Page History

winrm quickconfig

C:\Users\Administrateur> winrm quickconfig  

WinRM n'est pas configuré pour la gestion à distance de cet ordinateur.
Les modifications suivantes doivent être effectuées :

Créez un écouteur WinRM sur HTTP://* pour accepter les demandes de la gestion des services Web sur toutes les adresses IP de cet ordinateur.

Activez l'exception de pare-feu WinRM.
Configurez LocalAccountTokenFilterPolicy pour attribuer des droits d'administration à distance à des utilisateurs locaux.

Effectuer ces modifications [y/n] ? y

WinRM a été mis à jour pour la gestion à distance.

Écouteur WinRM créé sur HTTP://* pour accepter les demandes de la gestion des services Web sur toutes les adresses IP de cet ordinateur.

Exception de pare-feu WinRM activée.
LocalAccountTokenFilterPolicy configuré pour attribuer des droits d'administration à distance à des utilisateurs locaux.

Attention, Sur Windows10 et Windows11 l'hôte a besoin d'être en réseau privé et non public qui est par défaut. Sinon la configuration sera bloquée et non appliquée :

Avant d’utiliser ce script, lire attentivement les points recommandés suivants :

• Lecture préalable recommandée

  • Le script modifie la configuration système (WinRM, WMI, services, permissions).

• Environnement de test recommandé

  • Exécutez d’abord le script dans un environnement de test ou sur un serveur non critique.

  • Ne déployez en production qu’après validation de son bon fonctionnement.

• Privilèges administratifs requis

  • Le script doit être lancé en tant qu’administrateur.

  • Un manque de droits entraînera des erreurs ou une configuration partielle.

• Impact sécurité

  • L’activation de WinRM et l’usage éventuel de l’authentification Basic/AllowUnencrypted peuvent exposer des risques de sécurité.

  • Vérifiez vos politiques de sécurité internes avant de déployer ce type de configuration.

• Adaptabilité du script

  • Certaines parties sont spécifiques à Windows 10, Windows 11, Windows Server 2025.

  • Pour d’autres versions de Windows, l’installation des langues ou la configuration des groupes peut varier.

  • Les noms de groupes locaux (ex. Remote Management Users) diffèrent selon la langue de l’OS.

• Responsabilité

  • L’exécution reste sous la responsabilité de l’administrateur.

  • Aucune garantie n’est donnée concernant l’exactitude, la sécurité ou l’adaptation à un environnement particulier.

• Conseils pratiques

  • Vérifiez après exécution que :

    • L’utilisateur de supervision a bien les droits nécessaires.

    • WinRM répond correctement (Test-WSMan).

    • Les sondes Shinken peuvent exécuter les commandes attendues.

Le script nécessite les droits administrateurs pour l'execution

& {

param(
    [Parameter(Mandatory = $true)][string]$UserName,
    [Parameter(Mandatory = $true)][string]$Password,
    [string]$Basic,
    [string]$Negotiate,
    [string]$AllowUnencrypted
)

$LangCode = "en-US"
$Steps = New-Object System.Collections.ArrayList

function Parse-Bool($value) {catch {
        throw "Paramètre booléen invalide: '$value'"
    }
}

if (-not $Basic) {
    $Basic = Read-Host "Basic (true or false)"
}
if (-not $Negotiate) {
    $Negotiate = Read-Host "Negotiate (true or false)"
}
if (-not $AllowUnencrypted) {
    $AllowUnencrypted = Read-Host "AllowUnencrypted (true or false)"
}

$ParsedBasic = Parse-Bool $Basic
$ParsedNegotiate = Parse-Bool $Negotiate
$ParsedAllowUnencrypted = Parse-Bool $AllowUnencrypted

function Add-StepResult {
    param([string]$Name,[bool]$Ok,[string]$Msg="")
    $icon = if ($Ok) {"OK"} else {"KO"}
    $status = if ($Ok) {"Success"} else {"Failed"}
    [void]$Steps.Add([PSCustomObject]@{ Step=$Name; Status=$status; Message="$icon $Msg" })
}

function Execute-Step {
    param([string]$Name,[scriptblock]$Action)
    try {
        & $Action
        Add-StepResult -Name $Name -Ok $true -Msg "Étape réussie"
    } catch {
        Add-StepResult -Name $Name -Ok $false -Msg ("Erreur : " + $_.Exception.Message)
        throw "Étape $Name échouée"
    }
}

function Install-LanguageIfNeeded {
    param([string]$LangCode)
    Write-Host "[1/8] Installation de la langue $LangCode et configuration" -ForegroundColor Yellow
    try {
        Install-Language -Language $LangCode -ExcludeFeaturesreturn [System.Convert]::ToBoolean($value.ToString().Trim())
    }
    catch {
        Write-Warningthrow "ImpossibleParamètre d'installer la langue $LangCode. Veuillez l'installer par interface graphique depuis un compte adminbooléen invalide: '$value'"
    }
}

