KimConnect.com

# Quick method to obtain computernames of all nodes in a cluster and adjoin result with standalone machine names
$standaloneFileServers="komputer1","komputer2"
$sourceClusters="cluster1","cluster2"
$nodes=$sourceClusters|%{get-clusternode -cluster $_}
$computerNames=$nodes.Name+$standaloneFileServers

# function to obtain the version of a particular excecutable
function getExecutableVersion{
	param(
		[string]$computername,
		[string]$executablename="robocopy.exe"
		)
    $localComputerName=$env:computername
    $isLocal=if($computername -match "(localhost|127.0.0.1|$localComputerName)"){$true}else{$false}
	
    function getExeInfo{
        param($exeName)
        $exeFile=$(try{get-command $exeName -ea SilentlyContinue}catch{}).Definition;
        $exeInfo=$(try{get-item $exeFile -ea SilentlyContinue}catch{}).versionInfo;
        $osName=(Get-WmiObject -class Win32_OperatingSystem).Caption;
        $exeInfo | Add-Member -MemberType NoteProperty -Name "osName" -Value $osName
        return $exeInfo;
        }

    if ($isLocal){
        $exeInfo=getExeInfo -exeName $executablename;
        }else{
            $exeInfo=invoke-command -computername $computername -scriptblock{
		        param($importedFunc,$executablename)                
                [ScriptBlock]::Create($importedFunc).Invoke($executablename);
                } -args ${function:getExeInfo},$executablename
            }
    if ($exeInfo){
        $exeVersion=$exeInfo.ProductVersion;
        $exeLocation=$exeInfo.FileName;
        $fileVersion=$exeInfo.FileVersion;
        $osName=$exeInfo.osName;
	    return "$computername $osName $executablename $exeVersion$(if($exeVersion -ne $fileVersion){" $fileVersion "})$exeLocation";
        }else{
            write-host "$executablename is not in the environmental paths of $computername";
            }
}

$computerNames|getExecutableVersion -computerName $_ -executablename robocopy.exe

function addSystemPrivilege{
    param(
        [String[]]$privileges=@("SeBackupPrivilege","SeRestorePrivilege")
    )

    function includeSystemPrivileges{
    $win32api = @'
    using System;
    using System.Runtime.InteropServices;

    namespace SystemPrivilege.Win32API
    {
      [StructLayout(LayoutKind.Sequential)]
      public struct LUID
      {
        public UInt32 LowPart;
        public Int32 HighPart;
      }

      [StructLayout(LayoutKind.Sequential)]
      public struct LUID_AND_ATTRIBUTES
      {
        public LUID Luid;
        public UInt32 Attributes;
      }

      [StructLayout(LayoutKind.Sequential)]
      public struct TOKEN_PRIVILEGES
      {
        public UInt32 PrivilegeCount;
        public LUID Luid;
        public UInt32 Attributes;
      }

      public class Privileges
      {
        public const UInt32 DELETE = 0x00010000;
        public const UInt32 READ_CONTROL = 0x00020000;
        public const UInt32 WRITE_DAC = 0x00040000;
        public const UInt32 WRITE_OWNER = 0x00080000;
        public const UInt32 SYNCHRONIZE = 0x00100000;
        public const UInt32 STANDARD_RIGHTS_ALL = (
                                                    READ_CONTROL |
                                                    WRITE_OWNER |
                                                    WRITE_DAC |
                                                    DELETE |
                                                    SYNCHRONIZE
                                                );
        public const UInt32 STANDARD_RIGHTS_REQUIRED = 0x000F0000u;
        public const UInt32 STANDARD_RIGHTS_READ = 0x00020000u;

        public const UInt32 SE_PRIVILEGE_ENABLED_BY_DEFAULT = 0x00000001u;
        public const UInt32 SE_PRIVILEGE_ENABLED = 0x00000002u;
        public const UInt32 SE_PRIVILEGE_REMOVED = 0x00000004u;
        public const UInt32 SE_PRIVILEGE_USED_FOR_ACCESS = 0x80000000u;

