Operating System: Microsoft Windows Server 2012 R2 Datacenter
Get-NetIPAddress : The term 'Get-NetIPAddress' is not recognized as the name 
of a cmdlet, function, script file, or operable program. Check the spelling of 
the name, or if a path was included, verify that the path is correct and try 
again.
At line:4 char:28
+ Write-Output "Hostname: $((Get-NetIPAddress -InterfaceAlias "Ethernet*" 
-Address ...
+                            ~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-NetIPAddress:String) [], Co 
   mmandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
Hostname: 
Time: 2026-06-08 16:46:06
############################################################################
This server is NOT a part of domain (DC)
{"1.1.1. Cau hinh tham so 'Enforce password history'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi gia tri khuyen nghi: >= 24
# Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Enforce password history
-------------------
[FAILED]
#(net accounts | Select-String 'Length of password history maintained:').ToString().Split(':')[1].Trim() -ne 'None' 
None
-------------------
Cannot convert value "None" to type "System.Int32". Error: "Input string was 
not in a correct format."
At line:17 char:43
+ Write-Output "-------------------"; if ($([int](net accounts | Select-String 
'Le ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidArgument: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvalidCastFromStringToInteger
 
[FAILED]
#[int](net accounts | Select-String 'Length of password history maintained:').ToString().Split(':')[1].Trim() -ge 24 
Cannot convert value "None" to type "System.Int32". Error: "Input string was 
not in a correct format."
At line:17 char:368
+ Write-Output "-------------------"; if ($([int](net accounts | Select-String 
'Le ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidArgument: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvalidCastFromStringToInteger
 
###################################### PASSED 0/2
{"1.1.2. Cau hinh tham so 'Maximum password age'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi gia tri khuyen nghi: <= 90 (khac 0)
# Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Maximum password age
-------------------
[PASSED]
#[int](net accounts | Select-String Maximum).ToString().Split(':')[1].Trim() -le 90 
42
-------------------
[PASSED]
#[int](net accounts | Select-String Maximum).ToString().Split(':')[1].Trim() -ne 0 
42
###################################### PASSED 2/2
{"1.1.3. Cau hinh tham so 'Minimum password age'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi gia tri khuyen nghi: >= 1
# Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Minimum password age
-------------------
[FAILED]
#[int](net accounts | Select-String 'Minimum password age').ToString().Split(':')[1].Trim() -ge 1 
0
###################################### PASSED 0/1
{"1.1.4. Cau hinh tham so 'Minimum password length'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi gia tri khuyen nghi: >= 8
# Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Minimum password length
-------------------
[FAILED]
#[int](net accounts | Select-String 'Minimum password length').ToString().Split(':')[1].Trim() -ge 8 
0
###################################### PASSED 0/1
{"1.1.5. Cau hinh chinh sach 'Password must meet complexity requirements'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements
-------------------
[PASSED]
#[int](Get-Content c:\secpol.cfg | Select-String PasswordComplexity).ToString().Split('=')[1].Trim() -eq 1 
1
###################################### PASSED 1/1
{"1.1.6. Cau hinh tham so 'Store passwords using reversible encryption'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Store passwords using reversible encryption
# * Luu y: Cau hinh tham so se la Enabled neu su dung giao thuc xac thuc CHAP thong qua truy cap tu xa, cac dich vu IAS hoac Digest Authentication trong IIS.
-------------------
[PASSED]
#[int](Get-Content c:/secpol.cfg | Select-String 'ClearTextPassword').ToString().Split('=')[1].Trim() -eq 0 
0
###################################### PASSED 1/1
{"1.2.1. Cau hinh tham so 'Account lockout duration'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi gia tri khuyen nghi: >= 15
# Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policy\Account lockout duration
-------------------
[PASSED]
#(net accounts | Select-String 'Lockout duration').ToString().Split(':')[1].Trim() -ne 'Never' 
30
-------------------
[PASSED]
#[int](net accounts | Select-String 'Lockout duration').ToString().Split(':')[1].Trim() -ge 15 
30
###################################### PASSED 2/2
Cannot convert value "Never" to type "System.Int32". Error: "Input string was 
not in a correct format."
At line:4 char:8
+ if (($([int](net accounts | Select-String 'Lockout 
threshold').ToString().Split( ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidArgument: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvalidCastFromStringToInteger
 
Cannot convert value "Never" to type "System.Int32". Error: "Input string was 
not in a correct format."
At line:4 char:111
+ if (($([int](net accounts | Select-String 'Lockout 
threshold').ToString().Split( ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidArgument: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvalidCastFromStringToInteger
 
{"1.2.2. Cau hinh tham so 'Account lockout threshold'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi gia tri khuyen nghi: <= 5 (khac 0)
# Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policy\Account lockout threshold
-------------------
Cannot convert value "Never" to type "System.Int32". Error: "Input string was 
not in a correct format."
At line:16 char:43
+ Write-Output "-------------------"; if ($([int](net accounts | Select-String 
'Lo ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidArgument: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvalidCastFromStringToInteger
 
[PASSED]
#[int](net accounts | Select-String 'Lockout threshold').ToString().Split(':')[1].Trim() -le 5 
Cannot convert value "Never" to type "System.Int32". Error: "Input string was 
not in a correct format."
At line:16 char:324
+ Write-Output "-------------------"; if ($([int](net accounts | Select-String 
'Lo ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidArgument: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvalidCastFromStringToInteger
 
-------------------
Cannot convert value "Never" to type "System.Int32". Error: "Input string was 
not in a correct format."
At line:17 char:43
+ Write-Output "-------------------"; if ($([int](net accounts | Select-String 
'Lo ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidArgument: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvalidCastFromStringToInteger
 
[PASSED]
#[int](net accounts | Select-String 'Lockout threshold').ToString().Split(':')[1].Trim() -ne 0 
Cannot convert value "Never" to type "System.Int32". Error: "Input string was 
not in a correct format."
At line:17 char:324
+ Write-Output "-------------------"; if ($([int](net accounts | Select-String 
'Lo ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidArgument: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvalidCastFromStringToInteger
 
###################################### PASSED 2/2
{"1.2.3. Cau hinh tham so 'Reset account lockout counter after'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi gia tri khuyen nghi: >= 15 (phut)
# Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Account Lockout Policy\Reset account lockout counter after
-------------------
[PASSED]
#(net accounts | Select-String 'observation').ToString().Split(':')[1].Trim() -ne 'Never' 
30
-------------------
[PASSED]
#[int](net accounts | Select-String 'observation').ToString().Split(':')[1].Trim() -ge 15 
30
###################################### PASSED 2/2
{"2.1.1. Cau hinh chinh sach 'Access Credential Manager as a trusted caller'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: No One
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Access Credential Manager as a trusted caller
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String "SeTrustedCredManAccessPrivilege") | Measure-Object | ForEach-Object { $_.Count } -eq 0 
0
###################################### PASSED 1/1
{"2.1.2. Cau hinh chinh sach 'Access this computer from the network' [Chi MS]" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat:
# *	Doi voi DC: Administrators, Authenticated Users, ENTERPRISE DOMAIN CONTROLLERS
# *	Doi voi MS: Administrators, Authenticated Users
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Access this computer from the network
-------------------
[FAILED]
#(Get-Content c:/secpol.cfg | Select-String 'SeNetworkLogonRight').ToString().Split('=')[1].Trim() -eq '*S-1-5-11,*S-1-5-32-544' 
*S-1-1-0,*S-1-5-32-544,*S-1-5-32-545,*S-1-5-32-551
###################################### PASSED 0/1
{"2.1.3. Cau hinh chinh sach 'Act as part of the operating system'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: No One
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Act as part of the operating system
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String "SeTcbPrivilege") | Measure-Object | ForEach-Object { $_.Count } -ne 1 
0
###################################### PASSED 1/1
{"2.1.5. Cau hinh chinh sach 'Adjust memory quotas for a process'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Administrators, LOCAL SERVICE, NETWORK SERVICE
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Adjust memory quotas for a process
# * Luu y:
# *	Doi voi Member Server giu vai tro May chu Web (IIS) voi dich vu Web Server Role la ngoai le doi voi khuyen nghi nay, cho phep cac nhom ung dung IIS duoc tu cap.
# *	Doi voi Member Server duoc cai dat Microsoft SQL Server la ngoai le doi voi khuyen nghi nay.
-------------------
[FAILED]
#(Get-Content c:/secpol.cfg | Select-String 'SeIncreaseQuotaPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-19,*S-1-5-20,*S-1-5-32-544' 
*S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-82-1036420768-1044797643-1061213386-2937092688-4282445334,*S-1-5-82-1479775297-452159339-7981824-75229152-367208238,*S-1-5-82-1615981306-3550854100-1059380238-3728790164-2006131943,*S-1-5-82-1730656103-1099500801-1428095592-3994213322-2796982429,*S-1-5-82-2344033825-3734412582-1027789541-2800428526-3899558498,*S-1-5-82-2661132309-3702860373-614144184-2084021347-4153949123,*S-1-5-82-271721585-897601226-2024613209-625570482-296978595,*S-1-5-82-2804650334-810854867-2525687749-3026647746-453277615,*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415,*S-1-5-82-3454486162-385189505-1281580485-1198172467-3478574457,*S-1-5-82-3682073875-1643277370-2842298652-3532359455-2406259117,*S-1-5-82-3850996981-4204735980-411347227-282481492-1562716735,*S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236,*S-1-5-82-39667913-3332903105-607858146-2638305533-3755657102,*S-1-5-82-4068219030-1673637257-3279585211-533386110-4122969689,*S-1-5-82-4293156715-910959270-3793542201-2041744557-4090708944
###################################### PASSED 0/1
{"2.1.6. Cau hinh chinh sach 'Allow log on locally'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Administrators
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on locally
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'SeInteractiveLogonRight').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544' 
*S-1-5-32-544,*S-1-5-32-545,*S-1-5-32-551
###################################### PASSED 0/1
{"2.1.7. Cau hinh chinh sach 'Allow log on through Remote Desktop Services' [Chi MS]" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi:
# *	Doi voi DC: Administrators
# *	Doi voi MS: Administrators, Remote Desktop Users
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on through Remote Desktop Services
# * Luu y: Neu co danh sach Whitelists nguoi dung duoc cho phep su dung dich vu truy cap tu xa se la ngoai le doi voi khuyen nghi nay.
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeRemoteInteractiveLogonRight ').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544,*S-1-5-32-555' 
*S-1-5-32-544,*S-1-5-32-555
###################################### PASSED 1/1
{"2.1.8. Cau hinh sao luu tep va thu muc 'Back up files and directories'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Administrators
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Back up files and directories
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'SeBackupPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544' 
*S-1-5-32-544,*S-1-5-32-551
###################################### PASSED 0/1
{"2.1.9. Cau hinh thay doi thoi gian he thong 'Change the system time'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Administrators, LOCAL SERVICE
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Change the system time
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeSystemtimePrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-19,*S-1-5-32-544' 
*S-1-5-19,*S-1-5-32-544
###################################### PASSED 1/1
{"2.1.10. Cau hinh thay doi thoi gian he thong 'Change the time zone'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Administrators, LOCAL SERVICE
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Change the time zone
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeTimeZonePrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-19,*S-1-5-32-544' 
*S-1-5-19,*S-1-5-32-544
###################################### PASSED 1/1
{"2.1.11. Cau hinh chinh sach 'Create a pagefile'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Administrators
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Create a pagefile
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeCreatePagefilePrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544' 
*S-1-5-32-544
###################################### PASSED 1/1
{"2.1.12. Cau hinh chinh sach 'Create a token object'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: No One
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Create a token object
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String "SeCreateTokenPrivilege") | Measure-Object | ForEach-Object { $_.Count } -ne 1 
0
###################################### PASSED 1/1
{"2.1.13. Cau hinh chinh sach 'Create global objects'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Create global objects
# * Luu y: Doi voi Member Server duoc cai dat Microsoft SQL Server va chua thanh phan 'Integration Services' la ngoai le doi voi khuyen nghi nay.
