Skip to content

Commit 49a1e31

Browse files
arampricearamprice
committed
Powershell: always remove windows defender
Even though the code had paths in the stembuild/modules/ powershell code to disable rather than remove windows defender, it turns out that the pipelines have been building `stembuild` with the top-level `modules/` powershell code (orginally in `cloudfoundry/bosh-psmodules`). Severl releases of stembuild have been released with this behavior to no (apparent) ill effect so we are removing to unused conditional behavior of disable vs remove.
1 parent 0d0f24d commit 49a1e31

File tree

4 files changed

+20
-154
lines changed

4 files changed

+20
-154
lines changed

‎modules/BOSH.CFCell/BOSH.CFCell.Tests.ps1‎

Lines changed: 9 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ Describe "Protect-CFCell" {
3333
Get-Service "Termservice" | Set-Service -StartupType "Automatic"
3434
netstat /p tcp /a | findstr ":3389 " | Should -Not -BeNullOrEmpty
3535

36-
Protect-CFCell -IaaS "not-vsphere"
36+
Protect-CFCell -IaaS "ignored"
3737

3838
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" | select -exp fDenyTSConnections | Should -Be 1
3939
netstat /p tcp /a | findstr ":3389 " | Should -BeNullOrEmpty
@@ -44,7 +44,7 @@ Describe "Protect-CFCell" {
4444
It "disables the services" {
4545
Get-Service | Where-Object {$_.Name -eq "WinRM" } | Set-Service -StartupType Automatic
4646
Get-Service | Where-Object {$_.Name -eq "W3Svc" } | Set-Service -StartupType Automatic
47-
Protect-CFCell -IaaS "not-vsphere"
47+
Protect-CFCell -IaaS "ignored"
4848
(Get-Service | Where-Object {$_.Name -eq "WinRM" } ).StartType| Should -Be "Disabled"
4949
$w3svcStartType = (Get-Service | Where-Object {$_.Name -eq "W3Svc" } ).StartType
5050
"Disabled", $null -contains $w3svcStartType | Should -Be $true
@@ -55,7 +55,7 @@ Describe "Protect-CFCell" {
5555
get-firewall "public" | Should -Be "public,Allow,Allow"
5656
get-firewall "private" | Should -Be "private,Allow,Allow"
5757
get-firewall "domain" | Should -Be "domain,Allow,Allow"
58-
Protect-CFCell -IaaS "not-vsphere"
58+
Protect-CFCell -IaaS "ignored"
5959
get-firewall "public" | Should -Be "public,Block,Allow"
6060
get-firewall "private" | Should -Be "private,Block,Allow"
6161
get-firewall "domain" | Should -Be "domain,Block,Allow"
@@ -64,45 +64,10 @@ Describe "Protect-CFCell" {
6464
It "does not call 'Disable-WindowsDefenderFeatures'" {
6565
Mock -ModuleName BOSH.CFCell Disable-WindowsDefenderFeatures { }
6666

67-
{ Protect-CFCell -IaaS "not-vsphere" } | Should -Not -Throw
67+
{ Protect-CFCell -IaaS "ignored" } | Should -Not -Throw
6868

6969
Should -Not -Invoke -ModuleName BOSH.CFCell -CommandName Disable-WindowsDefenderFeatures
7070
}
71-
72-
Context "when -IaaS is 'vsphere'" {
73-
It "sets all Windows Defender `disable` settings to true" {
74-
Mock -ModuleName BOSH.CFCell Get-Command {
75-
[hashtable]@{
76-
ParameterSets = [hashtable]@{
77-
Parameters = @(
78-
@{ Name = "DisableBehaviorMonitoring" },
79-
@{ Name = "OtherThing" }
80-
)
81-
}
82-
}
83-
}
84-
Mock -ModuleName BOSH.CFCell Set-MpPreference { }
85-
86-
Protect-CFCell -IaaS "vsphere"
87-
88-
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Disabling Windows Defender Features" }
89-
90-
Assert-MockCalled Set-MpPreference -Exactly 1 -Scope It -ParameterFilter { $DisableBehaviorMonitoring -eq $true } -ModuleName BOSH.CFCell
91-
Assert-MockCalled Set-MpPreference -Exactly 0 -Scope It -ParameterFilter { $OtherThing -eq $true } -ModuleName BOSH.CFCell
92-
93-
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Setting Defender preference DisableBehaviorMonitoring to True" }
94-
}
95-
96-
It "does not attempt to change Windows Defender settings if Windows Defender is not installed" {
97-
Mock -ModuleName BOSH.CFCell Get-Command { $false }
98-
Mock -ModuleName BOSH.CFCell Set-MpPreference { }
99-
100-
Protect-CFCell -IaaS "vsphere"
101-
102-
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Set-MpPreference command not found, assuming Windows Defender is not installed" }
103-
Assert-MockCalled Set-MpPreference -Scope It -Exactly 0 -ModuleName BOSH.CFCell
104-
}
105-
}
10671
}
10772