if (-not $Basic) {
    $languages$Basic = GetRead-WinUserLanguageList
Host "Basic (true or false)"
}
if ($languages.LanguageTag -notcontainsnot $LangCode$Negotiate) {
    $Negotiate =   WriteRead-Host "LangueNegotiate $LangCode(true non présente, ajout..." -ForegroundColor Grayor false)"
}
if (-not $AllowUnencrypted) {
    $AllowUnencrypted = Read-Host "AllowUnencrypted (true   $languages.Add($LangCode)
        Set-WinUserLanguageList $languages -Force
        Write-Host "Langue $LangCode ajoutée." -ForegroundColor Green
    } else {or false)"
}

$ParsedBasic = Parse-Bool $Basic
$ParsedNegotiate = Parse-Bool $Negotiate
$ParsedAllowUnencrypted = Parse-Bool $AllowUnencrypted

function Add-StepResult {
    param([string]$Name,[bool]$Ok,[string]$Msg="")
    $icon = if ($Ok) {"OK"} else {"KO"}
    $status = if  Write-Host "Langue $LangCode déjà disponible." -ForegroundColor Green($Ok) {"Success"} else {"Failed"}
    }
    Write-Host ""[void]$Steps.Add([PSCustomObject]@{ Step=$Name; Status=$status; Message="$icon $Msg" })
}

function ConfigureExecute-WinRMStep {
    Write-Host "[2/8] Configuration rapide de WinRM" -ForegroundColor Yellowparam([string]$Name,[scriptblock]$Action)
    try {
    winrm quickconfig -q
  & $Action
 if ($LASTEXITCODE -ne 0) { throw "WinRM quickconfig a échoué ($LASTEXITCODE)" }
    Write-Host "WinRM configuré." -ForegroundColor Green
    Write-Host ""
}

function Add-UserToExistingGroup {
    param(
        [string]$UserName,
        [string]$PrimaryGroup,
Add-StepResult -Name $Name -Ok $true -Msg "Étape réussie"
    } catch {
        Add-StepResult -Name $Name -Ok $false -Msg ("Erreur : " + $_.Exception.Message)
        throw "Étape  [string]$FallbackGroup$Name échouée"
    )}
}

function Install-LanguageIfNeeded {
  $groupUsed = $null
 param([string]$LangCode)
    foreach ($grp in @($PrimaryGroup,$FallbackGroup)) {
        $output = net localgroup "$grp" 2>$null
Write-Host "[1/8] Installation de la langue $LangCode et configuration" -ForegroundColor Yellow
    try {
        Install-Language if-Language ($LASTEXITCODE$LangCode -eq 0) {
ExcludeFeatures
    }
    catch {
        $groupUsed = $grp
            breakWrite-Warning "Impossible d'installer la langue $LangCode. Veuillez l'installer par interface graphique depuis un compte admin"
    }
   
 }
   $languages = }
Get-WinUserLanguageList
    if ($languages.LanguageTag -notnotcontains $groupUsed$LangCode) {
        throw "Aucun des groupes '$PrimaryGroup' ou '$FallbackGroup' n'existe."
    }

Write-Host "Langue $LangCode non présente, ajout..." -ForegroundColor Gray
        $languages.Add($LangCode)
      if ($output Set-match "^\s*$UserName\s*$") {WinUserLanguageList $languages -Force
        Write-Host "UtilisateurLangue $UserName déjà dans le groupe $groupUsed$LangCode ajoutée." -ForegroundColor GrayGreen
    } else {
        & net localgroup "$groupUsed" $UserName /ADD | Out-NullWrite-Host "Langue $LangCode déjà disponible." -ForegroundColor Green
    }
    if ($LASTEXITCODE -ne 0) Write-Host ""
}

function Configure-WinRM {
    Write-Host "[2/8] Configuration rapide de    throw WinRM"Échec ajout-ForegroundColor utilisateurYellow
 $UserName dans le groupe $groupUsed ($LASTEXITCODE)"
   winrm quickconfig -q
    if ($LASTEXITCODE }-ne else0) {
 throw "WinRM quickconfig a échoué   ($LASTEXITCODE)" }
    Write-Host "Utilisateur $UserName ajouté au groupe $groupUsedWinRM configuré." -ForegroundColor Green
        }
    }
}

function Create-UserWrite-Host ""
}

function Add-UserToExistingGroup {
    param(
        [string]$UserName,
        [string]$Password)

