Skip to content

Commit 0d0f24d

Browse files
arampricearamprice
committed
Powershell: Protect-CFCell handles IAAS conditionality
1 parent 1073e30 commit 0d0f24d

File tree

4 files changed

+106
-29
lines changed

4 files changed

+106
-29
lines changed

‎modules/BOSH.CFCell/BOSH.CFCell.Tests.ps1‎

Lines changed: 46 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ Describe "Protect-CFCell" {
3333
Get-Service "Termservice" | Set-Service -StartupType "Automatic"
3434
netstat /p tcp /a | findstr ":3389 " | Should -Not -BeNullOrEmpty
3535

36-
Protect-CFCell -IaaS "ignored"
36+
Protect-CFCell -IaaS "not-vsphere"
3737

3838
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" | select -exp fDenyTSConnections | Should -Be 1
3939
netstat /p tcp /a | findstr ":3389 " | Should -BeNullOrEmpty
@@ -44,7 +44,7 @@ Describe "Protect-CFCell" {
4444
It "disables the services" {
4545
Get-Service | Where-Object {$_.Name -eq "WinRM" } | Set-Service -StartupType Automatic
4646
Get-Service | Where-Object {$_.Name -eq "W3Svc" } | Set-Service -StartupType Automatic
47-
Protect-CFCell -IaaS "ignored"
47+
Protect-CFCell -IaaS "not-vsphere"
4848
(Get-Service | Where-Object {$_.Name -eq "WinRM" } ).StartType| Should -Be "Disabled"
4949
$w3svcStartType = (Get-Service | Where-Object {$_.Name -eq "W3Svc" } ).StartType
5050
"Disabled", $null -contains $w3svcStartType | Should -Be $true
@@ -55,11 +55,54 @@ Describe "Protect-CFCell" {
5555
get-firewall "public" | Should -Be "public,Allow,Allow"
5656
get-firewall "private" | Should -Be "private,Allow,Allow"
5757
get-firewall "domain" | Should -Be "domain,Allow,Allow"
58-
Protect-CFCell -IaaS "ignored"
58+
Protect-CFCell -IaaS "not-vsphere"
5959
get-firewall "public" | Should -Be "public,Block,Allow"
6060
get-firewall "private" | Should -Be "private,Block,Allow"
6161
get-firewall "domain" | Should -Be "domain,Block,Allow"
6262
}
63+
64+
It "does not call 'Disable-WindowsDefenderFeatures'" {
65+
Mock -ModuleName BOSH.CFCell Disable-WindowsDefenderFeatures { }
66+
67+
{ Protect-CFCell -IaaS "not-vsphere" } | Should -Not -Throw
68+
69+
Should -Not -Invoke -ModuleName BOSH.CFCell -CommandName Disable-WindowsDefenderFeatures
70+
}
71+
72+
Context "when -IaaS is 'vsphere'" {
73+
It "sets all Windows Defender `disable` settings to true" {
74+
Mock -ModuleName BOSH.CFCell Get-Command {
75+
[hashtable]@{
76+
ParameterSets = [hashtable]@{
77+
Parameters = @(
78+
@{ Name = "DisableBehaviorMonitoring" },
79+
@{ Name = "OtherThing" }
80+
)
81+
}
82+
}
83+
}
84+
Mock -ModuleName BOSH.CFCell Set-MpPreference { }
85+
86+
Protect-CFCell -IaaS "vsphere"
87+
88+
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Disabling Windows Defender Features" }
89+
90+
Assert-MockCalled Set-MpPreference -Exactly 1 -Scope It -ParameterFilter { $DisableBehaviorMonitoring -eq $true } -ModuleName BOSH.CFCell
91+
Assert-MockCalled Set-MpPreference -Exactly 0 -Scope It -ParameterFilter { $OtherThing -eq $true } -ModuleName BOSH.CFCell
92+
93+
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Setting Defender preference DisableBehaviorMonitoring to True" }
94+
}
95+
96+
It "does not attempt to change Windows Defender settings if Windows Defender is not installed" {
97+
Mock -ModuleName BOSH.CFCell Get-Command { $false }
98+
Mock -ModuleName BOSH.CFCell Set-MpPreference { }
99+
100+
Protect-CFCell -IaaS "vsphere"
101+
102+
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Set-MpPreference command not found, assuming Windows Defender is not installed" }
103+
Assert-MockCalled Set-MpPreference -Scope It -Exactly 0 -ModuleName BOSH.CFCell
104+
}
105+
}
63106
}
64107

