE" + + Write-ColorText " Session contains the following modules:" -Color Yellow + Write-Host "" + for ($m = 0; $m -lt $availableModules.Count; $m++) { + $mod = $availableModules[$m] + Write-ColorText " [$($m+1)] " -Color Cyan -NoNewline + Write-ColorText "$($mod.name)" -Color White + } + Write-Host "" + + # Restore mode selection + do { + Write-ColorText " [A] Restore ALL modules in this session (recommended)" -Color Green + Write-ColorText " [M] Restore only SELECTED modules from this session" -Color Cyan + Write-Host "" + Write-ColorText " Select restore mode [A/M] (default: A): " -Color White -NoNewline + $modeInput = Read-Host + if ([string]::IsNullOrWhiteSpace($modeInput)) { $modeInput = "A" } + $modeInput = $modeInput.Trim().ToUpper() + + if ($modeInput -in @('A','M')) { + $restoreMode = $modeInput + break + } + Write-Host "" + Write-Step "Invalid input. Please enter A or M." -Status ERROR + Write-Host "" + } while ($true) + + # If user chose module selection, ask for specific modules + if ($restoreMode -eq 'M') { + Write-Host "" + Write-ColorText " Enter module numbers to restore [1-$($availableModules.Count), e.g. 1,3,5] or 0 to cancel: " -Color White -NoNewline + $moduleInput = Read-Host + $moduleInput = $moduleInput.Trim() + + if ([string]::IsNullOrWhiteSpace($moduleInput) -or $moduleInput -eq '0') { + Write-Step "Restore cancelled" -Status WARNING + Start-Sleep -Seconds 1 + return + } + + $indices = @() + foreach ($token in $moduleInput.Split(',', ';', ' ')) { + if (-not [string]::IsNullOrWhiteSpace($token)) { + $parsed = 0 + if ([int]::TryParse($token.Trim(), [ref]$parsed)) { + if ($parsed -ge 1 -and $parsed -le $availableModules.Count) { + $indices += $parsed + } + } + } + } + + $indices = $indices | Sort-Object -Unique + if ($indices.Count -eq 0) { + Write-Step "No valid module numbers selected - restore cancelled" -Status ERROR + Start-Sleep -Seconds 2 + return + } + + foreach ($i in $indices) { + $selectedModuleNames += $availableModules[$i-1].name + } + } + } + + Write-Host "" + Write-Header "RESTORE CONFIRMATION" + + Write-ColorText " You are about to restore from:" -Color Yellow + Write-ColorText " Session: $($selectedSession.SessionId)" -Color White + Write-ColorText " Created: $($selectedSession.Timestamp)" -Color Gray + + if ($restoreMode -eq 'M' -and $selectedModuleNames.Count -gt 0) { + Write-ColorText " Modules to restore: $($selectedModuleNames -join ', ')" -Color Cyan + } + else { + Write-ColorText " Modules: $($selectedSession.Modules.name -join ', ')" -Color Cyan + } + + Write-ColorText " Total Items: $($selectedSession.TotalItems)" -Color Green + Write-Host "" + + if ($restoreMode -eq 'M' -and $selectedModuleNames.Count -gt 0) { + Write-ColorText " This will revert ALL settings for the selected modules in this session." -Color Yellow + } + else { + Write-ColorText " This will revert ALL security settings to the backup state for this session." -Color Yellow + } + Write-Host "" + Write-ColorText " Are you sure? [Y/N]: " -Color White -NoNewline + $confirm = Read-Host + + if ($confirm -ne "Y" -and $confirm -ne "y") { + Write-Step "Restore cancelled" -Status WARNING + Start-Sleep -Seconds 1 + return + } + + Write-Host "" + Write-Step "Starting session restore..." -Status INFO + Write-Host "" + + try { + # Restore-Session should already be loaded from Rollback.ps1 + if (Get-Command Restore-Session -ErrorAction SilentlyContinue) { + # Call restore for the selected session (full or partial) + if ($restoreMode -eq 'M' -and $selectedModuleNames.Count -gt 0) { + $success = Restore-Session -SessionPath $selectedSession.FolderPath -ModuleNames $selectedModuleNames + } + else { + $success = Restore-Session -SessionPath $selectedSession.FolderPath + } + + if ($success) { + Write-Host "" + Write-Step "Session restored successfully" -Status SUCCESS + # Note: Reboot prompt is handled by Restore-Session in Rollback.ps1 + } + else { + Write-Host "" + Write-Step "Session restore completed with some failures" -Status WARNING + # Note: Reboot prompt is handled by Restore-Session in Rollback.ps1 + } + } + else { + Write-Step "Restore function not available - Rollback.ps1 not loaded" -Status ERROR + } + } + catch { + Write-Step "Restore failed: $($_.Exception.Message)" -Status ERROR + } + + Write-Host "" +} + +# ============================================================================ +# MAIN PROGRAM LOOP +# ============================================================================ + +try { + # Load Logger (required by Rollback.ps1) but don't initialize yet + $loggerPath = Join-Path $PSScriptRoot "Core\Logger.ps1" + if (Test-Path $loggerPath) { + . $loggerPath + } + + # Create dummy Write-Log if not initialized (for Rollback.ps1) + if (-not (Get-Command Write-Log -ErrorAction SilentlyContinue)) { + function Write-Log { param($Level, $Message, $Module, $Exception) } + } + + # Load Rollback system (required for Get-BackupSessions) + $rollbackPath = Join-Path $PSScriptRoot "Core\Rollback.ps1" + if (Test-Path $rollbackPath) { + . $rollbackPath + } + else { + Write-Host "[ERROR] Rollback.ps1 not found!" -ForegroundColor Red + exit 1 + } + + # Load framework + $frameworkPath = Join-Path $PSScriptRoot "Core\Framework.ps1" + if (Test-Path $frameworkPath) { + . $frameworkPath + } + + while ($true) { + # Clear before each main menu redraw + Clear-Host + Show-MainMenu + $choice = Read-Host + + switch ($choice.ToUpper()) { + "A" { + # Initialize to ensure clean state + [string[]]$selectedModules = @() + + $modules = Show-ModuleMenu + $moduleChoice = Read-Host + + if ($moduleChoice -eq "0") { + continue + } + elseif ($moduleChoice -eq "99") { + # All modules - force as string array + [string[]]$selectedModules = @($modules | Where-Object { $_.Enabled } | ForEach-Object { $_.Name }) + } + else { + $selectedModule = $modules | Where-Object { $_.Key -eq $moduleChoice } + if ($selectedModule -and $selectedModule.Enabled) { + # Single module - force as string array with explicit cast + [string[]]$selectedModules = @([string]$selectedModule.Name) + } + else { + Write-Step "Invalid or unavailable module" -Status ERROR + Start-Sleep -Seconds 1 + continue + } + } + + # Pass as explicit array + Invoke-HardeningWorkflow -SelectedModules ([string[]]$selectedModules) + + Write-Host "" + Write-ColorText "====================================================================" -Color Cyan + Write-ColorText " Press any key to return to the main menu..." -Color White + Write-ColorText "====================================================================" -Color Cyan + Write-Host "" + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + } + "V" { + Invoke-VerifyWorkflow + + Write-Host "" + Write-ColorText "====================================================================" -Color Cyan + Write-ColorText " Press any key to return to the main menu..." -Color White + Write-ColorText "====================================================================" -Color Cyan + Write-Host "" + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + } + "R" { + Invoke-RestoreWorkflow + + Write-Host "" + Write-ColorText "====================================================================" -Color Cyan + Write-ColorText " Press any key to return to the main menu..." -Color White + Write-ColorText "====================================================================" -Color Cyan + Write-Host "" + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + } + "I" { + Show-SystemInfo + } + "X" { + Write-Host "" + Write-ColorText " Thank you for using NoID Privacy!" -Color Cyan + Write-Host "" + exit 0 + } + default { + # Invalid choice, loop continues + } + } + } +} +catch { + Write-Host "" + Write-Step "Fatal error: $($_.Exception.Message)" -Status ERROR + Write-Host "" + Write-ColorText " Press any key to exit..." -Color Gray + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + exit 1 +} diff --git a/NoIDPrivacy.ps1 b/NoIDPrivacy.ps1 new file mode 100644 index 0000000..cd6de0c --- /dev/null +++ b/NoIDPrivacy.ps1 @@ -0,0 +1,435 @@ +#Requires -Version 5.1 +#Requires -RunAsAdministrator + +<# +.SYNOPSIS + NoID Privacy - Professional Windows 11 Security & Privacy Hardening Framework + +.DESCRIPTION + Enterprise-grade security hardening for Windows 11 implementing: + - Microsoft Security Baseline (425+ settings) + - Attack Surface Reduction (19 rules) + - Secure DNS configuration + - AI features disable + - Telemetry & privacy controls + - And more... + +.PARAMETER Module + Specific module to run (SecurityBaseline, ASR, DNS, etc.) + If not specified, shows interactive menu + +.PARAMETER DryRun + Preview changes without applying them + +.PARAMETER VerboseLogging + Enable verbose logging output + +.PARAMETER Config + Path to custom configuration file (default: config.json) + +.EXAMPLE + .\NoIDPrivacy.ps1 + Interactive menu mode + +.EXAMPLE + .\NoIDPrivacy.ps1 -Module SecurityBaseline + Run only the Security Baseline module + +.EXAMPLE + .\NoIDPrivacy.ps1 -Module ASR -DryRun + Preview ASR rule changes without applying + +.EXAMPLE + .\NoIDPrivacy.ps1 -Module All -VerboseLogging + Run all enabled modules with verbose logging + +.NOTES + DISCLAIMER: + This software is provided "as is" without warranty of any kind. + By using this software, you agree that the authors are not liable for any damages + resulting from its use. USE AT YOUR OWN RISK. + + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+, Administrator privileges, Windows 11 + License: GPL-3.0 (Core CLI). See LICENSE for full terms. +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $false)] + [ValidateSet( + "SecurityBaseline", + "ASR", + "DNS", + "Privacy", + "AntiAI", + "EdgeHardening", + "AdvancedSecurity", + "All" + )] + [string]$Module, + + [Parameter(Mandatory = $false)] + [switch]$DryRun, + + [Parameter(Mandatory = $false)] + [switch]$VerboseLogging, + + [Parameter(Mandatory = $false)] + [string]$ConfigPath +) + +# Enable strict mode for better error detection +Set-StrictMode -Version Latest + +# Script root path +$script:RootPath = $PSScriptRoot + +# Import Core modules +Write-Host "Loading NoID Privacy Framework..." -ForegroundColor Cyan +Write-Host "" + +try { + # Load Logger first + . (Join-Path $script:RootPath "Core\Logger.ps1") + + # Initialize logger with absolute path + $logLevel = if ($VerboseLogging) { [LogLevel]::DEBUG } else { [LogLevel]::INFO } + $logDirectory = Join-Path $script:RootPath "Logs" + Initialize-Logger -LogDirectory $logDirectory -MinimumLevel $logLevel + + Write-Log -Level INFO -Message "=== NoID Privacy Framework v2.2.0 ===" -Module "Main" + Write-Log -Level INFO -Message "Starting framework initialization..." -Module "Main" + + # Load other Core modules + . (Join-Path $script:RootPath "Core\Config.ps1") + . (Join-Path $script:RootPath "Core\Validator.ps1") + . (Join-Path $script:RootPath "Core\Rollback.ps1") + . (Join-Path $script:RootPath "Core\NonInteractive.ps1") # Must load BEFORE Framework for GUI mode + . (Join-Path $script:RootPath "Core\Framework.ps1") + + # Load Utils + . (Join-Path $script:RootPath "Utils\Registry.ps1") + . (Join-Path $script:RootPath "Utils\Service.ps1") + . (Join-Path $script:RootPath "Utils\Hardware.ps1") + # NOTE: Utils\GPO.ps1 removed - v2.0 SecurityBaseline is self-contained + . (Join-Path $script:RootPath "Utils\Localization.ps1") + . (Join-Path $script:RootPath "Utils\Compatibility.ps1") + . (Join-Path $script:RootPath "Utils\Dependencies.ps1") + + Write-Log -Level SUCCESS -Message "All core modules loaded successfully" -Module "Main" +} +catch { + Write-Host "" -ForegroundColor Red + Write-Host "==========================================================" -ForegroundColor Red + Write-Host "FATAL ERROR: Failed to load core framework modules" -ForegroundColor Red + Write-Host "==========================================================" -ForegroundColor Red + Write-Host "Error: $_" -ForegroundColor Red + Write-Host "Location: $($_.InvocationInfo.ScriptName):$($_.InvocationInfo.ScriptLineNumber)" -ForegroundColor Red + Write-Host "Stack Trace: $($_.ScriptStackTrace)" -ForegroundColor Red + Write-Host "" -ForegroundColor Red + Write-Host "Please ensure all framework files are present and not corrupted." -ForegroundColor Yellow + exit 1 +} + +# Load configuration +try { + Write-Log -Level INFO -Message "Loading configuration..." -Module "Main" + + # Check for ConfigPath from environment variable (GUI mode) + if ([string]::IsNullOrEmpty($ConfigPath) -and $env:NOIDPRIVACY_CONFIGPATH) { + $ConfigPath = $env:NOIDPRIVACY_CONFIGPATH + } + + if ($ConfigPath) { + Initialize-Config -ConfigPath $ConfigPath + } + else { + Initialize-Config + } + + Write-Log -Level SUCCESS -Message "Configuration loaded" -Module "Main" +} +catch { + Write-Log -Level ERROR -Message "Failed to load configuration file" -Module "Main" -Exception $_.Exception + Write-Host "ERROR: Configuration file error - check config.json syntax" -ForegroundColor Red + exit 1 +} + +# Validate prerequisites (full framework pre-flight: system, domain, backup) +try { + Write-Log -Level INFO -Message "Validating framework prerequisites..." -Module "Main" + + $ok = Test-FrameworkPrerequisites + + if (-not $ok) { + Write-Log -Level ERROR -Message "Framework prerequisites failed" -Module "Main" + Write-Host "ERROR: Prerequisite checks failed. See log for details." -ForegroundColor Red + exit 1 + } + + Write-Log -Level SUCCESS -Message "Framework prerequisites met" -Module "Main" +} +catch { + Write-ErrorLog -Message "Framework prerequisite validation failed" -Module "Main" -ErrorRecord $_ + Write-Host "ERROR: System requirements not met - see log for details" -ForegroundColor Red + exit 1 +} + +# Display banner +Write-Host "" +Write-Host "========================================" -ForegroundColor Cyan +Write-Host " NoID Privacy - v2.2.0" -ForegroundColor Cyan +Write-Host " Windows 11 Security Hardening" -ForegroundColor Cyan +Write-Host "========================================" -ForegroundColor Cyan +Write-Host "" + +if ($DryRun) { + Write-Host "[DRY RUN MODE - No changes will be applied]" -ForegroundColor Yellow + Write-Host "" +} + +# Interactive menu or direct module execution +if (-not $Module) { + # Show interactive menu + Write-Host "Available Actions:" -ForegroundColor White + Write-Host "" + Write-Host " APPLY HARDENING:" -ForegroundColor Cyan + Write-Host " 1. SecurityBaseline - Microsoft Security Baseline (425+ settings)" -ForegroundColor Green + Write-Host " 2. ASR - Attack Surface Reduction (19 rules)" -ForegroundColor Green + Write-Host " 3. DNS - Secure DNS with DoH (Cloudflare/Quad9/AdGuard)" -ForegroundColor Green + Write-Host " 4. Privacy - Telemetry & Privacy hardening (3 modes)" -ForegroundColor Green + Write-Host " 5. AntiAI - Disable Windows AI features (13 features, 32 policies)" -ForegroundColor Green + Write-Host " 6. EdgeHardening - Secure Microsoft Edge browser" -ForegroundColor Green + Write-Host " 7. AdvancedSecurity - Legacy Protocol hardening, Windows Update, SRP (CVE-2025-9491)" -ForegroundColor Green + Write-Host " 99. ALL MODULES (WIZARD) - Interactive setup for all modules" -ForegroundColor Cyan + Write-Host "" + Write-Host " SYSTEM OPERATIONS:" -ForegroundColor Cyan + Write-Host " V. Verify Settings - Check up to 630+ hardening settings" -ForegroundColor Magenta + Write-Host " R. Restore Backup - Rollback to previous state" -ForegroundColor Yellow + Write-Host " B. List Backups - Show all available backups" -ForegroundColor Gray + Write-Host " I. System Info - Display system information" -ForegroundColor Gray + Write-Host "" + Write-Host " 0. Exit" -ForegroundColor Red + Write-Host "" + + do { + $selection = Read-Host "Select option [1-7, 99, V, R, B, I, 0] (default: 99)" + if ([string]::IsNullOrWhiteSpace($selection)) { $selection = "99" } + $selection = $selection.ToUpper() + + if ($selection -notin @('1','2','3','4','5','6','7','99','V','R','B','I','0')) { + Write-Host "" + Write-Host "Invalid selection. Please choose from the menu." -ForegroundColor Red + Write-Host "" + } + } while ($selection -notin @('1','2','3','4','5','6','7','99','V','R','B','I','0')) + + switch ($selection) { + "1" { $Module = "SecurityBaseline" } + "2" { $Module = "ASR" } + "3" { $Module = "DNS" } + "4" { $Module = "Privacy" } + "5" { $Module = "AntiAI" } + "6" { $Module = "EdgeHardening" } + "7" { $Module = "AdvancedSecurity" } + "99" { $Module = "All" } + "V" { + # Verify all settings + Write-Host "" + Write-Host "Running complete verification..." -ForegroundColor Cyan + Write-Host "" + + $verifyScript = Join-Path $script:RootPath "Tools\Verify-Complete-Hardening.ps1" + if (Test-Path $verifyScript) { + # Discard return value so that 'True' / 'False' is not printed to console + $null = & $verifyScript -Detailed + } + else { + Write-Host "ERROR: Verification script not found" -ForegroundColor Red + } + + Write-Host "" + Write-Host "Press any key to exit..." -ForegroundColor Gray + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + exit 0 + } + "R" { + # Restore from backup + Write-Host "" + Write-Host "Loading backup system..." -ForegroundColor Cyan + Write-Host "" + + # Call Restore-AllBackups function from Rollback.ps1 + if (Get-Command Restore-AllBackups -ErrorAction SilentlyContinue) { + Restore-AllBackups + } + else { + Write-Host "ERROR: Restore function not available" -ForegroundColor Red + } + + Write-Host "" + Write-Host "Press any key to exit..." -ForegroundColor Gray + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + exit 0 + } + "B" { + # List backups + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host " Available Backups" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + + $backupPath = Join-Path $script:RootPath "Backups" + if (Test-Path $backupPath) { + $backups = Get-ChildItem -Path $backupPath -Directory | Sort-Object CreationTime -Descending + + if ($backups.Count -eq 0) { + Write-Host " No backups found" -ForegroundColor Yellow + } + else { + Write-Host " Found $($backups.Count) backup(s):" -ForegroundColor White + Write-Host "" + + foreach ($backup in $backups) { + $age = (Get-Date) - $backup.CreationTime + $ageStr = if ($age.TotalHours -lt 1) { "$([math]::Round($age.TotalMinutes)) minutes ago" } + elseif ($age.TotalDays -lt 1) { "$([math]::Round($age.TotalHours)) hours ago" } + else { "$([math]::Round($age.TotalDays)) days ago" } + + Write-Host " - $($backup.Name)" -ForegroundColor Green -NoNewline + Write-Host " ($ageStr)" -ForegroundColor Gray + } + } + } + else { + Write-Host " Backup directory not found" -ForegroundColor Yellow + } + + Write-Host "" + Write-Host "Press any key to exit..." -ForegroundColor Gray + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + exit 0 + } + "I" { + # System information + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host " System Information" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + + try { + $os = Get-CimInstance Win32_OperatingSystem + $cs = Get-CimInstance Win32_ComputerSystem + + Write-Host " Computer Name: $($cs.Name)" -ForegroundColor White + Write-Host " OS Version: $($os.Caption) Build $($os.BuildNumber)" -ForegroundColor White + Write-Host " PowerShell: $($PSVersionTable.PSVersion)" -ForegroundColor White + Write-Host " Domain Joined: $(if ($cs.PartOfDomain) { 'Yes' } else { 'No (Standalone)' })" -ForegroundColor White + + Write-Host "" + Write-Host " Security Status:" -ForegroundColor Yellow + + # Check VBS + try { + $vbs = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue + if ($vbs) { + Write-Host " VBS Enabled: $(if ($vbs.VirtualizationBasedSecurityStatus -eq 2) { 'Yes' } else { 'No' })" -ForegroundColor $(if ($vbs.VirtualizationBasedSecurityStatus -eq 2) { 'Green' } else { 'Red' }) + } + } + catch { $null = $null } # Intentionally ignore VBS query errors + + # Check Defender + try { + $defender = Get-MpComputerStatus -ErrorAction SilentlyContinue + if ($defender) { + Write-Host " Defender Active: $(if ($defender.AntivirusEnabled) { 'Yes' } else { 'No' })" -ForegroundColor $(if ($defender.AntivirusEnabled) { 'Green' } else { 'Red' }) + } + } + catch { $null = $null } # Intentionally ignore Defender query errors + } + catch { + Write-Host " Failed to retrieve system information" -ForegroundColor Red + } + + Write-Host "" + Write-Host "Press any key to exit..." -ForegroundColor Gray + $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") + exit 0 + } + "0" { + Write-Host "Exiting..." -ForegroundColor Yellow + exit 0 + } + } +} + +# Execute selected module(s) +try { + Write-Log -Level INFO -Message "Starting module execution: $Module" -Module "Main" + + $result = Invoke-Hardening -Module $Module -DryRun:$DryRun + + # Handle array return (pipeline contamination protection) + if ($result -is [array]) { + Write-Log -Level DEBUG -Message "Invoke-Hardening returned array ($($result.Count) items), using last element" -Module "Main" + $result = $result[-1] + } + + # Display results + Write-Host "" + Write-Host "========================================" -ForegroundColor Cyan + Write-Host " Execution Results" -ForegroundColor Cyan + Write-Host "========================================" -ForegroundColor Cyan + Write-Host "" + + if ($result.Success) { + Write-Host "Status: SUCCESS" -ForegroundColor Green + Write-Host "Modules Executed: $($result.ModulesExecuted)" -ForegroundColor White + Write-Host "Duration: $($result.Duration.TotalSeconds) seconds" -ForegroundColor White + } + else { + Write-Host "Status: FAILED" -ForegroundColor Red + Write-Host "Errors: $($result.Errors.Count)" -ForegroundColor Red + + if ($result.Errors.Count -gt 0) { + Write-Host "" + Write-Host "Error Details:" -ForegroundColor Red + foreach ($errMsg in $result.Errors) { + Write-Host " - $errMsg" -ForegroundColor Red + } + } + } + + if ($result.Warnings.Count -gt 0) { + Write-Host "" + Write-Host "Warnings: $($result.Warnings.Count)" -ForegroundColor Yellow + foreach ($warning in $result.Warnings) { + Write-Host " - $warning" -ForegroundColor Yellow + } + } + + Write-Host "" + Write-Host "Log file: $(Get-LogFilePath)" -ForegroundColor Cyan + Write-Host "" + + if ($result.Success) { + Write-Log -Level SUCCESS -Message "Framework execution completed successfully" -Module "Main" + exit 0 + } + else { + Write-Log -Level ERROR -Message "Framework execution completed with errors" -Module "Main" + exit 1 + } +} +catch { + Write-ErrorLog -Message "Fatal error during framework execution" -Module "Main" -ErrorRecord $_ + Write-Host "" + Write-Host "FATAL ERROR: Unexpected exception during execution" -ForegroundColor Red + Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red + Write-Host "" + exit 1 +} diff --git a/README.md b/README.md new file mode 100644 index 0000000..4bbd0f4 --- /dev/null +++ b/README.md @@ -0,0 +1,878 @@ +๏ปฟ# ๐Ÿ›ก๏ธ NoID Privacy - Professional Windows 11 Security & Privacy Hardening Framework + +> **โš ๏ธ DISCLAIMER: USE AT YOUR OWN RISK.** +> This tool makes deep modifications to the Windows Registry and System Services. While extensive backups are created, the authors accept **no responsibility for any damage, data loss, or system instability**. Always review changes before applying. + +
+ +[![PowerShell](https://img.shields.io/badge/PowerShell-5.1%2B-blue.svg?logo=powershell)](https://github.com/PowerShell/PowerShell) +[![Windows 11](https://img.shields.io/badge/Windows%2011-25H2-0078D4.svg?logo=windows11)](https://www.microsoft.com/windows/) +[![License](https://img.shields.io/badge/license-GPL--3.0-green.svg?logo=gnu)](LICENSE) +[![Version](https://img.shields.io/badge/version-2.2.0-blue.svg)](CHANGELOG.md) +[![Status](https://img.shields.io/badge/status-production--ready-brightgreen.svg)]() + +--- + +### ๐Ÿ”’ Complete Windows 11 Security Framework +**630+ Settings โ€ข 7 Modules โ€ข Full Backup & Restore** + +[๐Ÿ“ฅ Quick Start](#-quick-start) โ€ข [๐Ÿ“š Documentation](#documentation) โ€ข [๐ŸŽฏ Key Features](#-key-features) โ€ข [๐Ÿ’ฌ Community](https://github.com/NexusOne23/noid-privacy/discussions) + +--- + +![NoID Privacy Framework](assets/framework-architecture.png) + +**7 Independent Security Modules โ€ข Modular Design โ€ข Complete BAVR Pattern** + +
+ +--- + +## โš ๏ธ CRITICAL: Domain-Joined Systems & System Backup + +> **โšก READ THIS BEFORE RUNNING** This tool modifies critical Windows security settings! + +### ๐Ÿข Domain-Joined Systems (Active Directory) + +**WARNING:** This tool is **NOT recommended for production domain-joined systems** without AD team coordination! + +**Why?** +- This tool modifies **local Group Policies** +- Domain Group Policies **override local policies every 90 minutes** +- Your hardening **may be reset automatically** by domain GPOs +- Can lead to configuration conflicts and "flapping" behavior + +**RECOMMENDED USE CASES:** +- Standalone systems (Home/Workgroup) +- Home/Personal PCs (not domain-joined) +- Virtual machines (testing/lab environments) +- Air-gapped systems +- Test/development domain-joined systems (non-production) + +**For Enterprise/Domain Environments:** +- **Integrate these settings into your Domain Group Policies instead!** +- Coordinate with your Active Directory team before using this tool + +--- + +### ๐Ÿ’พ System Backup REQUIRED + +**Before running this tool, you MUST create:** + +1. **Windows System Restore Point** (recommended) +2. **Full System Image/Backup** (critical!) +3. **VM Snapshot** (if running in virtual machine) + +**Why?** +- This tool creates **internal backups** for rollback (Registry, Services, Tasks) +- However, a **full system backup** protects against: + - Unforeseen system issues + - Hardware failures during hardening + - Configuration conflicts + - Critical errors + +**Backup Tools:** +- Windows Backup (Settings System Storage Backup) +- System Image (wbadmin, Macrium Reflect, Acronis) +- Hyper-V/VMware: Checkpoint/Snapshot + +**โš ๏ธ IMPORTANT: Create your backup BEFORE running the tool. The tool does NOT verify backup existence.** + +--- + +## โšก In 30 Seconds + +**What?** Microsoft Security Baseline + Advanced Hardening for Windows 11 25H2 +**How?** PowerShell: **Backup** **Apply** **Verify** **Restore** (100% reversible!) +**For whom?** Professionals, power users, SMBs **without Intune/Active Directory** + +**630+ Security Settings โ€ข 7 Modules โ€ข 100% BAVR Coverage* โ€ข Production-Ready** + +*_For all settings changed by NoID Privacy_ + +--- + +## ๐Ÿค” Why "NoID Privacy" when it's mostly Security? + +**Because security and privacy are inseparable. You can't have one without the other.** + +**๐Ÿ›ก๏ธ Security Foundation** +- 425 settings: MS Security Baseline for Win11 25H2 +- 24 settings: MS Security Baseline for Edge +- 19 rules: Attack Surface Reduction +- VBS + Credential Guard: Hardware-level protection + +**๐Ÿ”’ Privacy Layer** +- DNS: Block telemetry, tracking, ads (DoH) +- Telemetry: 3 modes (MSRecommended/Strict/Paranoid) +- AntiAI: 13 features disabled (Recall, Copilot, Paint AI, Notepad AI, Edge AI) +- Bloatware: 24 pre-installed apps removed + +**๐ŸŽฏ The Result:** A hardened system that's both secure against attacks and private from surveillance. + +--- + +## ๐ŸŒŸ Why NoID Privacy? + +
+ +| **SECURITY** | **PRIVACY** | **RELIABILITY** | **SAFETY** | +|:---:|:---:|:---:|:---:| +| **Microsoft Baseline 25H2** | **AI Lockdown** | **Professional Quality** | **100% Reversible** | +| 630+ Security Settings | No Recall / Copilot / AI | 100% Verification Coverage | BAVR Architecture | +| 19 ASR Rules (Block Mode) | Telemetry & Ads Blocked | Detailed Logging | Exact Pre-State Restore | +| Zero-Day CVE-2025-9491 | DNS-over-HTTPS (DoH) | Modular Design | Designed for Zero Data Loss | +| VBS & Credential Guard | Edge Browser Hardened | Open Source / Auditable | Safe for Production | + +** [3-Minute Quick Start](#-quick-start)** **[Full Feature List](Docs/FEATURES.md)** + +
+ +--- + +## ๐Ÿš€ What Makes This Different? + +**Full BAVR pattern (Backup โ†’ Apply โ†’ Verify โ†’ Restore) โ€ข Zero external binaries โ€ข 100% native PowerShell** + +| Feature | **NoID Privacy** | HardeningKitty | ChrisTitus winutil | O&O ShutUp10++ | +|:---|:---:|:---:|:---:|:---:| +| **Focus** | **MS Baseline 25H2 + ASR + DNS + Privacy (630+ settings)** | CIS/MS baseline audit & CSV-based hardening | System tweaks, debloat & app installs | Privacy toggles & telemetry control | +| **BAVR Pattern** | **Backup โ†’ Apply โ†’ Verify โ†’ Restore (all modules)** | Audit + HailMary apply + partial restore | System Restore point (no verify) | System Restore + profile export | +| **Verification** | **630+ automated compliance checks** | Audit mode with severity scoring | No compliance scan | No compliance scan | +| **Dependencies** | **Zero (runs on stock PS 5.1/7+)** | PowerShell only | winget/chocolatey required | Portable EXE (closed-source) | +| **AI Lockdown** | **32 policies (Copilot+/Recall/24H2)** | No dedicated AI profile | Individual AI tweaks | Multiple AI/Copilot toggles | + +** BAVR = Backup-Apply-Verify-Restore** (Every change is reversible) +** Air-Gapped Ready** No LGPO.exe, no DLLs, no external downloads + +--- + +## ๐Ÿ”’ Our Privacy Promise + +**"We practice what we preach"** + +| | | +|---|---| +| ๐Ÿช **Zero Cookies** | No cookie banners, no tracking cookies, no consent popups | +| ๐Ÿ“Š **Zero Analytics** | No Google Analytics, no third-party tracking scripts | +| ๐Ÿ” **Zero Telemetry** | No usage tracking, no telemetry โ€“ only minimal license validation | +| โœ… **100% Verifiable** | Open source - inspect the code yourself | + +**Actions speak louder than privacy policies.** Unlike other "privacy" tools that track you, we actually respect your privacy. + +--- + +## ๐ŸŽฏ Key Features + +### ๐Ÿ” Security Baseline (425 Settings) + +**Microsoft Security Baseline 25H2 - 100% Implementation** +- **335 Registry Policies** Computer + User Configuration +- **67 Security Template Settings** Password Policy, Account Lockout, User Rights, Security Options +- **23 Advanced Audit Policies** Complete security event logging +- **Credential Guard** Passwords can't be stolen from memory +- **BitLocker Policies** USB drive protection, enhanced PIN, DMA attack prevention +- **VBS & HVCI** Virtualization-based security + +### ๐Ÿ›ก๏ธ Attack Surface Reduction (19 Rules) + +**19 ASR Rules (18 Block + 1 Configurable)** +- Helps block common ransomware, macro, exploit, and credential theft techniques +- Office/Adobe/Email protection +- Script & executable blocking +- PSExec/WMI: Audit mode (if management tools used), Block mode otherwise +- Configurable exceptions for compatibility + +### ๐ŸŒ Secure DNS (3 Providers) + +**DNS-over-HTTPS with Secure Default (REQUIRE)** +- **Quad9** (Default) Security-focused, malware blocking, 9.9.9.9 +- **Cloudflare** Fastest resolver, 1.1.1.1 +- **AdGuard** Ad/tracker blocking built-in +- REQUIRE mode (default): no unencrypted fallback +- ALLOW mode (optional): fallback allowed for VPN/mobile/enterprise networks +- IPv4 + IPv6 dual-stack support + +### ๐Ÿ”’ Privacy Hardening (77 Settings) + +**3 Operating Modes** +- **MSRecommended** (Default) MS-supported, max compatibility +- **Strict** Maximum privacy (AllowTelemetry=0 Enterprise/Education only, Force Deny breaks UCC apps) +- **Paranoid** Hardcore (not recommended) + +**Features:** +- Telemetry minimized to Security-Essential level +- Bloatware removal (policy-based on 25H2+ Ent/Edu) +- OneDrive telemetry off (sync functional) +- App permissions default-deny + +### ๐Ÿค– AI Lockdown (32 Policies) + +**13 AI Features Disabled (incl. Master Switch)** +- **Master Switch** Disables generative AI models system-wide +- **Windows Recall** Complete deactivation (component removal + protection) +- **Windows Copilot** System-wide disabled + hardware key remapped +- **Click to Do** Screenshot AI analysis disabled +- **Paint AI** Cocreator, Generative Fill, Image Creator all blocked +- **Notepad AI** GPT features disabled +- **Settings Agent** AI-powered settings search disabled + +### ๐ŸŒ Edge Hardening (24 Policies) + +**Microsoft Edge Security Baseline** +- SmartScreen enforced +- Tracking Prevention strict +- SSL/TLS hardening +- Extension security +- IE Mode restrictions + +### ๐Ÿ”ง Advanced Security (50 Settings) + +**Beyond Microsoft Baseline** +- **SRP .lnk Protection** โ€” CVE-2025-9491 zero-day mitigation +- **RDP Hardening** โ€” Disabled by default, TLS + NLA enforced +- **Wireless Display Security** โ€” Miracast hardening, screen interception protection +- **Legacy Protocol Blocking** โ€” SMBv1, NetBIOS, LLMNR, WPAD, PowerShell v2 +- **TLS Hardening** โ€” 1.0/1.1 OFF, 1.2/1.3 ON +- **UPnP/SSDP Blocking** โ€” Port forwarding attack prevention +- **Discovery Protocols** โ€” Optional WS-Discovery + mDNS disable (Maximum profile) +- **Windows Update** โ€” Interactive configuration +- **Finger Protocol** โ€” Blocked (ClickFix malware protection) + +--- + +## ๐Ÿ”„ BAVR Pattern - Our Unique Approach + +**Every change is tracked, verified, and 100% reversible!** + +``` +[1/4] BACKUP Full system state backup before changes +[2/4] APPLY Settings applied with comprehensive logging +[3/4] VERIFY Automated compliance checks confirm success +[4/4] RESTORE One command reverts everything +``` + +**What sets us apart:** +- **100% BAVR Coverage*** All settings we change are verified and restorable +- **Professional Code Quality** Advanced functions, comprehensive error handling +- **Complete Restore** Registry, Services, Tasks, Files - everything +- **Production-Ready** Tested on Windows 11 25H2, PowerShell 5.1+ + +**Before v2.2.0:** 89.4% verification coverage (62 settings missing) +**After v2.2.0:** 100% verification coverage (all 630+ settings verified) + +--- + +## โš ๏ธ What This Does NOT Protect Against + +**Important Limitations:** + +| Threat | Why Not Protected | +|--------|-------------------| +| **Social Engineering** | If users deliberately bypass all warnings and run malicious files | +| **Supply-Chain Attacks** | Malware embedded in legitimate signed software | +| **Physical Access** | Stolen device without BitLocker (use BitLocker!) | +| **Nation-State Actors** | Sophisticated targeted attacks require enterprise EDR/XDR | +| **Zero-Day Exploits** | Unknown vulnerabilities not yet patched by Microsoft | + +**What you need additionally:** +- **Regular Windows Updates** โ€” Critical for security patches +- **BitLocker** โ€” For lost/stolen device protection +- **User Awareness** โ€” Don't click suspicious links/attachments +- **Backups** โ€” 3-2-1 backup strategy for ransomware resilience + +> **NoID Privacy hardens your system significantly, but no security solution provides 100% protection.** +> Defense in depth is always recommended. + +--- + +## ๐Ÿ“ฅ Quick Start + +### โšก One-Liner Install (Recommended) + +**Step 1:** Open PowerShell as Administrator +- Press `Win + X` Click **"Terminal (Admin)"** + +**Step 2:** Run installer + +```powershell +# Download and run (Windows 11 25H2 recommended) +irm https://raw.githubusercontent.com/NexusOne23/noid-privacy/main/install.ps1 | iex +``` + +**What it does:** +1. Checks Administrator privileges +2. Verifies Windows 11 25H2 +3. Downloads latest release from GitHub +4. Extracts & unblocks all files +5. Starts interactive mode + +**Alternative - Manual Install:** + +```powershell +# 1. Clone repository +git clone https://github.com/NexusOne23/noid-privacy.git +cd noid-privacy + +# 2. Run as Admin +.\Start-NoIDPrivacy.bat + +# 3. Verify after reboot +.\Tools\Verify-Complete-Hardening.ps1 +``` + +> **Downloaded ZIP?** Run `Start-NoIDPrivacy.bat` - it automatically unblocks all files! + +--- + +## ๐Ÿ’ป Usage Examples + +### Interactive Mode (Recommended) + +```powershell +# Start interactive menu +.\Start-NoIDPrivacy.bat + +# Follow prompts: +# 1. Select modules (all or custom) +# 2. Choose settings (DNS provider, Privacy mode, etc.) +# 3. Automatic backup apply verify +# 4. Reboot prompt +``` + +### Direct Execution + +```powershell +# Apply all modules +.\NoIDPrivacy.ps1 -Module All + +# Apply specific module +.\NoIDPrivacy.ps1 -Module Privacy + +# Dry-run (no changes) +.\NoIDPrivacy.ps1 -Module All -DryRun +``` + +### Verification + +```powershell +# Full verification (632 checks with Paranoid mode) +.\Tools\Verify-Complete-Hardening.ps1 + +# Expected output (all modules enabled, Paranoid mode): +# SecurityBaseline: 425/425 verified +# ASR: 19/19 verified +# DNS: 5/5 verified +# Privacy: 77/77 verified +# AntiAI: 32/32 verified +# EdgeHardening: 24/24 verified +# AdvancedSecurity: 50/50 verified +# Total: 632/632 (100%) +``` + +### Restore + +```powershell +# Restore from latest backup +.\Core\Rollback.ps1 -RestoreLatest + +# Or via interactive menu +.\Start-NoIDPrivacy.bat +# Select "Restore from backup" +``` + +--- + +## ๐Ÿ“Š Module Overview + +| Module | Settings | Description | Status | +|--------|----------|-------------|--------| +| **SecurityBaseline** | 425 | Microsoft Security Baseline 25H2 | v2.2.0 | +| **ASR** | 19 | Attack Surface Reduction Rules | v2.2.0 | +| **DNS** | 5 | Secure DNS with DoH encryption | v2.2.0 | +| **Privacy** | 77 | Telemetry, Bloatware, OneDrive hardening (MSRecommended) | v2.2.0 | +| **AntiAI** | 32 | AI lockdown (13 features, 32 compliance checks) | v2.2.0 | +| **EdgeHardening** | 24 | Microsoft Edge security (24 policies) | v2.2.0 | +| **AdvancedSecurity** | 50 | Beyond MS Baseline (SRP, Legacy protocols, Wireless Display, Discovery Protocols, IPv6) | v2.2.0 | +| **TOTAL** | **632** | **Complete Framework (Paranoid mode)** | **Production** | + +**Release Highlights:** + + **v2.2.0:** 100% verification coverage (all 630+ settings verified) + **v2.2.0:** Improved Advanced Security module with SRP .lnk protection + **v2.2.0:** Enhanced RDP hardening with TLS + NLA enforced + **v2.2.0:** Legacy protocol blocking (SMBv1, NetBIOS, LLMNR, WPAD, PowerShell v2) + **v2.2.0:** TLS hardening (1.0/1.1 OFF, 1.2/1.3 ON) + **v2.2.0:** Windows Update interactive configuration + **v2.2.0:** Finger Protocol blocked (ClickFix malware protection) + **v2.2.0:** Enhanced Registry Backup (Smart JSON-Fallback for protected system keys) + +** [Detailed Module Documentation](Docs/FEATURES.md)** + +--- + +## โœ… Perfect For + +### **Ideal Use Cases** + +**Small/Medium Business (SMB)** +- No Active Directory/Intune licenses +- Cloud-first (Microsoft 365, Google Workspace) +- Remote/hybrid work security +- Compliance without enterprise infrastructure + +**Freelancers & Consultants** +- Client data protection +- Secure workstations without domain +- Professional security standards +- Safe experimentation (complete backup) + +**Power Users & Privacy-Conscious** +- Real security, not just "debloat" +- AI/Telemetry lockdown +- Understand every setting +- Full control + reversibility + +**IT Pros Without Intune** +- Standalone Windows 11 hardening +- Microsoft Baseline compliance locally +- Quick deploy for clients +- No domain controller required + +### **Not Ideal For** + +**Enterprise with Intune/AD** +- Use [Microsoft Security Baselines](https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10) with Group Policy instead + +**Windows 10 or Older** +- This tool is designed for Windows 11 (24H2/25H2 recommended, 23H2 compatible) + +**Legacy Software Dependencies** +- If you rely on unsafe SMB1/RPC/DCOM + +**Strict MDM Reporting** +- If compliance must be centrally reported + +--- + +## โš™๏ธ Requirements & Compatibility + +### Hardware & OS + +NoID Privacy is designed for modern, officially supported Windows 11 systems. + +If your PC can run Windows 11 according to Microsoft's **official requirements**, it is compatible with NoID Privacy: + +- **OS:** Windows 11 24H2/25H2 recommended (23H2 compatible) +- **CPU:** Any CPU on Microsoft's Windows 11 support list (Intel 8th Gen / AMD Ryzen 2000+) +- **Firmware:** UEFI with **Secure Boot** enabled +- **TPM:** 2.0 (required for BitLocker, Credential Guard, VBS) +- **RAM:** 8 GB minimum, 16 GB recommended for VBS +- **Admin Rights:** Required + +> **Short version:** If Windows 11 is officially supported on your PC, NoID Privacy is supported too. + +**Tested & Compatible:** + +| OS Version | Status | +|------------|--------| +| Windows 11 25H2 (Build 26200+) | **Fully Tested** | +| Windows 11 24H2 (Build 26100+) | Compatible | +| Windows 11 23H2 (Build 22631+) | Some features N/A | + +### Legacy Devices & Protocols + +The **AdvancedSecurity** and **SecurityBaseline** modules intentionally disable legacy and insecure protocols: + +- **TLS 1.0/1.1** (TLS 1.2+ required) +- **NetBIOS** name resolution, **LLMNR**, **WPAD** +- **PowerShell v2** +- **Administrative shares** (C$, ADMIN$) in some scenarios +- **NTLMv1/LM** authentication (NTLMv2 only) + +This can affect **very old hardware and software**, for example: + +- NAS, printers, IP cameras, and IoT devices that only support TLS 1.0/1.1 +- Legacy Windows systems (XP, 7) and old Samba implementations +- Old management tools that rely on hidden admin shares + +**In practice:** Environments using hardware and software from **~2018 onwards** are fully compatible. + +If you still depend on legacy devices, use the built-in **BAVR** pattern (Backup โ†’ Apply โ†’ Verify โ†’ Restore) to roll back if something breaks. + +### ๐Ÿ›ก๏ธ Antivirus Compatibility + +#### Designed for Microsoft Defender โ€“ Works with Any Antivirus + +**NoID Privacy is optimized for the default Windows 11 security stack:** + +``` +Windows 11 + Microsoft Defender + NoID Privacy = 100% Feature Coverage (630+ Settings) +``` + +This is the **recommended setup** โ€“ just install Windows 11, keep Defender active, and run NoID Privacy. You get: +- โœ… **All 7 modules** (Security Baseline, ASR, DNS, Privacy, AntiAI, Edge, Advanced Security) +- โœ… **19 ASR rules** protecting against ransomware, exploits, and malware +- โœ… **Full enterprise-grade hardening** with zero additional software + +--- + +#### Already Using Third-Party Antivirus? + +**No problem!** NoID Privacy automatically detects third-party antivirus software and adapts: + +| Your Setup | What Happens | Coverage | +|------------|--------------|----------| +| **Defender Active** | All modules applied | **632 settings** (100%) | +| **3rd-Party AV** (Kaspersky, Norton, Bitdefender, etc.) | ASR skipped, all other modules applied | **613 settings** (~97%) | + +**Why?** ASR (Attack Surface Reduction) rules are a **Microsoft Defender exclusive feature**. Third-party antivirus products provide their own equivalent protection. NoID Privacy detects this and gracefully skips ASR while applying everything else. + +When a third-party antivirus is detected, you'll see a clear notification: + +``` +======================================== + ASR Module Skipped +======================================== + +Third-party antivirus detected: Kaspersky Total Security + +ASR rules require Windows Defender to be active. +Your antivirus (Kaspersky Total Security) has its own protection features. + +This is NOT an error - ASR will be skipped. +``` + +**Why?