$PrimaryGroup,
       Write-Host "[3/8string]$FallbackGroup
 Création de l'utilisateur $UserName" -ForegroundColor Yellow )

    $exists$groupUsed = net user $UserName 2>$null$null

    ifforeach ($LASTEXITCODE$grp -ne 0in @($PrimaryGroup,$FallbackGroup)) {
        $output &= net userlocalgroup $UserName $Password /ADD | Out-Null"$grp" 2>$null
        if ($LASTEXITCODE -neeq 0) {
            throw$groupUsed "Échec= création$grp
 utilisateur via 'net user' ($LASTEXITCODE)"
        }break
    } else {
  }
    }

  Write-Host "Utilisateur déjàif existant : $UserName" -ForegroundColor Gray(-not $groupUsed) {
    }

    Add-UserToExistingGroup -UserName $UserName -PrimaryGroup "Remote Management Users" -FallbackGroup "Utilisateurs de gestion à distance"
    Add-UserToExistingGroup -UserName $UserName -PrimaryGroup "Performance Monitor Users" -FallbackGroup "Utilisateurs de l’Analyseur de performances"

    $SecurePassword = ConvertTo-SecureString $Password -AsPlainText -Force
    $Credential = New-Object System.Management.Automation.PSCredential ($UserName, $SecurePassword)
    try {
        Start-Process -FilePath "whoami.exe" -Credential $Credential -WindowStyle Hidden -Wait
    } catch {
throw "Aucun des groupes '$PrimaryGroup' ou '$FallbackGroup' n'existe."
    }

    if ($output -match "^\s*$UserName\s*$") {
        Write-Host "Utilisateur $UserName déjà dans le groupe $groupUsed" -ForegroundColor Gray
    } else {
        & net localgroup "$groupUsed" $UserName /ADD | Out-Null
        if ($LASTEXITCODE -ne 0) {
            Write-Hostthrow "⚠️Échec Impossibleajout deutilisateur lancer$UserName undans logonle testgroupe pour $UserName$groupUsed ($_$LASTEXITCODE)"
   -ForegroundColor Red
    }

 else {
            Write-Host "Utilisateur $UserName créé/validéajouté etau groupesgroupe assignés.$groupUsed" -ForegroundColor Green
}


function Configure-UserLanguage {
    param(
  }
    }
}

function  [string]$UserName,Create-User {
        param([string]$Password,
        [string]$LangCode
    $UserName, [string]$Password)

    Write-Host "[43/8] ConfigurationCréation de la langue pour l'utilisateur $UserName" -ForegroundColor Yellow

    $Computer$exists = $env:COMPUTERNAME net user $UserName 2>$null
    $SIDif =($LASTEXITCODE (Get-WmiObject Win32_UserAccount -Filter "Name='$UserName' AND Domain='$Computer'").SID
-ne 0) {
        & net user $UserName $Password /ADD | Out-Null
        if ($LASTEXITCODE -notne $SID0) {
            throw "Impossible de récupérer le SID pour $UserName" }
Échec création utilisateur via 'net user' ($LASTEXITCODE)"
        }
    $UserProfile} = Get-CimInstance Win32_UserProfile | Where-Object SID -eq $SID
    if (-not $UserProfile) { throw "Profil introuvable pour $UserName"else {
        Write-Host "Utilisateur déjà existant : $UserName" -ForegroundColor Gray
    }

    $HivePath = Join-Path $UserProfile.LocalPath "NTUSER.DATAdd-UserToExistingGroup -UserName $UserName -PrimaryGroup "Remote Management Users" -FallbackGroup "Utilisateurs de gestion à distance"
    ifAdd-UserToExistingGroup (-notUserName $UserName (Test-Path $HivePath)) { throw "Profil non initialisé (NTUSER.DAT introuvable) : $HivePath" }PrimaryGroup "Performance Monitor Users" -FallbackGroup "Utilisateurs de l’Analyseur de performances"

    $regRelative$SecurePassword = "Control Panel\Desktop" ConvertTo-SecureString $Password -AsPlainText -Force
    $valueName$Credential = "PreferredUILanguages"
New-Object System.Management.Automation.PSCredential ($UserName, $SecurePassword)
     [string[]]$LangArray = @($LangCode)

try {
       $IsLoaded =Start-Process Test-PathFilePath "Registry::HKEY_USERS\$SID"
    if ($IsLoaded) {
        $fullPath = "Registry::HKEY_USERS\$SID\$regRelative"
        if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null }
        if (-not (Get-ItemProperty -Path $fullPath -Name $valueName -ErrorAction SilentlyContinue)) whoami.exe" -Credential $Credential -WindowStyle Hidden -Wait
    } catch {
        Write-Host "⚠️ Impossible de lancer un logon test pour $UserName ($_)" -ForegroundColor Red
    }

