mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 13:57:22 +00:00
Merge pull request #6575 from illfated/wddg-wdcg-hwr-tool
WDDG & WDCG HW readiness tool: typo & Arch Locale
This commit is contained in:
Daniel Simpson
GitHub
commit
5963793a0d
@ -14,11 +14,13 @@ ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool
|
||||
|
||||
```powershell
|
||||
# Script to find out if machine is Device Guard compliant
|
||||
# requires driver verifier on system.
|
||||
# Script to find out if a machine is Device Guard compliant.
|
||||
# The script requires a driver verifier present on the system.
|
||||
|
||||
param([switch]$Capable, [switch]$Ready, [switch]$Enable, [switch]$Disable, $SIPolicyPath, [switch]$AutoReboot, [switch]$DG, [switch]$CG, [switch]$HVCI, [switch]$HLK, [switch]$Clear, [switch]$ResetVerifier)
|
||||
|
||||
$path = "C:\DGLogs\"
|
||||
@ -36,7 +38,7 @@ $DGVerifySuccess = New-Object System.Text.StringBuilder
|
||||
$Sys32Path = "$env:windir\system32"
|
||||
$DriverPath = "$env:windir\system32\drivers"
|
||||
|
||||
#generated by certutil -encode
|
||||
#generated by certutil -encode
|
||||
$SIPolicy_Encoded = "BQAAAA43RKLJRAZMtVH2AW5WMHbk9wcuTBkgTbfJb0SmxaI0BACNkAgAAAAAAAAA
|
||||
HQAAAAIAAAAAAAAAAAAKAEAAAAAMAAAAAQorBgEEAYI3CgMGDAAAAAEKKwYBBAGC
|
||||
NwoDBQwAAAABCisGAQQBgjc9BAEMAAAAAQorBgEEAYI3PQUBDAAAAAEKKwYBBAGC
|
||||
@ -114,7 +116,7 @@ function LogAndConsoleSuccess($message)
|
||||
|
||||
function LogAndConsoleError($message)
|
||||
{
|
||||
Write-Host $message -foregroundcolor "Red"
|
||||
Write-Host $message -foregroundcolor "Red"
|
||||
Log $message
|
||||
}
|
||||
|
||||
@ -132,16 +134,16 @@ function IsExempted([System.IO.FileInfo] $item)
|
||||
Log $cert.ToString()
|
||||
return 0
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function CheckExemption($_ModName)
|
||||
{
|
||||
$mod1 = Get-ChildItem $Sys32Path $_ModName
|
||||
$mod2 = Get-ChildItem $DriverPath $_ModName
|
||||
if($mod1)
|
||||
{
|
||||
{
|
||||
Log "NonDriver module" + $mod1.FullName
|
||||
return IsExempted($mod1)
|
||||
return IsExempted($mod1)
|
||||
}
|
||||
elseif($mod2)
|
||||
{
|
||||
@ -184,15 +186,15 @@ function CheckFailedDriver($_ModName, $CIStats)
|
||||
}
|
||||
if($Result.Contains("PASS"))
|
||||
{
|
||||
$CompatibleModules.AppendLine($_ModName.Trim()) | Out-Null
|
||||
$CompatibleModules.AppendLine($_ModName.Trim()) | Out-Null
|
||||
}
|
||||
elseif($FailingStat.Trim().Contains("execute-write"))
|
||||
{
|
||||
$FailingExecuteWriteCheck.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null
|
||||
$FailingExecuteWriteCheck.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null
|
||||
}
|
||||
else
|
||||
{
|
||||
$FailingModules.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null
|
||||
$FailingModules.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null
|
||||
}
|
||||
Log "Result: " $Result
|
||||
}
|
||||
@ -204,7 +206,7 @@ function ListCIStats($_ModName, $str1)
|
||||
{
|
||||
Log "String := " $str1
|
||||
