44 lines
2.2 KiB
PowerShell
44 lines
2.2 KiB
PowerShell
Import-Module GroupPolicy
|
|
|
|
# Nom de la GPO
|
|
$gpoName = "Sécurité - Verrouillage postes"
|
|
$ouTarget = "OU=Postes,DC=tondomaine,DC=local" # <- À ADAPTER
|
|
|
|
# Créer la GPO
|
|
$gpo = New-GPO -Name $gpoName -Comment "Renforcement sécurité poste utilisateur"
|
|
|
|
# Lier à l'OU
|
|
New-GPLink -Name $gpo.DisplayName -Target $ouTarget
|
|
|
|
# ------------------------
|
|
# PARAMÈTRES GPO APPLIQUÉS
|
|
# ------------------------
|
|
|
|
# 1. Verrouillage du panneau de configuration
|
|
Set-GPRegistryValue -Name $gpoName -Key "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -ValueName "NoControlPanel" -Type DWord -Value 1
|
|
|
|
# 2. Verrouillage CMD & PowerShell
|
|
Set-GPRegistryValue -Name $gpoName -Key "HKCU\Software\Policies\Microsoft\Windows\System" -ValueName "DisableCMD" -Type DWord -Value 1
|
|
Set-GPRegistryValue -Name $gpoName -Key "HKCU\Software\Policies\Microsoft\Windows\PowerShell" -ValueName "EnableScripts" -Type DWord -Value 0
|
|
|
|
# 3. Désactivation du hash LAN Manager
|
|
Set-GPRegistryValue -Name $gpoName -Key "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" -ValueName "NoLMHash" -Type DWord -Value 1
|
|
|
|
# 4. Désactiver installation sans mot de passe admin
|
|
Set-GPRegistryValue -Name $gpoName -Key "HKLM\Software\Policies\Microsoft\Windows\Installer" -ValueName "DisableMSI" -Type DWord -Value 1
|
|
|
|
# 5. Désactivation du compte invité
|
|
Set-GPRegistryValue -Name $gpoName -Key "HKLM\SAM\SAM\Domains\Account\Users\Names\Guest" -ValueName "Enabled" -Type DWord -Value 0
|
|
|
|
# 6. Politique de mot de passe (complexité et longueur)
|
|
Set-GPRegistryValue -Name $gpoName -Key "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" -ValueName "PasswordComplexity" -Type DWord -Value 1
|
|
Set-GPRegistryValue -Name $gpoName -Key "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" -ValueName "MinimumPasswordLength" -Type DWord -Value 10
|
|
|
|
# 7. Expiration du mot de passe (90 jours)
|
|
Set-GPRegistryValue -Name $gpoName -Key "HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -ValueName "MaximumPasswordAge" -Type DWord -Value 90
|
|
|
|
# 8. Blocage énumération SID anonymes
|
|
Set-GPRegistryValue -Name $gpoName -Key "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" -ValueName "RestrictAnonymousSAM" -Type DWord -Value 1
|
|
|
|
Write-Host "GPO '$gpoName' créée et liée à $ouTarget"
|