    Write-Host "Utilisateur $UserName créé/validé et groupes assignés." -ForegroundColor Green
}


function Configure-UserLanguage {
    param(
        New-ItemProperty -Path $fullPath -Name $valueName -Value $LangArray -PropertyType MultiString -Force | Out-Null[string]$UserName,
        [string]$Password,
        } else {[string]$LangCode
    )

    Write-Host "[4/8] Configuration de Set-ItemProperty -Path $fullPath -Name $valueName -Value $LangArrayla langue pour l'utilisateur $UserName" -ForegroundColor Yellow

    $Computer = $env:COMPUTERNAME
  }
  $SID = } else {
   (Get-WmiObject Win32_UserAccount -Filter "Name='$UserName' AND Domain='$Computer'").SID
    if Write(-Hostnot "Utilisateur$SID) non{ connecté.throw Chargement"Impossible de la ruche..." -ForegroundColor Gray
    récupérer le SID pour $UserName" }

    reg$UserProfile load "HKU\TempHive" $HivePath= Get-CimInstance Win32_UserProfile | Out-Null
  Where-Object SID -eq $SID
    if (-not try$UserProfile) {
 throw "Profil introuvable pour $UserName" }

    $HivePath = $tempPath = "Registry::HKEY_USERS\TempHive\$regRelative"
        Join-Path $UserProfile.LocalPath "NTUSER.DAT"
    if (-not (Test-Path $tempPath$HivePath)) { New-Item -Path $tempPath -Force | Out-Null }
            if (-not (Get-ItemProperty -Path $tempPath -Name $valueName -ErrorAction SilentlyContinue) throw "Profil non initialisé (NTUSER.DAT introuvable) : $HivePath" }

    $regRelative = "Control Panel\Desktop"
    $valueName = "PreferredUILanguages"
    [string[]]$LangArray = @($LangCode)

    $IsLoaded = Test-Path "Registry::HKEY_USERS\$SID"
    if ($IsLoaded) {
        $fullPath = "Registry::HKEY_USERS\$SID\$regRelative"
      New-ItemProperty -Path $tempPathif (-Namenot $valueName (Test-ValuePath $LangArray -PropertyType MultiString -Force | Out-Null
            } else {
     $fullPath)) { New-Item -Path $fullPath -Force | Out-Null }
        if   Set(-not (Get-ItemProperty -Path $tempPath$fullPath -Name $valueName -Value $LangArray
            }ErrorAction SilentlyContinue)) {
        } finally {
  New-ItemProperty -Path $fullPath -Name $valueName -Value $LangArray -PropertyType MultiString  reg unload "HKU\TempHive" -Force | Out-Null
        }    Write-Host "Ruche déchargée." -ForegroundColor Grayelse {
        }
    }

    Write-Host "Langue préférée utilisateur définie sur $LangCode (REG_MULTI_SZ)." -ForegroundColor Green
}

function Configure-WinRMAuth {
    param([bool]$Basic, [bool]$Negotiate, [bool]$AllowUnencrypted)
 
Set-ItemProperty -Path $fullPath -Name $valueName -Value $LangArray
        }
    } else {
        Write-Host "[5/8] ConfigurationUtilisateur non connecté. Chargement de l'authentification WinRMla ruche..." -ForegroundColor Yellow
Gray
        reg load "HKU\TempHive" $HivePath | Out-Null
    if  (!$Basic -and !$Negotiate)try {
        throw "Aucune méthode d'authentification n'est paramétrée. Veuillez choisir Basic ou Negotiate."
 $tempPath = "Registry::HKEY_USERS\TempHive\$regRelative"
        }

    if ($Basic-not (Test-andPath !$AllowUnencrypted$tempPath)) { New-Item -Path $tempPath -Force | Out-Null }
           throw "L'authentification Basic nécessite d'authoriser la connection non chiffré (AllowUnencrypted). Le support HTTPS n'est pas disponible pour le moment."
    }

    if (!$Basic -and $Negotiate -and $AllowUnencrypted) {
        throw "Negotiate ne nécessite pas une connection chiffré (AllowUnencrypted). Il est déconseillé de l'activer."
    }

    if ($Basic) {
        winrm set winrm/config/service/auth '@{Basic="true"}'
    }
    
    if ($Negotiate) {if (-not (Get-ItemProperty -Path $tempPath -Name $valueName -ErrorAction SilentlyContinue)) {
                New-ItemProperty -Path $tempPath -Name $valueName -Value $LangArray -PropertyType MultiString -Force | Out-Null
            } else {
                Set-ItemProperty -Path $tempPath -Name $valueName -Value $LangArray
            }
        winrm set winrm/config/service/auth '@{Negotiate="true"}'} finally {
    }

    if ($AllowUnencrypted) {
  reg unload "HKU\TempHive" |  Out-Null
 winrm set winrm/config/service '@{AllowUnencrypted="true"}'
    }