** Third-party antivirus products typically provide their own equivalent protection features. The rest of the hardening (Security Baseline, DNS, Privacy, Edge, Advanced Security) will still be applied. + +**All other modules work normally** regardless of your antivirus choice. + +--- + +## ๐Ÿ”’ Security & Quality + +### Code Quality + +- **PSScriptAnalyzer:** Available for static analysis +- **Pester Tests:** Unit and integration tests in `Tests/` directory (`.\Tests\Run-Tests.ps1`) +- **Verification:** 630+ automated compliance checks in production +- **Production-Ready:** Professional error handling and comprehensive logging +- **Best Practices:** Advanced Functions, CmdletBinding, Validated Parameters + +### What This Tool Does + +- Hardens Windows 11 to enterprise standards +- Implements Microsoft Security Baseline 25H2 +- Protects against zero-day exploits (CVE-2025-9491) +- Minimizes telemetry to Security-Essential level +- Locks down AI features (Recall, Copilot, etc.) +- Configures BitLocker policies, Credential Guard, VBS + +### What This Tool Does NOT Do + +- Install third-party antivirus (uses Windows Defender) +- Configure domain-specific policies +- Modify BIOS/UEFI settings +- Break critical Windows functionality +- Prevent re-enabling features + +### Reversibility + +- **What CAN be restored:** Services, Registry, Firewall, DNS, Tasks, AI features +- **What CAN be auto-restored:** Most removed bloatware apps via `winget` during session restore (where mappings exist) +- **What may still need manual reinstall:** Unmapped/third-party bloatware apps (use Microsoft Store) +- **Backup System:** Complete system state before applying +- **REMOVED_APPS_LIST.txt:** Created during bloatware removal with a full list of removed apps for manual reinstall if needed +- **Documented Changes:** All changes logged + +--- + +## โš™๏ธ Configuration + +### Default Settings + +All settings configured for **maximum security with maintained usability**: +- Services: Telemetry services controlled, critical services protected +- Firewall: Inbound blocked, outbound allowed +- Privacy: Default-deny for app permissions (user can enable individually) +- BitLocker: Policies set, user must enable manually +- AI Features: Disabled via Registry (100% reversible) + +### Customization + +All module settings can be customized via JSON files in `Modules/*/Config/`: + +```powershell +# Example: Adjust DNS provider +Edit: Modules/DNS/Config/Providers.json + +# Example: Modify Privacy mode +Edit: Modules/Privacy/Config/Privacy-MSRecommended.json + +# Example: Configure ASR exceptions +Edit: Modules/ASR/Config/ASR-Rules.json +``` + +--- + +## ๐Ÿ”ง Troubleshooting + +> **Can't install software after hardening?** See [Temporarily Disable ASR Rule](#temporarily-disable-asr-rule-for-software-installation) for step-by-step solution + +### Common Issues + +**"Access Denied" errors** +- Not running as Administrator +- Right-click PowerShell โ†’ "Run as Administrator" + +**VBS/Credential Guard not active after reboot** +- Hardware incompatibility (no TPM 2.0 or virtualization disabled) +- Enable virtualization in BIOS/UEFI +- Verify: `.\Tools\Verify-Complete-Hardening.ps1` + +**BitLocker not activating** +- No TPM 2.0 or insufficient disk space +- Check TPM: `Get-Tpm` +- Manual activation: Control Panel โ†’ BitLocker + +**ASR blocking legitimate software installation** +- ASR rule "Block executable files unless they meet prevalence" blocks unknown installers +- See [Temporarily Disable ASR Rule](#temporarily-disable-asr-rule-for-software-installation) below + +--- + +### Temporarily Disable ASR Rule for Software Installation + +**Problem:** ASR blocks installation of legitimate software (e.g., downloaded installers not in Microsoft's reputation database) + +**Blocked Rule:** `01443614-cd74-433a-b99e-2ecdc07bfc25` ("Block executable files unless they meet prevalence, age, or trusted list") + +**Solution:** Temporarily set the rule to AUDIT mode (warns only, doesn't block) + +**Step 1: Disable Tamper Protection** (GUI method - easiest) +1. Press `Win` key Type "Windows Security" Enter +2. Go to: **Virus & threat protection** +3. Click: **Manage settings** +4. Scroll down to: **Tamper Protection** Toggle **OFF** + +**Step 2: Set ASR Rule to AUDIT** (PowerShell as Admin) + +```powershell +# Get current ASR configuration +$currentIds = (Get-MpPreference).AttackSurfaceReductionRules_Ids +$currentActions = (Get-MpPreference).AttackSurfaceReductionRules_Actions + +# Convert to arrays +$ids = @($currentIds) +$actions = @($currentActions) + +# Find the prevalence rule +$targetGuid = "01443614-cd74-433a-b99e-2ecdc07bfc25" +$index = [array]::IndexOf($ids, $targetGuid) + +# Set to AUDIT (2 = Audit, 1 = Block) +$actions[$index] = 2 + +# Apply changes +Set-MpPreference -AttackSurfaceReductionRules_Ids $ids -AttackSurfaceReductionRules_Actions $actions + +Write-Host " ASR Prevalence Rule: AUDIT (Installation now possible)" -ForegroundColor Green +``` + +**Step 3: Install your software** + +**Step 4: Re-enable the ASR Rule** (PowerShell as Admin) + +```powershell +# Get current ASR configuration +$currentIds = (Get-MpPreference).AttackSurfaceReductionRules_Ids +$currentActions = (Get-MpPreference).AttackSurfaceReductionRules_Actions + +# Convert to arrays +$ids = @($currentIds) +$actions = @($currentActions) + +# Find the prevalence rule +$targetGuid = "01443614-cd74-433a-b99e-2ecdc07bfc25" +$index = [array]::IndexOf($ids, $targetGuid) + +# Set back to BLOCK +$actions[$index] = 1 + +# Apply changes +Set-MpPreference -AttackSurfaceReductionRules_Ids $ids -AttackSurfaceReductionRules_Actions $actions + +Write-Host " ASR Prevalence Rule: BLOCK (Protection restored)" -ForegroundColor Green +``` + +**Step 5: Re-enable Tamper Protection** (Windows Security Toggle ON) + +**IMPORTANT:** Always re-enable both the ASR rule AND Tamper Protection after installation! + +--- + +### Windows Insider Program Compatibility + +**Problem:** After applying Privacy hardening (MSRecommended mode), Windows Insider enrollment requires extra steps. + +**Cause:** Privacy module sets `AllowTelemetry=1` (Required diagnostic data) via Group Policy, which prevents the user from enabling "Optional diagnostic data" in Settings - a requirement for Insider Program enrollment. + +**Solution:** + +**Step 1: Temporarily remove the telemetry policy** (PowerShell as Admin) + +```powershell +Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" -Name "AllowTelemetry" +``` + +**Step 2: Reboot** (recommended for policy changes to take effect) + +```powershell +Restart-Computer +``` + +**Step 3: Join Windows Insider Program** +1. Go to: Settings > Windows Update > Windows Insider Program +2. Click: **Get Started** +3. When prompted, enable "Optional diagnostic data" +4. Complete Insider enrollment and select your channel (Dev/Beta/Release Preview) + +**Step 4 (Optional): Re-apply Privacy hardening** + +```powershell +.\NoIDPrivacy.ps1 -Module Privacy +``` + +**Note:** Once enrolled in the Insider Program, Windows will continue to receive preview builds even after re-applying Privacy hardening with `AllowTelemetry=1`. + +--- + +### Logs + +All operations logged to: +``` +Logs/NoIDPrivacy_YYYYMMDD_HHMMSS.log +``` + +**Example:** `NoIDPrivacy_20251117_142345.log` + +--- + +## ๐Ÿ“š Documentation + +### Core Documentation +- **[Features](Docs/FEATURES.md)** - Complete 630+ setting reference +- **[Changelog](CHANGELOG.md)** - Version history +- **[Quick Start](#-quick-start)** - Installation guide (see above) +- **[Troubleshooting](#troubleshooting)** - Common issues (see above) + +### ๐Ÿ’ฌ Community + +- **[๐Ÿ’ฌ Discussions](https://github.com/NexusOne23/noid-privacy/discussions)** - Questions, ideas, and commercial licensing inquiries +- **[๐Ÿ› Issues](https://github.com/NexusOne23/noid-privacy/issues)** - Bug reports only +- **[๐Ÿ“š Documentation](Docs/FEATURES.md)** - Complete feature reference + +--- + +## ๐Ÿ™ Acknowledgments + +- **Microsoft Security Baseline Team** for Windows 11 25H2 guidance +- **PowerShell Community** for best practices and patterns +- **Open Source Contributors** for testing and feedback + +--- + +## ๐Ÿ“œ License + +### Dual-License Model + +NoID Privacy is available under a **dual-licensing** model: + +#### ๐Ÿ†“ Open Source License (GPL v3.0) + +**For individuals, researchers, and open-source projects:** + +This project is licensed under the **GNU General Public License v3.0** (GPL-3.0). + +โœ… **You CAN:** +- โœ”๏ธ Use the software freely for personal and commercial purposes +- โœ”๏ธ Modify the source code +- โœ”๏ธ Distribute the software +- โœ”๏ธ Distribute your modifications + +โš ๏ธ **You MUST:** +- ๐Ÿ“ Disclose your source code when distributing +- ๐Ÿ”“ License your modifications under GPL v3.0 +- ๐Ÿ“„ Include the original copyright notice +- ๐Ÿ“‹ State significant changes made to the software + +[Read the full GPL v3.0 License](LICENSE) + +#### ๐Ÿ’ผ Commercial License + +**For companies and organizations that want to:** +- Integrate this software into closed-source/proprietary products +- Distribute this software without disclosing source code +- Receive dedicated commercial support and warranties +- Avoid GPL v3.0 copyleft requirements + +**Contact:** +- **Email:** [support@noid-privacy.com](mailto:support@noid-privacy.com) (Preferred for commercial inquiries) +- **GitHub:** [๐Ÿ’ฌ Discussions](https://github.com/NexusOne23/noid-privacy/discussions) (Public questions) + +--- + +### Third-Party Components + +This software implements security configurations based on: +- **Microsoft Security Baselines** - Public documentation +- **Microsoft Defender ASR Rules** - Official documentation +- **DNS Providers** - Cloudflare, Quad9, AdGuard (public services) + +Microsoft, Windows, and Edge are trademarks of Microsoft Corporation. This project is not affiliated with Microsoft. + +--- + +## โš ๏ธ Disclaimer + +This script modifies critical system settings. Use at your own risk. Always: +1. **Create a system backup** before running +2. **Test in a VM** first +3. **Review the code** to understand changes +4. **Verify compatibility** with your environment + +The authors are not responsible for any damage or data loss. + +--- + +## ๐Ÿ“ˆ Project Status + +**Current Version:** 2.2.0 +**Last Updated:** December 5, 2025 +**Status:** Production-Ready + +### Release Highlights v2.2.0 + +- 630+ settings (expanded from 580+) +- NonInteractive mode for GUI integration +- Third-party AV detection and graceful ASR skip +- AntiAI enhanced to 32 policies (was 24) +- Pre-Framework ASR snapshot +- Smart Registry Backup with JSON fallback + +** [See Full Changelog](CHANGELOG.md)** + +--- + +
+ +**Made with ๐Ÿ›ก๏ธ for the Windows Security Community** + +[Report Bug](https://github.com/NexusOne23/noid-privacy/issues) [Request Feature](https://github.com/NexusOne23/noid-privacy/issues) [Discussions](https://github.com/NexusOne23/noid-privacy/discussions) + + **Star this repo** if you find it useful! + +
+ + + diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..59d27ab --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,178 @@ +# Security Policy + +## ๐Ÿ”’ Reporting Security Vulnerabilities + +We take the security of NoID Privacy seriously. If you discover a security vulnerability, please follow responsible disclosure practices. + +### โœ… How to Report + +**DO NOT** create a public GitHub issue for security vulnerabilities. + +Instead, please report security issues via one of these methods: + +1. **GitHub Security Advisory** (Preferred) + - Go to: https://github.com/NexusOne23/noid-privacy/security/advisories + - Click "Report a vulnerability" + - Fill out the private security advisory form + +2. **GitHub Discussions** (Private) + - Create a new discussion in the Security category + - Mark it as "Private" if possible + - Provide full details + +3. **Email** (Alternative) + - Create a discussion requesting secure contact + - We'll provide a secure communication channel + +### ๐Ÿ“‹ What to Include + +When reporting a vulnerability, please include: + +- **Description**: Clear description of the vulnerability +- **Impact**: What can an attacker achieve? +- **Affected Versions**: Which versions are affected? +- **Steps to Reproduce**: Detailed reproduction steps +- **Proof of Concept**: PoC code if applicable (optional) +- **Suggested Fix**: If you have one (optional) + +### โฑ๏ธ Response Timeline + +- **Initial Response**: Within 48 hours +- **Status Update**: Within 7 days +- **Fix Timeline**: Depends on severity + - Critical: 7-14 days + - High: 14-30 days + - Medium: 30-60 days + - Low: 60-90 days + +### ๐ŸŽ–๏ธ Recognition + +We appreciate responsible disclosure! Contributors will be: +- Credited in the CHANGELOG (if desired) +- Listed in the Security Hall of Fame (coming soon) +- Eligible for swag/recognition (for significant findings) + +--- + +## ๐Ÿ›ก๏ธ Security Features + +NoID Privacy implements multiple security layers: + +### Secure by Design +- โœ… **No External Dependencies**: Zero third-party DLLs or executables +- โœ… **Code Signing (Planned)**: Code signing for all PowerShell scripts is planned (coming soon) +- โœ… **Verification**: 630+ automated compliance checks +- โœ… **Rollback**: Complete backup & restore functionality + +### Security Hardening Applied +- ๐Ÿ” Microsoft Security Baseline 25H2 (425 settings) +- ๐Ÿ›ก๏ธ Attack Surface Reduction (19 rules) +- ๐Ÿ”’ Credential Guard + VBS + HVCI +- ๐Ÿค– AI Lockdown (Recall, Copilot, etc.) +- ๐ŸŒ DNS-over-HTTPS with no fallback +- ๐Ÿšซ Zero-Day Protection (CVE-2025-9491 SRP) + +--- + +## ๐Ÿ“Š Supported Versions + +| Version | Supported | Notes | +| ------- | ------------------ | ----- | +| 2.2.x | โœ… Fully Supported | Current release, 630+ settings | +| 2.1.x | โš ๏ธ Limited Support | Upgrade to 2.2.x recommended | +| 2.0.x | โŒ Not Supported | Deprecated | +| 1.8.x | โŒ Not Supported | Legacy version (MIT license) | + +**Recommendation:** Always use the latest v2.x release. + +--- + +## ๐Ÿ” Security Best Practices for Users + +### Before Running +1. โœ… **Verify Script Integrity** + ```powershell + # Check file hash (coming soon - SHA256 checksums in releases) + Get-FileHash .\NoIDPrivacy.ps1 -Algorithm SHA256 + ``` + +2. โœ… **Review Code** + - This is open-source - read the code! + - Understand what changes will be made + - Check CHANGELOG for recent changes + +3. โœ… **Create Backup** + - System Restore Point + - Full system image + - VM snapshot (if applicable) + +### During Execution +- โš ๏ธ Run as Administrator (required) +- โš ๏ธ Disable third-party antivirus temporarily (may interfere) +- โš ๏ธ Close sensitive applications +- โš ๏ธ Review verification report + +### After Execution +- โœ… Run verification: `.\Tools\Verify-Complete-Hardening.ps1` +- โœ… Review HTML compliance report +- โœ… Test critical applications +- โœ… Keep backups for 30 days + +--- + +## ๐Ÿšจ Known Security Considerations + +### Domain-Joined Systems +- โš ๏ธ Local Group Policies may conflict with Domain GPOs +- โš ๏ธ Domain GPOs override local policies every 90 minutes +- โœ… **Recommendation**: Use in standalone/workgroup systems only + +### Third-Party Software Compatibility +- โš ๏ธ ASR rules may block unknown installers +- โš ๏ธ Some hardening settings may affect application functionality +- โœ… **Solution**: Temporarily disable specific ASR rules (see README) + +### Rollback Limitations +- โš ๏ธ Bloatware removal is partially reversible (policy-based on 25H2+ Enterprise/Education) +- โš ๏ธ Some changes require manual reverification after restore +- โœ… **Solution**: Test in VM first, maintain system backups + +--- + +## ๐Ÿ“š Security Resources + +- **Microsoft Security Baseline**: https://aka.ms/securitybaselines +- **Attack Surface Reduction**: https://aka.ms/ASRrules +- **Windows Security Documentation**: https://learn.microsoft.com/windows/security/ + +--- + +## ๐Ÿ” Code Quality + +### Testing & Validation +- **PSScriptAnalyzer**: Available for static analysis +- **Pester Tests**: Unit and integration tests available in `Tests/` directory +- **Verification**: 630+ automated compliance checks in production + +Run tests yourself: +```powershell +.\Tests\Run-Tests.ps1 +``` + +### Vulnerability Disclosures +*No security vulnerabilities reported to date.* + +--- + +## ๐Ÿ“„ License & Legal + +- **License**: GNU General Public License v3.0 +- **Disclaimer**: Use at your own risk. No warranties provided. +- **Compliance**: Implements Microsoft-recommended security settings + +For licensing questions, see [LICENSE](LICENSE) or open a [Discussion](https://github.com/NexusOne23/noid-privacy/discussions). + +--- + +**Last Updated**: December 5, 2025 +**Policy Version**: 1.1 diff --git a/Start-NoIDPrivacy.bat b/Start-NoIDPrivacy.bat new file mode 100644 index 0000000..207068e --- /dev/null +++ b/Start-NoIDPrivacy.bat @@ -0,0 +1,39 @@ +@echo off +REM ======================================== +REM NoID Privacy - Interactive Launcher +REM ======================================== +REM +REM This script launches NoIDPrivacy-Interactive.ps1 with +REM Administrator privileges (auto-elevation). +REM +REM Author: NexusOne23 +REM Version: 2.2.0 +REM ======================================== + +setlocal + +title NoID Privacy v2.2.0 + +REM Get the directory where this batch file is located +set "SCRIPT_DIR=%~dp0" + +REM Check if already running as administrator +net session >nul 2>&1 +if %errorLevel% == 0 ( + REM Already admin, run PowerShell script directly + echo Running NoID Privacy Interactive Menu with Administrator privileges... + echo. + powershell.exe -ExecutionPolicy Bypass -NoProfile -File "%SCRIPT_DIR%NoIDPrivacy-Interactive.ps1" %* + pause + exit /b +) + +REM Not admin - request elevation +echo Requesting Administrator privileges... +echo. + +REM Use PowerShell to elevate and run the script +powershell.exe -Command "Start-Process PowerShell.exe -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"%SCRIPT_DIR%NoIDPrivacy-Interactive.ps1\" %*' -Verb RunAs" + +REM Exit this non-elevated instance +exit /b diff --git a/Tests/Integration/ASR.Integration.Tests.ps1 b/Tests/Integration/ASR.Integration.Tests.ps1 new file mode 100644 index 0000000..a26c68d --- /dev/null +++ b/Tests/Integration/ASR.Integration.Tests.ps1 @@ -0,0 +1,31 @@ +Describe "ASR Integration Tests" { + BeforeAll { + $script:ModulePath = Join-Path $PSScriptRoot "..\..\Modules\ASR" + $script:ManifestPath = Join-Path $script:ModulePath "ASR.psd1" + } + + Context "Module Structure" { + It "Should have module manifest" { + Test-Path $script:ManifestPath | Should -Be $true + } + + It "Should load module without errors" { + { Import-Module $script:ManifestPath -Force -ErrorAction Stop } | Should -Not -Throw + } + + It "Should export Invoke-ASRRules function" { + $module = Get-Module ASR + $module.ExportedFunctions.Keys | Should -Contain "Invoke-ASRRules" + } + } + + Context "DryRun Execution" { + It "Should run in DryRun mode without errors" { + { Invoke-ASRRules -DryRun -ErrorAction Stop } | Should -Not -Throw + } + } + + AfterAll { + Remove-Module ASR -ErrorAction SilentlyContinue + } +} diff --git a/Tests/Integration/AdvancedSecurity.Integration.Tests.ps1 b/Tests/Integration/AdvancedSecurity.Integration.Tests.ps1 new file mode 100644 index 0000000..fbdec30 --- /dev/null +++ b/Tests/Integration/AdvancedSecurity.Integration.Tests.ps1 @@ -0,0 +1,74 @@ +Describe "AdvancedSecurity Integration Tests" { + BeforeAll { + $script:ModulePath = Join-Path $PSScriptRoot "..\..\Modules\AdvancedSecurity" + $script:ManifestPath = Join-Path $script:ModulePath "AdvancedSecurity.psd1" + } + + Context "Module Structure" { + It "Should have module manifest" { + Test-Path $script:ManifestPath | Should -Be $true + } + + It "Should load module without errors" { + { Import-Module $script:ManifestPath -Force -ErrorAction Stop } | Should -Not -Throw + } + + It "Should export Invoke-AdvancedSecurity function" { + $module = Get-Module AdvancedSecurity + $module.ExportedFunctions.Keys | Should -Contain "Invoke-AdvancedSecurity" + } + + It "Should export Test-AdvancedSecurity function" { + $module = Get-Module AdvancedSecurity + $module.ExportedFunctions.Keys | Should -Contain "Test-AdvancedSecurity" + } + } + + Context "Configuration Files" { + It "Should have SRP-Rules.json" { + $configPath = Join-Path $script:ModulePath "Config\SRP-Rules.json" + Test-Path $configPath | Should -Be $true + } + + It "SRP-Rules.json should be valid" { + $configPath = Join-Path $script:ModulePath "Config\SRP-Rules.json" + { Get-Content $configPath -Raw | ConvertFrom-Json -ErrorAction Stop } | Should -Not -Throw + } + + It "Should have WindowsUpdate.json" { + $configPath = Join-Path $script:ModulePath "Config\WindowsUpdate.json" + Test-Path $configPath | Should -Be $true + } + + It "WindowsUpdate.json should be valid" { + $configPath = Join-Path $script:ModulePath "Config\WindowsUpdate.json" + { Get-Content $configPath -Raw | ConvertFrom-Json -ErrorAction Stop } | Should -Not -Throw + } + } + + Context "DryRun Execution" { + It "Should run Invoke-AdvancedSecurity in DryRun mode without errors" { + { Invoke-AdvancedSecurity -DryRun -ErrorAction Stop } | Should -Not -Throw + } + + It "Should run with Balanced profile in DryRun mode" { + { Invoke-AdvancedSecurity -SecurityProfile "Balanced" -DryRun -ErrorAction Stop } | Should -Not -Throw + } + + It "Should run with Enterprise profile in DryRun mode" { + { Invoke-AdvancedSecurity -SecurityProfile "Enterprise" -DryRun -ErrorAction Stop } | Should -Not -Throw + } + + It "Should run with Maximum profile in DryRun mode" { + { Invoke-AdvancedSecurity -SecurityProfile "Maximum" -DryRun -ErrorAction Stop } | Should -Not -Throw + } + + It "Should run Test-AdvancedSecurity without errors" { + { Test-AdvancedSecurity -ErrorAction Stop } | Should -Not -Throw + } + } + + AfterAll { + Remove-Module AdvancedSecurity -ErrorAction SilentlyContinue + } +} diff --git a/Tests/Integration/AntiAI.Integration.Tests.ps1 b/Tests/Integration/AntiAI.Integration.Tests.ps1 new file mode 100644 index 0000000..46b3cb7 --- /dev/null +++ b/Tests/Integration/AntiAI.Integration.Tests.ps1 @@ -0,0 +1,42 @@ +Describe "AntiAI Integration Tests" { + BeforeAll { + $script:ModulePath = Join-Path $PSScriptRoot "..\..\Modules\AntiAI" + $script:ManifestPath = Join-Path $script:ModulePath "AntiAI.psd1" + $script:ComplianceScript = Join-Path $script:ModulePath "Test-AntiAICompliance.ps1" + } + + Context "Module Structure" { + It "Should have module manifest" { + Test-Path $script:ManifestPath | Should -Be $true + } + + It "Should have compliance test script" { + Test-Path $script:ComplianceScript | Should -Be $true + } + + It "Should load module without errors" { + { Import-Module $script:ManifestPath -Force -ErrorAction Stop } | Should -Not -Throw + } + + It "Should export Invoke-AntiAI function" { + $module = Get-Module AntiAI + $module.ExportedFunctions.Keys | Should -Contain "Invoke-AntiAI" + } + } + + Context "DryRun Execution" { + It "Should run in DryRun mode without errors" { + { Invoke-AntiAI -DryRun -ErrorAction Stop } | Should -Not -Throw + } + } + + Context "Compliance Check" { + It "Should run compliance test without errors" { + { & $script:ComplianceScript -ErrorAction Stop } | Should -Not -Throw + } + } + + AfterAll { + Remove-Module AntiAI -ErrorAction SilentlyContinue + } +} diff --git a/Tests/Integration/DNS.Integration.Tests.ps1 b/Tests/Integration/DNS.Integration.Tests.ps1 new file mode 100644 index 0000000..b71ef0b --- /dev/null +++ b/Tests/Integration/DNS.Integration.Tests.ps1 @@ -0,0 +1,36 @@ +Describe "DNS Integration Tests" { + BeforeAll { + $script:ModulePath = Join-Path $PSScriptRoot "..\..\Modules\DNS" + $script:ManifestPath = Join-Path $script:ModulePath "DNS.psd1" + } + + Context "Module Structure" { + It "Should have module manifest" { + Test-Path $script:ManifestPath | Should -Be $true + } + + It "Should load module without errors" { + { Import-Module $script:ManifestPath -Force -ErrorAction Stop } | Should -Not -Throw + } + + It "Should export Invoke-DNSConfiguration function" { + $module = Get-Module DNS + $module.ExportedFunctions.Keys | Should -Contain "Invoke-DNSConfiguration" + } + + It "Should export Get-DNSStatus function" { + $module = Get-Module DNS + $module.ExportedFunctions.Keys | Should -Contain "Get-DNSStatus" + } + } + + Context "DryRun Execution" { + It "Should run in DryRun mode with provider specified without errors" { + { Invoke-DNSConfiguration -Provider "Quad9" -DryRun -ErrorAction Stop } | Should -Not -Throw + } + } + + AfterAll { + Remove-Module DNS -ErrorAction SilentlyContinue + } +} diff --git a/Tests/Integration/EdgeHardening.Integration.Tests.ps1 b/Tests/Integration/EdgeHardening.Integration.Tests.ps1 new file mode 100644 index 0000000..e419b87 --- /dev/null +++ b/Tests/Integration/EdgeHardening.Integration.Tests.ps1 @@ -0,0 +1,52 @@ +Describe "EdgeHardening Integration Tests" { + BeforeAll { + $script:ModulePath = Join-Path $PSScriptRoot "..\..\Modules\EdgeHardening" + $script:ManifestPath = Join-Path $script:ModulePath "EdgeHardening.psd1" + } + + Context "Module Structure" { + It "Should have module manifest" { + Test-Path $script:ManifestPath | Should -Be $true + } + + It "Should load module without errors" { + { Import-Module $script:ManifestPath -Force -ErrorAction Stop } | Should -Not -Throw + } + + It "Should export Invoke-EdgeHardening function" { + $module = Get-Module EdgeHardening + $module.ExportedFunctions.Keys | Should -Contain "Invoke-EdgeHardening" + } + + It "Should export Test-EdgeHardening function" { + $module = Get-Module EdgeHardening + $module.ExportedFunctions.Keys | Should -Contain "Test-EdgeHardening" + } + } + + Context "Configuration Files" { + It "Should have EdgePolicies.json" { + $configPath = Join-Path $script:ModulePath "Config\EdgePolicies.json" + Test-Path $configPath | Should -Be $true + } + + It "EdgePolicies.json should be valid" { + $configPath = Join-Path $script:ModulePath "Config\EdgePolicies.json" + { Get-Content $configPath -Raw | ConvertFrom-Json -ErrorAction Stop } | Should -Not -Throw + } + } + + Context "DryRun Execution" { + It "Should run Invoke-EdgeHardening in DryRun mode without errors" { + { Invoke-EdgeHardening -DryRun -ErrorAction Stop } | Should -Not -Throw + } + + It "Should run Test-EdgeHardening without errors" { + { Test-EdgeHardening -ErrorAction Stop } | Should -Not -Throw + } + } + + AfterAll { + Remove-Module EdgeHardening -ErrorAction SilentlyContinue + } +} diff --git a/Tests/Integration/Privacy.Integration.Tests.ps1 b/Tests/Integration/Privacy.Integration.Tests.ps1 new file mode 100644 index 0000000..ca7ef4c --- /dev/null +++ b/Tests/Integration/Privacy.Integration.Tests.ps1 @@ -0,0 +1,31 @@ +Describe "Privacy Integration Tests" { + BeforeAll { + $script:ModulePath = Join-Path $PSScriptRoot "..\..\Modules\Privacy" + $script:ManifestPath = Join-Path $script:ModulePath "Privacy.psd1" + } + + Context "Module Structure" { + It "Should have module manifest" { + Test-Path $script:ManifestPath | Should -Be $true + } + + It "Should load module without errors" { + { Import-Module $script:ManifestPath -Force -ErrorAction Stop } | Should -Not -Throw + } + + It "Should export Invoke-PrivacyHardening function" { + $module = Get-Module Privacy + $module.ExportedFunctions.Keys | Should -Contain "Invoke-PrivacyHardening" + } + } + + Context "DryRun Execution" { + It "Should run in DryRun mode with MSRecommended mode without errors" { + { Invoke-PrivacyHardening -Mode "MSRecommended" -DryRun -ErrorAction Stop } | Should -Not -Throw + } + } + + AfterAll { + Remove-Module Privacy -ErrorAction SilentlyContinue + } +} diff --git a/Tests/Integration/SecurityBaseline.Integration.Tests.ps1 b/Tests/Integration/SecurityBaseline.Integration.Tests.ps1 new file mode 100644 index 0000000..466973a --- /dev/null +++ b/Tests/Integration/SecurityBaseline.Integration.Tests.ps1 @@ -0,0 +1,36 @@ +Describe "SecurityBaseline Integration Tests" { + BeforeAll { + $script:ModulePath = Join-Path $PSScriptRoot "..\..\Modules\SecurityBaseline" + $script:ManifestPath = Join-Path $script:ModulePath "SecurityBaseline.psd1" + } + + Context "Module Structure" { + It "Should have module manifest" { + Test-Path $script:ManifestPath | Should -Be $true + } + + It "Should load module without errors" { + { Import-Module $script:ManifestPath -Force -ErrorAction Stop } | Should -Not -Throw + } + + It "Should export Invoke-SecurityBaseline function" { + $module = Get-Module SecurityBaseline + $module.ExportedFunctions.Keys | Should -Contain "Invoke-SecurityBaseline" + } + + It "Should export Restore-SecurityBaseline function" { + $module = Get-Module SecurityBaseline + $module.ExportedFunctions.Keys | Should -Contain "Restore-SecurityBaseline" + } + } + + Context "DryRun Execution" { + It "Should run in DryRun mode without errors" { + { Invoke-SecurityBaseline -DryRun -ErrorAction Stop } | Should -Not -Throw + } + } + + AfterAll { + Remove-Module SecurityBaseline -ErrorAction SilentlyContinue + } +} diff --git a/Tests/Run-AllTests.ps1 b/Tests/Run-AllTests.ps1 new file mode 100644 index 0000000..2fa756a --- /dev/null +++ b/Tests/Run-AllTests.ps1 @@ -0,0 +1,75 @@ +#Requires -Modules Pester + +<# +.SYNOPSIS + Run all Pester tests for NoID Privacy Framework + +.DESCRIPTION + Executes all unit and integration tests and generates a summary report + +.EXAMPLE + .\Run-AllTests.ps1 + +.EXAMPLE + .\Run-AllTests.ps1 -OutputFile TestResults.xml +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $false)] + [string]$OutputFile, + + [Parameter(Mandatory = $false)] + [ValidateSet('None', 'Normal', 'Detailed', 'Diagnostic')] + [string]$OutputLevel = 'Detailed' +) + +$TestsRoot = $PSScriptRoot + +Write-Host "NoID Privacy - Test Suite" -ForegroundColor Cyan +Write-Host "======================================" -ForegroundColor Cyan +Write-Host "" + +# Configure Pester +$pesterConfig = New-PesterConfiguration +$pesterConfig.Run.Path = $TestsRoot +$pesterConfig.Run.PassThru = $true +$pesterConfig.Output.Verbosity = $OutputLevel +$pesterConfig.CodeCoverage.Enabled = $false + +# Add output file if specified +if ($OutputFile) { + $pesterConfig.TestResult.Enabled = $true + $pesterConfig.TestResult.OutputPath = $OutputFile + $pesterConfig.TestResult.OutputFormat = 'NUnitXml' +} + +# Run tests +Write-Host "Running tests..." -ForegroundColor Yellow +Write-Host "" + +$testResults = Invoke-Pester -Configuration $pesterConfig + +# Summary +Write-Host "" +Write-Host "======================================" -ForegroundColor Cyan +Write-Host "TEST SUMMARY" -ForegroundColor Cyan +Write-Host "======================================" -ForegroundColor Cyan +Write-Host "Total Tests: $($testResults.TotalCount)" -ForegroundColor White +Write-Host "Passed: $($testResults.PassedCount)" -ForegroundColor Green +Write-Host "Failed: $($testResults.FailedCount)" -ForegroundColor $(if ($testResults.FailedCount -gt 0) { "Red" } else { "White" }) +Write-Host "Skipped: $($testResults.SkippedCount)" -ForegroundColor Yellow +Write-Host "Duration: $([math]::Round($testResults.Duration.TotalSeconds, 2))s" -ForegroundColor White +Write-Host "" + +if ($OutputFile) { + Write-Host "Test results saved to: $OutputFile" -ForegroundColor Cyan +} + +# Exit with appropriate code +if ($testResults.FailedCount -gt 0) { + exit 1 +} +else { + exit 0 +} diff --git a/Tests/Run-Tests.ps1 b/Tests/Run-Tests.ps1 new file mode 100644 index 0000000..1c55d38 --- /dev/null +++ b/Tests/Run-Tests.ps1 @@ -0,0 +1,159 @@ +<# +.SYNOPSIS + Run all Pester tests for NoID Privacy + +.DESCRIPTION + Executes Pester v5 tests with proper configuration. + Generates test results and code coverage reports. + +.PARAMETER TestType + Type of tests to run (Unit, Integration, Validation, All) + +.PARAMETER OutputFormat + Output format for test results (NUnitXml, JUnitXml, None) + +.PARAMETER CodeCoverage + Enable code coverage analysis + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+, Pester 5.0+ + +.EXAMPLE + .\Run-Tests.ps1 + Run all tests with default settings + +.EXAMPLE + .\Run-Tests.ps1 -TestType Unit -CodeCoverage + Run only unit tests with code coverage +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $false)] + [ValidateSet("Unit", "Integration", "Validation", "All")] + [string]$TestType = "All", + + [Parameter(Mandatory = $false)] + [ValidateSet("NUnitXml", "JUnitXml", "None")] + [string]$OutputFormat = "NUnitXml", + + [Parameter(Mandatory = $false)] + [switch]$CodeCoverage +) + +# Check Pester availability +$pesterModule = Get-Module -Name Pester -ListAvailable | Sort-Object Version -Descending | Select-Object -First 1 + +if ($null -eq $pesterModule -or $pesterModule.Version -lt [Version]"5.0.0") { + Write-Host "ERROR: Pester v5.0+ required. Run Setup-TestEnvironment.ps1 first." -ForegroundColor Red + exit 1 +} + +# Import Pester +Import-Module Pester -MinimumVersion 5.0.0 + +Write-Host "NoID Privacy - Test Runner" -ForegroundColor Cyan +Write-Host "==============================" -ForegroundColor Cyan +Write-Host "Pester Version: $($pesterModule.Version)" -ForegroundColor Gray +Write-Host "" + +# Determine test paths +$testRoot = $PSScriptRoot +$testPaths = @() + +switch ($TestType) { + "Unit" { $testPaths += Join-Path $testRoot "Unit" } + "Integration" { $testPaths += Join-Path $testRoot "Integration" } + "Validation" { $testPaths += Join-Path $testRoot "Validation" } + "All" { + $testPaths += Join-Path $testRoot "Unit" + $testPaths += Join-Path $testRoot "Integration" + $testPaths += Join-Path $testRoot "Validation" + } +} + +# Filter out non-existent paths +$testPaths = $testPaths | Where-Object { Test-Path $_ } + +if ($testPaths.Count -eq 0) { + Write-Host "WARNING: No test files found in: $TestType" -ForegroundColor Yellow + Write-Host "Create test files in Tests/$TestType/*.Tests.ps1" -ForegroundColor Yellow + exit 0 +} + +# Prepare output directory +$resultsPath = Join-Path $testRoot "Results" +if (-not (Test-Path $resultsPath)) { + New-Item -ItemType Directory -Path $resultsPath -Force | Out-Null +} + +$timestamp = Get-Date -Format "yyyyMMdd_HHmmss" +$resultFile = Join-Path $resultsPath "TestResults_$timestamp.xml" + +# Configure Pester +$pesterConfig = New-PesterConfiguration + +# Set test paths +$pesterConfig.Run.Path = $testPaths + +# Output configuration +if ($OutputFormat -ne "None") { + $pesterConfig.TestResult.Enabled = $true + $pesterConfig.TestResult.OutputFormat = $OutputFormat + $pesterConfig.TestResult.OutputPath = $resultFile +} + +# Code coverage configuration +if ($CodeCoverage) { + $pesterConfig.CodeCoverage.Enabled = $true + $pesterConfig.CodeCoverage.Path = @( + (Join-Path (Split-Path $testRoot -Parent) "Core\*.ps1"), + (Join-Path (Split-Path $testRoot -Parent) "Utils\*.ps1"), + (Join-Path (Split-Path $testRoot -Parent) "Modules\*\*.ps1") + ) + $pesterConfig.CodeCoverage.OutputPath = Join-Path $resultsPath "CodeCoverage_$timestamp.xml" +} + +# Output configuration +$pesterConfig.Output.Verbosity = "Detailed" + +# Run tests +Write-Host "Running $TestType tests..." -ForegroundColor Yellow +Write-Host "" + +$testResults = Invoke-Pester -Configuration $pesterConfig + +# Display summary +Write-Host "" +Write-Host "==============================" -ForegroundColor Cyan +Write-Host "Test Summary" -ForegroundColor Cyan +Write-Host "==============================" -ForegroundColor Cyan +Write-Host "Total Tests: $($testResults.TotalCount)" -ForegroundColor White +Write-Host "Passed: $($testResults.PassedCount)" -ForegroundColor Green +Write-Host "Failed: $($testResults.FailedCount)" -ForegroundColor $(if ($testResults.FailedCount -gt 0) { "Red" } else { "White" }) +Write-Host "Skipped: $($testResults.SkippedCount)" -ForegroundColor Yellow +Write-Host "Duration: $($testResults.Duration)" -ForegroundColor White + +if ($OutputFormat -ne "None") { + Write-Host "" + Write-Host "Results saved to: $resultFile" -ForegroundColor Cyan +} + +if ($CodeCoverage) { + Write-Host "" + Write-Host "Code Coverage:" -ForegroundColor Cyan + Write-Host " Analyzed: $($testResults.CodeCoverage.AnalyzedFiles.Count) files" -ForegroundColor White + Write-Host " Coverage: $([math]::Round($testResults.CodeCoverage.CoveragePercent, 2))%" -ForegroundColor $(if ($testResults.CodeCoverage.CoveragePercent -ge 80) { "Green" } else { "Yellow" }) +} + +Write-Host "" + +# Exit code based on test results +if ($testResults.FailedCount -gt 0) { + exit 1 +} +else { + exit 0 +} diff --git a/Tests/Setup-TestEnvironment.ps1 b/Tests/Setup-TestEnvironment.ps1 new file mode 100644 index 0000000..2115d08 --- /dev/null +++ b/Tests/Setup-TestEnvironment.ps1 @@ -0,0 +1,88 @@ +<# +.SYNOPSIS + Setup Pester testing environment for NoID Privacy + +.DESCRIPTION + Installs and configures Pester v5 testing framework. + Creates sample test structure for all modules. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+ + +.EXAMPLE + .\Setup-TestEnvironment.ps1 + Install Pester and setup test structure +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $false)] + [switch]$SkipPesterInstall +) + +Write-Host "NoID Privacy - Test Environment Setup" -ForegroundColor Cyan +Write-Host "=========================================" -ForegroundColor Cyan +Write-Host "" + +# Check PowerShell version +if ($PSVersionTable.PSVersion.Major -lt 5) { + Write-Host "ERROR: PowerShell 5.1 or higher required" -ForegroundColor Red + exit 1 +} + +# Install/Update Pester +if (-not $SkipPesterInstall) { + Write-Host "Checking Pester installation..." -ForegroundColor Yellow + + $pesterModule = Get-Module -Name Pester -ListAvailable | Sort-Object Version -Descending | Select-Object -First 1 + + if ($null -eq $pesterModule -or $pesterModule.Version -lt [Version]"5.0.0") { + Write-Host "Installing Pester v5..." -ForegroundColor Yellow + + try { + Install-Module -Name Pester -Force -SkipPublisherCheck -Scope CurrentUser -MinimumVersion 5.0.0 + Write-Host "[OK] Pester v5 installed successfully" -ForegroundColor Green + } + catch { + Write-Host "[ERROR] Failed to install Pester: $_" -ForegroundColor Red + exit 1 + } + } + else { + Write-Host "[OK] Pester v$($pesterModule.Version) already installed" -ForegroundColor Green + } +} + +# Create test directories +Write-Host "" +Write-Host "Creating test directory structure..." -ForegroundColor Yellow + +$testRoot = $PSScriptRoot +$directories = @( + "Unit", + "Integration", + "Validation", + "Results" +) + +foreach ($dir in $directories) { + $path = Join-Path $testRoot $dir + if (-not (Test-Path -Path $path)) { + New-Item -ItemType Directory -Path $path -Force | Out-Null + Write-Host "[OK] Created: $dir/" -ForegroundColor Green + } + else { + Write-Host "[OK] Exists: $dir/" -ForegroundColor Gray + } +} + +Write-Host "" +Write-Host "Test environment setup complete!" -ForegroundColor Green +Write-Host "" +Write-Host "Next steps:" -ForegroundColor Cyan +Write-Host " 1. Run tests: .\Run-Tests.ps1" -ForegroundColor White +Write-Host " 2. Create module tests in Tests/Unit/" -ForegroundColor White +Write-Host " 3. View results in Tests/Results/" -ForegroundColor White +Write-Host "" diff --git a/Tests/Unit/ASR.Tests.ps1 b/Tests/Unit/ASR.Tests.ps1 new file mode 100644 index 0000000..2f082c3 --- /dev/null +++ b/Tests/Unit/ASR.Tests.ps1 @@ -0,0 +1,171 @@ +<# +.SYNOPSIS + Unit tests for ASR (Attack Surface Reduction) module + +.DESCRIPTION + Pester v5 tests for the ASR module functionality. + Tests return values, DryRun behavior, and backup creation. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: Pester 5.0+ +#> + +BeforeAll { + # Import the module being tested + $modulePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\ASR\ASR.psm1" + + if (Test-Path $modulePath) { + Import-Module $modulePath -Force + } + else { + throw "Module not found: $modulePath" + } + + # Import Core modules for testing + $coreModules = @("Logger.ps1", "Config.ps1", "Validator.ps1", "Rollback.ps1") + $corePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Core" + + foreach ($module in $coreModules) { + $moduleFile = Join-Path $corePath $module + if (Test-Path $moduleFile) { + . $moduleFile + } + } + + # Initialize logging (silent for tests) + if (Get-Command Initialize-Logger -ErrorAction SilentlyContinue) { + Initialize-Logger -EnableConsole $false + } + + # Initialize config + if (Get-Command Initialize-Config -ErrorAction SilentlyContinue) { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "config.json" + Initialize-Config -ConfigPath $configPath + } +} + +Describe "ASR Module" { + + Context "Module Structure" { + + It "Should export Invoke-ASRRules function" { + $command = Get-Command -Name Invoke-ASRRules -ErrorAction SilentlyContinue + $command | Should -Not -BeNullOrEmpty + } + + It "Should have correct function type" { + $command = Get-Command -Name Invoke-ASRRules + $command.CommandType | Should -Be 'Function' + } + + It "Should have CmdletBinding attribute" { + $command = Get-Command -Name Invoke-ASRRules + $command.CmdletBinding | Should -Be $true + } + } + + Context "Function Parameters" { + + It "Should have DryRun parameter" { + $command = Get-Command -Name Invoke-ASRRules + $command.Parameters.ContainsKey('DryRun') | Should -Be $true + } + + It "DryRun parameter should be a switch" { + $command = Get-Command -Name Invoke-ASRRules + $command.Parameters['DryRun'].ParameterType.Name | Should -Be 'SwitchParameter' + } + + It "Should have Force parameter" { + $command = Get-Command -Name Invoke-ASRRules + $command.Parameters.ContainsKey('Force') | Should -Be $true + } + } + + Context "Function Execution - DryRun Mode" { + + It "Should execute without errors in DryRun mode" { + { Invoke-ASRRules -DryRun } | Should -Not -Throw + } + + It "Should return a PSCustomObject" { + $result = Invoke-ASRRules -DryRun + $result | Should -BeOfType [PSCustomObject] + } + + It "Should have Success property" { + $result = Invoke-ASRRules -DryRun + $result.PSObject.Properties.Name | Should -Contain 'Success' + } + + It "Should have RulesApplied property" { + $result = Invoke-ASRRules -DryRun + $result.PSObject.Properties.Name | Should -Contain 'RulesApplied' + } + + It "Should not apply changes in DryRun mode" { + $result = Invoke-ASRRules -DryRun + $result.RulesApplied | Should -Be 0 + } + } + + Context "Return Object Structure" { + + It "Should return object with all required properties" { + $result = Invoke-ASRRules -DryRun + + $requiredProperties = @( + 'Success', + 'RulesApplied', + 'Errors', + 'Warnings', + 'Duration' + ) + + foreach ($prop in $requiredProperties) { + $result.PSObject.Properties.Name | Should -Contain $prop + } + } + + It "Errors should be an array" { + $result = Invoke-ASRRules -DryRun + $result.Errors -is [Array] | Should -Be $true + } + + It "Warnings should be an array" { + $result = Invoke-ASRRules -DryRun + $result.Warnings -is [Array] | Should -Be $true + } + + It "Duration should be a TimeSpan" { + $result = Invoke-ASRRules -DryRun + $result.Duration | Should -BeOfType [TimeSpan] + } + } + + Context "ASR Rules Configuration" { + + It "Should load ASR rules from JSON" { + $rulesPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\ASR\Config\ASR-Rules.json" + $rulesPath | Should -Exist + } + + It "ASR rules file should be valid JSON" { + $rulesPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\ASR\Config\ASR-Rules.json" + { Get-Content $rulesPath -Raw | ConvertFrom-Json } | Should -Not -Throw + } + + It "Should have 19 ASR rules" { + $rulesPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\ASR\Config\ASR-Rules.json" + $rules = Get-Content $rulesPath -Raw | ConvertFrom-Json + $rules.Count | Should -Be 19 + } + } +} + +AfterAll { + # Clean up + Remove-Module ASR -Force -ErrorAction SilentlyContinue +} diff --git a/Tests/Unit/AdvancedSecurity.Tests.ps1 b/Tests/Unit/AdvancedSecurity.Tests.ps1 new file mode 100644 index 0000000..d4f036e --- /dev/null +++ b/Tests/Unit/AdvancedSecurity.Tests.ps1 @@ -0,0 +1,197 @@ +<# +.SYNOPSIS + Unit tests for AdvancedSecurity module + +.DESCRIPTION + Pester v5 tests for the AdvancedSecurity module functionality. + Tests return values, DryRun behavior, profile handling, and configuration. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: Pester 5.0+ +#> + +BeforeAll { + # Import the module being tested + $modulePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\AdvancedSecurity\AdvancedSecurity.psm1" + + if (Test-Path $modulePath) { + Import-Module $modulePath -Force + } + else { + throw "Module not found: $modulePath" + } + + # Import Core modules for testing + $coreModules = @("Logger.ps1", "Config.ps1", "Validator.ps1", "Rollback.ps1") + $corePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Core" + + foreach ($module in $coreModules) { + $moduleFile = Join-Path $corePath $module + if (Test-Path $moduleFile) { + . $moduleFile + } + } + + # Import Utils modules + $utilsModules = @("Registry.ps1", "Service.ps1") + $utilsPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Utils" + + foreach ($module in $utilsModules) { + $moduleFile = Join-Path $utilsPath $module + if (Test-Path $moduleFile) { + . $moduleFile + } + } + + # Initialize logging (silent for tests) + if (Get-Command Initialize-Logger -ErrorAction SilentlyContinue) { + Initialize-Logger -EnableConsole $false + } + + # Initialize config + if (Get-Command Initialize-Config -ErrorAction SilentlyContinue) { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "config.json" + Initialize-Config -ConfigPath $configPath + } +} + +Describe "AdvancedSecurity Module" { + + Context "Module Structure" { + + It "Should export Invoke-AdvancedSecurity function" { + $command = Get-Command -Name Invoke-AdvancedSecurity -ErrorAction SilentlyContinue + $command | Should -Not -BeNullOrEmpty + } + + It "Should export Test-AdvancedSecurity function" { + $command = Get-Command -Name Test-AdvancedSecurity -ErrorAction SilentlyContinue + $command | Should -Not -BeNullOrEmpty + } + + It "Should have correct function type" { + $command = Get-Command -Name Invoke-AdvancedSecurity + $command.CommandType | Should -Be 'Function' + } + + It "Should have CmdletBinding attribute" { + $command = Get-Command -Name Invoke-AdvancedSecurity + $command.CmdletBinding | Should -Be $true + } + } + + Context "Function Parameters" { + + It "Should have SecurityProfile parameter" { + $command = Get-Command -Name Invoke-AdvancedSecurity + $command.Parameters.ContainsKey('SecurityProfile') | Should -Be $true + } + + It "Should have DryRun parameter" { + $command = Get-Command -Name Invoke-AdvancedSecurity + $command.Parameters.ContainsKey('DryRun') | Should -Be $true + } + + It "DryRun parameter should be a switch" { + $command = Get-Command -Name Invoke-AdvancedSecurity + $command.Parameters['DryRun'].ParameterType.Name | Should -Be 'SwitchParameter' + } + + It "Should have DisableRDP parameter" { + $command = Get-Command -Name Invoke-AdvancedSecurity + $command.Parameters.ContainsKey('DisableRDP') | Should -Be $true + } + + It "Should have BlockUPnP parameter" { + $command = Get-Command -Name Invoke-AdvancedSecurity + $command.Parameters.ContainsKey('BlockUPnP') | Should -Be $true + } + + It "Should have DisableAdminShares parameter" { + $command = Get-Command -Name Invoke-AdvancedSecurity + $command.Parameters.ContainsKey('DisableAdminShares') | Should -Be $true + } + } + + Context "Configuration" { + + It "SRP-Rules.json should exist" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\AdvancedSecurity\Config\SRP-Rules.json" + Test-Path $configPath | Should -Be $true + } + + It "SRP-Rules.json should be valid JSON" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\AdvancedSecurity\Config\SRP-Rules.json" + { Get-Content $configPath -Raw | ConvertFrom-Json } | Should -Not -Throw + } + + It "WindowsUpdate.json should exist" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\AdvancedSecurity\Config\WindowsUpdate.json" + Test-Path $configPath | Should -Be $true + } + + It "WindowsUpdate.json should be valid JSON" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\AdvancedSecurity\Config\WindowsUpdate.json" + { Get-Content $configPath -Raw | ConvertFrom-Json } | Should -Not -Throw + } + } + + Context "Security Profiles" { + + It "Should accept Balanced profile" { + { Invoke-AdvancedSecurity -SecurityProfile "Balanced" -DryRun -ErrorAction Stop } | Should -Not -Throw + } + + It "Should accept Enterprise profile" { + { Invoke-AdvancedSecurity -SecurityProfile "Enterprise" -DryRun -ErrorAction Stop } | Should -Not -Throw + } + + It "Should accept Maximum profile" { + { Invoke-AdvancedSecurity -SecurityProfile "Maximum" -DryRun -ErrorAction Stop } | Should -Not -Throw + } + } + + Context "DryRun Behavior" { + + It "Should accept DryRun parameter without errors" { + { Invoke-AdvancedSecurity -DryRun -ErrorAction Stop } | Should -Not -Throw + } + + It "Should not modify system in DryRun mode" { + # This test verifies that DryRun mode doesn't write to registry/services + # We can't easily test this without admin rights, but we can verify the function runs + Invoke-AdvancedSecurity -DryRun -ErrorAction SilentlyContinue + # Function should complete without errors + $? | Should -Be $true + } + } + + Context "Test-AdvancedSecurity Function" { + + It "Should run Test-AdvancedSecurity without errors" { + { Test-AdvancedSecurity -ErrorAction Stop } | Should -Not -Throw + } + + It "Should return compliance results" { + $result = Test-AdvancedSecurity -ErrorAction SilentlyContinue + $result | Should -Not -BeNullOrEmpty + } + + It "Compliance results should have expected properties" { + $result = Test-AdvancedSecurity -ErrorAction SilentlyContinue + if ($result) { + $result | Should -HaveProperty TotalTests + $result | Should -HaveProperty CompliantCount + $result | Should -HaveProperty NonCompliantCount + $result | Should -HaveProperty CompliancePercent + } + } + } +} + +AfterAll { + # Cleanup + Remove-Module AdvancedSecurity -ErrorAction SilentlyContinue +} diff --git a/Tests/Unit/AntiAI.Tests.ps1 b/Tests/Unit/AntiAI.Tests.ps1 new file mode 100644 index 0000000..29316dc --- /dev/null +++ b/Tests/Unit/AntiAI.Tests.ps1 @@ -0,0 +1,267 @@ +<# +.SYNOPSIS + Unit tests for AntiAI module + +.DESCRIPTION + Pester v5 tests for the AntiAI module functionality. + Tests return values, DryRun behavior, and compliance verification. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: Pester 5.0+ +#> + +BeforeAll { + # Import the module being tested + $modulePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\AntiAI\AntiAI.psm1" + + if (Test-Path $modulePath) { + Import-Module $modulePath -Force + } + else { + throw "Module not found: $modulePath" + } + + # Import Core modules for testing + $coreModules = @("Logger.ps1", "Config.ps1", "Validator.ps1", "Rollback.ps1") + $corePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Core" + + foreach ($module in $coreModules) { + $moduleFile = Join-Path $corePath $module + if (Test-Path $moduleFile) { + . $moduleFile + } + } + + # Import Utils + $utilsModules = @("Registry.ps1", "Service.ps1") + $utilsPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Utils" + + foreach ($module in $utilsModules) { + $moduleFile = Join-Path $utilsPath $module + if (Test-Path $moduleFile) { + . $moduleFile + } + } + + # Initialize logging (silent for tests) + if (Get-Command Initialize-Logger -ErrorAction SilentlyContinue) { + Initialize-Logger -EnableConsole $false + } + + # Initialize config + if (Get-Command Initialize-Config -ErrorAction SilentlyContinue) { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "config.json" + Initialize-Config -ConfigPath $configPath + } + + # Initialize backup system + if (Get-Command Initialize-BackupSystem -ErrorAction SilentlyContinue) { + Initialize-BackupSystem + } +} + +Describe "AntiAI Module" { + + Context "Module Structure" { + + It "Should export Invoke-AntiAI function" { + $command = Get-Command -Name Invoke-AntiAI -ErrorAction SilentlyContinue + $command | Should -Not -BeNullOrEmpty + } + + It "Should export Test-AntiAICompliance function" { + $command = Get-Command -Name Test-AntiAICompliance -ErrorAction SilentlyContinue + $command | Should -Not -BeNullOrEmpty + } + + It "Should have CmdletBinding attribute" { + $command = Get-Command -Name Invoke-AntiAI + $command.CmdletBinding | Should -Be $true + } + } + + Context "Function Parameters" { + + It "Should have DryRun parameter" { + $command = Get-Command -Name Invoke-AntiAI + $command.Parameters.ContainsKey('DryRun') | Should -Be $true + } + + It "DryRun parameter should be a switch" { + $command = Get-Command -Name Invoke-AntiAI + $command.Parameters['DryRun'].ParameterType.Name | Should -Be 'SwitchParameter' + } + + It "Should have Force parameter" { + $command = Get-Command -Name Invoke-AntiAI + $command.Parameters.ContainsKey('Force') | Should -Be $true + } + } + + Context "AntiAI Configuration" { + + It "Should load AntiAI settings from JSON" { + $settingsPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\AntiAI\Config\AntiAI-Settings.json" + $settingsPath | Should -Exist + } + + It "Settings file should be valid JSON" { + $settingsPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\AntiAI\Config\AntiAI-Settings.json" + { Get-Content $settingsPath -Raw | ConvertFrom-Json } | Should -Not -Throw + } + + It "Settings should have all AI feature sections" { + $settingsPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\AntiAI\Config\AntiAI-Settings.json" + $settings = Get-Content $settingsPath -Raw | ConvertFrom-Json + + $requiredSections = @( + 'systemAIModels', + 'recall', + 'recallProtection', + 'copilot', + 'clickToDo', + 'notepadAI', + 'paintAI', + 'settingsAgent' + ) + + foreach ($section in $requiredSections) { + $settings.PSObject.Properties.Name | Should -Contain $section + } + } + } + + Context "Function Execution - DryRun Mode" { + + It "Should execute without errors in DryRun mode" { + { Invoke-AntiAI -DryRun -Force } | Should -Not -Throw + } + + It "Should return a PSCustomObject" { + $result = Invoke-AntiAI -DryRun -Force + $result | Should -BeOfType [PSCustomObject] + } + + It "Should have Success property" { + $result = Invoke-AntiAI -DryRun -Force + $result.PSObject.Properties.Name | Should -Contain 'Success' + } + + It "Should have FeaturesDisabled property" { + $result = Invoke-AntiAI -DryRun -Force + $result.PSObject.Properties.Name | Should -Contain 'FeaturesDisabled' + } + + It "Should not apply changes in DryRun mode" { + $result = Invoke-AntiAI -DryRun -Force + # In DryRun, FeaturesDisabled should be 0 + $result.FeaturesDisabled | Should -Be 0 + } + } + + Context "Return Object Structure" { + + It "Should return object with all required properties" { + $result = Invoke-AntiAI -DryRun -Force + + $requiredProperties = @( + 'Success', + 'FeaturesDisabled', + 'TotalFeatures', + 'Errors', + 'Warnings', + 'Duration' + ) + + foreach ($prop in $requiredProperties) { + $result.PSObject.Properties.Name | Should -Contain $prop + } + } + + It "Errors should be an array" { + $result = Invoke-AntiAI -DryRun -Force + $result.Errors -is [Array] | Should -Be $true + } + + It "Warnings should be an array" { + $result = Invoke-AntiAI -DryRun -Force + $result.Warnings -is [Array] | Should -Be $true + } + + It "Duration should be a TimeSpan" { + $result = Invoke-AntiAI -DryRun -Force + $result.Duration | Should -BeOfType [TimeSpan] + } + + It "TotalFeatures should be 9" { + $result = Invoke-AntiAI -DryRun -Force + $result.TotalFeatures | Should -Be 9 + } + } + + Context "Compliance Testing" { + + It "Test-AntiAICompliance should execute without errors" { + { Test-AntiAICompliance } | Should -Not -Throw + } + + It "Test-AntiAICompliance should return PSCustomObject" { + $result = Test-AntiAICompliance + $result | Should -BeOfType [PSCustomObject] + } + + It "Compliance result should have Compliant property" { + $result = Test-AntiAICompliance + $result.PSObject.Properties.Name | Should -Contain 'Compliant' + } + + It "Compliance result should have TotalChecks property" { + $result = Test-AntiAICompliance + $result.PSObject.Properties.Name | Should -Contain 'TotalChecks' + } + + It "Compliance result should have PassedChecks property" { + $result = Test-AntiAICompliance + $result.PSObject.Properties.Name | Should -Contain 'PassedChecks' + } + + It "Should have 14 total checks" { + $result = Test-AntiAICompliance + $result.TotalChecks | Should -Be 14 + } + } + + Context "AI Features Coverage" { + + It "Should cover Recall disabling" { + $settingsPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\AntiAI\Config\AntiAI-Settings.json" + $settings = Get-Content $settingsPath -Raw | ConvertFrom-Json + $settings.recall.enabled | Should -Be $false + } + + It "Should cover Copilot disabling" { + $settingsPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\AntiAI\Config\AntiAI-Settings.json" + $settings = Get-Content $settingsPath -Raw | ConvertFrom-Json + $settings.copilot.enabled | Should -Be $false + } + + It "Should cover Notepad AI disabling" { + $settingsPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\AntiAI\Config\AntiAI-Settings.json" + $settings = Get-Content $settingsPath -Raw | ConvertFrom-Json + $settings.notepadAI.enabled | Should -Be $false + } + + It "Should cover Paint AI disabling" { + $settingsPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\AntiAI\Config\AntiAI-Settings.json" + $settings = Get-Content $settingsPath -Raw | ConvertFrom-Json + $settings.paintAI.enabled | Should -Be $false + } + } +} + +AfterAll { + # Clean up + Remove-Module AntiAI -Force -ErrorAction SilentlyContinue +} diff --git a/Tests/Unit/DNS.Tests.ps1 b/Tests/Unit/DNS.Tests.ps1 new file mode 100644 index 0000000..7458ede --- /dev/null +++ b/Tests/Unit/DNS.Tests.ps1 @@ -0,0 +1,224 @@ +<# +.SYNOPSIS + Unit tests for DNS module + +.DESCRIPTION + Pester v5 tests for the DNS module functionality. + Tests return values, DryRun behavior, provider configuration, and backup creation. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: Pester 5.0+ +#> + +BeforeAll { + # Import the module being tested + $modulePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\DNS\DNS.psm1" + + if (Test-Path $modulePath) { + Import-Module $modulePath -Force + } + else { + throw "Module not found: $modulePath" + } + + # Import Core modules for testing + $coreModules = @("Logger.ps1", "Config.ps1", "Validator.ps1", "Rollback.ps1") + $corePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Core" + + foreach ($module in $coreModules) { + $moduleFile = Join-Path $corePath $module + if (Test-Path $moduleFile) { + . $moduleFile + } + } + + # Initialize logging (silent for tests) + if (Get-Command Initialize-Logger -ErrorAction SilentlyContinue) { + Initialize-Logger -EnableConsole $false + } + + # Initialize config + if (Get-Command Initialize-Config -ErrorAction SilentlyContinue) { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "config.json" + Initialize-Config -ConfigPath $configPath + } + + # Initialize backup system + if (Get-Command Initialize-BackupSystem -ErrorAction SilentlyContinue) { + Initialize-BackupSystem + } +} + +Describe "DNS Module" { + + Context "Module Structure" { + + It "Should export Invoke-DNSConfiguration function" { + $command = Get-Command -Name Invoke-DNSConfiguration -ErrorAction SilentlyContinue + $command | Should -Not -BeNullOrEmpty + } + + It "Should export Get-DNSStatus function" { + $command = Get-Command -Name Get-DNSStatus -ErrorAction SilentlyContinue + $command | Should -Not -BeNullOrEmpty + } + + It "Should have CmdletBinding attribute" { + $command = Get-Command -Name Invoke-DNSConfiguration + $command.CmdletBinding | Should -Be $true + } + } + + Context "Function Parameters" { + + It "Should have Provider parameter" { + $command = Get-Command -Name Invoke-DNSConfiguration + $command.Parameters.ContainsKey('Provider') | Should -Be $true + } + + It "Provider parameter should accept specific values" { + $command = Get-Command -Name Invoke-DNSConfiguration + $validateSet = $command.Parameters['Provider'].Attributes | Where-Object { $_ -is [System.Management.Automation.ValidateSetAttribute] } + $validateSet.ValidValues | Should -Contain 'Cloudflare' + $validateSet.ValidValues | Should -Contain 'Quad9' + $validateSet.ValidValues | Should -Contain 'AdGuard' + } + + It "Should have DryRun parameter" { + $command = Get-Command -Name Invoke-DNSConfiguration + $command.Parameters.ContainsKey('DryRun') | Should -Be $true + } + + It "Should have Force parameter" { + $command = Get-Command -Name Invoke-DNSConfiguration + $command.Parameters.ContainsKey('Force') | Should -Be $true + } + } + + Context "DNS Providers Configuration" { + + It "Should load DNS providers from JSON" { + $providersPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\DNS\Config\Providers.json" + $providersPath | Should -Exist + } + + It "Providers file should be valid JSON" { + $providersPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\DNS\Config\Providers.json" + { Get-Content $providersPath -Raw | ConvertFrom-Json } | Should -Not -Throw + } + + It "Should have Cloudflare provider" { + $providersPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\DNS\Config\Providers.json" + $providersData = Get-Content $providersPath -Raw | ConvertFrom-Json + $providersData.providers.PSObject.Properties.Name | Should -Contain 'cloudflare' + } + + It "Should have Quad9 provider" { + $providersPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\DNS\Config\Providers.json" + $providersData = Get-Content $providersPath -Raw | ConvertFrom-Json + $providersData.providers.PSObject.Properties.Name | Should -Contain 'quad9' + } + + It "Should have AdGuard provider" { + $providersPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\DNS\Config\Providers.json" + $providersData = Get-Content $providersPath -Raw | ConvertFrom-Json + $providersData.providers.PSObject.Properties.Name | Should -Contain 'adguard' + } + + It "Cloudflare should have DoH template" { + $providersPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\DNS\Config\Providers.json" + $providersData = Get-Content $providersPath -Raw | ConvertFrom-Json + $providersData.providers.cloudflare.doh.template | Should -Not -BeNullOrEmpty + } + } + + Context "Function Execution - DryRun Mode" { + + It "Should execute without errors in DryRun mode with provider" { + { Invoke-DNSConfiguration -Provider 'Cloudflare' -DryRun -Force } | Should -Not -Throw + } + + It "Should return a PSCustomObject" { + $result = Invoke-DNSConfiguration -Provider 'Cloudflare' -DryRun -Force + $result | Should -BeOfType [PSCustomObject] + } + + It "Should have Success property" { + $result = Invoke-DNSConfiguration -Provider 'Cloudflare' -DryRun -Force + $result.PSObject.Properties.Name | Should -Contain 'Success' + } + + It "Should have Provider property" { + $result = Invoke-DNSConfiguration -Provider 'Cloudflare' -DryRun -Force + $result.PSObject.Properties.Name | Should -Contain 'Provider' + } + + It "Provider property should match requested provider" { + $result = Invoke-DNSConfiguration -Provider 'Quad9' -DryRun -Force + $result.Provider | Should -Be 'Quad9' + } + } + + Context "Return Object Structure" { + + It "Should return object with all required properties" { + $result = Invoke-DNSConfiguration -Provider 'Cloudflare' -DryRun -Force + + $requiredProperties = @( + 'Success', + 'Provider', + 'AdaptersConfigured', + 'Errors', + 'Warnings', + 'Duration' + ) + + foreach ($prop in $requiredProperties) { + $result.PSObject.Properties.Name | Should -Contain $prop + } + } + + It "Errors should be an array" { + $result = Invoke-DNSConfiguration -Provider 'Cloudflare' -DryRun -Force + $result.Errors -is [Array] | Should -Be $true + } + + It "Warnings should be an array" { + $result = Invoke-DNSConfiguration -Provider 'Cloudflare' -DryRun -Force + $result.Warnings -is [Array] | Should -Be $true + } + } + + Context "DoH Policy Settings" { + + It "Set-DoHPolicy should use correct registry values" { + # This is a mock test - actual policy setting requires admin rights + # We're just checking the function exists and has correct documentation + $functionContent = Get-Content (Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\DNS\Private\Set-DoHPolicy.ps1") -Raw + $functionContent | Should -Match "DoHPolicy = 3" + $functionContent | Should -Match "REQUIRE" + } + } +} + +Describe "DNS Helper Functions" { + + Context "Get-DNSStatus" { + + It "Should execute without errors" { + { Get-DNSStatus } | Should -Not -Throw + } + + It "Should return a PSCustomObject" { + $result = Get-DNSStatus + $result | Should -BeOfType [PSCustomObject] + } + } +} + +AfterAll { + # Clean up + Remove-Module DNS -Force -ErrorAction SilentlyContinue +} diff --git a/Tests/Unit/EdgeHardening.Tests.ps1 b/Tests/Unit/EdgeHardening.Tests.ps1 new file mode 100644 index 0000000..c340107 --- /dev/null +++ b/Tests/Unit/EdgeHardening.Tests.ps1 @@ -0,0 +1,171 @@ +<# +.SYNOPSIS + Unit tests for EdgeHardening module + +.DESCRIPTION + Pester v5 tests for the EdgeHardening module functionality. + Tests return values, DryRun behavior, and configuration handling. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: Pester 5.0+ +#> + +BeforeAll { + # Import the module being tested + $modulePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\EdgeHardening\EdgeHardening.psm1" + + if (Test-Path $modulePath) { + Import-Module $modulePath -Force + } + else { + throw "Module not found: $modulePath" + } + + # Import Core modules for testing + $coreModules = @("Logger.ps1", "Config.ps1", "Validator.ps1", "Rollback.ps1") + $corePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Core" + + foreach ($module in $coreModules) { + $moduleFile = Join-Path $corePath $module + if (Test-Path $moduleFile) { + . $moduleFile + } + } + + # Import Utils modules + $utilsModules = @("Registry.ps1") + $utilsPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Utils" + + foreach ($module in $utilsModules) { + $moduleFile = Join-Path $utilsPath $module + if (Test-Path $moduleFile) { + . $moduleFile + } + } + + # Initialize logging (silent for tests) + if (Get-Command Initialize-Logger -ErrorAction SilentlyContinue) { + Initialize-Logger -EnableConsole $false + } + + # Initialize config + if (Get-Command Initialize-Config -ErrorAction SilentlyContinue) { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "config.json" + Initialize-Config -ConfigPath $configPath + } +} + +Describe "EdgeHardening Module" { + + Context "Module Structure" { + + It "Should export Invoke-EdgeHardening function" { + $command = Get-Command -Name Invoke-EdgeHardening -ErrorAction SilentlyContinue + $command | Should -Not -BeNullOrEmpty + } + + It "Should export Test-EdgeHardening function" { + $command = Get-Command -Name Test-EdgeHardening -ErrorAction SilentlyContinue + $command | Should -Not -BeNullOrEmpty + } + + It "Should have correct function type" { + $command = Get-Command -Name Invoke-EdgeHardening + $command.CommandType | Should -Be 'Function' + } + + It "Should have CmdletBinding attribute" { + $command = Get-Command -Name Invoke-EdgeHardening + $command.CmdletBinding | Should -Be $true + } + } + + Context "Function Parameters" { + + It "Should have DryRun parameter" { + $command = Get-Command -Name Invoke-EdgeHardening + $command.Parameters.ContainsKey('DryRun') | Should -Be $true + } + + It "DryRun parameter should be a switch" { + $command = Get-Command -Name Invoke-EdgeHardening + $command.Parameters['DryRun'].ParameterType.Name | Should -Be 'SwitchParameter' + } + + It "Should have AllowExtensions parameter" { + $command = Get-Command -Name Invoke-EdgeHardening + $command.Parameters.ContainsKey('AllowExtensions') | Should -Be $true + } + + It "AllowExtensions parameter should be a switch" { + $command = Get-Command -Name Invoke-EdgeHardening + $command.Parameters['AllowExtensions'].ParameterType.Name | Should -Be 'SwitchParameter' + } + } + + Context "Configuration" { + + It "EdgePolicies.json should exist" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\EdgeHardening\Config\EdgePolicies.json" + Test-Path $configPath | Should -Be $true + } + + It "EdgePolicies.json should be valid JSON" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\EdgeHardening\Config\EdgePolicies.json" + { Get-Content $configPath -Raw | ConvertFrom-Json } | Should -Not -Throw + } + + It "EdgePolicies.json should contain policies" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\EdgeHardening\Config\EdgePolicies.json" + $config = Get-Content $configPath -Raw | ConvertFrom-Json + $config.Policies | Should -Not -BeNullOrEmpty + $config.Policies.Count | Should -BeGreaterThan 0 + } + + It "All policies should have required properties" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\EdgeHardening\Config\EdgePolicies.json" + $config = Get-Content $configPath -Raw | ConvertFrom-Json + + foreach ($policy in $config.Policies) { + $policy.Name | Should -Not -BeNullOrEmpty + $policy.Path | Should -Not -BeNullOrEmpty + $policy.Value | Should -Not -BeNull + $policy.Type | Should -Not -BeNullOrEmpty + } + } + } + + Context "DryRun Behavior" { + + It "Should accept DryRun parameter without errors" { + { Invoke-EdgeHardening -DryRun -ErrorAction Stop } | Should -Not -Throw + } + + It "Should not modify system in DryRun mode" { + # This test verifies that DryRun mode doesn't write to registry + # We can't easily test this without admin rights, but we can verify the function runs + Invoke-EdgeHardening -DryRun -AllowExtensions -ErrorAction SilentlyContinue + # Function should complete without errors + $? | Should -Be $true + } + } + + Context "Test-EdgeHardening Function" { + + It "Should run Test-EdgeHardening without errors" { + { Test-EdgeHardening -ErrorAction Stop } | Should -Not -Throw + } + + It "Should return compliance results" { + $result = Test-EdgeHardening -ErrorAction SilentlyContinue + $result | Should -Not -BeNullOrEmpty + } + } +} + +AfterAll { + # Cleanup + Remove-Module EdgeHardening -ErrorAction SilentlyContinue +} diff --git a/Tests/Unit/ModuleTemplate.Tests.ps1 b/Tests/Unit/ModuleTemplate.Tests.ps1 new file mode 100644 index 0000000..28a3000 --- /dev/null +++ b/Tests/Unit/ModuleTemplate.Tests.ps1 @@ -0,0 +1,177 @@ +<# +.SYNOPSIS + Unit tests for ModuleTemplate module + +.DESCRIPTION + Pester v5 tests demonstrating module testing best practices. + All test files must end with .Tests.ps1 + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: Pester 5.0+ +#> + +BeforeAll { + # Import the module being tested + $modulePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\_ModuleTemplate\ModuleTemplate.psm1" + + if (Test-Path $modulePath) { + Import-Module $modulePath -Force + } + else { + throw "Module not found: $modulePath" + } + + # Import Core modules for testing + $coreModules = @("Logger.ps1", "Config.ps1", "Validator.ps1", "Rollback.ps1") + $corePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Core" + + foreach ($module in $coreModules) { + $moduleFile = Join-Path $corePath $module + if (Test-Path $moduleFile) { + . $moduleFile + } + } + + # Import Utils + $utilsModules = @("Registry.ps1", "Service.ps1", "Hardware.ps1", "GPO.ps1") + $utilsPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Utils" + + foreach ($module in $utilsModules) { + $moduleFile = Join-Path $utilsPath $module + if (Test-Path $moduleFile) { + . $moduleFile + } + } +} + +Describe "ModuleTemplate Module" { + + Context "Module Structure" { + + It "Should export Invoke-ModuleTemplate function" { + $command = Get-Command -Name Invoke-ModuleTemplate -ErrorAction SilentlyContinue + $command | Should -Not -BeNullOrEmpty + } + + It "Should have correct function type" { + $command = Get-Command -Name Invoke-ModuleTemplate + $command.CommandType | Should -Be 'Function' + } + + It "Should have CmdletBinding attribute" { + $command = Get-Command -Name Invoke-ModuleTemplate + $command.CmdletBinding | Should -Be $true + } + } + + Context "Function Parameters" { + + It "Should have DryRun parameter" { + $command = Get-Command -Name Invoke-ModuleTemplate + $command.Parameters.ContainsKey('DryRun') | Should -Be $true + } + + It "DryRun parameter should be a switch" { + $command = Get-Command -Name Invoke-ModuleTemplate + $command.Parameters['DryRun'].ParameterType.Name | Should -Be 'SwitchParameter' + } + + It "Should have SkipBackup parameter" { + $command = Get-Command -Name Invoke-ModuleTemplate + $command.Parameters.ContainsKey('SkipBackup') | Should -Be $true + } + + It "Should have SkipVerify parameter" { + $command = Get-Command -Name Invoke-ModuleTemplate + $command.Parameters.ContainsKey('SkipVerify') | Should -Be $true + } + } + + Context "Function Execution - DryRun Mode" { + + BeforeAll { + # Initialize required systems for testing + if (Get-Command Initialize-Logger -ErrorAction SilentlyContinue) { + Initialize-Logger -EnableConsole $false + } + } + + It "Should execute without errors in DryRun mode" { + { Invoke-ModuleTemplate -DryRun } | Should -Not -Throw + } + + It "Should return a PSCustomObject" { + $result = Invoke-ModuleTemplate -DryRun + $result | Should -BeOfType [PSCustomObject] + } + + It "Should have ModuleName property" { + $result = Invoke-ModuleTemplate -DryRun + $result.ModuleName | Should -Be "ModuleTemplate" + } + + It "Should have Success property" { + $result = Invoke-ModuleTemplate -DryRun + $result.PSObject.Properties.Name | Should -Contain 'Success' + } + + It "Should have ChangesApplied property" { + $result = Invoke-ModuleTemplate -DryRun + $result.PSObject.Properties.Name | Should -Contain 'ChangesApplied' + } + + It "Should not apply changes in DryRun mode" { + $result = Invoke-ModuleTemplate -DryRun + $result.ChangesApplied | Should -Be 0 + } + } + + Context "Return Object Structure" { + + It "Should return object with all required properties" { + $result = Invoke-ModuleTemplate -DryRun + + $requiredProperties = @( + 'ModuleName', + 'Success', + 'ChangesApplied', + 'Errors', + 'Warnings', + 'BackupCreated', + 'VerificationPassed' + ) + + foreach ($prop in $requiredProperties) { + $result.PSObject.Properties.Name | Should -Contain $prop + } + } + + It "Errors should be an array" { + $result = Invoke-ModuleTemplate -DryRun + $result.Errors | Should -BeOfType [System.Object[]] + } + + It "Warnings should be an array" { + $result = Invoke-ModuleTemplate -DryRun + $result.Warnings | Should -BeOfType [System.Object[]] + } + } +} + +Describe "ModuleTemplate Helper Functions" { + + Context "Private Functions" { + + It "Private functions should not be exported" { + $exportedCommands = Get-Command -Module ModuleTemplate + $exportedCommands.Name | Should -Not -Contain 'Test-TemplateRequirements' + } + } +} + +AfterAll { + # Clean up + Remove-Module ModuleTemplate -Force -ErrorAction SilentlyContinue +} diff --git a/Tests/Unit/Privacy.Tests.ps1 b/Tests/Unit/Privacy.Tests.ps1 new file mode 100644 index 0000000..290fc20 --- /dev/null +++ b/Tests/Unit/Privacy.Tests.ps1 @@ -0,0 +1,243 @@ +<# +.SYNOPSIS + Unit tests for Privacy module + +.DESCRIPTION + Pester v5 tests for the Privacy module functionality. + Tests return values, DryRun behavior, mode selection, and compliance. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: Pester 5.0+ +#> + +BeforeAll { + # Import the module being tested + $modulePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\Privacy\Privacy.psm1" + + if (Test-Path $modulePath) { + Import-Module $modulePath -Force + } + else { + throw "Module not found: $modulePath" + } + + # Import Core modules for testing + $coreModules = @("Logger.ps1", "Config.ps1", "Validator.ps1", "Rollback.ps1") + $corePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Core" + + foreach ($module in $coreModules) { + $moduleFile = Join-Path $corePath $module + if (Test-Path $moduleFile) { + . $moduleFile + } + } + + # Import Utils + $utilsModules = @("Registry.ps1", "Service.ps1") + $utilsPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Utils" + + foreach ($module in $utilsModules) { + $moduleFile = Join-Path $utilsPath $module + if (Test-Path $moduleFile) { + . $moduleFile + } + } + + # Initialize logging (silent for tests) + if (Get-Command Initialize-Logger -ErrorAction SilentlyContinue) { + Initialize-Logger -EnableConsole $false + } + + # Initialize config + if (Get-Command Initialize-Config -ErrorAction SilentlyContinue) { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "config.json" + Initialize-Config -ConfigPath $configPath + } + + # Initialize backup system + if (Get-Command Initialize-BackupSystem -ErrorAction SilentlyContinue) { + Initialize-BackupSystem + } +} + +Describe "Privacy Module" { + + Context "Module Structure" { + + It "Should export Invoke-PrivacyHardening function" { + $command = Get-Command -Name Invoke-PrivacyHardening -ErrorAction SilentlyContinue + $command | Should -Not -BeNullOrEmpty + } + + It "Should export Test-PrivacyCompliance function" { + $command = Get-Command -Name Test-PrivacyCompliance -ErrorAction SilentlyContinue + $command | Should -Not -BeNullOrEmpty + } + + It "Should have CmdletBinding attribute" { + $command = Get-Command -Name Invoke-PrivacyHardening + $command.CmdletBinding | Should -Be $true + } + } + + Context "Function Parameters" { + + It "Should have Mode parameter" { + $command = Get-Command -Name Invoke-PrivacyHardening + $command.Parameters.ContainsKey('Mode') | Should -Be $true + } + + It "Mode parameter should accept specific values" { + $command = Get-Command -Name Invoke-PrivacyHardening + $validateSet = $command.Parameters['Mode'].Attributes | Where-Object { $_ -is [System.Management.Automation.ValidateSetAttribute] } + $validateSet.ValidValues | Should -Contain 'MSRecommended' + $validateSet.ValidValues | Should -Contain 'Strict' + $validateSet.ValidValues | Should -Contain 'Paranoid' + } + + It "Should have DryRun parameter" { + $command = Get-Command -Name Invoke-PrivacyHardening + $command.Parameters.ContainsKey('DryRun') | Should -Be $true + } + + It "Should have Force parameter" { + $command = Get-Command -Name Invoke-PrivacyHardening + $command.Parameters.ContainsKey('Force') | Should -Be $true + } + } + + Context "Privacy Mode Configurations" { + + It "Should load MSRecommended config from JSON" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\Privacy\Config\Privacy-MSRecommended.json" + $configPath | Should -Exist + } + + It "Should load Strict config from JSON" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\Privacy\Config\Privacy-Strict.json" + $configPath | Should -Exist + } + + It "Should load Paranoid config from JSON" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\Privacy\Config\Privacy-Paranoid.json" + $configPath | Should -Exist + } + + It "MSRecommended config should be valid JSON" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\Privacy\Config\Privacy-MSRecommended.json" + { Get-Content $configPath -Raw | ConvertFrom-Json } | Should -Not -Throw + } + + It "MSRecommended should have AllowTelemetry = 1" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\Privacy\Config\Privacy-MSRecommended.json" + $config = Get-Content $configPath -Raw | ConvertFrom-Json + $config.telemetry.AllowTelemetry | Should -Be 1 + } + + It "Strict should have AllowTelemetry = 0" { + $configPath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\Privacy\Config\Privacy-Strict.json" + $config = Get-Content $configPath -Raw | ConvertFrom-Json + $config.telemetry.AllowTelemetry | Should -Be 0 + } + } + + Context "Bloatware Configuration" { + + It "Should load Bloatware config from JSON" { + $bloatwarePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\Privacy\Config\Bloatware.json" + $bloatwarePath | Should -Exist + } + + It "Bloatware config should be valid JSON" { + $bloatwarePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\Privacy\Config\Bloatware.json" + { Get-Content $bloatwarePath -Raw | ConvertFrom-Json } | Should -Not -Throw + } + + It "Should have both removal and protected lists" { + $bloatwarePath = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) "Modules\Privacy\Config\Bloatware.json" + $config = Get-Content $bloatwarePath -Raw | ConvertFrom-Json + $config.PSObject.Properties.Name | Should -Contain 'appsToRemove' + $config.PSObject.Properties.Name | Should -Contain 'protectedApps' + } + } + + Context "Function Execution - DryRun Mode" { + + It "Should execute without errors in DryRun mode with MSRecommended" { + { Invoke-PrivacyHardening -Mode 'MSRecommended' -DryRun -Force } | Should -Not -Throw + } + + It "Should return a PSCustomObject" { + $result = Invoke-PrivacyHardening -Mode 'MSRecommended' -DryRun -Force + $result | Should -BeOfType [PSCustomObject] + } + + It "Should have Success property" { + $result = Invoke-PrivacyHardening -Mode 'MSRecommended' -DryRun -Force + $result.PSObject.Properties.Name | Should -Contain 'Success' + } + + It "Should have Mode property" { + $result = Invoke-PrivacyHardening -Mode 'MSRecommended' -DryRun -Force + $result.PSObject.Properties.Name | Should -Contain 'Mode' + } + + It "Mode property should match requested mode" { + $result = Invoke-PrivacyHardening -Mode 'Strict' -DryRun -Force + $result.Mode | Should -Be 'Strict' + } + } + + Context "Return Object Structure" { + + It "Should return object with all required properties" { + $result = Invoke-PrivacyHardening -Mode 'MSRecommended' -DryRun -Force + + $requiredProperties = @( + 'Success', + 'Mode', + 'Errors', + 'Warnings', + 'Duration' + ) + + foreach ($prop in $requiredProperties) { + $result.PSObject.Properties.Name | Should -Contain $prop + } + } + + It "Errors should be an array" { + $result = Invoke-PrivacyHardening -Mode 'MSRecommended' -DryRun -Force + $result.Errors -is [Array] | Should -Be $true + } + + It "Warnings should be an array" { + $result = Invoke-PrivacyHardening -Mode 'MSRecommended' -DryRun -Force + $result.Warnings -is [Array] | Should -Be $true + } + } + + Context "Compliance Testing" { + + It "Test-PrivacyCompliance should execute without errors" { + { Test-PrivacyCompliance -Mode 'MSRecommended' } | Should -Not -Throw + } + + It "Test-PrivacyCompliance should return PSCustomObject" { + $result = Test-PrivacyCompliance -Mode 'MSRecommended' + $result | Should -BeOfType [PSCustomObject] + } + + It "Compliance result should have Compliant property" { + $result = Test-PrivacyCompliance -Mode 'MSRecommended' + $result.PSObject.Properties.Name | Should -Contain 'Compliant' + } + } +} + +AfterAll { + # Clean up + Remove-Module Privacy -Force -ErrorAction SilentlyContinue +} diff --git a/Tools/Parse-EdgeBaseline.ps1 b/Tools/Parse-EdgeBaseline.ps1 new file mode 100644 index 0000000..56d15fe --- /dev/null +++ b/Tools/Parse-EdgeBaseline.ps1 @@ -0,0 +1,302 @@ +<# +.SYNOPSIS + Parse Microsoft Edge Security Baseline GPO files to JSON (DEVELOPER TOOL ONLY) + +.DESCRIPTION + **NOTE: This is a DEVELOPER/MAINTENANCE tool - NOT needed for production use!** + + Parses GPO backups from Microsoft Edge Security Baseline: + - Registry.pol (Computer policies for Microsoft Edge) + + Outputs structured JSON files for Edge hardening settings. + +.PARAMETER BaselinePath + Path to Microsoft Edge Security Baseline folder + +.PARAMETER OutputPath + Path where JSON output files will be saved + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+ + +.EXAMPLE + .\Parse-EdgeBaseline.ps1 -BaselinePath "C:\Edge Baseline" -OutputPath ".\Modules\EdgeHardening\ParsedSettings" +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $true)] + [string]$BaselinePath, + + [Parameter(Mandatory = $false)] + [string]$OutputPath = (Join-Path $PSScriptRoot "..\Modules\EdgeHardening\ParsedSettings") +) + +#region Helper Functions + +function Read-PolFile { + <# + .SYNOPSIS + Parse binary Registry.pol file + + .DESCRIPTION + Based on Microsoft GPRegistryPolicyParser format + Registry.pol binary format: + - Signature: PReg (4 bytes) + - Version: 1 (4 bytes) + - Entries: [KeyName;ValueName;Type;Size;Data] + #> + param( + [Parameter(Mandatory = $true)] + [string]$Path + ) + + if (-not (Test-Path $Path)) { + Write-Warning "Registry.pol not found: $Path" + return @() + } + + try { + $entries = @() + $bytes = [System.IO.File]::ReadAllBytes($Path) + + # Check signature (PReg) + $signature = [System.Text.Encoding]::ASCII.GetString($bytes[0..3]) + if ($signature -ne 'PReg') { + Write-Warning "Invalid Registry.pol signature: $signature" + return @() + } + + # Check version + $version = [BitConverter]::ToInt32($bytes, 4) + if ($version -ne 1) { + Write-Warning "Unsupported Registry.pol version: $version" + return @() + } + + $index = 8 # Start after signature and version + + while ($index -lt $bytes.Length) { + # Read entry: [KeyName;ValueName;Type;Size;Data] + + # Read KeyName (Unicode null-terminated string) + $keyNameBytes = @() + while ($index -lt ($bytes.Length - 1)) { + $b1 = $bytes[$index] + $b2 = $bytes[$index + 1] + $index += 2 + + if ($b1 -eq 0 -and $b2 -eq 0) { + break + } + + $keyNameBytes += $b1, $b2 + } + + $keyName = [System.Text.Encoding]::Unicode.GetString($keyNameBytes) + + # Skip semicolon + $index += 2 + + # Read ValueName (Unicode null-terminated string) + $valueNameBytes = @() + while ($index -lt ($bytes.Length - 1)) { + $b1 = $bytes[$index] + $b2 = $bytes[$index + 1] + $index += 2 + + if ($b1 -eq 0 -and $b2 -eq 0) { + break + } + + $valueNameBytes += $b1, $b2 + } + + $valueName = [System.Text.Encoding]::Unicode.GetString($valueNameBytes) + + # Skip semicolon + $index += 2 + + # Read Type (DWORD - 4 bytes) + if ($index + 4 -gt $bytes.Length) { break } + $type = [BitConverter]::ToInt32($bytes, $index) + $index += 4 + + # Skip semicolon + $index += 2 + + # Read Size (DWORD - 4 bytes) + if ($index + 4 -gt $bytes.Length) { break } + $size = [BitConverter]::ToInt32($bytes, $index) + $index += 4 + + # Skip semicolon + $index += 2 + + # Read Data + $data = $null + if ($size -gt 0 -and ($index + $size) -le $bytes.Length) { + $dataBytes = $bytes[$index..