Les configurations suivantes sont destinées à des postes Windows configurés en "groupe de travail". La configuration pour un poste d'un "domaine" peut différer.

• Windows 11
• Windows 10
• Windows Server 2025
• Windows Server 2022
• Windows Server 2019
• Windows Server 2016
• Windows Server 2012 R2

Les commandes ci-dessous doivent être exécutées par un administrateur local de la machine ( sauf mention contraire ).

Get-Service WinRM

C:\Users\Administrateur> Get-Service WinRM

Status   Name               DisplayName
------   ----               -----------
Running  WinRM              Gestion à distance de Windows (Gest...

winrm quickconfig

C:\Users\Administrateur> winrm quickconfig  

WinRM n'est pas configuré pour la gestion à distance de cet ordinateur.
Les modifications suivantes doivent être effectuées :

Créez un écouteur WinRM sur HTTP://* pour accepter les demandes de la gestion des services Web sur toutes les adresses IP de cet ordinateur.

Activez l'exception de pare-feu WinRM.
Configurez LocalAccountTokenFilterPolicy pour attribuer des droits d'administration à distance à des utilisateurs locaux.

Effectuer ces modifications [y/n] ? y

WinRM a été mis à jour pour la gestion à distance.

Écouteur WinRM créé sur HTTP://* pour accepter les demandes de la gestion des services Web sur toutes les adresses IP de cet ordinateur.

Exception de pare-feu WinRM activée.
LocalAccountTokenFilterPolicy configuré pour attribuer des droits d'administration à distance à des utilisateurs locaux.

winrm set winrm/config/service/auth '@{Negotiate="true"}'

L’utilisation du protocole « Basic » n’est pas recommandée lorsque des modes d’authentification plus sécurisés sont disponibles sur le système.

winrm set winrm/config/service/auth '@{Basic="true"}'

winrm set winrm/config/service '@{AllowUnencrypted="true"}'

net user "shinken" "mon_motdepasse" /ADD

Remplacer ici "mon_motdepasse".

Cette étape est nécessaire les systèmes suivants :

• windows server 2019
• windows server 2022

Il est nécessaire de se connecter au nouveau compte créer pour changer la langue de l'utilisateur.

Install-Language -Language en-US

# === 1. Config ===
$UserName = "shinken"
$LangCode = "en-US"

# Demander le mot de passe de manière sécurisée
$Credential = Get-Credential -UserName $UserName -Message "Mot de passe pour l'utilisateur $UserName"

# === 2. Forcer la création du profil utilisateur si nécessaire ===
Write-Host "Création/vérification du profil utilisateur $UserName..."
Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -Command whoami" -Credential $Credential -Wait

# Attendre un court délai pour laisser Windows créer le profil
Start-Sleep -Seconds 2

# === 3. Vérifier/ajouter la langue sur la machine ===
$languages = Get-WinUserLanguageList
if ($languages.LanguageTag -notcontains $LangCode) {
    Write-Host "La langue $LangCode n'est pas installée. Ajout..."
    $languages.Add($LangCode)
    Set-WinUserLanguageList $languages -Force
    Write-Host "Langue $LangCode ajoutée."
} else {
    Write-Host "Langue $LangCode déjà disponible."
}

# === 4. Récupérer infos profil utilisateur ===
$User = Get-LocalUser -Name $UserName -ErrorAction Stop
$SID = $User.SID
$Profile = Get-CimInstance Win32_UserProfile | Where-Object SID -eq $SID
$HivePath = "$($Profile.LocalPath)\NTUSER.DAT"

if (-not (Test-Path $HivePath)) {
    throw "Profil introuvable ou non initialisé : $HivePath"
}

# === 5. Déterminer si l'utilisateur est connecté ===
$IsLoaded = Test-Path "Registry::HKEY_USERS\$SID"

if ($IsLoaded) {
    Write-Host "L'utilisateur $UserName est connecté. Modification directe..."
    [string[]]$LangArray = $LangCode
    Set-ItemProperty -Path "Registry::HKEY_USERS\$SID\Control Panel\Desktop" -Name PreferredUILanguages -Value $LangArray
} else {
    Write-Host "L'utilisateur $UserName n'est pas connecté. Chargement de la ruche..."
    reg load "HKU\TempHive" $HivePath | Out-Null
    try {
        [string[]]$LangArray = $LangCode
        Set-ItemProperty -Path "Registry::HKEY_USERS\TempHive\Control Panel\Desktop" -Name PreferredUILanguages -Value $LangArray
    }
    finally {
        reg unload "HKU\TempHive" | Out-Null
        Write-Host "Ruche déchargée."
    }
}

