Les configurations suivantes sont destinées à des postes Windows configurés en "groupe de travail". La configuration pour un poste d'un "domaine" peut différer.

• Windows 11
• Windows 10
• Windows Server 2025
• Windows Server 2022
• Windows Server 2019
• Windows Server 2016
• Windows Server 2012 R2

Les commandes ci-dessous doivent être exécutées par un administrateur local de la machine ( sauf mention contraire ).

Get-Service WinRM

C:\Users\Administrateur> Get-Service WinRM

Status   Name               DisplayName
------   ----               -----------
Running  WinRM              Gestion à distance de Windows (Gest...

winrm quickconfig

C:\Users\Administrateur> winrm quickconfig  

WinRM n'est pas configuré pour la gestion à distance de cet ordinateur.
Les modifications suivantes doivent être effectuées :

Créez un écouteur WinRM sur HTTP://* pour accepter les demandes de la gestion des services Web sur toutes les adresses IP de cet ordinateur.

Activez l'exception de pare-feu WinRM.
Configurez LocalAccountTokenFilterPolicy pour attribuer des droits d'administration à distance à des utilisateurs locaux.

Effectuer ces modifications [y/n] ? y

WinRM a été mis à jour pour la gestion à distance.

Écouteur WinRM créé sur HTTP://* pour accepter les demandes de la gestion des services Web sur toutes les adresses IP de cet ordinateur.

Exception de pare-feu WinRM activée.
LocalAccountTokenFilterPolicy configuré pour attribuer des droits d'administration à distance à des utilisateurs locaux.

winrm set winrm/config/service/auth '@{Negotiate="true"}'

L’utilisation du protocole « Basic » n’est pas recommandée lorsque des modes d’authentification plus sécurisés sont disponibles sur le système.

winrm set winrm/config/service/auth '@{Basic="true"}'

winrm set winrm/config/service '@{AllowUnencrypted="true"}'

net user "shinken" "mon_motdepasse" /ADD

Remplacer ici "mon_motdepasse".

Il est nécessaire d'installer la langue "English (United-States)" depuis le compte administrateur pour les windows suivants :

• windows server 2019
• windows server 2022

Sinon vous pouvez sauter cette étape et installer la langue pour le nouvel utilisateur de supervision créé.

Il est nécessaire de se connecter au nouveau compte créer pour changer la langue de l'utilisateur.

Cette commande n'est disponible que sur Windows 11 et Windows Server 2025.
Il vous faudra sinon télécharger la langue manuellement.

Install-Language -Language en-US

# === 1. Config ===
$UserName = "shinken"
$LangCode = "en-US"

# Demander le mot de passe de manière sécurisée
$Credential = Get-Credential -UserName $UserName -Message "Mot de passe pour l'utilisateur $UserName"

# === 2. Forcer la création du profil utilisateur si nécessaire ===
Write-Host "Création/vérification du profil utilisateur $UserName..."
Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -Command whoami" -Credential $Credential -Wait

# Attendre un court délai pour laisser Windows créer le profil
Start-Sleep -Seconds 2

# === 3. Vérifier/ajouter la langue sur la machine ===
$languages = Get-WinUserLanguageList
if ($languages.LanguageTag -notcontains $LangCode) {
    Write-Host "La langue $LangCode n'est pas installée. Ajout..."
    $languages.Add($LangCode)
    Set-WinUserLanguageList $languages -Force
    Write-Host "Langue $LangCode ajoutée."
} else {
    Write-Host "Langue $LangCode déjà disponible."
}

# === 4. Récupérer infos profil utilisateur ===
$User = Get-LocalUser -Name $UserName -ErrorAction Stop
$SID = $User.SID
$Profile = Get-CimInstance Win32_UserProfile | Where-Object SID -eq $SID
$HivePath = "$($Profile.LocalPath)\NTUSER.DAT"

if (-not (Test-Path $HivePath)) {
    throw "Profil introuvable ou non initialisé : $HivePath"
}

