11$ErrorActionPreference = " Stop" ;
2+ $outfile = " C:\var\vcap\sys\log\check-system\combined-output.log"
23
34function Get-Config {
45 $configPath = Join-Path $PSScriptRoot " config.json"
5- Write-Host " Loading '$configPath '"
6+ Write-Output " Loading '$configPath '"
67 $config = Get-Content $configPath - raw | ConvertFrom-Json
7- Write-Host " Loaded '$configPath '"
8+ Write-Output " Loaded '$configPath '"
89 return $config
910}
1011
1112function Test-LGPO {
12- Write-Host " Running this function Test-LGPO"
13- Write-Host " Verifying that expected policies have been applied"
13+ Write-Output " Running this function Test-LGPO"
14+ Write-Output " Verifying that expected policies have been applied"
1415
15- lgpo / b $PSScriptRoot
16+ Invoke-Cmd " lgpo /q / b $PSScriptRoot "
1617 $LgpoDir = " $PSScriptRoot \" + (Get-ChildItem $PSScriptRoot - Directory | Where-Object { $_.Name -match " {*}" } | Select-Object - First 1 ).Name
1718
1819 $OutputDir = " $PSScriptRoot \lgpo_test"
1920 New-Item - ItemType Directory - Path $OutputDir - Force
2021
21- lgpo / parse / m " $LgpoDir \DomainSysvol\GPO\Machine\registry.pol" > " $OutputDir \machine_registry.unedited.txt"
22+ Invoke-Cmd " lgpo /q / parse /m ` "$LgpoDir \DomainSysvol\GPO\Machine\registry.pol`" " > " $OutputDir \machine_registry.unedited.txt"
2223 Get-Content " $OutputDir \machine_registry.unedited.txt" | Select-Object - Skip 3 > " $OutputDir \machine_registry.txt"
2324
24- lgpo / parse / u " $LgpoDir \DomainSysvol\GPO\User\registry.pol" > " $OutputDir \user_registry.unedited.txt"
25+ Invoke-Cmd " lgpo /q / parse /u ` "$LgpoDir \DomainSysvol\GPO\User\registry.pol`" " > " $OutputDir \user_registry.unedited.txt"
2526 Get-Content " $OutputDir \user_registry.unedited.txt" | Select-Object - Skip 3 > " $OutputDir \user_registry.txt"
2627
2728 Copy-Item " $LgpoDir \DomainSysvol\GPO\Machine\microsoft\windows nt\Audit\audit.csv" " $OutputDir "
@@ -40,8 +41,8 @@ function Test-LGPO {
4041 [Parameter (Mandatory )]
4142 [string ] $PolicyDelimiter
4243 )
43- Write-Host " actual policies $ActualPoliciesFile "
44- Write-Host " expected policies $ExpectedPoliciesFile "
44+ Write-Output " actual policies $ActualPoliciesFile "
45+ Write-Output " expected policies $ExpectedPoliciesFile "
4546
4647 $delims = [char []]" `r`n`t "
4748 $ActualPolicies = (Get-Content $ActualPoliciesFile - Raw).Replace(" `r`n " , " `n " )
@@ -78,7 +79,7 @@ function Test-LGPO {
7879
7980function Test-Dependencies {
8081 $BOSH_BIN = " C:\\var\\vcap\\bosh\\bin"
81- Write-Host " Checking $BOSH_BIN dependencies"
82+ Write-Output " Checking $BOSH_BIN dependencies"
8283
8384 $files = New-Object System.Collections.ArrayList
8485 [void ] $files.AddRange ((
@@ -88,7 +89,7 @@ function Test-Dependencies {
8889 ))
8990
9091 Get-ChildItem $BOSH_BIN | ForEach-Object {
91- Write-Host " Checking for $_ .Name"
92+ Write-Output " Checking for $_ .Name"
9293 $files.Remove ($_.Name )
9394 }
9495
@@ -123,7 +124,7 @@ function Test-Acls {
123124 $ident = (' {0},{1}' -f $_.IdentityReference , $_.AccessControlType ).ToString()
124125 If (-Not $expectedacls.Contains ($ident )) {
125126 $errCount += 1
126- Write-Host " Error ($name ): $ident "
127+ Write-Output " Error ($name ): $ident "
127128 }
128129 }
129130 }
@@ -175,9 +176,9 @@ function Test-FirewallRules {
175176 function Test-FirewallProfile {
176177 param ([string ] $ProfileName )
177178 $firewall = (Get-FirewallProfile $ProfileName )
178- Write-Host $firewall
179+ Write-Output $firewall
179180 if ($firewall -ne " $ProfileName ,Block,Allow" ) {
180- Write-Host $firewall
181+ Write-Output $firewall
181182 Write-Error " Unable to set $ProfileName Profile"
182183 Exit 1
183184 }
@@ -219,7 +220,7 @@ function Test-InstalledFeatures {
219220 Write-Error " Failed to find $feature "
220221 Exit 1
221222 } else {
222- Write-Host " Found $feature feature"
223+ Write-Output " Found $feature feature"
223224 }
224225 }
225226 function Assert-IsNotInstalled {
@@ -228,7 +229,7 @@ function Test-InstalledFeatures {
228229 [string ] $feature
229230 )
