---

```powershell
#requires -version 2.0

<#
.SYNOPSIS
    Проверка отключения LLMNR и NetBIOS.

.DESCRIPTION
    Скрипт проверяет:
      - LLMNR
      - NetBIOS over TCP/IP
      - TCP/139
      - UDP/137-138

    Формат summary:
        COMPUTER01 - PASS
        COMPUTER02 - PASS WITH WARNINGS
        COMPUTER03 - FAIL
#>

# ============================================================
# CONFIGURATION
# ============================================================

# Общая директория для результатов
$ResultDirectory = "\\10.68.16.120\report\netbios_llmnr_check"

# Общий файл со сводкой
$SummaryFile = Join-Path $ResultDirectory "summary.txt"

# Имя компьютера
$ComputerName = $env:COMPUTERNAME

$MarkerFile = Join-Path $ResultDirectory ($env:COMPUTERNAME + ".txt")

# ============================================================
# MARKER CHECK
# ============================================================

# Если подробный файл уже существует,
# значит компьютер ранее был проверен.
#
# Повторно проверку не выполняем.
$ExistingMarker = Get-ChildItem `
    -Path $ResultDirectory `
    -Filter ($ComputerName + "_*.txt") `
    -ErrorAction SilentlyContinue |
    Select-Object -First 1

if ($null -ne $ExistingMarker) {

    Write-Host ""
    Write-Host "============================================================"
    Write-Host "NETBIOS + LLMNR POLICY AUDIT"
    Write-Host "============================================================"
    Write-Host ""
    Write-Host "Computer: $ComputerName"
    Write-Host ""
    Write-Host "Audit already completed."
    Write-Host "Marker file:"
    Write-Host $ExistingMarker.Fullname
    Write-Host ""
    Write-Host "No action required."
    Write-Host "============================================================"

    exit 0
}


# ============================================================
# INITIALIZATION
# ============================================================

$Results = New-Object System.Collections.ArrayList

$FailCount = 0
$WarnCount = 0
$PassCount = 0

# ============================================================
# FUNCTIONS
# ============================================================

function Add-Result {
    param(
        [string]$Status,
        [string]$Name,
        [string]$Details
    )

    $Line = "[{0}] {1}: {2}" -f $Status, $Name, $Details

    [void]$Results.Add($Line)

    switch ($Status) {
        "PASS" { $script:PassCount++ }
        "FAIL" { $script:FailCount++ }
        "WARN" { $script:WarnCount++ }
    }
}

function Add-Section {
    param(
        [string]$Title
    )

    $Separator = ""
    $Separator = $Separator.PadLeft(60, "-")

    [void]$Results.Add("")
    [void]$Results.Add($Separator)
    [void]$Results.Add($Title)
    [void]$Results.Add($Separator)
}

function Get-RegistryValueSafe {
    param(
        [string]$Path,
        [string]$Name
    )

    try {
        $Property = Get-ItemProperty `
            -Path $Path `
            -Name $Name `
            -ErrorAction Stop

        return $Property.$Name
    }
    catch {
        return $null
    }
}

# ============================================================
# SYSTEM INFORMATION
# ============================================================

$OS = Get-WmiObject Win32_OperatingSystem
$ComputerSystem = Get-WmiObject Win32_ComputerSystem
$DateTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

$OSCaption = $OS.Caption
$OSVersion = $OS.Version
$OSBuild = $OS.BuildNumber
$Domain = $ComputerSystem.Domain
$CurrentUser = $env:USERDOMAIN + "\" + $env:USERNAME

[void]$Results.Add("============================================================")
[void]$Results.Add("DOMAIN SECURITY AUDIT")
[void]$Results.Add("============================================================")
[void]$Results.Add("")
[void]$Results.Add("Computer : $ComputerName")
[void]$Results.Add("Domain   : $Domain")
[void]$Results.Add("OS       : $OSCaption")
[void]$Results.Add("Version  : $OSVersion")
[void]$Results.Add("Build    : $OSBuild")
[void]$Results.Add("User     : $CurrentUser")
[void]$Results.Add("Date     : $DateTime")

# ============================================================
# 1. LLMNR
# ============================================================

Add-Section "1. LLMNR"
# просто проверка реестра
$LLMNRPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient"

$EnableMulticast = Get-RegistryValueSafe `
    -Path $LLMNRPath `
    -Name "EnableMulticast"

if ($null -eq $EnableMulticast) {
    Add-Result `
        -Status "FAIL" `
        -Name "LLMNR policy" `
        -Details "EnableMulticast отсутствует. LLMNR не считается отключенным."