    Write-Host "Configuration d'authentification définieRuche déchargée." -ForegroundColor GreenGray
     Write-Host ""
}

function Configure-WinRMSDDL {}
    param([string]$UserName)}

    Write-Host "[6/8] Attribution des droits WinRM (SDDL)Langue préférée utilisateur définie sur $LangCode (REG_MULTI_SZ)." -ForegroundColor YellowGreen
 
    $GENERIC_READ = 0x80000000
    $GENERIC_EXECUTE = 0x20000000}

function Configure-WinRMAuth {
    $user_sid = (New-Object System.Security.Principal.NTAccount $UserName).Translate([System.Security.Principal.SecurityIdentifier]param([bool]$Basic, [bool]$Negotiate, [bool]$AllowUnencrypted)
 
     $sddl = (Get-Item -Path WSMan:\localhost\Service\RootSDDL).ValueWrite-Host "[5/8] Configuration de l'authentification WinRM" -ForegroundColor Yellow

    $sdif =(!$Basic New-Object System.Security.AccessControl.CommonSecurityDescriptor $false, $false, $sddl
    $sd.DiscretionaryAcl.AddAccess(
and !$Negotiate) {
        throw "Aucune  [System.Security.AccessControl.AccessControlType]::Allow,
        $user_sid,
   méthode d'authentification n'est paramétrée. Veuillez choisir Basic ou Negotiate."
    }

    if ($GENERIC_READ$Basic -bor $GENERIC_EXECUTE),
and !$AllowUnencrypted) {
         [System.Security.AccessControl.InheritanceFlags]::None,
        [System.Security.AccessControl.PropagationFlags]::None
    )
    $new_sddl = $sd.GetSddlForm([System.Security.AccessControl.AccessControlSections]::All)
    Set-Item -Path WSMan:\localhost\Service\RootSDDL -Value $new_sddl -Force
    Write-Host "Droits SDDL appliqués." -ForegroundColor Green
    Write-Host ""
}

Function Configure-CIMSDDL {
    param(
        [parameter(Mandatory=$true,Position=0)][string] $namespace,
        [parameter(Mandatory=$true,Position=1)][string] $operation,
        [parameter(Mandatory=$true,Position=2)][string] $account,
throw "L'authentification Basic nécessite d'authoriser la connection non chiffré (AllowUnencrypted). Le support HTTPS n'est pas disponible pour le moment."
    }

    if (!$Basic -and $Negotiate -and $AllowUnencrypted) {
        throw "Negotiate ne nécessite pas une connection chiffré (AllowUnencrypted). Il est déconseillé de l'activer."
    }

    if ($Basic) {
        winrm set winrm/config/service/auth '@{Basic="true"}'
    }
    
    if ($Negotiate) {
         [parameter(Position=3)][string[]] $permissions = $null,winrm set winrm/config/service/auth '@{Negotiate="true"}'
    }

    [bool] $allowInherit = $false,
if ($AllowUnencrypted) {
        winrm [bool] $deny = $false,set winrm/config/service '@{AllowUnencrypted="true"}'
    }

    [string] $computerName = ".",
  Write-Host "Configuration d'authentification définie." -ForegroundColor Green
    Write-Host  [System.Management.Automation.PSCredential] $credential = $null""
}

function Configure-WinRMSDDL {
    )
 param([string]$UserName)
    Write-Host "[76/8] Attribution des droits WMI/CIMWinRM (SDDL)" -ForegroundColor Yellow
    $ErrorActionPreference = "Stop"
 
   $GENERIC_READ Function Get-AccessMaskFromPermission($permissions) {= 0x80000000
        $WBEM_ENABLE$GENERIC_EXECUTE = 10x20000000
    $user_sid = (New-Object  $WBEM_METHOD_EXECUTE = 2System.Security.Principal.NTAccount $UserName).Translate([System.Security.Principal.SecurityIdentifier])
 