65108
Describe "Install-CFFeatures" {

‎modules/BOSH.CFCell/BOSH.CFCell.psm1‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,28 @@ function Protect-CFCell {
7777

7878
Write-Log "Disabling NetBIOS over TCP"
7979
Disable-NetBIOS
80+
81+
if ($IaaS -eq "vsphere") {
82+
Disable-WindowsDefenderFeatures
83+
}
84+
}
85+
86+
function Disable-WindowsDefenderFeatures {
87+
if (Get-Command -Name Set-MpPreference -ErrorAction SilentlyContinue)
88+
{
89+
Write-Log "Disabling Windows Defender Features"
90+
(Get-Command -Name Set-MpPreference).ParameterSets.Parameters |
91+
Where-Object {
92+
$_.Name -Like "Disable*"
93+
} |
94+
ForEach-Object {
95+
Write-Log "Setting Defender preference $( $_.Name ) to True"
96+
iex "Set-MpPreference -$( $_.Name ) `$true"
97+
}
98+
}
99+
else {
100+
Write-Log "Set-MpPreference command not found, assuming Windows Defender is not installed"
101+
}
80102
}
81103

82104
function WindowsFeatureInstall {

‎stembuild/modules/BOSH.CFCell/BOSH.CFCell.Tests.ps1‎

Lines changed: 35 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ Describe "Protect-CFCell" {
3333
Get-Service "Termservice" | Set-Service -StartupType "Automatic"
3434
netstat /p tcp /a | findstr ":3389 " | Should -Not -BeNullOrEmpty
3535

36-
Protect-CFCell -IaaS "ignored"
36+
Protect-CFCell -IaaS "not-vsphere"
3737

3838
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" | select -exp fDenyTSConnections | Should -Be 1
3939
netstat /p tcp /a | findstr ":3389 " | Should -BeNullOrEmpty
@@ -44,7 +44,7 @@ Describe "Protect-CFCell" {
4444
It "disables the services" {
4545
Get-Service | Where-Object {$_.Name -eq "WinRM" } | Set-Service -StartupType Automatic
4646
Get-Service | Where-Object {$_.Name -eq "W3Svc" } | Set-Service -StartupType Automatic
47-
Protect-CFCell -IaaS "ignored"
47+
Protect-CFCell -IaaS "not-vsphere"
4848
(Get-Service | Where-Object {$_.Name -eq "WinRM" } ).StartType| Should -Be "Disabled"
4949
$w3svcStartType = (Get-Service | Where-Object {$_.Name -eq "W3Svc" } ).StartType
5050
"Disabled", $null -contains $w3svcStartType | Should -Be $true
@@ -55,43 +55,53 @@ Describe "Protect-CFCell" {
5555
get-firewall "public" | Should -Be "public,Allow,Allow"
5656
get-firewall "private" | Should -Be "private,Allow,Allow"
5757
get-firewall "domain" | Should -Be "domain,Allow,Allow"
58-
Protect-CFCell -IaaS "ignored"
58+
Protect-CFCell -IaaS "not-vsphere"
5959
get-firewall "public" | Should -Be "public,Block,Allow"
6060
get-firewall "private" | Should -Be "private,Block,Allow"
6161
get-firewall "domain" | Should -Be "domain,Block,Allow"
6262
}
6363

