一.背景資訊

在我們的安全運維工作中經常需要進行安全基線配置和檢查，所謂的安全基線配置就是系統的最基礎的安全配置，安全基線檢查涉及作業系統、中介軟體、資料庫、甚至是交換機等網路基礎裝置的檢查，面對如此繁多的檢查項，自動化的指令碼可以幫助我們快速地完成基線檢查的任務，如下為基線檢測指令碼具體的內容，供大家學習參考

二.基線檢測指令碼

<#
# Windows作業系統安全加固基線檢測指令碼
#>
$PSDefaultParameterValues['Out-File:Encoding'] = 'utf8'
$data = @{"project"=@()}
secedit /export /cfg config.cfg /quiet
 


#guest停用策略

$config = Get-Content -path config.cfg

 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "EnableGuestAccount ")){
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "1")
        {
            $data.code 
 
= "1"
            $projectdata = @{"msg"="guest賬戶停用策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="guest賬戶停用策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }
  


  #guest重新命名策略

$config 
 
= Get-Content -path config.cfg

 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "NewGuestName "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "Guest")
        {
            $data.code = "1"
            $projectdata = @{"msg"="guest賬戶重新命名策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="guest賬戶重新命名策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }
 

 #密碼複雜性策略
 $config = Get-Content -path config.cfg

 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "PasswordComplexity "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "1")
        {
            $data.code = "1"
            $projectdata = @{"msg"="密碼複雜性策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="密碼複雜性策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }
 

 #密碼長度最小值策略
 $config = Get-Content -path config.cfg

 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "MinimumPasswordLength "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -ge "8")
        {
            $data.code = "1"
            $projectdata = @{"msg"="密碼最小值策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="密碼最小值策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }



  #密碼最長使用期限策略
  
   $config = Get-Content -path config.cfg

 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "MaximumPasswordAge "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -le "90")
        {
            $data.code = "1"
            $projectdata = @{"msg"="密碼最長使用期限策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="密碼最長使用期限策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }



  #賬戶鎖定閥值策略
  
   $config = Get-Content -path config.cfg

 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "LockoutBadCount "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -le "5")
        {
            $data.code = "1"
            $projectdata = @{"msg"="賬戶鎖定閥值策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="賬戶鎖定閥值策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }
  


 #賬戶鎖定時間策略
  
   $config = Get-Content -path config.cfg

 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "ResetLockoutCount "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -ge "10")
        {
            $data.code = "1"
            $projectdata = @{"msg"="賬戶鎖定時間策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="賬戶鎖定時間策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }



 #關閉系統僅Administrator策略
  $config = Get-Content -path config.cfg

 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "ResetLockoutCount "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -ge "10")
        {
            $data.code = "1"
            $projectdata = @{"msg"="賬戶鎖定時間策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="賬戶鎖定時間策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }



 
#作業系統遠端關機策略安全


$config = Get-Content -path config.cfg

 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "SeRemoteShutdownPrivilege "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "*S-1-5-32-544")
        {
            $data.code = "1"
            $projectdata = @{"msg"="作業系統遠端關機策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="作業系統遠端關機策略不符合標準";
                             }
            $data['project']+=$projectdata
        }
    }
  }




  #作業系統本地關機策略安全

  $config = Get-Content -path config.cfg
 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "SeShutdownPrivilege "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "*S-1-5-32-544")
        {
            $data.code = "1"
            $projectdata = @{"msg"="作業系統本地關機策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="作業系統本地關機策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }


    #取得檔案或其他物件的所有許可權策略
  $config = Get-Content -path config.cfg
 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "SeProfileSingleProcessPrivilege "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "*S-1-5-32-544")
        {
            $data.code = "1"
            $projectdata = @{"msg"="取得檔案或其他物件的所有許可權策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="取得檔案或其他物件的所有許可權策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }



  #從網路訪問此計算機策略
  $config = Get-Content -path config.cfg
 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "SeNetworkLogonRight "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "*S-1-5-32-544,*S-1-5-32-545,*S-1-5-32-551")
        {
            $data.code = "1"
            $projectdata = @{"msg"="從網路訪問此計算機策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="從網路訪問此計算機策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }



 #稽核策略更改

 $config = Get-Content -path config.cfg
 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "AuditSystemEvents "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "3")
        {
            $data.code = "1"
            $projectdata = @{"msg"="稽核策略更改策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="稽核策略更改策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }
  



  #稽核登入事件

 $config = Get-Content -path config.cfg
 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "AuditLogonEvents "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "3")
        {
            $data.code = "1"
            $projectdata = @{"msg"="稽核登入事件策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="稽核登入事件不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }



    #稽核物件訪問

 $config = Get-Content -path config.cfg
 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "AuditObjectAccess "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "3")
        {
            $data.code = "1"
            $projectdata = @{"msg"="稽核物件訪問策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="稽核物件訪問不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }
  



  #稽核程序跟蹤

 $config = Get-Content -path config.cfg
 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "AuditProcessTracking "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "2")
        {
            $data.code = "1"
            $projectdata = @{"msg"="稽核程序跟蹤策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="稽核程序跟蹤策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }



    #稽核目錄服務訪問

 $config = Get-Content -path config.cfg
 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "AuditDSAccess "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "3")
        {
            $data.code = "1"
            $projectdata = @{"msg"="稽核目錄服務訪問策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="稽核目錄服務訪問策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }
  



  #稽核特權使用
 $config = Get-Content -path config.cfg
 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "AuditPrivilegeUse "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "3")
        {
            $data.code = "1"
            $projectdata = @{"msg"="稽核特權使用策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="稽核特權使用策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
  }
  



    #稽核系統事件
 $config = Get-Content -path config.cfg
 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "AuditSystemEvents "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "3")
        {
            $data.code = "1"
            $projectdata = @{"msg"="稽核系統事件策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="稽核系統事件策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
}
    



     #稽核賬戶登入事件
 $config = Get-Content -path config.cfg
 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "AuditAccountLogon "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "2")
        {
            $data.code = "1"
            $projectdata = @{"msg"="稽核賬戶登入事件策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="稽核賬戶登入事件策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
}
  
  



       #稽核賬戶管理
 $config = Get-Content -path config.cfg
 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "AuditAccountManage "))
    {
        $config_line[1] = $config_line[1].Trim(' ')
        if($config_line[1] -eq "2")
        {
            $data.code = "1"
            $projectdata = @{"msg"="稽核賬戶管理策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="稽核賬戶管理策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
}



#暫停會話前所需的空閒時間
 $config = Get-Content -path config.cfg
 for ($i=0; $i -lt $config.Length; $i++)
 {
    $config_line = $config[$i] -split "="
    if(($config_line[0] -eq "MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\AutoDisconnect"))
    {
        $config_line = $config_line[1]
        $config_line = $config[$i] -split ","
        
        if($config_line[1] -le "30")
        {
            $data.code = "1"
            $projectdata = @{"msg"="暫停會話前所需的空閒時間策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="暫停會話前所需的空閒時間策略不符合標準";}
            $data['project']+=$projectdata
        }
    }
}





#是否啟用NTP服務同步時鐘
$Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer'
$Name = 'Enabled'
 $config = (Get-ItemProperty -Path "Registry::$Key" -ErrorAction Stop).$Name
   if($config -eq "1")
        {
            $data.code = "1"
            $projectdata = @{"msg"="啟用NTP服務同步時鐘策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="啟用NTP服務同步時鐘策略不符合標準";}
            $data['project']+=$projectdata
        }



#檢測開機啟動項
$Key = 'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run'
$result = (Get-ItemProperty -Path "Registry::$Key" -ErrorAction Stop)
$projectdata = @{"msg"="開機啟動項為：$($result)";}
 $data['project']+=$projectdata