($index + $size - 1)] + + # Parse based on type + switch ($type) { + 1 { # REG_SZ (String) + $data = [System.Text.Encoding]::Unicode.GetString($dataBytes).TrimEnd([char]0) + } + 2 { # REG_EXPAND_SZ + $data = [System.Text.Encoding]::Unicode.GetString($dataBytes).TrimEnd([char]0) + } + 3 { # REG_BINARY + $data = $dataBytes + } + 4 { # REG_DWORD + if ($dataBytes.Length -ge 4) { + $data = [BitConverter]::ToInt32($dataBytes, 0) + } + } + 7 { # REG_MULTI_SZ + $data = [System.Text.Encoding]::Unicode.GetString($dataBytes).TrimEnd([char]0) -split '\x00' + } + default { + $data = $dataBytes + } + } + + $index += $size + } + + # Skip closing bracket + $index += 2 + + # Add entry + $entries += [PSCustomObject]@{ + KeyName = $keyName + ValueName = $valueName + Type = switch ($type) { + 1 { "REG_SZ" } + 2 { "REG_EXPAND_SZ" } + 3 { "REG_BINARY" } + 4 { "REG_DWORD" } + 7 { "REG_MULTI_SZ" } + 11 { "REG_QWORD" } + default { "Unknown($type)" } + } + Data = $data + } + } + + return $entries + } + catch { + Write-Error "Failed to parse Registry.pol: $Path - $_" + return @() + } +} + +#endregion + +#region Main Parsing Logic + +Write-Host "" +Write-Host "================================================" -ForegroundColor Cyan +Write-Host " Microsoft Edge Security Baseline Parser" -ForegroundColor Cyan +Write-Host "================================================" -ForegroundColor Cyan +Write-Host "" + +# Validate baseline path +if (-not (Test-Path $BaselinePath)) { + Write-Error "Baseline path not found: $BaselinePath" + exit 1 +} + +# Ensure output directory exists +if (-not (Test-Path $OutputPath)) { + New-Item -Path $OutputPath -ItemType Directory -Force | Out-Null + Write-Host "Created output directory: $OutputPath" -ForegroundColor Green +} + +# Find GPO folder (should be only one GPO in Edge Baseline) +$gpoFolders = Get-ChildItem -Path (Join-Path $BaselinePath "GPOs") -Directory + +if ($gpoFolders.Count -eq 0) { + Write-Error "No GPO folders found in $BaselinePath\GPOs" + exit 1 +} + +Write-Host "Found $($gpoFolders.Count) GPO folder(s)" -ForegroundColor Cyan +Write-Host "" + +$allComputerPolicies = @() + +foreach ($gpoFolder in $gpoFolders) { + $gpoName = $gpoFolder.Name + Write-Host "Processing GPO: $gpoName" -ForegroundColor Yellow + + # Parse Computer Registry policies + $computerPolPath = Join-Path $gpoFolder.FullName "DomainSysvol\GPO\Machine\registry.pol" + + if (Test-Path $computerPolPath) { + Write-Host " Parsing Computer registry policies..." -ForegroundColor Gray + $computerPolicies = Read-PolFile -Path $computerPolPath + + if ($computerPolicies.Count -gt 0) { + $allComputerPolicies += $computerPolicies + Write-Host " Found $($computerPolicies.Count) Computer registry policies" -ForegroundColor Green + } + else { + Write-Warning " No Computer registry policies found" + } + } + else { + Write-Warning " Computer registry.pol not found" + } + + # Check for User policies (Edge baseline typically doesn't have user policies) + $userPolPath = Join-Path $gpoFolder.FullName "DomainSysvol\GPO\User\registry.pol" + + if (Test-Path $userPolPath) { + Write-Host " User registry.pol found (unexpected for Edge baseline)" -ForegroundColor Yellow + } + + Write-Host "" +} + +# Save Computer Registry Policies +if ($allComputerPolicies.Count -gt 0) { + $computerPoliciesFile = Join-Path $OutputPath "EdgePolicies.json" + $allComputerPolicies | ConvertTo-Json -Depth 10 | Out-File -FilePath $computerPoliciesFile -Encoding UTF8 -Force + Write-Host "Saved $($allComputerPolicies.Count) policies to: EdgePolicies.json" -ForegroundColor Green +} + +# Create summary +$summary = [PSCustomObject]@{ + TotalEdgePolicies = $allComputerPolicies.Count + ParsedDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + BaselineVersion = "Edge v139" + RegistryPaths = ($allComputerPolicies | Select-Object -ExpandProperty KeyName -Unique | Sort-Object) +} + +$summaryFile = Join-Path $OutputPath "Summary.json" +$summary | ConvertTo-Json -Depth 10 | Out-File -FilePath $summaryFile -Encoding UTF8 -Force + +Write-Host "" +Write-Host "================================================" -ForegroundColor Cyan +Write-Host " Parsing Complete" -ForegroundColor Cyan +Write-Host "================================================" -ForegroundColor Cyan +Write-Host "" +Write-Host "Total Edge Policies: $($allComputerPolicies.Count)" -ForegroundColor White +Write-Host "" +Write-Host "Output files:" -ForegroundColor White +Write-Host " - EdgePolicies.json" -ForegroundColor Gray +Write-Host " - Summary.json" -ForegroundColor Gray +Write-Host "" +Write-Host "Next steps:" -ForegroundColor Yellow +Write-Host " 1. Review parsed policies in EdgePolicies.json" -ForegroundColor Gray +Write-Host " 2. Implement Set-EdgePolicies.ps1 (native PowerShell)" -ForegroundColor Gray +Write-Host " 3. Implement Test-EdgePolicies.ps1 (compliance check)" -ForegroundColor Gray +Write-Host " 4. Implement Invoke-EdgeHardening.ps1 (main entry point)" -ForegroundColor Gray +Write-Host "" + +#endregion diff --git a/Tools/Parse-SecurityBaseline.ps1 b/Tools/Parse-SecurityBaseline.ps1 new file mode 100644 index 0000000..97121fa --- /dev/null +++ b/Tools/Parse-SecurityBaseline.ps1 @@ -0,0 +1,497 @@ +<# +.SYNOPSIS + Parse Microsoft Security Baseline GPO files to JSON (DEVELOPER TOOL ONLY) + +.DESCRIPTION + **NOTE: This is a DEVELOPER/MAINTENANCE tool - NOT needed for production use!** + + The parsed JSON files are already included in Modules/SecurityBaseline/ParsedSettings/. + This tool is only used during development to update those JSON files when Microsoft + releases new Security Baselines. + + Parses GPO backups from Microsoft Security Baseline: + - Registry.pol (Computer + User) + - GptTmpl.inf (Security Template) + - audit.csv (Audit Policies) + + Outputs structured JSON files for each category. + +.PARAMETER BaselinePath + Path to Microsoft Security Baseline folder (download separately from Microsoft) + Download: https://www.microsoft.com/en-us/download/details.aspx?id=55319 + +.PARAMETER OutputPath + Path where JSON output files will be saved + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+ + +.EXAMPLE + .\Parse-SecurityBaseline.ps1 + Parse baseline and output to default location +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $true)] + [string]$BaselinePath, + + [Parameter(Mandatory = $false)] + [string]$OutputPath = (Join-Path $PSScriptRoot "..\Modules\SecurityBaseline\ParsedSettings") +) + +#region Helper Functions + +function Read-PolFile { + <# + .SYNOPSIS + Parse binary Registry.pol file + + .DESCRIPTION + Based on Microsoft GPRegistryPolicyParser format + Registry.pol binary format: + - Signature: PReg (4 bytes) + - Version: 1 (4 bytes) + - Entries: [KeyName;ValueName;Type;Size;Data] + #> + param( + [Parameter(Mandatory = $true)] + [string]$Path + ) + + if (-not (Test-Path $Path)) { + Write-Warning "Registry.pol not found: $Path" + return @() + } + + try { + $entries = @() + $bytes = [System.IO.File]::ReadAllBytes($Path) + + # Check signature (PReg) + $signature = [System.Text.Encoding]::ASCII.GetString($bytes[0..3]) + if ($signature -ne 'PReg') { + Write-Warning "Invalid Registry.pol signature: $signature" + return @() + } + + # Check version + $version = [BitConverter]::ToInt32($bytes, 4) + if ($version -ne 1) { + Write-Warning "Unsupported Registry.pol version: $version" + return @() + } + + $index = 8 # Start after signature and version + + while ($index -lt $bytes.Length) { + # Read entry: [KeyName;ValueName;Type;Size;Data] + + # Read KeyName (Unicode null-terminated string) + $keyNameBytes = @() + while ($index -lt ($bytes.Length - 1)) { + $b1 = $bytes[$index] + $b2 = $bytes[$index + 1] + $index += 2 + + if ($b1 -eq 0 -and $b2 -eq 0) { + break + } + + $keyNameBytes += $b1, $b2 + } + + $keyName = [System.Text.Encoding]::Unicode.GetString($keyNameBytes) + + # Skip semicolon + $index += 2 + + # Read ValueName (Unicode null-terminated string) + $valueNameBytes = @() + while ($index -lt ($bytes.Length - 1)) { + $b1 = $bytes[$index] + $b2 = $bytes[$index + 1] + $index += 2 + + if ($b1 -eq 0 -and $b2 -eq 0) { + break + } + + $valueNameBytes += $b1, $b2 + } + + $valueName = [System.Text.Encoding]::Unicode.GetString($valueNameBytes) + + # Skip semicolon + $index += 2 + + # Read Type (DWORD - 4 bytes) + if ($index + 4 -gt $bytes.Length) { break } + $type = [BitConverter]::ToInt32($bytes, $index) + $index += 4 + + # Skip semicolon + $index += 2 + + # Read Size (DWORD - 4 bytes) + if ($index + 4 -gt $bytes.Length) { break } + $size = [BitConverter]::ToInt32($bytes, $index) + $index += 4 + + # Skip semicolon + $index += 2 + + # Read Data + $data = $null + if ($size -gt 0 -and ($index + $size) -le $bytes.Length) { + $dataBytes = $bytes[$index..($index + $size - 1)] + + # Parse based on type + switch ($type) { + 1 { # REG_SZ (String) + $data = [System.Text.Encoding]::Unicode.GetString($dataBytes).TrimEnd([char]0) + } + 2 { # REG_EXPAND_SZ + $data = [System.Text.Encoding]::Unicode.GetString($dataBytes).TrimEnd([char]0) + } + 3 { # REG_BINARY + $data = $dataBytes + } + 4 { # REG_DWORD + if ($dataBytes.Length -ge 4) { + $data = [BitConverter]::ToInt32($dataBytes, 0) + } + } + 7 { # REG_MULTI_SZ + $data = [System.Text.Encoding]::Unicode.GetString($dataBytes).TrimEnd([char]0) -split '\x00' + } + default { + $data = $dataBytes + } + } + + $index += $size + } + + # Skip closing bracket + $index += 2 + + # Add entry + $entries += [PSCustomObject]@{ + KeyName = $keyName + ValueName = $valueName + Type = switch ($type) { + 1 { "REG_SZ" } + 2 { "REG_EXPAND_SZ" } + 3 { "REG_BINARY" } + 4 { "REG_DWORD" } + 7 { "REG_MULTI_SZ" } + 11 { "REG_QWORD" } + default { "Unknown($type)" } + } + Data = $data + } + } + + return $entries + } + catch { + Write-Error "Failed to parse Registry.pol: $Path - $_" + return @() + } +} + +function Read-GptTmplInf { + <# + .SYNOPSIS + Parse GptTmpl.inf security template file + #> + param( + [Parameter(Mandatory = $true)] + [string]$Path + ) + + if (-not (Test-Path $Path)) { + Write-Warning "GptTmpl.inf not found: $Path" + return @{} + } + + try { + $content = Get-Content -Path $Path -Encoding Unicode + $settings = @{} + $currentSection = "" + + foreach ($line in $content) { + $line = $line.Trim() + + # Skip empty lines and comments + if ([string]::IsNullOrWhiteSpace($line) -or $line.StartsWith(';')) { + continue + } + + # Section header + if ($line -match '^\[(.+)\]$') { + $currentSection = $matches[1] + $settings[$currentSection] = @{} + continue + } + + # Key = Value (normal format) + if ($line -match '^(.+?)\s*=\s*(.*)$' -and $currentSection) { + $key = $matches[1].Trim() + $value = $matches[2].Trim() + + $settings[$currentSection][$key] = $value + continue + } + + # Service format: "ServiceName",StartupType,"SecurityDescriptor" + # Example: "XboxGipSvc",4,"" + if ($line -match '^"(.+?)",(\d+),(.*)$' -and $currentSection) { + $serviceName = $matches[1] + $startupType = $matches[2] + # Note: $matches[3] contains SecurityDescriptor (not used currently) + + # Service startup type mapping: + # 2 = Automatic, 3 = Manual, 4 = Disabled + $startupTypeName = switch ($startupType) { + "2" { "Automatic" } + "3" { "Manual" } + "4" { "Disabled" } + default { $startupType } + } + + $settings[$currentSection][$serviceName] = "StartupType=$startupTypeName" + } + } + + return $settings + } + catch { + Write-Error "Failed to parse GptTmpl.inf: $Path - $_" + return @{} + } +} + +function Read-AuditCsv { + <# + .SYNOPSIS + Parse audit.csv advanced audit policy file + #> + param( + [Parameter(Mandatory = $true)] + [string]$Path + ) + + if (-not (Test-Path $Path)) { + Write-Warning "audit.csv not found: $Path" + return @() + } + + try { + $csv = Import-Csv -Path $Path -Header "Machine Name", "Policy Target", "Subcategory", "Subcategory GUID", "Inclusion Setting", "Exclusion Setting", "Setting Value" + + # Skip header row + $policies = $csv | Select-Object -Skip 1 | ForEach-Object { + [PSCustomObject]@{ + Subcategory = $_.'Subcategory' + SubcategoryGUID = $_.'Subcategory GUID' + InclusionSetting = $_.'Inclusion Setting' + SettingValue = $_.'Setting Value' + } + } + + return $policies + } + catch { + Write-Error "Failed to parse audit.csv: $Path - $_" + return @() + } +} + +#endregion + +#region Main Processing + +Write-Host "=============================================" -ForegroundColor Cyan +Write-Host "MS Security Baseline Parser - Windows 11 25H2" -ForegroundColor Cyan +Write-Host "=============================================" -ForegroundColor Cyan +Write-Host "" + +# Validate paths +if (-not (Test-Path $BaselinePath)) { + Write-Error "Baseline path not found: $BaselinePath" + exit 1 +} + +# Create output directory +if (-not (Test-Path $OutputPath)) { + New-Item -ItemType Directory -Path $OutputPath -Force | Out-Null +} + +# GPO mapping +$gpoMapping = @{ + "{02DB0E53-0925-4E5A-B775-E7A1A9370AB8}" = "MSFT Windows 11 25H2 - Computer" + "{D233D0A9-D74E-4AEE-9B89-2398C7AD1DDE}" = "MSFT Windows 11 25H2 - User" + "{E2D5B48E-8BB0-4ACC-AEB6-8DD82FDD825F}" = "MSFT Windows 11 25H2 - BitLocker" + "{FC357767-040F-49C3-965E-B071D17C29A0}" = "MSFT Windows 11 25H2 - Credential Guard" + "{D42CD0A5-F321-4CB1-ADA9-03A0F0A6E3B2}" = "MSFT Windows 11 25H2 - Defender Antivirus" + "{666ED8AB-DF4A-45CE-9666-61F802515051}" = "MSFT Windows 11 25H2 - Domain Security" + "{1879C2DC-00C6-4692-B167-15B9366DF5D4}" = "MSFT Internet Explorer 11 - Computer" + "{56977988-BEEC-4E61-B649-731EC7AB997B}" = "MSFT Internet Explorer 11 - User" +} + +$gpoPath = Join-Path $BaselinePath "GPOs" + +$allSettings = @{ + RegistryPolicies = @{ + Computer = @() + User = @() + } + SecurityTemplates = @{} + AuditPolicies = @() + Summary = @{ + TotalRegistrySettings = 0 + TotalSecuritySettings = 0 + TotalAuditPolicies = 0 + TotalSettings = 0 + } +} + +# Process each GPO +foreach ($guid in $gpoMapping.Keys) { + $gpoName = $gpoMapping[$guid] + $gpoFolder = Join-Path $gpoPath $guid + + if (-not (Test-Path $gpoFolder)) { + Write-Warning "GPO folder not found: $guid" + continue + } + + Write-Host "Processing: $gpoName" -ForegroundColor Yellow + Write-Host " GUID: $guid" -ForegroundColor Gray + + # Parse Computer Registry.pol + $computerPolPath = Join-Path $gpoFolder "DomainSysvol\GPO\Machine\registry.pol" + if (Test-Path $computerPolPath) { + Write-Host " [*] Parsing Computer registry.pol..." -ForegroundColor Gray + $entries = Read-PolFile -Path $computerPolPath + + foreach ($entry in $entries) { + $allSettings.RegistryPolicies.Computer += [PSCustomObject]@{ + GPO = $gpoName + KeyName = $entry.KeyName + ValueName = $entry.ValueName + Type = $entry.Type + Data = $entry.Data + } + } + + Write-Host " Found $($entries.Count) settings" -ForegroundColor Green + $allSettings.Summary.TotalRegistrySettings += $entries.Count + } + + # Parse User Registry.pol + $userPolPath = Join-Path $gpoFolder "DomainSysvol\GPO\User\registry.pol" + if (Test-Path $userPolPath) { + Write-Host " [*] Parsing User registry.pol..." -ForegroundColor Gray + $entries = Read-PolFile -Path $userPolPath + + foreach ($entry in $entries) { + $allSettings.RegistryPolicies.User += [PSCustomObject]@{ + GPO = $gpoName + KeyName = $entry.KeyName + ValueName = $entry.ValueName + Type = $entry.Type + Data = $entry.Data + } + } + + Write-Host " Found $($entries.Count) settings" -ForegroundColor Green + $allSettings.Summary.TotalRegistrySettings += $entries.Count + } + + # Parse GptTmpl.inf (Security Template) + $gptTmplPath = Join-Path $gpoFolder "DomainSysvol\GPO\Machine\microsoft\windows nt\SecEdit\GptTmpl.inf" + if (Test-Path $gptTmplPath) { + Write-Host " [*] Parsing GptTmpl.inf..." -ForegroundColor Gray + $template = Read-GptTmplInf -Path $gptTmplPath + + $settingCount = ($template.Values | ForEach-Object { $_.Count } | Measure-Object -Sum).Sum + + $allSettings.SecurityTemplates[$gpoName] = $template + + Write-Host " Found $settingCount settings in $($template.Count) sections" -ForegroundColor Green + $allSettings.Summary.TotalSecuritySettings += $settingCount + } + + # Parse audit.csv (Advanced Audit Policies) + $auditCsvPath = Join-Path $gpoFolder "DomainSysvol\GPO\Machine\microsoft\windows nt\Audit\audit.csv" + if (Test-Path $auditCsvPath) { + Write-Host " [*] Parsing audit.csv..." -ForegroundColor Gray + $policies = Read-AuditCsv -Path $auditCsvPath + + foreach ($policy in $policies) { + $allSettings.AuditPolicies += [PSCustomObject]@{ + GPO = $gpoName + Subcategory = $policy.Subcategory + SubcategoryGUID = $policy.SubcategoryGUID + InclusionSetting = $policy.InclusionSetting + SettingValue = $policy.SettingValue + } + } + + Write-Host " Found $($policies.Count) audit policies" -ForegroundColor Green + $allSettings.Summary.TotalAuditPolicies += $policies.Count + } + + Write-Host "" +} + +# Calculate total +$allSettings.Summary.TotalSettings = $allSettings.Summary.TotalRegistrySettings + + $allSettings.Summary.TotalSecuritySettings + + $allSettings.Summary.TotalAuditPolicies + +# Save outputs +Write-Host "Saving parsed settings..." -ForegroundColor Cyan + +$computerRegPath = Join-Path $OutputPath "Computer-RegistryPolicies.json" +$allSettings.RegistryPolicies.Computer | ConvertTo-Json -Depth 10 | Set-Content -Path $computerRegPath -Encoding UTF8 | Out-Null +Write-Host "[OK] Computer Registry Policies: $computerRegPath" -ForegroundColor Green + +$userRegPath = Join-Path $OutputPath "User-RegistryPolicies.json" +$allSettings.RegistryPolicies.User | ConvertTo-Json -Depth 10 | Set-Content -Path $userRegPath -Encoding UTF8 | Out-Null +Write-Host "[OK] User Registry Policies: $userRegPath" -ForegroundColor Green + +$securityPath = Join-Path $OutputPath "SecurityTemplates.json" +$allSettings.SecurityTemplates | ConvertTo-Json -Depth 10 | Set-Content -Path $securityPath -Encoding UTF8 | Out-Null +Write-Host "[OK] Security Templates: $securityPath" -ForegroundColor Green + +$auditPath = Join-Path $OutputPath "AuditPolicies.json" +$allSettings.AuditPolicies | ConvertTo-Json -Depth 10 | Set-Content -Path $auditPath -Encoding UTF8 | Out-Null +Write-Host "[OK] Audit Policies: $auditPath" -ForegroundColor Green + +$summaryPath = Join-Path $OutputPath "Summary.json" +$allSettings.Summary | ConvertTo-Json -Depth 10 | Set-Content -Path $summaryPath -Encoding UTF8 | Out-Null +Write-Host "[OK] Summary: $summaryPath" -ForegroundColor Green + +# Display summary +Write-Host "" +Write-Host "=============================================" -ForegroundColor Cyan +Write-Host "PARSING COMPLETE" -ForegroundColor Cyan +Write-Host "=============================================" -ForegroundColor Cyan +Write-Host "Total Registry Settings: $($allSettings.Summary.TotalRegistrySettings)" -ForegroundColor White +Write-Host " - Computer: $($allSettings.RegistryPolicies.Computer.Count)" -ForegroundColor Gray +Write-Host " - User: $($allSettings.RegistryPolicies.User.Count)" -ForegroundColor Gray +Write-Host "Total Security Settings: $($allSettings.Summary.TotalSecuritySettings)" -ForegroundColor White +Write-Host "Total Audit Policies: $($allSettings.Summary.TotalAuditPolicies)" -ForegroundColor White +Write-Host "" +Write-Host "GRAND TOTAL: $($allSettings.Summary.TotalSettings) SETTINGS" -ForegroundColor Green +Write-Host "" +Write-Host "Output location: $OutputPath" -ForegroundColor Cyan +Write-Host "" + +#endregion diff --git a/Tools/Verify-Complete-Hardening.ps1 b/Tools/Verify-Complete-Hardening.ps1 new file mode 100644 index 0000000..b8d8424 --- /dev/null +++ b/Tools/Verify-Complete-Hardening.ps1 @@ -0,0 +1,3729 @@ +<# +.SYNOPSIS + Complete verification of all applied hardening settings + +.DESCRIPTION + Verifies 100% of all settings ALWAYS - regardless of config.json: + - 335 Registry settings (Computer + User) [SecurityBaseline] + - 67 Security Template settings (79 parsed, 12 metadata excluded) [SecurityBaseline] + - 23 Audit Policies [SecurityBaseline] + - 19 ASR Rules [ASR] + - 5 DNS Checks [DNS] + - 67 Privacy Checks [Privacy] - 43 registry (37 Privacy + 6 OneDrive/Store) + 24 bloatware + - 32 AntiAI Policies [AntiAI] - includes 4-layer Copilot defense, Recall, Edge Sidebar, CapabilityAccessManager, Explorer AI + - 24 Edge Policies [EdgeHardening] - dynamic count based on extensions setting + - 50 Advanced Settings [AdvancedSecurity] - optional RDP/AdminShares/UPnP/WirelessDisplay/DiscoveryProtocols/IPv6 decisions are always counted as Pass + + NOTE: This shows the TRUTH about what is configured in your system. + + Total: 632 settings (Paranoid mode) + SecurityBaseline: 425 (335 Registry + 67 SecTemplate + 23 Audit) + ASR: 19 + DNS: 5 + Privacy: 81 (57 registry Paranoid + 24 bloatware) + AntiAI: 32 compliance checks (13 features) + EdgeHardening: 24 (22-23 applied depending on extensions) + AdvancedSecurity: 50 (15 features incl. Discovery Protocols + IPv6) + +.NOTES + Author: NexusOne23 + Version: 2.2.0 +#> + +#Requires -Version 5.1 +#Requires -RunAsAdministrator + +param( + [Parameter(Mandatory = $false)] + [string]$ExportPath +) + +$ErrorActionPreference = 'Stop' + +# Constants for verification counts +$EXPECTED_REGISTRY_COUNT = 335 +$EXPECTED_SECURITY_COUNT = 67 +$EXPECTED_AUDIT_COUNT = 23 +$EXPECTED_ASR_COUNT = 19 +$EXPECTED_EDGE_COUNT = 24 # 24 total Edge policies from EdgePolicies.json +$EXPECTED_ADVANCED_COUNT = 50 # 50 total AdvancedSecurity policy checks (incl. Discovery Protocols WSD/mDNS + IPv6) +$EXPECTED_DNS_COUNT = 5 +$EXPECTED_PRIVACY_COUNT = 77 # 53 registry from Privacy-MSRecommended.json + 24 bloatware apps +$EXPECTED_ANTIAI_COUNT = 32 # 32 AntiAI registry policy checks (13 features incl. Copilot 4-Layer Defense) + +Write-Host "" +Write-Host "========================================" -ForegroundColor Cyan +Write-Host " NoID Privacy - Verification" -ForegroundColor Cyan +Write-Host " 100% Complete Settings Check" -ForegroundColor Cyan +Write-Host "========================================" -ForegroundColor Cyan +Write-Host "" + +$startTime = Get-Date + +# Get root path (since script is in Tools/ subdirectory) +$rootPath = Split-Path $PSScriptRoot -Parent + +# VERIFY ALWAYS CHECKS ALL SETTINGS - Regardless of config.json +# This shows TRUTH: What is actually configured in the system +$totalSettings = $EXPECTED_REGISTRY_COUNT + $EXPECTED_ASR_COUNT + $EXPECTED_DNS_COUNT + $EXPECTED_PRIVACY_COUNT + $EXPECTED_ANTIAI_COUNT + $EXPECTED_EDGE_COUNT + $EXPECTED_ADVANCED_COUNT + $EXPECTED_SECURITY_COUNT + $EXPECTED_AUDIT_COUNT + +$results = [PSCustomObject]@{ + TotalSettings = $totalSettings + RegistrySettings = $EXPECTED_REGISTRY_COUNT + SecurityTemplate = $EXPECTED_SECURITY_COUNT + AuditPolicies = $EXPECTED_AUDIT_COUNT + ASRRules = $EXPECTED_ASR_COUNT + EdgeHardeningPolicies = $EXPECTED_EDGE_COUNT + AdvancedSecuritySettings = $EXPECTED_ADVANCED_COUNT + DNSChecks = $EXPECTED_DNS_COUNT + PrivacyChecks = $EXPECTED_PRIVACY_COUNT + AntiAIPolicies = $EXPECTED_ANTIAI_COUNT + Verified = 0 + Failed = 0 + FailedSettings = @() + AllSettings = @() # Track ALL settings for complete HTML report + Duration = $null +} + +# Load configuration files +$baseConfigPath = Join-Path $rootPath "Modules\SecurityBaseline\ParsedSettings" +$asrConfigPath = Join-Path $rootPath "Modules\ASR\Config" + +# ============================================================================= +# HELPER FUNCTION: Extract Registry Checks from JSON Configuration +# ============================================================================= +# This function recursively parses module JSON files and extracts registry checks. +# Supports both Privacy-style (Category > Path > Value) and AntiAI-style (Features > Registry > Path > Value) +# +# Returns array of: @{ Path = "HKLM:\..."; Name = "ValueName"; Value = expected; Desc = "Description"; Type = "DWord" } +# +function Get-RegistryChecksFromJson { + param( + [Parameter(Mandatory = $true)] + [string]$JsonPath, + + [Parameter(Mandatory = $false)] + [string[]]$ExcludeCategories = @() + ) + + $checks = @() + + if (-not (Test-Path $JsonPath)) { + Write-Warning "JSON file not found: $JsonPath" + return $checks + } + + $config = Get-Content $JsonPath -Raw | ConvertFrom-Json + + # Recursive function to find registry paths in any JSON structure + function Find-RegistrySettings { + param($Object, $ParentPath = "") + + $foundChecks = @() + + if ($null -eq $Object) { return $foundChecks } + + foreach ($prop in $Object.PSObject.Properties) { + $propName = $prop.Name + $propValue = $prop.Value + + # Skip metadata and excluded categories + # NOTE: EnterpriseProtection is NOT skipped - it contains valid registry paths! + if ($propName -in @('Mode', 'Description', 'BestFor', 'Warnings', 'Services', 'ScheduledTasks', + 'Summary', 'AutomaticallyBlockedByMasterSwitch', 'ModuleName', 'Version', + 'TotalFeatures', 'TotalPolicies', 'URIHandlers', 'Note', 'FilePath', + 'HostsEntries', 'CloudBased', 'RequiresReboot', + 'RequiresADMX', 'Impact', 'Name')) { + continue + } + + # Skip excluded categories + if ($propName -in $ExcludeCategories) { + continue + } + + # Check if this is a registry path (starts with HK) + if ($propName -match '^HK(LM|CU|CR|U):\\') { + $regPath = $propName + + # Iterate through values under this registry path + if ($propValue -is [PSCustomObject]) { + foreach ($valueProp in $propValue.PSObject.Properties) { + $valueName = $valueProp.Name + $valueDef = $valueProp.Value + + # Extract expected value and description + if ($valueDef -is [PSCustomObject]) { + $expectedValue = $null + $description = $valueName + $valueType = "DWord" + + # Handle different property names for the value + if ($null -ne $valueDef.Value) { + $expectedValue = $valueDef.Value + } + if ($null -ne $valueDef.value) { + $expectedValue = $valueDef.value + } + + if ($valueDef.Description) { + $description = $valueDef.Description + } + if ($valueDef.Type) { + $valueType = $valueDef.Type + } + if ($valueDef.type) { + $valueType = $valueDef.type + } + + # Only add if we have an expected value + if ($null -ne $expectedValue) { + $foundChecks += [PSCustomObject]@{ + Path = $regPath + Name = $valueName + Value = $expectedValue + Desc = $description + Type = $valueType + } + } + } + } + } + } + # Recurse into nested objects (Categories, Features, Registry blocks) + elseif ($propValue -is [PSCustomObject]) { + $foundChecks += Find-RegistrySettings -Object $propValue -ParentPath "$ParentPath/$propName" + } + } + + return $foundChecks + } + + $checks = Find-RegistrySettings -Object $config + return $checks +} + +# Helper function for testing a single registry value +# Supports "at least as strict" logic for Privacy settings +function Test-RegistryValue { + param( + [string]$Path, + [string]$Name, + $ExpectedValue, + [switch]$AllowStricter # If true, stricter values than expected are also accepted + ) + + try { + if (Test-Path $Path) { + $actual = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name + + # Handle MultiString arrays + if ($ExpectedValue -is [array]) { + if ($actual -is [array]) { + # Check if all expected items are present (order-independent) + $allPresent = $true + foreach ($item in $ExpectedValue) { + if ($actual -notcontains $item) { + $allPresent = $false + break + } + } + return $allPresent + } + return $false + } + + # Exact match + if ($actual -eq $ExpectedValue) { + return $true + } + + # "At least as strict" logic for Privacy settings + # If user has a STRICTER setting than MSRecommended, that's still a PASS + if ($AllowStricter -and $null -ne $actual) { + # LetApps* settings: 0=User decides, 1=Force Allow, 2=Force Deny + # 2 (Force Deny) is stricter than 0 (User decides) + if ($Name -like "LetApps*") { + if ($ExpectedValue -eq 0 -and $actual -eq 2) { return $true } + } + + # Telemetry/AllowTelemetry: 0=Off, 1=Required, 2=Enhanced, 3=Full + # 0 (Off) is stricter than 1 (Required) + if ($Name -eq "AllowTelemetry") { + if ($ExpectedValue -ge 1 -and $actual -lt $ExpectedValue) { return $true } + } + + # DisableLocation: 0=Enabled, 1=Disabled - 1 is stricter + if ($Name -eq "DisableLocation" -or $Name -eq "DisableLocationScripting") { + if ($ExpectedValue -eq 0 -and $actual -eq 1) { return $true } + } + + # Sync settings: DisableSettingSync 1=Force Off is stricter than 2=User decides + if ($Name -like "*Sync*" -or $Name -like "*SettingSync*") { + if ($ExpectedValue -eq 2 -and $actual -eq 1) { return $true } + if ($ExpectedValue -eq 0 -and $actual -eq 1) { return $true } + } + + # General disable patterns: 1 (disabled) is often stricter than 0 (enabled) + # This covers many privacy settings + if ($Name -like "Disable*" -or $Name -like "*Disabled" -or $Name -like "No*") { + if ($ExpectedValue -eq 0 -and $actual -eq 1) { return $true } + } + + # General allow patterns: 0 (disabled) is stricter than 1 (enabled) + if ($Name -like "Allow*" -or $Name -like "*Allowed" -or $Name -like "Enable*") { + if ($ExpectedValue -eq 1 -and $actual -eq 0) { return $true } + } + } + + return $false + } + return $false + } + catch { + return $false + } +} + +# Helper function to get actual registry value +function Get-ActualRegistryValue { + param( + [string]$Path, + [string]$Name + ) + + try { + if (Test-Path $Path) { + $actual = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name + if ($null -ne $actual) { + return $actual + } + } + return "Not set" + } + catch { + return "Error reading" + } +} + +$totalSteps = 9 # ALL modules: Registry + Audit + SecTemplate + ASR + DNS + Privacy + AntiAI + EdgeHardening + AdvancedSecurity + +Write-Host "[1/$totalSteps] Verifying Registry Settings (335)..." -ForegroundColor Yellow + +try { + # Detect if system is domain-joined for standalone adjustments + $isDomainJoined = $false + try { + $computerSystem = Get-CimInstance -ClassName Win32_ComputerSystem + $isDomainJoined = ($computerSystem.PartOfDomain -eq $true) + } + catch { + Write-Host " Warning: Could not detect domain membership, assuming standalone" -ForegroundColor Yellow + } + + # Load registry settings + $computerSettings = Get-Content (Join-Path $baseConfigPath "Computer-RegistryPolicies.json") -Raw | ConvertFrom-Json + $userSettings = Get-Content (Join-Path $baseConfigPath "User-RegistryPolicies.json") -Raw | ConvertFrom-Json + + $registryFailed = @() + $registryPassed = @() + + # Verify computer settings + foreach ($setting in $computerSettings) { + # Build full registry path - KeyName has format "[SOFTWARE\..." + $keyName = $setting.KeyName -replace '^\[', '' -replace '\]$', '' + $keyPath = "Registry::HKEY_LOCAL_MACHINE\$keyName" + + try { + if (Test-Path $keyPath) { + $property = Get-ItemProperty -Path $keyPath -Name $setting.ValueName -ErrorAction SilentlyContinue + + if ($null -ne $property -and $property.PSObject.Properties.Name -contains $setting.ValueName) { + $actualValue = $property.$($setting.ValueName) + $expectedValue = $setting.Data + + # Apply standalone workstation adjustments + if (-not $isDomainJoined) { + # LocalAccountTokenFilterPolicy: 0 (domain) -> 1 (standalone) for remote admin + if ($setting.ValueName -eq "LocalAccountTokenFilterPolicy") { + $expectedValue = 1 + } + } + + # ASR Module Override: PSExec/WMI rule can be upgraded from Audit (2) to Block (1) + # Security Baseline sets it to Audit, but ASR module may upgrade to Block if user chose "No management tools" + if ($setting.ValueName -eq "d1e49aac-8f56-4280-b9ba-993a6d77406c" -and $expectedValue -eq 2 -and $actualValue -eq 1) { + # ASR upgraded from Audit to Block - this is intentional and correct + $expectedValue = 1 + } + + if ($actualValue -eq $expectedValue) { + $results.Verified++ + $registryPassed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = $expectedValue + Actual = $actualValue + } + } + else { + $results.Failed++ + $registryFailed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = $expectedValue + Actual = $actualValue + Reason = "Value mismatch" + } + } + } + else { + # Check if this is a DELETE operation (**del..., **delvals) + # For DELETE operations, "Value not found" means SUCCESS (value was deleted or never existed) + $registryCounter++ + if ($setting.ValueName -like "**del*") { + $results.Verified++ + $registryPassed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = "Deleted/Not present" + Actual = "Value not found (Success)" + } + } + else { + $results.Failed++ + $registryFailed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = $setting.Data + Actual = "Value not found" + Reason = "Value does not exist" + } + } + } + } + else { + # Check if this is a DELETE operation (**del..., **delvals) + # For DELETE operations, "Key not found" means SUCCESS (key was deleted or never existed) + $registryCounter++ + if ($setting.ValueName -like "**del*") { + $results.Verified++ + $registryPassed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = "Deleted/Not present" + Actual = "Key not found (Success)" + } + } + else { + $results.Failed++ + $registryFailed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = $setting.Data + Actual = "Key not found" + Reason = "Key does not exist" + } + } + } + } + catch { + $results.Failed++ + $registryFailed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = $setting.Data + Actual = "Error" + Reason = $_.Exception.Message + } + } + } + + # Verify user settings + foreach ($setting in $userSettings) { + # Build full registry path - KeyName has format "[SOFTWARE\..." + $keyName = $setting.KeyName -replace '^\[', '' -replace '\]$', '' + $keyPath = "Registry::HKEY_CURRENT_USER\$keyName" + + try { + if (Test-Path $keyPath) { + $property = Get-ItemProperty -Path $keyPath -Name $setting.ValueName -ErrorAction SilentlyContinue + + if ($null -ne $property -and $property.PSObject.Properties.Name -contains $setting.ValueName) { + $actualValue = $property.$($setting.ValueName) + + if ($actualValue -eq $setting.Data) { + $results.Verified++ + $registryPassed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = $setting.Data + Actual = $actualValue + } + } + else { + $results.Failed++ + $registryFailed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = $setting.Data + Actual = $actualValue + Reason = "Value mismatch" + } + } + } + else { + # Check if this is a DELETE operation (**del..., **delvals) + # For DELETE operations, "Value not found" means SUCCESS (value was deleted or never existed) + $registryCounter++ + if ($setting.ValueName -like "**del*") { + $results.Verified++ + $registryPassed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = "Deleted/Not present" + Actual = "Value not found (Success)" + } + } + else { + $results.Failed++ + $registryFailed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = $setting.Data + Actual = "Value not found" + Reason = "Value does not exist" + } + } + } + } + else { + # Check if this is a DELETE operation (**del..., **delvals) + # For DELETE operations, "Key not found" means SUCCESS (key was deleted or never existed) + $registryCounter++ + if ($setting.ValueName -like "**del*") { + $results.Verified++ + $registryPassed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = "Deleted/Not present" + Actual = "Key not found (Success)" + } + } + else { + $results.Failed++ + $registryFailed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = $setting.Data + Actual = "Key not found" + Reason = "Key does not exist" + } + } + } + } + catch { + $results.Failed++ + $registryFailed += [PSCustomObject]@{ + Path = $keyPath + Name = $setting.ValueName + Expected = $setting.Data + Actual = "Error" + Reason = $_.Exception.Message + } + } + } + + # Add to AllSettings for HTML report (with category summary) + $registryPassedCount = $results.RegistrySettings - $registryFailed.Count + $results.AllSettings += [PSCustomObject]@{ + Category = "Registry" + Total = $results.RegistrySettings + Passed = $registryPassedCount + Failed = $registryFailed.Count + PassedDetails = $registryPassed + FailedDetails = $registryFailed + } + + if ($registryFailed.Count -gt 0) { + $results.FailedSettings += [PSCustomObject]@{ + Category = "Registry" + Count = $registryFailed.Count + Details = $registryFailed + } + } + + Write-Host " Registry: $($results.RegistrySettings - $registryFailed.Count)/$($results.RegistrySettings) verified" -ForegroundColor $(if ($registryFailed.Count -eq 0) { "Green" } else { "Yellow" }) +} +catch { + Write-Host " ERROR: $_" -ForegroundColor Red +} + +Write-Host "[2/$totalSteps] Verifying Audit Policies (23)..." -ForegroundColor Yellow + +try { + # Get current audit policies + $auditOutput = auditpol /get /category:* /r | ConvertFrom-Csv + + # Load expected audit policies + $auditSettings = Get-Content (Join-Path $baseConfigPath "AuditPolicies.json") -Raw | ConvertFrom-Json + + $auditFailed = @() + $auditPassed = @() + + foreach ($policy in $auditSettings) { + # Skip if Subcategory is null or empty + if ([string]::IsNullOrWhiteSpace($policy.Subcategory)) { + continue + } + + # Use GUID directly from JSON (already includes braces and correct case) + $guid = $policy.SubcategoryGUID + + if ($guid) { + # Language-independent column detection + # Find column containing "GUID" (works for English, German, French, etc.) + $guidColumn = ($auditOutput[0].PSObject.Properties.Name | Where-Object { $_ -like "*GUID*" }) | Select-Object -First 1 + + # Find column for inclusion setting (various languages) + # English: "Inclusion Setting", German: "Aufnahmeeinstellung", etc. + $inclusionColumn = ($auditOutput[0].PSObject.Properties.Name | Where-Object { + $_ -like "*Inclusion*" -or $_ -like "*Aufnahme*" -or $_ -like "*Setting*" + }) | Select-Object -First 1 + + if (-not $guidColumn -or -not $inclusionColumn) { + Write-Host " WARNING: Could not detect CSV column names - language compatibility issue" -ForegroundColor Yellow + continue + } + + # Case-insensitive comparison for GUID matching + $currentPolicy = $auditOutput | Where-Object { $_.$guidColumn -eq $guid } + + if ($currentPolicy) { + # Use language-independent numeric comparison + # SettingValue: 0=No Auditing, 1=Success, 2=Failure, 3=Success and Failure + $expectedValue = [int]$policy.SettingValue + + # Get actual value from auditpol output + # Convert text to numeric (language-independent) + $actualText = $currentPolicy.$inclusionColumn + $actualValue = 0 + + # auditpol text values are language-specific, so check all possibilities + # English: Success, Failure, Success and Failure, No Auditing + # German: Erfolg, Fehler, Erfolg und Fehler, Keine Ueberwachung + if ($actualText -match "Success.*Failure|Erfolg.*Fehler") { $actualValue = 3 } + elseif ($actualText -match "Success|Erfolg") { $actualValue = 1 } + elseif ($actualText -match "Failure|Fehler") { $actualValue = 2 } + else { $actualValue = 0 } + + if ($actualValue -eq $expectedValue) { + $results.Verified++ + $auditPassed += [PSCustomObject]@{ + Policy = $policy.Subcategory + Expected = $policy.SettingValue + Actual = $actualValue + } + } + else { + $results.Failed++ + $auditFailed += [PSCustomObject]@{ + Policy = $policy.Subcategory + Expected = $policy.SettingValue + Actual = $actualValue + GUID = $guid + } + } + } + else { + # Policy not found - this should never happen unless GUID mismatch + # Treat as "No Auditing" (most likely state if not explicitly configured) + $results.Failed++ + $auditFailed += [PSCustomObject]@{ + Policy = $policy.Subcategory + Expected = $policy.InclusionSetting + Actual = "No Auditing" + GUID = $guid + } + } + } + else { + # GUID is empty/null - this policy will be skipped + } + } + + # Add to AllSettings for HTML report + $auditPassedCount = $results.AuditPolicies - $auditFailed.Count + $results.AllSettings += [PSCustomObject]@{ + Category = "AuditPolicies" + Total = $results.AuditPolicies + Passed = $auditPassedCount + Failed = $auditFailed.Count + PassedDetails = $auditPassed + FailedDetails = $auditFailed + } + + if ($auditFailed.Count -gt 0) { + $results.FailedSettings += [PSCustomObject]@{ + Category = "AuditPolicies" + Count = $auditFailed.Count + Details = $auditFailed + } + } + + Write-Host " Audit Policies: $($results.AuditPolicies - $auditFailed.Count)/$($results.AuditPolicies) verified" -ForegroundColor $(if ($auditFailed.Count -eq 0) { "Green" } else { "Yellow" }) +} +catch { + Write-Host " ERROR: $_" -ForegroundColor Red +} + +Write-Host "[3/$totalSteps] Verifying Security Template Settings (67)..." -ForegroundColor Yellow + +try { + # Export current security settings + $tempFile = Join-Path $env:TEMP "current_secedit.inf" + secedit /export /cfg $tempFile /quiet | Out-Null + + # Load expected settings + $expectedSettings = Get-Content (Join-Path $baseConfigPath "SecurityTemplates.json") -Raw | ConvertFrom-Json + + # Parse secedit output + $currentSettings = Get-Content $tempFile + + $securityFailed = @() + $securityPassed = @() + $securityVerified = 0 + + # Check if domain-joined + $isDomainJoined = (Get-CimInstance Win32_ComputerSystem).PartOfDomain + + # Verify each GPO + foreach ($gpoName in $expectedSettings.PSObject.Properties.Name) { + # Note: We do NOT skip Domain Security on standalone! + # The standalone delta modifies 1 setting (LocalAccountTokenFilterPolicy), + # but all 67 settings are still applied and should be verified. + + $gpo = $expectedSettings.$gpoName + + foreach ($sectionName in $gpo.PSObject.Properties.Name) { + # Skip metadata sections (Unicode, Version) + if ($sectionName -in @("Unicode", "Version")) { + continue + } + + $section = $gpo.