# === 5. Déterminer si l'utilisateur est connecté ===
$IsLoaded = Test-Path "Registry::HKEY_USERS\$SID"

if ($IsLoaded) {
    Write-Host "L'utilisateur $UserName est connecté. Modification directe..."
    [string[]]$LangArray = $LangCode
    Set-ItemProperty -Path "Registry::HKEY_USERS\$SID\Control Panel\Desktop" -Name PreferredUILanguages -Value $LangArray
} else {
    Write-Host "L'utilisateur $UserName n'est pas connecté. Chargement de la ruche..."
    reg load "HKU\TempHive" $HivePath | Out-Null
    try {
        [string[]]$LangArray = $LangCode
        Set-ItemProperty -Path "Registry::HKEY_USERS\TempHive\Control Panel\Desktop" -Name PreferredUILanguages -Value $LangArray
    }
    finally {
        reg unload "HKU\TempHive" | Out-Null
        Write-Host "Ruche déchargée."
    }
}

Write-Host "Langue UI de $UserName changée en $LangCode."
Write-Host "Déconnectez/reconnectez $UserName pour appliquer le changement."

Ensuite, il est nécessaire de se déconnecter puis se reconnecter au nouvel utilisateur afin de correctement appliquer le changement de langue.

Sur certaines distributions inférieures à Windows 2012, le groupe "Utilisateurs de gestion à distance" et sa fonction n'existent pas.

net localgroup "Remote Management Users" "shinken" /ADD
net localgroup "Performance Monitor Users" "shinken" /ADD

net localgroup "Utilisateurs de gestion à distance" "shinken" /ADD
net localgroup "Utilisateurs de l’Analyseur de performances" "shinken" /ADD

Il est possible que la commande "net localgroup "Utilisateurs de l’Analyseur de performances" "shinken" /ADD" ne fonctionne pas lors d'un copier-coller.

Il y a un bug avec le terminal PowerShell sur le copier-coller qui ne retranscrira pas le symbole apostrophe ’ lorsque l'action "coller" est déclenché avec un clic droit dans le terminal.
Il faut utiliser le raccourci "CTRL+V" affin de coller correctement la commande
Sinon, il est possible de générer le caractère spécial apostrophe ’ avec le raccourci "ALT + 0146".  ( Différent de l'apostrophe de la touche 4 ).

Example du bug du copier-coller dans un terminal PowerShell Administrateur où l'apostrophe n'est pas retranscrit :

winrm configSDDL default

$user = "shinken"

$GENERIC_READ = 0x80000000
$GENERIC_EXECUTE = 0x20000000

$user_sid = (New-Object -TypeName System.Security.Principal.NTAccount -ArgumentList $user).Translate([System.Security.Principal.SecurityIdentifier])

# get the existing SDDL of the WinRM listener
$sddl = (Get-Item -Path WSMan:\localhost\Service\RootSDDL).Value

# convert the SDDL string to a SecurityDescriptor object
$sd = New-Object -TypeName System.Security.AccessControl.CommonSecurityDescriptor -ArgumentList $false, $false, $sddl

# apply a new DACL to the SecurityDescriptor object
$sd.DiscretionaryAcl.AddAccess(
    [System.Security.AccessControl.AccessControlType]::Allow,
    $user_sid,
    ($GENERIC_READ -bor $GENERIC_EXECUTE),
    [System.Security.AccessControl.InheritanceFlags]::None,
    [System.Security.AccessControl.PropagationFlags]::None
)

# get the SDDL string from the changed SecurityDescriptor object
$new_sddl = $sd.GetSddlForm([System.Security.AccessControl.AccessControlSections]::All)

# apply the new SDDL to the WinRM listener
Set-Item -Path WSMan:\localhost\Service\RootSDDL -Value $new_sddl -Force 

Cette section n'est pas nécessaire si les machines supervisées sont configurées avec un Active Directory.

wmimgmt.msc

$script_name = ".\Set-WmiNamespaceSecurity.ps1"

@'
# Set-WmiNamespaceSecurity.ps1
# Example: Set-WmiNamespaceSecurity root/cimv2 add steve Enable,RemoteAccess

Param ( [parameter(Mandatory=$true,Position=0)][string] $namespace,
    [parameter(Mandatory=$true,Position=1)][string] $operation,
    [parameter(Mandatory=$true,Position=2)][string] $account,
    [parameter(Position=3)][string[]] $permissions = $null,
    [bool] $allowInherit = $false,
    [bool] $deny = $false,
    [string] $computerName = ".",
    [System.Management.Automation.PSCredential] $credential = $null)