        public const UInt32 TOKEN_QUERY = 0x00000008;
        public const UInt32 TOKEN_ADJUST_PRIVILEGES = 0x00000020;

        public const UInt32 TOKEN_ASSIGN_PRIMARY = 0x00000001u;
        public const UInt32 TOKEN_DUPLICATE = 0x00000002u;
        public const UInt32 TOKEN_IMPERSONATE = 0x00000004u;
        public const UInt32 TOKEN_QUERY_SOURCE = 0x00000010u;
        public const UInt32 TOKEN_ADJUST_GROUPS = 0x00000040u;
        public const UInt32 TOKEN_ADJUST_DEFAULT = 0x00000080u;
        public const UInt32 TOKEN_ADJUST_SESSIONID = 0x00000100u;
        public const UInt32 TOKEN_READ = (
                                          STANDARD_RIGHTS_READ |
                                          TOKEN_QUERY
                                       );
        public const UInt32 TOKEN_ALL_ACCESS = (
                                                STANDARD_RIGHTS_REQUIRED |
                                                TOKEN_ASSIGN_PRIMARY |
                                                TOKEN_DUPLICATE |
                                                TOKEN_IMPERSONATE |
                                                TOKEN_QUERY |
                                                TOKEN_QUERY_SOURCE |
                                                TOKEN_ADJUST_PRIVILEGES |
                                                TOKEN_ADJUST_GROUPS |
                                                TOKEN_ADJUST_DEFAULT |
                                                TOKEN_ADJUST_SESSIONID
                                             );

        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        public static extern IntPtr GetCurrentProcess();

        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        public static extern IntPtr GetCurrentThread();

        [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, out LUID lpLuid);

        [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges, ref TOKEN_PRIVILEGES NewState, UInt32 BufferLengthInBytes, IntPtr PreviousStateNull, IntPtr ReturnLengthInBytesNull);

        [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern bool OpenProcessToken(IntPtr ProcessHandle, UInt32 DesiredAccess, out IntPtr TokenHandle);

        [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
        public static extern bool OpenThreadToken(IntPtr ThreadHandle, UInt32 DesiredAccess, bool OpenAsSelf, out IntPtr TokenHandle);

        [DllImport("ntdll.dll", EntryPoint = "RtlAdjustPrivilege")]
        public static extern int RtlAdjustPrivilege(
                    UInt32 Privilege,
                    bool Enable,
                    bool CurrentThread,
                    ref bool Enabled
                    );

        [DllImport("Kernel32.dll", SetLastError = true)]
        public static extern bool CloseHandle(IntPtr handle);

        //
        //

        private static LUID LookupPrivilege(string privilegeName)
        {
          LUID privilegeValue = new LUID();
      
          bool res = LookupPrivilegeValue(null, privilegeName, out privilegeValue);

          if (!res)
          {
            throw new Exception("Error: LookupPrivilegeValue()");
          }

          return privilegeValue;
        }

        //
        //

        public static void AdjustPrivilege(string privilegeName, bool enable)
        {
          IntPtr accessToken = IntPtr.Zero;
          bool res = false;

          try
          {
            LUID privilegeValue = LookupPrivilege(privilegeName);

            res = OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, false, out accessToken);
        
            if (!res)
            {
              res = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out accessToken);

              if (!res)
              {
                throw new Exception("Error: OpenProcessToken()");
              }
            }

            TOKEN_PRIVILEGES tokenPrivileges = new TOKEN_PRIVILEGES();
            tokenPrivileges.PrivilegeCount = 1;
            tokenPrivileges.Luid = privilegeValue;

            if (enable)
            {
              tokenPrivileges.Attributes = SE_PRIVILEGE_ENABLED;
            }
            else
            {
              tokenPrivileges.Attributes = 0;
            }

            res = AdjustTokenPrivileges(accessToken, false, ref tokenPrivileges, (uint)System.Runtime.InteropServices.Marshal.SizeOf(tokenPrivileges), IntPtr.Zero, IntPtr.Zero);
        
            if (!res)
            {
              throw new Exception("Error: AdjustTokenPrivileges()");
            }
          }

          finally
          {
            if (accessToken != IntPtr.Zero)
            {
              CloseHandle(accessToken);
              accessToken = IntPtr.Zero;
            }
          }
        }
      }
    }
'@

  if ([object]::Equals(('SystemPrivilege.Win32API.Privileges' -as [type]), $null)) {
    Add-Type -TypeDefinition $win32api
    }
}
    includeSystemPrivileges;


