操作系统安全状态检查
加入以下检查：
1 所有账号应该有密码，
2 密码策略是否要求包含数字和大小写字母，
3 密码策略是否要求90天强制更新一次，
4 连续5次输入错误密码，账号锁定30分钟
5 密码不能复用最近3次密码
6 登录界面不显示用户名，需要手动输入
`# 检查管理员权限
$isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) {
Write-Host "[!] 警告: 未检测到管理员权限！部分策略将无法读取，请右键以管理员身份运行。" -ForegroundColor Yellow
}
Write-Host "n=========================================" -ForegroundColor Cyan Write-Host " Windows 安全基线全面检查报告 (PS 5.1 兼容版)" -ForegroundColor Cyan Write-Host "=========================================n" -ForegroundColor Cyan
==========================================
1. 账户基础检查 (使用 WMI，100%兼容)
==========================================
$localUsers = Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount=True" -ErrorAction SilentlyContinue
$guest = $localUsers | Where-Object { $_.Name -eq 'Guest' }
$guestEnabled = if ($guest) { -not $guest.Disabled } else { $null }
$admin = $localUsers | Where-Object { $_.SID -like '*-500' }
$adminName = if ($admin) { $admin.Name } else { "" }
$adminRenamed = if ($admin) { $admin.Name -ne "Administrator" } else { $null }
$excludeNames = @('Guest', 'DefaultAccount', 'WDAGUtilityAccount')
$noPwdUsers = $localUsers | Where-Object {
$.PasswordRequired -eq $false -and
$.Disabled -eq $false -and
$_.Name -notin $excludeNames
}
==========================================
2. 密码与锁定策略检查 (secedit 字节流读取)
==========================================
$tempFile = [System.IO.Path]::GetTempFileName()
$secPolicy = @{}
try {
$null = secedit /export /cfg $tempFile /areas SECURITYPOLICY 2>&1
if ($LASTEXITCODE -eq 0 -and (Test-Path $tempFile)) {
$bytes = [System.IO.File]::ReadAllBytes($tempFile)
$content = [System.Text.Encoding]::Unicode.GetString($bytes)
if ($content -notmatch 'MinimumPasswordLength') {
$content = [System.Text.Encoding]::Default.GetString($bytes)
}
if ($content -match 'MinimumPasswordLength\s=\s(\d+)') { $secPolicy.MinLen = [int]$matches[1] }
if ($content -match 'PasswordComplexity\s=\s(\d+)') { $secPolicy.Complexity = [int]$matches[1] }
if ($content -match 'MaximumPasswordAge\s=\s(\d+)') { $secPolicy.MaxAge = [int]$matches[1] }
if ($content -match 'PasswordHistorySize\s=\s(\d+)') { $secPolicy.HistorySize = [int]$matches[1] }
if ($content -match 'LockoutBadCount\s=\s(\d+)') { $secPolicy.LockoutCount = [int]$matches[1] }
if ($content -match 'LockoutDuration\s=\s(\d+)') { $secPolicy.LockoutTime = [int]$matches[1] }
}
} catch {
Write-Host "[-] 导出安全策略失败: $_" -ForegroundColor Red
} finally {
if (Test-Path $tempFile) { Remove-Item $tempFile -Force -ErrorAction SilentlyContinue }
}
==========================================
3. 无操作自动锁屏检查 (注册表 HKCU)
==========================================
$regPaths = @(
"HKCU:\Software\Policies\Microsoft\Windows\Control Panel\Desktop",
"HKCU:\Control Panel\Desktop"
)
$timeout = $null; $active = $null; $secure = $null
foreach ($regPath in $regPaths) {
if (Test-Path $regPath) {
$props = Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue
if ($null -eq $timeout -and $null -ne $props.ScreenSaveTimeOut) { $timeout = [int]$props.ScreenSaveTimeOut }
if ($null -eq $active -and $null -ne $props.ScreenSaveActive) { $active = $props.ScreenSaveActive }
if ($null -eq $secure -and $null -ne $props.ScreenSaverIsSecure) { $secure = $props.ScreenSaverIsSecure }
}
}
==========================================
4. 登录界面隐藏用户名检查 (注册表 HKLM)
==========================================
$regPathLogin = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
$dontDisplayLastUser = $null
if (Test-Path $regPathLogin) {
$loginProps = Get-ItemProperty -Path $regPathLogin -Name "DontDisplayLastUserName" -ErrorAction SilentlyContinue
if ($loginProps -and $loginProps.DontDisplayLastUserName -ne $null) {
$dontDisplayLastUser = [int]$loginProps.DontDisplayLastUserName
}
}
==========================================
5. 格式化输出报告
==========================================