Process {
    $ErrorActionPreference = "Stop"
    Function Get-AccessMaskFromPermission($permissions) {
        $WBEM_ENABLE = 1
        $WBEM_METHOD_EXECUTE = 2
        $WBEM_FULL_WRITE_REP = 4
        $WBEM_PARTIAL_WRITE_REP = 8
        $WBEM_WRITE_PROVIDER = 0x10
        $WBEM_REMOTE_ACCESS = 0x20
        $WBEM_RIGHT_SUBSCRIBE = 0x40
        $WBEM_RIGHT_PUBLISH = 0x80
        $READ_CONTROL = 0x20000
        $WRITE_DAC = 0x40000

        $WBEM_RIGHTS_FLAGS = $WBEM_ENABLE,$WBEM_METHOD_EXECUTE,$WBEM_FULL_WRITE_REP,`

            $WBEM_PARTIAL_WRITE_REP,$WBEM_WRITE_PROVIDER,$WBEM_REMOTE_ACCESS,`

            $READ_CONTROL,$WRITE_DAC

        $WBEM_RIGHTS_STRINGS = "Enable","MethodExecute","FullWrite","PartialWrite",`
            "ProviderWrite","RemoteAccess","ReadSecurity","WriteSecurity"

        $permissionTable = @{}
        for ($i = 0; $i -lt $WBEM_RIGHTS_FLAGS.Length; $i++) {
            $permissionTable.Add($WBEM_RIGHTS_STRINGS[$i].ToLower(), $WBEM_RIGHTS_FLAGS[$i])
        }

        $accessMask = 0
        foreach ($permission in $permissions) {
            if (-not $permissionTable.ContainsKey($permission.ToLower())) {
                throw "Unknown permission: $permission`nValid permissions: $($permissionTable.Keys)"
            }
            $accessMask += $permissionTable[$permission.ToLower()]
        }
        $accessMask
    }

    if ($PSBoundParameters.ContainsKey("Credential")) {
        $remoteparams = @{ComputerName=$computer;Credential=$credential}
    } else {
        $remoteparams = @{}
    }

    $invokeparams = @{Namespace=$namespace;Path="__systemsecurity=@"} + $remoteParams
    $output = Invoke-WmiMethod @invokeparams -Name GetSecurityDescriptor
    if ($output.ReturnValue -ne 0) {
        throw "GetSecurityDescriptor failed: $($output.ReturnValue)"
    }

    $acl = $output.Descriptor
    $OBJECT_INHERIT_ACE_FLAG = 0x1
    $CONTAINER_INHERIT_ACE_FLAG = 0x2
    $computerName = (Get-WmiObject @remoteparams Win32_ComputerSystem).Name

    if ($account.Contains('\')) {
        $domainaccount = $account.Split('\')
        $domain = $domainaccount[0]
        if (($domain -eq ".") -or ($domain -eq "BUILTIN")) {
            $domain = $computerName
        }
        $accountname = $domainaccount[1]
    } elseif ($account.Contains('@')) {
        $domainaccount = $account.Split('@')
        $domain = $domainaccount[1].Split('.')[0]
        $accountname = $domainaccount[0]
    } else {
        $domain = $computerName
        $accountname = $account
    }

    $getparams = @{Class="Win32_Account";Filter="Domain='$domain' and Name='$accountname'"} + $remoteParams
    $win32account = Get-WmiObject @getparams
    if ($win32account -eq $null) {
        throw "Account was not found: $account"
    }

    switch ($operation) {
        "add" {
            if ($permissions -eq $null) {
                throw "-Permissions must be specified for an add operation"
            }

            $accessMask = Get-AccessMaskFromPermission($permissions)
            $ace = (New-Object System.Management.ManagementClass("win32_Ace")).CreateInstance()
            $ace.AccessMask = $accessMask

            if ($allowInherit) {
                $ace.AceFlags = $OBJECT_INHERIT_ACE_FLAG + $CONTAINER_INHERIT_ACE_FLAG
            } else {
                $ace.AceFlags = 0
            }