10873
Describe "Install-CFFeatures" {
@@ -116,42 +81,34 @@ Describe "Install-CFFeatures" {
11681
}
11782

11883
It "triggers a machine restart when the -ForceReboot flag is set" {
119-
{ Install-CFFeatures -IaaS "not-vsphere" -ForceReboot } | Should -Not -Throw
84+
{ Install-CFFeatures -IaaS "ignored" -ForceReboot } | Should -Not -Throw
12085

12186
Assert-MockCalled Restart-Computer -Times 1 -Scope It -ModuleName BOSH.CFCell
12287
}
12388

12489
It "doesn't trigger a machine restart if -ForceReboot flag not set" {
125-
{ Install-CFFeatures -IaaS "not-vsphere" } | Should -Not -Throw
90+
{ Install-CFFeatures -IaaS "ignored" } | Should -Not -Throw
12691

12792
Assert-MockCalled Restart-Computer -Times 0 -Scope It -ModuleName BOSH.CFCell
12893
}
12994

13095
It "logs Installing CloudFoundry Cell Windows Features" {
131-
{ Install-CFFeatures -IaaS "not-vsphere" } | Should -Not -Throw
96+
{ Install-CFFeatures -IaaS "ignored" } | Should -Not -Throw
13297

13398
Assert-MockCalled Write-Log -Times 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Installing CloudFoundry Cell Windows Features" }
13499
}
135100

136101
It "logs Installed CloudFoundry Cell Windows Features after installation" {
137-
{ Install-CFFeatures -IaaS "not-vsphere" } | Should -Not -Throw
102+
{ Install-CFFeatures -IaaS "ignored" } | Should -Not -Throw
138103

139104
Assert-MockCalled Write-Log -Times 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Installed CloudFoundry Cell Windows Features" }
140105
}
141106

142107
It "calls Uninstall-WindowsFeature (for '*Defender')" {
143-
{ Install-CFFeatures -IaaS "not-vsphere" } | Should -Not -Throw
108+
{ Install-CFFeatures -IaaS "ignored" } | Should -Not -Throw
144109

145110
Should -Invoke -ModuleName BOSH.CFCell -CommandName Uninstall-WindowsFeature
146111
}
147-
148-
Context "when -IaaS is 'vsphere'" {
149-
It "does not call Uninstall-WindowsFeature (for '*Defender')" {
150-
{ Install-CFFeatures -IaaS "vsphere" } | Should -Not -Throw
151-
152-
Should -Not -Invoke -ModuleName BOSH.CFCell -CommandName Uninstall-WindowsFeature
153-
}
154-
}
155112
}
156113

157114
Describe "Remove-DockerPackage" {

‎modules/BOSH.CFCell/BOSH.CFCell.psm1‎

Lines changed: 1 addition & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,7 @@ function Install-CFFeatures {
2020

2121
WindowsFeatureInstall("FS-Resource-Manager")
2222
WindowsFeatureInstall("Containers")
23-
if ($IaaS -ne "vsphere") {
24-
Get-WindowsFeature | Where-Object -FilterScript { $_.Name -like '*Defender*' } | Uninstall-WindowsFeature -Remove
25-
}
23+
Get-WindowsFeature | Where-Object -FilterScript { $_.Name -like '*Defender*' } | Uninstall-WindowsFeature -Remove
2624
Write-Log "Installed CloudFoundry Cell Windows Features"
2725

2826
Write-Log "Setting WinRM startup type to automatic"
@@ -77,28 +75,6 @@ function Protect-CFCell {
7775

7876
Write-Log "Disabling NetBIOS over TCP"
7977
Disable-NetBIOS
80-
81-
if ($IaaS -eq "vsphere") {
82-
Disable-WindowsDefenderFeatures
83-
}
84-
}
85-
86-
function Disable-WindowsDefenderFeatures {
87-
if (Get-Command -Name Set-MpPreference -ErrorAction SilentlyContinue)
88-
{
89-
Write-Log "Disabling Windows Defender Features"
90-
(Get-Command -Name Set-MpPreference).ParameterSets.Parameters |
91-
Where-Object {
92-
$_.Name -Like "Disable*"
93-
} |
94-
ForEach-Object {
95-
Write-Log "Setting Defender preference $( $_.Name ) to True"
96-
iex "Set-MpPreference -$( $_.Name ) `$true"
97-
}
98-
}
99-
else {
100-
Write-Log "Set-MpPreference command not found, assuming Windows Defender is not installed"
101-
}
10278
}
10379