 #檢查關閉預設共享盤

 $Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa'
 $Name = 'restrictanonymous'
 $config = (Get-ItemProperty -Path "Registry::$Key" -ErrorAction Stop).$Name
   if($config -eq "1")
        {
            $data.code = "1"
            $projectdata = @{"msg"="關閉預設共享盤策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="關閉預設共享盤策略不符合標準";}
            $data['project']+=$projectdata
        }
        



#禁止全部驅動器自動播放
 $Key = 'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
 $name = "NoDriveTypeAutoRun"
 $config = (Get-ItemProperty -Path "Registry::$Key" -ErrorAction Stop).$name
   if($config -eq "255")
        {
            $data.code = "1"
            $projectdata = @{"msg"="禁止全部驅動器自動播放符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="禁止全部驅動器自動播放不符合標準";}
            $data['project']+=$projectdata
        }
        



#應用日誌檢視器大小設定
$Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application'

$name = "MaxSize"
$config = (Get-ItemProperty -Path "Registry::$Key" -ErrorAction Stop).$name
if($config -ge "8192")
        {
            $data.code = "1"
            $projectdata = @{"msg"="應用日誌檢視器大小設定策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="應用日誌檢視器大小設定策略不符合標準";}
            $data['project']+=$projectdata
        }



        
#系統日誌檢視器大小設定
$Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System'

$name = "MaxSize"
$config = (Get-ItemProperty -Path "Registry::$Key" -ErrorAction Stop).$name
if($config -ge "8192")
        {
            $data.code = "1"
            $projectdata = @{"msg"="系統日誌檢視器大小設定策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="系統日誌檢視器大小設定策略不符合標準";}
            $data['project']+=$projectdata
        }



#安全日誌檢視器大小設定
$Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security'
$name = "MaxSize"
$config = (Get-ItemProperty -Path "Registry::$Key" -ErrorAction Stop).$name
if($config -ge "8192")
        {
            $data.code = "1"
            $projectdata = @{"msg"="安全日誌檢視器大小設定策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="安全日誌檢視器大小設定策略不符合標準";}
            $data['project']+=$projectdata
        }




#螢幕自動保護程式
$Key = 'HKEY_CURRENT_USER\Control Panel\Desktop'
$name = "ScreenSaveActive"
$config = (Get-ItemProperty -Path "Registry::$Key" -ErrorAction Stop).$name
if($config -eq "1")
        {
            $data.code = "1"
            $projectdata = @{"msg"="螢幕自動保護程式策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="螢幕自動保護程式策略不符合標準";}
            $data['project']+=$projectdata
        }




#螢幕保護程式啟動時間
$Key = 'HKEY_CURRENT_USER\Control Panel\Desktop'
$name = "ScreenSaveTimeOut"
$config = (Get-ItemProperty -Path "Registry::$Key" -ErrorAction Stop).$name
if($config -le "600")
        {
            $data.code = "1"
            $projectdata = @{"msg"="螢幕保護程式啟動時間策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="螢幕保護程式啟動時間策略不符合標準";}
            $data['project']+=$projectdata
        }




#螢幕恢復時使用密碼保護
$Key = 'HKEY_CURRENT_USER\Control Panel\Desktop'
$name = "ScreenSaveTimeOut"
$config = (Get-ItemProperty -Path "Registry::$Key" -ErrorAction Stop).$name
if($config -ge "1")
        {
            $data.code = "1"
            $projectdata = @{"msg"="螢幕恢復時使用密碼保護策略符合標準";}
            $data['project']+=$projectdata
        }
        else
        {
            $data.code = "0"
            $projectdata = @{"msg"="螢幕恢復時使用密碼保護策略不符合標準";}
            $data['project']+=$projectdata
        }



#結果處理
$date = Get-Date

#$result = ""
foreach ($i in $data.project){
    #$result += "{'msg':$($i.msg)},"
    echo "{'msg':[$($i.msg)]}"
    $i.msg >>jixian.txt
    
}

三.執行指令碼