Write-Host "Langue UI de $UserName changée en $LangCode."
Write-Host "Déconnectez/reconnectez $UserName pour appliquer le changement."

Ensuite, il est nécessaire de se déconnecter puis se reconnecter au nouvel utilisateur afin de correctement appliquer le changement de langue.

Sur certaines distributions inférieures à Windows 2012, le groupe "Utilisateurs de gestion à distance" et sa fonction n'existent pas.

net localgroup "Remote Management Users" "shinken" /ADD
net localgroup "Performance Monitor Users" "shinken" /ADD

net localgroup "Utilisateurs de gestion à distance" "shinken" /ADD
net localgroup "Utilisateurs de l’Analyseur de performances" "shinken" /ADD

Il est possible que la commande "net localgroup "Utilisateurs de l’Analyseur de performances" "shinken" /ADD" ne fonctionne pas lors d'un copier-coller.

Il y a un bug avec le terminal PowerShell sur le copier-coller qui ne retranscrira pas le symbole apostrophe ’ lorsque l'action "coller" est déclenché avec un clic droit dans le terminal.
Il faut utiliser le raccourci "CTRL+V" affin de coller correctement la commande
Sinon, il est possible de générer le caractère spécial apostrophe ’ avec le raccourci "ALT + 0146".  ( Différent de l'apostrophe de la touche 4 ).

Example du bug du copier-coller dans un terminal PowerShell Administrateur où l'apostrophe n'est pas retranscrit :

winrm configSDDL default

$user = "shinken"

$GENERIC_READ = 0x80000000
$GENERIC_EXECUTE = 0x20000000

$user_sid = (New-Object -TypeName System.Security.Principal.NTAccount -ArgumentList $user).Translate([System.Security.Principal.SecurityIdentifier])

# get the existing SDDL of the WinRM listener
$sddl = (Get-Item -Path WSMan:\localhost\Service\RootSDDL).Value

# convert the SDDL string to a SecurityDescriptor object
$sd = New-Object -TypeName System.Security.AccessControl.CommonSecurityDescriptor -ArgumentList $false, $false, $sddl

# apply a new DACL to the SecurityDescriptor object
$sd.DiscretionaryAcl.AddAccess(
    [System.Security.AccessControl.AccessControlType]::Allow,
    $user_sid,
    ($GENERIC_READ -bor $GENERIC_EXECUTE),
    [System.Security.AccessControl.InheritanceFlags]::None,
    [System.Security.AccessControl.PropagationFlags]::None
)

# get the SDDL string from the changed SecurityDescriptor object
$new_sddl = $sd.GetSddlForm([System.Security.AccessControl.AccessControlSections]::All)

# apply the new SDDL to the WinRM listener
Set-Item -Path WSMan:\localhost\Service\RootSDDL -Value $new_sddl -Force 

Cette section n'est pas nécessaire si les machines supervisées sont configurées avec un Active Directory.

wmimgmt.msc

$script_name = ".\Set-WmiNamespaceSecurity.ps1"

@'
# Set-WmiNamespaceSecurity.ps1
# Example: Set-WmiNamespaceSecurity root/cimv2 add steve Enable,RemoteAccess

Param ( [parameter(Mandatory=$true,Position=0)][string] $namespace,
    [parameter(Mandatory=$true,Position=1)][string] $operation,
    [parameter(Mandatory=$true,Position=2)][string] $account,
    [parameter(Position=3)][string[]] $permissions = $null,
    [bool] $allowInherit = $false,
    [bool] $deny = $false,
    [string] $computerName = ".",
    [System.Management.Automation.PSCredential] $credential = $null)