    $privileges|%{[SystemPrivilege.Win32API.Privileges]::AdjustPrivilege($_, $true)}

    # Validation
    whoami /priv|?{$_ -match "SeBackupPrivilege|SeRestorePrivilege"}
}
addSystemPrivilege;

# Name your file
$item="\\FILESHERVER007\someweird folder names with long paths\ fmmkklghhbb-yj-yuyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy                                              p-hphlfiles\whatup.exe - Shortcut.lnk" #item could be file or folder

# Move such item into a temp directory, then purge that temp folder
$tempDirectory="c:\tempDirectory"
$emptyDirectory="c:\emptyDirectory"
mkdir $emptyDirectory | out-null
mkdir $emptyDirectory | out-null
$filename=split-path $item -Leaf
$foldername=split-path $item -Parent
robocopy $foldername $tempDirectory $filename /MOVE
robocopy $emptyDirectory $tempDirectory /purge

function getAntivirusName {  
        $wmiQuery = "SELECT * FROM AntiVirusProduct"                  
        $antivirus = Get-WmiObject -Namespace "root\SecurityCenter2" -Query $wmiQuery  @psboundparameters -ErrorVariable myError -ErrorAction 'SilentlyContinue'             

        if($antivirus){
            return $antivirus.displayName            
            }else{
                $alternateAntivirusQuery=WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct GET displayName /Format:List|?{$_.trim() -ne ""}|%{$_ -replace "displayName=",""}
                if ($alternateAntivirusQuery){                    
                    return $alternateAntivirusQuery
                    }else{
                        write-host "No antivirus software were detected. Hence, namespace querying errors."
                        $rawSearch=((get-wmiobject -class "Win32_Process" -namespace "root\cimv2" | where-object {$_.Name.ToLower() -match "antivirus|endpoint|protection|security|defender|msmpeng"}).Name | Out-String).Trim();
                        if($rawSearch){
                            return $rawSearch
                            }else{
                                return "No antivirus detected."
                                }
                        }
                
                } 
        }
getAntivirusName;

Business Use-Case:

1. There’s an existing logon script or Group Policy that maps users toward a particular share on a file server (e.g. “NET USE P:\ \\FILESHERVER01\Public /USER:INTRANET.KIMCONNECT.COM\%USERNAME%”)
2. The requirement is to add more directories to that existing share without incurring extra storage on existing volume where that share resides
3. There is a new LUN being dedicated to that file server that is intended to be mounted as a sub-directory at path \\FILESHERVER01\Public\Infrastructure
4. There are other existing volumes at local paths of T:\Software and M:\Public_Relations, and all other existing shares on this server, that must be accessible from \\FILESHERVER01\Public as sub-folders named Software and Public_Relations, etc.

Technical Implementation:

• a. There shall be no changes required for the logon script. Hence, no change requests are needed to perform this task.
• b. The default recommendation is to expand the volume the hosting share \\FILESHERVER01\Public. If that is not feasible, then items (c) and (d) shall apply
• c. These are the PowerShell commands to mount a new volume as a folder inside \\FILESHERVER01\Public

<# Method 1: Dedicate a whole volume as a sub-directory 
Warning: all data on this new volume will be erased.