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeCreateGlobalPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6' 
*S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6
###################################### PASSED 1/1
{"2.1.14. Cau hinh chinh sach 'Create permanent shared objects'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: No One
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Create permanent shared objects
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String "SeCreatePermanentPrivilege") | Measure-Object | ForEach-Object { $_.Count } -ne 1 
0
###################################### PASSED 1/1
{"2.1.15. Cau hinh chinh sach 'Create symbolic links' [Chi MS]" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi:
# *	Doi voi DC: Administrators
# *	Doi voi MS: Administrators, NT VIRTUAL MACHINE\Virtual Machines (khi Hyper-V role duoc cai dat cho may chu MS)
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Create symbolic links
-------------------
[FAILED]
#[string]::IsNullOrEmpty((Get-WindowsFeature -Name Hyper-V).InstallDate) -ne $true 
True
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeCreateSymbolicLinkPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544' 
*S-1-5-32-544
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'SeCreateSymbolicLinkPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544,*S-1-5-83-0' 
*S-1-5-32-544
###################################### PASSED 1/3
{"2.1.16. Cau hinh chinh sach 'Debug programs'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Administrators
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Debug programs
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeDebugPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544' 
*S-1-5-32-544
###################################### PASSED 1/1
{"2.1.17. Cau hinh chinh sach 'Deny access to this computer from the network' [Chi MS]" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: 
# *	Doi voi DC: Guests 
# *	Doi voi MS: Guests, Local account va member of Administrators group
# (Luu y: Doi voi MS neu su dung RDP de remote thi chi can cau hinh la Guests - *S-1-5-32-546)
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny access to this computer from the network
# * Luu y: Viec cau hinh may chu doc lap (khong tham gia mien) nhu mo ta o tren co the dan den viec khong the quan tri may chu tu xa.
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String "SeDenyNetworkLogonRight") | Measure-Object | ForEach-Object { $_.Count } -eq 1 
0
-------------------
[PASSED]
#[int](Get-Item "HKLM:\System\CurrentControlSet\Control\Terminal Server" -ErrorAction SilentlyContinue).GetValue("fDenyTSConnections") -eq 0
0
-------------------
You cannot call a method on a null-valued expression.
At line:48 char:44
+     Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String "SeDenyNetworkLogonRight").ToString().Split('=')[1].Trim() -eq '*S-1-5-113,*S-1-5-32-544,*S-1-5-32-546' 
You cannot call a method on a null-valued expression.
At line:48 char:435
+     Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
-------------------
You cannot call a method on a null-valued expression.
At line:49 char:44
+     Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String "SeDenyNetworkLogonRight").ToString().Split('=')[1].Trim() -eq '*S-1-5-32-546'
You cannot call a method on a null-valued expression.
At line:49 char:384
+     Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 1/4
You cannot call a method on a null-valued expression.
At line:4 char:7
+ if ($((Get-Content c:\secpol.cfg | Select-String 
"SeDenyBatchLogonRight").ToStri ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
{"2.1.18. Cau hinh chinh sach 'Deny log on as a batch job'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Guests
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on as a batch job
-------------------
You cannot call a method on a null-valued expression.
At line:16 char:43
+ Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-St ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String "SeDenyBatchLogonRight").ToString().Split('=')[1].Trim() -eq '*S-1-5-32-546' 
You cannot call a method on a null-valued expression.
At line:16 char:380
+ Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-St ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 0/1
You cannot call a method on a null-valued expression.
At line:7 char:7
+ if ($((Get-Content c:\secpol.cfg | Select-String 
"SeDenyServiceLogonRight").ToSt ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
{"2.1.19. Cau hinh chinh sach 'Deny log on as a service'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Guests
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on as a service
# * Luu y:
# *	Cau hinh chinh sach nay khong ap dung cho tai khoan System, Local Service, hoac Network Service.
# *	Neu cau hinh chinh sach tu choi dang nhap voi tu cach la nguoi dung dich vu cho cac tai khoan cu the, cac dich vu co the khong the khoi dong va xay ra tu choi dich vu (DoS).
-------------------
You cannot call a method on a null-valued expression.
At line:22 char:43
+ Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-St ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String "SeDenyServiceLogonRight").ToString().Split('=')[1].Trim() -eq '*S-1-5-32-546'
You cannot call a method on a null-valued expression.
At line:22 char:383
+ Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-St ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 0/1
{"2.1.20. Cau hinh chinh sach 'Deny log on locally'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Guests
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on locally
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String "SeDenyInteractiveLogonRight") | Measure-Object | ForEach-Object { $_.Count } -ne 0 
0
-------------------
You cannot call a method on a null-valued expression.
At line:17 char:43
+ Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-St ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String "SeDenyInteractiveLogonRight").ToString().Split('=')[1].Trim() -eq '*S-1-5-32-546' 
You cannot call a method on a null-valued expression.
At line:17 char:392
+ Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-St ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 0/2
{"2.1.21. Cau hinh chinh sach 'Deny log on through Remote Desktop Services' [Chi MS]" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi:
# *	Doi voi DC: Guests
# *	Doi voi MS: Guests, Local account
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on through Remote Desktop Services
# * Luu y: Neu may khong join domain thi co can phai bo local account neu muon su dung dung RDP.
# *	Doi voi DC: Guests
# *	Doi voi MS: Guests
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String "SeDenyRemoteInteractiveLogonRight") | Measure-Object | ForEach-Object { $_.Count } -ne 0 
0
-------------------
[PASSED]
#[int](Get-Item "HKLM:\System\CurrentControlSet\Control\Terminal Server" -ErrorAction SilentlyContinue).GetValue("fDenyTSConnections") -eq 0
0
-------------------
You cannot call a method on a null-valued expression.
At line:51 char:44
+     Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String "SeDenyRemoteInteractiveLogonRight").ToString().Split('=')[1].Trim() -eq 'S-1-5-113,*S-1-5-32-546' 
You cannot call a method on a null-valued expression.
At line:51 char:425
+     Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
-------------------
You cannot call a method on a null-valued expression.
At line:52 char:44
+     Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String "SeDenyRemoteInteractiveLogonRight").ToString().Split('=')[1].Trim() -eq '*S-1-5-32-546' 
You cannot call a method on a null-valued expression.
At line:52 char:405
+     Write-Output "-------------------"; if ($((Get-Content c:\secpol.cfg | 
Select-S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 1/4
{"2.1.22. Cau hinh chinh sach 'Enable computer and user accounts to be trusted for delegation' [Chi MS]" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi:
# *	Doi voi DC: Administrators
# *	Doi voi MS: No One
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Enable computer and user accounts to be trusted for delegation
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String "SeEnableDelegationPrivilege") | Measure-Object | ForEach-Object { $_.Count } -ne 1 
0
###################################### PASSED 1/1
{"2.1.23. Cau hinh chinh sach 'Force shutdown from a remote system'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Administrators
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Force shutdown from a remote system
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeRemoteShutdownPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544' 
*S-1-5-32-544
###################################### PASSED 1/1
{"2.1.24. Cau hinh chinh sach 'Generate security audits'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: LOCAL SERVICE, NETWORK SERVICE
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Generate security audits
# * Luu y:
# *	Doi voi Member Server giu vai tro May chu Web (IIS) voi dich vu Web Server Role la ngoai le doi voi khuyen nghi nay, cho phep cac nhom ung dung IIS duoc tu cap quyen.
# *	Doi voi Member Server giu vai tro Active Directory Federation Services la ngoai le doi voi khuyen nghi nay, cho phep NT SERVICE\ADFSSrv va NT SERVICE\DRSservices, cung nhu tai khoan Active Directory Federation Services lien ket se duoc tu cap quyen.
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'SeAuditPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-19,*S-1-5-20'
*S-1-5-19,*S-1-5-20,*S-1-5-82-1036420768-1044797643-1061213386-2937092688-4282445334,*S-1-5-82-1479775297-452159339-7981824-75229152-367208238,*S-1-5-82-1615981306-3550854100-1059380238-3728790164-2006131943,*S-1-5-82-1730656103-1099500801-1428095592-3994213322-2796982429,*S-1-5-82-2344033825-3734412582-1027789541-2800428526-3899558498,*S-1-5-82-2661132309-3702860373-614144184-2084021347-4153949123,*S-1-5-82-271721585-897601226-2024613209-625570482-296978595,*S-1-5-82-2804650334-810854867-2525687749-3026647746-453277615,*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415,*S-1-5-82-3454486162-385189505-1281580485-1198172467-3478574457,*S-1-5-82-3682073875-1643277370-2842298652-3532359455-2406259117,*S-1-5-82-3850996981-4204735980-411347227-282481492-1562716735,*S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236,*S-1-5-82-39667913-3332903105-607858146-2638305533-3755657102,*S-1-5-82-4068219030-1673637257-3279585211-533386110-4122969689,*S-1-5-82-4293156715-910959270-3793542201-2041744557-4090708944
###################################### PASSED 0/1
{"2.1.25. Cau hinh chinh sach 'Impersonate a client after authentication' [Chi MS]" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi:
# *	Doi voi DC: Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE.
# *	Doi voi MS: Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE IIS_IUSRS (Neu cai dat Web Server IIS Role voi Web Server Role Service).
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Impersonate a client after authentication
# * Luu y: Doi voi Member Server duoc cai dat Microsoft SQL Server va chua thanh phan 'Integration Services' la ngoai le doi voi khuyen nghi nay.
-------------------
[FAILED]
#(Get-WindowsFeature -Name Web-Server, Web-Services).Installed -ne $true
True
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeImpersonatePrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-32-568,*S-1-5-6'
*S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-32-568,*S-1-5-6
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'SeImpersonatePrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-6'
*S-1-5-19,*S-1-5-20,*S-1-5-32-544,*S-1-5-32-568,*S-1-5-6
###################################### PASSED 1/3
Get-LocalGroup : The term 'Get-LocalGroup' is not recognized as the name of a 
cmdlet, function, script file, or operable program. Check the spelling of the 
name, or if a path was included, verify that the path is correct and try again.
At line:4 char:7
+ if ($(Get-LocalGroup -Name "Window Manager\Window Manager Group" 
-ErrorAction Si ...
+       ~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-LocalGroup:String) [], Comm 
   andNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
{"2.1.26. Cau hinh chinh sach 'Increase scheduling priority'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Administrators, Window Manager\Window Manager Group
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Increase scheduling priority
-------------------
Get-LocalGroup : The term 'Get-LocalGroup' is not recognized as the name of a 
cmdlet, function, script file, or operable program. Check the spelling of the 
name, or if a path was included, verify that the path is correct and try again.
At line:26 char:43
+ Write-Output "-------------------"; if ($(Get-LocalGroup -Name "Window 
Manager\W ...