Log "Warning! CI Stats are missing for " $_ModName
|
||||
return
|
||||
return
|
||||
}
|
||||
$temp_str1 = $str1.Substring($i1)
|
||||
$CIStats = $temp_str1.Substring(0).Trim()
|
||||
@ -245,7 +247,7 @@ function ListDrivers($str)
|
||||
}
|
||||
|
||||
$DriverScanCompletedMessage = "Completed scan. List of Compatible Modules can be found at " + $LogFile
|
||||
LogAndConsole $DriverScanCompletedMessage
|
||||
LogAndConsole $DriverScanCompletedMessage
|
||||
|
||||
if($FailingModules.Length -gt 0 -or $FailingExecuteWriteCheck.Length -gt 0 )
|
||||
{
|
||||
@ -254,7 +256,7 @@ function ListDrivers($str)
|
||||
{
|
||||
LogAndConsoleError $WarningMessage
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
LogAndConsoleWarning $WarningMessage
|
||||
}
|
||||
@ -321,7 +323,7 @@ function ListSummary()
|
||||
}
|
||||
else
|
||||
{
|
||||
LogAndConsoleSuccess "Machine is Device Guard / Credential Guard Ready.`n"
|
||||
LogAndConsoleSuccess "Machine is Device Guard / Credential Guard Ready.`n"
|
||||
if(!$HVCI -and !$DG)
|
||||
{
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Capable" /t REG_DWORD /d 2 /f '
|
||||
@ -336,56 +338,56 @@ function ListSummary()
|
||||
|
||||
|
||||
function Instantiate-Kernel32 {
|
||||
try
|
||||
try
|
||||
{
|
||||
Add-Type -TypeDefinition @"
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
|
||||
public static class Kernel32
|
||||
{
|
||||
[DllImport("kernel32", SetLastError=true, CharSet = CharSet.Ansi)]
|
||||
public static extern IntPtr LoadLibrary(
|
||||
[MarshalAs(UnmanagedType.LPStr)]string lpFileName);
|
||||
|
||||
|
||||
[DllImport("kernel32", CharSet=CharSet.Ansi, ExactSpelling=true, SetLastError=true)]
|
||||
public static extern IntPtr GetProcAddress(
|
||||
IntPtr hModule,
|
||||
string procName);
|
||||
}
|
||||
|
||||
|
||||
"@
|
||||
}
|
||||
catch
|
||||
{
|
||||
Log $_.Exception.Message
|
||||
Log $_.Exception.Message
|
||||
LogAndConsole "Instantiate-Kernel32 failed"
|
||||
}
|
||||
}
|
||||
|
||||
function Instantiate-HSTI {
|
||||
try
|
||||
try
|
||||
{
|
||||
Add-Type -TypeDefinition @"
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Net;
|
||||
|
||||
|
||||
public static class HstiTest3
|
||||
{
|
||||
[DllImport("hstitest.dll", CharSet = CharSet.Unicode)]
|
||||
public static extern int QueryHSTIdetails(
|
||||
ref HstiOverallError pHstiOverallError,
|
||||
public static extern int QueryHSTIdetails(
|
||||
ref HstiOverallError pHstiOverallError,
|
||||
[In, Out] HstiProviderErrorDuple[] pHstiProviderErrors,
|
||||
ref uint pHstiProviderErrorsCount,
|
||||
byte[] hstiPlatformSecurityBlob,
|
||||
ref uint pHstiPlatformSecurityBlobBytes);
|
||||
|
||||
[DllImport("hstitest.dll", CharSet = CharSet.Unicode)]
|
||||
public static extern int QueryHSTI(ref bool Pass);
|
||||
|
||||
public static extern int QueryHSTI(ref bool Pass);
|
||||
|
||||
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
|
||||
public struct HstiProviderErrorDuple
|
||||
{
|
||||