    $sddl = (Get-Item  $WBEM_FULL_WRITE_REP = 4-Path WSMan:\localhost\Service\RootSDDL).Value
    $sd = New-Object  $WBEM_PARTIAL_WRITE_REP = 8System.Security.AccessControl.CommonSecurityDescriptor $false, $false, $sddl
        $WBEM_WRITE_PROVIDER = 0x10$sd.DiscretionaryAcl.AddAccess(
        $WBEM_REMOTE_ACCESS = 0x20[System.Security.AccessControl.AccessControlType]::Allow,
        $READ_CONTROL = 0x20000$user_sid,
        $WRITE($GENERIC_DACREAD = 0x40000
 -bor $GENERIC_EXECUTE),
        $WBEM_RIGHTS_FLAGS = $WBEM_ENABLE,$WBEM_METHOD_EXECUTE,$WBEM_FULL_WRITE_REP,[System.Security.AccessControl.InheritanceFlags]::None,
        [System.Security.AccessControl.PropagationFlags]::None
    $WBEM_PARTIAL_WRITE_REP,$WBEM_WRITE_PROVIDER,$WBEM_REMOTE_ACCESS,
    )
    $new_sddl = $sd.GetSddlForm([System.Security.AccessControl.AccessControlSections]::All)
    Set-Item -Path WSMan:\localhost\Service\RootSDDL -Value $READ_CONTROL,$WRITE_DAC
 
  $new_sddl -Force
    Write-Host  $WBEM_RIGHTS_STRINGS = "Enable","MethodExecute","FullWrite","PartialWrite",
  "Droits SDDL appliqués." -ForegroundColor Green
    Write-Host ""
}

Function Configure-CIMSDDL {
   "ProviderWrite","RemoteAccess","ReadSecurity","WriteSecurity"
  param(
        $permissionTable = @{}[parameter(Mandatory=$true,Position=0)][string] $namespace,
        for ($i = 0; $i -lt $WBEM_RIGHTS_FLAGS.Length; $i++) {
    [parameter(Mandatory=$true,Position=1)][string] $operation,
        $permissionTable.Add($WBEM_RIGHTS_STRINGS[$i].ToLower(), $WBEM_RIGHTS_FLAGS[$i])[parameter(Mandatory=$true,Position=2)][string] $account,
        }[parameter(Position=3)][string[]] $permissions = $null,
 
       [bool] $accessMask$allowInherit = 0$false,
         foreach ($permission in $permissions) {
[bool] $deny = $false,
        [string] $computerName = ".",
      if (-not $permissionTable.ContainsKey($permission.ToLower())) {
     [System.Management.Automation.PSCredential] $credential = $null
    )
 
    Write-Host "[7/8] Attribution des droits WMI/CIM" -ForegroundColor Yellow
 throw "Permission inconnue: $permission`nPermissions$ErrorActionPreference authorisées: $($permissionTable.Keys)= "Stop"
 
    Function Get-AccessMaskFromPermission($permissions) {
     }
   $WBEM_ENABLE = 1
        $accessMask$WBEM_METHOD_EXECUTE += $permissionTable[$permission.ToLower()]2
        }
$WBEM_FULL_WRITE_REP = 4
        $WBEM_PARTIAL_WRITE_REP = $accessMask8
    }
 
    if ($PSBoundParameters.ContainsKey("Credential")) {$WBEM_WRITE_PROVIDER = 0x10
        $remoteparams$WBEM_REMOTE_ACCESS = @{ComputerName=$computerName;Credential=$credential}
0x20
        }$READ_CONTROL else= {0x20000
        $remoteparams$WRITE_DAC = @{}0x40000
 
   }
 
    $invokeparams$WBEM_RIGHTS_FLAGS = @{Namespace=$namespace;Path="__systemsecurity=@"} + $remoteParams
    $output = Invoke-WmiMethod @invokeparams -Name GetSecurityDescriptor
$WBEM_ENABLE,$WBEM_METHOD_EXECUTE,$WBEM_FULL_WRITE_REP,
         if ($output.ReturnValue -ne 0) { $WBEM_PARTIAL_WRITE_REP,$WBEM_WRITE_PROVIDER,$WBEM_REMOTE_ACCESS,
        throw "GetSecurityDescriptor a échoué: $($output.ReturnValue)"
  $READ_CONTROL,$WRITE_DAC
 
   }
 
    $acl$WBEM_RIGHTS_STRINGS = $output.Descriptor"Enable","MethodExecute","FullWrite","PartialWrite",
    $OBJECT_INHERIT_ACE_FLAG = 0x1
    $CONTAINER_INHERIT_ACE_FLAG = 0x2
    $computerName = (Get-WmiObject @remoteparams Win32_ComputerSystem).Name
 
    if ($account.Contains('\')) {
  "ProviderWrite","RemoteAccess","ReadSecurity","WriteSecurity"
 
        $permissionTable = @{}
       $domainaccount =for $account.Split('\')
        $domain = $domainaccount[0]
($i = 0; $i -lt $WBEM_RIGHTS_FLAGS.Length; $i++) {
           if $permissionTable.Add(($domain -eq ".") -or ($domain -eq "BUILTIN")) {
    $WBEM_RIGHTS_STRINGS[$i].ToLower(), $WBEM_RIGHTS_FLAGS[$i])
        }
 