+                                           ~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-LocalGroup:String) [], Comm 
   andNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
[PASSED]
#Get-LocalGroup -Name "Window Manager\Window Manager Group" -ErrorAction SilentlyContinue -ne $true
Get-LocalGroup : The term 'Get-LocalGroup' is not recognized as the name of a 
cmdlet, function, script file, or operable program. Check the spelling of the 
name, or if a path was included, verify that the path is correct and try again.
At line:26 char:333
+ ... ue -ne $true'; Get-LocalGroup -Name "Window Manager\Window Manager 
Group" -Error ...
+                    ~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-LocalGroup:String) [], Comm 
   andNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'SeIncreaseBasePriorityPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544,*S-1-5-90-0'
*S-1-5-32-544
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeIncreaseBasePriorityPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544'
*S-1-5-32-544
###################################### PASSED 2/3
{"2.1.27. Cau hinh chinh sach 'Load and unload device drivers'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Administrators
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Load and unload device drivers
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String SeLoadDriverPrivilege).ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544'
*S-1-5-32-544
###################################### PASSED 1/1
{"2.1.28. Cau hinh chinh sach 'Lock pages in memory'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: No One
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Lock pages in memory
# * Luu y: Doi voi Member Server duoc cai dat Microsoft SQL Server va chua thanh phan 'Integration Services' la ngoai le doi voi khuyen nghi nay.
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String "SeLockMemoryPrivilege") | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
###################################### PASSED 0/1
{"2.1.29. Cau hinh chinh sach 'Manage auditing and security log' [Chi MS]" : "PASSED"}
######################################
# Doi voi DC: Administrators, Exchange Servers (moi truong su dung Exchange)
# Doi voi MS: Administrators
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Manage auditing and security log
-------------------
[FAILED]
#Get-Service -Name "MSExchangeServiceHost" -ErrorAction Stop -ne $true
Exception
-------------------
[FAILED]
#(Get-Service -Name "MSExchangeServiceHost" -ErrorAction Stop).Status -ne "Running"
Exception
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'SeSecurityPrivilege').ToString().Split('=')[1].Trim() -eq "*S-1-5-32-544,*S-1-5-21-$((Get-WmiObject -Namespace root\cimv2 -Class Win32_ComputerSystem).Domain.replace('.', '-'))-498"
*S-1-5-32-544
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeSecurityPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544'
*S-1-5-32-544
###################################### PASSED 1/4
{"2.1.30. Cau hinh chinh sach 'Modify an object label'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: No One
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Modify an object label
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String "SeRelabelPrivilege") | Measure-Object | ForEach-Object { $_.Count } -ne 1
0
###################################### PASSED 1/1
{"2.1.31. Cau hinh gia tri 'Modify firmware environment values'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Administrators
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Modify firmware environment values
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeSystemEnvironmentPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544'
*S-1-5-32-544
###################################### PASSED 1/1
{"2.1.32. Cau hinh chinh sach 'Perform volume maintenance tasks'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Administrators
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Perform volume maintenance task
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeManageVolumePrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544'
*S-1-5-32-544
###################################### PASSED 1/1
{"2.1.33. Cau hinh chinh sach 'Profile single process'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Administrators
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Profile single process
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeProfileSingleProcessPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544'
*S-1-5-32-544
###################################### PASSED 1/1
{"2.1.34. Cau hinh chinh sach 'Profile system performance'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Administrators, NT SERVICE\WdiServiceHost
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Profile system performance
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeSystemProfilePrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544,*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420'
*S-1-5-32-544,*S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420
###################################### PASSED 1/1
{"2.1.35. Cau hinh chinh sach 'Replace a process level token'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: LOCAL SERVICE, NETWORK SERVICE
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Replace a process level token
# * Luu y:
# *	Doi voi Member Server giu vai tro May chu Web (IIS) voi dich vu Web Server Role la ngoai le doi voi khuyen nghi nay, cho phep cac nhom ung dung IIS duoc tu cap.
# *	Doi voi Member Server duoc cai dat Microsoft SQL Server la ngoai le doi voi khuyen nghi nay.
# *	Yeu cau cau hinh chinh sach 'Adjust memory quotas for a process' tai muc truoc do
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'SeAssignPrimaryTokenPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-19,*S-1-5-20'
*S-1-5-19,*S-1-5-20,*S-1-5-82-1036420768-1044797643-1061213386-2937092688-4282445334,*S-1-5-82-1479775297-452159339-7981824-75229152-367208238,*S-1-5-82-1615981306-3550854100-1059380238-3728790164-2006131943,*S-1-5-82-1730656103-1099500801-1428095592-3994213322-2796982429,*S-1-5-82-2344033825-3734412582-1027789541-2800428526-3899558498,*S-1-5-82-2661132309-3702860373-614144184-2084021347-4153949123,*S-1-5-82-271721585-897601226-2024613209-625570482-296978595,*S-1-5-82-2804650334-810854867-2525687749-3026647746-453277615,*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415,*S-1-5-82-3454486162-385189505-1281580485-1198172467-3478574457,*S-1-5-82-3682073875-1643277370-2842298652-3532359455-2406259117,*S-1-5-82-3850996981-4204735980-411347227-282481492-1562716735,*S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236,*S-1-5-82-39667913-3332903105-607858146-2638305533-3755657102,*S-1-5-82-4068219030-1673637257-3279585211-533386110-4122969689,*S-1-5-82-4293156715-910959270-3793542201-2041744557-4090708944
###################################### PASSED 0/1
{"2.1.36. Cau hinh chinh sach 'Restore files and directories'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: ADMINISTRATORS, BACKUP OPERATORS
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Restore files and directories
# * Luu y: Gioi han quyen nay doi voi nhom Quan tri vien (Administrators Group). Chi dinh them quyen nay cho nhom Backup Operators neu to chuc yeu cau nhom nay can co.
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'SeRestorePrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544'
*S-1-5-32-544,*S-1-5-32-551
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeRestorePrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544,*S-1-5-32-551'
*S-1-5-32-544,*S-1-5-32-551
###################################### PASSED 1/2
{"2.1.37. Cau hinh chinh sach 'Shut down the system'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: ADMINISTRATORS, BACKUP OPERATORS
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Shut down the system
# * Luu y: Gioi han quyen nay doi voi nhom Quan tri vien (Administrators Group). Chi dinh them quyen nay cho nhom Backup Operators neu to chuc yeu cau nhom nay can co.
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'SeShutdownPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544'
*S-1-5-32-544,*S-1-5-32-551
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeShutdownPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544,*S-1-5-32-551'
*S-1-5-32-544,*S-1-5-32-551
###################################### PASSED 1/2
{"2.1.39. Cau hinh chinh sach 'Take ownership of files or other objects'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Administrators
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Take ownership of files or other objects
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'SeTakeOwnershipPrivilege').ToString().Split('=')[1].Trim() -eq '*S-1-5-32-544'
*S-1-5-32-544
###################################### PASSED 1/1
Get-LocalUser : The term 'Get-LocalUser' is not recognized as the name of a 
cmdlet, function, script file, or operable program. Check the spelling of the 
name, or if a path was included, verify that the path is correct and try again.
At line:8 char:39
+ if ($((invoke-expression "net user $((Get-LocalUser | ForEach-Object { 
$_.Name + ...
+                                       ~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-LocalUser:String) [], Comma 
   ndNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
You cannot call a method on a null-valued expression.
At line:8 char:38
+ if ($((invoke-expression "net user $((Get-LocalUser | ForEach-Object { 
$_.Name + ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
{"2.2.1.1. Cau hinh trang thai tai khoan 'Administrator account status'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Administrator account status
# *Luu y: Tai khoan Administator khong the disable duoc neu chi co duy nhat mot tai khoan nay dung cho Remote Desktop
# Khi cau hinh trong Group Policy bang giao dien co the se gap truong hop Disable xong, mo lai thi trang thai lai la Enable. Neu cau hinh co the su dung cau lenh sau voi quyen administrators:
# net user administrator /active:no 
# gpupdate /force
-------------------
Get-LocalUser : The term 'Get-LocalUser' is not recognized as the name of a 
cmdlet, function, script file, or operable program. Check the spelling of the 
name, or if a path was included, verify that the path is correct and try again.
At line:24 char:75
+ Write-Output "-------------------"; if ($((invoke-expression "net user 
$((Get-Lo ...
+                                                                           
~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-LocalUser:String) [], Comma 
   ndNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
You cannot call a method on a null-valued expression.
At line:24 char:74
+ Write-Output "-------------------"; if ($((invoke-expression "net user 
$((Get-Lo ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
[FAILED]
#(invoke-expression "net user $((Get-LocalUser | ForEach-Object { $_.Name + " " + $_.Description } | Select-String "Built-in account for administering the computer/domain" | ForEach-Object { "$(($_ -split '\s+'))" } | ForEach-Object { $_.replace('Built-in account for administering the computer/domain', '') }))" | Select-String 'Account active').ToString().Split(' ')[16].Trim() -eq 'No'
Get-LocalUser : The term 'Get-LocalUser' is not recognized as the name of a 
cmdlet, function, script file, or operable program. Check the spelling of the 
name, or if a path was included, verify that the path is correct and try again.
At line:24 char:955
+ ... n "net user $((Get-LocalUser | ForEach-Object { $_.Name + " " + 
$_.Description } ...
+                    ~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-LocalUser:String) [], Comma 
   ndNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
You cannot call a method on a null-valued expression.
At line:24 char:954
+ Write-Output "-------------------"; if ($((invoke-expression "net user 
$((Get-Lo ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 0/1
{"2.2.1.2. Cau hinh chinh sach tai khoan 'Block Microsoft accounts'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Users can't add or log on with Microsoft accounts
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Block Microsoft accounts
-------------------
#Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -eq $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'NoConnectedUser' | Measure-Object | ForEach-Object { $_.Count } -eq 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:39 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
Get-LocalUser : The term 'Get-LocalUser' is not recognized as the name of a 
cmdlet, function, script file, or operable program. Check the spelling of the 
name, or if a path was included, verify that the path is correct and try again.
At line:4 char:38
+ if ($((invoke-expression "net user $(Get-LocalUser | ForEach-Object { 
$_.Name +  ...
+                                      ~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-LocalUser:String) [], Comma 
   ndNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
You cannot call a method on a null-valued expression.
At line:4 char:38
+ if ($((invoke-expression "net user $(Get-LocalUser | ForEach-Object { 
$_.Name +  ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
{"2.2.1.3. Cau hinh trang thai tai khoan 'Guest account status' [Chi MS]" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Guest account status
-------------------
Get-LocalUser : The term 'Get-LocalUser' is not recognized as the name of a 
cmdlet, function, script file, or operable program. Check the spelling of the 
name, or if a path was included, verify that the path is correct and try again.
At line:16 char:74
+ Write-Output "-------------------"; if ($((invoke-expression "net user 
$(Get-Loc ...
+                                                                          
~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-LocalUser:String) [], Comma 
   ndNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
You cannot call a method on a null-valued expression.
At line:16 char:74
+ Write-Output "-------------------"; if ($((invoke-expression "net user 
$(Get-Loc ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
[FAILED]
#(invoke-expression "net user $(Get-LocalUser | ForEach-Object { $_.Name + " " + $_.Description } | Select-String "Built-in account for guest access to the computer/domain" | ForEach-Object { "$(($_ -split '\s+'))" } | ForEach-Object { $_.replace('Built-in account for guest access to the computer/domain', '') })" | Select-String 'Account active').ToString().Split(' ')[16].Trim() -eq 'No'
Get-LocalUser : The term 'Get-LocalUser' is not recognized as the name of a 
cmdlet, function, script file, or operable program. Check the spelling of the 
name, or if a path was included, verify that the path is correct and try again.