@ -397,7 +399,7 @@ function Instantiate-HSTI {
|
||||
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 4096)]
|
||||
internal string ErrorString;
|
||||
}
|
||||
|
||||
|
||||
[FlagsAttribute]
|
||||
public enum HstiProviderErrors : int
|
||||
{
|
||||
@ -425,8 +427,8 @@ function Instantiate-HSTI {
|
||||
BlobVersionMismatch = 0x00000080,
|
||||
PlatformSecurityVersionMismatch = 0x00000100,
|
||||
ProviderError = 0x00000200
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
"@
|
||||
|
||||
@ -434,9 +436,9 @@ function Instantiate-HSTI {
|
||||
$FuncHandle = [Kernel32]::GetProcAddress($LibHandle, "QueryHSTIdetails")
|
||||
$FuncHandle2 = [Kernel32]::GetProcAddress($LibHandle, "QueryHSTI")
|
||||
|
||||
if ([System.IntPtr]::Size -eq 8)
|
||||
if ([System.IntPtr]::Size -eq 8)
|
||||
{
|
||||
#assuming 64 bit
|
||||
#assuming 64 bit
|
||||
Log "`nKernel32::LoadLibrary 64bit --> 0x$("{0:X16}" -f $LibHandle.ToInt64())"
|
||||
Log "HstiTest2::QueryHSTIdetails 64bit --> 0x$("{0:X16}" -f $FuncHandle.ToInt64())"
|
||||
}
|
||||
@ -450,7 +452,7 @@ function Instantiate-HSTI {
|
||||
$hr = [HstiTest3]::QueryHSTIdetails([ref] $overallError, $null, [ref] $providerErrorDupleCount, $null, [ref] $blobByteSize)
|
||||
|
||||
[byte[]]$blob = New-Object byte[] $blobByteSize
|
||||
[HstiTest3+HstiProviderErrorDuple[]]$providerErrors = New-Object HstiTest3+HstiProviderErrorDuple[] $providerErrorDupleCount
|
||||
[HstiTest3+HstiProviderErrorDuple[]]$providerErrors = New-Object HstiTest3+HstiProviderErrorDuple[] $providerErrorDupleCount
|
||||
$hr = [HstiTest3]::QueryHSTIdetails([ref] $overallError, $providerErrors, [ref] $providerErrorDupleCount, $blob, [ref] $blobByteSize)
|
||||
$string = $null
|
||||
$blob | foreach { $string = $string + $_.ToString("X2")+"," }
|
||||
@ -479,7 +481,7 @@ function Instantiate-HSTI {
|
||||
LogAndConsoleError $ErrorMessage
|
||||
$DGVerifyCrit.AppendLine($ErrorMessage) | Out-Null
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
LogAndConsoleWarning $ErrorMessage
|
||||
$DGVerifyWarn.AppendLine("HSTI is absent") | Out-Null
|
||||
@ -487,9 +489,9 @@ function Instantiate-HSTI {
|
||||
}
|
||||
|
||||
}
|
||||
catch
|
||||
catch
|
||||
{
|
||||
LogAndConsoleError $_.Exception.Message
|
||||
LogAndConsoleError $_.Exception.Message
|
||||
LogAndConsoleError "Instantiate-HSTI failed"
|
||||
}
|
||||
}
|
||||
@ -613,10 +615,10 @@ function ExecuteCommandAndLog($_cmd)
|
||||
$CmdOutput = Invoke-Expression $_cmd | Out-String
|
||||
Log "Output: $CmdOutput"
|
||||
}
|
||||
catch
|
||||
catch
|
||||
{
|
||||
Log "Exception while exectuing $_cmd"
|
||||
Log $_.Exception.Message
|
||||
Log $_.Exception.Message
|
||||
}
|
||||
|
||||
|
||||
@ -676,7 +678,7 @@ function CheckDriverCompat
|
||||
verifier.exe /flags 0x02000000 /all /log.code_integrity
|
||||
|
||||
LogAndConsole "Enabling Driver Verifier and Rebooting system"
|
||||
Log $verifier_state
|
||||
Log $verifier_state
|
||||
LogAndConsole "Please re-execute this script after reboot...."