$sectionName + + # Iterate through actual settings in this section + foreach ($settingProperty in $section.PSObject.Properties) { + $settingName = $settingProperty.Name + $expectedValue = $settingProperty.Value + + # Find in current settings - look in the matching INI section + $inSection = $false + $actualValue = $null + + foreach ($line in $currentSettings) { + # Check if we're in the right section + if ($line -match "^\[$sectionName\]") { + $inSection = $true + continue + } + elseif ($line -match "^\[") { + $inSection = $false + } + + # If in right section, look for setting + $escapedName = [regex]::Escape($settingName) + if ($inSection -and $line -match "^$escapedName\s*=") { + $actualValue = ($line -split '=', 2)[1].Trim() + break + } + } + + if ($null -ne $actualValue) { + # Special handling for Privilege Rights - compare SID sets (order-independent) + $isMatch = $false + if ($sectionName -eq "Privilege Rights") { + # Split SIDs and compare as sets + $expectedSIDs = $expectedValue -split ',' | ForEach-Object { $_.Trim() } | Sort-Object + $actualSIDs = $actualValue -split ',' | ForEach-Object { $_.Trim() } | Sort-Object + + # Compare arrays (order-independent) + if ($expectedSIDs.Count -eq $actualSIDs.Count) { + $isMatch = $true + for ($i = 0; $i -lt $expectedSIDs.Count; $i++) { + if ($expectedSIDs[$i] -ne $actualSIDs[$i]) { + $isMatch = $false + break + } + } + } + } + else { + # Normal string comparison for non-Privilege Rights + $isMatch = ($actualValue -eq $expectedValue) + } + + if ($isMatch) { + $securityVerified++ + $results.Verified++ + $securityPassed += [PSCustomObject]@{ + GPO = $gpoName + Section = $sectionName + Setting = $settingName + Expected = $expectedValue + Actual = $actualValue + } + } + else { + $results.Failed++ + $securityFailed += [PSCustomObject]@{ + GPO = $gpoName + Section = $sectionName + Setting = $settingName + Expected = $expectedValue + Actual = $actualValue + } + } + } + else { + # Setting not found in secedit output + # There are legitimate cases where "Not found" = SUCCESS: + + # 1. Xbox services may not exist on clean installations + $xboxServices = @("XboxGipSvc", "XblAuthManager", "XblGameSave", "XboxNetApiSvc") + if ($sectionName -eq "Service General Setting" -and $settingName -in $xboxServices) { + $securityVerified++ + $results.Verified++ + $securityPassed += [PSCustomObject]@{ + GPO = $gpoName + Section = $sectionName + Setting = $settingName + Expected = $expectedValue + Actual = "Not found (Xbox service not installed - OK)" + } + } + # 2. Privilege Rights with empty expected value (nobody should have this right) + # If secedit doesn't list it, it means nobody has it = SUCCESS + elseif ($sectionName -eq "Privilege Rights" -and [string]::IsNullOrEmpty($expectedValue)) { + $securityVerified++ + $results.Verified++ + $securityPassed += [PSCustomObject]@{ + GPO = $gpoName + Section = $sectionName + Setting = $settingName + Expected = "Empty (nobody has right)" + Actual = "Not found (Success)" + } + } + # 3. Privilege Rights that are edition/domain-specific and may not exist + # These are NOT APPLICABLE on standalone/non-Enterprise systems + elseif ($sectionName -eq "Privilege Rights") { + $editionSpecificRights = @( + "SeEnableDelegationPrivilege", # Enterprise/Domain only + "SeTrustedCredManAccessPrivilege", # May not exist on Home + "SeRelabelPrivilege", # May not exist on Home + "SeSyncAgentPrivilege" # Domain controllers only + ) + + # Domain-specific rights that don't apply to standalone systems + # These deny local admin accounts (*S-1-5-113) from remote/network access + # On standalone, local admins ARE the only admins, so denying them makes no sense + $domainOnlyDenyRights = @( + "SeDenyRemoteInteractiveLogonRight", # Deny RDP for local admins (Domain-only) + "SeDenyNetworkLogonRight" # Deny network logon for local admins (Domain-only) + ) + + if ($settingName -in $editionSpecificRights) { + # Edition-specific right not found = N/A (treat as success) + $securityVerified++ + $results.Verified++ + $securityPassed += [PSCustomObject]@{ + GPO = $gpoName + Section = $sectionName + Setting = $settingName + Expected = $expectedValue + Actual = "Not found (Edition-specific - N/A)" + } + } + elseif (-not $isDomainJoined -and $settingName -in $domainOnlyDenyRights) { + # Domain-only deny rights on standalone system = N/A (treat as success) + # These settings are meant to separate Domain Admins from Local Admins + # On standalone, there are no Domain Admins, so these don't apply + $securityVerified++ + $results.Verified++ + $securityPassed += [PSCustomObject]@{ + GPO = $gpoName + Section = $sectionName + Setting = $settingName + Expected = $expectedValue + Actual = "Not found (Domain-only on standalone - N/A)" + } + } + else { + # This privilege SHOULD exist on all editions - it's missing! + $results.Failed++ + $securityFailed += [PSCustomObject]@{ + GPO = $gpoName + Section = $sectionName + Setting = $settingName + Expected = $expectedValue + Actual = "Not found (should exist on this edition)" + } + } + } + else { + $results.Failed++ + $securityFailed += [PSCustomObject]@{ + GPO = $gpoName + Section = $sectionName + Setting = $settingName + Expected = $expectedValue + Actual = "Not found" + } + } + } + } + } + } + + # Add to AllSettings for HTML report + $securityPassedCount = $results.SecurityTemplate - $securityFailed.Count + $results.AllSettings += [PSCustomObject]@{ + Category = "SecurityTemplate" + Total = $results.SecurityTemplate + Passed = $securityPassedCount + Failed = $securityFailed.Count + PassedDetails = $securityPassed + FailedDetails = $securityFailed + } + + if ($securityFailed.Count -gt 0) { + $results.FailedSettings += [PSCustomObject]@{ + Category = "SecurityTemplate" + Count = $securityFailed.Count + Details = $securityFailed + } + } + + Remove-Item $tempFile -Force -ErrorAction SilentlyContinue + + Write-Host " Security Template: $securityVerified/$($results.SecurityTemplate) verified" -ForegroundColor $(if ($securityFailed.Count -eq 0) { "Green" } else { "Yellow" }) +} +catch { + Write-Host " ERROR: $_" -ForegroundColor Red +} + +Write-Host "[4/$totalSteps] Verifying ASR Rules (19)..." -ForegroundColor Yellow + +try { + # Check if Windows Defender is active or if third-party AV is managing security + $thirdPartyAV = $null + $defenderManaged = $true + + try { + # Check for third-party AV products + $avProducts = Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName "AntiVirusProduct" -ErrorAction SilentlyContinue + $thirdPartyAV = $avProducts | Where-Object { $_.displayName -notmatch "Windows Defender|Microsoft Defender" } | Select-Object -First 1 + + if ($thirdPartyAV) { + # Try to access Defender - if it fails, third-party AV is managing + try { + $null = Get-MpPreference -ErrorAction Stop + } + catch { + $defenderManaged = $false + } + } + } + catch { + # SecurityCenter2 not available - assume Defender is active + $null = $null # Intentionally empty - suppress PSScriptAnalyzer warning + } + + # If third-party AV is managing ASR (Defender unavailable) + if (-not $defenderManaged -and $thirdPartyAV) { + Write-Host " Third-party AV detected: $($thirdPartyAV.displayName)" -ForegroundColor Cyan + Write-Host " ASR rules are managed by your antivirus solution" -ForegroundColor Green + + # Count all ASR rules as verified (AV is handling protection) + $results.Verified += $EXPECTED_ASR_COUNT + + $results.AllSettings += [PSCustomObject]@{ + Category = "ASR" + Total = $EXPECTED_ASR_COUNT + Passed = $EXPECTED_ASR_COUNT + Failed = 0 + PassedDetails = @([PSCustomObject]@{ Rule = "All rules"; Expected = "Managed by $($thirdPartyAV.displayName)"; Actual = "Protected" }) + FailedDetails = @() + } + + Write-Host " ASR: $EXPECTED_ASR_COUNT/$EXPECTED_ASR_COUNT verified (Third-Party AV)" -ForegroundColor Green + } + else { + # Defender is active - verify ASR rules normally + $mpPreference = Get-MpPreference + $currentASRIds = $mpPreference.AttackSurfaceReductionRules_Ids + $currentASRActions = $mpPreference.AttackSurfaceReductionRules_Actions + + # Load expected ASR rules - JSON is array directly + $asrRules = Get-Content (Join-Path $asrConfigPath "ASR-Rules.json") -Raw | ConvertFrom-Json + + $asrFailed = @() + $asrPassed = @() + + # Check if ASR rules are configured at all + if ($null -eq $currentASRIds -or $currentASRIds.Count -eq 0) { + # No ASR rules configured - mark all as failed + foreach ($rule in $asrRules) { + $results.Failed++ + $expectedActionText = if ($rule.Action -eq 1) { "Block" } elseif ($rule.Action -eq 2) { "Audit" } else { "Disabled" } + $asrFailed += [PSCustomObject]@{ + Rule = $rule.Name + GUID = $rule.GUID + Expected = $expectedActionText + Actual = "Not configured" + } + } + } + else { + # Rules where both BLOCK (1) and AUDIT (2) are considered "Pass" + # These are user-configurable rules where either mode is valid + $flexibleRules = @( + "d1e49aac-8f56-4280-b9ba-993a6d77406c", # PSExec/WMI (Management Tools) + "01443614-cd74-433a-b99e-2ecdc07bfc25" # Prevalence (New/Unknown Software) + ) + + foreach ($rule in $asrRules) { + # Case-insensitive GUID matching (Get-MpPreference may return different case) + $index = -1 + for ($i = 0; $i -lt $currentASRIds.Count; $i++) { + if ($currentASRIds[$i] -eq $rule.GUID) { + $index = $i + break + } + } + + if ($index -ge 0) { + $actualAction = $currentASRActions[$index] + $expectedAction = $rule.Action + + # Check if this is a flexible rule (Block or Audit both count as Pass) + $isFlexibleRule = $flexibleRules -contains $rule.GUID + $isActiveMode = $actualAction -in @(1, 2) # Block or Audit + + # For flexible rules: Pass if Block OR Audit + # For other rules: Pass only if exact match + $rulePassed = if ($isFlexibleRule) { $isActiveMode } else { $actualAction -eq $expectedAction } + + if ($rulePassed) { + $results.Verified++ + $actionText = if ($actualAction -eq 1) { "Block" } elseif ($actualAction -eq 2) { "Audit" } else { "Disabled" } + $asrPassed += [PSCustomObject]@{ + Rule = $rule.Name + Expected = $actionText + Actual = $actionText + } + } + else { + $results.Failed++ + $expectedActionText = if ($expectedAction -eq 1) { "Block" } elseif ($expectedAction -eq 2) { "Audit" } else { "Disabled" } + $actualActionText = if ($actualAction -eq 1) { "Block" } elseif ($actualAction -eq 2) { "Audit" } else { "Disabled" } + $asrFailed += [PSCustomObject]@{ + Rule = $rule.Name + GUID = $rule.GUID + Expected = $expectedActionText + Actual = $actualActionText + } + } + } + else { + $results.Failed++ + $expectedActionText = if ($rule.Action -eq 1) { "Block" } elseif ($rule.Action -eq 2) { "Audit" } else { "Disabled" } + $asrFailed += [PSCustomObject]@{ + Rule = $rule.Name + GUID = $rule.GUID + Expected = $expectedActionText + Actual = "Not configured" + } + } + } + } + + # Add to AllSettings for HTML report + $asrPassedCount = $results.ASRRules - $asrFailed.Count + $results.AllSettings += [PSCustomObject]@{ + Category = "ASR" + Total = $results.ASRRules + Passed = $asrPassedCount + Failed = $asrFailed.Count + PassedDetails = $asrPassed + FailedDetails = $asrFailed + } + + if ($asrFailed.Count -gt 0) { + $results.FailedSettings += [PSCustomObject]@{ + Category = "ASR" + Count = $asrFailed.Count + Details = $asrFailed + } + } + + Write-Host " ASR Rules: $($results.ASRRules - $asrFailed.Count)/$($results.ASRRules) verified" -ForegroundColor $(if ($asrFailed.Count -eq 0) { "Green" } else { "Yellow" }) + } # End of else (Defender active) +} +catch { + Write-Host " ERROR: $_" -ForegroundColor Red +} + +# [ALWAYS] DNS Configuration (5 checks) +Write-Host "[5/$totalSteps] Verifying DNS Configuration (5 checks)..." -ForegroundColor Yellow + +try { + $dnsFailed = @() + $dnsPassed = @() + + # Get all physical network adapters (including Disconnected for offline verification) + $adapters = Get-NetAdapter | Where-Object { ($_.Status -eq 'Up' -or $_.Status -eq 'Disconnected') -and $_.Virtual -eq $false } + + # Ensure $adapters is an array (even if empty) + if ($null -eq $adapters) { + $adapters = @() + } + elseif ($adapters -isnot [array]) { + $adapters = @($adapters) + } + + if ($adapters.Count -eq 0) { + Write-Host " DNS: No physical adapters - marking all 5 checks as FAILED" -ForegroundColor Yellow + # CRITICAL: Must count all 5 DNS checks as Failed when no adapters exist! + $results.Failed += 5 + $dnsFailed += [PSCustomObject]@{ + Check = "DNS Configuration (All 5 checks)" + Expected = "Physical network adapter required" + Actual = "No active physical adapters found" + } + } + else { + # Known secure DNS providers used by the framework (IPv4 + IPv6) + $knownDNSv4 = @('1.1.1.1', '1.0.0.1', '9.9.9.9', '149.112.112.112', '94.140.14.14', '94.140.15.15') + $knownDNSv6 = @('2606:4700:4700::1111', '2606:4700:4700::1001', '2620:fe::fe', '2620:fe::9', '2a10:50c0::ad1:ff', '2a10:50c0::ad2:ff') + $knownDNSAll = $knownDNSv4 + $knownDNSv6 + + # Collect current IPv4 DNS servers on physical adapters + $configuredDnsV4 = @() + foreach ($adapter in $adapters) { + $dnsInfo = Get-DnsClientServerAddress -InterfaceAlias $adapter.Name -AddressFamily IPv4 -ErrorAction SilentlyContinue + if ($dnsInfo) { + foreach ($entry in $dnsInfo) { + if ($entry.ServerAddresses) { + $configuredDnsV4 += $entry.ServerAddresses + } + } + } + } + $configuredDnsV4 = $configuredDnsV4 | Where-Object { $_ } | Select-Object -Unique + + # Collect DoH configuration for known provider IPs + $dohSettings = $null + $providerDohEntries = @() + try { + $dohSettings = Get-DnsClientDohServerAddress -ErrorAction SilentlyContinue + } + catch { + $dohSettings = $null + } + + if ($dohSettings) { + $providerDohEntries = $dohSettings | Where-Object { $knownDNSAll -contains $_.ServerAddress } + } + + # Check 1: DNS Servers (IPv4) from supported secure providers + $dnsConfigured = $false + if ($configuredDnsV4 | Where-Object { $knownDNSv4 -contains $_ }) { + $dnsConfigured = $true + } + + if ($dnsConfigured) { + $results.Verified++ + $providerNames = ($configuredDnsV4 | Where-Object { $knownDNSv4 -contains $_ }) -join ', ' + $dnsPassed += [PSCustomObject]@{ + Check = "DNS Servers (IPv4)" + Expected = "Cloudflare/Quad9/AdGuard" + Actual = $providerNames + } + } + else { + $results.Failed++ + $dnsFailed += [PSCustomObject]@{ + Check = "DNS Servers (IPv4)" + Expected = "Cloudflare/Quad9/AdGuard" + Actual = "Not configured or DHCP" + } + } + + # Check 2: DNS over HTTPS (DoH) configured for provider servers + $dohConfigured = $false + + if ($providerDohEntries -and $providerDohEntries.Count -gt 0) { + $dohConfigured = $true + } + else { + # Fallback: Check global DoH registry for known provider IPv4 addresses + $dohRegPath = "HKLM:\System\CurrentControlSet\Services\Dnscache\Parameters\DohInterfaceSettings\Doh" + if (Test-Path $dohRegPath) { + $dohKeys = Get-ChildItem -Path $dohRegPath -ErrorAction SilentlyContinue + foreach ($key in $dohKeys) { + if ($knownDNSv4 -contains $key.PSChildName) { + $dohFlags = (Get-ItemProperty -Path $key.PSPath -Name "DohFlags" -ErrorAction SilentlyContinue).DohFlags + if ($dohFlags -ge 1) { + # 1 = Encrypted Only, 2 = Encrypted Preferred + $dohConfigured = $true + break + } + } + } + } + } + + if ($dohConfigured) { + $results.Verified++ + $dnsPassed += [PSCustomObject]@{ + Check = "DNS over HTTPS (DoH)" + Expected = "Enabled (Cloudflare/Quad9/AdGuard)" + Actual = "Enabled" + } + } + else { + $results.Failed++ + $dnsFailed += [PSCustomObject]@{ + Check = "DNS over HTTPS (DoH)" + Expected = "Enabled (Cloudflare/Quad9/AdGuard)" + Actual = "Not configured" + } + } + + # Check 3: DoH policy / fallback consistency (REQUIRE vs ALLOW) + $policyOk = $false + $policyValue = $null + try { + $dnsClientPolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" + $policyValue = (Get-ItemProperty -Path $dnsClientPolicyPath -Name "DoHPolicy" -ErrorAction SilentlyContinue).DoHPolicy + } + catch { + $policyValue = $null + } + + if ($dohConfigured -and $policyValue) { + switch ([int]$policyValue) { + 3 { + # REQUIRE mode: all provider DoH entries must have fallback disabled + if ($providerDohEntries -and $providerDohEntries.Count -gt 0) { + $fallbackFlags = $providerDohEntries | Select-Object -ExpandProperty AllowFallbackToUdp + if ($fallbackFlags -and ($fallbackFlags -notcontains $true)) { + $policyOk = $true + } + } + } + 2 { + # ALLOW mode: presence of provider DoH entries is sufficient (user explicitly allowed fallback) + if ($providerDohEntries -and $providerDohEntries.Count -gt 0) { + $policyOk = $true + } + } + } + } + + if ($policyOk) { + $results.Verified++ + $policyText = if ([int]$policyValue -eq 3) { "REQUIRE (no fallback)" } else { "ALLOW (with fallback)" } + $dnsPassed += [PSCustomObject]@{ + Check = "DoH Policy / Fallback" + Expected = "REQUIRE (no fallback) or ALLOW with valid provider DoH" + Actual = $policyText + } + } + else { + $results.Failed++ + $dnsFailed += [PSCustomObject]@{ + Check = "DoH Policy / Fallback" + Expected = "REQUIRE (no fallback) or ALLOW with valid provider DoH" + Actual = "Policy missing, unsupported value, or inconsistent with DoH servers" + } + } + + # Check 4: DNS connectivity (configured provider servers preferred) + $dnsResponds = $false + $testDNS = @() + + if ($configuredDnsV4) { + $testDNS = $configuredDnsV4 | Where-Object { $knownDNSv4 -contains $_ } | Select-Object -Unique + } + if (-not $testDNS) { + # Fallback to standard list if no provider DNS is currently configured + $testDNS = @('1.1.1.1', '9.9.9.9', '94.140.14.14') + } + + foreach ($dns in $testDNS) { + $ping = Test-Connection -ComputerName $dns -Count 1 -Quiet -ErrorAction SilentlyContinue + if ($ping) { + $dnsResponds = $true + break + } + } + + if ($dnsResponds) { + $results.Verified++ + $dnsPassed += [PSCustomObject]@{ + Check = "DNS Connectivity" + Expected = "At least one DNS server responds" + Actual = "DNS server reachable" + } + } + else { + $results.Failed++ + $dnsFailed += [PSCustomObject]@{ + Check = "DNS Connectivity" + Expected = "At least one DNS server responds" + Actual = "No response (offline or blocked)" + } + } + + # Check 5: Static DNS configuration (manual, not DHCP) + $staticDNS = $false + + # In ALLOW mode (DoHPolicy = 2) with valid provider DoH configuration ($policyOk), + # static DNS is considered optional (VPN/mobile/enterprise scenarios). + if ($policyOk -and $policyValue -and [int]$policyValue -eq 2) { + $staticDNS = $true + } + else { + foreach ($adapter in $adapters) { + $dnsInfo = Get-DnsClientServerAddress -InterfaceIndex $adapter.InterfaceIndex -AddressFamily IPv4 -ErrorAction SilentlyContinue + if ($dnsInfo) { + foreach ($entry in $dnsInfo) { + # Accept 'Manual', 'Static', or any configured DNS that matches known providers + # Windows may report 'Static' or 'Manual' depending on timing and method + if ($entry.ServerAddresses -and $entry.ServerAddresses.Count -gt 0) { + # Check if it's not DHCP (empty or localhost fallback) + $isDHCP = ($entry.ServerAddresses.Count -eq 0) -or + ($entry.ServerAddresses -contains '127.0.0.1') -or + ($entry.AddressOrigin -eq 'DHCP') + + if (-not $isDHCP) { + $staticDNS = $true + break + } + } + } + } + if ($staticDNS) { break } + } + } + + if ($staticDNS) { + $results.Verified++ + $staticReason = if ($policyOk -and $policyValue -and [int]$policyValue -eq 2) { "ALLOW mode (optional)" } else { "Manual configuration" } + $dnsPassed += [PSCustomObject]@{ + Check = "Static DNS Configuration" + Expected = "Static DNS servers configured" + Actual = $staticReason + } + } + else { + $results.Failed++ + $dnsFailed += [PSCustomObject]@{ + Check = "Static DNS Configuration" + Expected = "Static DNS servers configured" + Actual = "DNS from DHCP or not configured" + } + } + } + + # Add to AllSettings for HTML report + $dnsPassedCount = $results.DNSChecks - $dnsFailed.Count + $results.AllSettings += [PSCustomObject]@{ + Category = "DNS" + Total = $results.DNSChecks + Passed = $dnsPassedCount + Failed = $dnsFailed.Count + PassedDetails = $dnsPassed + FailedDetails = $dnsFailed + } + + if ($dnsFailed.Count -gt 0) { + $results.FailedSettings += [PSCustomObject]@{ + Category = "DNS" + Count = $dnsFailed.Count + Details = $dnsFailed + } + } + + Write-Host " DNS: $($results.DNSChecks - $dnsFailed.Count)/$($results.DNSChecks) verified" -ForegroundColor $(if ($dnsFailed.Count -eq 0) { "Green" } else { "Yellow" }) +} +catch { + Write-Host " ERROR: $_" -ForegroundColor Red +} + +# [ALWAYS] Privacy Compliance Checks (loaded dynamically from JSON) +# Source: Privacy-MSRecommended.json (registry settings) + Bloatware apps list +Write-Host "[6/$totalSteps] Verifying Privacy Compliance ($EXPECTED_PRIVACY_COUNT)..." -ForegroundColor Yellow + +try { + $privacyFailed = @() + $privacyPassed = @() + + # ========================================================================== + # LOAD REGISTRY CHECKS FROM Privacy-MSRecommended.json (Single Source of Truth) + # ========================================================================== + $privacyJsonPath = Join-Path $rootPath "Modules\Privacy\Config\Privacy-MSRecommended.json" + $privacyChecks = Get-RegistryChecksFromJson -JsonPath $privacyJsonPath + + # Verify each registry setting from JSON + # Uses -AllowStricter to accept values that are MORE restrictive than MSRecommended baseline + # Example: If baseline says "User decides" (0) but system has "Force Deny" (2), that's stricter = PASS + foreach ($check in $privacyChecks) { + # Convert JSON path format (HKLM:\\...) to PowerShell format (HKLM:\...) + $regPath = $check.Path -replace '\\\\', '\' + + # -AllowStricter: Accept stricter values than baseline (e.g., Strict/Paranoid profile applied) + $passed = Test-RegistryValue -Path $regPath -Name $check.Name -ExpectedValue $check.Value -AllowStricter + + $actual = Get-ActualRegistryValue -Path $regPath -Name $check.Name + + if ($passed) { + $results.Verified++ + $privacyPassed += [PSCustomObject]@{ + Setting = $check.Desc + Path = "$regPath\$($check.Name)" + Expected = "$($check.Value) (or stricter)" + Actual = $actual + } + } + else { + $results.Failed++ + + $privacyFailed += [PSCustomObject]@{ + Setting = $check.Desc + Path = "$regPath\$($check.Name)" + Expected = $check.Value + Actual = $actual + } + } + } + + # ========================================================================== + # BLOATWARE CHECKS (loaded from Bloatware.json) + # ========================================================================== + $bloatwareJsonPath = Join-Path $rootPath "Modules\Privacy\Config\Bloatware.json" + $bloatwareApps = @() + + if (Test-Path $bloatwareJsonPath) { + $bloatwareConfig = Get-Content $bloatwareJsonPath -Raw | ConvertFrom-Json + + # Extract app names from ClassicMethod.RemoveApps list + if ($bloatwareConfig.ClassicMethod -and $bloatwareConfig.ClassicMethod.RemoveApps) { + $bloatwareApps = $bloatwareConfig.ClassicMethod.RemoveApps + } + } + + # Fallback if JSON not found or empty + if ($bloatwareApps.Count -eq 0) { + $bloatwareApps = @( + 'Microsoft.BingNews', 'Microsoft.BingWeather', + 'Microsoft.MicrosoftSolitaireCollection', 'Microsoft.MicrosoftStickyNotes', + 'Microsoft.GamingApp', 'Microsoft.XboxApp', + 'Microsoft.XboxGamingOverlay', 'Microsoft.XboxIdentityProvider', + 'Microsoft.XboxSpeechToTextOverlay', 'Microsoft.Xbox.TCUI', + 'Microsoft.ZuneMusic', 'Microsoft.ZuneVideo', + 'Microsoft.WindowsFeedbackHub', 'Microsoft.GetHelp', 'Microsoft.Getstarted', + 'Microsoft.MixedReality.Portal', 'Microsoft.People', 'Microsoft.YourPhone', + 'Clipchamp.Clipchamp', 'SpotifyAB.SpotifyMusic', 'TikTok.TikTok', + 'king.com.CandyCrushSaga', 'Disney.DisneyPlus', 'Facebook.Facebook' + ) + } + + # Apps that are intentionally NOT removed (cannot be reinstalled via winget msstore) + $nonRestorableApps = @('Microsoft.Xbox.TCUI', 'Microsoft.XboxSpeechToTextOverlay', 'Microsoft.MicrosoftSolitaireCollection') + + foreach ($app in $bloatwareApps) { + $isInstalled = Get-AppxPackage -Name $app -ErrorAction SilentlyContinue + + # Non-restorable apps: Pass regardless of installed state (intentionally kept) + if ($nonRestorableApps -contains $app) { + $results.Verified++ + $privacyPassed += [PSCustomObject]@{ + Setting = "Bloatware: $app" + Path = "AppxPackage" + Expected = "Kept (Non-Restorable)" + Actual = if ($null -eq $isInstalled) { "Not installed" } else { "Kept (not in winget msstore)" } + } + continue + } + + if ($null -eq $isInstalled) { + $results.Verified++ # App removed = success + $privacyPassed += [PSCustomObject]@{ + Setting = "Bloatware: $app" + Path = "AppxPackage" + Expected = "Removed" + Actual = "Not installed (Success)" + } + } + else { + $results.Failed++ + $privacyFailed += [PSCustomObject]@{ + Setting = "Bloatware: $app" + Path = "AppxPackage" + Expected = "Removed" + Actual = "Still installed" + } + } + } + + # Calculate totals + $registryCheckCount = $privacyChecks.Count + $actualPrivacyTotal = $registryCheckCount + $bloatwareApps.Count + $privacyPassedCount = $actualPrivacyTotal - $privacyFailed.Count + + # Add to AllSettings for HTML report + $results.AllSettings += [PSCustomObject]@{ + Category = "Privacy" + Total = $actualPrivacyTotal + Passed = $privacyPassedCount + Failed = $privacyFailed.Count + PassedDetails = $privacyPassed + FailedDetails = $privacyFailed + } + + if ($privacyFailed.Count -gt 0) { + $results.FailedSettings += [PSCustomObject]@{ + Category = "Privacy" + Count = $privacyFailed.Count + Details = $privacyFailed + } + } + + Write-Host " Privacy: $privacyPassedCount/$actualPrivacyTotal verified ($registryCheckCount registry + $($bloatwareApps.Count) bloatware)" -ForegroundColor $(if ($privacyFailed.Count -eq 0) { "Green" } else { "Yellow" }) + + # Update global results object with actual Privacy count + $results.PrivacyChecks = $actualPrivacyTotal +} +catch { + Write-Host " ERROR: $_" -ForegroundColor Red +} + +# [ALWAYS] AntiAI Policies (loaded dynamically from JSON) +# Source: AntiAI-Settings.json (Single Source of Truth) +Write-Host "[7/$totalSteps] Verifying AntiAI Policies ($EXPECTED_ANTIAI_COUNT)..." -ForegroundColor Yellow + +try { + $antiAIFailed = @() + $antiAIPassed = @() + + # ========================================================================== + # LOAD REGISTRY CHECKS FROM AntiAI-Settings.json (Single Source of Truth) + # ========================================================================== + $antiAIJsonPath = Join-Path $rootPath "Modules\AntiAI\Config\AntiAI-Settings.json" + $antiAIChecks = Get-RegistryChecksFromJson -JsonPath $antiAIJsonPath + + # Verify each AntiAI registry setting from JSON + # MultiString policies count as 1 check (consistent with Test-AntiAICompliance.ps1) + $actualCheckCount = 0 + + foreach ($check in $antiAIChecks) { + # Convert JSON path format (HKLM:\\...) to PowerShell format (HKLM:\...) + $regPath = $check.Path -replace '\\\\', '\' + $actualCheckCount++ + + if ($check.Value -is [array]) { + # MultiString-Policies: count as 1 check, PASS if all expected items present + $actual = $null + try { + if (Test-Path $regPath) { + $prop = Get-ItemProperty -Path $regPath -Name $check.Name -ErrorAction SilentlyContinue + if ($null -ne $prop -and $prop.PSObject.Properties.Name -contains $check.Name) { + $actual = $prop.$($check.Name) + } + } + } + catch { + $actual = $null + } + + $actualArray = @() + if ($actual -is [array]) { + $actualArray = $actual + } + elseif ($null -ne $actual) { + $actualArray = @($actual) + } + + # Check if ALL expected items are present + $allPresent = $true + foreach ($item in $check.Value) { + if ($actualArray -notcontains $item) { + $allPresent = $false + break + } + } + + if ($allPresent) { + $results.Verified++ + $antiAIPassed += [PSCustomObject]@{ + Policy = $check.Desc + Path = "$regPath\$($check.Name)" + Expected = "$($check.Value.Count) items" + Actual = "$($actualArray.Count) items" + } + } + else { + $results.Failed++ + $antiAIFailed += [PSCustomObject]@{ + Policy = $check.Desc + Path = "$regPath\$($check.Name)" + Expected = "$($check.Value.Count) items" + Actual = if ($actualArray.Count -gt 0) { "$($actualArray.Count) items" } else { "Not set" } + } + } + } + else { + # Simple Registry-Policy (DWORD/String) + $passed = Test-RegistryValue -Path $regPath -Name $check.Name -ExpectedValue $check.Value + + if ($passed) { + $results.Verified++ + $antiAIPassed += [PSCustomObject]@{ + Policy = $check.Desc + Path = "$regPath\$($check.Name)" + Expected = $check.Value + Actual = $check.Value + } + } + else { + $results.Failed++ + $actual = Get-ActualRegistryValue -Path $regPath -Name $check.Name + $antiAIFailed += [PSCustomObject]@{ + Policy = $check.Desc + Path = "$regPath\$($check.Name)" + Expected = $check.Value + Actual = $actual + } + } + } + } + + # Update AntiAI-Total with actual check count (incl. MultiString individual checks) + $results.AntiAIPolicies = $actualCheckCount + + # Add to AllSettings for HTML report + $antiAIPassedCount = $actualCheckCount - $antiAIFailed.Count + $results.AllSettings += [PSCustomObject]@{ + Category = "AntiAI" + Total = $actualCheckCount + Passed = $antiAIPassedCount + Failed = $antiAIFailed.Count + PassedDetails = $antiAIPassed + FailedDetails = $antiAIFailed + } + + if ($antiAIFailed.Count -gt 0) { + $results.FailedSettings += [PSCustomObject]@{ + Category = "AntiAI" + Count = $antiAIFailed.Count + Details = $antiAIFailed + } + } + + Write-Host " AntiAI: $antiAIPassedCount/$actualCheckCount verified" -ForegroundColor $(if ($antiAIFailed.Count -eq 0) { "Green" } else { "Yellow" }) +} +catch { + Write-Host " ERROR: $_" -ForegroundColor Red +} + +# [ALWAYS] EdgeHardening Configuration (24 policies) +$edgeStep = 8 +Write-Host "[$edgeStep/$totalSteps] Verifying EdgeHardening Policies ($EXPECTED_EDGE_COUNT)..." -ForegroundColor Yellow + +try { + $edgeFailed = @() + $edgePassed = @() + + # Load Edge policies configuration + $edgeConfigPath = Join-Path $rootPath "Modules\EdgeHardening\Config\EdgePolicies.json" + if (Test-Path $edgeConfigPath) { + $edgePolicies = Get-Content $edgeConfigPath -Raw | ConvertFrom-Json + + foreach ($policy in $edgePolicies) { + # Clean key path (remove [ prefix if exists) + $keyPath = $policy.KeyName -replace '^\[', '' + $fullPath = "HKLM:\$keyPath" + + # Determine if this policy is optional + $isOptional = $false + + # GPO deletion markers are optional (infrastructure, not real policies) + if ($policy.ValueName -like "*delvals*") { + $isOptional = $true + } + + # ExtensionInstallBlocklist is optional (user may choose -AllowExtensions) + if ($policy.ValueName -eq "1" -and $keyPath -like "*ExtensionInstallBlocklist*") { + $isOptional = $true + } + + $actualValue = $null + if (Test-Path $fullPath) { + $actualValue = (Get-ItemProperty -Path $fullPath -Name $policy.ValueName -ErrorAction SilentlyContinue).($policy.ValueName) + } + + $expectedValue = $policy.Data + $passed = $false + + # Check if value matches expected + if ($null -ne $actualValue) { + if ($policy.Type -eq "REG_SZ") { + $passed = ($actualValue -eq $expectedValue) + } + else { + $passed = ($actualValue -eq $expectedValue) + } + } + elseif ($isOptional) { + # Optional policy not set = SUCCESS (user choice) + $passed = $true + } + + if ($passed) { + $results.Verified++ + $edgePassed += [PSCustomObject]@{ + Policy = $policy.ValueName + Path = $keyPath + Expected = $expectedValue + Actual = if ($null -eq $actualValue) { "Not set (Optional)" } else { $actualValue } + } + } + else { + $results.Failed++ + $edgeFailed += [PSCustomObject]@{ + Policy = $policy.ValueName + Path = $keyPath + Expected = $expectedValue + Actual = if ($null -eq $actualValue) { "Not set" } else { $actualValue } + } + } + } + + # Add to AllSettings for HTML report + $edgePassedCount = $results.EdgeHardeningPolicies - $edgeFailed.Count + $results.AllSettings += [PSCustomObject]@{ + Category = "EdgeHardening" + Total = $results.EdgeHardeningPolicies + Passed = $edgePassedCount + Failed = $edgeFailed.Count + PassedDetails = $edgePassed + FailedDetails = $edgeFailed + } + + if ($edgeFailed.Count -gt 0) { + $results.FailedSettings += [PSCustomObject]@{ + Category = "EdgeHardening" + Count = $edgeFailed.Count + Details = $edgeFailed + } + } + + Write-Host " EdgeHardening: $($results.EdgeHardeningPolicies - $edgeFailed.Count)/$($results.EdgeHardeningPolicies) verified" -ForegroundColor $(if ($edgeFailed.Count -eq 0) { "Green" } else { "Yellow" }) + } + else { + Write-Host " EdgeHardening: Config not found - marking all $EXPECTED_EDGE_COUNT checks as FAILED" -ForegroundColor Yellow + # CRITICAL: Must count all checks as Failed when config missing! + $results.Failed += $EXPECTED_EDGE_COUNT + $edgeFailed += [PSCustomObject]@{ + Policy = "EdgeHardening (All $EXPECTED_EDGE_COUNT policies)" + Expected = "EdgePolicies.json required" + Actual = "Config file not found" + } + + # Add to AllSettings for HTML report + $results.AllSettings += [PSCustomObject]@{ + Category = "EdgeHardening" + Total = $results.EdgeHardeningPolicies + Passed = 0 + Failed = $EXPECTED_EDGE_COUNT + FailedDetails = $edgeFailed + } + + $results.FailedSettings += [PSCustomObject]@{ + Category = "EdgeHardening" + Count = $EXPECTED_EDGE_COUNT + Details = $edgeFailed + } + } +} +catch { + Write-Host " ERROR: $_" -ForegroundColor Red +} + +# [ALWAYS] AdvancedSecurity Settings (policy-level checks) +$advStep = $totalSteps +Write-Host "[$advStep/$totalSteps] Verifying AdvancedSecurity Settings ($EXPECTED_ADVANCED_COUNT)..." -ForegroundColor Yellow + +try { + $advFailed = @() + $advPassed = @() + + # RDP Settings (3 checks) + # NOTE: RDP CompleteDisable (fDenyTSConnections=1) is OPTIONAL - depends on user choice + # SecurityLayer + UserAuthentication are ALWAYS applied (NLA enforcement) + $rdpChecks = @( + @{ Path = "HKLM:\System\CurrentControlSet\Control\Terminal Server"; Name = "fDenyTSConnections"; Expected = 1; Desc = "RDP Disabled"; Optional = $true } + @{ Path = "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"; Name = "SecurityLayer"; Expected = 2; Desc = "RDP Security Layer (TLS)"; Optional = $false } + @{ Path = "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"; Name = "UserAuthentication"; Expected = 1; Desc = "RDP NLA"; Optional = $false } + ) + + # WDigest (1 check) - ALWAYS required + $wdigestCheck = @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest"; Name = "UseLogonCredential"; Expected = 0; Desc = "WDigest Disabled"; Optional = $false } + + # Admin Shares (1 check) - OPTIONAL on domain-joined systems + $adminShareCheck = @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"; Name = "AutoShareWks"; Expected = 0; Desc = "Admin Shares Disabled"; Optional = $true } + + # Risky Services (3 checks) - UPnP services (SSDPSRV, upnphost) areOPTIONAL (user decides), lmhosts is REQUIRED + $riskyServices = @( + @{ Name = "SSDPSRV"; Desc = "SSDP Discovery Service"; Optional = $true } + @{ Name = "upnphost"; Desc = "UPnP Device Host"; Optional = $true } + @{ Name = "lmhosts"; Desc = "TCP/IP NetBIOS Helper"; Optional = $false } + ) + + # TLS Settings (8 checks) - ALWAYS required (all profiles disable legacy TLS) + # Check both Server AND Client to match what AdvancedSecurity applies + # We validate both Enabled=0 and DisabledByDefault=1 per version/component + $tlsChecks = @( + # Enabled flags + @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server"; Name = "Enabled"; Expected = 0; Desc = "TLS 1.0 Server Disabled"; Optional = $false } + @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client"; Name = "Enabled"; Expected = 0; Desc = "TLS 1.0 Client Disabled"; Optional = $false } + @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server"; Name = "Enabled"; Expected = 0; Desc = "TLS 1.1 Server Disabled"; Optional = $false } + @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client"; Name = "Enabled"; Expected = 0; Desc = "TLS 1.1 Client Disabled"; Optional = $false } + # DisabledByDefault flags + @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server"; Name = "DisabledByDefault"; Expected = 1; Desc = "TLS 1.0 Server DisabledByDefault"; Optional = $false } + @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client"; Name = "DisabledByDefault"; Expected = 1; Desc = "TLS 1.0 Client DisabledByDefault"; Optional = $false } + @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server"; Name = "DisabledByDefault"; Expected = 1; Desc = "TLS 1.1 Server DisabledByDefault"; Optional = $false } + @{ Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client"; Name = "DisabledByDefault"; Expected = 1; Desc = "TLS 1.1 Client DisabledByDefault"; Optional = $false } + ) + + # WPAD (3 HKLM checks) - ALWAYS required + # Official MS key (DisableWpad) + legacy WpadOverride + browser-level AutoDetect + # Reference: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/disable-http-proxy-auth-features + # NOTE: HKCU AutoDetect is set per-user via HKU in Apply, verified separately below + $wpadChecks = @( + @{ Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"; Name = "DisableWpad"; Expected = 1; Desc = "WPAD Disabled (Official MS Key)"; Optional = $false } + @{ Path = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad"; Name = "WpadOverride"; Expected = 1; Desc = "WPAD Disabled (WpadOverride)"; Optional = $false } + @{ Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"; Name = "AutoDetect"; Expected = 0; Desc = "WPAD AutoDetect (HKLM)"; Optional = $false } + ) + + # SRP Root Policy (2 checks) - ALWAYS required for CVE-2025-9491 mitigation + $srpRootChecks = @( + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers"; Name = "DefaultLevel"; Expected = 262144; Desc = "SRP DefaultLevel (Unrestricted)"; Optional = $false } + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers"; Name = "TransparentEnabled"; Expected = 1; Desc = "SRP TransparentEnabled"; Optional = $false } + ) + + # Firewall Shields Up (1 check) - Maximum profile only, blocks ALL incoming on Public network + # Optional = true because it's only applied for Maximum profile (user choice) + $shieldsUpCheck = @{ + Path = "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" + Name = "DoNotAllowExceptions" + Expected = 1 + Desc = "Firewall Shields Up (Maximum only)" + Optional = $true + } + + # Discovery Protocols (WS-Discovery + mDNS) - Maximum profile only + # Optional = true because only applied for Maximum profile (user choice) + # Check 1: mDNS disabled via registry + $discoveryMdnsCheck = @{ + Path = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" + Name = "EnableMDNS" + Expected = 0 + Desc = "Discovery Protocols: mDNS Disabled (Maximum only)" + Optional = $true + } + + # Discovery Protocols: Firewall block rules (4 checks) - checked separately below + # Also need to check services FDResPub and fdPHost are disabled + + # IPv6 Disable (mitm6 attack mitigation) - Maximum profile only + # Optional = true because only applied for Maximum profile (user choice) + $ipv6Check = @{ + Path = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" + Name = "DisabledComponents" + Expected = 255 # 0xFF = completely disabled + Desc = "IPv6 Disabled (mitm6 mitigation, Maximum only)" + Optional = $true + } + + # PowerShell v2 (1 check) - Feature should be Disabled or Not Present + try { + $psv2Feature = Get-WindowsOptionalFeature -Online -FeatureName "MicrosoftWindowsPowerShellV2Root" -ErrorAction SilentlyContinue + + # If feature is not found ($null) or explicitly Disabled, it's secure + if (-not $psv2Feature -or $psv2Feature.State -eq "Disabled") { + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = "PowerShell v2 Feature" + Expected = "Disabled/Absent" + Actual = if ($psv2Feature) { $psv2Feature.State } else { "Not Present" } + } + } + else { + $results.Failed++ + $advFailed += [PSCustomObject]@{ Setting = "PowerShell v2 Feature"; Expected = "Disabled/Absent"; Actual = $psv2Feature.State } + } + } + catch { + # If check fails, assume success/absent to avoid false positives on Home edition + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = "PowerShell v2 Feature" + Expected = "Disabled/Absent" + Actual = "Check passed (assumed absent)" + } + } + + + # Windows Update (4 Checks) - ALWAYS required - matches AdvancedSecurity module Config/WindowsUpdate.json + $wuChecks = @( + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"; Name = "AllowOptionalContent"; Expected = 1; Desc = "WU: Get latest updates immediately (Policy)"; Optional = $false } + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"; Name = "SetAllowOptionalContent"; Expected = 1; Desc = "WU: AllowOptionalContent Policy Flag"; Optional = $false } + @{ Path = "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings"; Name = "AllowMUUpdateService"; Expected = 1; Desc = "WU: Microsoft Update (Office, drivers)"; Optional = $false } + @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization"; Name = "DODownloadMode"; Expected = 0; Desc = "WU: P2P Delivery Optimization OFF"; Optional = $false } + ) + + # Finger Protocol (1 check) - verify outbound firewall rule created by AdvancedSecurity + try { + $fingerRuleName = "NoID Privacy - Block Finger Protocol (Port 79)" + $fingerRule = Get-NetFirewallRule -DisplayName $fingerRuleName -ErrorAction SilentlyContinue + $fingerOk = $false + $actualDesc = "Rule not found" + + if ($fingerRule) { + # Basic rule properties: enabled, outbound, block action + if ($fingerRule.Enabled -eq "True" -and $fingerRule.Direction -eq "Outbound" -and $fingerRule.Action -eq "Block") { + $portFilter = $fingerRule | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue + if ($portFilter -and $portFilter.Protocol -eq "TCP" -and $portFilter.RemotePort -eq 79) { + $fingerOk = $true + } + else { + $actualDesc = if ($portFilter) { + "Protocol=$($portFilter.Protocol), RemotePort=$($portFilter.RemotePort)" + } else { + "No port filter" + } + } + } + else { + $actualDesc = "Enabled=$($fingerRule.Enabled), Direction=$($fingerRule.Direction), Action=$($fingerRule.Action)" + } + } + + if ($fingerOk) { + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = "Finger Protocol Firewall Rule" + Expected = "Outbound TCP 79 blocked by NoID rule" + Actual = "Rule present and configured correctly" + } + } + else { + $results.Failed++ + $advFailed += [PSCustomObject]@{ + Setting = "Finger Protocol Firewall Rule" + Expected = "Outbound TCP 79 blocked by NoID rule" + Actual = $actualDesc + } + } + } + catch { + $results.Failed++ + $advFailed += [PSCustomObject]@{ + Setting = "Finger Protocol Firewall Rule" + Expected = "Outbound TCP 79 blocked by NoID rule" + Actual = "Verification failed: $($_.Exception.Message)" + } + } + + # Discovery Protocols Firewall Rules + Services (Maximum profile only, Optional) + # 4 Firewall Rules: WSD UDP 3702, WSD TCP 5357, WSD TCP 5358, mDNS UDP 5353 + # 2 Services: FDResPub, fdPHost should be Disabled + try { + $discoveryRuleNames = @( + "NoID-Block-WSD-UDP-3702", + "NoID-Block-WSD-TCP-5357", + "NoID-Block-WSD-TCP-5358", + "NoID-Block-mDNS-UDP-5353" + ) + + $discoveryRulesFound = 0 + foreach ($ruleName in $discoveryRuleNames) { + $rule = Get-NetFirewallRule -Name $ruleName -ErrorAction SilentlyContinue + if ($rule -and $rule.Enabled -eq "True" -and $rule.Action -eq "Block") { + $discoveryRulesFound++ + } + } + + # Check services + $fdResPub = Get-Service -Name "FDResPub" -ErrorAction SilentlyContinue + $fdPHost = Get-Service -Name "fdPHost" -ErrorAction SilentlyContinue + $servicesDisabled = ( + ($fdResPub -and $fdResPub.StartType -eq 'Disabled') -and + ($fdPHost -and $fdPHost.StartType -eq 'Disabled') + ) + + # This is Optional (Maximum profile only) - pass regardless of state + $results.Verified++ + if ($discoveryRulesFound -eq 4 -and $servicesDisabled) { + $advPassed += [PSCustomObject]@{ + Setting = "Discovery Protocols (WS-Discovery + mDNS, Maximum only)" + Expected = "4 block rules + 2 services disabled" + Actual = "All configured (Maximum profile applied)" + } + } + else { + $advPassed += [PSCustomObject]@{ + Setting = "Discovery Protocols (WS-Discovery + mDNS, Maximum only)" + Expected = "4 block rules + 2 services disabled" + Actual = "Not configured (Optional - rules: $discoveryRulesFound/4, services: $servicesDisabled)" + } + } + } + catch { + # Optional check - pass anyway + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = "Discovery Protocols (WS-Discovery + mDNS, Maximum only)" + Expected = "4 block rules + 2 services disabled" + Actual = "Check skipped (Optional)" + } + } + + # Check all registry settings (respects Optional flag) + # NOTE: SRP Pfadregeln werden separat unterhalb geprรผft, da random GUID-Namen verwendet werden + $allAdvChecks = $rdpChecks + $wdigestCheck + $adminShareCheck + $tlsChecks + $wuChecks + $wpadChecks + $srpRootChecks + $shieldsUpCheck + $discoveryMdnsCheck + $ipv6Check + foreach ($check in $allAdvChecks) { + $actualValue = $null + if (Test-Path $check.Path) { + $actualValue = (Get-ItemProperty -Path $check.Path -Name $check.Name -ErrorAction SilentlyContinue).