At line:16 char:958
+ ... on "net user $(Get-LocalUser | ForEach-Object { $_.Name + " " + 
$_.Description } ...
+                    ~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-LocalUser:String) [], Comma 
   ndNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 
You cannot call a method on a null-valued expression.
At line:16 char:958
+ Write-Output "-------------------"; if ($((invoke-expression "net user 
$(Get-Loc ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 0/1
{"2.2.1.4. Cau hinh chinh sach tai khoan 'Limit local account use of blank passwords to console logon only'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Limit local account use of blank passwords to console logon only
-------------------
#Get-ItemProperty -Path HKLM:\System\Currentcontrolset\Control\Lsa -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\System\Currentcontrolset\Control\Lsa" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\System\Currentcontrolset\Control\Lsa" | Select-String 'LimitBlankPasswordUse' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\System\Currentcontrolset\Control\Lsa" | Select-String 'LimitBlankPasswordUse').ToString().Split('')[12].Trim() -eq [int]'0x1'
1
###################################### PASSED 4/4
{"2.2.1.5. Cau hinh thay doi ten mac dinh tai khoan quan tri 'Rename administrator account'" : "FAILED"}
######################################
# Cau hinh theo duong dan sau: thay doi ten tai khoan quan tri mac dinh duoc tao ra ban dau.
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Rename administrator account
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'NewAdministratorName').ToString().Split('=')[1].Trim() -ne '"Administrator"'
"Administrator"
###################################### PASSED 0/1
{"2.2.1.6. Cau hinh thay doi ten mac dinh tai khoan Guests 'Rename guest account'" : "FAILED"}
######################################
# Cau hinh theo duong dan sau: thay doi ten tai khoan Guests mac dinh duoc tao ra ban dau.
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Rename guest account
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'NewGuestName').ToString().Split('=')[1].Trim() -ne '"Guest"'
"Guest"
###################################### PASSED 0/1
{"2.2.2.1. Cau hinh chinh sach 'Audit: Force audit policy subcategory settings to override audit policy category settings'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings
-------------------
#Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" -eq $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" | Select-String 'SCENoApplyLegacyAuditPolicy' | Measure-Object | ForEach-Object { $_.Count } -eq 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:39 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"2.2.2.2. Cau hinh chinh sach 'Audit: Shut down system immediately if unable to log security audits'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Audit: Shut down system immediately if unable to log security audits
-------------------
#Get-ItemProperty -Path HKLM:\System\Currentcontrolset\Control\Lsa -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\System\Currentcontrolset\Control\Lsa" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\System\Currentcontrolset\Control\Lsa" | Select-String 'CrashOnAuditFail' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\System\Currentcontrolset\Control\Lsa" | Select-String 'CrashOnAuditFail').ToString().Split('')[12].Trim() -eq [int]'0x0'
0
###################################### PASSED 4/4
{"2.2.3.1. Cau hinh chinh sach 'Devices: Allowed to format and eject removable media'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Administrators
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Devices: Allowed to format and eject removable media
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -eq $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" | Select-String 'AllocateDASD' | Measure-Object | ForEach-Object { $_.Count } -eq 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:39 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"2.2.3.2. Cau hinh chinh sach 'Devices: Prevent users from installing printer drivers'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Devices: Prevent users from installing printer drivers
-------------------
#Get-ItemProperty -Path 'HKLM:\System\Currentcontrolset\Control\Print\Providers\Lanman Print Services\Servers' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\System\Currentcontrolset\Control\Print\Providers\Lanman Print Services\Servers" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\System\Currentcontrolset\Control\Print\Providers\Lanman Print Services\Servers" | Select-String 'AddPrinterDrivers' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\System\Currentcontrolset\Control\Print\Providers\Lanman Print Services\Servers" | Select-String 'AddPrinterDrivers').ToString().Split('')[12].Trim() -eq [int]'0x1'
1
###################################### PASSED 4/4
{"2.2.4.1. Cau hinh chinh sach 'Domain controller: Allow server operators to schedule tasks' is set to 'Disabled'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Domain controller: Allow server operators to schedule tasks
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" -eq $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" | Select-String 'SubmitControl' | Measure-Object | ForEach-Object { $_.Count } -eq 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:39 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"2.2.4.2. Cau hinh chinh sach 'Domain controller: Refuse machine account password changes'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Domain controller: Refuse machine account password changes
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -eq $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" | Select-String 'RefusePasswordChange' | Measure-Object | ForEach-Object { $_.Count } -eq 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:39 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"2.2.5.1. Cau hinh chinh sach 'Domain member: Digitally encrypt or sign secure channel data (always)'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Domain member: Digitally encrypt or sign secure channel data (always)
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'RequireSignOrSeal').ToString().Split('=')[1].Trim() -eq '4,1'
4,1
###################################### PASSED 1/1
{"2.2.5.2. Cau hinh chinh sach 'Domain member: Digitally encrypt secure channel data (when possible)'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Domain member: Digitally encrypt secure channel data (when possible)
-------------------
#Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" | Select-String 'SealSecureChannel' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" | Select-String 'SealSecureChannel').ToString().Split('')[12].Trim() -eq [int]'0x1'
1
###################################### PASSED 4/4
{"2.2.5.3. Cau hinh chinh sach 'Domain member: Digitally sign secure channel data (when possible)'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Domain member: Digitally sign secure channel data (when possible)
-------------------
#Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" | Select-String 'SignSecureChannel' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" | Select-String 'SignSecureChannel').ToString().Split('')[12].Trim() -eq [int]'0x1'
1
###################################### PASSED 4/4
{"2.2.5.4. Cau hinh chinh sach 'Domain member: Disable machine account password changes'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Domain member: Disable machine account password changes
-------------------
#Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" | Select-String 'DisablePasswordChange' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" | Select-String 'DisablePasswordChange').ToString().Split('')[12].Trim() -eq [int]'0x0'
0
###################################### PASSED 4/4
{"2.2.5.5. Cau hinh chinh sach 'Domain member: Maximum machine account password age'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: <= 30 (khac 0)
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Domain member: Maximum machine account password age
-------------------
#Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" | Select-String 'MaximumPasswordAge' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" | Select-String 'MaximumPasswordAge').ToString().Split('')[12].Trim() -eq [int]'0x1e'
30
###################################### PASSED 4/4
{"2.2.5.6. Cau hinh chinh sach 'Domain member: Require strong (Windows 2000 or later) session key'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Domain member: Require strong (Windows 2000 or later) session key
-------------------
#Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Services\Netlogon\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" | Select-String 'RequireStrongKey' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters" | Select-String 'RequireStrongKey').ToString().Split('')[12].Trim() -eq [int]'0x1'
1
###################################### PASSED 4/4
{"2.2.6.1. Thiet lap 'Interactive logon: Do not display last user name'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Don't display last signed-in
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'DontDisplayLastUserName' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'DontDisplayLastUserName').ToString().Split('')[12].Trim() -eq [int]'0x1'
0
###################################### PASSED 3/4
{"2.2.6.2. Thiet lap 'CTRL+ALT+DEL'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Do not require CTRL+ALT+DEL
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'DisableCAD' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'DisableCAD').ToString().Split('')[12].Trim() -eq [int]'0x0'
0
###################################### PASSED 4/4
{"2.2.6.3. Thiet lap 'Interactive logon: Machine inactivity limit'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: <= 900 (s) (khac 0)
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Machine inactivity limit
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -eq $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'InactivityTimeoutSecs' | Measure-Object | ForEach-Object { $_.Count } -eq 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:43 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"2.2.6.4. Cau hinh 'Interactive logon: Message text for users attempting to log on'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi noi dung de xuat: Tao ra noi dung thong bao cho nguoi dung (tuan theo cac chinh sach ATTT duoc ban hanh cua to chuc) nham canh bao ve cac hanh vi lam dung thong tin khong duoc cho phep khi dang nhap vao he thong.
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Message text for users attempting to log on
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'LegalNoticeText' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'LegalNoticeText' | ForEach-Object { "$(($_ -split '\s+',4)[3])" } | Select-String -pattern "[A-z][a-z]" | Measure-Object | ForEach-Object { $_.Count } -eq 1
0
###################################### PASSED 3/4
{"2.2.6.5. Thiet lap 'Interactive logon: Message title for users attempting to log on'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi noi dung de xuat: Tao ra tieu de thong bao cho nguoi dung (tuan theo cac chinh sach ATTT duoc ban hanh cua to chuc) nham canh bao ve cac hanh vi lam dung thong tin khong duoc cho phep khi dang nhap vao he thong.
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Message title for users attempting to log on
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'LegalNoticeCaption' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'LegalNoticeCaption' | ForEach-Object { "$(($_ -split '\s+',4)[3])" } | Select-String -pattern "[A-z][a-z]" | Measure-Object | ForEach-Object { $_.Count } -eq 1
0
###################################### PASSED 3/4
{"2.2.6.6. Thiet lap 'Interactive logon: Prompt user to change password before expiration'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi de xuat: Thiet lap thong bao mat khau sap het han cho nguoi dung: tu 5-14 (ngay)
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Prompt user to change password before expiration
-------------------
#Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" | Select-String 'PasswordExpiryWarning' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" | Select-String 'PasswordExpiryWarning').ToString().Split('')[12].Trim() -ge [int]'0x5'
5
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" | Select-String 'PasswordExpiryWarning').ToString().Split('')[12].Trim() -le [int]'0x14'
5
###################################### PASSED 5/4
{"2.2.6.7. Thiet lap 'Interactive logon: Require Domain Controller Authentication to unlock workstation' [Chi MS]" : "FAILED"}
######################################
# Khi bang dieu khien tren may tinh bi khoa boi nguoi dung hoac tu dong boi thoi man hinh cho khi het thoi gian, bang dieu khien chi co the duoc mo khoa neu co Domain Controller de xac thuc lai tai khoan dang duoc su dung de mo khoa may tinh. Neu khong co Domain Controller, nguoi dung khong the mo khoa may tinh.
# Thiet lap theo duong dan sau gia tri la: Enable
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Require Domain Controller Authentication to unlock workstation
-------------------
#Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" | Select-String 'ForceUnlockLogon' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" | Select-String 'ForceUnlockLogon').ToString().Split('')[12].Trim() -eq [int]'0x1'
0
###################################### PASSED 3/4
{"2.2.6.8. Thiet lap 'Interactive logon: Smart card removal behavior' is set to 'Lock Workstation'" : "FAILED"}
######################################
# Nguoi dung doi khi quen khoa may tram cua ho khi ho roi khoi vi tri, tao dieu kien cho nhung nguoi dung co y do xau truy cap vao may tinh cua ho. Neu the thong minh duoc su dung de xac thuc, may tinh se tu dong khoa khi the duoc thao ra de dam bao rang chi nguoi dung co the thong minh moi truy cap tai nguyen bang cac thong tin xac thuc do.