            $trustee = (New-Object System.Management.ManagementClass("win32_Trustee")).CreateInstance()
            $trustee.SidString = $win32account.Sid
            $ace.Trustee = $trustee

            $ACCESS_ALLOWED_ACE_TYPE = 0x0
            $ACCESS_DENIED_ACE_TYPE = 0x1

            if ($deny) {
                $ace.AceType = $ACCESS_DENIED_ACE_TYPE
            } else {
                $ace.AceType = $ACCESS_ALLOWED_ACE_TYPE
            }
            $acl.DACL += $ace.psobject.immediateBaseObject
        }
        "delete" {
            if ($permissions -ne $null) {
               throw "Permissions cannot be specified for a delete operation"
            }

            [System.Management.ManagementBaseObject[]]$newDACL = @()
            foreach ($ace in $acl.DACL) {
                if ($ace.Trustee.SidString -ne $win32account.Sid) {
                    $newDACL += $ace.psobject.immediateBaseObject
                }
            }
            $acl.DACL = $newDACL.psobject.immediateBaseObject
        }
        default {
            throw "Unknown operation: $operation`nAllowed operations: add delete"
        }
    }

    $setparams = @{Name="SetSecurityDescriptor";ArgumentList=$acl.psobject.immediateBaseObject} + $invokeParams
    $output = Invoke-WmiMethod @setparams
    if ($output.ReturnValue -ne 0) {
        throw "SetSecurityDescriptor failed: $($output.ReturnValue)"
    }

}


'@ | Set-Content $script_name

$user = "shinken"
.\Set-WmiNamespaceSecurity.ps1 "root\cimv2"  add $user Enable,RemoteAccess
.\Set-WmiNamespaceSecurity.ps1 "root\standardcimv2" add $user Enable,RemoteAccess

rm .\Set-WmiNamespaceSecurity.ps1

$user = "shinken"

$sid = (New-Object System.Security.Principal.NTAccount($user)).Translate([System.Security.Principal.SecurityIdentifier]).Value
$currentSddl = & sc.exe sdshow w32time
# Ajoute les droits suivants à l'utilisateur
# CC – SERVICE_QUERY_CONFIG
# LC – SERVICE_QUERY_STATUS
# LO – SERVICE_INTERROGATE
$newAce = "(A;;CCLCLO;;;${sid})"
$newSddl = $currentSddl + $newAce

sc.exe sdset w32time "$newSddl"

Restart-Service w32time

Le script necessite les droits administrateurs pour l'execution

& {

param(
    [Parameter(Mandatory = $true)][string]$UserName,
    [Parameter(Mandatory = $true)][string]$Password,
    [Parameter(Mandatory = $true)][bool]$Basic,
    [Parameter(Mandatory = $true)][bool]$Negotiate,
    [Parameter(Mandatory = $true)][bool]$AllowUnencrypted
)



function Add-StepResult {
    param([string]$Name,[bool]$Ok,[string]$Msg="")
    $icon = if ($Ok) {"OK"} else {"KO"}
    $status = if ($Ok) {"Success"} else {"Failed"}
    [void]$Steps.Add([PSCustomObject]@{ Step=$Name; Status=$status; Message="$icon $Msg" })
}

function Execute-Step {
    param([string]$Name,[scriptblock]$Action)
    try {
        & $Action
        Add-StepResult -Name $Name -Ok $true -Msg "Étape réussie"
    } catch {
        Add-StepResult -Name $Name -Ok $false -Msg ("Erreur : " + $_.Exception.Message)
        throw "Step $Name failed"
    }
}

function Install-LanguageIfNeeded {
    param([string]$LangCode)
    Write-Host "[1/8] Installation de la langue $LangCode et configuration" -ForegroundColor Yellow
    try {
        Install-Language -Language $LangCode -ExcludeFeatures
    }
    catch {
        Write-Host "Impossible d'installer la lange $LangCode. Veuillez l'installer par interface graphique depuis un compte admin"
    }
   
