---

#requires -version 2.0

<#
.SYNOPSIS
    Проверка отключения LLMNR и NetBIOS.

.DESCRIPTION
    Скрипт проверяет:
      - LLMNR
      - NetBIOS over TCP/IP
      - TCP/139
      - UDP/137-138

    Результат добавляется в один общий файл на сетевой шаре.

    ВАЖНО:
    Измените переменную $ResultFile на нужный сетевой путь.
#>


# ============================================================
# CONFIGURATION
# ============================================================

# УКАЖИТЕ ПУТЬ К ОБЩЕМУ ФАЙЛУ
$ResultFile = "\\SERVER\Audit$\Security-Audit.txt"


# ============================================================
# INITIALIZATION
# ============================================================

$ErrorActionPreference = "SilentlyContinue"

$ComputerName = $env:COMPUTERNAME

$Results = New-Object System.Collections.ArrayList

$FailCount = 0
$WarnCount = 0
$PassCount = 0


# ============================================================
# FUNCTIONS
# ============================================================

function Add-Result {

    param(
        [string]$Status,
        [string]$Name,
        [string]$Details
    )

    $Line = "[{0}] {1}: {2}" -f $Status, $Name, $Details

    [void]$Results.Add($Line)

    switch ($Status) {

        "PASS" {
            $script:PassCount++
        }

        "FAIL" {
            $script:FailCount++
        }

        "WARN" {
            $script:WarnCount++
        }
    }
}


function Add-Section {

    param(
        [string]$Title
    )

    $Separator = ""
    $Separator = $Separator.PadLeft(60, "-")

    [void]$Results.Add("")
    [void]$Results.Add($Separator)
    [void]$Results.Add($Title)
    [void]$Results.Add($Separator)
}


function Get-RegistryValueSafe {

    param(
        [string]$Path,
        [string]$Name
    )

    try {

        $Property = Get-ItemProperty `
            -Path $Path `
            -Name $Name `
            -ErrorAction Stop

        return $Property.$Name

    }
    catch {

        return $null
    }
}


# ============================================================
# SYSTEM INFORMATION
# ============================================================

$OS = Get-WmiObject Win32_OperatingSystem

$ComputerSystem = Get-WmiObject Win32_ComputerSystem

$DateTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

$OSCaption = $OS.Caption
$OSVersion = $OS.Version
$OSBuild = $OS.BuildNumber

$Domain = $ComputerSystem.Domain

$CurrentUser = $env:USERDOMAIN + "\" + $env:USERNAME


[void]$Results.Add("============================================================")
[void]$Results.Add("DOMAIN SECURITY AUDIT")
[void]$Results.Add("============================================================")
[void]$Results.Add("")

[void]$Results.Add("Computer : $ComputerName")
[void]$Results.Add("Domain   : $Domain")
[void]$Results.Add("OS       : $OSCaption")
[void]$Results.Add("Version  : $OSVersion")
[void]$Results.Add("Build    : $OSBuild")
[void]$Results.Add("User     : $CurrentUser")
[void]$Results.Add("Date     : $DateTime")


# ============================================================
# 1. LLMNR
# ============================================================

Add-Section "1. LLMNR"

$LLMNRPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient"

$EnableMulticast = Get-RegistryValueSafe `
    -Path $LLMNRPath `
    -Name "EnableMulticast"


if ($null -eq $EnableMulticast) {

    Add-Result `
        -Status "FAIL" `
        -Name "LLMNR policy" `
        -Details "EnableMulticast отсутствует. LLMNR не считается отключенным."

}
elseif ([int]$EnableMulticast -eq 0) {

    Add-Result `
        -Status "PASS" `
        -Name "LLMNR policy" `
        -Details "EnableMulticast = 0. LLMNR отключен."

}
else {

    Add-Result `
        -Status "FAIL" `
        -Name "LLMNR policy" `
        -Details "EnableMulticast = $EnableMulticast. LLMNR включен."

}


# ============================================================
# 2. NETBIOS OVER TCP/IP
# ============================================================

Add-Section "2. NETBIOS over TCP/IP"

$Adapters = Get-WmiObject Win32_NetworkAdapterConfiguration `
    -Filter "IPEnabled=True"


if ($null -eq $Adapters) {

    Add-Result `
        -Status "WARN" `
        -Name "NetBIOS adapters" `
        -Details "IP-enabled сетевые адаптеры не найдены."

}
else {

    $NetBIOSFailure = $false

    foreach ($Adapter in $Adapters) {

        $Description = $Adapter.Description
        $Index = $Adapter.Index
        $TcpipNetbiosOptions = $Adapter.TcpipNetbiosOptions

        # TcpipNetbiosOptions:
        #
        # 0 = NetBIOS configuration from DHCP
        # 1 = NetBIOS enabled
        # 2 = NetBIOS disabled

        if ($TcpipNetbiosOptions -eq 2) {

            Add-Result `
                -Status "PASS" `
                -Name "NetBIOS adapter $Index" `
                -Details "$Description -> TcpipNetbiosOptions = 2. NetBIOS disabled."

        }
        elseif ($TcpipNetbiosOptions -eq 1) {

            Add-Result `
                -Status "FAIL" `
                -Name "NetBIOS adapter $Index" `
                -Details "$Description -> TcpipNetbiosOptions = 1. NetBIOS ENABLED."