#### Set variables ####
$mountPath=""S:\Public\Infrastructure"
$diskIndex=5
#### Only edit above lines ####

$disk = Get-Disk $diskIndex
$disk | Clear-Disk -RemoveData -Confirm:$false
$disk | Initialize-Disk -PartitionStyle MBR
$disk | New-Partition -UseMaximumSize -MbrType IFS
$partition = Get-Partition -DiskNumber $disk.Number
$partition | Format-Volume -FileSystem NTFS -Confirm:$false
New-Item -ItemType Directory -Force -Path $mountPath
$partition | Add-PartitionAccessPath -AccessPath $mountPath

#>

• d. This PowerShell snippet shall retrieve existing SMB shares on the file server and create “junctions” that are accessible from \\FILESHERVER01\Public

<# Method 2: Create Junction Points to All Shares On File Server 

#### Set variables ############
$shareRoot="S:\Public"
#### Only edit above lines ####

# Gather SMB shares on this file server
$paths=get-smbshare|?{$_.Name -notlike "*$"}|select Name,Path

# Install junction.exe
if (!(get-command junction)){
    if (!(Get-Command choco.exe -ErrorAction SilentlyContinue)) {
        Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
        }
    choco install junction -y
    }

# Create junctions at SMB Share Root with a given path
function createJunction{
    param(
        [string]$path,
        [string]$smbShareRoot=$shareRoot
        )
    $folderName=Split-Path $path -Leaf
    #Write-Host "junction '$smbShareRoot\$folderName' '$path'"
    invoke-expression "junction '$smbShareRoot\$folderName' '$path'"
}

foreach ($path in $paths){
    if ($path.Path -notlike "$shareRoot*"){
        Write-Host "Creating juncion for $($path.Path)";
        createJunction -path $path.Path -smbShareRoot $shareRoot;
        }    
}

# Show current sessions on a list of servers
$servers="SHERVER005","SHERVER007";
$servers|%{"$_`n$(query user /server:$_|Out-String)"}

# Sample Output
PS C:\Windows\system32> $servers|%{"$_`n$(query user /server:$_|Out-String)"}
SHERVER005
 USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
 user001                                    6  Disc      9+08:54  10/10/2019 4:42 AM
 user002                                    9  Disc      3+01:12  10/16/2019 12:56 PM
 user003                                   15  Disc         1:48  10/17/2019 2:29 PM
 user004                                   21  Disc         2:34  10/19/2019 7:52 AM
 user005                rdp-tcp#40         22  Active       2:38  10/19/2019 8:21 AM
 user006                rdp-tcp#43         23  Active          .  10/19/2019 2:02 PM

SHERVER007
 USERNAME              SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
 user007                rdp-tcp#8           3  Active       2:38  10/18/2019 10:01 PM
 user008                                    4  Disc         5:43  10/19/2019 7:52 AM
 user009                                    5  Disc         2:51  10/19/2019 10:08 AM
 user010                                    6  Disc         1:48  10/19/2019 11:18 AM

# Step 0: Activate Windows
$licenseKey="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX"
function activateWindows{
    param(
    [string]$key
        )
    $licensingService = get-wmiObject -query "select * from SoftwareLicensingService" -computername $env:computername;
    $licensingService.InstallProductKey($key);
    sleep 20;
    $licensingService.RefreshLicenseStatus();
    Get-CimInstance -ClassName SoftwareLicensingProduct|where {$_.PartialProductKey}|select Description, LicenseStatus
}
activateWindows;

# Step 1: Rename the local machine while remaining with its default workgroup
Rename-Computer -NewName $newServername -Force
Restart-Computer -Force

# Step 2: Find the OU of an intended peer server
$peerServername="SHEVER002"
Move-ADObject $peerServername -TargetPath "OU=Quarantine,DC=INTRANET,DC=KIMCONNECT,DC=COM" -WhatIf

# Step 3: Join new machine to domain
$newServername="SHERVER007"
$domain="INTRANET.KIMCONNECT.COM"
$desktopAdmin="Rambo"
$ouPath= "OU=Servers,DC=INTRANET,DC=KIMCONNECT,DC=COM"
$cred = Get-Credential "$domain`\$desktopAdmin"
add-computer -computername $newServername –Domain $domain -Credential $cred -OUPath $ouPath -restart –force