64-
It "sets all Windows Defender `disable` settings to true" {
65-
Mock -ModuleName BOSH.CFCell Get-Command {
66-
[hashtable]@{
67-
ParameterSets = [hashtable]@{
68-
Parameters = @(
69-
@{Name = "DisableBehaviorMonitoring"},
70-
@{Name = "OtherThing"}
71-
)
64+
It "does not call 'Disable-WindowsDefenderFeatures'" {
65+
Mock -ModuleName BOSH.CFCell Disable-WindowsDefenderFeatures { }
66+
67+
{ Protect-CFCell -IaaS "not-vsphere" } | Should -Not -Throw
68+
69+
Should -Not -Invoke -ModuleName BOSH.CFCell -CommandName Disable-WindowsDefenderFeatures
70+
}
71+
72+
Context "when -IaaS is 'vsphere'" {
73+
It "sets all Windows Defender `disable` settings to true" {
74+
Mock -ModuleName BOSH.CFCell Get-Command {
75+
[hashtable]@{
76+
ParameterSets = [hashtable]@{
77+
Parameters = @(
78+
@{ Name = "DisableBehaviorMonitoring" },
79+
@{ Name = "OtherThing" }
80+
)
81+
}
7282
}
7383
}
74-
}
75-
Mock -ModuleName BOSH.CFCell Set-MpPreference { }
84+
Mock -ModuleName BOSH.CFCell Set-MpPreference { }
7685

77-
Protect-CFCell -IaaS "ignored"
86+
Protect-CFCell -IaaS "vsphere"
7887

79-
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Disabling Windows Defender Features" }
88+
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Disabling Windows Defender Features" }
8089

81-
Assert-MockCalled Set-MpPreference -Exactly 1 -Scope It -ParameterFilter { $DisableBehaviorMonitoring -eq $true } -ModuleName BOSH.CFCell
82-
Assert-MockCalled Set-MpPreference -Exactly 0 -Scope It -ParameterFilter { $OtherThing -eq $true } -ModuleName BOSH.CFCell
90+
Assert-MockCalled Set-MpPreference -Exactly 1 -Scope It -ParameterFilter { $DisableBehaviorMonitoring -eq $true } -ModuleName BOSH.CFCell
91+
Assert-MockCalled Set-MpPreference -Exactly 0 -Scope It -ParameterFilter { $OtherThing -eq $true } -ModuleName BOSH.CFCell
8392

84-
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Setting Defender preference DisableBehaviorMonitoring to True" }
85-
}
93+
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Setting Defender preference DisableBehaviorMonitoring to True" }
94+
}
8695

87-
It "does not attempt to change Windows Defender settings if Windows Defender is not installed" {
88-
Mock -ModuleName BOSH.CFCell Get-Command { $false }
89-
Mock -ModuleName BOSH.CFCell Set-MpPreference { }
96+
It "does not attempt to change Windows Defender settings if Windows Defender is not installed" {
97+
Mock -ModuleName BOSH.CFCell Get-Command { $false }
98+
Mock -ModuleName BOSH.CFCell Set-MpPreference { }
9099

91-
Protect-CFCell -IaaS "ignored"
100+
Protect-CFCell -IaaS "vsphere"
92101

93-
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Set-MpPreference command not found, assuming Windows Defender is not installed" }
94-
Assert-MockCalled Set-MpPreference -Scope It -Exactly 0 -ModuleName BOSH.CFCell
102+
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Set-MpPreference command not found, assuming Windows Defender is not installed" }
103+
Assert-MockCalled Set-MpPreference -Scope It -Exactly 0 -ModuleName BOSH.CFCell
104+
}
95105
}
96106
}
97107

‎stembuild/modules/BOSH.CFCell/BOSH.CFCell.psm1‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,9 @@ function Protect-CFCell {
7878
Write-Log "Disabling NetBIOS over TCP"
7979
Disable-NetBIOS
8080

81-
Disable-WindowsDefenderFeatures
81+
if ($IaaS -eq "vsphere") {
82+
Disable-WindowsDefenderFeatures
83+
}
8284
}
8385

8486
function Disable-WindowsDefenderFeatures {

0 commit comments

Comments
 (0)