}
elseif ([int]$EnableMulticast -eq 0) {
    Add-Result `
        -Status "PASS" `
        -Name "LLMNR policy" `
        -Details "EnableMulticast = 0. LLMNR отключен."
}
else {
    Add-Result `
        -Status "FAIL" `
        -Name "LLMNR policy" `
        -Details "EnableMulticast = $EnableMulticast. LLMNR включен."
}

# ============================================================
# 2. NETBIOS OVER TCP/IP
# ============================================================

Add-Section "2. NETBIOS over TCP/IP"
# получение списка всех сетевых адаптеров. 
$Adapters = Get-WmiObject Win32_NetworkAdapterConfiguration `
    -Filter "IPEnabled=True"

if ($null -eq $Adapters) {
    Add-Result `
        -Status "WARN" `
        -Name "NetBIOS adapters" `
        -Details "IP-enabled сетевые адаптеры не найдены."
}
else {
    $NetBIOSFailure = $false

    foreach ($Adapter in $Adapters) {

        $Description = $Adapter.Description
        $Index = $Adapter.Index
        $TcpipNetbiosOptions = $Adapter.TcpipNetbiosOptions

        # TcpipNetbiosOptions:
        #
        # 0 = NetBIOS configuration from DHCP
        # 1 = NetBIOS enabled
        # 2 = NetBIOS disabled

        if ($TcpipNetbiosOptions -eq 2) {

            Add-Result `
                -Status "PASS" `
                -Name "NetBIOS adapter $Index" `
                -Details "$Description -> TcpipNetbiosOptions = 2. NetBIOS disabled."
        }
        elseif ($TcpipNetbiosOptions -eq 1) {

            Add-Result `
                -Status "FAIL" `
                -Name "NetBIOS adapter $Index" `
                -Details "$Description -> TcpipNetbiosOptions = 1. NetBIOS ENABLED."

            $NetBIOSFailure = $true
        }
        elseif ($TcpipNetbiosOptions -eq 0) {

            Add-Result `
                -Status "FAIL" `
                -Name "NetBIOS adapter $Index" `
                -Details "$Description -> TcpipNetbiosOptions = 0. NetBIOS controlled by DHCP."

            $NetBIOSFailure = $true
        }
        else {

            Add-Result `
                -Status "WARN" `
                -Name "NetBIOS adapter $Index" `
                -Details "$Description -> неизвестное значение: $TcpipNetbiosOptions."

            $NetBIOSFailure = $true
        }
    }

    if ($NetBIOSFailure) {

        Add-Result `
            -Status "FAIL" `
            -Name "NetBIOS overall" `
            -Details "Как минимум один IP-enabled адаптер не имеет принудительно отключенного NetBIOS."
    }
    else {

        Add-Result `
            -Status "PASS" `
            -Name "NetBIOS overall" `
            -Details "На всех IP-enabled адаптерах NetBIOS over TCP/IP отключен."
    }
}

# NetBIOS использует порты 137, 138 и 139 => их логично проверять также
# ============================================================
# 3. TCP/139
# ============================================================

Add-Section "3. TCP/139"

$TCP139 = netstat -ano -p tcp 2>$null |
    Select-String "LISTENING" |
    Select-String ":139"

if ($TCP139) {

    [void]$Results.Add("TCP/139 listeners:")
    [void]$Results.Add(($TCP139 | Out-String).Trim())

    Add-Result `
        -Status "FAIL" `
        -Name "TCP/139" `
        -Details "Обнаружен LISTENING TCP/139."
}
else {

    Add-Result `
        -Status "PASS" `
        -Name "TCP/139" `
        -Details "LISTENING TCP/139 не обнаружен."
}

# ============================================================
# 4. UDP/137-138 
# ============================================================

Add-Section "4. UDP/137-138"

$UDPNetBIOS = netstat -ano -p udp 2>$null |
    Select-String ":(137|138)\s"

if ($UDPNetBIOS) {

    [void]$Results.Add("UDP NetBIOS listeners:")
    [void]$Results.Add(($UDPNetBIOS | Out-String).Trim())

    Add-Result `
        -Status "FAIL" `
        -Name "UDP/137-138" `
        -Details "Обнаружен UDP listener на NetBIOS портах."
}
else {

    Add-Result `
        -Status "PASS" `
        -Name "UDP/137-138" `
        -Details "UDP/137-138 listeners не обнаружены."
}

# ============================================================
# FINAL RESULT
# ============================================================

Add-Section "FINAL RESULT"

[void]$Results.Add("PASS : $PassCount")
[void]$Results.Add("WARN : $WarnCount")
[void]$Results.Add("FAIL : $FailCount")
[void]$Results.Add("")

# Определяем общий статус компьютера
if ($FailCount -eq 0 -and $WarnCount -eq 0) {

    $OverallStatus = "PASS"

    [void]$Results.Add("RESULT: PASS")
    [void]$Results.Add(
        "LLMNR и NetBIOS выглядят полностью отключенными."