# Thiet lap Lock Workstation:
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Smart card removal behavior
-------------------
#Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" | Select-String 'ScRemoveOption' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" | Select-String 'ScRemoveOption').ToString().Split('')[12].Trim() -eq [int]'0x1'
0
###################################### PASSED 3/4
{"2.2.7.1. Thiet lap 'Microsoft network client: Digitally sign communications (if server agrees)'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network client: Digitally sign communications (if server agrees)
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" | Select-String 'EnableSecuritySignature' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" | Select-String 'EnableSecuritySignature' | ForEach-Object { "$(($_ -split '\s+',4)[3])" }) -eq [int]'0x1'
1
###################################### PASSED 4/4
{"2.2.7.2. Thiet lap 'Microsoft network client: Send unencrypted password to third-party SMB servers'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network client: Send unencrypted password to third-party SMB servers
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters" | Select-String 'EnablePlainTextPassword' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters" | Select-String 'EnablePlainTextPassword').ToString().Split('')[12].Trim() -eq [int]'0x0'
0
###################################### PASSED 4/4
{"2.2.7.3. Thiet lap 'Microsoft network client: Digitally sign communications (if server always)'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan voi trang thai de xuat: Enable
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network client: Digitally sign communications (always)
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" | Select-String 'RequireSecuritySignature' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" | Select-String 'RequireSecuritySignature' | ForEach-Object { "$(($_ -split '\s+',4)[3])" }) -eq [int]'0x1'
0
###################################### PASSED 3/4
{"2.2.8.1. Thiet lap 'Microsoft network server: Amount of idle time required before suspending session'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: <= 15 (phut)
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network server: Amount of idle time required before suspending session
-------------------
#Get-ItemProperty -Path 'HKLM:\System\Currentcontrolset\Services\Lanmanserver\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\Lanmanserver\Parameters" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\Lanmanserver\Parameters" | Select-String 'AutoDisconnect' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\Lanmanserver\Parameters" | Select-String 'AutoDisconnect').ToString().Split('')[12].Trim() -eq [int]'0xf'
15
###################################### PASSED 4/4
{"2.2.8.2. Thiet lap 'Microsoft network server: Disconnect clients when logon hours expire'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network server: Disconnect clients when logon hours expire
-------------------
#Get-ItemProperty -Path 'HKLM:\System\Currentcontrolset\Services\Lanmanserver\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" | Select-String 'enableforcedlogoff' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" | Select-String 'enableforcedlogoff').ToString().Split('')[12].Trim() -eq [int]'0x1'
1
###################################### PASSED 4/4
{"2.2.8.3. Thiet lap 'Microsoft network server: Digitally sign communications (always)'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network server: Digitally sign communications (always)
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" | Select-String 'RequireSecuritySignature' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" | Select-String 'RequireSecuritySignature').ToString().Split('')[12].Trim() -eq [int]'0x1'
0
###################################### PASSED 3/4
{"2.2.8.4. Thiet lap 'Microsoft network server: Digitally sign communications (if client agrees)'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network server: Digitally sign communications (if client agrees)
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" | Select-String 'EnableSecuritySignature' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" | Select-String 'EnableSecuritySignature').ToString().Split('')[12].Trim() -eq [int]'0x1'
0
###################################### PASSED 3/4
{"2.2.8.5. Thiet lap 'Microsoft network server: Server SPN target name validation level' [Chi MS]" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Accept if provided by client
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network server: Server SPN target name validation level
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" -eq $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" | Select-String 'SMBServerNameHardeningLevel' | Measure-Object | ForEach-Object { $_.Count } -eq 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:44 char:45
+         Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\ ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"2.2.9.1. Thiet lap 'Network access: Allow anonymous SID/Name translation'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Allow anonymous SID/Name translation
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'LSAAnonymousNameLookup').ToString().Split('=')[1].Trim() -eq 0
0
###################################### PASSED 1/1
{"2.2.9.2. Thiet lap 'Network access: Do not allow anonymous enumeration of SAM accounts' [Chi MS]" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Do not allow anonymous enumeration of SAM accounts
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" | Select-String 'RestrictAnonymousSAM' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" | Select-String 'RestrictAnonymousSAM').ToString().Split('')[12].Trim() -eq [int]'0x1'
1
###################################### PASSED 4/4
{"2.2.9.3. Thiet lap 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' [Chi MS]" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Do not allow anonymous enumeration of SAM accounts and shares
# * Luu y: Nguoi dung truy cap vao cac may chu tep va may in duoi dang an danh se khong the xem duoc cac tai nguyen duoc chia se tren cac may chu do; nguoi dung se phai xac thuc truoc khi co the xem danh sach cac thu muc va may in duoc chia se.
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'RestrictAnonymous=').ToString().Split('=')[1].Trim() -eq '4,1'
4,0
###################################### PASSED 0/1
{"2.2.9.4. Thiet lap 'Network access: Let Everyone permissions apply to anonymous users'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Let Everyone permissions apply to anonymous users
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" | Select-String 'EveryoneIncludesAnonymous' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" | Select-String 'EveryoneIncludesAnonymous').ToString().Split('')[12].Trim() -eq [int]'0x0'
0
###################################### PASSED 4/4
{"2.2.9.5. Cau hinh 'Network access: Named Pipes that can be accessed anonymously' [Chi MS]" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi:
# *	Doi voi DC: LSARPC, NETLOGON, SAMR, BROWSER (neu Computer Browser service duoc bat).
# *	Doi voi MS: <blank> [i.e None], BROWSER (neu Computer Browser service duoc bat).
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Named Pipes that can be accessed anonymously
# * Luu y: Doi voi Member Server giu vai tro Remote Desktop Services voi dich vu Remote Desktop Licensing Role la ngoai le doi voi khuyen nghi nay; cho phep su dung Named Pipes la HydraLSPipe va TermServLicensing.
-------------------
[FAILED]
#(Get-Service -name Browser).Status --clike "Stopped"
Stopped
-------------------
[FAILED]
#Get-Content c:\secpol.cfg | Select-String NullSessionPipes -eq 'MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPipes=7,BROWSER'

MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPi
pes=7,
-------------------
[FAILED]
#Get-Content c:\secpol.cfg | Select-String NullSessionPipes -eq 'MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPipes=7,'
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPi
pes=7,
###################################### PASSED 0/3


{"2.2.9.6. Cau hinh 'Network access: Remotely accessible registry paths'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi:
# *	System\CurrentControlSet\Control\Product Options
# *	System\CurrentControlSet\Control\Server Applications
# *	Software\Microsoft\Windows NT\CurrentVersion
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Remotely accessible registry paths
-------------------
[PASSED]
#(Get-Content c:/secpol.cfg | Select-String 'Winreg.*AllowedExactPaths.*Machine').ToString().Split('=')[1].Trim() -eq '7,System\CurrentControlSet\Control\ProductOptions,System\CurrentControlSet\Control\Server Applications,Software\Microsoft\Windows NT\CurrentVersion'
7,System\CurrentControlSet\Control\ProductOptions,System\CurrentControlSet\Control\Server Applications,Software\Microsoft\Windows NT\CurrentVersion
###################################### PASSED 1/1
{"2.2.9.7. Cau hinh 'Network access: Remotely accessible registry paths and sub-paths'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi:
# *	System\CurrentControlSet\Control\Print\Printers
# *	System\CurrentControlSet\Services\Eventlog
# *	Software\Microsoft\OLAP Server
# *	Software\Microsoft\Windows NT\CurrentVersion\Print
# *	Software\Microsoft\Windows NT\CurrentVersion\Windows
# *	System\CurrentControlSet\Control\ContentIndex
# *	System\CurrentControlSet\Control\Terminal Server
# *	System\CurrentControlSet\Control\Terminal Server\UserConfig
# *	System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration
# *	Software\Microsoft\Windows NT\CurrentVersion\Perflib
# *	System\CurrentControlSet\Services\SysmonLog
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Remotely accessible registry paths and sub-paths
-------------------
[PASSED]
#(Get-Content c:\secpol.cfg | Select-String 'AllowedPaths.*Machine').ToString().Split('=')[1].Trim() -eq '7,System\CurrentControlSet\Control\Print\Printers,System\CurrentControlSet\Services\Eventlog,Software\Microsoft\OLAP Server,Software\Microsoft\Windows NT\CurrentVersion\Print,Software\Microsoft\Windows NT\CurrentVersion\Windows,System\CurrentControlSet\Control\ContentIndex,System\CurrentControlSet\Control\Terminal Server,System\CurrentControlSet\Control\Terminal Server\UserConfig,System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration,Software\Microsoft\Windows NT\CurrentVersion\Perflib,System\CurrentControlSet\Services\SysmonLog'
7,System\CurrentControlSet\Control\Print\Printers,System\CurrentControlSet\Services\Eventlog,Software\Microsoft\OLAP Server,Software\Microsoft\Windows NT\CurrentVersion\Print,Software\Microsoft\Windows NT\CurrentVersion\Windows,System\CurrentControlSet\Control\ContentIndex,System\CurrentControlSet\Control\Terminal Server,System\CurrentControlSet\Control\Terminal Server\UserConfig,System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration,Software\Microsoft\Windows NT\CurrentVersion\Perflib,System\CurrentControlSet\Services\SysmonLog
###################################### PASSED 1/1
{"2.2.9.8. Cau hinh 'Network access: Restrict anonymous access to Named Pipes and Shares'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Restrict anonymous access to Named Pipes and Shares
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" | Select-String 'RestrictNullSessAccess' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" | Select-String 'RestrictNullSessAccess').ToString().Split('')[12].Trim() -eq [int]'0x1'
1
###################################### PASSED 4/4
{"2.2.9.9. Cau hinh 'Network access: Shares that can be accessed anonymously'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: <blank> (i.e. None)
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Shares that can be accessed anonymously
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" -eq $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" | Select-String 'NullSessionShares' | Measure-Object | ForEach-Object { $_.Count } -eq 1
0
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" | Select-String 'NullSessionShares' | ForEach-Object { "$(($_ -split '\s+',4)[3])" } | Select-String -pattern "[0-9]" | Measure-Object | ForEach-Object { $_.Count } -ne 1
0
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters" | Select-String 'NullSessionShares' | ForEach-Object { "$(($_ -split '\s+',4)[3])" } | Select-String -pattern "[A-Z][a-z]" | Measure-Object | ForEach-Object { $_.Count } -ne 1
0
###################################### PASSED 4/5
{"2.2.9.10. Cau hinh 'Network access: Sharing and security model for local accounts'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Classic - local users authenticate as themselves
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Sharing and security model for local accounts
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" | Select-String 'ForceGuest' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" | Select-String 'ForceGuest').ToString().Split('')[12].Trim() -eq [int]'0x0'
0
###################################### PASSED 4/4
{"2.2.10.1. Thiet lap 'Network security: Allow LocalSystem NULL session fallback'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Allow LocalSystem NULL session fallback
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" -eq $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" | Select-String 'AllowNullSessionFallback' | Measure-Object | ForEach-Object { $_.Count } -eq 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:43 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"2.2.10.2. Thiet lap 'Network Security: Allow PKU2U authentication requests to this computer to use online identities'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network Security: Allow PKU2U authentication requests to this computer to use online identities
# * Luu y: Bat ky ung dung nao yeu cau NULL session cho LocalSystem se khong hoat dong.
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\pku2u' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"2.2.10.3. Thiet lap 'Network security: Configure encryption types allowed for Kerberos'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Configure encryption types allowed for Kerberos
# * Luu y:
# *	Windows Server 2008 (non-R2) va cac phien ban thap hon cho phep su dung DES la mac dinh danh cho Kerberos, nhung cac phien ban moi hon thi khong.
# *	Mot so ung dung va he dieu hanh cu co the yeu cau RC4_HMAC_MD5, khuyen nghi nen kiem tra va xac dinh co the loai bo duoc hay khong.