# Step 4: Install  Choco and update PowerShell
if (!(Get-Command choco.exe -ErrorAction SilentlyContinue)) {
Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))}
$packages = 'powershell','googlechrome','firefox','adobereader','7zip.install','javaruntime','putty.install','sysinternals'
ForEach ($package in $packages){choco install $package -y};
Restart-Computer -Force;

# Step 5: Perform Windows Update
function updateLocalWindows{
    # Prerequisites
    function installPrerequisites{
    #Import-Module PSWindowsUpdate -force;
    #$psWindowsUpdateAvailable=Get-Module PSWindowsUpdate -EA SilentlyContinue;
    $psWindowsUpdateAvailable=Get-Module -ListAvailable -Name PSWindowsUpdate -ErrorAction SilentlyContinue;
    if (!($psWindowsUpdateAvailable)){
        try {                
            [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;          
            Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Confirm:$false | Out-Null;
            Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted | Out-Null;
            Install-Module PSWindowsUpdate -Confirm:$false -Force | Out-Null;
            Import-Module PSWindowsUpdate -force | Out-Null;                    
            }
        catch{
            "Prerequisites not met on $computer.";
            }
        }    
    }

    function checkPendingReboot{
            param([string]$computer=$ENV:computername)

            function checkRegistry{
                 if (Get-ChildItem "HKLM:\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending" -EA Ignore) { return $true }
                 if (Get-Item "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired" -EA Ignore) { return $true }
                 if (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name PendingFileRenameOperations -EA Ignore) { return $true }
                 try { 
                   $util = [wmiclass]"\\.\root\ccm\clientsdk:CCM_ClientUtilities"
                   $status = $util.DetermineIfRebootPending()
                   if(($status -ne $null) -and $status.RebootPending){
                     return $true
                   }
                 }catch{}
                 return $false             
            }

            $localhost=$ENV:computername
            if ($localHost -eq $computer){
                $result=checkRegistry;
             }else{
                $result=Invoke-Command -ComputerName $computer -ScriptBlock{
                                                                    param($importedFunc);
                                                                    [ScriptBlock]::Create($importedFunc).Invoke();
                                                                    } -ArgumentList ${function:checkRegistry}
                }
            return $result;
        }
    installPrerequisites;

    # Register the user of Windows Update Service if it has not been registered
    $MicrosoftUpdateID="7971f918-a847-4430-9279-4a52d1efe18d"
    $registered=$MicrosoftUpdateID -in (Get-WUServiceManager).ServiceID
    if (!($registered)){
        Add-WUServiceManager -ServiceID 7971f918-a847-4430-9279-4a52d1efe18d -Confirm:$false
    }
                          
    # Perform Updates
    Get-WindowsUpdate -AcceptAll -MicrosoftUpdate -Install -IgnoreReboot;

    if (checkPendingReboot){
        $warning="There is a pending reboot flag on this host.`n"
        $prompt="Please type 'exit' to cancel or 'reboot' to reboot"    
        $warning;
        do{
            $userInput=Read-Host -Prompt $prompt;
            if ($userInput -match "reboot"){"Restarting command received!";Restart-Computer;} # -match is faster than -like
        }while (($userInput -notmatch "reboot") -AND ($userInput -notmatch "(quit|cancel|exit)"))
    }else{"Done."}
}
updateLocalWindows;

# Step 6: Remediate Common Vulnerabilities
function remediateVulnerabilities{
    "`nVCE-2017-829..."
    reg add "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_PRINT_INFO_DISCLOSURE_FIX" /v iexplore.exe /t REG_DWORD /d 1 /f
    reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_PRINT_INFO_DISCLOSURE_FIX" /v iexplore.exe /t REG_DWORD /d 1 /f

    "`nCVE-2017-5715..."
    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 0 /f
    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f

    "`nVCE-2017-5753-54..."
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v MinVmVersionForCpuBasedMitigations /t REG_SZ /d "1.0" /f

    "`nASLR Hardening Setting for IE..."
    reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING" /v iexplore.exe /t REG_DWORD /d 1 /f
    reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_USER32_EXCEPTION_HANDLER_HARDENING" /v iexplore.exe /t REG_DWORD /d 1 /f