    $languages = Get-WinUserLanguageList
    if ($languages.LanguageTag -notcontains $LangCode) {
        Write-Host "Langue $LangCode non présente, ajout..." -ForegroundColor Gray
        $languages.Add($LangCode)
        Set-WinUserLanguageList $languages -Force
        Write-Host "Langue $LangCode ajoutée." -ForegroundColor Green
    } else {
        Write-Host "Langue $LangCode déjà disponible." -ForegroundColor Green
    }
    Write-Host ""
}

function Configure-WinRM {
    Write-Host "[2/8] Configuration rapide de WinRM" -ForegroundColor Yellow
    winrm quickconfig -q
    if ($LASTEXITCODE -ne 0) { throw "WinRM quickconfig a échoué ($LASTEXITCODE)" }
    Write-Host "WinRM configuré." -ForegroundColor Green
    Write-Host ""
}

function Add-UserToExistingGroup {
    param(
        [string]$UserName,
        [string]$PrimaryGroup,
        [string]$FallbackGroup
    )

    $members = $null
    $groupUsed = $null

    # Try primary, then fallback (catch GroupNotFound)
    try {
        $members = Get-LocalGroupMember -Group $PrimaryGroup -ErrorAction Stop
        $groupUsed = $PrimaryGroup
    } catch [Microsoft.PowerShell.Commands.GroupNotFoundException] {
        try {
            $members = Get-LocalGroupMember -Group $FallbackGroup -ErrorAction Stop
            $groupUsed = $FallbackGroup
        } catch {
            throw "Aucun des groupes '$PrimaryGroup' ou '$FallbackGroup' n'existe."
        }
    }

    if ($null -eq $members) { $members = @() }
    if (-not ($members -is [System.Collections.IEnumerable])) { $members = @($members) }

    # Check membership by comparing the last segment after '\' (handles DOMAIN\user or COMPUTER\user)
    $isMember = $false
    foreach ($m in $members) {
        $memberSimpleName = ($m.Name -split '\\')[-1]
        if ($memberSimpleName -eq $UserName -or $m.Name -eq $UserName) {
            $isMember = $true
            break
        }
    }

    if (-not $isMember) {
        & net localgroup $groupUsed $UserName /ADD 2> $null
        if ($LASTEXITCODE -ne 0) {
            throw "Échec ajout utilisateur $UserName dans le groupe $groupUsed ($LASTEXITCODE)"
        } else {
            Write-Host "Utilisateur $UserName ajouté au groupe $groupUsed" -ForegroundColor Green
        }
    } else {
        Write-Host "Utilisateur $UserName déjà dans le groupe $groupUsed" -ForegroundColor Gray
    }
}
function Create-User {
    param([string]$UserName, [string]$Password)

    Write-Host "[3/8] Création de l'utilisateur $UserName" -ForegroundColor Yellow

    # Create user if not exists (same behaviour as before)
    if (-not (Get-LocalUser -Name $UserName -ErrorAction SilentlyContinue)) {
        & net user $UserName $Password /ADD | Out-Null
        if ($LASTEXITCODE -ne 0) { throw "Échec création utilisateur via 'net user' ($LASTEXITCODE)" }
    } else {
        Write-Host "Utilisateur déjà existant : $UserName" -ForegroundColor Gray
    }

    # Call the helper for each group pair (primary, fallback)
    Add-UserToExistingGroup -UserName $UserName -PrimaryGroup "Remote Management Users" -FallbackGroup "Utilisateurs de gestion à distance"
    Add-UserToExistingGroup -UserName $UserName -PrimaryGroup "Performance Monitor Users" -FallbackGroup "Utilisateurs de l’Analyseur de performances"

    Write-Host "Utilisateur $UserName créé/validé et groupes assignés." -ForegroundColor Green

    # Test credentials (unchanged)
    $SecurePassword = ConvertTo-SecureString $Password -AsPlainText -Force
    $Credential = New-Object System.Management.Automation.PSCredential ($UserName, $SecurePassword)
    Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -Command whoami" -Credential $Credential -Wait
    Start-Sleep -Seconds 2
    Write-Host ""
}

function Configure-UserLanguage {
    param([string]$UserName, [string]$LangCode)
    Write-Host "[4/8] Configuration de la langue pour l'utilisateur $UserName" -ForegroundColor Yellow
 