Process {
    $ErrorActionPreference = "Stop"
    Function Get-AccessMaskFromPermission($permissions) {
        $WBEM_ENABLE = 1
        $WBEM_METHOD_EXECUTE = 2
        $WBEM_FULL_WRITE_REP = 4
        $WBEM_PARTIAL_WRITE_REP = 8
        $WBEM_WRITE_PROVIDER = 0x10
        $WBEM_REMOTE_ACCESS = 0x20
        $WBEM_RIGHT_SUBSCRIBE = 0x40
        $WBEM_RIGHT_PUBLISH = 0x80
        $READ_CONTROL = 0x20000
        $WRITE_DAC = 0x40000

        $WBEM_RIGHTS_FLAGS = $WBEM_ENABLE,$WBEM_METHOD_EXECUTE,$WBEM_FULL_WRITE_REP,`

            $WBEM_PARTIAL_WRITE_REP,$WBEM_WRITE_PROVIDER,$WBEM_REMOTE_ACCESS,`

            $READ_CONTROL,$WRITE_DAC

        $WBEM_RIGHTS_STRINGS = "Enable","MethodExecute","FullWrite","PartialWrite",`
            "ProviderWrite","RemoteAccess","ReadSecurity","WriteSecurity"

        $permissionTable = @{}
        for ($i = 0; $i -lt $WBEM_RIGHTS_FLAGS.Length; $i++) {
            $permissionTable.Add($WBEM_RIGHTS_STRINGS[$i].ToLower(), $WBEM_RIGHTS_FLAGS[$i])
        }

        $accessMask = 0
        foreach ($permission in $permissions) {
            if (-not $permissionTable.ContainsKey($permission.ToLower())) {
                throw "Unknown permission: $permission`nValid permissions: $($permissionTable.Keys)"
            }
            $accessMask += $permissionTable[$permission.ToLower()]
        }
        $accessMask
    }

    if ($PSBoundParameters.ContainsKey("Credential")) {
        $remoteparams = @{ComputerName=$computer;Credential=$credential}
    } else {
        $remoteparams = @{}
    }

    $invokeparams = @{Namespace=$namespace;Path="__systemsecurity=@"} + $remoteParams
    $output = Invoke-WmiMethod @invokeparams -Name GetSecurityDescriptor
    if ($output.ReturnValue -ne 0) {
        throw "GetSecurityDescriptor failed: $($output.ReturnValue)"
    }

    $acl = $output.Descriptor
    $OBJECT_INHERIT_ACE_FLAG = 0x1
    $CONTAINER_INHERIT_ACE_FLAG = 0x2
    $computerName = (Get-WmiObject @remoteparams Win32_ComputerSystem).Name

    if ($account.Contains('\')) {
        $domainaccount = $account.Split('\')
        $domain = $domainaccount[0]
        if (($domain -eq ".") -or ($domain -eq "BUILTIN")) {
            $domain = $computerName
        }
        $accountname = $domainaccount[1]
    } elseif ($account.Contains('@')) {
        $domainaccount = $account.Split('@')
        $domain = $domainaccount[1].Split('.')[0]
        $accountname = $domainaccount[0]
    } else {
        $domain = $computerName
        $accountname = $account
    }

    $getparams = @{Class="Win32_Account";Filter="Domain='$domain' and Name='$accountname'"} + $remoteParams
    $win32account = Get-WmiObject @getparams
    if ($win32account -eq $null) {
        throw "Account was not found: $account"
    }

    switch ($operation) {
        "add" {
            if ($permissions -eq $null) {
                throw "-Permissions must be specified for an add operation"
            }

            $accessMask = Get-AccessMaskFromPermission($permissions)
            $ace = (New-Object System.Management.ManagementClass("win32_Ace")).CreateInstance()
            $ace.AccessMask = $accessMask

            if ($allowInherit) {
                $ace.AceFlags = $OBJECT_INHERIT_ACE_FLAG + $CONTAINER_INHERIT_ACE_FLAG
            } else {
                $ace.AceFlags = 0
            }

            $trustee = (New-Object System.Management.ManagementClass("win32_Trustee")).CreateInstance()
            $trustee.SidString = $win32account.Sid
            $ace.Trustee = $trustee