    "`nRemediate MS11-025 MFC Remote Code Execution..."
	$minVersion=14
	$vcVersions=(Get-ItemProperty HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | where {$_.displayname -like "Microsoft Visual C++*"} | Select-Object DisplayVersion)
	foreach ($version in $vcVersions){
		if($version.DisplayVersion -ge $minVersion){$safeFlag=$True;}
	}
	if (!($safeFlag)){
		try{  
			New-Item -ItemType Directory -Force -Path C:\Temp
			(new-object System.Net.WebClient).DownloadFile('https://download.microsoft.com/download/1/6/5/165255E7-1014-4D0A-B094-B6A430A6BFFC/vcredist_x64.exe','C:\Temp\vcredist_x64.exe')
			C:\Temp\vcredist_x64.exe /quiet /norestart
			}
			catch{
				"Unable to download Visual C++"
			}
		}

    "`nSecuring Remote Desktop..."
	function secureRDP{
		# Remote Desktop Services: Enable NLA Requirement
		(Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'").SetUserAuthenticationRequired(1)

		# Remote Desktop Services: Require 'High' level of encryption - FIPS compliant
		(Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'").SetEncryptionLevel(4)		
	}
    secureRDP;
    
	"`nUpdating Windows Defender..."
    try{"`nUpdating Windows Defender Antimalware Virus Definitions...";Update-MPSignature;}
    catch{"Cannot update Windows Defender."}

	"`nFix Unquoted Service Path Enumerations..."
	function fixUnquotedServicePathEnum{
		$fixScriptDestination="C:\Temp\Windows_Path_Enumerate.ps1"
		$fixScriptDownload="https://gallery.technet.microsoft.com/scriptcenter/Windows-Unquoted-Service-190f0341/file/136821/7/Windows_Path_Enumerate.ps1"
		(new-object System.Net.WebClient).DownloadFile($fixScriptDownload, $fixScriptDestination)
		C:\Temp\Windows_Path_Enumerate.ps1 -FixUninstall -FixEnv
	}
    fixUnquotedServicePathEnum;
	
	"`nApplying IIS Crypto Templates..."
	function installIISCrypto{
		# Download iisCrypto
		New-Item -ItemType Directory -Force -Path C:\Temp
		$url = "https://kimconnect.com/wp-content/uploads/2019/05/IISCryptoCli.zip"    
		$temp = "C:\Temp\IISCryptoCli.zip"
		(new-object System.Net.WebClient).DownloadFile($url,$temp)

		$destination="C:\Windows"
		expand-archive -path $temp -destinationpath $destination
		}
	installIISCrypto;
	
	function applyIISCrypto{
		$templateValues="pci32","best","strict","fips140","default"
		$count=$templateValues.length
		for ($i=0; $i -lt $count; $i++) { $template=$templateValues[$i];"$i`: $template"}
		$index=Read-Host -Prompt "Type in the Template Index NUMBER from 0 to $($count-1) to apply"
		if ($index -lt $count){			
			$iisCryptoExist=([System.IO.File]::Exists("C:\Windows\IISCryptoCli.exe"))
			if ($iisCryptoExist){
				$choice=$templateValues[$index]
				"`nBacking up registry into C:\backup.reg, and applying $choice template..."
				IISCryptoCli /backup C:\backup.reg /template $choice;
				"`nIISCrypto $choice template has been applied...`nPlease reboot machine for changes to take effect."
				}
			else{            
				"`nIISCryto wasn't installed. Retrying..."
				installIISCripto;
				applyIISCrypto;
				}
			}
		else{"Index number was not recognized. Thus, IISCrypto Template was NOT applied."}        
	}
	applyIISCrypto;
	
	# Disable SMB1
    Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol -InformationAction SilentlyContinue -NoRestart

}

# Step 7: Optimize & Clean Windows
function optimizeWindows{
    "`nSet Power Options..."
    function setPowerMax{
		powercfg /setactive SCHEME_MIN
		powercfg /hibernate off
	}
	setPowerMax;
	