        $domain$accessMask = $computerName0
        foreach ($permission }
in $permissions) {
      $accountname = $domainaccount[1]
    }if elseif ($account.Contains('@'(-not $permissionTable.ContainsKey($permission.ToLower())) {
         $domainaccount = $account.Split('@')
     throw "Permission inconnue: $domain$permission`nPermissions = $domainaccount[1].Split('.')[0]authorisées: $($permissionTable.Keys)"
        $accountname = $domainaccount[0]
  }
  } else {
        $domain$accessMask += $computerName$permissionTable[$permission.ToLower()]
        $accountname = $account}
    }
 
    $getparams$accessMask
 = @{Class="Win32_Account";Filter="Domain='$domain' and Name='$accountname'"} + $remoteParams}
 
    $win32account = Get-WmiObject @getparams
if ($PSBoundParameters.ContainsKey("Credential")) {
      if ($null -eq$remoteparams $win32account)= @{ComputerName=$computerName;Credential=$credential}
    } else {
  throw "Compte utilisateur inconnu: $account"
  $remoteparams = @{}
 
    switch ($operation) {}
 
    $invokeparams    "add" {= @{Namespace=$namespace;Path="__systemsecurity=@"} + $remoteParams
    $output = Invoke-WmiMethod @invokeparams -Name GetSecurityDescriptor
    if ($null$output.ReturnValue -eqne $permissions0) {
                throw "LesGetSecurityDescriptor permissionsa doivent être spécifié."
    échoué: $($output.ReturnValue)"
        }
 
    $acl    = $output.Descriptor
    $accessMask$OBJECT_INHERIT_ACE_FLAG = Get-AccessMaskFromPermission($permissions)0x1
    $CONTAINER_INHERIT_ACE_FLAG = 0x2
     $computerName $ace = (NewGet-Object System.Management.ManagementClass("win32_Ace")).CreateInstance()
 WmiObject @remoteparams Win32_ComputerSystem).Name
 
           $ace.AccessMask = $accessMaskif ($account.Contains('\')) {
        $domainaccount =   $ace.AceFlags = if ($allowInherit) { $OBJECT_INHERIT_ACE_FLAG + $CONTAINER_INHERIT_ACE_FLAG } else { 0 }
 $account.Split('\')
        $domain = $domainaccount[0]
        if (($domain -eq  $trustee = (New-Object System.Management.ManagementClass("win32_Trustee")).CreateInstance()".") -or ($domain -eq "BUILTIN")) {
            $trustee.SidString$domain = $win32account.Sid$computerName
        }
    $ace.Trustee = $trustee
  $accountname = $domainaccount[1]
    } elseif   $ace.AceType = if ($deny($account.Contains('@')) {
 0x1 } else { 0x0 }
 
 $domainaccount = $account.Split('@')
         $acl.DACL$domain += $ace.psobject.immediateBaseObject
        }
$domainaccount[1].Split('.')[0]
        $accountname  default {= $domainaccount[0]
    } else {
      throw "Opération inconnue:$domain $operation`nOpérations= authorisés$computerName
 : add"
      $accountname = }$account
    }
 
    $setparams$getparams = @{NameClass="SetSecurityDescriptorWin32_Account";ArgumentList=$acl.psobject.immediateBaseObjectFilter="Domain='$domain' and Name='$accountname'"} + $invokeParams$remoteParams
    $output$win32account = InvokeGet-WmiMethodWmiObject @setparams@getparams
    if ($output.ReturnValue$null -neeq 0$win32account) {
        throw "SetSecurityDescriptorCompte autilisateur échouéinconnu: $($output.ReturnValue)$account"
    }
}

function Configure-W32TimeSDDL {
 
    switch param([string]$UserName)
$operation) {
     Write-Host   "[8/8] Attribution des droits sur W32Time" -ForegroundColor Yellow
 
add" {
           $sid =if (New$null -Object System.Security.Principal.NTAccount($UserName)).Translate([System.Security.Principal.SecurityIdentifier]).Value
eq $permissions) {
      $currentSddl = & sc.exe sdshow w32time
    $newAce = "(A;;CCLCLO;;;${sid})"
throw "Les permissions doivent être spécifié."
         $newSddl = $currentSddl +}
 $newAce
       sc.exe sdset w32time "$newSddl"
  $accessMask = Restart-Service w32time
 