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"2.2.10.4. Thiet lap 'Network security: Do not store LAN Manager hash value on next password change'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Do not store LAN Manager hash value on next password change
# * Luu y: Nhung he dieu hanh cu hon va mot so ung dung cua ben thu ba co the bi loi khi bat thiet lap nay. Ngoai ra, luu y rang mat khau se can duoc thay doi tren tat ca cac tai khoan sau khi thiet lap duoc bat.
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" -eq $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" | Select-String 'NoLMHash' | Measure-Object | ForEach-Object { $_.Count } -eq 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" | Select-String 'NoLMHash').ToString().Split('')[12].Trim() -eq [int]'0x1'
1
###################################### PASSED 4/4
{"2.2.10.5. Thiet lap 'Network security: Force logoff when logon hours expire'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Force logoff when logon hours expire
# * Luu y: Neu bat chinh sach nay thi nen bat them chinh sach 'Microsoft network server: Disconnect clients when logon hours expire'
-------------------
[FAILED]
#(Get-Content c:\secpol.cfg | Select-String 'ForceLogoffWhenHourExpire').ToString().Split('=')[1].Trim() -eq 1
0
###################################### PASSED 0/1
{"2.2.10.6. Thiet lap 'Network security: Allow Local System to use computer identity for NTLM'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Allow Local System to use computer identity for NTLM
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" -eq $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" | Select-String 'UseMachineId' | Measure-Object | ForEach-Object { $_.Count } -eq 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:43 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"2.2.10.7. Thiet lap 'Network security: LAN Manager authentication level'" : "FAILED"}
######################################
# Thiet lap nay xac dinh giao thuc xac thuc challenge/response nao duoc su dung de dang nhap mang. Lua chon nay anh huong den muc do giao thuc xac thuc duoc su dung boi client, muc do bao mat phien duoc va muc do xac thuc duoc chap nhan boi may chu
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Send NTLMv2 response only. Refuse LM & NTLM
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: LAN Manager authentication level
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name version
PSArgumentException
-------------------
[PASSED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" -eq $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" | Select-String 'LmCompatibilityLevel' | Measure-Object | ForEach-Object { $_.Count } -eq 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:45 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"2.2.10.8. Thiet lap 'Network security: LDAP client signing requirements'" : "PASSED"}
######################################
# Lam cho tat ca cac loai tan cong MITM tro nen cuc ky kho khan neu yeu cau chu ky so tren tat ca cac goi mang IPsec authentication headers.
# Cau hinh tham so theo duong dan sau voi trang thai: Negotiate signing
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: LDAP client signing requirements
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LDAP' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LDAP" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LDAP" | Select-String 'LDAPClientIntegrity' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LDAP" | Select-String 'LDAPClientIntegrity').ToString().Split('')[12].Trim() -eq [int]'0x1'
1
###################################### PASSED 2/4
{"2.2.10.9. Thiet lap 'Network security: Minimum session security for NTLM SSP based (including secure RPC) clients'" : "FAILED"}
######################################
# Bao ve khoi cac cuoc tan cong MITM
# Cau hinh tham so theo duong dan sau voi trang thai: Require NTLMv2 session security, require 128-bit encryption
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Minimum session security for NTLM SSP based (including secure RPC) clients
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" | Select-String 'NTLMMinClientSec' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" | Select-String 'NTLMMinClientSec').ToString().Split('')[12].Trim() -eq [int]'0x20080000'
536870912
###################################### PASSED 1/4
{"2.2.10.10. Thiet lap 'Network security: Minimum session security for NTLM SSP based (including secure RPC) servers'" : "FAILED"}
######################################
# Bao ve khoi cac cuoc tan cong MITM
# Cau hinh voi gia tri khuyen nghi: NTLMv2 session security, require 128-bit encryption
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Minimum session security for NTLM SSP based (including secure RPC) servers
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" | Select-String 'NTLMMinServerSec' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" | Select-String 'NTLMMinServerSec').ToString().Split('')[12].Trim() -ne [int]'0x20080000'
536870912
###################################### PASSED 2/4
{"2.2.11.1. Thiet lap co che 'Shutdown: Allow system to be shut down without having to log on'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Disabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Shutdown: Allow system to be shut down without having to log on
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'ShutdownWithoutLogon' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'ShutdownWithoutLogon').ToString().Split('')[12].Trim() -ne [int]'0x0'
0
###################################### PASSED 1/4
{"2.2.12.1. Cau hinh chinh sach 'System objects: Require case insensitivity for non-Windows subsystems'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\System objects: Require case insensitivity for nonWindows subsystems
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" | Select-String 'ObCaseInsensitive' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[PASSED]
#(REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" | Select-String 'ObCaseInsensitive').ToString().Split('')[12].Trim() -ne [int]'0x1'
0x1
###################################### PASSED 2/4
{"2.2.12.2. Cau hinh chinh sach 'System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)
-------------------
#Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" | Select-String 'ProtectionMode' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" | Select-String 'ProtectionMode').ToString().Split('')[12].Trim() -ne [int]'0x1'
1
###################################### PASSED 1/4
{"2.2.13.1. Thiet lap 'User Account Control: Admin Approval Mode for the Built-in Administrator account'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Admin Approval Mode for the Built-in Administrator account
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'FilterAdministratorToken' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'FilterAdministratorToken').ToString().Split('')[12].Trim() -ne [int]'0x1'
0
###################################### PASSED 2/4
{"2.2.13.2. Thiet lap 'User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Prompt for consent on the secure desktop
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'ConsentPromptBehaviorAdmin' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'ConsentPromptBehaviorAdmin').ToString().Split('')[12].Trim() -ne [int]'0x2'
5
###################################### PASSED 2/4
{"2.2.13.3. Thiet lap 'User Account Control: Detect application installations and prompt for elevation'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Detect application installations and prompt for elevation
# * Luu y: Khi phat hien goi cai dat ung dung yeu cau nang cao dac quyen, nguoi dung se duoc nhac nhap ten va mat khau quan tri. Neu nguoi dung nhap thong tin xac thuc hop le, viec cai dat se tiep tuc voi dac quyen duoc ap dung.
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'EnableInstallerDetection' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'EnableInstallerDetection').ToString().Split('')[12].Trim() -ne [int]'0x1'
1
###################################### PASSED 1/4
{"2.2.13.4. Thiet lap 'User Account Control: Only elevate UIAccess applications that are installed in secure locations'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Only elevate UIAccess applications that are installed in secure locations
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'EnableSecureUIAPaths' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'EnableSecureUIAPaths').ToString().Split('')[12].Trim() -ne [int]'0x1'
1
###################################### PASSED 1/4
{"2.2.13.5. Thiet lap 'User Account Control: Run all administrators in Admin Approval Mode'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'EnableLUA' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'EnableLUA').ToString().Split('')[12].Trim() -ne [int]'0x1'
1
###################################### PASSED 1/4
{"2.2.13.6. Thiet lap 'User Account Control: Switch to the secure desktop when prompting for elevation'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Switch to the secure desktop when prompting for elevation
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'PromptOnSecureDesktop' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'PromptOnSecureDesktop').ToString().Split('')[12].Trim() -ne [int]'0x1'
1
###################################### PASSED 1/4
{"2.2.13.7. Thiet lap 'User Account Control: Virtualize file and registry write failures to per-user locations'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Enabled
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Virtualize file and registry write failures to per-user locations
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'EnableVirtualization' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[FAILED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'EnableVirtualization').ToString().Split('')[12].Trim() -ne [int]'0x1'
1
###################################### PASSED 1/4
{"2.2.13.8. Thiet lap 'User Account Control: Behavior of the elevation prompt for standard users' is set to 'Automatically deny elevation requests'" : "FAILED"}
######################################
# Cai dat nay nang cao nhan thuc cho nguoi dung rang chuong trinh yeu cau su dung cac hoat dong dac quyen nang cao va yeu cau nguoi dung co the cung cap thong tin dang nhap quan tri de thuc hien thao tac chay chuong trinh.
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Automatically deny elevation requests
# Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -ne $true
True
-------------------
[FAILED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'ConsentPromptBehaviorUser' | Measure-Object | ForEach-Object { $_.Count } -ne 1
1
-------------------
[PASSED]
#[int](REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-String 'ConsentPromptBehaviorUser').ToString().Split('')[12].Trim() -ne [int]'0x0'
3
###################################### PASSED 2/4
{"3.1.1. Thiet lap trang thai 'Windows Firewall: Domain: Firewall state'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: On
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Domain Profile\Firewall state
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.1.2. Thiet lap trang thai 'Windows Firewall: Domain: Inbound connections'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Block
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Domain Profile\Inbound connections
# * Luu y: Dam bao chi mo cac ket noi can thiet, khong mo theo dai IP.
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.1.3. Thiet lap trang thai 'Windows Firewall: Domain: Outbound connections'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Allow
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Domain Profile\Outbound connections
# * Luu y: Dam bao chi mo cac ket noi can thiet, khong mo theo dai IP.
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.1.4. Cau hinh vi tri luu tru nhat ky 'Windows Firewall: Domain: Logging: Name'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: %SystemRoot%\System32\logfiles\firewall\domainfw.log
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Domain Profile\Logging Customize\Name
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.1.5. Cau hinh kich thuoc gioi han 'Windows Firewall: Domain: Logging: Size limit (KB)'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: >= 16,384 KB
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Domain Profile\Logging Customize\Size limit (KB)
# * Luu y: Tep nhat ky se bi gioi han o kich thuoc duoc chi dinh, cac su kien cu se bi ghi de boi cac su kien moi hon khi dat den gioi han.