|
||||
if($AutoReboot)
|
||||
{
|
||||
@ -692,7 +694,7 @@ function CheckDriverCompat
|
||||
else
|
||||
{
|
||||
LogAndConsole "Driver verifier already enabled"
|
||||
Log $verifier_state
|
||||
Log $verifier_state
|
||||
ListDrivers($verifier_state.Trim().ToLowerInvariant())
|
||||
}
|
||||
}
|
||||
@ -700,23 +702,23 @@ function IsDomainController
|
||||
{
|
||||
$_isDC = 0
|
||||
$CompConfig = Get-WmiObject Win32_ComputerSystem
|
||||
foreach ($ObjItem in $CompConfig)
|
||||
foreach ($ObjItem in $CompConfig)
|
||||
{
|
||||
$Role = $ObjItem.DomainRole
|
||||
Log "Role=$Role"
|
||||
Switch ($Role)
|
||||
Switch ($Role)
|
||||
{
|
||||
0 { Log "Standalone Workstation" }
|
||||
1 { Log "Member Workstation" }
|
||||
2 { Log "Standalone Server" }
|
||||
3 { Log "Member Server" }
|
||||
4
|
||||
4
|
||||
{
|
||||
Log "Backup Domain Controller"
|
||||
$_isDC=1
|
||||
break
|
||||
}
|
||||
5
|
||||
5
|
||||
{
|
||||
Log "Primary Domain Controller"
|
||||
$_isDC=1
|
||||
@ -735,7 +737,7 @@ function CheckOSSKU
|
||||
Log "OSNAME:$osname"
|
||||
$SKUarray = @("Enterprise", "Education", "IoT", "Windows Server", "Pro", "Home")
|
||||
$HLKAllowed = @("microsoft windows 10 pro")
|
||||
foreach ($SKUent in $SKUarray)
|
||||
foreach ($SKUent in $SKUarray)
|
||||
{
|
||||
if($osname.ToString().Contains($SKUent.ToLower()))
|
||||
{
|
||||
@ -762,7 +764,7 @@ function CheckOSSKU
|
||||
}
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "OSSKU" /t REG_DWORD /d 2 /f '
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
LogAndConsoleError "This PC edition is Unsupported for Device Guard"
|
||||
$DGVerifyCrit.AppendLine("OS SKU unsupported") | Out-Null
|
||||
@ -773,14 +775,14 @@ function CheckOSSKU
|
||||
function CheckOSArchitecture
|
||||
{
|
||||
$OSArch = $(gwmi win32_operatingsystem).OSArchitecture.ToLower()
|
||||
Log $OSArch
|
||||
if($OSArch.Contains("64-bit"))
|
||||
Log $OSArch
|
||||
if($OSArch -match ("^64\-?\s?bit"))
|
||||
{
|
||||
LogAndConsoleSuccess "64 bit archictecture"
|
||||
LogAndConsoleSuccess "64 bit architecture"
|
||||
}
|
||||
elseif($OSArch.Contains("32-bit"))
|
||||
elseif($OSArch -match ("^32\-?\s?bit"))
|
||||
{
|
||||
LogAndConsoleError "32 bit archictecture"
|
||||
LogAndConsoleError "32 bit architecture"
|
||||
$DGVerifyCrit.AppendLine("32 Bit OS, OS Architecture failure.") | Out-Null
|
||||
}
|
||||
else
|
||||
@ -878,7 +880,7 @@ function CheckTPM
|
||||
function CheckSecureMOR
|
||||
{
|
||||
$isSecureMOR = CheckDGFeatures(4)
|
||||
Log "isSecureMOR= $isSecureMOR "
|
||||
Log "isSecureMOR= $isSecureMOR "
|
||||
if($isSecureMOR -eq 1)
|
||||
{
|
||||
LogAndConsoleSuccess "Secure MOR is available"
|
||||
@ -904,7 +906,7 @@ function CheckSecureMOR
|
||||
function CheckNXProtection
|
||||
{
|
||||
$isNXProtected = CheckDGFeatures(5)
|
||||
Log "isNXProtected= $isNXProtected "
|
||||
Log "isNXProtected= $isNXProtected "
|
||||
if($isNXProtected -eq 1)
|
||||
{
|
||||
LogAndConsoleSuccess "NX Protector is available"
|
||||
@ -921,7 +923,7 @@ function CheckNXProtection
|
||||
function CheckSMMProtection
|
||||
{
|
||||
$isSMMMitigated = CheckDGFeatures(6)
|
||||
Log "isSMMMitigated= $isSMMMitigated "
|
||||
Log "isSMMMitigated= $isSMMMitigated "
|
||||
if($isSMMMitigated -eq 1)
|
||||
{
|
||||
LogAndConsoleSuccess "SMM Mitigation is available"
|
||||
@ -938,15 +940,15 @@ function CheckSMMProtection
|
||||
function CheckHSTI
|
||||
{
|
||||
LogAndConsole "Copying HSTITest.dll"
|
||||
try
|
||||
try
|
||||
{
|
||||
$HSTITest_Decoded = [System.Convert]::FromBase64String($HSTITest_Encoded)
|
||||
[System.IO.File]::WriteAllBytes("$env:windir\System32\hstitest.dll",$HSTITest_Decoded)
|
||||
|
||||
}
|
||||
catch
|
||||
catch
|
||||
{
|
||||
LogAndConsole $_.Exception.Message
|
||||
LogAndConsole $_.Exception.Message
|
||||
LogAndConsole "Copying and loading HSTITest.dll failed"
|
||||
}
|
||||
|
||||
@ -959,7 +961,7 @@ function PrintToolVersion
|
||||
LogAndConsole ""
|
||||
LogAndConsole "###########################################################################"
|
||||
LogAndConsole ""
|
||||
LogAndConsole "Readiness Tool Version 3.7.1 Release. `nTool to check if your device is capable to run Device Guard and Credential Guard."