Get-AccessMaskFromPermission($permissions)
        Write-Host "Droits W32Time appliqués pour$ace $UserName."= (New-ForegroundColor Green
Object System.Management.ManagementClass("win32_Ace")).CreateInstance()
     Write-Host ""
}

function Run-All-Steps {
    $LangCode$ace.AccessMask = "en-US"
$accessMask
    try {
        Execute-Step "Langue en-US" { Install-LanguageIfNeeded -LangCode $LangCode }
        Execute-Step "WinRM quickconfig" { Configure-WinRM }
$ace.AceFlags = if ($allowInherit) { $OBJECT_INHERIT_ACE_FLAG + $CONTAINER_INHERIT_ACE_FLAG } else { 0 }
 
            $trustee = Execute(New-Step "Création utilisateur + Ajout aux groupes" { Create-User -UserName $UserName -Password $Password }Object System.Management.ManagementClass("win32_Trustee")).CreateInstance()
            $trustee.SidString = $win32account.Sid
        Execute-Step "Langue UI du profil" { Configure-UserLanguage -UserName $UserName -LangCode $LangCode }
$ace.Trustee = $trustee
             Execute-Step "WinRM Auth" { Configure-WinRMAuth $ParsedBasic $ParsedNegotiate $ParsedAllowUnencrypted }
$ace.AceType = if ($deny) { 0x1 } else { 0x0 }
 
            $acl.DACL +=  Execute-Step "WinRM RootSDDL" { Configure-WinRMSDDL -UserName $UserName$ace.psobject.immediateBaseObject
        }
        Execute-Step "WMI/CIM root\cimv2 (Enable+RemoteAccess)" { Configure-CIMSDDL "root/cimv2" add $UserName Enable,RemoteAccess }
        Execute-Step "WMI/CIM root\standardcimv2 (Enable+RemoteAccess)" { Configure-CIMSDDL "root/standardcimv2" add $UserName Enable,RemoteAccessdefault {
            throw "Opération inconnue: $operation`nOpérations authorisés : add"
        }
    }
 
   Execute-Step "W32Time$setparams SDDL"= { Configure-W32TimeSDDL -UserName $UserName }
@{Name="SetSecurityDescriptor";ArgumentList=$acl.psobject.immediateBaseObject} + $invokeParams
    $output }= catchInvoke-WmiMethod {@setparams
        Write-Host "$($_.Exception.Message)" -ForegroundColor Red
    }
}

function Configure if ($output.ReturnValue -ne 0) {
    $Steps = New-Object System.Collections.ArrayList

 throw "SetSecurityDescriptor  Write-Host "========================================================" -ForegroundColor DarkGraya échoué: $($output.ReturnValue)"
    }
}

function Configure-W32TimeSDDL {
    param([string]$UserName)
    Write-Host "CONFIGURE PACK [windows-by-WinRM] for supervised host[8/8] Attribution des droits sur W32Time" -ForegroundColor CyanYellow
 
   Write-Host "========================================================" -ForegroundColor DarkGray $sid = (New-Object System.Security.Principal.NTAccount($UserName)).Translate([System.Security.Principal.SecurityIdentifier]).Value
    Write-Host ""

    Run-All-Steps
$currentSddl = & sc.exe sdshow w32time
    $newAce Write-Host= "(A;;CCLCLO;;;${sid})"
    $newSddl = $currentSddl + $newAce
    sc.exe sdset Write-Hostw32time ("═$newSddl"
  * 70) Restart-ForegroundColorService w32time
 DarkGray
    Write-Host "RÉSUMÉ DES ÉTAPESDroits W32Time appliqués pour $UserName." -ForegroundColor YellowGreen
    Write-Host ("═" * 70) -ForegroundColor DarkGray
}

function Run-All-Steps {
    $LangCode    = "en-US"

    foreach ($s in $Steps)try {
        if ($s.Status -eq "Success") {
    Execute-Step "Langue en-US" { Install-LanguageIfNeeded -LangCode $LangCode }
        Write-Host ("[OK] {0} : {1}" -f $s.Step, $s.Message) -ForegroundColor Green
        } else {Execute-Step "WinRM quickconfig" { Configure-WinRM }
        Execute-Step "Création utilisateur + Ajout aux groupes" { Create-User -UserName $UserName -Password $Password }
        Execute-Step "Langue UI du Write-Host ("[KO]profil" {0} : {1}" Configure-UserLanguage -f $s.Step, $s.Message) -ForegroundColor RedUserName $UserName -LangCode $LangCode }
        }
    }
    Execute-Step "WinRM Auth" { Configure-WinRMAuth $ParsedBasic $ParsedNegotiate $ParsedAllowUnencrypted }
    
    WriteExecute-HostStep ("═WinRM RootSDDL" * 70){ Configure-WinRMSDDL -ForegroundColorUserName $UserName DarkGray
}

Configure

}