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.1.6. Thiet lap chinh sach 'Windows Firewall: Domain: Logging: Log dropped packets'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi thiet lap de xuat: Yes
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Domain Profile\Logging Customize\Log dropped packets
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.1.7. Thiet lap chinh sach 'Windows Firewall: Domain: Logging: Log successful connections'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi thiet lap de xuat: Yes
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Domain Profile\Logging Customize\Log successful connections
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.1.8. Thiet lap chinh sach 'Windows Firewall: Domain: Settings: Display a notification'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi thiet lap de xuat: No
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Domain Profile\Settings Customize\Display a notification
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.2.1. Thiet lap trang thai 'Windows Firewall: Private: Firewall state'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: On
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Firewall state
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.2.2. Thiet lap trang thai 'Windows Firewall: Private: Inbound connections'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Block
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Inbound connections
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.2.3. Thiet lap trang thai 'Windows Firewall: Private: Outbound connections'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Allow
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Outbound connections
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.2.4. Cau hinh vi tri luu tru nhat ky 'Windows Firewall: Private: Logging: Name'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: %SystemRoot%\System32\logfiles\firewall\privatefw.log
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Logging Customize\Name
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.2.5. Cau hinh kich thuoc gioi han 'Windows Firewall: Private: Logging: Size limit (KB)'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: >= 16,384 KB
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Logging Customize\Size limit (KB)
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.2.6. Thiet lap chinh sach 'Windows Firewall: Private: Logging: Log dropped packets'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi thiet lap de xuat: Yes
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Logging Customize\Log dropped packets
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.2.7. Thiet lap chinh sach 'Windows Firewall: Private: Logging: Log successful connections'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi thiet lap de xuat: Yes
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Logging Customize\Log successful connections
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile\Logging' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.2.8. Thiet lap trang thai 'Windows Firewall: Private: Settings: Display a notification'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi thiet lap de xuat: No
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Settings Customize\Display a notification
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.3.1. Thiet lap trang thai 'Windows Firewall: Public: Firewall state'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: On
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Firewall state
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.3.2. Thiet lap trang thai 'Windows Firewall: Public: Inbound connections'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Block
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Inbound connections
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.3.3. Thiet lap trang thai 'Windows Firewall: Public: Outbound connections'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi trang thai de xuat: Allow
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Outbound connections
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.3.4. Cau hinh vi tri luu tru nhat ky 'Windows Firewall: Public: Logging: Name'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: %SystemRoot%\System32\logfiles\firewall\publicfw.log
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Logging Customize\Name\
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.3.5. Cau hinh kich thuoc gioi han 'Windows Firewall: Public: Logging: Size limit (KB)'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: >= 16,384 KB
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\PublicProfile\Logging Customize\Size limit (KB)
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.3.6. Thiet lap chinh sach 'Windows Firewall: Public: Logging: Log dropped packets'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi thiet lap de xuat: Yes
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Logging Customize\Log dropped packets
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.3.7. Thiet lap chinh sach 'Windows Firewall: Public: Logging: Log successful connections'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi thiet lap de xuat: Yes
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\PublicProfile\Logging Customize\Log successful connections
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\Logging' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.3.8. Thiet lap trang thai 'Windows Firewall: Public: Settings: Display a notification'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi thiet lap de xuat: No
# Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Settings Customize\Display a notification
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"3.3.9. Thiet lap trang thai 'Windows Firewall: Public: Settings: Apply local connection security rules'" : "FAILED"}
######################################

-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"4.1.1. Cau hinh chinh sach 'Audit Credential Validation'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon\Audit Credential Validation
-------------------
[FAILED]
#auditpol /get /category:* | Select-String "Credential Validation" | ForEach-Object { "$(($_ -split '\s+',4)[3])" } -eq "Success and Failure"
No Auditing
###################################### PASSED 0/1
{"4.1.2. Cau hinh chinh sach 'Audit Kerberos Authentication Service' [Chi DC]" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon\Audit Kerberos Authentication Service
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Kerberos Authentication Service" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success and Failure"
No Auditing
###################################### PASSED 0/1
{"4.1.3. Cau hinh chinh sach 'Audit Kerberos Service Ticket Operations' [Chi DC]" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Logon\Audit Kerberos Service Ticket Operations
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Kerberos Service Ticket Operations" | ForEach-Object { "$(($_ -split '\s+',6)[5])" } -eq "Success and Failure"
No Auditing
###################################### PASSED 0/1
{"4.2.1. Cau hinh chinh sach 'Audit Application Group Management'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Application Group Management
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Application Group Management" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success and Failure"
Success
###################################### PASSED 0/1
{"4.2.2. Cau hinh chinh sach 'Audit Computer Account Management' [Chi DC]" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Computer Account Management
-------------------
[PASSED]
#auditpol.exe /get /category:* | Select-String "Computer Account Management" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success"
Success
###################################### PASSED 1/1
{"4.2.3. Cau hinh chinh sach 'Audit Distribution Group Management' [Chi DC]" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Distribution Group Management
-------------------
[PASSED]
#auditpol.exe /get /category:* | Select-String "Distribution Group Management" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success"
Success
###################################### PASSED 1/1
{"4.2.4. Cau hinh chinh sach 'Audit Other Account Management Events' [Chi DC]" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Other Account Management Events
-------------------
[PASSED]
#auditpol.exe /get /category:* | Select-String "Other Account Management Events" | ForEach-Object { "$(($_ -split '\s+',6)[5])" } -eq "Success"
Success
###################################### PASSED 1/1
{"4.2.5. Cau hinh chinh sach 'Audit Security Group Management'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit Security Group Management
-------------------
[PASSED]
#auditpol.exe /get /category:* | Select-String "Security Group Management" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success"
Success
###################################### PASSED 1/1
{"4.2.6. Cau hinh chinh sach 'Audit User Account Management'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "User Account Management" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success and Failure"
Success
###################################### PASSED 0/1
{"4.3.1. Cau hinh chinh sach 'Audit Process Creation'" : "PASSED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Detailed Tracking\Audit Process Creation
-------------------
[PASSED]
#auditpol.exe /get /category:* | Select-String "Process Creation" | ForEach-Object { "$(($_ -split '\s+',4)[3])" } -eq "Success"
Success
###################################### PASSED 1/1
{"4.3.2. Cau hinh chinh sach 'Audit PNP Activity'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Detailed Tracking\Audit PNP Activity
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Plug and Play Events" | ForEach-Object { "$(($_ -split '\s+',6)[5])" } -eq "Success"
###################################### PASSED 0/1
{"4.4.1. Cau hinh chinh sach 'Audit Directory Service Access' [Chi DC]" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Access
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Directory Service Access" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Failure"
No Auditing
###################################### PASSED 0/1
{"4.4.2. Cau hinh chinh sach 'Audit Directory Service Changes' [Chi DC]" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Changes
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Directory Service Changes" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success"
No Auditing
###################################### PASSED 0/1
{"4.5.1. Cau hinh chinh sach 'Audit Account Lockout'" : "FAILED"}
{"4.5.2. Cau hinh chinh sach 'Audit Logoff'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logoff
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String " Logoff " | ForEach-Object { "$(($_ -split '\s+',3)[2])" } -eq "Success"
No Auditing
###################################### PASSED 0/1
{"4.5.3. Cau hinh chinh sach 'Audit Logon'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Logon
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String " Logon " | ForEach-Object { "$(($_ -split '\s+',3)[2])" } -eq "Success and Failure"
No Auditing
Logon                           No Auditing
Account Logon Events              No Auditing
###################################### PASSED 0/1
{"4.5.4. Cau hinh chinh sach 'Audit Other Logon/Logoff Events'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Other Logon/Logoff Events
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Other Logon/Logoff Events" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success and Failure"
No Auditing
###################################### PASSED 0/1
{"4.5.5. Cau hinh chinh sach 'Audit Special Logon'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Special Logon
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Special Logon" | ForEach-Object { "$(($_ -split '\s+',4)[3])" } -eq "Success"
No Auditing
###################################### PASSED 0/1
{"4.5.6. Cau hinh chinh sach 'Audit Group Membership'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Logon/Logoff\Audit Group Membership
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Group Membership" | ForEach-Object { "$(($_ -split '\s+',4)[3])" } -eq "Success"
###################################### PASSED 0/1
{"4.6.1. Cau hinh chinh sach 'Audit Detailed File Share'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit Detailed File Share
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Detailed File Share" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Failure"
No Auditing
###################################### PASSED 0/1
{"4.6.2. Cau hinh chinh sach 'Audit File Share'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit File Share
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String " File Share" | ForEach-Object { "$(($_ -split '\s+',4)[3])" } -eq "Success and Failure"
No Auditing
Share                     No Auditing
###################################### PASSED 0/1
{"4.6.3. Cau hinh chinh sach 'Audit Other Object Access Events'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit Other Object Access Events
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Other Object Access Events" | ForEach-Object { "$(($_ -split '\s+',6)[5])" } -eq "Success and Failure"
No Auditing
###################################### PASSED 0/1
{"4.6.4. Cau hinh chinh sach 'Audit Removable Storage'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Object Access\Audit Removable Storage
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Removable Storage" | ForEach-Object { "$(($_ -split '\s+',4)[3])" } -eq "Success and Failure"
No Auditing
###################################### PASSED 0/1
{"4.7.1. Cau hinh chinh sach 'Audit Audit Policy Change'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Audit Policy Change
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Audit Policy Change" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success"
No Auditing
###################################### PASSED 0/1
{"4.7.2. Cau hinh chinh sach 'Audit Authentication Policy Change'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Authentication Policy Change
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Authentication Policy Change" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success"
No Auditing
###################################### PASSED 0/1
{"4.7.3. Cau hinh chinh sach 'Audit Authorization Policy Change'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Authorization Policy Change
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Authorization Policy Change" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success"
No Auditing
###################################### PASSED 0/1
{"4.7.4. Cau hinh chinh sach 'Audit MPSSVC Rule-Level Policy Change'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit MPSSVC Rule-Level Policy Change
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "MPSSVC Rule-Level Policy Change" | ForEach-Object { "$(($_ -split '\s+',6)[5])" } -eq "Success and Failure"
No Auditing
###################################### PASSED 0/1
{"4.7.5. Cau hinh chinh sach 'Audit Other Policy Change Events'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Other Policy Change Events
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Other Policy Change Events" | ForEach-Object { "$(($_ -split '\s+',6)[5])" } -eq "Failure"
No Auditing
###################################### PASSED 0/1
{"4.8.1. Cau hinh chinh sach 'Audit Sensitive Privilege Use'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Privilege Use\Audit Sensitive Privilege Use
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String " Sensitive Privilege Use " | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success and Failure"
Use             No Auditing
No Auditing
###################################### PASSED 0/1
{"4.9.1. Cau hinh chinh sach 'Audit IPsec Driver'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit IPsec Driver
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "IPsec Driver" | ForEach-Object { "$(($_ -split '\s+',4)[3])" } -eq "Success and Failure"
No Auditing
###################################### PASSED 0/1
{"4.9.2. Cau hinh chinh sach 'Audit Other System Events'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Other System Events
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Other System Events" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success and Failure"
No Auditing
###################################### PASSED 0/1
{"4.9.3. Cau hinh chinh sach 'Audit Security State Change'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Security State Change
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Security State Change" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success"
No Auditing
###################################### PASSED 0/1
{"4.9.4. Cau hinh chinh sach 'Audit Security System Extension'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Security System Extension
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "Security System Extension" | ForEach-Object { "$(($_ -split '\s+',5)[4])" } -eq "Success"
No Auditing
###################################### PASSED 0/1
{"4.9.5. Cau hinh chinh sach 'Audit System Integrity'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Success and Failure
# Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit System Integrity
-------------------
[FAILED]
#auditpol.exe /get /category:* | Select-String "System Integrity" | ForEach-Object { "$(($_ -split '\s+',4)[3])" } -eq "Success and Failure"
No Auditing
###################################### PASSED 0/1
{"5.1.1. Cau hinh chinh sach 'Turn off app notifications on the lock screen'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Enabled
# Computer Configuration\Policies\Administrative Templates\System\Logon\Turn off app notifications on the lock screen
# * Luu y: Duong dan Chinh sach Nhom nay co the khong ton tai, duoc cung cap boi mau Chinh sach Nhom CredentialProviders.admx/adml bao gom trong Mau quan tri Microsoft Windows 8.0 & Server 2012 (non-R2) (hoac cac phien ban moi hon).
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" -ne $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" | Select-String 'DisableLockScreenAppNotifications' | Measure-Object | ForEach-Object { $_.Count } -ne 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:45 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"5.1.2. Cau hinh chinh sach 'Turn off picture password sign-in'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Enabled
# Computer Configuration\Policies\Administrative Templates\System\Logon\Turn off picture password sign-in
# * Luu y: Duong dan Chinh sach Nhom nay co the khong ton tai, duoc cung cap boi mau Chinh sach Nhom CredentialProviders.admx/adml bao gom trong Microsoft Windows 8.0 & Server 2012 (non-R2) (hoac cac phien ban moi hon).