    $User = Get-LocalUser -Name $UserName -ErrorAction Stop
    $SID = $User.SID
    $UserProfile = Get-CimInstance Win32_UserProfile | Where-Object SID -eq $SID
    if (-not $UserProfile) { throw "Profil introuvable pour $UserName" }
    $HivePath = Join-Path $UserProfile.LocalPath "NTUSER.DAT"
    if (-not (Test-Path $HivePath)) { throw "Profil non initialisé (NTUSER.DAT introuvable) : $HivePath" }
 
    $regRelative = "Control Panel\Desktop"
    $valueName = "PreferredUILanguages"
 
    [string[]]$LangArray = @($LangCode)
 
    $IsLoaded = Test-Path "Registry::HKEY_USERS\$SID"
    if ($IsLoaded) {
        $fullPath = "Registry::HKEY_USERS\$SID\$regRelative"
        if (-not (Test-Path $fullPath)) { New-Item -Path $fullPath -Force | Out-Null }
        if (-not (Get-ItemProperty -Path $fullPath -Name $valueName -ErrorAction SilentlyContinue)) {
            New-ItemProperty -Path $fullPath -Name $valueName -Value $LangArray -PropertyType MultiString -Force | Out-Null
        } else {
            Set-ItemProperty -Path $fullPath -Name $valueName -Value $LangArray
        }
    } else {
        Write-Host "Utilisateur non connecté. Chargement de la ruche..." -ForegroundColor Gray
        reg load "HKU\TempHive" $HivePath | Out-Null
        try {
            $tempPath = "Registry::HKEY_USERS\TempHive\$regRelative"
            if (-not (Test-Path $tempPath)) { New-Item -Path $tempPath -Force | Out-Null }
            if (-not (Get-ItemProperty -Path $tempPath -Name $valueName -ErrorAction SilentlyContinue)) {
                New-ItemProperty -Path $tempPath -Name $valueName -Value $LangArray -PropertyType MultiString -Force | Out-Null
            } else {
                Set-ItemProperty -Path $tempPath -Name $valueName -Value $LangArray
            }
        } finally {
            reg unload "HKU\TempHive" | Out-Null
            Write-Host "Ruche déchargée." -ForegroundColor Gray
        }
    }
 
    Write-Host "Langue préférée utilisateur définie sur $LangCode (REG_MULTI_SZ)." -ForegroundColor Green
    Write-Host ""
}

function Configure-WinRMAuth {
    param($Basic, $Negotiate, $AllowUnencrypted)
 
    Write-Host "[5/8] Configuration de l'authentification WinRM" -ForegroundColor Yellow

    if (!$Basic -and !$Negotiate) {
        throw "Au moins un mode d'authentification doit être paramétré"
    }

    if ($Basic) {
        winrm set winrm/config/service/auth '@{Basic="true"}'
    }
    
    if ($Negotiate) {
        winrm set winrm/config/service/auth '@{Negotiate="true"}'
    }

    if ($AllowUnencrypted) {
        winrm set winrm/config/service '@{AllowUnencrypted="true"}'
    }

    Write-Host "Configuration d'authentification définie." -ForegroundColor Green
    Write-Host ""
}

function Configure-WinRMSDDL {
    param([string]$UserName)
    Write-Host "[6/8] Attribution des droits WinRM (SDDL)" -ForegroundColor Yellow
 
    $GENERIC_READ = 0x80000000
    $GENERIC_EXECUTE = 0x20000000
    $user_sid = (New-Object System.Security.Principal.NTAccount $UserName).Translate([System.Security.Principal.SecurityIdentifier])
 
    $sddl = (Get-Item -Path WSMan:\localhost\Service\RootSDDL).Value
    $sd = New-Object System.Security.AccessControl.CommonSecurityDescriptor $false, $false, $sddl
    $sd.DiscretionaryAcl.AddAccess(
        [System.Security.AccessControl.AccessControlType]::Allow,
        $user_sid,
        ($GENERIC_READ -bor $GENERIC_EXECUTE),
        [System.Security.AccessControl.InheritanceFlags]::None,
        [System.Security.AccessControl.PropagationFlags]::None
    )
    $new_sddl = $sd.GetSddlForm([System.Security.AccessControl.AccessControlSections]::All)
    Set-Item -Path WSMan:\localhost\Service\RootSDDL -Value $new_sddl -Force
    Write-Host "Droits SDDL appliqués." -ForegroundColor Green
    Write-Host ""
}