230231 If (! (Get-WindowsFeature $feature ).Installed) {
231- Write-Host " Feature $feature is not installed"
232+ Write-Output " Feature $feature is not installed"
232233 } else {
233234 Write-Error " Feature $feature is installed"
234235 Exit 1
@@ -244,7 +245,7 @@ function Test-ProvisionerDeleted {
244245 $user = " Provisioner"
245246 $existing = $adsi.Children | Where-Object { $_.SchemaClassName -eq ' user' -and $_.Name -eq $user }
246247 if ($null -eq $existing ) {
247- Write-Host " $user user is deleted"
248+ Write-Output " $user user is deleted"
248249 } else {
249250 Write-Error " $user user still exists. Please run 'Remove-Account -User $user '"
250251 Exit 1
@@ -292,7 +293,7 @@ function Test-AgentBehavior {
292293
293294 $StartType = (Get-Service wuauserv).StartType
294295 if ($StartType -ne " Disabled" ) {
295- Write-Host " Warning: wuauserv service StartType is not disabled: ${StartType} "
296+ Write-Output " Warning: wuauserv service StartType is not disabled: ${StartType} "
296297 }
297298}
298299
@@ -313,7 +314,7 @@ function Test-RandomPassword {
313314}
314315
315316function Test-NTPSync {
316- Write-Host " Verifying NTP sync works correctly"
317+ Write-Output " Verifying NTP sync works correctly"
317318 w32tm / query / configuration
318319
319320 Set-Date - Date (Get-Date ).AddHours(-8 )
@@ -328,7 +329,7 @@ function Test-NTPSync {
328329 w32tm / resync
329330
330331 if ((Get-Date ) -le $OutOfSyncTime ) {
331- Write-Host " Time not reset correctly via NTP on attempt $ ( $i + 1 ) of 10: $ ( Get-Date ) less than or equal to $OutOfSyncTime "
332+ Write-Output " Time not reset correctly via NTP on attempt $ ( $i + 1 ) of 10: $ ( Get-Date ) less than or equal to $OutOfSyncTime "
332333 } else {
333334 $TimeSetCorrectly = $true
334335 break
@@ -345,7 +346,7 @@ function Test-NoDocker {
345346 try {
346347 docker ps
347348 } catch {
348- Write-Host " Docker is not installed"
349+ Write-Output " Docker is not installed"
349350 return
350351 }
351352
@@ -361,7 +362,7 @@ function Test-PSVersion5 {
361362 Exit 1
362363 }
363364
364- Write-Host " PowerShell is up to date: Version is: $ ( $PSVersionTable.PSVersion ) "
365+ Write-Output " PowerShell is up to date: Version is: $ ( $PSVersionTable.PSVersion ) "
365366}
366367
367368function Test-VersionFile {
@@ -372,7 +373,7 @@ function Test-VersionFile {
372373 Exit 1
373374 }
374375
375- Write-Host " Version file exists at path C:\\var\\vcap\\bosh\\etc\\stemcell_version"
376+ Write-Output " Version file exists at path C:\\var\\vcap\\bosh\\etc\\stemcell_version"
376377}
377378
378379function Test-HyperVIsEnabled {
@@ -384,7 +385,7 @@ function Test-HyperVIsEnabled {
384385 Exit 1
385386 }
386387
387- Write-Host " Hyper-V is enabled"
388+ Write-Output " Hyper-V is enabled"
388389}
389390
390391function Test-TimeZone {
@@ -422,9 +423,12 @@ function Test-AuditPolicies {
422423 ' System Integrity' = ' Success and Failure' ;
423424 }
424425
425- $backupDir = " $env: TMP /policyBackup-$ ( [System.Guid ]::NewGuid() ) "
426+
427+ $backupDirWithoutBackslashes = " $env: TMP /policyBackup-$ ( [System.Guid ]::NewGuid() ) "
428+ $backupDir = [System.IO.Path ]::GetFullPath($backupDirWithoutBackslashes )
429+
426430 New-Item - ItemType Directory - Path $backupDir
427- C:\ var \vcap\packages\ lgpo\lgpo\ LGPO.exe / b $backupDir
431+ Invoke-Cmd " lgpo /q / b $backupDir "
428432
429433 $backupPaths = (Get-ChildItem $backupDir )
430434 if ($backupPaths.Count -ne 1 ) {
@@ -439,15 +443,15 @@ function Test-AuditPolicies {
439443 Exit 1
440444 }
441445
442- Write-Host " Loading actual policies from: $policyPath "
446+ Write-Output " Loading actual policies from: $policyPath "
443447 $actualPolicies = Import-Csv $policyPath
444448
445449 $failedTests = 0
446450 foreach ($policyName in $expectedAuditPolicies.keys ) {
447451 $expectedValue = $expectedAuditPolicies [$policyName ]
448452 $actualPolicy = $actualPolicies | Where-Object { $_.Subcategory -eq $policyName }
449453
450- Write-Host " Checking audit policy '$policyName ' is set to '$expectedValue '..."