            $ACCESS_ALLOWED_ACE_TYPE = 0x0
            $ACCESS_DENIED_ACE_TYPE = 0x1

            if ($deny) {
                $ace.AceType = $ACCESS_DENIED_ACE_TYPE
            } else {
                $ace.AceType = $ACCESS_ALLOWED_ACE_TYPE
            }
            $acl.DACL += $ace.psobject.immediateBaseObject
        }
        "delete" {
            if ($permissions -ne $null) {
               throw "Permissions cannot be specified for a delete operation"
            }

            [System.Management.ManagementBaseObject[]]$newDACL = @()
            foreach ($ace in $acl.DACL) {
                if ($ace.Trustee.SidString -ne $win32account.Sid) {
                    $newDACL += $ace.psobject.immediateBaseObject
                }
            }
            $acl.DACL = $newDACL.psobject.immediateBaseObject
        }
        default {
            throw "Unknown operation: $operation`nAllowed operations: add delete"
        }
    }

    $setparams = @{Name="SetSecurityDescriptor";ArgumentList=$acl.psobject.immediateBaseObject} + $invokeParams
    $output = Invoke-WmiMethod @setparams
    if ($output.ReturnValue -ne 0) {
        throw "SetSecurityDescriptor failed: $($output.ReturnValue)"
    }

}


'@ | Set-Content $script_name

$user = "shinken"
.\Set-WmiNamespaceSecurity.ps1 "root\cimv2"  add $user Enable,RemoteAccess
.\Set-WmiNamespaceSecurity.ps1 "root\standardcimv2" add $user Enable,RemoteAccess

rm .\Set-WmiNamespaceSecurity.ps1

$user = "shinken"

$sid = (New-Object System.Security.Principal.NTAccount($user)).Translate([System.Security.Principal.SecurityIdentifier]).Value
$currentSddl = & sc.exe sdshow w32time
# Ajoute les droits suivants à l'utilisateur
# CC – SERVICE_QUERY_CONFIG
# LC – SERVICE_QUERY_STATUS
# LO – SERVICE_INTERROGATE
$newAce = "(A;;CCLCLO;;;${sid})"
$newSddl = $currentSddl + $newAce

sc.exe sdset w32time "$newSddl"

Restart-Service w32time

Le script necessite les droits administrateurs pour l'execution

& {

param(
    [Parameter(Mandatory = $true)][string]$UserName,
    [Parameter(Mandatory = $true)][string]$Password,
    [Parameter(Mandatory = $true)][bool]$Basic,
    [Parameter(Mandatory = $true)][bool]$Negotiate,
    [Parameter(Mandatory = $true)][bool]$AllowUnencrypted
)



function Add-StepResult {
    param([string]$Name,[bool]$Ok,[string]$Msg="")
    $icon = if ($Ok) {"OK"} else {"KO"}
    $status = if ($Ok) {"Success"} else {"Failed"}
    [void]$Steps.Add([PSCustomObject]@{ Step=$Name; Status=$status; Message="$icon $Msg" })
}

function Execute-Step {
    param([string]$Name,[scriptblock]$Action)
    try {
        & $Action
        Add-StepResult -Name $Name -Ok $true -Msg "Étape réussie"
    } catch {
        Add-StepResult -Name $Name -Ok $false -Msg ("Erreur : " + $_.Exception.Message)
        throw "Step $Name failed"
    }
}

function Install-LanguageIfNeeded {
    param([string]$LangCode)
    Write-Host "[1/8] Installation de la langue $LangCode et configuration" -ForegroundColor Yellow
    try {
        Install-Language -Language $LangCode -ExcludeFeatures
    }
    catch {
        Write-Host "Impossible d'installer la lange $LangCode. Veuillez l'installer par interface graphique depuis un compte admin"
    }
   