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" -ne $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" | Select-String 'BlockDomainPicturePassword' | Measure-Object | ForEach-Object { $_.Count } -ne 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:45 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"5.1.3. Cau hinh chinh sach 'Turn on convenience PIN sign-in'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Disabled
# Computer Configuration\Policies\Administrative Templates\System\Logon\Turn on convenience PIN sign-in
# * Luu y: Duong dan Chinh sach Nhom nay co the khong ton tai, duoc cung cap boi mau Chinh sach Nhom CredentialProviders.admx/adml bao gom trong Mau quan tri Microsoft Windows 8.0 & Server 2012 (non-R2) (hoac cac phien ban moi hon).
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" -ne $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" | Select-String 'AllowDomainPINLogon' | Measure-Object | ForEach-Object { $_.Count } -ne 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:45 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"5.1.4. Cau hinh chinh sach 'Block user from showing account details on sign-in'" : "FAILED"}
######################################
# Nguoi dung khong the chon hien thi chi tiet tai khoan tren man hinh dang nhap.
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Disabled
# Computer Configuration\Policies\Administrative Templates\System\Logon\Block user from showing account details on sign-in
# * Luu y: Duong dan Group Policy nay co the khong ton tai trong mac dinh. No duoc cung cap boi Logon.admx/adml di kem voi Microsoft Windows 10 Release 1607 & Server 2016 Administrative Templates
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" -ne $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" | Select-String 'BlockUserFromShowingAccountDetailsOnSignin' | Measure-Object | ForEach-Object { $_.Count } -ne 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:47 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"5.1.5. Cau hinh chinh sach 'Do not display network selection UI'" : "FAILED"}
######################################
# Ngan can nguoi dung trai phep co the ngat ket noi PC khoi mang hoac co the ket noi PC voi cac mang kha dung khac ma khong can dang nhap vao Windows
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Enabled
# Computer Configuration\Policies\Administrative Templates\System\Logon\Do not display network selection UI
# * Luu y: Duong dan Group Policy nay co the khong ton tai trong mac dinh. No duoc cung cap boi Logon.admx/adml di kem voi Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates (or newer)
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" -ne $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" | Select-String 'DontDisplayNetworkSelectionUI' | Measure-Object | ForEach-Object { $_.Count } -ne 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:47 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"5.1.6. Cau hinh chinh sach 'Do not enumerate connected users on domain joined computers'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Enabled
# Computer Configuration\Policies\Administrative Templates\System\Logon\Do not enumerate connected users on domain-joined computers
# * Luu y: Duong dan Group Policy nay co the khong ton tai trong mac dinh. No duoc cung cap boi Logon.admx/adml di kem voi Microsoft Windows 8.1 & Server 2012 R2 Administrative Templates (or newer)
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" -ne $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" | Select-String 'DontEnumerateConnectedUsers' | Measure-Object | ForEach-Object { $_.Count } -ne 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:45 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"5.1.7. Cau hinh chinh sach 'Enumerate local users on domain-joined computers' [Chi MS]" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Disabled
# Computer Configuration\Policies\Administrative Templates\System\Logon\Enumerate local users on domain-joined computers
# * Luu y: Duong dan Group Policy nay co the khong ton tai trong mac dinh. No duoc cung cap boi Logon.admx/adml di kem voi Microsoft Windows 8.0 & Server 2012 (non R2) Administrative Templates (or newer)
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" -ne $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" | Select-String 'EnumerateLocalUsers' | Measure-Object | ForEach-Object { $_.Count } -ne 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:45 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
{"5.2.1. Cau hinh chinh sach 'Require a password when a computer wakes (on battery)'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Enabled
# Computer Configuration\Policies\Administrative Templates\System\Power Management\Sleep Settings\Require a password when a computer wakes (on battery)
# * Luu y: Duong dan Chinh sach Nhom nay co the khong ton tai, duoc cung cap boi mau Chinh sach Nhom Power.admx/adml bao gom trong Mau quan tri Microsoft Windows 8.0 & Server 2012 (non-R2) (hoac cac phien ban moi hon).
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"5.2.2. Cau hinh chinh sach 'Require a password when a computer wakes (plugged in)'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Enabled
# Computer Configuration\Policies\Administrative Templates\System\Power Management\Sleep Settings\Require a password when a computer wakes (plugged in)
# * Luu y: Duong dan Chinh sach Nhom nay co the khong ton tai, duoc cung cap boi mau Chinh sach Nhom Power.admx/adml bao gom trong Mau quan tri Microsoft Windows 8.0 & Server 2012 (non-R2) (hoac cac phien ban moi hon).
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"5.3.1. Cau hinh chinh sach 'Disallow Autoplay for non-volume devices'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Enabled
# Computer Configuration\Policies\Administrative Templates\Windows Components\AutoPlay Policies\Disallow Autoplay for non-volume devices
# * Luu y: Duong dan Chinh sach Nhom nay co the khong ton tai, duoc cung cap boi mau Chinh sach Nhom AutoPlay.admx/adml bao gom trong Mau quan tri Microsoft Windows 8.0 & Server 2012 (non-R2) (hoac cac phien ban moi hon).
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"5.3.2. Cau hinh chinh sach 'Set the default behavior for AutoRun'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Enabled: Do not execute any autorun commands
# Computer Configuration\Policies\Administrative Templates\Windows Components\AutoPlay Policies\Set the default behavior for AutoRun
# * Luu y: Duong dan Chinh sach Nhom nay co the khong ton tai, duoc cung cap boi mau Chinh sach Nhom AutoPlay.admx/adml bao gom trong Mau quan tri Microsoft Windows 8.0 & Server 2012 (non-R2) (hoac cac phien ban moi hon).
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name version
PSArgumentException
-------------------
[FAILED]
#Test-Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -ne $true
True
-------------------
[PASSED]
#REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" | Select-String 'NoAutorun' | Measure-Object | ForEach-Object { $_.Count } -ne 1
0
-------------------
You cannot call a method on a null-valued expression.
At line:45 char:44
+     Write-Output "-------------------"; if ($([int](REG QUERY 
"HKEY_LOCAL_MACHINE\S ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull
 
###################################### PASSED 2/4
Khong tim thay gia tri NoDriveTypeAutoRun trong registry.
{"5.3.3. Cau hinh chinh sach 'Turn off Autoplay'" : "FAILED"}
{"5.4.1.1. Thiet lap chinh sach 'Application: Control Event Log behavior when the log file reaches its maximum size'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Disabled
# Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Application\Control Event Log behavior when the log file reaches its maximum size
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"5.4.1.2. Thiet lap chinh sach 'Application: Specify the maximum log file size (KB)'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Enabled: >= 32,768
# Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Application\Specify the maximum log file size (KB)
# * Luu y:
# *	De giam thieu rui ro mat du lieu khi viec ghi nhat ky bi day, co the ap dung cac chinh sach (data retention) de lua chon luu giu cac su kien cu nao duoc ghi de khi can.
# *	He qua cua viec cau hinh chinh sach nay la cac su kien cu hon se bi xoa khoi nhat ky. Ke tan cong co the loi dung de tao ra mot so luong lon cac su kien khong lien quan nham ghi de len cac bang chung ve cuoc tan cong.
# => Tot nhat, nen su dung cac giai phap giam sat cu the. Neu tat ca cac su kien duoc gui den mot may chu giam sat se ho tro cho viec thu thap thong tin va cac hoat dong dieu tra ve sau.
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"5.4.2.1. Thiet lap chinh sach 'Security: Control Event Log behavior when the log file reaches its maximum size'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Disabled
# Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Security\Control Event Log behavior when the log file reaches its maximum size
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"5.4.2.2. Thiet lap chinh sach 'Security: Specify the maximum log file size (KB)'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Enabled: >= 196,608
# Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\ Security\Specify the maximum log file size (KB)
# * Luu y:
# *	De giam thieu rui ro mat du lieu khi viec ghi nhat ky bi day, co the ap dung cac chinh sach (data retention) de lua chon luu giu cac su kien cu nao duoc ghi de khi can.
# *	He qua cua viec cau hinh chinh sach nay la cac su kien cu hon se bi xoa khoi nhat ky. Ke tan cong co the loi dung de tao ra mot so luong lon cac su kien khong lien quan nham ghi de len cac bang chung ve cuoc tan cong.
# => Tot nhat, nen su dung cac giai phap giam sat cu the. Neu tat ca cac su kien duoc gui den mot may chu giam sat se ho tro cho viec thu thap thong tin va cac hoat dong dieu tra ve sau.
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"5.4.3.1. Thiet lap chinh sach 'Setup: Control Event Log behavior when the log file reaches its maximum size'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Disabled
# Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Setup\Control Event Log behavior when the log file reaches its maximum size
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"5.4.3.2. Thiet lap chinh sach 'Setup: Specify the maximum log file size (KB)'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Enabled: >= 32,768
# Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\Setup\Specify the maximum log file size (KB)
# * Luu y:
# *	De giam thieu rui ro mat du lieu khi viec ghi nhat ky bi day, co the ap dung cac chinh sach (data retention) de lua chon luu giu cac su kien cu nao duoc ghi de khi can.
# *	He qua cua viec cau hinh chinh sach nay la cac su kien cu hon se bi xoa khoi nhat ky. Ke tan cong co the loi dung de tao ra mot so luong lon cac su kien khong lien quan nham ghi de len cac bang chung ve cuoc tan cong.
# => Tot nhat, nen su dung cac giai phap giam sat cu the. Neu tat ca cac su kien duoc gui den mot may chu giam sat se ho tro cho viec thu thap thong tin va cac hoat dong dieu tra ve sau.
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"5.4.4.1. Thiet lap chinh sach 'System: Control Event Log behavior when the log file reaches its maximum size'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Disabled
# Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\System\Control Event Log behavior when the log file reaches its maximum size
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"5.4.4.2. Thiet lap chinh sach 'System: Specify the maximum log file size (KB)'" : "FAILED"}
######################################
# Cau hinh tham so theo duong dan sau voi khuyen nghi: Enabled: >= 32,768
# Computer Configuration\Policies\Administrative Templates\Windows Components\Event Log Service\System\Specify the maximum log file size (KB)
# * Luu y:
# *	De giam thieu rui ro mat du lieu khi viec ghi nhat ky bi day, co the ap dung cac chinh sach (data retention) de lua chon luu giu cac su kien cu nao duoc ghi de khi can.
# *	He qua cua viec cau hinh chinh sach nay la cac su kien cu hon se bi xoa khoi nhat ky. Ke tan cong co the loi dung de tao ra mot so luong lon cac su kien khong lien quan nham ghi de len cac bang chung ve cuoc tan cong.
# => Tot nhat, nen su dung cac giai phap giam sat cu the. Neu tat ca cac su kien duoc gui den mot may chu giam sat se ho tro cho viec thu thap thong tin va cac hoat dong dieu tra ve sau.
-------------------
#Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\EventLog\System' -Name version
ItemNotFoundException
###################################### PASSED 0/4
{"6.1. Cai dat va cap nhat cac ban va bao mat" : "NONE"}

Source        Description      HotFixID      InstalledBy          InstalledOn  
------        -----------      --------      -----------          -----------  
APP-WEBCMS01  Update           KB2934520     NT AUTHORITY\SYSTEM  6/8/2021 1...


{"7. Kiem tra cai dat phan mem Anti-virus" : "NONE"}
Khong co trinh diet virus dang chay tren may.
Khong co trinh diet virus duoc cai dat tren may.
{"7.1. Kiem tra trang thai phan mem" : "FAILED"}
Khong co trinh diet virus duoc cai dat tren may.