454+ Write-Output " Checking audit policy '$policyName ' is set to '$expectedValue '..."
451455 if ($null -eq $actualPolicy -or $actualPolicy.Count -eq 0 ) {
452456 Write-Error " Audit policy subcategory '$policyName ' should exist but was not found"
453457 $failedTests ++
@@ -459,7 +463,7 @@ function Test-AuditPolicies {
459463 Write-Error " Audit policy '$policyName ' is set to '$actualValue ' but expected '$expectedValue '"
460464 $failedTests ++
461465 } else {
462- Write-Host " ✓ Audit policy '$policyName ' is correctly set to '$expectedValue '"
466+ Write-Output " ✓ Audit policy '$policyName ' is correctly set to '$expectedValue '"
463467 }
464468
465469 if ($failedTests -gt 0 ) {
@@ -469,25 +473,76 @@ function Test-AuditPolicies {
469473 }
470474}
471475
472- # END function definitions
473-
474- Test-LGPO
475- Test-Dependencies
476- Test-Acls
477- Test-Services
478- Test-FirewallRules
479- Test-MetadataFirewallRule
480- Test-InstalledFeatures
481- Test-ProvisionerDeleted
482- Test-NetBIOSDisabled
483- Test-AgentBehavior
484- Test-RandomPassword
485- Test-NTPSync
486- Test-NoDocker
487- Test-PSVersion5
488- Test-VersionFile
489- Test-TimeZone
490-
491- Test-AuditPolicies
492-
493- Exit 0
476+ function Invoke-Cmd {
477+ param (
478+ [string ] $Command
479+ )
480+ Write-Output " Invoking command: $Command "
481+ $output = cmd / c $Command ' 2>&1'
482+
483+ if ($LASTEXITCODE -ne 0 ) {
484+ Write-Error ($output -join " `n " )
485+ }
486+ Write-Output ($output -join " `n " )
487+ }
488+
489+ $scriptBlock = {
490+ try {
491+ Write-Output " Starting Test Suite"
492+
493+ Write-Output " `n Testing LGPO"
494+ Test-LGPO
495+ Write-Output " `n Testing Dependencies"
496+ Test-Dependencies
497+ Write-Output " `n Testing Acls"
498+ Test-Acls
499+ Write-Output " `n Testing Services"
500+ Test-Services
501+ Write-Output " `n Testing Firewall Rules"
502+ Test-FirewallRules
503+ Write-Output " `n Testing Metadata Firewall Rule"
504+ Test-MetadataFirewallRule
505+ Write-Output " `n Testing Installed Features"
506+ Test-InstalledFeatures
507+ Write-Output " `n Testing Provisioner Deleted"
508+ Test-ProvisionerDeleted
509+ Write-Output " `n Testing NetBIOS Disabled"
510+ Test-NetBIOSDisabled
511+ Write-Output " `n Testing Agent Behavior"
512+ Test-AgentBehavior
513+ Write-Output " `n Testing Random Password"
514+ Test-RandomPassword
515+ Write-Output " `n Testing NTP Sync"
516+ Test-NTPSync
517+ Write-Output " `n Testing No Docker"
518+ Test-NoDocker
519+ Write-Output " `n Testing PS Version 5"
520+ Test-PSVersion5
521+ Write-Output " `n Testing Version File"
522+ Test-VersionFile
523+ Write-Output " `n Testing Time Zone"
524+ Test-TimeZone
525+ Write-Output " `n Testing Audit Policies"
526+ Test-AuditPolicies
527+
528+ Write-Output " Test Suite completed successfully"
529+ } catch {
530+ Write-Host " ERROR: $ ( $_.Exception.Message ) "
531+ Write-Host " ERROR: $ ( $_.Exception.StackTrace ) "
532+ Write-Host " ERROR: $ ( $_.Exception.TargetSite ) "
533+ Write-Host " ERROR: $ ( $_.Exception.Data ) "
534+ Write-Host " ERROR: $ ( $_.Exception.HelpLink ) "
535+ Write-Host " ERROR: $ ( $_.Exception.Source ) "
536+ Write-Host " ERROR: $ ( $_.Exception.InnerException ) "
537+
538+ exit 1
539+ } finally {
540+ if (Test-Path " $outfile .utf16" ) {
541+ Get-Content " $outfile .utf16" | Set-Content - Encoding utf8 " $outfile "
542+ }
543+ }
544+ }
545+
546+ & $scriptBlock * > & 1 | Tee-Object - FilePath " $outfile .utf16"
547+
548+ Exit 0
0 commit comments