    $languages = Get-WinUserLanguageList
    if ($languages.LanguageTag -notcontains $LangCode) {
        Write-Host "Langue $LangCode non présente, ajout..." -ForegroundColor Gray
        $languages.Add($LangCode)
        Set-WinUserLanguageList $languages -Force
        Write-Host "Langue $LangCode ajoutée." -ForegroundColor Green
    } else {
        Write-Host "Langue $LangCode déjà disponible." -ForegroundColor Green
    }
    Write-Host ""
}

function Configure-WinRM {
    Write-Host "[2/8] Configuration rapide de WinRM" -ForegroundColor Yellow
    winrm quickconfig -q
    if ($LASTEXITCODE -ne 0) { throw "WinRM quickconfig a échoué ($LASTEXITCODE)" }
    Write-Host "WinRM configuré." -ForegroundColor Green
    Write-Host ""
}

function Add-UserToExistingGroup {
    param(
        [string]$UserName,
        [string]$PrimaryGroup,
        [string]$FallbackGroup
    )

    $members = $null
    $groupUsed = $null

    # Try primary, then fallback (catch GroupNotFound)
    try {
        $members = Get-LocalGroupMember -Group $PrimaryGroup -ErrorAction Stop
        $groupUsed = $PrimaryGroup
    } catch [Microsoft.PowerShell.Commands.GroupNotFoundException] {
        try {
            $members = Get-LocalGroupMember -Group $FallbackGroup -ErrorAction Stop
            $groupUsed = $FallbackGroup
        } catch {
            throw "Aucun des groupes '$PrimaryGroup' ou '$FallbackGroup' n'existe."
        }
    }

    if ($null -eq $members) { $members = @() }
    if (-not ($members -is [System.Collections.IEnumerable])) { $members = @($members) }

    # Check membership by comparing the last segment after '\' (handles DOMAIN\user or COMPUTER\user)
    $isMember = $false
    foreach ($m in $members) {
        $memberSimpleName = ($m.Name -split '\\')[-1]
        if ($memberSimpleName -eq $UserName -or $m.Name -eq $UserName) {
            $isMember = $true
            break
        }
    }

    if (-not $isMember) {
        & net localgroup $groupUsed $UserName /ADD 2> $null
        if ($LASTEXITCODE -ne 0) {
            throw "Échec ajout utilisateur $UserName dans le groupe $groupUsed ($LASTEXITCODE)"
        } else {
            Write-Host "Utilisateur $UserName ajouté au groupe $groupUsed" -ForegroundColor Green
        }
    } else {
        Write-Host "Utilisateur $UserName déjà dans le groupe $groupUsed" -ForegroundColor Gray
    }
}
function Create-User {
    param([string]$UserName, [string]$Password)

    Write-Host "[3/8] Création de l'utilisateur $UserName" -ForegroundColor Yellow

    # Create user if not exists (same behaviour as before)
    if (-not (Get-LocalUser -Name $UserName -ErrorAction SilentlyContinue)) {
        & net user $UserName $Password /ADD | Out-Null
        if ($LASTEXITCODE -ne 0) { throw "Échec création utilisateur via 'net user' ($LASTEXITCODE)" }
    } else {
        Write-Host "Utilisateur déjà existant : $UserName" -ForegroundColor Gray
    }

    # Call the helper for each group pair (primary, fallback)
    Add-UserToExistingGroup -UserName $UserName -PrimaryGroup "Remote Management Users" -FallbackGroup "Utilisateurs de gestion à distance"
    Add-UserToExistingGroup -UserName $UserName -PrimaryGroup "Performance Monitor Users" -FallbackGroup "Utilisateurs de l’Analyseur de performances"

    Write-Host "Utilisateur $UserName créé/validé et groupes assignés." -ForegroundColor Green

    # Test credentials (unchanged)
    $SecurePassword = ConvertTo-SecureString $Password -AsPlainText -Force
    $Credential = New-Object System.Management.Automation.PSCredential ($UserName, $SecurePassword)
    Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -Command whoami" -Credential $Credential -Wait
    Start-Sleep -Seconds 2
    Write-Host ""
}

function Configure-UserLanguage {
    param([string]$UserName, [string]$LangCode)
    Write-Host "[4/8] Configuration de la langue pour l'utilisateur $UserName" -ForegroundColor Yellow
 
