---

#requires -version 2.0

<#
.SYNOPSIS
    Проверка отключения сохранения паролей в браузерах.

.DESCRIPTION
    Проверяет политики PasswordManagerEnabled для:

      - Google Chrome
      - Microsoft Edge
      - Yandex Browser

    Проверяются 64-bit и 32-bit ветки реестра.

    Для каждого компьютера создается отдельный файл:

        \\SERVER\Audit$\COMPUTERNAME.txt

    Этот файл одновременно является маркером того,
    что компьютер уже прошел проверку.

    В общий файл:

        \\SERVER\Audit$\Security-Audit-Summary.txt

    записывается только:

        COMPUTER01 - PASS
        COMPUTER02 - FAIL
        COMPUTER03 - PASS WITH WARNINGS

    ВАЖНО:
    Измените $ResultDirectory на нужный сетевой путь.
#>


# ============================================================
# CONFIGURATION
# ============================================================

# Общая директория для результатов
$ResultDirectory = "\\SERVER\Audit$"

# Общий файл со сводкой
$SummaryFile = Join-Path `
    $ResultDirectory `
    "Security-Audit-Summary.txt"

# Имя компьютера
$ComputerName = $env:COMPUTERNAME

# Файл-маркер и подробный отчет
$MarkerFile = Join-Path `
    $ResultDirectory `
    ($ComputerName + ".txt")


# ============================================================
# INITIALIZATION
# ============================================================

$ErrorActionPreference = "SilentlyContinue"

# ============================================================
# MARKER CHECK
# ============================================================

# Если подробный файл уже существует,
# значит компьютер ранее был проверен.
#
# Повторно проверку не выполняем.

if (Test-Path $MarkerFile) {

    Write-Host ""
    Write-Host "============================================================"
    Write-Host "BROWSER PASSWORD POLICY AUDIT"
    Write-Host "============================================================"
    Write-Host ""
    Write-Host "Computer: $ComputerName"
    Write-Host ""
    Write-Host "Audit already completed."
    Write-Host "Marker file:"
    Write-Host $MarkerFile
    Write-Host ""
    Write-Host "No action required."
    Write-Host "============================================================"

    exit 0
}


# ============================================================
# VARIABLES
# ============================================================

$Results = New-Object System.Collections.ArrayList

$FailCount = 0
$WarnCount = 0
$PassCount = 0


# ============================================================
# FUNCTIONS
# ============================================================

function Add-Result {
    param(
        [string]$Status,
        [string]$Name,
        [string]$Details
    )

    $Line = "[{0}] {1}: {2}" -f `
        $Status, `
        $Name, `
        $Details

    [void]$Results.Add($Line)

    switch ($Status) {

        "PASS" {
            $script:PassCount++
        }

        "FAIL" {
            $script:FailCount++
        }

        "WARN" {
            $script:WarnCount++
        }
    }
}


function Add-Section {
    param(
        [string]$Title
    )

    $Separator = ""
    $Separator = $Separator.PadLeft(60, "-")

    [void]$Results.Add("")
    [void]$Results.Add($Separator)
    [void]$Results.Add($Title)
    [void]$Results.Add($Separator)
}


function Get-RegistryValueSafe {
    param(
        [string]$Path,
        [string]$Name
    )

    try {

        $Property = Get-ItemProperty `
            -Path $Path `
            -Name $Name `
            -ErrorAction Stop

        return $Property.$Name

    }
    catch {

        return $null
    }
}


function Test-PasswordManagerPolicy {
    param(
        [string]$Browser,
        [string]$Path,
        [string]$Architecture
    )

    $Value = Get-RegistryValueSafe `
        -Path $Path `
        -Name "PasswordManagerEnabled"

    if ($null -eq $Value) {

        Add-Result `
            -Status "FAIL" `
            -Name "$Browser $Architecture" `
            -Details "PasswordManagerEnabled отсутствует. Политика отключения сохранения паролей не задана."

    }
    elseif ([int]$Value -eq 0) {

        Add-Result `
            -Status "PASS" `
            -Name "$Browser $Architecture" `
            -Details "PasswordManagerEnabled = 0. Сохранение паролей отключено."