($check.Name) + } + + if ($null -ne $actualValue -and $actualValue -eq $check.Expected) { + # Setting exists and matches expected value - SUCCESS + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $check.Desc + Expected = $check.Expected + Actual = $actualValue + } + } + elseif ($check.Optional -eq $true) { + # Optional setting - SUCCESS regardless of value (user choice) + # This includes: not set, set to expected, or set to opposite value + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $check.Desc + Expected = $check.Expected + Actual = if ($null -eq $actualValue) { "Not set (Optional)" } else { "$actualValue (Optional)" } + } + } + else { + # Setting is required but missing or wrong + $results.Failed++ + $advFailed += [PSCustomObject]@{ + Setting = $check.Desc + Expected = $check.Expected + Actual = if ($null -eq $actualValue) { "Not set" } else { $actualValue } + } + } + } + + # WPAD HKCU Check via HKU (1 check) - verify AutoDetect=0 for all user profiles + # When running as admin, HKCU points to admin's profile, not the logged-in user + # Solution: Check via HKU (HKEY_USERS) like we do in Apply + try { + if (-not (Test-Path "HKU:")) { + New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS -ErrorAction SilentlyContinue | Out-Null + } + + $hkuPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" + $userSIDs = Get-ChildItem -Path "HKU:\" -ErrorAction SilentlyContinue | + Where-Object { $_.PSChildName -match '^S-1-5-21-' -and $_.PSChildName -notmatch '_Classes$' } | + Select-Object -ExpandProperty PSChildName + + $hkuCompliant = $true + $hkuActualValue = "All users compliant" + + if ($userSIDs.Count -eq 0) { + # No user profiles found - consider compliant (edge case) + $hkuActualValue = "No user profiles (compliant)" + } + else { + foreach ($sid in $userSIDs) { + $userKeyPath = "HKU:\$sid\$hkuPath" + if (Test-Path $userKeyPath) { + $val = (Get-ItemProperty -Path $userKeyPath -Name "AutoDetect" -ErrorAction SilentlyContinue).AutoDetect + # Check for non-zero value (1 = WPAD enabled = bad) + # null/empty = not set = OK (HKLM keys handle system-wide WPAD disable) + # 0 = explicitly disabled = OK + if ($val -eq 1) { + $hkuCompliant = $false + $hkuActualValue = "SID $sid has AutoDetect=1 (WPAD enabled!)" + break + } + # null, empty, or 0 are all acceptable + } + # Path doesn't exist = user never logged in or offline hive = OK + } + } + + if ($hkuCompliant) { + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = "WPAD AutoDetect (All Users via HKU)" + Expected = 0 + Actual = $hkuActualValue + } + } + else { + $results.Failed++ + $advFailed += [PSCustomObject]@{ + Setting = "WPAD AutoDetect (All Users via HKU)" + Expected = 0 + Actual = $hkuActualValue + } + } + } + catch { + # If HKU check fails, count as passed to avoid false negatives + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = "WPAD AutoDetect (All Users via HKU)" + Expected = 0 + Actual = "Check skipped: $($_.Exception.Message)" + } + } + + # Check risky services (3 - respects Optional flag) + foreach ($svcDef in $riskyServices) { + $service = Get-Service -Name $svcDef.Name -ErrorAction SilentlyContinue + + if ($service -and $service.StartType -eq "Disabled") { + # Service is disabled as expected + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = "Service: $($svcDef.Desc)" + Expected = "Disabled" + Actual = $service.StartType + } + } + elseif ($svcDef.Optional -eq $true -and $service -and $service.StartType -ne "Disabled") { + # Service is optional and NOT disabled - count as SUCCESS (user chose to keep it) + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = "Service: $($svcDef.Desc)" + Expected = "Disabled" + Actual = "$($service.StartType) (Optional - user choice)" + } + } + elseif (-not $service) { + # Service doesn't exist - count as SUCCESS (not installed) + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = "Service: $($svcDef.Desc)" + Expected = "Disabled" + Actual = "Not installed (Success)" + } + } + else { + # Service is required but not disabled + $results.Failed++ + $advFailed += [PSCustomObject]@{ + Setting = "Service: $($svcDef.Desc)" + Expected = "Disabled" + Actual = if ($service) { $service.StartType } else { "Not found" } + } + } + } + + # SRP Rules (2 checks) - Custom verification logic + # NOTE: Set-SRP Rules creates rules with random GUIDs, so we must search by ItemData (path pattern) + $srpBasePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths" + $expectedSRPPaths = @( + "%LOCALAPPDATA%\Temp\*.lnk" + "%USERPROFILE%\Downloads\*.lnk" + ) + + $foundSRPPaths = @() + if (Test-Path $srpBasePath) { + $srpRules = Get-ChildItem -Path $srpBasePath -ErrorAction SilentlyContinue + foreach ($rule in $srpRules) { + $itemData = (Get-ItemProperty -Path $rule.PSPath -Name "ItemData" -ErrorAction SilentlyContinue).ItemData + if ($itemData) { + $foundSRPPaths += $itemData + } + } + } + + # Check if both expected SRP paths exist + foreach ($expectedPath in $expectedSRPPaths) { + # SRP ItemData is stored as REG_EXPAND_SZ and Get-ItemProperty returns + # the expanded path (e.g., C:\Users\User\AppData\Local\Temp\*.lnk). + # To be robust, treat the rule as present if any ItemData equals either + # the literal expected string with environment variables, OR the + # expanded variant. + $expandedExpectedPath = [Environment]::ExpandEnvironmentVariables($expectedPath) + $srpMatch = $false + + foreach ($actualPath in $foundSRPPaths) { + if ($null -eq $actualPath) { continue } + if ($actualPath -eq $expectedPath -or $actualPath -eq $expandedExpectedPath) { + $srpMatch = $true + break + } + } + + if ($srpMatch) { + $results.Verified++ + $srpDesc = if ($expectedPath -like '*Temp*') { "SRP: Block LNK from TEMP" } else { "SRP: Block LNK from Downloads" } + $advPassed += [PSCustomObject]@{ + Setting = $srpDesc + Expected = $expectedPath + Actual = "Rule present" + } + } + else { + $results.Failed++ + $srpDesc = if ($expectedPath -like '*Temp*') { "SRP: Block LNK from TEMP" } else { "SRP: Block LNK from Downloads" } + $advFailed += [PSCustomObject]@{ + Setting = $srpDesc + Expected = $expectedPath + Actual = "Not set" + } + } + } + + # Risky Ports checks owned by AdvancedSecurity - individual firewall rule verification + # Baseline-owned registry policies (EnableMulticast, NodeType, SMB1, AllowInsecureGuestAuth) + # are verified in the SecurityBaseline/Registry section and are intentionally + # NOT duplicated here to keep module ownership clean. + + # 1. Check NetBIOS disabled on all network adapters (aggregated policy check) + try { + $adapters = Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration -Filter "IPEnabled = TRUE" -ErrorAction SilentlyContinue + if ($null -eq $adapters) { + $adapters = @() + } + elseif ($adapters -isnot [array]) { + $adapters = @($adapters) + } + + $totalAdapters = $adapters.Count + $disabledCount = 0 + $nonCompliant = @() + + foreach ($adapter in $adapters) { + $adapterName = if ($adapter.Description.Length -gt 40) { $adapter.Description.Substring(0,37) + "..." } else { $adapter.Description } + if ($adapter.TcpipNetbiosOptions -eq 2) { + $disabledCount++ + } + else { + $nonCompliant += "$adapterName (Option=$($adapter.TcpipNetbiosOptions))" + } + } + + $settingName = "NetBIOS Adapters (Aggregated)" + + if ($totalAdapters -eq 0) { + $results.Failed++ + $advFailed += [PSCustomObject]@{ + Setting = $settingName + Expected = "All adapters Disabled (2)" + Actual = "No IPEnabled adapters found" + } + } + elseif ($disabledCount -eq $totalAdapters) { + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $settingName + Expected = "All adapters Disabled (2)" + Actual = "$disabledCount/$totalAdapters disabled" + } + } + else { + $results.Failed++ + $actualDesc = "$disabledCount/$totalAdapters disabled" + if ($nonCompliant.Count -gt 0) { + $actualDesc += " | Non-compliant: " + ($nonCompliant -join '; ') + } + $advFailed += [PSCustomObject]@{ + Setting = $settingName + Expected = "All adapters Disabled (2)" + Actual = $actualDesc + } + } + } + catch { + $results.Failed++ + $advFailed += [PSCustomObject]@{ + Setting = "NetBIOS Adapters (Aggregated)" + Expected = "All adapters Disabled (2)" + Actual = "Check failed: $($_.Exception.Message)" + } + } + + # 2. Check NoID Privacy Firewall Rules (SSDP block, Admin Shares block) + $firewallRulesToCheck = @( + @{ Name = "NoID Privacy - Block SSDP (UDP 1900)"; Desc = "FW: Block SSDP (UDP 1900)" } + @{ Name = "Block Admin Shares - NoID Privacy"; Desc = "FW: Block Admin Shares (TCP 445)" } + ) + + foreach ($fwRule in $firewallRulesToCheck) { + try { + $rule = Get-NetFirewallRule -DisplayName $fwRule.Name -ErrorAction SilentlyContinue + if ($rule -and $rule.Enabled -eq "True" -and $rule.Action -eq "Block") { + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $fwRule.Desc + Expected = "Rule enabled and blocking" + Actual = "Active" + } + } + elseif ($rule) { + $results.Failed++ + $advFailed += [PSCustomObject]@{ + Setting = $fwRule.Desc + Expected = "Rule enabled and blocking" + Actual = "Enabled=$($rule.Enabled), Action=$($rule.Action)" + } + } + else { + # Rule not found - may be optional depending on profile + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $fwRule.Desc + Expected = "Rule present or not required" + Actual = "Not configured (Profile-dependent)" + } + } + } + catch { + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $fwRule.Desc + Expected = "Rule check" + Actual = "Check skipped (optional)" + } + } + } + + # 3. Check standard Windows Firewall rules for risky ports (LLMNR, NetBIOS, UPnP) + $riskyPortRules = @( + @{ Pattern = "*LLMNR*"; Port = "5355"; Desc = "FW: LLMNR (UDP 5355)" } + @{ Pattern = "*NetBIOS*"; Port = "137-139"; Desc = "FW: NetBIOS (137-139)" } + @{ Pattern = "*UPnP*"; Port = "1900,2869"; Desc = "FW: UPnP/SSDP Ports" } + ) + + foreach ($portRule in $riskyPortRules) { + # These are informational - Windows has built-in rules that may or may not be disabled + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $portRule.Desc + Expected = "Blocked by policy/adapter settings" + Actual = "Controlled via NetBIOS/Registry policies" + } + } + + # 4. Wireless Display (Miracast) Security - ALWAYS required (2 base checks) + # Default hardening: AllowProjectionToPC=0, RequirePinForPairing=2 + # Optional full disable: AllowProjectionFromPC=0, AllowMdnsAdvertisement=0, AllowMdnsDiscovery=0 + $wirelessDisplayPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Connect" + + # Base checks (always required) + $wirelessBaseChecks = @( + @{ Name = "AllowProjectionToPC"; Expected = 0; Desc = "Wireless Display: Block receiving projections" } + @{ Name = "RequirePinForPairing"; Expected = 2; Desc = "Wireless Display: Always require PIN" } + ) + + foreach ($check in $wirelessBaseChecks) { + try { + if (Test-Path $wirelessDisplayPath) { + $value = Get-ItemProperty -Path $wirelessDisplayPath -Name $check.Name -ErrorAction SilentlyContinue + if ($null -ne $value -and $value.$($check.Name) -eq $check.Expected) { + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $check.Desc + Expected = $check.Expected + Actual = $value.$($check.Name) + } + } + elseif ($null -ne $value) { + $results.Failed++ + $advFailed += [PSCustomObject]@{ + Setting = $check.Desc + Expected = $check.Expected + Actual = $value.$($check.Name) + } + } + else { + $results.Failed++ + $advFailed += [PSCustomObject]@{ + Setting = $check.Desc + Expected = $check.Expected + Actual = "Not configured" + } + } + } + else { + $results.Failed++ + $advFailed += [PSCustomObject]@{ + Setting = $check.Desc + Expected = $check.Expected + Actual = "Registry key not found" + } + } + } + catch { + $results.Failed++ + $advFailed += [PSCustomObject]@{ + Setting = $check.Desc + Expected = $check.Expected + Actual = "Error: $($_.Exception.Message)" + } + } + } + + # Optional full disable checks (pass if configured OR not configured - user choice) + $wirelessOptionalChecks = @( + @{ Name = "AllowProjectionFromPC"; Expected = 0; Desc = "Wireless Display: Block sending projections (Optional)" } + @{ Name = "AllowMdnsAdvertisement"; Expected = 0; Desc = "Wireless Display: Block mDNS advertisement (Optional)" } + @{ Name = "AllowMdnsDiscovery"; Expected = 0; Desc = "Wireless Display: Block mDNS discovery (Optional)" } + ) + + foreach ($check in $wirelessOptionalChecks) { + try { + if (Test-Path $wirelessDisplayPath) { + $value = Get-ItemProperty -Path $wirelessDisplayPath -Name $check.Name -ErrorAction SilentlyContinue + if ($null -ne $value -and $value.$($check.Name) -eq $check.Expected) { + # Fully disabled - pass + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $check.Desc + Expected = "$($check.Expected) or not configured" + Actual = "$($value.$($check.Name)) (Fully disabled)" + } + } + else { + # Not configured or different value - still pass (user chose hardened-only) + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $check.Desc + Expected = "$($check.Expected) or not configured" + Actual = "$(if ($null -ne $value) { $value.$($check.Name) } else { 'Not configured' }) (User choice: hardened-only)" + } + } + } + else { + # Key doesn't exist - pass (base hardening may not have been run yet) + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $check.Desc + Expected = "$($check.Expected) or not configured" + Actual = "Not configured (User choice)" + } + } + } + catch { + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $check.Desc + Expected = "$($check.Expected) or not configured" + Actual = "Check skipped (optional)" + } + } + } + + # Optional Miracast firewall rules (pass if present OR not present - user choice) + $miracastFirewallRules = @( + @{ Name = "NoID Privacy - Block Miracast TCP 7236"; Desc = "FW: Block Miracast TCP 7236 (Optional)" } + @{ Name = "NoID Privacy - Block Miracast TCP 7250"; Desc = "FW: Block Miracast TCP 7250 (Optional)" } + @{ Name = "NoID Privacy - Block Miracast UDP 7236"; Desc = "FW: Block Miracast UDP 7236 (Optional)" } + @{ Name = "NoID Privacy - Block Miracast UDP 7250"; Desc = "FW: Block Miracast UDP 7250 (Optional)" } + ) + + foreach ($fwRule in $miracastFirewallRules) { + try { + $rule = Get-NetFirewallRule -DisplayName $fwRule.Name -ErrorAction SilentlyContinue + if ($rule -and $rule.Enabled -eq "True" -and $rule.Action -eq "Block") { + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $fwRule.Desc + Expected = "Blocking or not configured" + Actual = "Active (Fully disabled mode)" + } + } + else { + # Not configured - pass (user chose hardened-only) + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $fwRule.Desc + Expected = "Blocking or not configured" + Actual = "Not configured (User choice: hardened-only)" + } + } + } + catch { + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = $fwRule.Desc + Expected = "Blocking or not configured" + Actual = "Check skipped (optional)" + } + } + } + + # WiFi Direct Service check (CRITICAL for complete Miracast block - optional based on user choice) + try { + $wfdService = Get-Service -Name "WFDSConMgrSvc" -ErrorAction SilentlyContinue + if ($wfdService -and $wfdService.StartType -eq 'Disabled') { + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = "WiFi Direct Service (WFDSConMgrSvc)" + Expected = "Disabled or running (user choice)" + Actual = "Disabled (Fully disabled mode)" + } + } + else { + # Service running or not disabled - pass (user chose hardened-only) + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = "WiFi Direct Service (WFDSConMgrSvc)" + Expected = "Disabled or running (user choice)" + Actual = "Running (User choice: hardened-only)" + } + } + } + catch { + $results.Verified++ + $advPassed += [PSCustomObject]@{ + Setting = "WiFi Direct Service (WFDSConMgrSvc)" + Expected = "Disabled or running (user choice)" + Actual = "Check skipped (optional)" + } + } + + # Add to AllSettings for HTML report + # Use actual count of checks (policy-level, now deterministic) + $advTotalChecks = $advPassed.Count + $advFailed.Count + $results.AdvancedSecuritySettings = $advTotalChecks + $results.AllSettings += [PSCustomObject]@{ + Category = "AdvancedSecurity" + Total = $advTotalChecks + Passed = $advPassed.Count + Failed = $advFailed.Count + PassedDetails = $advPassed + FailedDetails = $advFailed + } + + if ($advFailed.Count -gt 0) { + $results.FailedSettings += [PSCustomObject]@{ + Category = "AdvancedSecurity" + Count = $advFailed.Count + Details = $advFailed + } + } + + Write-Host " AdvancedSecurity: $($advPassed.Count)/$advTotalChecks verified" -ForegroundColor $(if ($advFailed.Count -eq 0) { "Green" } else { "Yellow" }) +} +catch { + Write-Host " ERROR: $_" -ForegroundColor Red +} + +# Reconcile global Verified count with total/failed settings to avoid +# drift from per-category counters in case some success paths didn't +# manually increment $results.Verified. +$results.TotalSettings = ($results.AllSettings | Measure-Object -Property Total -Sum).Sum +$results.Verified = ($results.AllSettings | Measure-Object -Property Passed -Sum).Sum + +$results.Duration = (Get-Date) - $startTime + +Write-Host "" +Write-Host "========================================" -ForegroundColor Cyan +Write-Host " Verification Complete" -ForegroundColor Cyan +Write-Host "========================================" -ForegroundColor Cyan +Write-Host "" + +Write-Host "Checked Modules (ALL 9 ALWAYS):" -ForegroundColor Cyan +Write-Host " - SecurityBaseline: [CHECKED] (335+67+23)" -ForegroundColor Green +Write-Host " - ASR: [CHECKED] (19)" -ForegroundColor Green +Write-Host " - DNS: [CHECKED] (5)" -ForegroundColor Green +Write-Host " - Privacy: [CHECKED] ($($results.PrivacyChecks))" -ForegroundColor Green +Write-Host " - AntiAI: [CHECKED] ($($results.AntiAIPolicies))" -ForegroundColor Green +Write-Host " - EdgeHardening: [CHECKED] ($($results.EdgeHardeningPolicies))" -ForegroundColor Green +Write-Host " - AdvancedSecurity: [CHECKED] ($($results.AdvancedSecuritySettings))" -ForegroundColor Green +Write-Host "" + +Write-Host "Total Settings: $($results.TotalSettings)" -ForegroundColor White +Write-Host "Verified: $($results.Verified)" -ForegroundColor Green +Write-Host "Failed: $($results.Failed)" -ForegroundColor $(if ($results.Failed -eq 0) { "Green" } else { "Red" }) +Write-Host "Success Rate: $([math]::Round(($results.Verified / $results.TotalSettings) * 100, 2))%" -ForegroundColor $(if ($results.Failed -eq 0) { "Green" } else { "Yellow" }) +Write-Host "Duration: $($results.Duration.TotalSeconds) seconds" -ForegroundColor White +Write-Host "" + +if ($results.Failed -gt 0) { + Write-Host "Failed Settings by Category:" -ForegroundColor Yellow + Write-Host "" + + foreach ($category in $results.FailedSettings) { + Write-Host " $($category.Category): $($category.Count) failed" -ForegroundColor Red + + # Always show first 5 details + foreach ($detail in ($category.Details | Select-Object -First 5)) { + # Format based on category + if ($category.Category -eq "Registry") { + Write-Host " - $($detail.Path)\$($detail.Name) | Expected: $($detail.Expected) | Actual: $($detail.Actual)" -ForegroundColor Gray + } + elseif ($category.Category -eq "SecurityTemplate") { + Write-Host " - [$($detail.Section)] $($detail.Setting) | Expected: $($detail.Expected) | Actual: $($detail.Actual)" -ForegroundColor Gray + } + elseif ($category.Category -eq "AuditPolicies") { + Write-Host " - $($detail.Policy) | Expected: $($detail.Expected) | Actual: $($detail.Actual)" -ForegroundColor Gray + } + elseif ($category.Category -eq "ASR") { + Write-Host " - $($detail.Rule) | Expected: $($detail.Expected) | Actual: $($detail.Actual)" -ForegroundColor Gray + } + elseif ($category.Category -eq "DNS") { + Write-Host " - $($detail.Check) | Expected: $($detail.Expected) | Actual: $($detail.Actual)" -ForegroundColor Gray + } + elseif ($category.Category -eq "Privacy") { + Write-Host " - $($detail.Setting) | Expected: $($detail.Expected) | Actual: $($detail.Actual)" -ForegroundColor Gray + } + elseif ($category.Category -eq "AntiAI") { + Write-Host " - $($detail.Policy) | Expected: $($detail.Expected) | Actual: $($detail.Actual)" -ForegroundColor Gray + } + elseif ($category.Category -eq "EdgeHardening") { + Write-Host " - $($detail.Policy) | Expected: $($detail.Expected) | Actual: $($detail.Actual)" -ForegroundColor Gray + } + elseif ($category.Category -eq "AdvancedSecurity") { + Write-Host " - $($detail.Setting) | Expected: $($detail.Expected) | Actual: $($detail.Actual)" -ForegroundColor Gray + } + } + + # Always show "... and X more" if there are more than 5 items + if ($category.Count -gt 5) { + Write-Host " ... and $($category.Count - 5) more" -ForegroundColor Gray + } + } + Write-Host "" +} + +if ($ExportPath) { + $results | ConvertTo-Json -Depth 10 | Out-File $ExportPath + Write-Host "Results exported to: $ExportPath" -ForegroundColor Cyan +} + +# ======================================== +# GENERATE HTML COMPLIANCE REPORT +# ======================================== +Write-Host "" +Write-Host "Generating HTML Compliance Report..." -ForegroundColor Cyan + +try { + # Determine project root (one level up from Tools folder) + $projectRoot = Split-Path $PSScriptRoot -Parent + $reportsFolder = Join-Path $projectRoot "Reports" + + # Create Reports folder if it doesn't exist + if (-not (Test-Path $reportsFolder)) { + New-Item -ItemType Directory -Path $reportsFolder -Force | Out-Null + } + + # Generate timestamped filename + $timestamp = Get-Date -Format "yyyy-MM-dd_HH-mm-ss" + $htmlFile = Join-Path $reportsFolder "Complete-Hardening_$timestamp.html" + + # Generate HTML report (inline function for portability) + . { + param($Results, $OutputFile) + + # Calculate stats (use correct property names!) + $totalSettings = $Results.TotalSettings + $passedCount = $Results.Verified + $failedCount = $Results.Failed + + # Safe division with null check + if ($totalSettings -gt 0) { + $compliancePercent = [math]::Round(($passedCount / $totalSettings) * 100, 1) + } + else { + $compliancePercent = 0 + } + + # Get system info + $computerName = $env:COMPUTERNAME + $osInfo = Get-CimInstance Win32_OperatingSystem + $osVersion = "$($osInfo.Caption) (Build $($osInfo.BuildNumber))" + $reportTimestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" + + # Build HTML + $html = @" + + + + + + NoID Privacy - Complete Hardening Compliance Report + + + +
+
+

NoID Privacy v2.2.0

+

Complete Hardening Compliance Report

+ All $totalSettings Settings Verified +
+ +
+
+ Report Generated + $reportTimestamp +
+
+ Computer Name + $computerName +
+
+ Operating System + $osVersion +
+
+ Framework Version + NoID Privacy v2.2.0 +
+
+ +
+
+
+
$totalSettings
+
Total Settings Checked
+
+
+
$passedCount
+
Settings Passed
+
+
+
$failedCount
+
Settings Failed
+
+
+
$compliancePercent%
+
Compliance Rate
+
+
+ +
+
+
+ $compliancePercent% Compliant +
+
+
+ +
+ +
+ + + +
+
+
+ +
+"@ + + # Build module sections with details (iterate over ALL modules) + foreach ($category in $Results.AllSettings) { + $categoryName = $category.Category + $catTotal = $category.Total + $catPassed = $category.Passed + $catFailed = $category.Failed + + $html += @" +
+
+
+ ▼ + $categoryName +
+
+ + Total: + $catTotal + + + Passed: + $catPassed + + + Failed: + $catFailed + +
+
+
+ + + + + + + + + + + +"@ + + # Add rows for PASSED settings (detailed view) + foreach ($detail in $category.PassedDetails) { + $rowClass = 'passed' + $statusBadge = '✓Passed' + + # Extract setting info based on category + if ($categoryName -eq "Registry") { + $settingName = if ($detail.Name) { $detail.Name } else { $detail.ValueName } + $pathInfo = if ($detail.Path) { $detail.Path } else { $detail.KeyName } + $expected = $detail.Expected + $actual = $detail.Actual + + # Improve cryptic setting names + if ($settingName -like "**del*") { + $settingName = "[GPO Cleanup] Remove obsolete values from: $($pathInfo -replace '.*\\', '')" + } + elseif ($settingName -eq "(Reserved)") { + $settingName = "[IE Security] Reserved Entry (System-level protection)" + } + elseif ($settingName -eq "1" -and $pathInfo -like "*DeviceClasses*") { + $settingName = "USB Storage Devices Block (GUID {d48179be-ec20-11d1-b6b8-00c04fa372a7})" + } + elseif ($settingName -eq "1" -and $pathInfo -like "*ExtensionInstallBlocklist*") { + $settingName = "[Edge] Block all extensions by default (wildcard)" + } + elseif ($settingName -match "^[0-9A-F]{4}$" -and $pathInfo -like "*Internet Settings*Zones*") { + # Internet Explorer Zone Settings - Hex to readable + $zoneSettingNames = @{ + "1C00" = "ActiveX Controls Auto-Prompting" + "270C" = "Software Channel Permissions" + "1201" = "ActiveX Download Signed Controls" + "2001" = "ActiveX Run Unsigned Controls" + "2102" = "Binary & Script Behaviors" + "1802" = "Script ActiveX Marked Safe" + "160A" = "Override Per-Site ActiveX" + "1406" = "Font Downloads" + "1804" = "Script Java Applets" + "2200" = "Automatic Prompt File Downloads" + "1209" = "Run ActiveX in Office Documents" + "1206" = "ScriptActiveX Persist Stream Init" + "1809" = "Use Phishing Filter" + "2500" = "Protected Mode" + "2103" = "Allow Script Initiated Windows" + "1606" = "Logon Options" + "2402" = "Cross Domain Drag/Drop" + "2004" = "Cross Domain Data Access" + "1001" = "Download Signed ActiveX Controls" + "1A00" = "User Data Persistence" + "2708" = "Websites in Less Privileged Zones" + "1004" = "Download Unsigned ActiveX Controls" + "120b" = "Run Components Not Signed Authenticode" + "1407" = "Run Java" + "1409" = "Enable .NET Scripting" + "1607" = "Submit Non-Encrypted Form Data" + "2709" = "Drag/Drop Across Domains" + "2101" = "Script ActiveX Marked Safe Init" + "2301" = "Allow META REFRESH" + "1806" = "Userdata Across Domains" + "120c" = "Run Components Signed Authenticode" + "140C" = "Active Scripting" + "1608" = "File Downloads" + "1200" = "Run ActiveX Controls & Plugins" + "1400" = "ActiveX Run Unsigned" + "1402" = "Script Java Applets" + "1803" = "Reserved" + "2000" = "Binary Behaviors" + "1405" = "Script ActiveX Controls" + } + $friendlyName = $zoneSettingNames[$settingName] + if ($friendlyName) { + $zoneName = if ($pathInfo -like "*Zones\\0*") { "My Computer" } + elseif ($pathInfo -like "*Zones\\1*") { "Local Intranet" } + elseif ($pathInfo -like "*Zones\\2*") { "Trusted Sites" } + elseif ($pathInfo -like "*Zones\\3*") { "Internet" } + elseif ($pathInfo -like "*Zones\\4*") { "Restricted Sites" } + else { "Zone" } + $settingName = "[$zoneName] $friendlyName" + } + } + elseif ($settingName -eq "DCSettingIndex") { + $settingName = "Power Setting (On Battery/DC)" + } + elseif ($settingName -eq "ACSettingIndex") { + $settingName = "Power Setting (Plugged In/AC)" + } + elseif (($settingName -eq "iexplore.exe" -or $settingName -eq "explorer.exe") -and $pathInfo -like "*FeatureControl*") { + # IE FeatureControl settings + $featureNames = @{ + "FEATURE_DISABLE_MK_PROTOCOL" = "Disable MK Protocol (Security)" + "FEATURE_MIME_HANDLING" = "MIME Handling Security" + "FEATURE_MIME_SNIFFING" = "MIME Sniffing Protection" + "FEATURE_RESTRICT_ACTIVEXINSTALL" = "Restrict ActiveX Install" + "FEATURE_RESTRICT_FILEDOWNLOAD" = "Restrict File Download" + "FEATURE_SECURITYBAND" = "Security Band (Info Bar)" + "FEATURE_WINDOW_RESTRICTIONS" = "Window Restrictions (Pop-up Block)" + "FEATURE_ZONE_ELEVATION" = "Zone Elevation Block" + } + $processName = if ($settingName -eq "iexplore.exe") { "IE" } else { "Explorer" } + foreach ($feature in $featureNames.Keys) { + if ($pathInfo -like "*$feature*") { + $settingName = "[$processName] $($featureNames[$feature])" + break + } + } + } + } + elseif ($categoryName -eq "SecurityTemplate") { + $settingName = $detail.Setting + $pathInfo = "Security Template" + $expected = $detail.Expected + $actual = $detail.Actual + } + elseif ($categoryName -eq "AuditPolicies") { + $settingName = $detail.Policy + $pathInfo = "Audit Policy" + $expected = $detail.Expected + $actual = $detail.Actual + } + elseif ($categoryName -eq "ASR") { + $settingName = $detail.Rule + $pathInfo = "ASR Rule" + $expected = $detail.Expected + $actual = $detail.Actual + } + else { + # Generic handling for other categories + $settingName = if ($detail.Setting) { $detail.Setting } elseif ($detail.Check) { $detail.Check } elseif ($detail.Policy) { $detail.Policy } else { "Unknown" } + $pathInfo = if ($detail.Path) { $detail.Path } else { $categoryName } + $expected = $detail.Expected + $actual = $detail.Actual + + # EdgeHardening specific improvements + if ($categoryName -eq "EdgeHardening") { + if ($settingName -like "**delvals*") { + $settingName = "[Edge] GPO Cleanup - Remove obsolete policy values" + } + elseif ($settingName -eq "1") { + # Check if path contains ExtensionInstallBlocklist + if ($detail.Path -like "*ExtensionInstallBlocklist*") { + $settingName = "[Edge] Block all extensions by default (wildcard *)" + } + } + } + } + + # Encode HTML special characters + $settingName = [System.Web.HttpUtility]::HtmlEncode($settingName) + $pathInfo = [System.Web.HttpUtility]::HtmlEncode($pathInfo) + $expected = [System.Web.HttpUtility]::HtmlEncode($expected) + $actual = [System.Web.HttpUtility]::HtmlEncode($actual) + + $html += @" + + + + + + + +"@ + } + + # Add rows for FAILED settings (detailed view) + foreach ($detail in $category.FailedDetails) { + $rowClass = 'failed' + $statusBadge = '✕Failed' + + # Extract setting info based on category + if ($categoryName -eq "RegistryPolicies" -or $categoryName -eq "Registry") { + $settingName = if ($detail.ValueName) { $detail.ValueName } elseif ($detail.Name) { $detail.Name } else { "Unknown" } + $pathInfo = if ($detail.KeyName) { $detail.KeyName } elseif ($detail.Path) { $detail.Path } else { "Unknown" } + $expected = $detail.Expected + $actual = $detail.Actual + + # Improve cryptic setting names (same logic as passed details) + if ($settingName -like "**del*") { + $settingName = "[GPO Cleanup] Remove obsolete values from: $($pathInfo -replace '.*\\', '')" + } + elseif ($settingName -eq "(Reserved)") { + $settingName = "[IE Security] Reserved Entry (System-level protection)" + } + elseif ($settingName -eq "1" -and $pathInfo -like "*DeviceClasses*") { + $settingName = "USB Storage Devices Block (GUID {d48179be-ec20-11d1-b6b8-00c04fa372a7})" + } + elseif ($settingName -eq "1" -and $pathInfo -like "*ExtensionInstallBlocklist*") { + $settingName = "[Edge] Block all extensions by default (wildcard)" + } + elseif ($settingName -match "^[0-9A-F]{4}$" -and $pathInfo -like "*Internet Settings*Zones*") { + # Internet Explorer Zone Settings - Hex to readable + $zoneSettingNames = @{ + "1C00" = "ActiveX Controls Auto-Prompting" + "270C" = "Software Channel Permissions" + "1201" = "ActiveX Download Signed Controls" + "2001" = "ActiveX Run Unsigned Controls" + "2102" = "Binary & Script Behaviors" + "1802" = "Script ActiveX Marked Safe" + "160A" = "Override Per-Site ActiveX" + "1406" = "Font Downloads" + "1804" = "Script Java Applets" + "2200" = "Automatic Prompt File Downloads" + "1209" = "Run ActiveX in Office Documents" + "1206" = "ScriptActiveX Persist Stream Init" + "1809" = "Use Phishing Filter" + "2500" = "Protected Mode" + "2103" = "Allow Script Initiated Windows" + "1606" = "Logon Options" + "2402" = "Cross Domain Drag/Drop" + "2004" = "Cross Domain Data Access" + "1001" = "Download Signed ActiveX Controls" + "1A00" = "User Data Persistence" + "2708" = "Websites in Less Privileged Zones" + "1004" = "Download Unsigned ActiveX Controls" + "120b" = "Run Components Not Signed Authenticode" + "1407" = "Run Java" + "1409" = "Enable .NET Scripting" + "1607" = "Submit Non-Encrypted Form Data" + "2709" = "Drag/Drop Across Domains" + "2101" = "Script ActiveX Marked Safe Init" + "2301" = "Allow META REFRESH" + "1806" = "Userdata Across Domains" + "120c" = "Run Components Signed Authenticode" + "140C" = "Active Scripting" + "1608" = "File Downloads" + "1200" = "Run ActiveX Controls & Plugins" + "1400" = "ActiveX Run Unsigned" + "1402" = "Script Java Applets" + "1803" = "Reserved" + "2000" = "Binary Behaviors" + "1405" = "Script ActiveX Controls" + } + $friendlyName = $zoneSettingNames[$settingName] + if ($friendlyName) { + $zoneName = if ($pathInfo -like "*Zones\\0*" -or $pathInfo -like "*Zones\0*") { "My Computer" } + elseif ($pathInfo -like "*Zones\\1*" -or $pathInfo -like "*Zones\1*") { "Local Intranet" } + elseif ($pathInfo -like "*Zones\\2*" -or $pathInfo -like "*Zones\2*") { "Trusted Sites" } + elseif ($pathInfo -like "*Zones\\3*" -or $pathInfo -like "*Zones\3*") { "Internet" } + elseif ($pathInfo -like "*Zones\\4*" -or $pathInfo -like "*Zones\4*") { "Restricted Sites" } + else { "Zone" } + $settingName = "[$zoneName] $friendlyName" + } + } + elseif ($settingName -eq "DCSettingIndex") { + $settingName = "Power Setting (On Battery/DC)" + } + elseif ($settingName -eq "ACSettingIndex") { + $settingName = "Power Setting (Plugged In/AC)" + } + elseif (($settingName -eq "iexplore.exe" -or $settingName -eq "explorer.exe") -and $pathInfo -like "*FeatureControl*") { + # IE FeatureControl settings + $featureNames = @{ + "FEATURE_DISABLE_MK_PROTOCOL" = "Disable MK Protocol (Security)" + "FEATURE_MIME_HANDLING" = "MIME Handling Security" + "FEATURE_MIME_SNIFFING" = "MIME Sniffing Protection" + "FEATURE_RESTRICT_ACTIVEXINSTALL" = "Restrict ActiveX Install" + "FEATURE_RESTRICT_FILEDOWNLOAD" = "Restrict File Download" + "FEATURE_SECURITYBAND" = "Security Band (Info Bar)" + "FEATURE_WINDOW_RESTRICTIONS" = "Window Restrictions (Pop-up Block)" + "FEATURE_ZONE_ELEVATION" = "Zone Elevation Block" + } + $processName = if ($settingName -eq "iexplore.exe") { "IE" } else { "Explorer" } + foreach ($feature in $featureNames.Keys) { + if ($pathInfo -like "*$feature*") { + $settingName = "[$processName] $($featureNames[$feature])" + break + } + } + } + } + elseif ($categoryName -eq "SecurityTemplate") { + $settingName = $detail.Setting + $pathInfo = "Security Template" + $expected = $detail.Expected + $actual = $detail.Actual + } + elseif ($categoryName -eq "AuditPolicies") { + $settingName = $detail.Policy + $pathInfo = "Audit Policy" + $expected = $detail.Expected + $actual = $detail.Actual + } + elseif ($categoryName -eq "ASR") { + $settingName = $detail.Rule + $pathInfo = "ASR Rule" + $expected = $detail.Expected + $actual = $detail.Actual + } + else { + # Generic handling for other categories + $settingName = if ($detail.Setting) { $detail.Setting } elseif ($detail.Check) { $detail.Check } elseif ($detail.Policy) { $detail.Policy } else { "Unknown" } + $pathInfo = if ($detail.Path) { $detail.Path } else { $categoryName } + $expected = $detail.Expected + $actual = $detail.Actual + + # EdgeHardening specific improvements + if ($categoryName -eq "EdgeHardening") { + if ($settingName -like "**delvals*") { + $settingName = "[Edge] GPO Cleanup - Remove obsolete policy values" + } + elseif ($settingName -eq "1") { + # Check if path contains ExtensionInstallBlocklist + if ($detail.Path -like "*ExtensionInstallBlocklist*") { + $settingName = "[Edge] Block all extensions by default (wildcard *)" + } + } + } + } + + # Encode HTML special characters + $settingName = [System.Web.HttpUtility]::HtmlEncode($settingName) + $pathInfo = [System.Web.HttpUtility]::HtmlEncode($pathInfo) + $expected = [System.Web.HttpUtility]::HtmlEncode($expected) + $actual = [System.Web.HttpUtility]::HtmlEncode($actual) + + $valueClass = if ($detail.Status -eq 'Pass') { 'value-match' } else { 'value-mismatch' } + + $html += @" + + + + + + + +"@ + } + + # If no failed settings, show success message + if ($catFailed -eq 0 -and $catPassed -eq 0) { + $html += @" + + + +"@ + } + + $html += @" + +
SettingPath/PolicyExpectedActualStatus
$settingName$pathInfo$expected$actual$statusBadge
$settingName$pathInfo$expected$actual$statusBadge
+ No settings configured for this module +
+
+
+"@ + } + + # Close HTML + $html += @" +
+ +
+ +
+ +
+

Generated by NoID Privacy v2.2.0

+

Professional Windows 11 Security & Privacy Hardening Framework

+
+