Write-Host "[账户基础检查]" -ForegroundColor Magenta
if ($guestEnabled -eq $false) { Write-Host " [+] 合规: Guest 账户已禁用。" -ForegroundColor Green } elseif ($guestEnabled -eq $true) { Write-Host " [!] 风险: Guest 账户处于启用状态！" -ForegroundColor Red }
else { Write-Host " [-] 未知: 无法获取 Guest 状态。" -ForegroundColor Yellow }
if ($adminRenamed -eq $true) { Write-Host " [+] 合规: 内置 Admin 已改名为 [$adminName]。" -ForegroundColor Green } elseif ($adminRenamed -eq $false) { Write-Host " [!] 风险: 内置 Admin 未改名，仍为 Administrator！" -ForegroundColor Red }
else { Write-Host " [-] 未知: 无法获取 Admin 状态。" -ForegroundColor Yellow }
if ($noPwdUsers -and $noPwdUsers.Count -gt 0) {
$names = ($noPwdUsers | Select-Object -ExpandProperty Name) -join ", "
Write-Host " [!] 风险: 发现无密码的启用账号: [$names]！" -ForegroundColor Red
} else {
Write-Host " [+] 合规: 所有启用的本地账号均已设置密码。" -ForegroundColor Green
}
Write-Host "n[密码策略检查]" -ForegroundColor Magenta $minLen = $secPolicy.MinLen if ($minLen -ge 8) { Write-Host " [+] 合规: 密码最低长度为 $minLen 位 (>=8)。" -ForegroundColor Green }
elseif ($null -ne $minLen) { Write-Host " [!] 风险: 密码最低长度为 $minLen 位，低于 8 位要求！" -ForegroundColor Red }`
else { Write-Host " [-] 未知: 无法获取密码长度 (需管理员权限)。" -ForegroundColor Yellow }
$complexity = $secPolicy.Complexity
if ($complexity -eq 1) { Write-Host " [+] 合规: 密码已要求包含数字和大小写字母(复杂性启用)。" -ForegroundColor Green } elseif ($complexity -eq 0) { Write-Host " [!] 风险: 密码未要求复杂性(可设置纯数字/简单密码)！" -ForegroundColor Red }
else { Write-Host " [-] 未知: 无法获取密码复杂性策略。" -ForegroundColor Yellow }
$maxAge = $secPolicy.MaxAge
if ($maxAge -gt 0 -and $maxAge -le 90) { Write-Host " [+] 合规: 密码最长使用期限为 $maxAge 天 (<=90天)。" -ForegroundColor Green } elseif ($maxAge -eq 0) { Write-Host " [!] 风险: 密码设置为'永不过期'，不符合90天更新要求！" -ForegroundColor Red }
elseif ($null -ne $maxAge) { Write-Host " [!] 风险: 密码最长使用期限为 $maxAge 天，大于 90 天！" -ForegroundColor Red }`
else { Write-Host " [-] 未知: 无法获取密码使用期限。" -ForegroundColor Yellow }
$historySize = $secPolicy.HistorySize
if ($historySize -ge 3) { Write-Host " [+] 合规: 强制密码历史为记住 $historySize 个旧密码 (>=3)。" -ForegroundColor Green } elseif ($null -ne $historySize) { Write-Host " [!] 风险: 强制密码历史为记住 $historySize 个旧密码，低于要求的 3 个！" -ForegroundColor Red }
else { Write-Host " [-] 未知: 无法获取强制密码历史策略。" -ForegroundColor Yellow }
Write-Host "`n[账户锁定策略检查]" -ForegroundColor Magenta
$lockCount = $secPolicy.LockoutCount
$lockTime = $secPolicy.LockoutTime
if ($null -ne $lockCount -and $null -ne $lockTime) {
$countOk = ($lockCount -gt 0 -and $lockCount -le 5)
$timeOk = ($lockTime -ge 30)
if ($countOk -and $timeOk) {
Write-Host " [+] 合规: 连续 $lockCount 次错误后锁定 $lockTime 分钟 (阈值<=5, 时间>=30)。" -ForegroundColor Green
} else {
Write-Host " [!] 风险: 锁定策略不合规！当前为: 错误 $lockCount 次后锁定 $lockTime 分钟。" -ForegroundColor Red
Write-Host " -> 要求: 连续5次错误锁定，且锁定时间至少30分钟。" -ForegroundColor Gray
}
} else {
Write-Host " [-] 未知: 无法获取账户锁定策略 (需管理员权限)。" -ForegroundColor Yellow
}
Write-Host "`n[无操作自动锁屏检查]" -ForegroundColor Magenta
if ($null -ne $timeout) {
$min = [math]::Round($timeout / 60, 1)
$isActive = ($active -eq "1" -or $active -eq 1)
$isLocked = ($secure -eq "1" -or $secure -eq 1)
if ($isActive -and $isLocked -and $timeout -le 600) {
Write-Host " [+] 合规: 无操作 $min 分钟后自动锁屏 (<=10分钟)，且需密码恢复。" -ForegroundColor Green
} else {
Write-Host " [!] 风险: 锁屏策略不合规 (超时:$min分钟, 屏保启用:$isActive, 恢复需密码:$isLocked)。" -ForegroundColor Red
}
} else {
Write-Host " [!] 风险: 未配置无操作自动锁屏策略。" -ForegroundColor Red
}
Write-Host "`n[登录界面策略检查]" -ForegroundColor Magenta
if ($dontDisplayLastUser -eq 1) {
Write-Host " [+] 合规: 登录界面已设置为不显示上次登录的用户名 (需手动输入)。" -ForegroundColor Green
} elseif ($null -ne $dontDisplayLastUser) {
Write-Host " [!] 风险: 登录界面仍显示上次登录的用户名，未启用隐藏策略。" -ForegroundColor Red
} else {
Write-Host " [-] 未知: 未配置登录界面隐藏用户名策略 (Windows 默认会显示)。" -ForegroundColor Yellow
}
Write-Host "n=========================================n" -ForegroundColor Cyan`
浙公网安备 33010602011771号