            $NetBIOSFailure = $true

        }
        elseif ($TcpipNetbiosOptions -eq 0) {

            Add-Result `
                -Status "FAIL" `
                -Name "NetBIOS adapter $Index" `
                -Details "$Description -> TcpipNetbiosOptions = 0. NetBIOS controlled by DHCP."

            $NetBIOSFailure = $true

        }
        else {

            Add-Result `
                -Status "WARN" `
                -Name "NetBIOS adapter $Index" `
                -Details "$Description -> неизвестное значение: $TcpipNetbiosOptions."

            $NetBIOSFailure = $true
        }
    }


    if ($NetBIOSFailure) {

        Add-Result `
            -Status "FAIL" `
            -Name "NetBIOS overall" `
            -Details "Как минимум один IP-enabled адаптер не имеет принудительно отключенного NetBIOS."

    }
    else {

        Add-Result `
            -Status "PASS" `
            -Name "NetBIOS overall" `
            -Details "На всех IP-enabled адаптерах NetBIOS over TCP/IP отключен."

    }
}


# ============================================================
# 3. TCP/139
# ============================================================

Add-Section "3. TCP/139"

$TCP139 = netstat -ano -p tcp 2>$null |
    Select-String "LISTENING" |
    Select-String ":139"


if ($TCP139) {

    [void]$Results.Add("TCP/139 listeners:")
    [void]$Results.Add(($TCP139 | Out-String).Trim())

    Add-Result `
        -Status "FAIL" `
        -Name "TCP/139" `
        -Details "Обнаружен LISTENING TCP/139."

}
else {

    Add-Result `
        -Status "PASS" `
        -Name "TCP/139" `
        -Details "LISTENING TCP/139 не обнаружен."

}


# ============================================================
# 4. UDP/137-138
# ============================================================

Add-Section "4. UDP/137-138"

$UDPNetBIOS = netstat -ano -p udp 2>$null |
    Select-String ":(137|138)\s"


if ($UDPNetBIOS) {

    [void]$Results.Add("UDP NetBIOS listeners:")
    [void]$Results.Add(($UDPNetBIOS | Out-String).Trim())

    Add-Result `
        -Status "FAIL" `
        -Name "UDP/137-138" `
        -Details "Обнаружен UDP listener на NetBIOS портах."

}
else {

    Add-Result `
        -Status "PASS" `
        -Name "UDP/137-138" `
        -Details "UDP/137-138 listeners не обнаружены."

}


# ============================================================
# FINAL RESULT
# ============================================================

Add-Section "FINAL RESULT"

[void]$Results.Add("PASS : $PassCount")
[void]$Results.Add("WARN : $WarnCount")
[void]$Results.Add("FAIL : $FailCount")
[void]$Results.Add("")


if ($FailCount -eq 0 -and $WarnCount -eq 0) {

    [void]$Results.Add("RESULT: PASS")
    [void]$Results.Add(
        "LLMNR и NetBIOS выглядят полностью отключенными."
    )

}
elseif ($FailCount -eq 0) {

    [void]$Results.Add("RESULT: PASS WITH WARNINGS")
    [void]$Results.Add(
        "Критических нарушений не обнаружено, но присутствуют предупреждения."
    )

}
else {

    [void]$Results.Add("RESULT: FAIL")
    [void]$Results.Add(
        "Обнаружены настройки, требующие исправления."
    )

}


# ============================================================
# WRITE TO NETWORK FILE
# ============================================================

$Header = ""
$Header = $Header.PadLeft(70, "=")

$Output = New-Object System.Collections.ArrayList

[void]$Output.Add("")
[void]$Output.Add($Header)
[void]$Output.Add("COMPUTER: $ComputerName")
[void]$Output.Add("DATE: $DateTime")
[void]$Output.Add($Header)

foreach ($Line in $Results) {
    [void]$Output.Add($Line)
}

[void]$Output.Add($Header)
[void]$Output.Add("END OF AUDIT: $ComputerName")
[void]$Output.Add($Header)
[void]$Output.Add("")


try {

    Add-Content `
        -Path $ResultFile `
        -Value $Output `
        -Encoding UTF8

}
catch {

    # Если сеть/шара недоступны — записываем локальный лог.
    $LocalLogDirectory = "C:\ProgramData\DomainSecurityAudit"

    if (-not (Test-Path $LocalLogDirectory)) {

        New-Item `
            -Path $LocalLogDirectory `
            -ItemType Directory `
            -Force | Out-Null
    }

    $LocalResult = Join-Path `
        $LocalLogDirectory `
        ($ComputerName + ".txt")

    $Output | Out-File `
        -FilePath $LocalResult `
        -Encoding UTF8 `
        -Force
}


# ============================================================
# CONSOLE OUTPUT
# ============================================================

Write-Host ""
Write-Host "============================================================"
Write-Host "DOMAIN SECURITY AUDIT"
Write-Host "============================================================"
Write-Host ""

foreach ($Line in $Results) {
    Write-Host $Line
}

Write-Host ""
Write-Host "============================================================"
Write-Host "Result file:"
Write-Host $ResultFile
Write-Host "============================================================"