    }
    else {

        Add-Result `
            -Status "FAIL" `
            -Name "$Browser $Architecture" `
            -Details "PasswordManagerEnabled = $Value. Сохранение паролей НЕ отключено."
    }
}


# ============================================================
# SYSTEM INFORMATION
# ============================================================

$OS = Get-WmiObject Win32_OperatingSystem
$ComputerSystem = Get-WmiObject Win32_ComputerSystem

$DateTime = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

$OSCaption = $OS.Caption
$OSVersion = $OS.Version
$OSBuild = $OS.BuildNumber

$Domain = $ComputerSystem.Domain

$CurrentUser = `
    $env:USERDOMAIN + "\" + $env:USERNAME


# Определяем разрядность ОС
$OSArchitecture = $OS.OSArchitecture

if ([string]::IsNullOrEmpty($OSArchitecture)) {

    if ([IntPtr]::Size -eq 8) {
        $OSArchitecture = "64-bit"
    }
    else {
        $OSArchitecture = "32-bit"
    }
}


# ============================================================
# REPORT HEADER
# ============================================================

[void]$Results.Add(
    "============================================================"
)

[void]$Results.Add(
    "BROWSER PASSWORD POLICY AUDIT"
)

[void]$Results.Add(
    "============================================================"
)

[void]$Results.Add("")

[void]$Results.Add("Computer     : $ComputerName")
[void]$Results.Add("Domain       : $Domain")
[void]$Results.Add("OS           : $OSCaption")
[void]$Results.Add("Version      : $OSVersion")
[void]$Results.Add("Build        : $OSBuild")
[void]$Results.Add("Architecture : $OSArchitecture")
[void]$Results.Add("User         : $CurrentUser")
[void]$Results.Add("Date         : $DateTime")


# ============================================================
# 1. GOOGLE CHROME
# ============================================================

Add-Section "1. GOOGLE CHROME"

# 64-bit
$Chrome64 = `
    "HKLM:\SOFTWARE\Policies\Google\Chrome"

# 32-bit
$Chrome32 = `
    "HKLM:\SOFTWARE\WOW6432Node\Policies\Google\Chrome"


if ($OSArchitecture -eq "32-bit") {

    # На 32-bit ОС отдельная WOW6432Node ветка
    # не используется.

    Test-PasswordManagerPolicy `
        -Browser "Google Chrome" `
        -Path $Chrome64 `
        -Architecture "32-bit/OS"

}
else {

    Test-PasswordManagerPolicy `
        -Browser "Google Chrome" `
        -Path $Chrome64 `
        -Architecture "64-bit"

    Test-PasswordManagerPolicy `
        -Browser "Google Chrome" `
        -Path $Chrome32 `
        -Architecture "32-bit"
}


# ============================================================
# 2. MICROSOFT EDGE
# ============================================================

Add-Section "2. MICROSOFT EDGE"

# 64-bit
$Edge64 = `
    "HKLM:\SOFTWARE\Policies\Microsoft\Edge"

# 32-bit
$Edge32 = `
    "HKLM:\SOFTWARE\WOW6432Node\Policies\Microsoft\Edge"


if ($OSArchitecture -eq "32-bit") {

    Test-PasswordManagerPolicy `
        -Browser "Microsoft Edge" `
        -Path $Edge64 `
        -Architecture "32-bit/OS"

}
else {

    Test-PasswordManagerPolicy `
        -Browser "Microsoft Edge" `
        -Path $Edge64 `
        -Architecture "64-bit"

    Test-PasswordManagerPolicy `
        -Browser "Microsoft Edge" `
        -Path $Edge32 `
        -Architecture "32-bit"
}


# ============================================================
# 3. YANDEX BROWSER
# ============================================================

Add-Section "3. YANDEX BROWSER"

# 64-bit
$Yandex64 = `
    "HKLM:\SOFTWARE\Policies\Yandex\Browser"

# 32-bit
$Yandex32 = `
    "HKLM:\SOFTWARE\WOW6432Node\Policies\Yandex\Browser"


if ($OSArchitecture -eq "32-bit") {

    Test-PasswordManagerPolicy `
        -Browser "Yandex Browser" `
        -Path $Yandex64 `
        -Architecture "32-bit/OS"