|
||||
LogAndConsole "Readiness Tool Version 3.7.2 Release. `nTool to check if your device is capable to run Device Guard and Credential Guard."
|
||||
LogAndConsole ""
|
||||
LogAndConsole "###########################################################################"
|
||||
LogAndConsole ""
|
||||
@ -1030,7 +1032,7 @@ if(!($Ready) -and !($Capable) -and !($Enable) -and !($Disable) -and !($Clear) -a
|
||||
}
|
||||
|
||||
$user = [Security.Principal.WindowsIdentity]::GetCurrent();
|
||||
$TestForAdmin = (New-Object Security.Principal.WindowsPrincipal $user).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
|
||||
$TestForAdmin = (New-Object Security.Principal.WindowsPrincipal $user).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
|
||||
|
||||
if(!$TestForAdmin)
|
||||
{
|
||||
@ -1065,7 +1067,7 @@ if($Ready)
|
||||
{
|
||||
Log "_CGState: $_CGState"
|
||||
PrintCGDetails $_CGState
|
||||
|
||||
|
||||
if($_CGState)
|
||||
{
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Running" /t REG_DWORD /d 1 /f'
|
||||
@ -1077,28 +1079,28 @@ if($Ready)
|
||||
}
|
||||
elseif($DG)
|
||||
{
|
||||
Log "_HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState"
|
||||
Log "_HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState"
|
||||
|
||||
PrintHVCIDetails $_HVCIState
|
||||
PrintConfigCIDetails $_ConfigCIState
|
||||
PrintConfigCIDetails $_ConfigCIState
|
||||
|
||||
if($_ConfigCIState -and $_HVCIState)
|
||||
{
|
||||
LogAndConsoleSuccess "HVCI, and Config-CI are enabled and running."
|
||||
|
||||
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Running" /t REG_DWORD /d 1 /f'
|
||||
}
|
||||
else
|
||||
{
|
||||
LogAndConsoleWarning "Not all services are running."
|
||||
|
||||
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Running" /t REG_DWORD /d 0 /f'
|
||||
}
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
Log "_CGState: $_CGState, _HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState"
|
||||
|
||||
Log "_CGState: $_CGState, _HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState"
|
||||
|
||||
PrintCGDetails $_CGState
|
||||
PrintHVCIDetails $_HVCIState
|
||||
PrintConfigCIDetails $_ConfigCIState
|
||||
@ -1147,7 +1149,7 @@ if($Enable)
|
||||
{
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f'
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f'
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f'
|
||||
@ -1158,8 +1160,8 @@ if($Enable)
|
||||
{
|
||||
if(!$HVCI -and !$CG)
|
||||
{
|
||||
if(!$SIPolicyPath)
|
||||
{
|
||||
if(!$SIPolicyPath)
|
||||
{
|
||||
Log "Writing Decoded SIPolicy.p7b"
|
||||
$SIPolicy_Decoded = [System.Convert]::FromBase64String($SIPolicy_Encoded)
|
||||
[System.IO.File]::WriteAllBytes("$env:windir\System32\CodeIntegrity\SIPolicy.p7b",$SIPolicy_Decoded)
|
||||
@ -1182,7 +1184,7 @@ if($Enable)
|
||||
if(!$_isRedstone)
|
||||
{
|
||||
LogAndConsole "OS Not Redstone, enabling IsolatedUserMode separately"
|
||||
#Enable/Disable IOMMU seperately
|
||||
#Enable/Disable IOMMU separately
|
||||
ExecuteCommandAndLog 'DISM.EXE /Online /Enable-Feature:IsolatedUserMode /NoRestart'
|
||||
}
|
||||
$CmdOutput = DISM.EXE /Online /Enable-Feature:Microsoft-Hyper-V-Hypervisor /All /NoRestart | Out-String