10480
function WindowsFeatureInstall {

‎stembuild/modules/BOSH.CFCell/BOSH.CFCell.Tests.ps1‎

Lines changed: 9 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ Describe "Protect-CFCell" {
3333
Get-Service "Termservice" | Set-Service -StartupType "Automatic"
3434
netstat /p tcp /a | findstr ":3389 " | Should -Not -BeNullOrEmpty
3535

36-
Protect-CFCell -IaaS "not-vsphere"
36+
Protect-CFCell -IaaS "ignored"
3737

3838
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" | select -exp fDenyTSConnections | Should -Be 1
3939
netstat /p tcp /a | findstr ":3389 " | Should -BeNullOrEmpty
@@ -44,7 +44,7 @@ Describe "Protect-CFCell" {
4444
It "disables the services" {
4545
Get-Service | Where-Object {$_.Name -eq "WinRM" } | Set-Service -StartupType Automatic
4646
Get-Service | Where-Object {$_.Name -eq "W3Svc" } | Set-Service -StartupType Automatic
47-
Protect-CFCell -IaaS "not-vsphere"
47+
Protect-CFCell -IaaS "ignored"
4848
(Get-Service | Where-Object {$_.Name -eq "WinRM" } ).StartType| Should -Be "Disabled"
4949
$w3svcStartType = (Get-Service | Where-Object {$_.Name -eq "W3Svc" } ).StartType
5050
"Disabled", $null -contains $w3svcStartType | Should -Be $true
@@ -55,7 +55,7 @@ Describe "Protect-CFCell" {
5555
get-firewall "public" | Should -Be "public,Allow,Allow"
5656
get-firewall "private" | Should -Be "private,Allow,Allow"
5757
get-firewall "domain" | Should -Be "domain,Allow,Allow"
58-
Protect-CFCell -IaaS "not-vsphere"
58+
Protect-CFCell -IaaS "ignored"
5959
get-firewall "public" | Should -Be "public,Block,Allow"
6060
get-firewall "private" | Should -Be "private,Block,Allow"
6161
get-firewall "domain" | Should -Be "domain,Block,Allow"
@@ -64,45 +64,10 @@ Describe "Protect-CFCell" {
6464
It "does not call 'Disable-WindowsDefenderFeatures'" {
6565
Mock -ModuleName BOSH.CFCell Disable-WindowsDefenderFeatures { }
6666

67-
{ Protect-CFCell -IaaS "not-vsphere" } | Should -Not -Throw
67+
{ Protect-CFCell -IaaS "ignored" } | Should -Not -Throw
6868

6969
Should -Not -Invoke -ModuleName BOSH.CFCell -CommandName Disable-WindowsDefenderFeatures
7070
}
71-
72-
Context "when -IaaS is 'vsphere'" {
73-
It "sets all Windows Defender `disable` settings to true" {
74-
Mock -ModuleName BOSH.CFCell Get-Command {
75-
[hashtable]@{
76-
ParameterSets = [hashtable]@{
77-
Parameters = @(
78-
@{ Name = "DisableBehaviorMonitoring" },
79-
@{ Name = "OtherThing" }
80-
)
81-
}
82-
}
83-
}
84-
Mock -ModuleName BOSH.CFCell Set-MpPreference { }
85-
86-
Protect-CFCell -IaaS "vsphere"
87-
88-
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Disabling Windows Defender Features" }
89-
90-
Assert-MockCalled Set-MpPreference -Exactly 1 -Scope It -ParameterFilter { $DisableBehaviorMonitoring -eq $true } -ModuleName BOSH.CFCell
91-
Assert-MockCalled Set-MpPreference -Exactly 0 -Scope It -ParameterFilter { $OtherThing -eq $true } -ModuleName BOSH.CFCell
92-
93-
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Setting Defender preference DisableBehaviorMonitoring to True" }
94-
}
95-
96-
It "does not attempt to change Windows Defender settings if Windows Defender is not installed" {
97-
Mock -ModuleName BOSH.CFCell Get-Command { $false }
98-
Mock -ModuleName BOSH.CFCell Set-MpPreference { }
99-
100-
Protect-CFCell -IaaS "vsphere"
101-
102-
Assert-MockCalled Write-Log -Exactly 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Set-MpPreference command not found, assuming Windows Defender is not installed" }
103-
Assert-MockCalled Set-MpPreference -Scope It -Exactly 0 -ModuleName BOSH.CFCell
104-
}
105-
}
10671
}
10772