    $User = Get-LocalUser -Name $UserName -ErrorAction Stop
    $SID = $User.SID
    $UserProfile = Get-CimInstance Win32_UserProfile | Where-Object SID -eq $SID
    if (-not $UserProfile) { throw "Profil introuvable pour $UserName" }
    $HivePath = Join-Path $UserProfile.LocalPath "NTUSER.DAT"
    if (-not (Test-Path $HivePath)) { throw "Profil non initialisé (NTUSER.DAT introuvable) : $HivePath" }
 
    $regRelative = "Control Panel\Desktop"
    $valueName = "PreferredUILanguages"
 
    [string[]]$LangArray = @($LangCode)
 
    $IsLoaded = Test-Path "Registry::HKEY_USERS\$SID"
    if ($IsLoaded) {
        $fullPath = "Registry::HKEY_USERS\$SID\$regRelative"
        if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null }
        if (-not (Get-ItemProperty -Path $fullPath -Name $valueName -ErrorAction SilentlyContinue)) {
            New-ItemProperty -Path $fullPath -Name $valueName -Value $LangArray -PropertyType MultiString -Force | Out-Null
        } else {
            Set-ItemProperty -Path $fullPath -Name $valueName -Value $LangArray
        }
    } else {
        Write-Host "Utilisateur non connecté. Chargement de la ruche..." -ForegroundColor Gray
        reg load "HKU\TempHive" $HivePath | Out-Null
        try {
            $tempPath = "Registry::HKEY_USERS\TempHive\$regRelative"
            if (-not (Test-Path $tempPath)) { New-Item -Path $tempPath -Force | Out-Null }
            if (-not (Get-ItemProperty -Path $tempPath -Name $valueName -ErrorAction SilentlyContinue)) {
                New-ItemProperty -Path $tempPath -Name $valueName -Value $LangArray -PropertyType MultiString -Force | Out-Null
            } else {
                Set-ItemProperty -Path $tempPath -Name $valueName -Value $LangArray
            }
        } finally {
            reg unload "HKU\TempHive" | Out-Null
            Write-Host "Ruche déchargée." -ForegroundColor Gray
        }
    }
 
    Write-Host "Langue préférée utilisateur définie sur $LangCode (REG_MULTI_SZ)." -ForegroundColor Green
    Write-Host ""
}

function Configure-WinRMAuth {
    param($Basic, $Negotiate, $AllowUnencrypted)
 
    Write-Host "[5/8] Configuration de l'authentification WinRM" -ForegroundColor Yellow

    if (!$Basic -and !$Negotiate) {
        throw "Au moins un mode d'authentification doit être paramétré"
    }

    if ($Basic) {
        winrm set winrm/config/service/auth '@{Basic="true"}'
    }
    
    if ($Negotiate) {
        winrm set winrm/config/service/auth '@{Negotiate="true"}'
    }

    if ($AllowUnencrypted) {
        winrm set winrm/config/service '@{AllowUnencrypted="true"}'
    }

    Write-Host "Configuration d'authentification définie." -ForegroundColor Green
    Write-Host ""
}

function Configure-WinRMSDDL {
    param([string]$UserName)
    Write-Host "[6/8] Attribution des droits WinRM (SDDL)" -ForegroundColor Yellow
 
    $GENERIC_READ = 0x80000000
    $GENERIC_EXECUTE = 0x20000000
    $user_sid = (New-Object System.Security.Principal.NTAccount $UserName).Translate([System.Security.Principal.SecurityIdentifier])
 
    $sddl = (Get-Item -Path WSMan:\localhost\Service\RootSDDL).Value
    $sd = New-Object System.Security.AccessControl.CommonSecurityDescriptor $false, $false, $sddl
    $sd.DiscretionaryAcl.AddAccess(
        [System.Security.AccessControl.AccessControlType]::Allow,
        $user_sid,
        ($GENERIC_READ -bor $GENERIC_EXECUTE),
        [System.Security.AccessControl.InheritanceFlags]::None,
        [System.Security.AccessControl.PropagationFlags]::None
    )
    $new_sddl = $sd.GetSddlForm([System.Security.AccessControl.AccessControlSections]::All)
    Set-Item -Path WSMan:\localhost\Service\RootSDDL -Value $new_sddl -Force
    Write-Host "Droits SDDL appliqués." -ForegroundColor Green
    Write-Host ""
}