+ + + + +"@ + + # Save HTML file + $html | Out-File -FilePath $OutputFile -Encoding UTF8 + } -Results $results -OutputFile $htmlFile + + Write-Host "" + Write-Host "========================================" -ForegroundColor Green + Write-Host " HTML COMPLIANCE REPORT GENERATED" -ForegroundColor Green + Write-Host "========================================" -ForegroundColor Green + Write-Host "" + Write-Host "Report Location:" -ForegroundColor Cyan + Write-Host " $htmlFile" -ForegroundColor White + Write-Host "" + Write-Host "Open this file in your browser to view the detailed compliance report" -ForegroundColor Gray + Write-Host "with all $($results.TotalSettings) settings verified!" -ForegroundColor Gray + Write-Host "" +} +catch { + Write-Host "Warning: Failed to generate HTML report: $_" -ForegroundColor Yellow +} + +# Final status message +if ($results.Failed -eq 0) { + Write-Host "[+] ALL SETTINGS VERIFIED SUCCESSFULLY!" -ForegroundColor Green +} +else { + Write-Host "[-] SOME SETTINGS FAILED VERIFICATION" -ForegroundColor Red +} + +# Return result (don't use exit - causes output buffer issues when called from interactive shell) +return $results.Failed -eq 0 diff --git a/Utils/Compatibility.ps1 b/Utils/Compatibility.ps1 new file mode 100644 index 0000000..fd1a834 --- /dev/null +++ b/Utils/Compatibility.ps1 @@ -0,0 +1,92 @@ +<# +.SYNOPSIS + Compatibility wrappers for module function calls + +.DESCRIPTION + Provides wrapper functions to ensure compatibility between module calls + and core framework functions. Maps old function names to new names. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+ +#> + +function Test-IsAdmin { + <# + .SYNOPSIS + Wrapper for Test-IsAdministrator + + .DESCRIPTION + Checks if the current PowerShell session has administrator privileges + + .OUTPUTS + Boolean indicating administrator status + #> + [CmdletBinding()] + [OutputType([bool])] + param() + + return Test-IsAdministrator +} + +function Test-WindowsVersion { + <# + .SYNOPSIS + Wrapper for Get-WindowsVersion with minimum build check + + .DESCRIPTION + Checks if Windows version meets minimum requirements + + .PARAMETER MinimumBuild + Minimum required build number (default: 22000 for Windows 11) + + .OUTPUTS + Boolean indicating if version requirement is met + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $false)] + [int]$MinimumBuild = 22000 + ) + + $versionInfo = Get-WindowsVersion + return ($versionInfo.BuildNumber -ge $MinimumBuild) +} + +function New-RegistryBackup { + <# + .SYNOPSIS + Wrapper for Backup-RegistryKey + + .DESCRIPTION + Creates a backup of a registry key before modification + + .PARAMETER Path + Registry path to backup + + .PARAMETER BackupId + Optional backup identifier + + .OUTPUTS + PSCustomObject with backup results + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$Path, + + [Parameter(Mandatory = $false)] + [string]$BackupId + ) + + # Ensure a valid backup name is always passed to Backup-RegistryKey + if (-not $BackupId) { + $BackupId = "RegistryBackup_{0:yyyyMMdd_HHmmss}" -f (Get-Date) + } + + return Backup-RegistryKey -KeyPath $Path -BackupName $BackupId +} + +# Note: Export-ModuleMember not used - this script is dot-sourced, not imported as module diff --git a/Utils/Dependencies.ps1 b/Utils/Dependencies.ps1 new file mode 100644 index 0000000..87c5489 --- /dev/null +++ b/Utils/Dependencies.ps1 @@ -0,0 +1,239 @@ +<# +.SYNOPSIS + Dependency checking utilities for NoID Privacy + +.DESCRIPTION + Provides functions to check for required external tools and dependencies + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+ +#> + +function Test-CommandExists { + <# + .SYNOPSIS + Check if a command/executable exists + + .PARAMETER Command + Command or executable name to check + + .OUTPUTS + Boolean indicating existence + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [string]$Command + ) + + try { + $null = Get-Command $Command -ErrorAction Stop + return $true + } + catch { + return $false + } +} + +function Test-SecEditAvailable { + <# + .SYNOPSIS + Check if secedit.exe is available + + .DESCRIPTION + Verifies secedit.exe exists (required for Security Baseline module) + + .OUTPUTS + PSCustomObject with availability status + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + $result = [PSCustomObject]@{ + Available = $false + Path = $null + Version = $null + Error = $null + } + + try { + # secedit.exe is typically in System32 + $seceditPath = Join-Path $env:SystemRoot "System32\secedit.exe" + + if (Test-Path $seceditPath) { + $result.Available = $true + $result.Path = $seceditPath + + # Try to get version + try { + $versionInfo = (Get-Item $seceditPath).VersionInfo + $result.Version = $versionInfo.FileVersion + } + catch { + $result.Version = "Unknown" + } + } + else { + $result.Error = "secedit.exe not found at expected location: $seceditPath" + } + } + catch { + $result.Error = "Failed to check for secedit.exe: $($_.Exception.Message)" + } + + return $result +} + +function Test-AuditPolAvailable { + <# + .SYNOPSIS + Check if auditpol.exe is available + + .DESCRIPTION + Verifies auditpol.exe exists (required for Security Baseline module) + + .OUTPUTS + PSCustomObject with availability status + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + $result = [PSCustomObject]@{ + Available = $false + Path = $null + Version = $null + Error = $null + } + + try { + # auditpol.exe is typically in System32 + $auditpolPath = Join-Path $env:SystemRoot "System32\auditpol.exe" + + if (Test-Path $auditpolPath) { + $result.Available = $true + $result.Path = $auditpolPath + + # Try to get version + try { + $versionInfo = (Get-Item $auditpolPath).VersionInfo + $result.Version = $versionInfo.FileVersion + } + catch { + $result.Version = "Unknown" + } + } + else { + $result.Error = "auditpol.exe not found at expected location: $auditpolPath" + } + } + catch { + $result.Error = "Failed to check for auditpol.exe: $($_.Exception.Message)" + } + + return $result +} + +function Test-WindowsDefenderAvailable { + <# + .SYNOPSIS + Check if Windows Defender is available and running + + .DESCRIPTION + Verifies Windows Defender service status (required for ASR module) + + .OUTPUTS + PSCustomObject with availability status + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + $result = [PSCustomObject]@{ + Available = $false + ServiceRunning = $false + ServiceName = "WinDefend" + Error = $null + } + + try { + $defenderService = Get-Service -Name "WinDefend" -ErrorAction SilentlyContinue + + if ($defenderService) { + $result.Available = $true + $result.ServiceRunning = ($defenderService.Status -eq "Running") + + if (-not $result.ServiceRunning) { + $result.Error = "Windows Defender service exists but is not running (Status: $($defenderService.Status))" + } + } + else { + $result.Error = "Windows Defender service (WinDefend) not found" + } + } + catch { + $result.Error = "Failed to check Windows Defender: $($_.Exception.Message)" + } + + return $result +} + +function Test-AllDependencies { + <# + .SYNOPSIS + Check all required dependencies for NoID Privacy + + .DESCRIPTION + Performs comprehensive dependency check for all modules + + .OUTPUTS + PSCustomObject with all dependency statuses + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + $result = [PSCustomObject]@{ + AllAvailable = $true + SecurityBaseline = @{ + secedit = $null + auditpol = $null + } + ASR = @{ + defender = $null + } + MissingCritical = @() + MissingOptional = @() + } + + # Check secedit.exe (CRITICAL for SecurityBaseline) + $result.SecurityBaseline.secedit = Test-SecEditAvailable + if (-not $result.SecurityBaseline.secedit.Available) { + $result.AllAvailable = $false + $result.MissingCritical += "secedit.exe (required for Security Baseline)" + } + + # Check auditpol.exe (CRITICAL for SecurityBaseline) + $result.SecurityBaseline.auditpol = Test-AuditPolAvailable + if (-not $result.SecurityBaseline.auditpol.Available) { + $result.AllAvailable = $false + $result.MissingCritical += "auditpol.exe (required for Security Baseline)" + } + + # NOTE: LGPO.exe check removed - v2.0 SecurityBaseline is fully self-contained + + # Check Windows Defender (CRITICAL for ASR) + $result.ASR.defender = Test-WindowsDefenderAvailable + if (-not $result.ASR.defender.Available -or -not $result.ASR.defender.ServiceRunning) { + $result.AllAvailable = $false + $result.MissingCritical += "Windows Defender (required for ASR module)" + } + + return $result +} + +# Note: Export-ModuleMember not used - this script is dot-sourced, not imported as module diff --git a/Utils/Hardware.ps1 b/Utils/Hardware.ps1 new file mode 100644 index 0000000..1da9ecd --- /dev/null +++ b/Utils/Hardware.ps1 @@ -0,0 +1,239 @@ +<# +.SYNOPSIS + Hardware capability detection for NoID Privacy + +.DESCRIPTION + Detects hardware features required for advanced security features + like VBS, Credential Guard, TPM, etc. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+ +#> + +function Test-VBSCapable { + <# + .SYNOPSIS + Check if system is capable of Virtualization-Based Security + + .OUTPUTS + PSCustomObject with capability details + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + $requirements = @{ + UEFI = Test-UEFIBoot + SecureBoot = Test-SecureBootEnabled + TPM = (Test-TPMAvailable).Present + Virtualization = Test-VirtualizationEnabled + Windows11 = (Get-WindowsVersion).IsWindows11 + } + + $allMet = $requirements.UEFI -and $requirements.SecureBoot -and ` + $requirements.TPM -and $requirements.Virtualization -and ` + $requirements.Windows11 + + return [PSCustomObject]@{ + Capable = $allMet + UEFI = $requirements.UEFI + SecureBoot = $requirements.SecureBoot + TPM = $requirements.TPM + Virtualization = $requirements.Virtualization + Windows11 = $requirements.Windows11 + } +} + +function Test-UEFIBoot { + <# + .SYNOPSIS + Check if system is booted in UEFI mode + + .OUTPUTS + Boolean indicating UEFI boot mode + #> + [CmdletBinding()] + [OutputType([bool])] + param() + + try { + $firmwareType = (Get-ComputerInfo -Property BiosFirmwareType -ErrorAction Stop).BiosFirmwareType + return $firmwareType -eq 'Uefi' + } + catch { + # Fallback method + try { + $null = bcdedit /enum "{current}" | Select-String "path.*\\EFI\\" + return $true + } + catch { + return $false + } + } +} + +function Get-CPUInfo { + <# + .SYNOPSIS + Get CPU information + + .OUTPUTS + PSCustomObject with CPU details + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + try { + $cpu = Get-CimInstance -ClassName Win32_Processor -ErrorAction Stop | Select-Object -First 1 + + return [PSCustomObject]@{ + Name = $cpu.Name + Manufacturer = $cpu.Manufacturer + Cores = $cpu.NumberOfCores + LogicalProcessors = $cpu.NumberOfLogicalProcessors + MaxClockSpeed = $cpu.MaxClockSpeed + VirtualizationEnabled = $cpu.VirtualizationFirmwareEnabled + Architecture = $cpu.Architecture + } + } + catch { + Write-Log -Level ERROR -Message "Failed to get CPU information" -Module "Hardware" -Exception $_ + return $null + } +} + +function Get-MemoryInfo { + <# + .SYNOPSIS + Get system memory information + + .OUTPUTS + PSCustomObject with memory details + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + try { + $cs = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop + $os = Get-CimInstance -ClassName Win32_OperatingSystem -ErrorAction Stop + + return [PSCustomObject]@{ + TotalPhysicalMemoryGB = [math]::Round($cs.TotalPhysicalMemory / 1GB, 2) + FreePhysicalMemoryGB = [math]::Round($os.FreePhysicalMemory / 1MB / 1024, 2) + TotalVirtualMemoryGB = [math]::Round($os.TotalVirtualMemorySize / 1MB / 1024, 2) + FreeVirtualMemoryGB = [math]::Round($os.FreeVirtualMemory / 1MB / 1024, 2) + } + } + catch { + Write-Log -Level ERROR -Message "Failed to get memory information" -Module "Hardware" -Exception $_ + return $null + } +} + +function Test-SSDDrive { + <# + .SYNOPSIS + Check if system drive is SSD + + .OUTPUTS + Boolean indicating SSD status + #> + [CmdletBinding()] + [OutputType([bool])] + param() + + try { + $systemDrive = $env:SystemDrive -replace ':', '' + $partition = Get-Partition | Where-Object { $_.DriveLetter -eq $systemDrive } | Select-Object -First 1 + + if ($null -eq $partition) { + return $false + } + + $disk = Get-Disk -Number $partition.DiskNumber + + # MediaType: 3 = HDD, 4 = SSD, 5 = SCM (Storage Class Memory) + return $disk.MediaType -in @('SSD', 'SCM', '4', '5') + } + catch { + Write-Log -Level WARNING -Message "Unable to detect drive type" -Module "Hardware" + return $false + } +} + +function Get-WindowsEdition { + <# + .SYNOPSIS + Get Windows edition information + + .OUTPUTS + PSCustomObject with edition details + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + try { + $os = Get-CimInstance -ClassName Win32_OperatingSystem + + # Determine edition type + $isHome = $os.Caption -match 'Home' + $isPro = $os.Caption -match 'Pro' -and -not ($os.Caption -match 'Education') + $isEnterprise = $os.Caption -match 'Enterprise' + $isEducation = $os.Caption -match 'Education' + + # Check for specific features availability + $supportsCredentialGuard = $isPro -or $isEnterprise -or $isEducation + $supportsAppLocker = $isEnterprise -or $isEducation + $supportsBitLocker = -not $isHome + + return [PSCustomObject]@{ + Caption = $os.Caption + Version = $os.Version + BuildNumber = $os.BuildNumber + IsHome = $isHome + IsPro = $isPro + IsEnterprise = $isEnterprise + IsEducation = $isEducation + SupportsCredentialGuard = $supportsCredentialGuard + SupportsAppLocker = $supportsAppLocker + SupportsBitLocker = $supportsBitLocker + } + } + catch { + Write-Log -Level ERROR -Message "Failed to get Windows edition" -Module "Hardware" -Exception $_ + return $null + } +} + +function Get-HardwareReport { + <# + .SYNOPSIS + Generate comprehensive hardware capability report + + .OUTPUTS + PSCustomObject with complete hardware details + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param() + + return [PSCustomObject]@{ + OS = Get-WindowsVersion + Edition = Get-WindowsEdition + CPU = Get-CPUInfo + Memory = Get-MemoryInfo + UEFI = Test-UEFIBoot + SecureBoot = Test-SecureBootEnabled + TPM = Test-TPMAvailable + Virtualization = Test-VirtualizationEnabled + VBSCapable = Test-VBSCapable + SSD = Test-SSDDrive + } +} + +# Note: Export-ModuleMember not used - this script is dot-sourced, not imported as module diff --git a/Utils/Localization.ps1 b/Utils/Localization.ps1 new file mode 100644 index 0000000..f6937a4 --- /dev/null +++ b/Utils/Localization.ps1 @@ -0,0 +1,209 @@ +<# +.SYNOPSIS + Localization utilities for international Windows support + +.DESCRIPTION + Provides functions for detecting system locale and handling + locale-specific paths (e.g., ADMX templates in en-US, de-DE, etc.) +#> + +function Get-SystemLocale { + <# + .SYNOPSIS + Detect system locale for ADMX template paths + + .DESCRIPTION + Detects the current Windows UI language and returns the locale string + (e.g., "de-DE", "en-US", "fr-FR") for use in ADMX template paths. + Falls back to "en-US" if detection fails. + + .OUTPUTS + String - Locale identifier (e.g., "en-US") + + .EXAMPLE + $locale = Get-SystemLocale + # Returns "en-US" on English Windows + + .NOTES + Uses Get-Culture as primary method, with multiple fallbacks + #> + [CmdletBinding()] + [OutputType([string])] + param() + + try { + Write-Log -Level DEBUG -Message "Detecting system locale..." -Module "Localization" + + # Method 1: Get UI Culture (most reliable) + $culture = Get-Culture + $locale = $culture.Name + + Write-Log -Level DEBUG -Message "Culture detected: $locale" -Module "Localization" + + # Validate format (should be xx-XX) + if ($locale -match '^[a-z]{2}-[A-Z]{2}$') { + Write-Log -Level INFO -Message "Using system locale: $locale" -Module "Localization" + return $locale + } + + # Method 2: Try WinSystemLocale as fallback + try { + $systemLocale = Get-WinSystemLocale + $locale = $systemLocale.Name + + if ($locale -match '^[a-z]{2}-[A-Z]{2}$') { + Write-Log -Level INFO -Message "Using system locale from WinSystemLocale: $locale" -Module "Localization" + return $locale + } + } + catch { + Write-Log -Level DEBUG -Message "Get-WinSystemLocale failed: $_" -Module "Localization" + } + + # Method 3: Registry fallback + try { + $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Nls\Language" + $regValue = Get-ItemProperty -Path $regPath -Name "InstallLanguage" -ErrorAction Stop + $languageId = $regValue.InstallLanguage + + # Map common language IDs to locale strings + $languageMap = @{ + "0409" = "en-US" # English (US) + "0809" = "en-GB" # English (UK) + "0407" = "de-DE" # German + "040c" = "fr-FR" # French + "0410" = "it-IT" # Italian + "0c0a" = "es-ES" # Spanish + "0413" = "nl-NL" # Dutch + "0416" = "pt-BR" # Portuguese (Brazil) + "0419" = "ru-RU" # Russian + "0411" = "ja-JP" # Japanese + "0804" = "zh-CN" # Chinese (Simplified) + "0404" = "zh-TW" # Chinese (Traditional) + "0412" = "ko-KR" # Korean + } + + if ($languageMap.ContainsKey($languageId)) { + $locale = $languageMap[$languageId] + Write-Log -Level INFO -Message "Using locale from registry: $locale (ID: $languageId)" -Module "Localization" + return $locale + } + } + catch { + Write-Log -Level DEBUG -Message "Registry locale detection failed: $_" -Module "Localization" + } + + # Ultimate fallback: en-US (universally available) + Write-Log -Level WARNING -Message "Could not reliably detect locale, using en-US" -Module "Localization" + return "en-US" + } + catch { + Write-Log -Level WARNING -Message "Locale detection failed: $_. Using en-US" -Module "Localization" -Exception $_ + return "en-US" + } +} + +function Test-LocaleAvailability { + <# + .SYNOPSIS + Check if a specific locale exists in a directory + + .DESCRIPTION + Checks if a locale subdirectory exists and contains files + + .PARAMETER BasePath + Base path containing locale subdirectories + + .PARAMETER Locale + Locale to check (e.g., "de-DE") + + .PARAMETER FilePattern + Optional file pattern to check for (e.g., "*.admx") + + .OUTPUTS + Boolean - True if locale directory exists with files + + .EXAMPLE + Test-LocaleAvailability -BasePath "C:\Templates" -Locale "de-DE" + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [string]$BasePath, + + [Parameter(Mandatory = $true)] + [string]$Locale, + + [Parameter(Mandatory = $false)] + [string]$FilePattern = "*" + ) + + $localePath = Join-Path $BasePath $Locale + + Write-Log -Level DEBUG -Message "Checking locale availability: $localePath" -Module "Localization" + + if (Test-Path $localePath) { + # Check if directory contains files + $files = Get-ChildItem -Path $localePath -Filter $FilePattern -ErrorAction SilentlyContinue + + if ($files.Count -gt 0) { + Write-Log -Level DEBUG -Message "Locale $Locale found with $($files.Count) files" -Module "Localization" + return $true + } + } + + Write-Log -Level DEBUG -Message "Locale $Locale not available" -Module "Localization" + return $false +} + +function Get-AvailableLocaleWithFallback { + <# + .SYNOPSIS + Get best available locale with fallback to en-US + + .DESCRIPTION + Tries to find the system locale first, falls back to en-US if not found + + .PARAMETER BasePath + Base path containing locale subdirectories + + .PARAMETER FilePattern + Optional file pattern to check for + + .OUTPUTS + String - Best available locale + + .EXAMPLE + $locale = Get-AvailableLocaleWithFallback -BasePath "C:\Templates" + #> + [CmdletBinding()] + [OutputType([string])] + param( + [Parameter(Mandatory = $true)] + [string]$BasePath, + + [Parameter(Mandatory = $false)] + [string]$FilePattern = "*" + ) + + # Get system locale + $systemLocale = Get-SystemLocale + + # Check if system locale is available + if (Test-LocaleAvailability -BasePath $BasePath -Locale $systemLocale -FilePattern $FilePattern) { + Write-Log -Level INFO -Message "Using detected locale: $systemLocale" -Module "Localization" + return $systemLocale + } + + # Fallback to en-US + $fallbackLocale = "en-US" + Write-Log -Level WARNING -Message "Locale $systemLocale not available, falling back to $fallbackLocale" -Module "Localization" + + if (Test-LocaleAvailability -BasePath $BasePath -Locale $fallbackLocale -FilePattern $FilePattern) { + return $fallbackLocale + } + + # If even en-US is not available, throw error + throw "Neither $systemLocale nor $fallbackLocale locale available in $BasePath" +} diff --git a/Utils/Registry.ps1 b/Utils/Registry.ps1 new file mode 100644 index 0000000..239adbc --- /dev/null +++ b/Utils/Registry.ps1 @@ -0,0 +1,332 @@ +<# +.SYNOPSIS + Safe registry operation utilities for NoID Privacy + +.DESCRIPTION + Provides safe, validated registry manipulation functions with + automatic backup and error handling. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+ +#> + +function Test-RegistryValueType { + <# + .SYNOPSIS + Validate registry value type matches expected type + + .DESCRIPTION + Performs strict type checking to ensure registry value + matches the declared registry type before setting. + + .PARAMETER Value + Value to validate + + .PARAMETER Type + Expected registry type + + .OUTPUTS + Boolean indicating if type matches + + .EXAMPLE + Test-RegistryValueType -Value 1 -Type "DWord" + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [AllowNull()] + $Value, + + [Parameter(Mandatory = $true)] + [ValidateSet("String", "ExpandString", "Binary", "DWord", "MultiString", "QWord")] + [string]$Type + ) + + # Null values are not allowed for registry + if ($null -eq $Value) { + Write-Log -Level ERROR -Message "Registry value cannot be null" -Module "Registry" + return $false + } + + switch ($Type) { + "String" { + if ($Value -isnot [string]) { + Write-Log -Level ERROR -Message "Value must be [string] for type String, got [$($Value.GetType().Name)]" -Module "Registry" + return $false + } + } + + "ExpandString" { + if ($Value -isnot [string]) { + Write-Log -Level ERROR -Message "Value must be [string] for type ExpandString, got [$($Value.GetType().Name)]" -Module "Registry" + return $false + } + } + + "DWord" { + # DWord must be integer and fit in 32-bit (0 to 4294967295) + if ($Value -isnot [int] -and $Value -isnot [uint32] -and $Value -isnot [long]) { + Write-Log -Level ERROR -Message "Value must be numeric for type DWord, got [$($Value.GetType().Name)]" -Module "Registry" + return $false + } + + $numValue = [long]$Value + if ($numValue -lt 0 -or $numValue -gt 4294967295) { + Write-Log -Level ERROR -Message "DWord value must be between 0 and 4294967295, got $numValue" -Module "Registry" + return $false + } + } + + "QWord" { + # QWord must be integer and fit in 64-bit + if ($Value -isnot [int] -and $Value -isnot [long] -and $Value -isnot [uint64]) { + Write-Log -Level ERROR -Message "Value must be numeric for type QWord, got [$($Value.GetType().Name)]" -Module "Registry" + return $false + } + + # Check if value is in valid range for QWord (0 to 18446744073709551615) + if ([long]$Value -lt 0) { + Write-Log -Level ERROR -Message "QWord value cannot be negative, got $Value" -Module "Registry" + return $false + } + } + + "Binary" { + # Binary must be byte array + if ($Value -isnot [byte[]]) { + Write-Log -Level ERROR -Message "Value must be [byte[]] for type Binary, got [$($Value.GetType().Name)]" -Module "Registry" + return $false + } + } + + "MultiString" { + # MultiString must be string array + if ($Value -isnot [string[]]) { + Write-Log -Level ERROR -Message "Value must be [string[]] for type MultiString, got [$($Value.GetType().Name)]" -Module "Registry" + return $false + } + } + } + + return $true +} + +function Set-RegistryValue { + <# + .SYNOPSIS + Safely set a registry value with automatic backup + + .PARAMETER Path + Registry path (e.g., "HKLM:\SOFTWARE\Policies\Microsoft\Windows") + + .PARAMETER Name + Registry value name + + .PARAMETER Value + Value to set + + .PARAMETER Type + Registry value type (String, DWord, QWord, Binary, MultiString, ExpandString) + + .PARAMETER BackupName + Optional backup name (if not provided, backup is skipped) + + .OUTPUTS + Boolean indicating success + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [string]$Path, + + [Parameter(Mandatory = $true)] + [string]$Name, + + [Parameter(Mandatory = $true)] + $Value, + + [Parameter(Mandatory = $true)] + [ValidateSet("String", "ExpandString", "Binary", "DWord", "MultiString", "QWord")] + [string]$Type, + + [Parameter(Mandatory = $false)] + [string]$BackupName + ) + + try { + # CRITICAL: Validate value type BEFORE setting + if (-not (Test-RegistryValueType -Value $Value -Type $Type)) { + $errMsg = "Type validation failed for $Path\$Name - Expected type: $Type, Value: $Value" + Write-Log -Level ERROR -Message $errMsg -Module "Registry" + throw $errMsg + } + + # Create backup if requested + if ($BackupName) { + $parentPath = Split-Path -Path $Path -Parent + if (Test-Path -Path $parentPath) { + Backup-RegistryKey -KeyPath $parentPath -BackupName $BackupName | Out-Null + } + } + + # Ensure the key exists + if (-not (Test-Path -Path $Path)) { + New-Item -Path $Path -Force | Out-Null + Write-Log -Level INFO -Message "Created registry key: $Path" -Module "Registry" + + # Track newly created key for proper rollback + if (Get-Command Register-NewRegistryKey -ErrorAction SilentlyContinue) { + Register-NewRegistryKey -KeyPath $Path + } + } + + # Set the value + Set-ItemProperty -Path $Path -Name $Name -Value $Value -Type $Type -Force -ErrorAction Stop | Out-Null + + Write-Log -Level SUCCESS -Message "Set registry value: $Path\$Name = $Value (Type: $Type)" -Module "Registry" + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to set registry value: $Path\$Name - $_" -Module "Registry" -Exception $_ + return $false + } +} + +function Get-RegistryValue { + <# + .SYNOPSIS + Safely get a registry value + + .PARAMETER Path + Registry path + + .PARAMETER Name + Registry value name + + .PARAMETER DefaultValue + Default value if registry value doesn't exist + + .OUTPUTS + Registry value or default value + #> + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$Path, + + [Parameter(Mandatory = $true)] + [string]$Name, + + [Parameter(Mandatory = $false)] + $DefaultValue = $null + ) + + try { + if (Test-Path -Path $Path) { + $value = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Stop + return $value.$Name + } + else { + Write-Log -Level WARNING -Message "Registry path not found: $Path" -Module "Registry" + return $DefaultValue + } + } + catch { + Write-Log -Level WARNING -Message "Registry value not found: $Path\$Name" -Module "Registry" + return $DefaultValue + } +} + +function Remove-RegistryValue { + <# + .SYNOPSIS + Safely remove a registry value + + .PARAMETER Path + Registry path + + .PARAMETER Name + Registry value name + + .PARAMETER BackupName + Optional backup name + + .OUTPUTS + Boolean indicating success + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [string]$Path, + + [Parameter(Mandatory = $true)] + [string]$Name, + + [Parameter(Mandatory = $false)] + [string]$BackupName + ) + + try { + # Create backup if requested + if ($BackupName) { + Backup-RegistryKey -KeyPath $Path -BackupName $BackupName | Out-Null + } + + if (Test-Path -Path $Path) { + Remove-ItemProperty -Path $Path -Name $Name -Force -ErrorAction Stop + Write-Log -Level SUCCESS -Message "Removed registry value: $Path\$Name" -Module "Registry" + return $true + } + else { + Write-Log -Level WARNING -Message "Registry path not found: $Path" -Module "Registry" + return $false + } + } + catch { + Write-Log -Level ERROR -Message "Failed to remove registry value: $Path\$Name" -Module "Registry" -Exception $_ + return $false + } +} + +function Test-RegistryValue { + <# + .SYNOPSIS + Check if a registry value exists + + .PARAMETER Path + Registry path + + .PARAMETER Name + Registry value name + + .OUTPUTS + Boolean indicating existence + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [string]$Path, + + [Parameter(Mandatory = $true)] + [string]$Name + ) + + try { + if (Test-Path -Path $Path) { + $null = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Stop + return $true + } + return $false + } + catch { + return $false + } +} + +# Note: Export-ModuleMember not used - this script is dot-sourced, not imported as module diff --git a/Utils/Service.ps1 b/Utils/Service.ps1 new file mode 100644 index 0000000..94bcac0 --- /dev/null +++ b/Utils/Service.ps1 @@ -0,0 +1,231 @@ +<# +.SYNOPSIS + Service management utilities for NoID Privacy + +.DESCRIPTION + Provides safe service manipulation functions with automatic + backup and validation. + +.NOTES + Author: NexusOne23 + Version: 2.2.0 + Requires: PowerShell 5.1+ +#> + +function Set-ServiceStartupType { + <# + .SYNOPSIS + Safely change service startup type with backup + + .PARAMETER ServiceName + Name of the service + + .PARAMETER StartupType + Startup type (Automatic, Manual, Disabled) + + .PARAMETER BackupName + Optional backup name + + .OUTPUTS + Boolean indicating success + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [string]$ServiceName, + + [Parameter(Mandatory = $true)] + [ValidateSet("Automatic", "Manual", "Disabled")] + [string]$StartupType, + + [Parameter(Mandatory = $false)] + [string]$BackupName + ) + + try { + # Verify service exists (throws if not found) + $null = Get-Service -Name $ServiceName -ErrorAction Stop + + # Create backup if requested + if ($BackupName) { + Backup-ServiceConfiguration -ServiceName $ServiceName -BackupName $BackupName | Out-Null + } + + # Set startup type + Set-Service -Name $ServiceName -StartupType $StartupType -ErrorAction Stop + + Write-Log -Level SUCCESS -Message "Service '$ServiceName' startup type set to: $StartupType" -Module "Service" + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to set service startup type: $ServiceName" -Module "Service" -Exception $_ + return $false + } +} + +function Stop-ServiceSafely { + <# + .SYNOPSIS + Safely stop a service + + .PARAMETER ServiceName + Name of the service + + .PARAMETER Force + Force stop even if dependent services exist + + .OUTPUTS + Boolean indicating success + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [string]$ServiceName, + + [Parameter(Mandatory = $false)] + [switch]$Force + ) + + try { + $service = Get-Service -Name $ServiceName -ErrorAction Stop + + if ($service.Status -eq 'Stopped') { + Write-Log -Level INFO -Message "Service '$ServiceName' is already stopped" -Module "Service" + return $true + } + + if ($Force) { + Stop-Service -Name $ServiceName -Force -ErrorAction Stop + } + else { + Stop-Service -Name $ServiceName -ErrorAction Stop + } + + Write-Log -Level SUCCESS -Message "Service '$ServiceName' stopped" -Module "Service" + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to stop service: $ServiceName" -Module "Service" -Exception $_ + return $false + } +} + +function Disable-ServiceSafely { + <# + .SYNOPSIS + Safely disable a service (set to disabled and stop) + + .PARAMETER ServiceName + Name of the service + + .PARAMETER BackupName + Optional backup name + + .OUTPUTS + Boolean indicating success + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [string]$ServiceName, + + [Parameter(Mandatory = $false)] + [string]$BackupName + ) + + try { + # Verify service exists + $service = Get-Service -Name $ServiceName -ErrorAction Stop + + # Create backup if requested + if ($BackupName) { + Backup-ServiceConfiguration -ServiceName $ServiceName -BackupName $BackupName | Out-Null + } + + # Stop service if running + if ($service.Status -ne 'Stopped') { + Stop-Service -Name $ServiceName -Force -ErrorAction Stop + Write-Log -Level INFO -Message "Service '$ServiceName' stopped" -Module "Service" + } + + # Set to disabled + Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction Stop + + Write-Log -Level SUCCESS -Message "Service '$ServiceName' disabled" -Module "Service" + return $true + } + catch { + Write-Log -Level ERROR -Message "Failed to disable service: $ServiceName" -Module "Service" -Exception $_ + return $false + } +} + +function Test-ServiceExists { + <# + .SYNOPSIS + Check if a service exists + + .PARAMETER ServiceName + Name of the service + + .OUTPUTS + Boolean indicating existence + #> + [CmdletBinding()] + [OutputType([bool])] + param( + [Parameter(Mandatory = $true)] + [string]$ServiceName + ) + + try { + $null = Get-Service -Name $ServiceName -ErrorAction Stop + return $true + } + catch { + return $false + } +} + +function Get-ServiceStatus { + <# + .SYNOPSIS + Get detailed service status information + + .PARAMETER ServiceName + Name of the service + + .OUTPUTS + PSCustomObject with service details or $null if not found + #> + [CmdletBinding()] + [OutputType([PSCustomObject])] + param( + [Parameter(Mandatory = $true)] + [string]$ServiceName + ) + + try { + $service = Get-Service -Name $ServiceName -ErrorAction Stop + $serviceWmi = Get-CimInstance -ClassName Win32_Service -Filter "Name='$ServiceName'" -ErrorAction Stop + + return [PSCustomObject]@{ + Name = $service.Name + DisplayName = $service.DisplayName + Status = $service.Status + StartType = $service.StartType + StartMode = $serviceWmi.StartMode + PathName = $serviceWmi.PathName + Description = $serviceWmi.Description + } + } + catch { + Write-Log -Level WARNING -Message "Service not found: $ServiceName" -Module "Service" + return $null + } +} + +# Note: Export-ModuleMember not used - this script is dot-sourced, not imported as module diff --git a/assets/framework-architecture.png b/assets/framework-architecture.png new file mode 100644 index 0000000000000000000000000000000000000000..d641e0be68ccd34e656b68a8d0b0c6da5a9b6471 GIT binary patch literal 57391 zcmd422UJsCw=Rqg3j!)Hq99;Hl&Z8y5D-z2uJn$IbO=&Hhu8oWAxf3ry9BABCU$x+ z5keBF2{p6;Nl0=x_`c`+?my1|-*f*n#vM0fWUv$V-kEc*xt{r~HJ|xW zckbOW-e_(O@5A4h?ycO!rA_VOuRROJlvdw3^~-#F#N(Rz<>jbX3&ZUiuM=LNd*dbF zoIJE&xLE#5gb~k)>8xu%f{H#8gx$E@%93@5FUo2~G}&PibS&mGt@7X;(yL5bN@9xpfu?wv`uCTE^t4|VRs#kpRyOP8NolV$hyR@aD%$adHH$f>3HCU8 zZ{}v(bym&B8K&V+46B#AX1DY4Z8^H1y2g6v#S{j!YN!MlZ3ampz}LNncA^iw?pHeX z2$`6gwqLy!>32g2-rwIJpO7#;HiWPZniav_aE(8~b0V$rq85}w33A(n;6gWX-8K)y zIla^A+irSxlw#CSbNNYFPwsr2vgOJs!DIu*lKOW1S0$4rzYo#NT4Q)Baf@mNt^DAF zQm2!|K_Cpe41v&Z^jqu)?&ahr&>kg?Dq2`@7rAt)q`KO;rlzKr;g1h2Ji)``fejfh zvvQ*Q7b*X~)TQ$vD;a!JbjnOFc6lvC~ zbi;bTPC8(@UC2tfZ5Y)-FC9DtTsky_al_1)i_>ed&-dDlZ^(mmH%awQ$epjIGc z8H`M6-z5(90SF_)FeuD{y{74lB$35EOBf2goH{yc2}BDFLbkp;r!E&t^92mD0pWb( zY=al&6OxjYQmNEYuG2EN0sp+05-&PDe(YPs)|;PXJE!Uy_~MB^WVC6uU7WenK$|Ny zv9z3X|C0|BFCU)TF&GNODRO%j@H)=IcJa!!b7~_lXuN$;}H{Z;Y zIiDkyMB1jpNOu`#v{{a5+Rr{n`kHS4vP*9+eWEWP?>UsV8^-h>4&$k}j z^+@W*@J%zfebz_#rofw24A^TU=jO5bZ47@eQGiCUmx{Z{px#YqGF@zXV}A_hdCvDo zr5c2Hbaf4le~WzaTmlM(2GJLhP-412Er}oq_Pv}l9SwO7@&&*p^T?<^;%+fN2)f4OcjT7`s zrZh%a6)`wyY?TVQ&0vsWn@;xO69t^Rrhf`vswY}AvL;<+S}BG0nX^Df(Ds=JUO*M| z$_BaoPOw>LeT1oVE88G+8bz_sAN-`koLfIby4B@ffb1P@^e^|Y($kBkZ7jNpAA(Va z%;pD+jcWbILpDa7&T+JNSOtXQ8lWX*WiLd-Nw63g!#b2!=p^{-p=q=IrS)5 z+_RO!{>iEb0|k0MlozB5sryGwa>Whx*z581`J`3r!8=KQishLh<*Cd~L7Z{mLi`eS z<YcZCdvDf?!hjZ`4}1*QNA1$E^2BTJ9)Wk$HAS@15vjL zr3^6_cXBakW5Ff(e7=#7M+0=e0ItgX#d5OyENT3Jd)JGziD~k6Y4Q!0Ic;Y#^qN=z zavR*fgA$-!AjB9uR9+H#d3b-m^qV@oR;Igaq0!62*!K#Dt|^bHdYjR>@G>>!YbpNM}-Gq_ecc%!JY(lFw< zO!WnLOD+JE4h{~A{xzjZwn17TIRDV&_f!Ccn`?rRODH;oi1?Ip)LXfp`cZ{GCxCxN z09}OdRBHyh1-Lxp&;}Z^Rja{CYp>y)sX{fsUEHw zQiJ3>N}{9T8jZcqeEf^Iq9Xkql+vwsM&oJ73NZ5S zb888+{kxIBIX3?(8TfScpWEcxIP)1QC5rDvoiFCDOg-5BAMTfKbx}>~&wl_C{J-Fd z{}x;Wv;E*x7bt$X6*5Mw-qVv+`!iJ94b!g<_HdikuZD|iMIel4zP@fy8Mxs%i2~KQ z%?ewF+}O46mdn!Y8vzCPcP*2BJ5f9_wHM59zrNU@4(nG^QXO>hd^fi=jV!{Vl4`&k*II7FJ0@{a0*?zi_~^Qfa8-GS#!ayZQYp1E2?{`|BTd_8!Bn z%x%V73!GuAb9|T`F}STQUC!#Ql)u4RNmIJ0RY<{a+m$pm6#EqpnFm`&GS}`f@<(fP zEwbUF#T(VG3Lb_d`c>R|H9n3sxuNdANG#r;%mU@Kf|NoIliGm|L)g1Q0={(yAs=MG07Yk>Wz|)iy2Uu5 zHmW_`L+$aQKG^78PW}5UpVqsm6l;%svLruvwEmj6kf7m+O}Hh@EIT8WRlqMI4`C(@ z6HJOI{^5tr7lKC`%kTAc5%PIznxO-$Fe81Po*zL?jbZsnxBRI{*s+isSUT#813qU3 z-C%=y7mE!uW^Cxmi|H}aS~l5DX$~2~!D#5?3(+XNzzv;&cg1F-n_3Ny<7k)dZy4=h zkV|R4bfZH0Dsp8Z;+2fca%BNl6CZ$IR<3&b|C{M%~Qyb1U9(@k)BlBK0n3 zjUnlQE}C>Q&JSr56?YIQf*Y@_1?tSM}7>f(M;kYh&FA znEN^pdU_Mu(>@gZ?2?{uKBmTJzaH9fr3&eq!OU+TPVLy7TI`rjhkbIWGm#9nkdL{U z{646$QuHpF;q*(rm`kJ6+tZJfo=R@hH=vX9^#yU;5?rclYc>Ve%0uS-g1T zf)z`dc8{}0GR=P1shp>PQ^h0hju&y&SFf8-+P_5^ObVm!;5Jbo%TT(-&CSrzBHiMX zt0Z+nT(IR_a2fl{!zH)lvc;R99e3I=SlcG11~yCHBz0Ua8JRkykRPVWpqb9~($v)$ z>jyp?(+luk5^6_(B%M zE%se)98NW8UL&cSlo5bI;7#Zh&omO%*O@C@y3(!uel{I^+kcxbIcI8Btga`4ll9GK zmrg61r)O|+-L3a^WgxQNirHPAe|f=Nev4@}=s^gkMX{jGPzD3_`4LGX?@6aal;e}i zO%mPLh>$30v`$iA#6IT!(1xBeED2Qd-4md0CbmZKe816rCc)CIPeo`qzJdqT5DLES ze4mcgxL>0v&0)-3$LNJw4iCED=J_R1m05=EE36F3MF0X|$8zc#k+^Cz00U&YZmo9j zU4jJq-WA;#NfO$qpSFZu?P#&c?brl6oixuYNkn~2=_CWG-F(5ez`1G-wr*S2jQUVN zCFARuT=qGXBjY*gudYd`4(e-tTjTx{JJvkiPYEzh} zA`0tMlY2YfeTrx5WePOr2N6De_B^}%D$4j%q}272qfS>#C@nIaVOa-%%4|4895*)UpKTpEaTVXuYt z3qIyeU}AfCIQ&d7sE*-lmGC|J0hII{EPH&H3pk7KuOEE|*nw=Ycy5hK(Q{;Te5E?z zv^@B_0abp>k$$_xf9{xUY9V=cSh6vycb0-4#M1L1JeIaM34GSGKr+w9r1n2=`DXV7 zpOHUhz2q|d3tR@_3Cki&%C(FX0$1DcOp0U+3HB?c=FgLbADyh=KK_?XCfh8eo71NF zD0$#|>XGvr^ne-4e3{Wqqds4lL0gSvsoBo<4ckq*fEzECuB8baSB{7v#h9T*m2I3$ zwH)&Bh{hzsc@JiS2i2V1hZGNTxwSYrAJst#H%(;0-;8W`lVh3 zI(QwcN|HYA=tYGi$qr@Qah!w3N-Xbs)QsX%DHk+M` z1FGMwNkC-tl$&@HZhk1O*r?Xub}HJWWHjOjhlS;YFT2KgE;SCB&Mh9JbRsNBR*tiO z-H>|bmB25Ei8TN!rd?w=4>YtuF)W&nA4KGr2@C8v#`dvW7+(|-!A_ic_Ya}UQh#%? z^@sPJ-T$-w*U8s^mES1CoqClceC#zJ00=iAr0)Z%Ee>qBhvr*M+odG{pQz@L6dFxf z^o8u?>9O*E+4%oTEug=20iwaadu_B|cAr!=N3mcBFOXeNIW#XOTMH`u!;-osW6$#K z{%7aj|0#|9FMIM29s6JL(*Hv@G&>bRyUfz$c3q2tmyB($MTJZ&3DoAEBf#!WORJO= zdP0|6R8c;a%xVhthpY8bN*_0DrKla|o9<&433~h)N*jj@4bC`r<2)L>FPmb9!gI=0 zg*#iqfAm6wXg_Kj!+?-I89&#``;(J^)=@nzwP?GXC$l6A)3{M(CDI-7NpU^ZY2Rec zZ#b>AYR~9f>3depiCjzMf(A~tDGA}N@Fq)eH?0H{T4YH=-|8zaT=h+VV|%7NHC;(R zqtB|msU(tceR_KxJfLbN2tf?ybe-p9)EGcH;m#hCV$dDU7J|>Xi$)zC} zpwAP=6NHKkVX2h~F!}UY_ExVL&E?!RA4%UhF)j-=Ue+=^)tQS<#v*`hh zCXM}D8irlMJS%(lF^irt&@-2p%27~pBcErP6dyCJWhO%LT3Qu|AJi#P8o0Cv5db9> zH9m;N`aw9U%omnPq6~~|qHZg2rG3x#{YEYFxA4x@P1E0zY|V{U?~aUIFozq^k1 zC*Jgf%LhOB-eWNPUKp28kKByC*gV~Omfw3`GHBTjGT4RcjE#$=V9osI`S6`r2`j1A zCD2uP?Z{Z`-NgQiC=RaINYwTWmJ3^$?z^}!!Aab`JPF}l*A$rDzWSR+dYW#7kBFwx$pE!odH<{n0^W6 zVxFOnCa*mdP9><=cl#I-1W->?DM3%@&Byzo4lWK9GxDYh6D~Al5Rr;0_Zjig`Pp2| zi~uKMd&;q1_xESQXJ$aLJr1|m#wP-f^uf_WTe*I2O-lyVFaoHsn0n~P;`PR4&|2^Y zKaiQ4lwjv3h`vnARB`F5iQ$tP#GBvbvU`}AI0{|6D}+U@oAorBOk(98q{NLMp{4`j zf674!PiW(PZyPkFnd`fr?<7BgBCccOHkyByQ7z4$k+{oaIk66t@^e$d^0-DAEwQRrS5`fAy;Xe@3Y)Oo_K;Z$HXO(dG-+hc z)$MuGr{A4oR?3Clu&AH)yeX}`8r7KBT%OWm^U1_h#HK9sItLqiwM3}u@$|N7v#*cZ z!kZN|9aCj!=*bzIx5tG);i8tZ{DY?#DfiJAXJ7h!L-4ITpu(7|E()w?jaC$I+lMYcnB+1$QJBzkGnEfL_;Rn3&Dmp@kpmLIm^a zaor@ObU2s9?K`(K3Coicw6$^XFug9A6s}YA=32|zX0B8(oCOZdT@r>U-8&jC?9{f{ zMCoU6a}Fb%G6s9N*83U$#8OfTuH9}~lOaE=p-iGH6(>_)P0_WbP^{ja5e57N80=nh42_KWP#q1n~zU}pmnRhZ#` z8RHHusnHm~%F*qp5XRNppF0+btsr4l`gm$>#dY8Ho-%>ds|10*8AVzFbN;EX3I4Lx z)33cyF|j&J@N&z$)5(3uR*1-CFRwM~GScT7I<^s*CDvzp2=L5EvSz28Z1?+4tW~*r zOk99v4|68ocm1ut`Dk4-H(BD3R!fwvIPPIkZsxOuH&A|P)h8O-4I2JOKP@;% zkcDa54fp4ph-N!}kP%2;8Im+>_rYLX z9JX@5r84`}^&kz=CbhD|7s?aom_;n`@8;8uB}fFA%E!R}2t4RgfM!ya@A1+s*SwUv z6CdC>K{mOiyJz<5r`p)U*4b`A=cP-&a35TA)O`R#H#K-_O6RihlU>$6`obx*gh4CF!`^ zOaO#_{8~#$JbKHS$3kzsWuyhyBrm+|uPiKuF1LoUEPzCnGrxoWP;eh=b-_|g5rwl6RtM)Dbv_|-?G8$gE7F`86T}|Z@6T1|%4??|Evahq9qH)< zQGO-LHi(g>7*C!i|DZgum1aOYmJ$zIo|)uxJ#Fr*iiW5P3xH>Lq$< z?c~I^``Ym@ne4P0X5NTjcGS5@85Y#r zKcC|*=qra`S@ohTuG$>z0`^W-`2<@V(bQbLp)?M*31vzk-sybGy-3Tn^Uvf)u3^Jc z<}_Q5Ee86i{ym;|=H6jBIzax5rH=nTHY@Q{jv%Jo1E?Kxia6jGN=U0}c#*tG1pIm9PdXnpv-47+t< zj@?*MSd1U!=ZNsfj>h{SdZLD4+2B%~**x=x&T-;pyMv1WU87|q*^|gK7zL@|eW!0g zR5ZJ41%6x6oVYDd&E;x_c_nES=O;_QuVA12iu(|}?xfr}{Z=ldX}Crqsw06E7KRH` z860b}m_aI=tD?DslHmON5No!wf@;1*Jt^Y1#mxjP8J$?k-jHIww6n=%?h6FvvDCg) z)Es;!Iv)w?GKk0=@-$P%$n_M1eKBR!A`0vCI?V`E*^TSvOs8fY{;=GWRvYEw zbsD0z?nAyrLqX)C^&3Z+GC035W26MBZ(Eib(BrjocXq@nW5Cm3qo2_sG&FP1;BC|; z&vz}E(Z6%p_1w^Q92&V%1a~d=9SS@G$NB z#M(SUwACXxRq0M9U-mSa&3rERH0=B&Ruian{SuRR*p* zYn>YzYMZCJquHMRl7Vz#n9oZo!zGCrw_ENXPCp&+h2e&|?tzX1=lxG))Z`K$oA3Ug zPv?z|pVU~my=F6O+)0$}cO9-hKvh2eduL~M;&8GxTdzjM4pHuy7nyy_4Eha}Mxx-f zOGSDTK>v7^eRCoDM{cD3E*IsVM`v8QuNC#CU}u--RROT6`>)mE`PLz>Sk!}6mOD3?8<##}vab=k0`$$Mu6Pi9^kYVQ5x^!w?Bk*+NKeD9Z*iUWVIiwL z9)vZmC^#{0Jsm}3B31i(Hq(5T=8k=}kw%4@W{-wH0!~NgmPddx-qexbcY7M5Rrr5nz6G8|das75)I3)%l7m09Zk=_0uf( zz;b`I>4s!+uvxwhR(&7k^&2a%Gk{OOZ}Doqn?G;RGtZGOaJ(L3W?diXdjqtju?zmFVh=I=dH#sM7^mZwE$omrA~DwB=WI9mJAhIml-F5Zq^-^}ttt**1C4 zij%I)cJ!Pl2k&1?-3`aPsCA+`h1Qi(6+~wk7_+$HD)b3)`LN?7e>-cq<7`G06jx&d z4YcP#v|OrVgw%NuGpHl9?cQs=%=RRpuL!=bV^skmf zfbVthZYcQYptipH=bpBWTiF$(4goU_^xAd zn;#cULcK+lU|D7!s>eU%{$$sAD*k-3zL{&RHY(rT#tbCtZ!)3Ux$;I-i!hrT%%UE_ zsSMIi&z7v~sBU&^uD`HW*d6_Fhp<`{v_QV)Dqs?yd>EqNzk9B1Qxzl9CQ0wynG)%0 z7u674bl)HTc-C#<(o%Mc&(bx|zYdCo=IYi*8%!yVhNnzTR9?D&@I-8|FSV(E`K}{&NA)KI+vW{LaED;c-!9h++Z)Q=iH_+Y@wL%U zcHHl+r6H$rWf&7X93wp{UC;7|B6|2i9F5XuMB6!g0_w|u>u zPF%0Z>yY*dX?aP-e+tW#7nxNG^`O5%W1pijV<84K#0xlU^);G3wJB6_-{*2VuEm9C)ss0{ z{*RGTOm}3T|2hVKY5#N0P!#Tms$<`F#`*z1Y4psIB(KT1->V2&A|2Gg^#nY1Koi`1ne)toIW2L} zWYlcF=jF0o+Q324F5QG-i58g`{>piAg~r>3!v_!Kgf?-B7sFLcr|1`?hFj=vO1iK} zTdaE0d|JD@wOQHF`gV|PiLd@NzVKoYaPJWxZOy?u-^w{x0y%*x8`(|8FXk`RCUei`4(hquq+Zqwwvg; zgX@!WpC#Ilq-}S?CTHl2P2`GIq0oF)+EqfV zDbdl9?|Ke8r}2gToF7Z0+b_)J1~zq|1)G|>t^0@70^CHE>+4O?BdmNW;XX6fhFpf5 zH?=&t!|9ym*Pe2VeWk^t=Go6H#^Fxh!Gd)jm~o32g~`f!4MwysvcZ9w{>4oV^|M9O zr3t2Cl~L@rLq7!GZEFjIZnJ{>2~*!igQ%M|j*h0e$qpx7Pe1Y@xJiQ1elv9Xl|lI( zT}M`^FX?R3#b%$?G*(3SJu_TD^qB+1=46q?TivypmmnqIR?@ELPjt1cr>cHH7x&cR zLc6kKe)2syg+G;kG=(H6?R)P#tV-ao+b(uMFych@XIVIy{@k#-ec4F(;@716yf$53 z<(|nYRqTnd##~2JpB5jOV4a)OI>&yvPM|!z%{rCyDx*5WBKfoq9; zM(5_f+|e2P0|p2C#$Q;2S6*|;1188gs@Ue^Xo>^U-FJXDkJs7fQw@ z14}ZHPf=^Lo)PG$$Y#|(1-a7lhGdE|XN zSRVpHCfN+EsdUzMtTkJjgNuW2pezb*5XEtQ|vdwk^%J)j0g zyL*to>mxU-?lGnB^G}0n<;TMYbeX|B>g97K9lS+8Q%4n&lXc9TvmOOApJf?v<4D1y zwws6sdW=xR*vKytJC67t6j(2d6J?>ql_8M(}j4MIBHFJj3lXs6CT1q`8lh zaG~mYZ*4tU6^II3pa1(pA|<>#TCl57INfZbMp^C?RxyE0)fEPB?9h{g`eFGxQu8I` zZ69e|m&mhMDTW>nM@pqRR8C}j`;Oyr=Z4y*QpaaQp2CCh1zvF&JZK= zqKr3_szz0b%XZ;wxTq&W#CsNSJon(rxM1GTS8QcV;X5uGJ)6p-l8ZfA?PT zQ1!xN=N{SkdzjhaPlZ4Zw<*Wdx_Y3bR-zsnc1XRv`BpJ5uOqH$a-20=qN5M)8BkIn z#H*+d6up6m5P6R+P67l)GbU|7q^&tVbwmeb7n~fV5SG*B`I7rhUEkuH4&QG-G7m=Q z2ji)v;i3MXj`*OJKtV<0@}%aqnLgm?g2={V_QI}NgnnYANc$;g99p&&C@{6uzB6(Up2;qh|*)3KBE2v0Ye6;fi#mBMe)Lk zmTZxlZh*@>5Txuuh}~=tIpoACqH~ymHh;hm2mTL(Cdul-R8?VRX{NR3l1ed)+KMTe zWrBg)pP6~*Lr-Kh)^FSwt(z-T-Wx!$CZ+i;ATSy4S~yq?C-!gjSqQlz7ImeKW)mkN z$U#HFnUtO7(DxTDGx~#kb}t*fxR(Fc0If&?#Dc=`g!NarQO_Eo>?3zzS;j1->Zrx4@{k`2SmB^KWXE|9zd(|Dk@+e?v+2e}jb?E-+@* z_!!A(%{M!&oG!OGE=QCS_?Ld^U(G(b(eUAn#dbe1axdG{?xp{beYF8HD1*3v#wV-! z_KB%S_2>T#^@LCdujIcPj=N1m;68w=Nh;58SL~$!{;_w3_3=Na3mX3alQRAD)K(KUtn&8h3FG;RmyS4#nuVC`B|YvG2T2jh#dujP?y z>}KV#wDOeuEO8@1QB#IA- zQjT!mrQV%Zl2k*?Kqhj>^kWegTb_;&T-Gi%S25K+uP$m+PBR24H<$-miuA1)5=Xcu z>K<~s%R#vIpZSOlRXgIe+(t|ZXB7bYEn$T%r#!CvGmMc26{C_sS`vQp08*CFn4pGm z9BrG1_MRA@`8FagOx&t@DV=q(KOMg=iw@YvvcZ_T<*7{uF+IHuZ{!y4feVzC3O0i zJqVIwSxRW(kjIq&RF9xQXmhNaxQUT~^N`crZ5sm8&{JuzfQgQOaRFJfJtHXJqcP#% zB}@~G&o*5SEj)}0-3WAlt|?qHha{KYH{1-m~F51v*o-`jF zI?0a@vx^QbA9`xM*7L$s+h`KMITfW&+pAupoL@D}ryZ*z(^8ZC`;DgX90@-VI~_Wz z9&CNE?-csdzr;p@k3!0Bfb$5dHpLJgW)flrA`rro?4QxA&9B&p> z2go`+qONnL;WT{tl97hM0r1zxTR6IQ38N^q(kh0f7P&z&MOz`_v(L>X1zL*Yw_E$O zX4lpZL=Ph2LEsI=bg-ADp(oV9YstmR115OeY5Ue`;OFLQ$;ym7{l%0<<6L|LlX^nH|>*E#=!{_u3tf5?pJ6s}%z_kF~cBTh>V^^PG4c1Hs<;j%5XKW$ebL zSNj@=H`RotB`R@X82ds~*p*PAUCeu+)vBX&?_3!qR2=&CKA*%r1M$IFu+J6SNxW(} zXT<(FL+V~Zy#rxQI`mP?qvbE0-)0(RJ!O`=t2GmsXbJOs*LM>nYw@;ZD*%ErO*Kg& zAQmvoeisAM6}#dY54sU~G{vHkRNbJr^$dl4@=Ee%pAz&H!sW%I37EyG@613kC3W4_ z<4M85@9+_A1gD)-F(Ccfg+&zEh2<^p_Q10UDU_%vJfdyd;dWELuo>}U_^sVt=JT}; z3^aZ(YuAL&-GA$6PyErD0%EbbVbHN#t{=+=vsoecVJlL(GIF>5n`p`+2W?%wEXiH0 z{PxmRH?v}7^Ov0E#l0!VZ{06g1zy3TW-FNZ$Pu&U)h zLwv9#3&({TWw$pa+w8a+&Lf{kcJVxE>Ip5!<=g1&(;2*<7xUX1subuf0 zHnv5P|4Gnej&N4{Tj2aZ5d^<;HTFBT|H+$+aZ&&HM|yYu@V{!j*MG~g{~IXNzvS_M zcM{4R-UgYOb$+bypa)sic0(3iv3~d4BWb40gAL{{d^cvrJ?Ix_bAkzmJzku(9(D-9 z(g<9wUi#>($i$-cXZsT*lZ%6qikp5?sESXn5bIOB>o7JjVplKzMM%I^yHlqAsL1?4 zn?1ChKFRUqG`P@HWjm4P{tMB;n%oyE-kjYQw-q$m#l*nm0_#xmEhGDvv8>MX6n;gc zW{qy+p0@JYqN+cGS@+nIvVVc6rv!5$ zIK9zER?d*sys0*Qy;fLxCB{_3I-k=dMsTt7R9g8yfhA-4)0Vqw|GkXseH(8#re(3? zB=$|coStPxZ|BCWymvuRjCIZk2eNqmRh9g$QN~9Rt2v7V*P=w}F3ce(rQM64Dhx`g zAvPXdwxA*}kx1osH4cJ-#<>iWV9J2UhJ=*;@?B--;ED8+#$kHZZGjdM?C930$Jk>J zq^XmFWZ&eAX1ctgz$RiSxlm)&7BrD90f?PvLgGe-?^P}`Krue3;nlF1$<|er z)23AaLRhSZvU6}3GqMw<8|GTpy&&29nBF1MLVY<=JX#tHn#&J+-Oyc$J9Wbl?rE9B zh`Cm=@rBT>@Dt^i-7?Y@Qg^&+x(?49aNR*4YMgvyA$R9jNh*DjNssQ+p~pFW8v7rhM{0B+K7>VvFqY_%9;Ax zr3Sw?M_mmh16xo79l6a7nAGB0+DqkqrI^-aW`1%{d8nSIys=NSnslm{zl$F_sLWO% zD0%Xg*8xk$Q_vIASbbQTqgCa!skoYA)ZQ=W)Z1ty{Rib632LlUsrE=ytjZJiGq|ou zE67jjvs$WHIiu0~;ml^!Vb7vOtG%#3l|R{ftX`jIDmIT3-f6rP`=Wm^*->GjV6U>! z`QP#mGwJ+KCgi)q9LqO?kqN3kHyvWVH4Z)(Fml8f?+Mae6HWY8`EA2&(ZeRX(@N1j{9R>Q1bFQwPD zeiVhCSF7TatdvxhjsN(Cagow!l%FW#;Ustm!&vkaKGgllwG4M~`Z{XE?|QOvJ%1kmx|@D&hklHfW~x-)RTf1T=Yn?f9c${c73-fD=I>e~a#I0FV=)`w!u6k) z*i~iGo>~+BYu*LkqN=5aBCbp9RrrKv6;sVjcud%i#1KGxu5^XgX)_aqp-z`Lys4v4 zgOgiK3Nl@~GGyI&FXYa$QtYZzZL#j*6lI@0)hM@c`_qr^3J=Z}O~X-a$$qM(!I_68 zERH(ChHM$@?@jnsykDDUo+=qhER=6Zhi~-v{c-SVch126`lHc6x*BZ$9jRz z1&*6>?SAYskdTheL{G6#lG(ECqHe2o@0plL574iq5#v&B{r#@jPw${hmoehGZ0e&g z{BM0!)Oy=emTtdYy!u-X@6MfoGC1sD@kJV4BKG5xW*Ni)w$;hDU z^|f%F>d{~>dZ>T5$`)M6R&v|^NYQy zxzbZl{Az#M!YE1F;7@c? z1fCOqTYY$jDEU3?g2!`(gkLQMj{*~A(iY=CI*4qnxH(UJ;7f@K5Y)A?{TLCOKN?RA zek2V<>S@8Tsau_oyHm?@+>3qtk3tPVFe$5Lr80ko{W(QV&JTYFrB>Svb+dc5@&$;c zN+lq~jW?;mX?hp61{|YJN_=vAhGK`yOk*6}T>c0l)&<9tF&M#iHKPF z@!I_^7*oljqwbr=!{(_6Dm7B-`eKZK-ta7llDEo#Tr4*8!|CL0A0Qkp<%-YT2#P;} z2(4JW677oi36_cfD5`zLBx|v~&93->)k5Yu;R~KIZ>nudW0W>O+^|w`n@HqOpfj!O zEvhoglPX&dhQgt~kn&*UVhDH+dJpALwbU&=C>CvU`q>Vp&C=RmZz-ZyU;pg)>uibW zj#~Mf0_`7=#tue#yc`nA_OszBH4jR);n%HlP5gMRD)Zl%lspu({MqHNI~8hn;0ndE z=0TO}&FRONb)+Tr2TSDXX^l^wEf;C1+J3Sbx?)dp=0V@y;VIxopq|LA&J;bOzP#+1 zI_TDd2+GGNp02Ct5kOpP;dYI@5O=;#&{o;>zbT zlOXN$kwzuBG|T(w%8Qkc@x(Juj1hYo9uSr7WW5;O<38P13Z4)IA9B*k@ni(z#YvY$ z9itlw!PQhs&=ryU7^_+V7Yj?%iH~iyawLAvjHrTg^zYhiZ2j@J>yar{_bAgjfnlrN zeLMq^2OMsL^{iCX?fpE4;NPkbPt%x(W9N){C!qExgUjV?z z94(qu0%UTcBzFia*&{8~Bgi`BMnY=Mqa-;;@E!*sXlLVrpsl)F6k90q$Zv)Z6RN2p zpQ>&RU71b!tvp=a_sy6=+Y|cR*{SsS`Y*K>JR2}UxKLNs?Txbo6Tzm69JM9wBj&O3 zd7_ChGZVLybCv5~vmCTF@MjVvg-Qo8Q3;b>t|^;AIY&LN>Qtso+>b7a(JD4_ zjBM75cS!Srdr&qNiBxcO#rn6=Za`|m8-^bP+TJbXdU>o#*~1h8F=tZ8G0TAlOP$k! zKGlwIK%W8L0;zGdsGKvsqGo^c;Pbu5ZD3NwE=kbjnRj`j+KxI(W~qy!yl$H9S9vY= zz65BBQ6+o+-JzBg=8aQm74H(3PqwZ~2Zan56ZiWJ%TZj`aS6 zVPmg0wi}w4aJ5FAh!+*w$}{u~>oVS!pQWE;rv=*Tt~dKjT+iCs8UH*8(70G*ltX?* zJ|FFc4JQCm@{-@X&{mNkw;xhIZ8`PE6}I{LZC9>Ur8|h0 zxOTO_qi>%++k$j6?Gy5RP^{6zTQ*!W+2yo1-fZ|+40d#~CLDM;=`yk6hzreK*6PCT z;gpa`_u0sci{juc!PuW~xyC+f+z^I@CnKHL9K!PSsR&8zcWeA`NW{H3iR5bzQ9LFL z^N05y^iOtWtzn)TMklXKKVPF6?O!{|Gcw!%Je>LVropt32UesQ7RzdYw^8#&u9z57 z-uDv3Q9b#x_lC{@6Uubds{=OMwlv9wmsqn;wpx))EXa^oF18v@7bkUj zyQ4m&jWsz@po-th$Vmb_)F$R9TUf&tYMQRzVrH$_AIy)hu$(M{8rKGVT&KBqtXBQj zmGZ~fX=Wl%rQ1zwndoQ>o&q2893JE^I1jtmYWYGe;B~h2XOkxqA?#*%C9Ti%kjM>>T?j3@d~U_vOv41id6vT`}X$?F6;(Hk?e=nG^9T z-uJMU@1rM6ujDU`tKE5PmFJzQ4ezi$MZmHSBSr3>tL$zU-*o;GBHQ6HRPj*klZs^d zftLAWO~l2?9&H!LG%HzQ=C#?I8@wJAX~i`MuRF1ffsfyyCAHgqe0K*BkMtyt0CZAx zj6(FokLoORmum>0Niw8Ia(S0!dUCUmxZRUH+73>sZMt`06p?o5xdyZFr$Su%U|K+i z-DW5C&Bb}ivAUPup{)J00qJ<3CBQ4T-g@9sx8K7leNfA5E)fmH@}a7p$bDJHY``GqO%15qBfDE2H^RV{9>JwzAF z%Q`rUn|(R0Q}Nqx`^IRlXeLl*or)y1Ev!|5@-7L&-B)T?k{bEOuupmqQiJ0YAC!tt zZP1K-)*dD!H%>&Yt-+QmTO!l#K%ILjT`*J50|-y`wwXAAp~{1QeRmDR*=;V3-ie|F zuihub2@O;>5f1Np|28Ut{BTcK*SVb_SnQ~2--B9&$Fws&r7z;|2Z({(e&szX1JBqr zOjtdycCYN95ix(7J4`RrK>UdOW-YiY^>KM1FC>i!(BN*6 zu+R{xg`?IjvU3!iY1%oQ1ud1IrvNOtYjG=i#ClcbMpnWX8=djMHSjw>bHqL$>o+x% zTUU7ld)&I5XWI^hTS9NB9gzO3^eeKuZ;`_1sPb`b*!GcMm{piljD_rJm9GE6*jvX% zxy5b278nQy0s;aSUDDkG(%q%fF?8n^1OrK7=I&GH)#ji?xQp;pv7Ur`iA0OK zpBB$Biv0i;sq)#t0`)HY za<%{yMe0=W@$q|m9=XKJv!rrx43_N-{(NN?!gNXBp>59RhIubPy_@GNd5(yFekomO zc91^zR2g-OS`10Pjb}|ok@D1ad+dqmRYV7l{#W)zW{vTvD>A#V=}L|A#m!k7()W*^ zFoV++c`+OPn|Dg;R3f=Vc$%*5rrY2jiAs~m(2)EckU76tr<`Y(s?TRMo3L*6u4mRW z=W*rQ&v~E{#^+MQ`^Y}hNb9Cn^N`l6b(b|u%|7$)1M|)H80$8m5Fmu$>A-_UlmgJH z=Gnu%2e>}7lk^?;U7ia$XJO#A`3-xx^`0lv(G4mQMMFwPD?rV#@1%L!+{#Zl$zNV2`Z-CUUP@3s z^&|nY+CBZX52GMgahhh*;d)a#A!nQGo5!