Function Configure-CIMSDDL {
    param(
        [parameter(Mandatory=$true,Position=0)][string] $namespace,
        [parameter(Mandatory=$true,Position=1)][string] $operation,
        [parameter(Mandatory=$true,Position=2)][string] $account,
        [parameter(Position=3)][string[]] $permissions = $null,
        [bool] $allowInherit = $false,
        [bool] $deny = $false,
        [string] $computerName = ".",
        [System.Management.Automation.PSCredential] $credential = $null
    )
 
    Write-Host "[7/8] Attribution des droits WMI/CIM" -ForegroundColor Yellow
    $ErrorActionPreference = "Stop"
 
    Function Get-AccessMaskFromPermission($permissions) {
        $WBEM_ENABLE = 1
        $WBEM_METHOD_EXECUTE = 2
        $WBEM_FULL_WRITE_REP = 4
        $WBEM_PARTIAL_WRITE_REP = 8
        $WBEM_WRITE_PROVIDER = 0x10
        $WBEM_REMOTE_ACCESS = 0x20
        $READ_CONTROL = 0x20000
        $WRITE_DAC = 0x40000
 
        $WBEM_RIGHTS_FLAGS = $WBEM_ENABLE,$WBEM_METHOD_EXECUTE,$WBEM_FULL_WRITE_REP,
            $WBEM_PARTIAL_WRITE_REP,$WBEM_WRITE_PROVIDER,$WBEM_REMOTE_ACCESS,
            $READ_CONTROL,$WRITE_DAC
 
        $WBEM_RIGHTS_STRINGS = "Enable","MethodExecute","FullWrite","PartialWrite",
            "ProviderWrite","RemoteAccess","ReadSecurity","WriteSecurity"
 
        $permissionTable = @{}
        for ($i = 0; $i -lt $WBEM_RIGHTS_FLAGS.Length; $i++) {
            $permissionTable.Add($WBEM_RIGHTS_STRINGS[$i].ToLower(), $WBEM_RIGHTS_FLAGS[$i])
        }
 
        $accessMask = 0
        foreach ($permission in $permissions) {
            if (-not $permissionTable.ContainsKey($permission.ToLower())) {
                throw "Unknown permission: $permission`nValid permissions: $($permissionTable.Keys)"
            }
            $accessMask += $permissionTable[$permission.ToLower()]
        }
        $accessMask
    }
 
    if ($PSBoundParameters.ContainsKey("Credential")) {
        $remoteparams = @{ComputerName=$computerName;Credential=$credential}
    } else {
        $remoteparams = @{}
    }
 
    $invokeparams = @{Namespace=$namespace;Path="__systemsecurity=@"} + $remoteParams
    $output = Invoke-WmiMethod @invokeparams -Name GetSecurityDescriptor
    if ($output.ReturnValue -ne 0) {
        throw "GetSecurityDescriptor failed: $($output.ReturnValue)"
    }
 
    $acl = $output.Descriptor
    $OBJECT_INHERIT_ACE_FLAG = 0x1
    $CONTAINER_INHERIT_ACE_FLAG = 0x2
    $computerName = (Get-WmiObject @remoteparams Win32_ComputerSystem).Name
 
    if ($account.Contains('\')) {
        $domainaccount = $account.Split('\')
        $domain = $domainaccount[0]
        if (($domain -eq ".") -or ($domain -eq "BUILTIN")) {
            $domain = $computerName
        }
        $accountname = $domainaccount[1]
    } elseif ($account.Contains('@')) {
        $domainaccount = $account.Split('@')
        $domain = $domainaccount[1].Split('.')[0]
        $accountname = $domainaccount[0]
    } else {
        $domain = $computerName
        $accountname = $account
    }
 
    $getparams = @{Class="Win32_Account";Filter="Domain='$domain' and Name='$accountname'"} + $remoteParams
    $win32account = Get-WmiObject @getparams
    if ($null -eq $win32account) {
        throw "Account was not found: $account"
    }
 
    switch ($operation) {
        "add" {
            if ($null -eq $permissions) {
                throw "-Permissions must be specified for an add operation"
            }
 