10873
Describe "Install-CFFeatures" {
@@ -116,42 +81,34 @@ Describe "Install-CFFeatures" {
11681
}
11782

11883
It "triggers a machine restart when the -ForceReboot flag is set" {
119-
{ Install-CFFeatures -IaaS "not-vsphere" -ForceReboot } | Should -Not -Throw
84+
{ Install-CFFeatures -IaaS "ignored" -ForceReboot } | Should -Not -Throw
12085

12186
Assert-MockCalled Restart-Computer -Times 1 -Scope It -ModuleName BOSH.CFCell
12287
}
12388

12489
It "doesn't trigger a machine restart if -ForceReboot flag not set" {
125-
{ Install-CFFeatures -IaaS "not-vsphere" } | Should -Not -Throw
90+
{ Install-CFFeatures -IaaS "ignored" } | Should -Not -Throw
12691

12792
Assert-MockCalled Restart-Computer -Times 0 -Scope It -ModuleName BOSH.CFCell
12893
}
12994

13095
It "logs Installing CloudFoundry Cell Windows Features" {
131-
{ Install-CFFeatures -IaaS "not-vsphere" } | Should -Not -Throw
96+
{ Install-CFFeatures -IaaS "ignored" } | Should -Not -Throw
13297

13398
Assert-MockCalled Write-Log -Times 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Installing CloudFoundry Cell Windows Features" }
13499
}
135100

136101
It "logs Installed CloudFoundry Cell Windows Features after installation" {
137-
{ Install-CFFeatures -IaaS "not-vsphere" } | Should -Not -Throw
102+
{ Install-CFFeatures -IaaS "ignored" } | Should -Not -Throw
138103

139104
Assert-MockCalled Write-Log -Times 1 -Scope It -ModuleName BOSH.CFCell -ParameterFilter { $Message -eq "Installed CloudFoundry Cell Windows Features" }
140105
}
141106

142107
It "calls Uninstall-WindowsFeature (for '*Defender')" {
143-
{ Install-CFFeatures -IaaS "not-vsphere" } | Should -Not -Throw
108+
{ Install-CFFeatures -IaaS "ignored" } | Should -Not -Throw
144109

145110
Should -Invoke -ModuleName BOSH.CFCell -CommandName Uninstall-WindowsFeature
146111
}
147-
148-
Context "when -IaaS is 'vsphere'" {
149-
It "does not call Uninstall-WindowsFeature (for '*Defender')" {
150-
{ Install-CFFeatures -IaaS "vsphere" } | Should -Not -Throw
151-
152-
Should -Not -Invoke -ModuleName BOSH.CFCell -CommandName Uninstall-WindowsFeature
153-
}
154-
}
155112
}
156113

157114
Describe "Remove-DockerPackage" {

‎stembuild/modules/BOSH.CFCell/BOSH.CFCell.psm1‎

Lines changed: 1 addition & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,7 @@ function Install-CFFeatures {
2020

2121
WindowsFeatureInstall("FS-Resource-Manager")
2222
WindowsFeatureInstall("Containers")
23-
if ($IaaS -ne "vsphere") {
24-
Get-WindowsFeature | Where-Object -FilterScript { $_.Name -like '*Defender*' } | Uninstall-WindowsFeature -Remove
25-
}
23+
Get-WindowsFeature | Where-Object -FilterScript { $_.Name -like '*Defender*' } | Uninstall-WindowsFeature -Remove
2624
Write-Log "Installed CloudFoundry Cell Windows Features"
2725

2826
Write-Log "Setting WinRM startup type to automatic"
@@ -77,28 +75,6 @@ function Protect-CFCell {
7775

7876
Write-Log "Disabling NetBIOS over TCP"
7977
Disable-NetBIOS
80-
81-
if ($IaaS -eq "vsphere") {
82-
Disable-WindowsDefenderFeatures
83-
}
84-
}
85-
86-
function Disable-WindowsDefenderFeatures {
87-
if (Get-Command -Name Set-MpPreference -ErrorAction SilentlyContinue)
88-
{
89-
Write-Log "Disabling Windows Defender Features"
90-
(Get-Command -Name Set-MpPreference).ParameterSets.Parameters |
91-
Where-Object {
92-
$_.Name -Like "Disable*"
93-
} |
94-
ForEach-Object {
95-
Write-Log "Setting Defender preference $( $_.Name ) to True"
96-
iex "Set-MpPreference -$( $_.Name ) `$true"
97-
}
98-
}
99-
else {
100-
Write-Log "Set-MpPreference command not found, assuming Windows Defender is not installed"
101-
}
10278
}
10379

10480
function WindowsFeatureInstall {

0 commit comments

Comments
 (0)