Function Configure-CIMSDDL {
    param(
        [parameter(Mandatory=$true,Position=0)][string] $namespace,
        [parameter(Mandatory=$true,Position=1)][string] $operation,
        [parameter(Mandatory=$true,Position=2)][string] $account,
        [parameter(Position=3)][string[]] $permissions = $null,
        [bool] $allowInherit = $false,
        [bool] $deny = $false,
        [string] $computerName = ".",
        [System.Management.Automation.PSCredential] $credential = $null
    )
 
    Write-Host "[7/8] Attribution des droits WMI/CIM" -ForegroundColor Yellow
    $ErrorActionPreference = "Stop"
 
    Function Get-AccessMaskFromPermission($permissions) {
        $WBEM_ENABLE = 1
        $WBEM_METHOD_EXECUTE = 2
        $WBEM_FULL_WRITE_REP = 4
        $WBEM_PARTIAL_WRITE_REP = 8
        $WBEM_WRITE_PROVIDER = 0x10
        $WBEM_REMOTE_ACCESS = 0x20
        $READ_CONTROL = 0x20000
        $WRITE_DAC = 0x40000
 
        $WBEM_RIGHTS_FLAGS = $WBEM_ENABLE,$WBEM_METHOD_EXECUTE,$WBEM_FULL_WRITE_REP,
            $WBEM_PARTIAL_WRITE_REP,$WBEM_WRITE_PROVIDER,$WBEM_REMOTE_ACCESS,
            $READ_CONTROL,$WRITE_DAC
 
        $WBEM_RIGHTS_STRINGS = "Enable","MethodExecute","FullWrite","PartialWrite",
            "ProviderWrite","RemoteAccess","ReadSecurity","WriteSecurity"
 
        $permissionTable = @{}
        for ($i = 0; $i -lt $WBEM_RIGHTS_FLAGS.Length; $i++) {
            $permissionTable.Add($WBEM_RIGHTS_STRINGS[$i].ToLower(), $WBEM_RIGHTS_FLAGS[$i])
        }
 
        $accessMask = 0
        foreach ($permission in $permissions) {
            if (-not $permissionTable.ContainsKey($permission.ToLower())) {
                throw "Unknown permission: $permission`nValid permissions: $($permissionTable.Keys)"
            }
            $accessMask += $permissionTable[$permission.ToLower()]
        }
        $accessMask
    }
 
    if ($PSBoundParameters.ContainsKey("Credential")) {
        $remoteparams = @{ComputerName=$computerName;Credential=$credential}
    } else {
        $remoteparams = @{}
    }
 
    $invokeparams = @{Namespace=$namespace;Path="__systemsecurity=@"} + $remoteParams
    $output = Invoke-WmiMethod @invokeparams -Name GetSecurityDescriptor
    if ($output.ReturnValue -ne 0) {
        throw "GetSecurityDescriptor failed: $($output.ReturnValue)"
    }
 
    $acl = $output.Descriptor
    $OBJECT_INHERIT_ACE_FLAG = 0x1
    $CONTAINER_INHERIT_ACE_FLAG = 0x2
    $computerName = (Get-WmiObject @remoteparams Win32_ComputerSystem).Name
 
    if ($account.Contains('\')) {
        $domainaccount = $account.Split('\')
        $domain = $domainaccount[0]
        if (($domain -eq ".") -or ($domain -eq "BUILTIN")) {
            $domain = $computerName
        }
        $accountname = $domainaccount[1]
    } elseif ($account.Contains('@')) {
        $domainaccount = $account.Split('@')
        $domain = $domainaccount[1].Split('.')[0]
        $accountname = $domainaccount[0]
    } else {
        $domain = $computerName
        $accountname = $account
    }
 
    $getparams = @{Class="Win32_Account";Filter="Domain='$domain' and Name='$accountname'"} + $remoteParams
    $win32account = Get-WmiObject @getparams
    if ($null -eq $win32account) {
        throw "Account was not found: $account"
    }
 
    switch ($operation) {
        "add" {
            if ($null -eq $permissions) {
                throw "-Permissions must be specified for an add operation"
            }
 