|
||||
@ -1251,7 +1253,7 @@ if($Disable)
|
||||
if(!$_isRedstone)
|
||||
{
|
||||
LogAndConsole "OS Not Redstone, disabling IsolatedUserMode separately"
|
||||
#Enable/Disable IOMMU seperately
|
||||
#Enable/Disable IOMMU separately
|
||||
ExecuteCommandAndLog 'DISM.EXE /Online /disable-Feature /FeatureName:IsolatedUserMode /NoRestart'
|
||||
}
|
||||
$CmdOutput = DISM.EXE /Online /disable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /NoRestart | Out-String
|
||||
@ -1270,7 +1272,7 @@ if($Disable)
|
||||
}
|
||||
|
||||
#set of commands to run SecConfig.efi to delete UEFI variables if were set in pre OS
|
||||
#these steps can be performed even if the UEFI variables were not set - if not set it will lead to No-Op but this can be run in general always
|
||||
#these steps can be performed even if the UEFI variables were not set - if not set it will lead to No-Op but this can be run in general always
|
||||
#this requires a reboot and accepting the prompt in the Pre-OS which is self explanatory in the message that is displayed in pre-OS
|
||||
$FreeDrive = ls function:[s-z]: -n | ?{ !(test-path $_) } | random
|
||||
Log "FreeDrive=$FreeDrive"
|
||||
@ -1314,7 +1316,7 @@ if($Capable)
|
||||
}
|
||||
$_StepCount = 1
|
||||
if(!$CG)
|
||||
{
|
||||
{
|
||||
LogAndConsole " ====================== Step $_StepCount Driver Compat ====================== "
|
||||
$_StepCount++
|
||||
CheckDriverCompat
|
||||
@ -1323,15 +1325,15 @@ if($Capable)
|
||||
LogAndConsole " ====================== Step $_StepCount Secure boot present ====================== "
|
||||
$_StepCount++
|
||||
CheckSecureBootState
|
||||
|
||||
|
||||
if(!$HVCI -and !$DG -and !$CG)
|
||||
{
|
||||
{
|
||||
#check only if sub-options are absent
|
||||
LogAndConsole " ====================== Step $_StepCount MS UEFI HSTI tests ====================== "
|
||||
$_StepCount++
|
||||
CheckHSTI
|
||||
}
|
||||
|
||||
|
||||
LogAndConsole " ====================== Step $_StepCount OS Architecture ====================== "
|
||||
$_StepCount++
|
||||
CheckOSArchitecture
|
||||
@ -1345,11 +1347,11 @@ if($Capable)
|
||||
CheckVirtualization
|
||||
|
||||
if(!$HVCI -and !$DG)
|
||||
{
|
||||
{
|
||||
LogAndConsole " ====================== Step $_StepCount TPM version ====================== "
|
||||
$_StepCount++
|
||||
CheckTPM
|
||||
|
||||
|
||||
LogAndConsole " ====================== Step $_StepCount Secure MOR ====================== "
|
||||
$_StepCount++
|
||||
CheckSecureMOR
|
||||
@ -1358,11 +1360,11 @@ if($Capable)
|
||||
LogAndConsole " ====================== Step $_StepCount NX Protector ====================== "
|
||||
$_StepCount++
|
||||
CheckNXProtection
|
||||
|
||||
|
||||
LogAndConsole " ====================== Step $_StepCount SMM Mitigation ====================== "
|
||||
$_StepCount++
|
||||
CheckSMMProtection
|
||||
|
||||
|
||||
LogAndConsole " ====================== End Check ====================== "
|
||||
|
||||
LogAndConsole " ====================== Summary ====================== "
|
||||
@ -1371,7 +1373,6 @@ if($Capable)
|
||||
}
|
||||
|
||||
|
||||
|
||||
# SIG # Begin signature block
|
||||
## REPLACE
|
||||
# SIG # End signature block
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user