	"Disable Automatic Startup Repair..."
    cmd.exe /c "bcdedit /set {default} recoveryenabled No"
	cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
}

function removeBloatware{
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    $bloatwareRemovalDownload="https://github.com/Sycnex/Windows10Debloater/archive/master.zip"
    $bloatwareRemovalDestination="C:\Temp\Windows10Debloater-master.zip"
    (New-Object System.Net.WebClient).DownloadFile($bloatwareRemovalDownload, $bloatwareRemovalDestination)
    $destination="C:\Temp"
    expand-archive -path $bloatwareRemovalDestination -DestinationPath $destination
    PowerShell.exe -executionpolicy bypass -File C:\Temp\Windows10Debloater-master\Windows10Debloater.ps1 -Confirm:$False

    # Disable Windows Media (a vector of attack surface from malware)
    Disable-WindowsOptionalFeature –FeatureName "WindowsMediaPlayer" -Online

    # Disable XPS
    Disable-WindowsOptionalFeature -Online -FeatureName "Printing-XPSServices-Features"

    # Workfolder Client
    Disable-WindowsOptionalFeature -Online -FeatureName "WorkFolders-Client"

	# Remove Windows Store
	Get-AppxPackage -AllUsers | Where-Object {$_.Name -like "Microsoft.WindowsStore*"} | remove-appxpackage
}
removeBloatware;

function cleanWindows{
    "Clear Windows Update Cache..."
    Dism.exe /online /Cleanup-Image /StartComponentCleanup

    "Delete files in Temp directory..."
    del C:\Temp\*.* -Recurse -Force

    "Prune Event Logs..."
    wevtutil el | Foreach-Object {wevtutil cl "$_"}

    "Performing Disk Cleanup..."
    $HKLM = [UInt32] "0x80000002"
    $strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches"
    $strValueName = "StateFlags0065"

    $subkeys = gci -Path HKLM:\$strKeyPath -Name
    ForEach ($subkey in $subkeys) {
            New-ItemProperty -Path HKLM:\$strKeyPath\$subkey -Name $strValueName -PropertyType DWord -Value 2 -ErrorAction SilentlyContinue| Out-Null
            Start-Process cleanmgr -ArgumentList "/sagerun:65" -Wait -NoNewWindow -ErrorAction SilentlyContinue -WarningAction SilentlyContinue
        }
    ForEach ($subkey in $subkeys) {
            Remove-ItemProperty -Path HKLM:\$strKeyPath\$subkey -Name $strValueName | Out-Null
    }
}
cleanWindows;

$remoteWindows="SHERVER01","SHERVER02"
$licenseKey="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX"

function activateWindows{
    param(
    [string]$key 
        )
    $licensingService = get-wmiObject -query "select * from SoftwareLicensingService" -computername $env:computername;
    $licensingService.InstallProductKey($key);
    sleep 20;
    $licensingService.RefreshLicenseStatus();
    Get-CimInstance -ClassName SoftwareLicensingProduct|where {$_.PartialProductKey}|select Description, LicenseStatus
}

Invoke-Command -computer $remoteWindows -ScriptBlock{
                            param($importedFunc,$importedKey)
                            [ScriptBlock]::Create($importedFunc).Invoke($importedKey);                                
                        } -Args ${function:activateWindows},$licenseKey

#Validate licensing status
Get-CimInstance -computername $remoteWindows -ClassName SoftwareLicensingProduct|where {$_.PartialProductKey}|select Description, LicenseStatus

<# Sample Output
Description                                     LicenseStatus
-----------                                     -------------
Windows(R) Operating System, VOLUME_MAK channel             1
Windows(R) Operating System, VOLUME_MAK channel             1
Windows(R) Operating System, VOLUME_MAK channel             1
Windows(R) Operating System, VOLUME_MAK channel             1
Windows(R) Operating System, VOLUME_MAK channel             1
Windows(R) Operating System, VOLUME_MAK channel             1
Windows(R) Operating System, VOLUME_MAK channel             1
Windows(R) Operating System, VOLUME_MAK channel             1
#>