            $accessMask = Get-AccessMaskFromPermission($permissions)
            $ace = (New-Object System.Management.ManagementClass("win32_Ace")).CreateInstance()
            $ace.AccessMask = $accessMask
            $ace.AceFlags = if ($allowInherit) { $OBJECT_INHERIT_ACE_FLAG + $CONTAINER_INHERIT_ACE_FLAG } else { 0 }
 
            $trustee = (New-Object System.Management.ManagementClass("win32_Trustee")).CreateInstance()
            $trustee.SidString = $win32account.Sid
            $ace.Trustee = $trustee
            $ace.AceType = if ($deny) { 0x1 } else { 0x0 }
 
            $acl.DACL += $ace.psobject.immediateBaseObject
        }
        default {
            throw "Unknown operation: $operation`nAllowed operations: add"
        }
    }
 
    $setparams = @{Name="SetSecurityDescriptor";ArgumentList=$acl.psobject.immediateBaseObject} + $invokeParams
    $output = Invoke-WmiMethod @setparams
    if ($output.ReturnValue -ne 0) {
        throw "SetSecurityDescriptor failed: $($output.ReturnValue)"
    }
}

function Configure-W32TimeSDDL {
    param([string]$UserName)
    Write-Host "[8/8] Attribution des droits sur W32Time" -ForegroundColor Yellow
 
    $sid = (New-Object System.Security.Principal.NTAccount($UserName)).Translate([System.Security.Principal.SecurityIdentifier]).Value
    $currentSddl = & sc.exe sdshow w32time
    $newAce = "(A;;CCLCLO;;;${sid})"
    $newSddl = $currentSddl + $newAce
    sc.exe sdset w32time "$newSddl"
    Restart-Service w32time
 
    Write-Host "Droits W32Time appliqués pour $UserName." -ForegroundColor Green
    Write-Host ""
}

function Run-All-Steps {
    try {
        Execute-Step "Langue en-US" { Install-LanguageIfNeeded -LangCode $LangCode }
        Execute-Step "WinRM quickconfig" { Configure-WinRM }
        Execute-Step "Création utilisateur + Ajout aux groupes" { Create-User -UserName $UserName -Password $Password }
        Execute-Step "Langue UI du profil" { Configure-UserLanguage -UserName $UserName -LangCode $LangCode }
        Execute-Step "WinRM Auth" { Configure-WinRMAuth $Basic $Negotiate $AllowUnencrypted }
        Execute-Step "WinRM RootSDDL" { Configure-WinRMSDDL -UserName $UserName }
        Execute-Step "WMI/CIM root\cimv2 (Enable+RemoteAccess)" { Configure-CIMSDDL "root/cimv2" add $UserName Enable,RemoteAccess }
        Execute-Step "WMI/CIM root\standardcimv2 (Enable+RemoteAccess)" { Configure-CIMSDDL "root/standardcimv2" add $UserName Enable,RemoteAccess }
        Execute-Step "W32Time SDDL" { Configure-W32TimeSDDL -UserName $UserName }
    } catch {
        # Do nothing. 
    }
}
    
function Configure {
    $LangCode = "en-US"
    $Steps = New-Object System.Collections.ArrayList

    Write-Host "========================================================" -ForegroundColor DarkGray
    Write-Host "CONFIGURE PACK [windows-by-WinRM] for supervised host" -ForegroundColor Cyan
    Write-Host "========================================================" -ForegroundColor DarkGray
    Write-Host ""

    Run-All-Steps
    Write-Host ""
    Write-Host ("═" * 70) -ForegroundColor DarkGray
    Write-Host "RÉSUMÉ DES ÉTAPES" -ForegroundColor Yellow
    Write-Host ("═" * 70) -ForegroundColor DarkGray
        
    foreach ($s in $Steps) {
        if ($s.Status -eq "Success") {
            Write-Host ("[OK] {0} : {1}" -f $s.Step, $s.Message) -ForegroundColor Green
        } else {
            Write-Host ("[KO] {0} : {1}" -f $s.Step, $s.Message) -ForegroundColor Red
        }
    }
        
    Write-Host ("═" * 70) -ForegroundColor DarkGray
}

Configure

}