            $accessMask = Get-AccessMaskFromPermission($permissions)
            $ace = (New-Object System.Management.ManagementClass("win32_Ace")).CreateInstance()
            $ace.AccessMask = $accessMask
            $ace.AceFlags = if ($allowInherit) { $OBJECT_INHERIT_ACE_FLAG + $CONTAINER_INHERIT_ACE_FLAG } else { 0 }
 
            $trustee = (New-Object System.Management.ManagementClass("win32_Trustee")).CreateInstance()
            $trustee.SidString = $win32account.Sid
            $ace.Trustee = $trustee
            $ace.AceType = if ($deny) { 0x1 } else { 0x0 }
 
            $acl.DACL += $ace.psobject.immediateBaseObject
        }
        default {
            throw "Unknown operation: $operation`nAllowed operations: add"
        }
    }
 
    $setparams = @{Name="SetSecurityDescriptor";ArgumentList=$acl.psobject.immediateBaseObject} + $invokeParams
    $output = Invoke-WmiMethod @setparams
    if ($output.ReturnValue -ne 0) {
        throw "SetSecurityDescriptor failed: $($output.ReturnValue)"
    }
}

function Configure-W32TimeSDDL {
    param([string]$UserName)
    Write-Host "[8/8] Attribution des droits sur W32Time" -ForegroundColor Yellow
 
    $sid = (New-Object System.Security.Principal.NTAccount($UserName)).Translate([System.Security.Principal.SecurityIdentifier]).Value
    $currentSddl = & sc.exe sdshow w32time
    $newAce = "(A;;CCLCLO;;;${sid})"
    $newSddl = $currentSddl + $newAce
    sc.exe sdset w32time "$newSddl"
    Restart-Service w32time
 
    Write-Host "Droits W32Time appliqués pour $UserName." -ForegroundColor Green
    Write-Host ""
}

function Run-All-Steps {
    try {
        Execute-Step "Langue en-US" { Install-LanguageIfNeeded -LangCode $LangCode }
        Execute-Step "WinRM quickconfig" { Configure-WinRM }
        Execute-Step "Création utilisateur + Ajout aux groupes" { Create-User -UserName $UserName -Password $Password }
        Execute-Step "Langue UI du profil" { Configure-UserLanguage -UserName $UserName -LangCode $LangCode }
        Execute-Step "WinRM Auth" { Configure-WinRMAuth $Basic $Negotiate $AllowUnencrypted }
        Execute-Step "WinRM RootSDDL" { Configure-WinRMSDDL -UserName $UserName }
        Execute-Step "WMI/CIM root\cimv2 (Enable+RemoteAccess)" { Configure-CIMSDDL "root/cimv2" add $UserName Enable,RemoteAccess }
        Execute-Step "WMI/CIM root\standardcimv2 (Enable+RemoteAccess)" { Configure-CIMSDDL "root/standardcimv2" add $UserName Enable,RemoteAccess }
        Execute-Step "W32Time SDDL" { Configure-W32TimeSDDL -UserName $UserName }
    } catch {
        # Do nothing. 
    }
}
    
function Configure {
    $LangCode = "en-US"
    $Steps = New-Object System.Collections.ArrayList

    Write-Host "========================================================" -ForegroundColor DarkGray
    Write-Host "CONFIGURE PACK [windows-by-WinRM] for supervised host" -ForegroundColor Cyan
    Write-Host "========================================================" -ForegroundColor DarkGray
    Write-Host ""

    Run-All-Steps
    Write-Host ""
    Write-Host ("═" * 70) -ForegroundColor DarkGray
    Write-Host "RÉSUMÉ DES ÉTAPES" -ForegroundColor Yellow
    Write-Host ("═" * 70) -ForegroundColor DarkGray
        
    foreach ($s in $Steps) {
        if ($s.Status -eq "Success") {
            Write-Host ("[OK] {0} : {1}" -f $s.Step, $s.Message) -ForegroundColor Green
        } else {
            Write-Host ("[KO] {0} : {1}" -f $s.Step, $s.Message) -ForegroundColor Red
        }
    }
        
    Write-Host ("═" * 70) -ForegroundColor DarkGray
}

Configure

}