    )
}
elseif ($FailCount -eq 0) {

    $OverallStatus = "PASS WITH WARNINGS"

    [void]$Results.Add("RESULT: PASS WITH WARNINGS")
    [void]$Results.Add(
        "Критических нарушений не обнаружено, но присутствуют предупреждения."
    )
}
else {

    $OverallStatus = "FAIL"

    [void]$Results.Add("RESULT: FAIL")
    [void]$Results.Add(
        "Обнаружены настройки, требующие исправления."
    )
}

# ============================================================
# PREPARE DETAILED RESULT
# ============================================================

$Header = ""
$Header = $Header.PadLeft(70, "=")

$Output = New-Object System.Collections.ArrayList

[void]$Output.Add("")
[void]$Output.Add($Header)
[void]$Output.Add("COMPUTER: $ComputerName")
[void]$Output.Add("DATE: $DateTime")
[void]$Output.Add($Header)

foreach ($Line in $Results) {
    [void]$Output.Add($Line)
}

[void]$Output.Add($Header)
[void]$Output.Add("END OF AUDIT: $ComputerName")
[void]$Output.Add($Header)
[void]$Output.Add("")

# ============================================================
# PREPARE COMPUTER RESULT FILE
# ============================================================

$ComputerResultFile = Join-Path `
    $ResultDirectory `
    ($ComputerName + ".txt")

# ============================================================
# WRITE DETAILED COMPUTER FILE / MARKER FILE
# ============================================================

$ResultSavedToNetwork = $false

try {

    # Сначала создаём обычный файл:
    #
    # PC-001.txt

    $Output | Out-File `
        -FilePath $ComputerResultFile `
        -Encoding UTF8 `
        -Force

    $ResultSavedToNetwork = $true

}
catch {

    # Если сеть недоступна — сохраняем локально
    $LocalLogDirectory = "C:\netbios_llmnr_check"

    if (-not (Test-Path $LocalLogDirectory)) {

        New-Item `
            -Path $LocalLogDirectory `
            -ItemType Directory `
            -Force | Out-Null
    }

    $LocalResult = Join-Path `
        $LocalLogDirectory `
        ($ComputerName + ".txt")

    $Output | Out-File `
        -FilePath $LocalResult `
        -Encoding UTF8 `
        -Force
}

# ============================================================
# RENAME NETWORK RESULT TO STATUS FILE
# ============================================================

if ($ResultSavedToNetwork) {

    # Заменяем пробелы на "_",
    # чтобы имя файла было удобным.

    $StatusForFileName = $OverallStatus.Replace(" ", "_")

    # Например:
    #
    # PC-001.txt
    #
    # превращается в:
    #
    # PC-001_PASS.txt
    # PC-001_FAIL.txt
    # PC-001_PASS_WITH_WARNINGS.txt

    $FinalResultFile = Join-Path `
        $ResultDirectory `
        ($ComputerName + "_" + $StatusForFileName + ".txt")

    try {

        Rename-Item `
            -Path $ComputerResultFile `
            -NewName (
                $ComputerName + "_" +
                $StatusForFileName + ".txt"
            ) `
            -Force

        # После переименования именно этот файл
        # является маркером выполнения.

        $MarkerFile = $FinalResultFile

    }
    catch {

        # Если переименование не удалось,
        # оставляем исходный файл PC-001.txt.
        #
        # В этом случае он НЕ считается маркером
        # при следующем запуске.

        $MarkerFile = $null
    }
}

# ============================================================
# WRITE SUMMARY
# ============================================================

try {

    # В общий файл пишем только:
    # COMPUTER - STATUS

    $SummaryLine = "{0} - {1}" -f `
        $ComputerName, `
        $OverallStatus

    Add-Content `
        -Path $SummaryFile `
        -Value $SummaryLine `
        -Encoding UTF8
}
catch {

    # Ничего критичного.
    # Подробный файл уже сохранен локально/на сети.
}

# ============================================================
# CONSOLE OUTPUT
# ============================================================

Write-Host ""
Write-Host "============================================================"
Write-Host "DOMAIN SECURITY AUDIT"
Write-Host "============================================================"
Write-Host ""

foreach ($Line in $Results) {
    Write-Host $Line
}

Write-Host ""
Write-Host "============================================================"
Write-Host "Computer result:"
Write-Host $ComputerResultFile
Write-Host ""
Write-Host "Overall status:"
Write-Host $OverallStatus
Write-Host "============================================================"
```