}
else {

    Test-PasswordManagerPolicy `
        -Browser "Yandex Browser" `
        -Path $Yandex64 `
        -Architecture "64-bit"

    Test-PasswordManagerPolicy `
        -Browser "Yandex Browser" `
        -Path $Yandex32 `
        -Architecture "32-bit"
}


# ============================================================
# FINAL RESULT
# ============================================================

Add-Section "FINAL RESULT"

[void]$Results.Add("PASS : $PassCount")
[void]$Results.Add("WARN : $WarnCount")
[void]$Results.Add("FAIL : $FailCount")
[void]$Results.Add("")


# Определяем общий статус компьютера

if ($FailCount -eq 0 -and $WarnCount -eq 0) {

    $OverallStatus = "PASS"

    [void]$Results.Add(
        "RESULT: PASS"
    )

    [void]$Results.Add(
        "Во всех проверенных политиках сохранение паролей отключено."
    )
}
elseif ($FailCount -eq 0) {

    $OverallStatus = "PASS WITH WARNINGS"

    [void]$Results.Add(
        "RESULT: PASS WITH WARNINGS"
    )

    [void]$Results.Add(
        "Критических нарушений не обнаружено, но присутствуют предупреждения."
    )
}
else {

    $OverallStatus = "FAIL"

    [void]$Results.Add(
        "RESULT: FAIL"
    )

    [void]$Results.Add(
        "Обнаружены браузеры, в которых политика отключения сохранения паролей не установлена или имеет неправильное значение."
    )
}


# ============================================================
# PREPARE OUTPUT
# ============================================================

$Header = ""
$Header = $Header.PadLeft(70, "=")

$Output = New-Object System.Collections.ArrayList

[void]$Output.Add("")
[void]$Output.Add($Header)
[void]$Output.Add("COMPUTER: $ComputerName")
[void]$Output.Add("DATE: $DateTime")
[void]$Output.Add($Header)

foreach ($Line in $Results) {

    [void]$Output.Add($Line)
}

[void]$Output.Add($Header)
[void]$Output.Add("END OF AUDIT: $ComputerName")
[void]$Output.Add($Header)
[void]$Output.Add("")


# ============================================================
# WRITE DETAILED RESULT / MARKER
# ============================================================

try {

    # Этот файл одновременно является:
    #
    # 1. Подробным отчетом
    # 2. Маркером успешного выполнения проверки

    $Output | Out-File `
        -FilePath $MarkerFile `
        -Encoding UTF8 `
        -Force

}
catch {

    # Если сеть недоступна,
    # локальный файл НЕ считается маркером.

    $LocalLogDirectory = `
        "C:\ProgramData\DomainSecurityAudit"

    if (-not (Test-Path $LocalLogDirectory)) {

        New-Item `
            -Path $LocalLogDirectory `
            -ItemType Directory `
            -Force | Out-Null
    }

    $LocalResult = Join-Path `
        $LocalLogDirectory `
        ($ComputerName + ".txt")

    $Output | Out-File `
        -FilePath $LocalResult `
        -Encoding UTF8 `
        -Force
}


# ============================================================
# WRITE SUMMARY
# ============================================================

try {

    $SummaryLine = "{0} - {1}" -f `
        $ComputerName, `
        $OverallStatus

    Add-Content `
        -Path $SummaryFile `
        -Value $SummaryLine `
        -Encoding UTF8

}
catch {

    # Если Summary недоступен,
    # подробный отчет все равно уже сохранен.
}


# ============================================================
# CONSOLE OUTPUT
# ============================================================

Write-Host ""
Write-Host "============================================================"
Write-Host "BROWSER PASSWORD POLICY AUDIT"
Write-Host "============================================================"
Write-Host ""

foreach ($Line in $Results) {

    Write-Host $Line
}

Write-Host ""
Write-Host "============================================================"
Write-Host "Computer result:"
Write-Host $MarkerFile
Write-Host ""
Write-Host "Overall status:"
Write-Host $OverallStatus
Write-Host "============================================================"