>BU+KGgE$FsReVOfyc#1!wZ`a>x^<6?v z{qV1f*R%4wWR{p6;FFY-*s87Ek)E6C!<~@#RUmW8k>$CweCD-Zu#lsmY2Q`)kRrR9 zT?`J!&%sW3Vza7Dak2~aoH&`ibrADI(|_Eiks#Pt*D$M!Myq1qnjS;z?oKt0bfQ}7 zUAbYGUTnn)Jl@9<+?i)r4b8Q#arV`-Y9}*P;o_C3KA9f)Xub!V5An>KdA4wiU~Ml~ zN`p4@;;ruCR);1X!&%^`{qT)c9A4@B_nBPJl&P%~Ec2uD=@5yrWoNel*USBjkZ^TO zH+M9>Sh;ysBTykCbE?I<*Mz-I88F_z5;mPCv$;2RI3#^KVS$!GFuM+O1-pmR298E{ULbRX}g?3 zC?a({n0Tc-`*z@}v`{XG*XZinw4|;u%rKvpb+8_p7;^sNZ_BL{&u`;=Vc{F+Ce@FO z+UncJKQEp?mKa*&rIudF$p|3 zDR_=Lk8qm%7zZ;k=8a{*Ihcv(s) z_e9}J_n+T`eEsg(dhZ&<_t{+)^;w@JWyHo1IZr&*jTuGlEHWwg5kIzZ>Tgn8cS>+@ z)uyP!hxAwPcVf(mEity1UoQt&I3zk@y&NA@VkNK1v{nS9vsrJz3+VRfxFDO{G zHWU;Hf3)J>rJXiRDJ&ZoG(xS@|wJ+3$Pz%`Tma=V5xu6WCJ`P@H31 z=O6_f%C>5-8%NKj*dS)a>jn=`yES4g5m>RO$hGFWajvAl1}^@a>6(cZflD|B$G4tY z;O8YY$SBOFmNC6E_HeXU8 za^T*14B~5Own3m@pW6FqGWDqjm8%GB^}N~5VO}&|-G0p##Wa##XR>s5EV2)LNW#J! zhc?Tn(_={Dl$aXoN$Da!RzxM?zqxkcA7DC^HRuw!D(n~LcQm|UW}mwjxW&+}s0>55 z7)niCq40hcR8iDl$4yI=&+iq~DNE!0UR29t;M>6?E$A|<$O+f^OY0q zFZcbHzy3ftkG}C!nPyI&R|D%l zoLcxtLw6<}J&mrtmPrQo3ykV6>S(QP%u!U}X%@l!QF8{_iF=c)2H_6&g1?>ikCMKk zpy0G&Ng>hU`TFpghKNytMqAb}k{$Bqnvq#=4pAV(i-;(p=H#?F{EyWTT05Z>Q|jJ$ zH8}}H51aKVuhkm(Jj={loAf=2JbWG)(P-?V8;3ltX`-#v4XfKyP6pMPpOsUFpBxvA ziv~qjcGof$G^sMSzeq^^_-xMH0CO*Ri=)mZ_R{)es@iPq8Ki|phWaX)^B7{c00@ z*$CC6t9=o}JA3x}KEjU^jjAT~{hA>0#q|rdi*53>C0N}1YyE#^F^ zS;88<{)MozigI>qJfi$uzobP4-P{jQY8_j5^$eJ?>T1;ZE4$ZvG%`v|r$sOX)6Gwx zW3bY=`IFJUxAdOEy|%tlmi;l!h2Il`MmcQ3coMk1j~BWy16%y{=2IKnK0U6+(TAR; zj&)rtaLYPUZ>x)-7u>OHlYen{OzhN^7C1Sb#Ck_6xgN!|u!r-!v@0JX#|ITR?|zeM znTTMQmt=`iz~u-~8)k7gJ)YLf?W^eH;HzN ze^s#+M~_Un@*Zn9xD^PSygZ|u;s^g1eOu`ACf2gNmBD57Vqr{0u|>WsofuBJuIH2W z(6)p-3wRUm>c+TZ53pB+I>njdEr6XX-rrUPM7uoJ1c6p_t=LNztsThe1COhmYlmBw zu07W%v^?-Qc^|hTHm5_G6K5Drh6G-fCtXYkOOco2W}9*S8DJ2(cxj~H)L-H znUL1K23vJr+cxU><2ZFFM)&AW)Yj)D7G~|`z6U$%8v}5I!fTH`0+dIjzg;zppHm6( zt?MmltZa>GiGya*LPH>B%JtSNhu&Wn_73r~>dLam(Ua#IRvJZeHco`aJ&B>6dQ%~r zbu7AEG5$#WRevOH6*&6qyVh$KvZa(PM(j)Rd$|Y4NLHJ&Aa5{TWJrj7iQMeNY~lWh z=h0`4zQ?eyUFw*qqr{B0)o2!3hfP0!)bQ-?hFkVHvUMOyHbY9WHpI;KrG)`95x?4~ zQigJ-w!@0oK~;)+cpfqPKDsKo>1+Ij@fH0Dt*T8FoXQs9rA1jll~8|yMvI89w5Qsf zlzki90v=Fe8-c9ajUGNdZhhUCEN+O>&&;Q5l3VD32UVjfthpd=AsJyh3*+pUoyCeQ zIum&eje({oxy0ikIsVb(;vv}iHU8*K_Ou`JneD@tNH%&duR0;^ep#@==|1yIW5If& zg}N-nLIV^cPNWG=e95Qg4Wt)BV)xw_J@D0Rm0eSj`@3)nlzOtd%RRj27(1Oj=NbKl z;^8pHEHV1Q&?M$M!-+&Bs_*9Nzxr4bsZUYT{pJHO#74vdqOtoWf3hOUJn%EYIhmIicx7zNNj>jI6r3iA$*Hc%f#^f~k`uZk5ZO zlD`;-y}wYz^&a#=E6T%mp?XGUk?a+uMWtB1}jyZI?P@CrR@Gl%K-E}?9v zdF+KkM>3|VtAXq=WFXzly|~~j{H>vQuEq-E>Dp%4)w!0iUgJ2-7|eZoWFBUxAu>6-n;wA>+=|&JXp7xpuI+$dpj%pd~Op{EcLpto+Lt9Hkcpf6LIq zzw7qRi}Pm04MxBFzQke}wP;GMhWp*b-1T;34W| z1)fJ*3-)R|iJ!}(ptnfjb8CItv=ZfjWN#28_4q}7<`sN0lX3UV=jDC|tRbGy-03q$ zgQU$E+&aW8SLN-Pi!KQ%em$QQnc7pS7v8msn!4;_1~Kxu%doqy(p$fta~xL*QqJSD zmJ_6`^X7NSRlWnA=;RmuYm&jvW@@sC+UiC?$mqadu*2?uIsq+u!yDIpcKSenmF6KI64)vru z->tHhYfAaVV-P_tOVT$f^HLzXnd2v`m7cFY>mmP`&m3qsLURLkifoqdj%fx5IIgJe(+$JJZA zm~HAt+uqNaBrLYX%u60xzGq@d`C2BKueB6rwl>V*0{r*dv3Vpx1#1hsVY!}UWzlT&N03&8{XJ5WFEbXWx+qr17`e9# zw@I41uTx(byx}7!)HW`#y)aSwcf!j52AB!wujWD_sORP2+tJ_(yl4NTj8+SK0 zU!1&u>w(WYQpUNIyf-@R4RW^$bx=?ExS-QnQfZ;fd4wE3Xh~2$iLI&A#;2C6q-PyR zV8xonE$};jPuyJmVpF4D16;4AO$TmEO^*R_7i@;K!r?rgxejyXUVg~F)T5~aSLg2# z96kGEe~{O?`PJ<-TTX0~%KG?L607s?JInto8U+w7u-@dfvdHU2mkhQLGkayen41d) z`Qh0lu%?AE>|!ew56_QgU-aNmW6~idqL$NOD|W(YB2!9Dj&xujBl+U3I^O@P!gEmL zbn$TL|6RGydvuAAu!?s-R@{{LdnD4qH9t?j++wE-d*h{7e*5TeVi9KQO z{&p2wshNkwSWdB6!!T0{%dK?eNXFU+f@F`_* z@Ss;8fK0DRoi4doYS#G>aWpm>x)U!1vv7#U_)De_)qq=-8bf!7WDgswhC2G`I)rpA>x8K{E3GMT+Y4$Suh3_9)i~ zcT`3{=u%8cXw(o;ZM6z<^L|WfUUkBS3`)60uM?n}IgIID&(4PDf505>dlWCNE(KSv zeu?tbGi&#NV2-;N!i`l4tdgJ94yfs5>`Hp6Q)X-huX$QFP=WZaN4Hc?YzE7{i0WbA zT44LfS8}L08PSExmULy1X;6Gt&FOY^`Rx8HkQAhpBPn^2Xz!#}CYFjR_1_aADuIhS zs|WK;V=xBP#V64Jq{ZTe{I)Zwy<=TqK|p-#4P|9UuXK%Vy8G6`xa1`jt|UJuU0VFz zm*yAAUclo8HI*LSS5n?(LkA6M3apd{z>N>wE2IhQ#+Iz(tx_7PQ{@|+C-KE{8R%KFr6^G!P?VKeD;-bMwE0Q?5F%I&LPL+wUCD==M# ze6ZLbJ@(cPtI|bsPTw^1@L=F!6zX>A7ZPzM)+;|#_O3_<>bKW#NS`{{(&;EM;r0HE zx7YJ`u2bCPn~>u=d?^1bM~CGQWhU&sG<#HVgiS^t!My@kixqUU9n}b|BnOgH`{Ke9 z&>WX7*#q_wBvsJhEj)Xt`nQ|Xbek0UF{*c6>YcF2Uq3FtLbzOHXH~&)$&R>RNq(A1 zXm)m`p#9l~B&Z3#rJxYk4nIwKoULKvS$SP!QcR|gz~ zusWxOlsPgJtCw}g=h?u*wq6%drKJ}OD1zGvmYvfa=A0fG>#m7YV{Vx&_Lrg1JpGY; z-4A4mX45|iHdr;Nt`oFBS8%PVc$p^R)T~x5jdbPm8JfC_aDd}RdZSS)A<2xog&J+h zhjZV^)vpO-)z3t9HR5%VvFe-MdD0|hNt7XP5S5A`qwWfe?9r8Whm^H#F$7+m=TF3r4J0*iX^O7$uw zt~11%QVH-Z<>V7Kd$Z`auKzx$t~QKENncys4?9T0j{2#nR3w^@+^1S?c&XLPZ@GaN zC?*&8Sml3eYT{BB5j2is6uYJ=)buF`oPHr(94gS$qLL#;moem|z`lPdqAWVKe$X-~ zY;+;L<5R$5+jwQO3no?5%(g}~3^MZ3;Cg3|!rpY+iRhCP|)6mKFu-STOhN`#p)fbr!9y zrE+HVuc69j2QN9ry~@2{;B>+jmE|xFsF+s$^pyx6(Ig?k-$&Ce2Yi5YU`na~L0xXk z$>YmyTNFclX69KaC9$*{WhuxRf2gUu1@SEZ-qH1$%ALsb5Reqv> z98Ie+WseqXvZ=>!EF;awwDB{XgFvKh`oF3brhQ9WWcBFXa96wwe{EJ zE>GD3-AtM4N`vs?zw$m}XEch>uC5jML#$W)-%5@<-b;1!@O_8!7bZz&X6)(HCzQ)b zn6o{ebQ}-6-MyK@uhDX_PX|8epK3XHj-;}hz;vc4pi>`rwrt51cX7Lifkb!uFjO)p zT*pBC=rE?jJr#H@zed_EFIFv$>SCO19>1T@R*WmGK1uSDu>Vx0Lbnzqk=YW3~w_i$3mt)~`=^>gzD5%-2!%smnk_yt=_pZFd5^$iK!=>S8QL_SQYi z{DrY57&AW~(=LBKaQ5o1?H+I=1VGc!VvpvVCu%>cxu$=vQajn;Y=%^rDD-q~HwxPb z_^m%X>Uo!DBBa8uS8cUox0c{x)OAp)4m3UXBqAnTugQGPhmiiXtmR6UE*_`!vtHZZ z{vYzxTCG0W(JL+pM^jQ|`_sQkM@N+5(m$!U41t2(_14okCrk218r#*3mQ&35oJ43a z;1_z38pXr(fiP{`Mg;p{*<)YPw?~+oqX#&b_>FgS-DJvv1rQ_K`mT6=*lHTxMY%y0 z@Tu;)=MMZW@uk zcIbum87yRTt~-LO=eVhG=V0&K2D91|3OV(SopB5q54fLOZGhQQJoL)Q=hHJ2w-VHW z1zv}<>9ZcwgP44?F%g0$w%%u6M?NZt14F!=%VNr^$5Y5Y@kOAQ5$ZtlyDBmd|+zNr_+P+~LCdBR(}JE`cz7tWfxa7#H4pgzoajvanO@fLc$!?#x)J6}}aH!tTN za9x3uPFrUyOID3oju;0rlQq7F93*K{C@D9U^-Io-_8H|Sw!!mjPTlqDbGf=&txL*F z@oW#tJC*=`nC6%)k~`e;WlMScp^~+foDvHiXWMq*YmMiz zCyRSdwq`gTMqUi}0Jc1LEZ!r)txrVlRAG7WKqKlN@TvnBv#$ETux;au#MC5*<$vaM ziyO~QOV`GxFt{6GUatIQ!Oo!!u)_e|$_=*xJ<3nHUDyreq$;Rrh$slVN}xUc z_eZSTPp9MW##g920eDQ zeOsqLQJrWe|8p7;A^Y%q6exQ5iQ{~Ex)OQJV367G059g5Uh_MV{`?Ll=aHxYULkn= zHHK3?`3%JJwqym3qiw?OrWTpp8wU9ty(u8^cF;%RJ>B#(i|`D28vI9?3snGN-j9{F zDk(8zF?6ky|8X;?ReRGVCwP0uZ=e5&t@J4nT?*=_u@D6eyH8feVX_RtU zMJDg^<#BzGZT-%!7!h6`YEVEa6jMI<_zgm)hcwhjo+2^-?=}N%#-XI}Y}bEMgwUfOykIZZls> zI_)5oRz}2Yl|`e_AT#+%jK%KtBg2`yErw6bVM~#2YXUy7P7Tk;V%5g}G0zoAh14hN z6+{ZlZ1fv7%bDZM@}pA|CHG!Nv+){TqVF$!9Qkjo8>+r*gc*Ybyk<)+E4qj zKk}uPv(~6yvv>+Md7gXUj+qc_H(gGwnbOEdBUN_;oy^I}+1xWRUMtvw0!5*FD~9uh z%wR4!QyFC8BOa>11)Ld{-@kZk()5HD9HO~-kurlDm*1pDU<(J#OiYdI8im4a>T^t81RRuPIf;bDD@&ns zA@^hK^n$bxMg1X-SZHoZhzFVc5=*y%zw@9z;~*@&tlBmpxVowrUwZa>TsZ z)u8lMOhfd`_Rqee^*nW1b~(I8cTAz*(DgJdgY|uDyXJ~5A6cI;np-tUxnI@*6`Nce zpAYNx(pZQ)cq3|BJ70h1?sucB=8n}1c?<(YX${a90JM-5Q#E#hl5MX zp!l=lLsMch&;j&FQaGoTdwcq};zFN|THIYuuf-RB#9HlHap#NMp`a%~KPg(;YZq-K z2Uv*Vs5m!SyC{K6I+cfCN$R$RA31q0`ip+H~8xQ^rJJO%q3OE>eq{&T1#C+49 zIC}92A(ug^POo$BhW@xD31-JfZ}R4507GZnw`m;v_R->{09-#!x1p(^t@00rfB4+r z%uYN1WO_n38Fm*x<+wmIpz1X?NA`Na>+o`EDJraJHubtmwiYtVplx z{%+A>cN7`z%Vz9Dn2ZhkxVvEXr&h^WsP3 zXVzvou;QfM?1t8)U!UHSIbWcln)o^RpYJ5e1m8)*rdRa7-4xgdK_6cu`?3Yi8Q-4q z_*Yv?0gPNO^X^9i3eUwC-_%kK*xmf?zsY40Wsz`!6!*9ptY>8ZDVR@lZ!;ZhqQskd zS-u-2Mhk#_nM@XHrIvhh9gh9M`~?2`6fgcCUXN(`xz|%+70DOWnLIFi8DCTnjT6|J zEtduMbRP^Q5(9I|kDfbaVbIJA%3BTuMve7IbwP@V1Rshab0rW=z)8J%&b_RMKGeed zU5@)eM@vkE+T8R(~&%ws_Gwh(ql1Dgs|g)FiW1mNYv>k@e-x}HU8~m z5VI3f2LfTUFkd|E&&&lsp&YR|`Gd|&1Mw3RmD@zYn~={OWj9_>i^i*zHP&#w=-Y_h zdbY4X8SJ+>2WC)-{Tk~AS%|eqSdHU&!|o80!fwl z*DA57s$mC*K&XzDB$s*x%ah#dIZ{hPb(K=}E-bR~eX^0MM}Xi_S$DipGEe!+&_{6q zJa#6(>avH$nnTFj_t>Ls1d3RBu{TjN260wDD+Tyi!{7}K#xo4h#v$ER5Uz}u?raRa z++;nqJ5dw>QMjSw)RRb<|Fv$ss>=&s&&U{9GddlrPQpGS)N&HIKR#73K^%v5tmv*k zVAMoEnn4wgYJNEJ0Vj!d-Y$XAMHjnJv>X&Q)Vc0LwJMZ!V$aoh=Yi6rLzPlNIRN(i z`A&fdkT(0)XIF^JNp*XBLI#&wCPi4`u;)^*+4Do8s0j1*Vm_KKac?F5wyZ2Pd5r>^ zG~wLyAmgYvMPrxSLvEnMyUIxVh1qfmA!87W!xW9K~ zkx!8U_#&?u9C5q#cb+^v=1n-EIHUDH3roag6(hJqcmm4B*1s9;U+md$9yvbb@)PtE z3B@@q{W<1NWP&8P2ks!U5wNhp!#Z4TFqVdyl18YphA4$PW<~f+U@%YL}&-pN)S$m_51^ zQSmfO7AAc6=V9e9oXT1(=xvP5qAz5GPfzZLi!^t$Qz07f%EYDr*JbmoPs(V<<<|Hjf z--zCB(QE6D$G^+qMdvi_9x@=-<0QCV$Oqn=V<85+$1gLCX`d8`nHWKJ;5KzT04CW^ z(1wr5`xzj&1q%6v<>#2j8RO8c*4^RR#^()aXuga7tnB6B()l`l(x zanEiuO*e1ty50BD`Yzuui0-Y)y^OQn?o}8?l&*dN>|pZ|mPC+*`TC@+bFAKS&(5?K zk3Vv75NK>jb*!v1&@(^4dhPFvK#*_cwYdFo2~-@FzBdJg`U>uYCJPtpz%xrR4uV)w zfl?+#rmimek?i3jI{YNOfEnjeCBy?-2PQ11+v|3=A2eSe96F2uZ&MJiy)`v>AZk>Y;af`MBjb)`BL;9>M_?Y(^kW34keVQ&aI; zH4X6OJFMg%xj}g{yzCv1iV+<<#ff{wgjR*dSvf)nQ;-%ecd;4Nn>5;;F}#l7so{Q9Fsu8}YVdsxDR$hVgxBOi*Od~j{7kdINd>#7jB-Aw*tWa|c`NIllU z^5ht*wK3oi?mU|?<7V{|rsM5y)Di92B@}ieoG{9{;dtP$XDu}fycJSFQ>daCjh%EFzf`GilzyEoX-p8CU$G8 zy*%d_P8u)m@~#AaGAI2^e;u88aE;Atw=Oh}_fc+a+DT1c5%Sa%S58VTL8EeIND2?^ z`+P(uuQAz?=S$big#*&QUY&jVNYwwYlDR?uJ{8Ub=m59^D0f+?xWMN5yu)UJpIrK@ z-{jhsg0F86hW6;lF4F^57O2fa&Wykm#hHiJgMulRgP`9wXOr^s{RiI1bl1r*n7uQa zwmA!2zItHqm&^CDH-h$rxm&hbeN`ksLb;R{%<#`$0l8P+yRV>FTc8)wW4$?dw)#S8 zVP6N~O$QZq*J8&dwuzH$b^5{g^iasEN9@-L`@DiXRvP5H%H)l6sNY%bctde^!!++x zRyqA)!+_P|IKaN}j%{o_SM0;Ex$6w>X=5`p_Gp0(E99#zI?%L^*l8}@P7mz#zyJz? z#Pf(xA4q=9yo_faUmUKxOjU7#m1-uEedRC>Ctm~h>td`Kuo3v+3T6zZR+GS2X3keK zx?enO(9+ov1`%xo_c@(;44jl9pALbA{Avmn^C=lCM&QAR$J1D{|EP;NC;#x^^#W(9 z$p{Frw9SYs!!-J_{bbRuKi|sp25thdkDTClmTkt&Ov9nMuZ8(pK=zTIsf^S1QBQ-X z+YhKQm`h{uxZ^sW0``;U_bF(#@ahgYs~gMzJ6a-%<})6}XFvMkqSu!gC@!D}96(68 zXBvQ6@B&6?_QFLL4~}Kxd9Z_?f${n5Yy!dmH@NT@_Ui^Kg0X}WH?^2*J7&i|OSY_)%;P7TfZ_N9tP~Q*ZB$k z2cb+jqZ!x#nAf1=Q_Wp+3Iq`RLd;X2`Yp55hA^62qcPiK=U?%4;lfAL@cbuWbi&zC zf_j|zwMkOY#P{?b(oOQP%5>6tag?HyY51hs+#yh)@oR&!h}_Qamu=^6zydbGBX+t)3G{xv>gP}(S>~24d8-kPJfYDQLwqKRtgY@ z=-DTSW*?pGY_MY;vI#~8j70KB0G?iDX7Lu%$fLHJ7hwiPsL5T5Q%$%Or_td0?`(uF z*o576#Sr&)$4_SLMezdXwdxC3tbzQOHrTC_-sH4~oTSVi^5@A;Vdj{9YMCz?1aL$l zH-YdrE0&$kjXA_u^KJi2Ez%cmnO)&j$YTu#KkSmj7N$)KJ26Jkjo=Plj zM9H5ZlT~_w$VRY6HAU-% zEPqaLqCiG_|BDcEjp7mOec5T70!S@&2pOgN4};pON)Mm>_r2Kb20VO02D%XQi|6FC zliod3K~6l+zswaFoS>XrJi?x~0R z5bVnwq;A=yMZf`Q`+5dsfsfmySf9;XhtL4fU?Z+-bFrpTLIAeIbPZ zhGHS}FU;|iKG@n@pSW4lO||==;O7ep0vY>4y|!P}ENyNTSOa)8-ADN%?-(e^| zX0jol?cPspOZ-bMjIB?eFW0~Ddj6wf{q?oFD_Cp)nVf=1{Qre5`22${s5}qP5BZ}{ zA)QVeA6O&+aiCHVw4l>#Am+Vfa`Isp*x?1OeadCf=r81~v40~Ah63kZa+S{!Jkmr8 z`Z@nn?Vq2XSI0$AL|x@kvo`l16$OMg9TPZp+X2i$!3n+tH=wl8EA%OKc^%%JIi*zUmU(omquUP@5wKtIPL3M@SF;R zfCcbBsrfgA0|-)%jZ0!5{#4B`8Lz2?OzV|T+`N`q4BD*lmmJWIrrDy zp9V>=x)diroeY9z61hHY;G!}Bj<)H&n`P=#v=rX#u_ zs5{&`9>I3kjI*!$l9L16-x)V#wlL4wnmk?e9hRA-?j_?@xQgi36@0VrO38Y+X=$u% z4y&hDQ!;N_YX8l0L*A`RkbQXf}ai6W!F0vBhCO=BJxT>6Z{}F&M;R)wm-I|sp-KkRdI}2((va4 zvs#ZnIb-5J+ij}N+547+&SyY_8NzWTSy+OvZxk3S-%=Br7S{w+Nxr1XcB$KbWa_f& zCNEumV%9kI$w>4ZJ=kHHjaM(Apl?<;sUGJ#V$;kkCh@W!EWj#jyLe_`b1~@IK(x*{ z{I5u(Q+=L01)q7|EBh4CY#+EVVk6_LmFexZoE?r+E&kXJfY0cpgBOi4*b-KgsoJ?e zE_+%odhVHKa_u&(NEY6g0NQ?GMq?yC@Xegwmlf&m#nFA8U%1{G9iU86J+8Woju`Fx z$$xDsY|P;5hIR~X%$a28pO36n9v$*(TTM!s?4m5@%4j|n8k*d<%$&s3|467}gY^r_ zO?|;y2&R@KD_gH!DCz*`|MTS&@F`sS-`E7M6TK1WS)1D**I<2;uzI_btkBIw2S79y zZz}gbvX0&DEG>+;D6CigBYG6fsklr586*p8l;t10=VS&O(l1Xuvg}^I7UuRvaik#? zG4erH$gtRICKiiQ>>mCoK})ijAEJmoz!M``4lb)~?@E}xqMw-c#OTNB5S*$}x#y!!OeSZodYYvs zh={o5`f+?p;IC0-xmccA<1B-g!kag_`qqCtP*fzlcsQQPbclMl_o!ypy92M*^?ggG z-wm5f3wH1xF^`30;vSiT;>+lnTYLOg;9asWR>P^DKY3UAPYoa+D*rtA+-ZO*lIF8- zKACDZO^E9fz9jbubjf)WIGYOU@6sE6m6}GQ>o;?VIO=v&AFF!|QVqw0#;UVTezm-@ zGn8jpBdw=r^5)y&?lKlXk-9f&G#=$$p!B}f7!k4Cii}}1y^b(l%x2sj(<~f|PMw@I zu_F#8EeLk@oqF~+MBqJ`EIs{~;oh$wpBlJ{S9S-tQG7RCDSpkkdt&X!H~vH5tCfNe zLWr96+J*Ob#k0Ip2JbW4w)MS3J@f>y5~2i@1|C@n2EyK1uo#38x6N?aHY#Ow@9x*j zZMkEu9cOL;AdC>RU!{>{ZhwxQHLX~VK0+;dHO zpQ&F@kMhM(ANW3Q(AgvAr;N>NI?19C*#C`kRv?ePug*c^sXK8>^E<$$qo%>n-*s&= zW670LeH9Yd*$uX8=*uJ|xQej$hKm0U!)uc^M5c@;7Z2e}7*ETo-3QhiM|ai_qP<6B zqWGWjqgU|ki5>*|;Kp>EfY12**IE9y-8p<=9dVHI z+c~$nbiRFXg@(87zimObGL9y!R}@!Z$8V4=6&e$fr`c`$+jcVS=W#xNwEyE^7YD`u zH;|wWfCO>ErW$+DBG?qXq$JDf=Uw?WacK$xzQmxgA=%(ppAO!a^>-Sai#%Vwd;;6+ zEI(Lw;b8~6eBh;A<2Y+YavV_3gbnmH$F%EyB-9gLL??4C_gz@p`ldz@vMPkiMDYwas6 zTUWVZ9k%Q9cLyJhx`j|6&1Y+%X2ZIq-my2bulT!cER9n8HF+HIws;;WJ)JaQ zjWFm#Bp~`p@9aIyj;rPbIE05(c!KY9AK&`p(N}xFX%11z;HW1#{>Hkh@C#{UuQ$c- zWOdRFOJCdArHHjtN^Yz{`?{O}@frFPee_WiwEEDm9$+>r7dSWmmY@;-@rkd(Mn9rNr>$Sv3V2Ha1<3L=iKZPiB(|VlbEzJc40^SsnuQrxe^Cqo-)o^QJbC-@!i9dtpIpIm*#Eka8uC1{L-J1r{sM(+ z?bT{9jBE8{++IAJkzE&JJj4KkWFgxvs+rNq55C*2_Pa({XGwE9m9-A%E9?JN#8*pr z7FBRYu+t`M6ie^%yBXO})HFV!)J+FN=hWdQ*&9=ff5aAl1~$UW?*NQ&iXvsc+H^|l zh0%JumF>8Y!|f5h69}1Mz3OR6#Q}DBqz{z>WfAK_>Dqa4d_f+Jpba$6e4w)Lkg}Rz z$%C@1z1&n>>}Hf#T(6@)VD^VnNb}`huzriifpq)%Dup=PC?Vz&{Hu&C_C(5G)JsMF ziJ^6~L3#Q#N+ZW^_!eSj;?;N>7$FDjhzUO$s6}J>S!@81FR6s9pqf5Z739Z|w8jwP zsU^fymn{rn`~AkV^~GrVQm6$qXFPD@AjX=7jVM=x%izuE)%S^v=%=qHNzjvvG%HU9m2Ee0mOKHyl^hY3RWK z>q@xb*<4L7j4{X?!K6!yLMAC{nAJK1B-e4{ndGoh)yaJ>dEGBBK%qt0bV#jI3+XDi z8Z%t>iGifeN#J}6-H&fW1Y$*YD3qtn?hIT=W}s1MC6T2J5>}>iiyzuPUY-JExxI)? z?JbJ{(^|Ff>xWZ$s$ECPQ%9+ei6KPZzQAd^(U}{Wd1r3B(n0OziXp&mdTB1!-uitR z%+OrUA-s$;ZHx$;LhcOF_**d#V)Kb}%R@gFAP5U8T0SnSs^4aIl+xfSYp`NwWCly_ zuVV&j<;-H-z-tUR!6gR$N1lF^_4v)J*h&I3t<8ViT-dRs*Mm@Cy znsb#b;4_!UWc#%M_UV_sxw9B!0FM+?O~pS1v@nGdtxYHr!?1etzUal`pEt}Mcti^W z(T676g@?x`Ni0WU>ou>NSzHw4)qzh0Mih`s>nSS~fgv4kA1JG?K(JSOb)&CzUNCW- zOAeG^6dq`;v8v6zJPz-)*%wVsA}-R%dz!>cN_W#pBYpOB%E&6=_4wK*)jq2g`5p=j z5i=(&X+tcWUq&cVIq6j}l983ds-HeW3s{e4-SvH3k4eX=8M?hE#FM>$F3DeijOl+7 z3Tajg(`AX>G37^v^=kOFr>A=xJlr2Sn)XkMH?7RIbQK(^y zHBjGV_Hs}M7r%VbmpiAgNxQCj*YkY{BAve<{MKTTz2UEtPo~#WZ7M$95hi`6{+vh z*+mPkPu1ApXBhSpVz!DEti6E9yEJj-(TEVrRV zcJ;jE*#nUsu#V)beiPhlCuaOvLj@!35{!@^>KkCKBh z`;?KR4^`(bW^jCJx-f1!V|AQtBUl>jTz}DCe?;=E4Z+Q|{M|FpPdX`?g@a0o;!u03 z9_Ni->baI31;6q@oDDBY5jS>o3)-S43o&DwP#`*r10(2ZSRyL>Vi1r1XdPgsEl zZKclTdb}sgWc&`iTZa=426NMwlw#36E--!`rgg|j_oZsAb@^5Q$$Wg)HjVYuw@$+n zn=1G`%neFIa~Y7JuvP6mFXYDF&J+4Io=jx1XO*DNO(H8KBhFxtH9u#(yD&HZ0u!|S zj`|1dpXeVUztW?wkZ=D%qCe0_vA>v}_71SKk#`*IATLD{iG>W7%Jsx}1+3i2bZs9R18+S_H>t=PS8tPnhtvMa@2o_P{~8k zu#fsWgrz!$;%*lu%~7Zj?HscwAVLy`Hh8M_w5;cv?@YNbv&7YzDQ;hTrk4${^h2oK zR5s<(wYupO{>3~y$AnBnG|dp^(;x)9-sWaCxrk+Sjh4oX`BuL*G~{(Ic)d-nrd0ds zsjuiDXjeVECre?iL`eai48p9F1nrMapDe(ru8=BdO*?Zo2vry59mzS4&pW&`gwO@!X=*`AB9MyBx#YJ zc6Gz8z$v3v-*9yrm&URdsp92%1ap zp;edvXgvX6$F5Ua7^b%Sw%WC4$kYW^^Xmn9SVhfr!NdZ$m9|3YZaj>@U?|q5WGRwM=$8+0Tuz5xg^)yBCXBRtaTg5!Hs5!iQR}TV>lJvCTzGvJNiE@1 zwK4iNqK5%fAkY9+9x|63Ud}BBuhOqTF{CSK4)U6^T+PSG^HTSPqu>xjmAJ~nxwO7^ z25WT<`Kn4Gh3YcG4dbQA@!nofXPA;+cS%q2q6IthY-QR@W;<%4Mg5s%4!KGK%qkBIN_ShoQc09|B8VUS$Mx@(D%DO#j=9B6H2NW zqI6|bT55%xLZ6kRf8Pd;>|>?Pu2;gT@(u2_dEw{7VNg{9c7PkTjm{?z5IVuK0Tn5N^b&dr zT|x^bDk4gk7Fvk(5<(9pA<6v(_j%9vz4wm$*Zbc4jqx2u27{3?_?5NhT650ldFEWG z$CrR(D+We}ER09lS(+V#_aOl;q-TOz^kp0DWHvFG1ME#q#aFefop6pow%!THlD!x>*=`}o3EXDs`g zSPc3qJlHS^rpw8AJ4ne&+ML1<4hkNR9RsT%6FI6o<<616lP$9n9SxptPRc6@f^FT1(jv8-sxQO^Os=sHfm>t z=lg0Ieev7Xlspt2ANr%Bx@??TpM}~75sP-!h$d5#IC~cs9oyWy{#HN=J}T~ z(){<>mD_Pqc;t^7cwke;euAo2&qQy?mdqnyvFo|p-JH)^VjE?E$Cex<)mbz{>!cO0 zk0zb-{ATbS0X(5;A;cJTD<<5Z&n0~%slSL9@(+tAhNMqT7h)_42|l~vkCfi~8@uYA z&bK0*mj)Jmrm7OsAP)|^l$8cj;%0M4CsxI;=vqZHG%l8uxL|4Gf#LM)j_|~tgFGj# z_FEV)9_>AjnsxZTukGtCxQ9_C?bX zwu-^m2Xcy|6H?PFE_*y38J$gu#XHTxx-xIN{2Vs~vG)QV2eeG`-0&wNySi45>hdiq zns2E)aQ23eydd0AwhZ1x=^Ovkrh>V?4`ALuf)&l#DHd~r18>+EiGv?bVh?uxyH3cM zg{J|ez3na}MoSQOQ#RA*!|#<}UmNi>mT!Jf?{bNblF?usbQ0>v1Wf;9gW(g&_(PqT z@K$*~-GRs-vVy)jl;|y3?n9n78vh3FD7+RS#Q$@{*-;HZrmpVrU<@Pp!7Mpmmp7qW$=?H!DeOYL=!M|``y>* zWamjntprwU(@3hg6CokNm>YhR|GZxu?o6Y$L@w$WLy?gMyD zmf+0^7~`QM`hv<#p#nM{f*2nPH$s{_rT3tkDko)qe+$e<8g!-$8n54*o~VErw@y=H ze3bXul6SPBMHe`l;?IakR@v553!SuE7+gA``Pt#COQ5$-|jhWP!P4ioSZme0FFeB|zv z+vD^DFF!s+IzJS($5R6vjYrq4@7=p^IQZqF@rL`Ws?u%XI|gu2K@sP=l&>8S7r3f5 z$lWe4z3qQ!&ji2{)jm>U77mhy+}BZ+9O4+~Ao;1BD@$^98?|3xpEU!lmJWMU{Fa;= zw64~a6&n-#pespoWlWaP*(9~qz~YhC(H}yVeqX&?p7S`cqX)7iQM{Yfhoqb)OBpUv z{rtJ>jGleITV^xrSjJJz~Lu@>7V_*Lc^7cc6IoT~yd+=^;~)f6f(_8w-aIBXTIbEQE_) zBXJ{J)i)N@a}+pCG!mq_G;mt-bqz0e)x`kQ9=MlCY)^C1w!RP`<9> zvbVI#@EaMBZ80mhRB|uXC;+4REP|iaax1KzeCxztwz2$@7_Tle${@AwfH?R{t}iUJ zd1b;Jh(f#Dp%a0LR0)m+%Z3#~Yet=Sy)B*7sD5@d)2)@BmbRrxfc$tne=?p!)uqs% ztTU8l(s}LV8~#`3xIr_h4q|#TopMH5_-gZHvs87%6FCf`_z!x6jB53}35*Z;fqxR^ zp3IAR{95e()$n_HiBURBHtcs;c~p<9=hgq;vGfj?&ow-?nVL7<`n4NPtiUv+P@hCn zHE8Rz)ouCn?d*cXp8iw@N+0Pk&YH}iU^rL#4ejqf+9QH7^!==tJB@eIZ=W|;ATQ|AoH84l=uE=@#R=RB_uZXI31(u*KZoLDqWjTiES_*@elp3BN0(#+#L#VBdF1d7nZ zJ$>3+ON7q3nN;e4>2(&M`~)XT={(q@1uVHz%Isn*jxTWHnSkd_)2ph$frPb7nv(XX zY!4kv9;Tdb-tD!?_Yao&vqFl29okT=g*$hfDIMd4veke^QNFBC!{xAh!D3G2 z)_4BWk-~#lh0>I@k2@NZ8_e}9*o&B<#rkyBu(>hE_eRUuY-ud?EsRuDtexU|9c>>c zdf(bMmP>AWkv~IzwuirTppZ-L8U#MQb5~Pvip=gdRG2<*BW53FTr!cuxcjpmj-NG~ zJxnd~3vkm@TJ^2^#Cp`Yf}e3?E0$uIuyPmfFA?(Okei%10(EYMR_2FIc`{fIR~rqY zWUPR@SxpAD2rayNp!)nc&AJn?C^av>D@I!1hvnn;sD%NB)c5bpf>+q&f?V}l;ksH{ zrlq4CUhjujr#rL-sYm4qp;h9O$0;Nu`$*3Enwvyj){RpHIu98tKzg1Z`c&c$gCnS&DjShUZcpscV-1yJl4Qr39no9Dth-5TX!Bo$ookIW9t(4Zs?x1IJdxq-p_{ zxaeGzt=fve6d0l4Q55`Fy~pdXC^^T5xMz0ut#UzHZIqu*B8s+r$7cO4I*74pP2Y+p z7nR@Gb3*X$hugP>9#}NUap_$ZH2Q9!VRAm%1lKb`Ocp9uG31B%X40 zcJbCO?!kDgG(p9HW{FJCY$cTwirFI4rTRcb?gw{ zlge{;(c7O>_MqFs4`?kW_lkLoY~#KmCO~CUCSHbQpXaCh_P?s#`EFg^>X5h_lma1H z!_0}BPimu;W@ofENpc-uPZRTHEO&eQbay{WWr;6)!>`xWSWAW8s{jlIkG&}IBn%IQ zP{ciLk4Gk+ZRes-T7Dy}0*A}$*0P;-J(1q~lmP#Bo!KFyT1I`piy z(o~}fvB1^gz`%uqnp9$_4vkH~x}!4*bwDyR(MviAN}T>Mnjx+! zxLcdeex(^Uba^NTww*hy2hIf%GYa~nh}^Q-tNGD&rcj@DJq0|mcaFY)f4qJ9sbcoU83dETn@yD z_cwNe=B>P@yPHo?u!bTC>L%lr24pH;gA-KI)()z?prxZCqq=K@<#5%#kVo0vG-rBJ zY1AyG{lWL;ZeqLpYNlkd&NPwi*d_^>t3~Thxf~y(-@sks_GCU0VSb@}>J!_=g%>0H zn8Byd5doM^%mm55`Y{7I+hj*)KiyP0E~7FN#8OL9{PC_qo&O(x_*KyJvft*}Nbg$8LzNJvZ%zBKzb^x>FzR4~*3l6{iuK9v{7u#t*v*}Q0`WS`nd4qnCsKWbu6;ix%nD&f zmePnPHHLz{%5<4LnfplHzZi>W0{;t4%j!uN5F(aSN+KtPS~IL(BwN1i%7}G!Y_wFc zY_(j3=RPEOC?RHMJbK6CrYREykyn`lI25?O6`QWHWpP)tAq~UR;cq$Mqx&Y}KyKn+ zpcSKZwq&H>h(xGSr{=E5boRq?~E`@RWgDq8-bA;2h14VJjK4Y#Iwj0?abBp!l}Up)dRp`KIfT-t~lkkAoYOM81Vi3A(kWeeh|n-^3Jja(qQ+7 zvDo|YS?DO#c*Ocge8aPjF%&pXM&6+FL$AvupL5gU`CZa!5w=sxRi2_i@~|)?=e{ei z1lvLFN%6%Jz#bNJEZi&exkGZEtutF7_Nhynu_6N-Gq*R9k1d2733 za(8c9++A4km68nA>kD+P>5eJItui+8O%SIv%e#daPO9DYb{+Fd-xuqGNZMz{eyOwm0F#oEOl%oY{`^j4(Y-P08r?2 z)5uFpOCs@$DBeoqt91D)PZ}&fG+e`>o+3E8$B1ZIDLL)0!Fiv#m?^4-SnVK(HX<_l zbL(P7t;hFMrl_3JnD!mgHzGc$o}5A0`29hBYUMq(NL32$MDQsQ24PoAu(ACQq#Sc0 zweyD_5M-L?#YzOU(9N`citY{X`GMvhXAt+Sw3iyk3G5yD#0;sQGU+|W>**xE=a1muY;H5y zqd4UHj>;4Xa3Y{@eMBL~ohm}ZAF@MGS^gmXK+YRxTRAy8V$%3QlOe<4I?pnt!(N)=Dosd%z=&s{u<@x*Lu54E zjjV;B8J;-7_`t1WKc-_-Z%5mHeie5ur2dv?20=xL`ZbWo78lcL8lH|6$?!?zn%Fj+ zqm-e=xs+g;fk(5ZUl$h9f9Od=o4V2J(@SKN5SI?!nC`g5{xCu*_*xt{UssyLCF1ZK zv^OWsr*=PpvvX&y6FPM{?wz3{XwNFlO&%6HG&YB^Hb*wsA7$O0^=&zrV+(gGhbHw; z^&Q_0eALy71AdL%R>o(<;V&S#ej|ei)CM5PB}6`#OBaI(+x&&1w(kzug@<6=WtL_u z;WhlXVitMo<88dECAF{dDEbRkwURmB@?>v#F|<`4dXB74ByCRf z86-u+qoCOW-RAqR{gzyly&G!MJ=x>Jtixe(R%lqS&pJNja9B4C%$K&uh6FF5lsfxG z+9|{2>Z%lQ+C1tszP}A4^EBLia;=5Sak6!zb>s9hgYATD3X!Ow3&#W^{I?X>!U87+ zzO`>0jb@X8CG3W??-B2_F9ggIBeK;ziti+cDrGHZlyGf!wwiKa)kzAaz zb?#rG?3qgWFM7=mffz6r0vm7XaVe^T(5D;42_IGfnXqx|P(P*N*>#B;2!)5sPd05w zYJLa_YWYqTbG8q^tgn4q=~C0brC}d+7P+NvcY&Nk?A0ORFBEXulEC*OEc9>1=oU;z z9jE`?`i7A+Tgu(1fT>rW5L+fPS?K%*R{H~Zis{oULprrbu^w1{i^5B>P~$ZLP{$=K zLa=Pe&>>4sw&rmR{!+*vL!#E`%+%yJ$;-SOk@6BoB?%4*T#AEYtsDwKHVgo4g?Zxc z86CK@wOLd7SI=EprL>k6L}7??dWMURG?MoF$@1C$iqgQ&_k_7`n?cyw6LC zNpO<777*4hUJsza7nX?5#>WWoWS{0F%ZvJ*&{3IJ2hQmrrrfsbKSvI+05mz9ZHO`% zd7OZJ#9OF&L^u?Lwi*h8%2x9(WXXHqAEx{{MBz17cyV?LmLD)os|IL=?+$xzX1v&z zWFPiCeUvr>Mr+Qc@2;`JNjN<2&i>XDgDh|=_2MclX-4td1W81$b_POe97TCr#Y=O! zc!^|l@500!+Tf>K(fj~Qf8tx~{|eb{RH|ki8CW(NBr%8VxtnaY<0k@U{pI7Ed}p&g z)F&EmZmEq}WrjS`t~0eFUuAF2LiX#8iv1W%>%r^HKXluDqci>fO+f2v@Jo9gOD$Ue zgxe|irLkpqPL$jgu}d_yfXb(hT*~;F&MI1j0V(rM5-BE<^IQQr%Hn2MZ!$Q{X$a=) z7?uX0&&=kK_g_>!%QlJ%9Qr$oVPpF*6MG%$^Tfa>m-z6C5{xhlT`E(Hl{x3pSE^gf z=!XTUAl;Cc?9oNgIjhx`YMsR(R_BiBX_2DsK~0ciy?F?7ZMxGfMdBFT%Dm#$T^Jlsb}2z~pNMAwz`+FQTzz{b z!gugfoQ2e-pKRaJHVJCVf_vTTMQ9lr(#YV?%bMBOEQ#T9R(P?8wz8ZY&iR@rNh`N_ zk<2LQ9QLvv*V26+IB$acAMPnZ4Q+iW<_ftQ>N`3A>)BX^Zxgs4uZGjH?(Y=wCdL&Z zcO5b~ZJq{8u$nPjqk;HifYRZxYs(0Q@lgj$6trVJ z9H2J>&%eKVlPmFxSvi;x0#h!mh!XjDDBw&6QOr15OiRDsMLD_;vARFGJ2)I~Z@VW+ zGd)$Rma}8{iX8aSU%zOFaT5HZiyY>oxz9OcJV0(0G2I^;2v<6Bg9U(^iML*X6e>P^ zkTWJMo1ib|4`!;opUXehGPJg)mL9H?Cnz2Km@N9FEHDKq8`CSCo;HqO(pUI2*+dUj zV%_{jBtg)dWZfXXT#fZI$^abmxSYGUJ1-P&k zkV}7mXzvxYUTK2E;+aCQ&J(Tf?4fM7TpYfZ+QVM#qQ6Ks_6AR;=XnCJ>$Aang%9@lY$Lkb2Lo@%>Pq}E z36}uja;BaaL*tBpkth5_{H??%1bHx#sY|ag*1TJNjM6hAnq8OoA`^ZX!FK9(spIH- zWDMT0>QtIR=%=9l4PKyxeCUbD%DR~H>V-#RdlEFy1onMn*Z#KN1SeAY)9_raYQ?lt zF5CWof#opytS3vwR{JT>tiroQL(6CEqj4i$%24q)8tu=Evb zo;-ze;@KTm?QaflSZJ8xl{Y0V~+xF7dvV?<0^@>z>2@h?Z>sw^M`-44ZABA zfJ-(3cBRh0q^^9*{tPWwW&octsr+hjS*l2Y@^b)+jhF4DZh5^l0TR2m{)^=A4J_%+ z(7Bn5nB8aBHmdgyoJGx}4;Po<7mED|P7Sr=Ff3}zD@n)9q0cQI7FuG=$c|&saBNSh*&?z z&u0X?XxgQ0yNZ;iP32nILA$vN{lmsf7NXql`ou3#DZ)38dH7*zqc|)Bf4JC=2wp;c zO>y_Gu=H6RV@(QVWH^tcrRCpLH444u9Y$t`-j2yRg97ID2fVfk?s&OciJ`SkxuY`M zWaK`k&~&vtB&bZMWm}zd16dSyDO=;Ke|9lRGn@8&mSqXxR{!RO(9&Ei4XZze;)ap! zt*6bGcWT#dw|?A)8J?E#61}&v(0n578Ch#NxZp|)#Vvpo1t2y$e94D@3G6k9Xifxv z3BgY7584pVgu`?MHs*f&$9<)!>$@p;ddQz%z1g?eUkYqKC>QbfH3JBo2r@967L+cK zC=j}5kX?$%T5VL=i3fT$V{bM%rum-pO8`OT98a0wTviWF*w*&0T0tE`pJ(;nzW1%- z3reqNF%Eh6%ZQR)4IV?2Au^DBK=2~HqyCIvh@LDvU_Q9=35P}#NTR#IXNU1ka8FDG z45s{dzTc9D#o3>Dh4>c|B$EEl%IrF@4nc|^x~wdpJrnY=8*PX%&Pqh=*GF>AJRg_P z6snsHVAq(<`0{xS0AHTBIt&6LAj)41R=H|_+%RCBB!ZTK&l1~ZVk!qCy-KpFU0qcE z0s!(@fCJ@ATs{9C-I=YRlhdtk*}cL$(x$L(*iJ?jws zPwwA7H8FSOqb%AU0(}kYF6Mm&d1I>TvrUJ|cK>DPJjs!N?R04!j z-<&(@{#c>snwl=a1Tl*0`Gb8Fk4VM?K8&vcok_+5E`om)c;}xQ@hS1$yXs`q@N%U( zF0ri8>o~jj)DX%XuJTyTp_%R~qirnq6^+ zyZ<`1NtFIr0lIa!`a+iYf`5wG{9&=KQ8Ts*6q#1*&EK8Ztnk2rOAltM{MOR1g?6Zh zSD500Ze5`yG0UpjoDxY9ixl*8sit#V;Rr5V^30{_oP`(anYtO%BHo^pLGp)*vj=CM zXRCtbrc1OG+)*JdpRZWo+FJpN_iKl|-vV(oY%mLvnL_ifh|>M|Vey&NV3+>7hi=9? z*EiVkJ7APBLwTpe@>U6)Bz>IG(ILQ<4X%d(Odei-Xt>=s>qv1tK(PhB&9EAt-HDxB zuip_%2@P`(AO{mE1oze9+eETe)Zr{R?on7vRa8z3MF#PCv>o<4)dC*SoyhCf+#{tD zfe34QfEp?0j^WLYi%Hx6lWwFlJwX5qCy>OdF$bquRNj@qz$(xwyR(do$gepI+X%-x z#4QaW=pF5!clXa4wchnsj1)Ag?K8f?^%Gg93#kuSu9LaHJF&-_WfT)0=#4L*Gh9-n z^H3B!OM}e>-`KgY+>;?tjQ-POT2eGie(mat-jAZl_OMl2m;Rmd^o>%wDv_l*j_nu8 z)SVq5kKe;|pDp-a1vPyc+`HpKdC4+azT@WI>J5c`*eF+9D!3JvtLXXjd;txh|M><{ zmuHM#;Q^8g7I<(;!3?G0dFTdbsX0%eH%vKUmboZDpU_su7F{sAfFpXu&xa~HHyzyp zP)Yx);g>A^2wwvWs!x!Q*B!AUDKE%Gm?A(!N*zX=zI~~%i-oS5WOLnnf^Ob)gr83K zFmOT)JTd?XC8f|>t*pdThzY`_)SjCm1??|c!YiZu-Z7^SVrxDfESFWU;qjcxw&c#& zE-ov+7IW8`>|#m)Ff^fX@a1c8NVo_R)M?q1b`ju!n>#u4m#*Wlk1w=wy6LwYXyB*4;$H2vD85ZNyWe&?5hLmw%f8Ju zDfRh7!NZNcK#a{c%k`Lqv!KpRcSw+R+lVvu#h+w`vmxIYF( zm3cRWi0s~U$m&JC7UEs8qa|;{j!dTzvZ%-;Wj0@v(l2(YHp>tW50ES)r#gaRGTl@* zqg0q2<{}08*_Ca_;+j;<;-TXY*oQrQOTE(lpVS;4=kPy-48!-t5=lgW+pJFQRryBb z2s_j>_+hwyYF-OI8119TjkL=CpZHDb?rh{I&{(-I(Qo8W?-{*zhFK zM@I=)_K`LncITaIuirnW)wavf@awGeq;zF4>7(0Bu+9c?SPSlNo{#QxwOP@uv-H#< zytCbU=a+pU0;0oPS)p%G7Q%+pBR+y7DhMOoI%SAL-VP4x((d%uhD&)_$6bT|xzH5$ z%=|;690cn=(umv$FsilotwjK#`k`4XHMnu~j4Sz1YD+gjTJd3d9=kV7H>%8R5)#sZ zwI8s{BqhxGdZW7>l0sT<20JOoauk6cnw#eLF@f=Xlf7Xw;rzyR!%@sKbP6YN@hCIj zJSJV0*x+Wcwd7>%PSM#}I_0W9-uD{`toIvf-5QvgB?c{Hj3dM^oR0Dl+MQwg)Sulu>azdA3n6H_8<>}^4j$+V5R_BnNEWom7J zUp?^d?g+BrWQExbR=h#9&Ae*0{(?(DYumN8LF{Gt=O}}10AaaZf}*Ljtm#2IE{ec2 zM}Kb?(abiiDT3m3uGHE9B)4_9rousWZvd#En$oYA>(5zb+CJ#Qlo_Cle!@FMtZT^l zWc{Vwl9$utb=+=r3=?7_c{YFN^BA2y=2OydFZ~qQ%=|Z}8(R4t#mkOg^@@@Adt=UX zo)FgYyILImy{y0`K_OKTFhBFhItH%+HcP>VMWaw?@K2c zVVdrFXf}|Li`qMlfKcw?Gt8pf7qv{eRR~uDuo(!bS~xC;E1x11@3{PI$*j4d(>7{^asHCq%I9LRGoW)2tTL}ae7`_cC31r{Bst-a zM;%07QGxwfp?0U7#Mi4klQq=un~ck0 zMQt08=0l=V8HK*NkWntsb+;|1UO<7-+8gA4iG_B7U-rEnyQ|sO4{t4*Qk*ySn2}Cd zoEvRD;OI{++RZ0?XKcwBD!ynKM*@p^xyNy1&dMzr{gdd17{PK>jT7O^d?pGXTvH_1 zya>JJ{y1hRo?Kr>ztt3D)d;828jItA0n?%r>xCz!tezYVjkoEn zu$_QI!uBPr{gUJYs)j!vS~E3CTX?pFs#g4!HfTb9s9Y^`QB#2+#bvFLxm!C>u1k&vt3wrfrG;U+4|%nEF9`3+ftszW*|Jyw%bdmssQ_gJmF~0e2pQ{5PBCwutQL>*bVxmMqPxWg zw*y%mS3*iU5NY7D*5VNqm$8zFC&M=MZ61@|_0h&VU7jRS{a;-(xG*Xp#zD;%Uu zdwwXKvS^b$v^=~B2f7AoAV>4ILq8B48eY!wBpaM^+Sy&SaZ{(%vMbwGXeZBdTqd|= zb%QJQi3Sp9*ip8X5hk_eH}HD>R?gFzFBUP>@jY~Nv4s(32ANzH!sGJ8Pw6{GChd?Z zA+3FY&wN7P&-{*2ZiBU0yhqju1Tc?JEo;=2vbjhp`bM(HpPS%gEOhscR**AWakKqP z(vJ*I3($|EzVAt{_tH}hlKbZ-W~*Xul)LngPqT=BSofXAgvDbv-2Oo*X0-mf*G=89 zETPW6(+<};UQi$9Bdk$H1c7+B2?PX=XkRs_TK*Knty5_1(6^Q$4%QdZ zo}*2$T+lD2z5xIi=gLhM@jR_87Dr4K@RSBK(6G z#QQ1hCcBb{8x|0+aoV?x&I;3)QlAAmwn*h=8iyKxRH?PIdsQrDg^}l!nDSkH@Ct$D1Wpf*r8WFHj!#VTcC7*`>aYH?vdFSt) zi+6tTP4TYGMjGCYvNv6ZYBEJp`@)B4tDIR^kXFpHY)5g+NGj2XyJ?G?svdG z(N1u8HHlf@lUyC#QU$HL3@H;!Cp<5|n>!+jjg|y&Uy|DJ3&(@Yt5inZ!6ktK(RCi` z(ade~6^`hE+sbmF2y0vqNFJId!7BT{zvzMg1)wyuaMb;xgATL-3<%e) zrvSx}%56`DSsotwq4TX!W-Lu!w8bU%0O7h7nicj84~a$x1(bi1#J#BZl@@IYGWk6* z8$Wv{%Kks35 z1X_Mk50_=%1N0zf;kZ~plQ|=bc{MXY;eGazBKs2$2<2>QqB~4Nahr;=mS24ZDI3WGV?b}g`3+KSu)d7*8Ct;; z?pcc4CX+E%?mi11MwhBZPja`l6r`nH+ZbxwzLx-btz*ek4GY;Yrfl2TP1sffx#W4J zzK!*YAK}}qCkz1Lq@qcfHDVeoUiMB*zhNgZg%nVg(AThHe)3o=^5Dz7!!001)IIx4 zBe}!(pOWiJc^y-_!Wj5jJpF$sf&Sm-<1HJ?uhUE>U>oTZm;rrfGHu-8CKsCkduCA1x7 z6(}WZa`rD70(sQ2urX!1inE`C_eyX>v35XKep~QFsM;Y=zJ?mMujE@0#&ZhH*X;ym zv|Xc1FdvOw{7Zp-W%3iNlyDMqooW9Y^7nO0MJXWnzet`x#q`Guzmn+Zv$k47gadT6L5Ykl^&e^f=Sq3*@4G&w5wi;YaU zIda^>a2!AWUlPE?+)_9&-H;e8>GwSZ@*@4LDz@cMQA(J{8(#r2RJB^DF|yR~6vEXz zN>Ej!VjUEEEUDC~U8}u9L?})b-&K+u#L!-ZeKdS&*IKuA*TppS^7O~SB-egBl;c3~7^WdOPj_Umj^bru+(t-g z{=2=`Ot0lPDbMRXaFXR&$?4I>vyo3@HUa$M{rZFwr0e?DLQNSgF&WP&<+(BPSPcOU za2p`j_WqI_lLvK;T3g#2o>bB+6`M^pf$(Q$IA`60*yu&~sRkqK!bQ&08zbK>7mbvB z-{6oW&!Y)TK`(N|2ahDb#>Yw@9)21d%OQDaSdgrySC4OXe?m7QQU^QqtN_83y(yTo z^s9XHVMaqd$ z{(%ms^#31n$uq^GeqnhG7NvXHUjxlG#5K>>)qbIIoXb)+-JV_eB&#Bg{wPd$t1Swe z6%Qe6B(4(Eb_186p?ik6#el@oNl4D%$;&20?e&19W^ zw-jB;8@@4Bo(%Z9SpY0h+)w`H(8gc=hl>s5oj&Zg;%eHm&do&a{&$~0OD8%*Epi)Ul}~@`OBT0xB=$*8-{*1 zZgJ;7{%(5k-;Xu_Z(Zeo8xn5q)~`g(p9ve3CWhCo(ne`T3N*FSfJDZHBmF+^|LIq+ zQ`2+Z*8YDJD^jC>&N@!vyQocO&??MEeueo6iinqri`qVa$=;`MV@7vT_wop-Ns+f z7A=crumWrLf#m=KAFEOs9&;vNQooQAlG0 zP&W0t(~DjtekC|s)H(7jv>f=3kTk8GsscbqDNb?~4+;%ASz37=`}wg&FS{!taHn~* zO2T*ppa-hLcbfLj0Wu@J5?bQVEAFF{mhCCsb#>ZIuEOm4iBfjJo*6bURl)H%1A5!8 z3QWKI$JxZ8`0mWFx3c5`P00@MfP0*%B5GAj;d7fv)g3lPAmSl+c1gne6nMpeAw|&3 zPRBX-y(_1Om^3=XQg0dz_%u0|=uKJ+#M9MhAj={@TCUMi*F;O~pT_~GO}!7R&$wqo zr&wtDPX6m9`}9G&+~I?2;TXWnan=^)ro{n8`soyogB&uz#*GZ&g)#KPeK`|Xchkb) z$Yvr?))w>2S!$VXzb*(`#Je~L$An2+blc3yb?1MVE#hU>Sh!DA3+W8G8;O&(-Y zj9`odpJg^o!z7&oBydL)xQpmws(KQZ9$uFcuuK({&) z^GNB6<8$_X0%idyf=AHJF7<_@8@B2>PloZ4c|fRkK~aBl$&UuEJ|CdKfmPytcRuj^ zSAa$Y)M?(;dx_XT_hwRg@{nt?`>#p{mwKeW&h|5iq;St&`c5IITpF4#K7MX9FJSyN z2LGkn7`_y?DQ+W<~vevWqjZ|LIgiz%VN0s~rkkV3n zjBoL!PP09ACB?hEF)&W>JocQGiAHQN5V)}Dq~i75r!uZ?Ibh}rbelrYPV~L2AsQR& zS`FpOgG0l9g@3*tAvx3xZmuBgrK<=|l>gQ#`LPoy!CM|TJr9&7I~FAUfSTd89fU#!_ghWC z(m3F#NipZ9sV(^JYb-K}tOduBs*UY;%Wqd?=ykjD<~||qicl`6RmaP zyPqeN_fzVvN<-32IY}1*o7@5A*BPFAw#eBzAS%79DQ@>==S&V-BUnohmrm+ptC?4=oD(J&jm9) zl(XR0B!|AwCpWS+a2;KTXwk|5gR!>*nk3Ad;a1FEGPnJla=HV&K&4f0be}@{aSMznpn(DZ{Y!BFw2(!M zCv@e6q)i>}wJBHWT$YI`nF)~MAQ*WB6%)*AOE>h2oxV)Hhj}fdJib|};Qu8jarmr> zfsI==+{nE79q1pi17v#`-byu3J7wxex=vEodgw{Q?yRp|U{8x9y~JWnh!|1{G%=E8 z1!zXSNd&X|>wWY~R3*Yf!seK~x4HQ@*78RWuRR{7p!la$(qWvD#Tj~+io=p8l>5y6 zhjP}+J(xpa`hbdt6;3#`|JXcJ3;!i@Sn#^Vc88w*=tl|Affk zpLhN*(k%S@a{r%^kNkTo{yi1H_L2XyvZa69-M{Vb-*!hIfoK1H+Q9!`EiwvC#zaL< TuY)>5A61RVI*%$J+PwH50%z%o literal 0 HcmV?d00001 diff --git a/config.json b/config.json new file mode 100644 index 0000000..0c94356 --- /dev/null +++ b/config.json @@ -0,0 +1,109 @@ +{ + "version": "2.2.0", + "modules": { + "SecurityBaseline": { + "enabled": true, + "priority": 1, + "status": "IMPLEMENTED", + "_comment": "Interactive: BitLocker USB enforcement (Y/N, default: N)", + "bitLockerUSBEnforcement": false + }, + "ASR": { + "enabled": true, + "priority": 2, + "status": "IMPLEMENTED", + "_comment": "Interactive: Management tools (Y/N), Prevalence rule (Y/N), Cloud protection (C/A)", + "usesManagementTools": false, + "allowNewSoftware": false, + "continueWithoutCloud": true + }, + "DNS": { + "enabled": true, + "priority": 3, + "status": "IMPLEMENTED", + "_comment": "Interactive: Provider (1=Quad9/Security, 2=Cloudflare/Speed, 3=AdGuard/AdBlock), DoH mode (1-2)", + "provider": "Quad9", + "dohMode": "REQUIRE" + }, + "Privacy": { + "enabled": true, + "priority": 4, + "status": "IMPLEMENTED", + "_comment": "Interactive: Mode (1-3), Cloud Clipboard (Y/N, MSRecommended only), Bloatware removal (Y/N)", + "mode": "MSRecommended", + "disableCloudClipboard": true, + "removeBloatware": true + }, + "AntiAI": { + "enabled": true, + "priority": 5, + "status": "IMPLEMENTED", + "description": "Disable all Windows 11 AI features (Recall, Copilot, Paint AI, etc.)", + "_comment": "No interactive prompts - fully automatic" + }, + "EdgeHardening": { + "enabled": true, + "priority": 6, + "status": "IMPLEMENTED", + "description": "Microsoft Edge v139 Security Baseline: 20 security policies", + "_comment": "Interactive: Allow extensions (Y/N, default: Y)", + "allowExtensions": true, + "version": "2.2.0", + "baseline": "Edge v139", + "policies": 20, + "features": { + "smartscreen_enforcement": true, + "site_isolation": true, + "ssl_error_blocking": true, + "extension_blocklist": true, + "ie_mode_restrictions": true, + "spectre_mitigations": true, + "application_encryption": true, + "auth_scheme_restrictions": true + } + }, + "AdvancedSecurity": { + "enabled": true, + "priority": 7, + "status": "IMPLEMENTED", + "description": "Advanced Security hardening beyond MS Baseline", + "_comment": "Interactive: Profile (1-3), RDP (Y/N), Admin shares (Y/N, domain only), UPnP (Y/N), Wireless Display (Y/N), Discovery Protocols (Maximum only, Y/N), IPv6 (Maximum only, Y/N)", + "securityProfile": "Balanced", + "disableRDP": true, + "forceAdminShares": false, + "disableUPnP": true, + "disableWirelessDisplay": false, + "disableDiscoveryProtocols": true, + "disableIPv6": false, + "version": "2.2.0", + "policies": 50, + "features": { + "rdp_hardening": true, + "wdigest_protection": true, + "admin_shares_disable": true, + "risky_ports_closure": true, + "risky_services_stop": true, + "legacy_tls_disable": true, + "wpad_disable": true, + "powershell_v2_removal": true, + "srp_lnk_protection": true, + "windows_update_config": true, + "finger_protocol_block": true, + "wireless_display_security": true, + "discovery_protocols_security": true, + "firewall_shields_up": true, + "ipv6_disable": true + }, + "profiles": ["Balanced", "Enterprise", "Maximum"] + } + }, + "options": { + "dryRun": false, + "createBackup": true, + "verboseLogging": true, + "autoReboot": false, + "nonInteractive": false, + "autoConfirm": false, + "_comment": "nonInteractive=true: Skip all Read-Host prompts, use config values instead" + } +} diff --git a/gui-state.json b/gui-state.json new file mode 100644 index 0000000..9820db0 --- /dev/null +++ b/gui-state.json @@ -0,0 +1,35 @@ +{ + "HardeningApplied": true, + "LastHardeningDate": "2025-12-04T23:57:32.7164595+01:00", + "TotalSettingsApplied": 44, + "ModuleStatuses": { + "ASR": { + "IsApplied": true, + "LastApplied": "2025-12-04T23:57:32.7182749+01:00" + }, + "SecurityBaseline": { + "IsApplied": true, + "LastApplied": "2025-12-04T23:53:10.7213433+01:00" + }, + "DNS": { + "IsApplied": true, + "LastApplied": "2025-12-04T23:57:32.7185664+01:00" + }, + "Privacy": { + "IsApplied": true, + "LastApplied": "2025-12-04T23:53:10.722384+01:00" + }, + "AntiAI": { + "IsApplied": true, + "LastApplied": "2025-12-04T23:53:10.7226177+01:00" + }, + "EdgeHardening": { + "IsApplied": true, + "LastApplied": "2025-12-04T23:57:32.7188501+01:00" + }, + "AdvancedSecurity": { + "IsApplied": true, + "LastApplied": "2025-12-04T23:53:10.7303963+01:00" + } + } +} \ No newline at end of file diff --git a/install.ps1 b/install.ps1 new file mode 100644 index 0000000..fa73705 --- /dev/null +++ b/install.ps1 @@ -0,0 +1,332 @@ +#Requires -Version 5.1 + +<# +.SYNOPSIS + NoID Privacy - One-Line Installer + +.DESCRIPTION + Downloads and installs the latest version of NoID Privacy from GitHub. + This script checks prerequisites, downloads the latest release, extracts it, + and prepares it for execution. + +.EXAMPLE + # Run from web (one-liner) + irm https://raw.githubusercontent.com/NexusOne23/noid-privacy/main/install.ps1 | iex + +.NOTES + Author: NexusOne23 + Version: 1.0.0 + Requires: PowerShell 5.1+, Windows 11, Admin Rights +#> + +function Install-NoIDPrivacy { + [CmdletBinding()] + param( + [Parameter(Mandatory = $false)] + [string]$InstallPath = "$env:USERPROFILE\NoIDPrivacy", + + [Parameter(Mandatory = $false)] + [switch]$SkipAdminCheck + ) + +$ErrorActionPreference = 'Stop' +$ProgressPreference = 'SilentlyContinue' + +# Colors +$ColorSuccess = 'Green' +$ColorError = 'Red' +$ColorWarning = 'Yellow' +$ColorInfo = 'Cyan' + +function Write-ColorOutput { + param( + [Parameter(Mandatory)] + [string]$Message, + + [Parameter(Mandatory = $false)] + [string]$Color = 'White', + + [Parameter(Mandatory = $false)] + [switch]$NoNewline + ) + + if ($NoNewline) { + Write-Host $Message -ForegroundColor $Color -NoNewline + } + else { + Write-Host $Message -ForegroundColor $Color + } +} + +function Test-Administrator { + $identity = [Security.Principal.WindowsIdentity]::GetCurrent() + $principal = [Security.Principal.WindowsPrincipal]::new($identity) + return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) +} + +function Get-LatestRelease { + try { + Write-ColorOutput "Fetching latest release from GitHub..." -Color $ColorInfo + $release = Invoke-RestMethod -Uri "https://api.github.com/repos/NexusOne23/noid-privacy/releases/latest" -UseBasicParsing + return $release + } + catch { + Write-ColorOutput "No releases found. Using main branch instead..." -Color $ColorWarning + return $null + } +} + +function Test-SafeInstallPath { + [CmdletBinding()] + param( + [Parameter(Mandatory = $true)] + [string]$Path + ) + + try { + $fullPath = (Resolve-Path -LiteralPath $Path -ErrorAction Stop).Path + } + catch { + $fullPath = [System.IO.Path]::GetFullPath($Path) + } + + $normalized = $fullPath.TrimEnd('\').ToLowerInvariant() + + # Block drive roots (e.g. C:\) + if ($normalized -match '^[a-z]:$') { + Write-ColorOutput "ERROR: Installation path '$fullPath' is a drive root and is not allowed." -Color $ColorError + return $false + } + + # Block critical system locations + $blocked = @() + if ($env:WINDIR) { $blocked += $env:WINDIR.TrimEnd('\\').ToLowerInvariant() } + if ($env:ProgramFiles) { $blocked += $env:ProgramFiles.TrimEnd('\\').ToLowerInvariant() } + if (${env:ProgramFiles(x86)}) { $blocked += ${env:ProgramFiles(x86)}.TrimEnd('\\').ToLowerInvariant() } + if ($env:SystemRoot) { $blocked += $env:SystemRoot.TrimEnd('\\').ToLowerInvariant() } + if ($env:USERPROFILE) { $blocked += $env:USERPROFILE.TrimEnd('\\').ToLowerInvariant() } + + foreach ($b in $blocked) { + if ([string]::IsNullOrEmpty($b)) { continue } + if ($normalized -eq $b -or $normalized.StartsWith($b + '\\')) { + Write-ColorOutput "ERROR: Installation path '$fullPath' is too close to a critical system directory ($b)." -Color $ColorError + return $false + } + } + + return $true +} + +# Banner +Write-Host "" +Write-Host "===============================================================" -ForegroundColor Cyan +Write-Host " NoID Privacy - One-Line Installer " -ForegroundColor Cyan +Write-Host " Professional Windows 11 Security & Privacy Hardening Framework " -ForegroundColor Cyan +Write-Host "===============================================================" -ForegroundColor Cyan +Write-Host "" + +# Step 1: Check Administrator +if (-not $SkipAdminCheck) { + Write-ColorOutput "Checking administrator privileges..." -Color $ColorInfo + if (-not (Test-Administrator)) { + Write-ColorOutput "ERROR: Administrator rights required!" -Color $ColorError + Write-ColorOutput " Please run PowerShell as Administrator and try again." -Color $ColorWarning + Write-ColorOutput @" + +To run as Administrator: +1. Press Win + X +2. Click "Terminal (Admin)" or "PowerShell (Admin)" +3. Run the install command again + +"@ -Color $ColorInfo + exit 1 + } + Write-ColorOutput "Administrator privileges confirmed" -Color $ColorSuccess +} + +# Step 2: Check PowerShell Version +Write-ColorOutput "Checking PowerShell version..." -Color $ColorInfo +$psVersion = $PSVersionTable.PSVersion +if ($psVersion.Major -lt 5 -or ($psVersion.Major -eq 5 -and $psVersion.Minor -lt 1)) { + Write-ColorOutput "ERROR: PowerShell 5.1 or higher required!" -Color $ColorError + Write-ColorOutput " Current version: $($psVersion.ToString())" -Color $ColorWarning + exit 1 +} +Write-ColorOutput "PowerShell version OK ($($psVersion.ToString()))" -Color $ColorSuccess + +# Step 3: Check Windows Version +Write-ColorOutput "Checking Windows version..." -Color $ColorInfo +$osInfo = Get-ComputerInfo +$buildNumber = [int]$osInfo.OsBuildNumber + +if ($buildNumber -lt 22000) { + Write-ColorOutput "ERROR: Windows 11 required!" -Color $ColorError + Write-ColorOutput " Current build: $buildNumber (Windows 10 or older)" -Color $ColorWarning + exit 1 +} + +$osVersion = if ($buildNumber -ge 26200) { "25H2" } + elseif ($buildNumber -ge 26100) { "24H2" } + elseif ($buildNumber -ge 22631) { "23H2" } + else { "Unknown" } + +Write-ColorOutput "Windows 11 $osVersion detected (Build $buildNumber)" -Color $ColorSuccess + +# Step 4: Create Install Directory +Write-ColorOutput "Creating installation directory..." -Color $ColorInfo +if (-not (Test-SafeInstallPath -Path $InstallPath)) { + Write-ColorOutput "Installation aborted due to unsafe install path." -Color $ColorError + exit 1 +} +if (Test-Path $InstallPath) { + Write-ColorOutput "Directory already exists: $InstallPath" -Color $ColorWarning + $response = Read-Host " Overwrite existing installation? (Y/N)" + if ($response -ne 'Y') { + Write-ColorOutput "Installation cancelled by user" -Color $ColorWarning + exit 0 + } + Write-ColorOutput "Removing old installation..." -Color $ColorInfo + Remove-Item -Path $InstallPath -Recurse -Force +} + +New-Item -ItemType Directory -Path $InstallPath -Force | Out-Null +Write-ColorOutput "Install directory created: $InstallPath" -Color $ColorSuccess + +# Step 5: Download Latest Release or Main Branch +$downloadUrl = $null +$downloadPath = Join-Path $env:TEMP "NoIDPrivacy.zip" + +$release = Get-LatestRelease + +if ($release) { + Write-ColorOutput "Latest release: $($release.tag_name)" -Color $ColorInfo + $zipAsset = $release.assets | Where-Object { $_.name -like "*.zip" } | Select-Object -First 1 + + if ($zipAsset) { + $downloadUrl = $zipAsset.browser_download_url + Write-ColorOutput "Downloading release: $($zipAsset.name)" -Color $ColorInfo + } +} + +if (-not $downloadUrl) { + Write-ColorOutput "Downloading from main branch..." -Color $ColorInfo + $downloadUrl = "https://github.com/NexusOne23/noid-privacy/archive/refs/heads/main.zip" +} + +try { + Invoke-WebRequest -Uri $downloadUrl -OutFile $downloadPath -UseBasicParsing + Write-ColorOutput "Download complete" -Color $ColorSuccess +} +catch { + Write-ColorOutput "ERROR: Download failed!" -Color $ColorError + Write-ColorOutput " $($_.Exception.Message)" -Color $ColorWarning + exit 1 +} + +# Step 6: Extract Archive +Write-ColorOutput "Extracting files..." -Color $ColorInfo +try { + Expand-Archive -Path $downloadPath -DestinationPath $InstallPath -Force + + # Move files from subdirectory to root (GitHub zip structure) + $subDir = Get-ChildItem -Path $InstallPath -Directory | Select-Object -First 1 + if ($subDir) { + Get-ChildItem -Path $subDir.FullName -Recurse | ForEach-Object { + $dest = Join-Path $InstallPath $_.FullName.Substring($subDir.FullName.Length + 1) + if ($_.PSIsContainer) { + New-Item -ItemType Directory -Path $dest -Force | Out-Null + } + else { + Move-Item -Path $_.FullName -Destination $dest -Force + } + } + Remove-Item -Path $subDir.FullName -Recurse -Force + } + + Remove-Item -Path $downloadPath -Force + Write-ColorOutput "Files extracted successfully" -Color $ColorSuccess +} +catch { + Write-ColorOutput "ERROR: Extraction failed!" -Color $ColorError + Write-ColorOutput " $($_.Exception.Message)" -Color $ColorWarning + exit 1 +} + +# Step 7: Unblock Files +Write-ColorOutput "Unblocking PowerShell scripts..." -Color $ColorInfo +Get-ChildItem -Path $InstallPath -Recurse -Include *.ps1, *.psm1, *.psd1 | Unblock-File +Write-ColorOutput "All files unblocked" -Color $ColorSuccess + +# Step 8: Display Success Message +Write-Host "" +Write-Host "===============================================================" -ForegroundColor Green +Write-Host " INSTALLATION COMPLETE! " -ForegroundColor Green +Write-Host "===============================================================" -ForegroundColor Green +Write-Host "" +Write-Host "Installation Path: $InstallPath" -ForegroundColor Green +Write-Host "" +Write-Host "Next Steps:" -ForegroundColor Green +Write-Host "" +Write-Host "1. Review the documentation:" -ForegroundColor Green +Write-Host " README: $InstallPath\README.md" -ForegroundColor Green +Write-Host "" +Write-Host "2. Create a system backup (CRITICAL!):" -ForegroundColor Green +Write-Host " - System Restore Point" -ForegroundColor Green +Write-Host " - Full system image" -ForegroundColor Green +Write-Host " - VM snapshot (if applicable)" -ForegroundColor Green +Write-Host "" +Write-Host "3. Run the interactive setup:" -ForegroundColor Green +Write-Host " cd `"$InstallPath`"" -ForegroundColor Green +Write-Host " .\Start-NoIDPrivacy.bat" -ForegroundColor Green +Write-Host "" +Write-Host "4. Or run directly with PowerShell:" -ForegroundColor Green +Write-Host " cd `"$InstallPath`"" -ForegroundColor Green +Write-Host " .\NoIDPrivacy.ps1 -Module All" -ForegroundColor Green +Write-Host "" +Write-Host "5. After execution, verify settings:" -ForegroundColor Green +Write-Host " .\Tools\Verify-Complete-Hardening.ps1" -ForegroundColor Green +Write-Host "" +Write-Host "IMPORTANT WARNINGS:" -ForegroundColor Yellow +Write-Host "" +Write-Host "- This tool modifies CRITICAL system settings" -ForegroundColor Yellow +Write-Host "- BACKUP your system BEFORE running" -ForegroundColor Yellow +Write-Host "- Test in a VM first (recommended)" -ForegroundColor Yellow +Write-Host "- Domain-joined systems: Coordinate with IT" -ForegroundColor Yellow +Write-Host "- Read SECURITY.md for security considerations" -ForegroundColor Yellow +Write-Host "" +Write-Host "Documentation:" -ForegroundColor Cyan +Write-Host "- README.md - Complete guide" -ForegroundColor Cyan +Write-Host "- CHANGELOG.md - Version history" -ForegroundColor Cyan +Write-Host "- SECURITY.md - Security policy" -ForegroundColor Cyan +Write-Host "- LICENSE - GPL v3.0 dual-license" -ForegroundColor Cyan +Write-Host "" +Write-Host "Community & Support:" -ForegroundColor Cyan +Write-Host "- GitHub Issues: https://github.com/NexusOne23/noid-privacy/issues" -ForegroundColor Cyan +Write-Host "- Discussions: https://github.com/NexusOne23/noid-privacy/discussions" -ForegroundColor Cyan + +Write-Host "" +Write-Host "" +Write-ColorOutput "Press any key to start interactive menu..." -Color $ColorInfo -NoNewline +$null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") +Write-Host "" + +# Auto-start interactive menu after user confirmation +Write-ColorOutput "Starting NoID Privacy..." -Color $ColorInfo + +try { + Push-Location $InstallPath + & .\Start-NoIDPrivacy.bat + Pop-Location +} +catch { + Write-ColorOutput "Could not auto-start. Please run manually:" -Color $ColorWarning + Write-ColorOutput " cd `"$InstallPath`"" -Color $ColorInfo + Write-ColorOutput " .\Start-NoIDPrivacy.bat" -Color $ColorInfo +} + +Write-Host "" +Write-ColorOutput "NoID Privacy - Keeping Windows 11 secure and private!" -Color $ColorSuccess +} + +# Call the function +Install-NoIDPrivacy @PSBoundParameters