C01 — Quản trị, Rủi ro & Tuân thủ

# NIST 800-53 AC-2: Account Management — kiểm tra local accounts
$report = @()

# Lấy tất cả local users
$localUsers = Get-LocalUser

foreach ($user in $localUsers) {
    $finding = [PSCustomObject]@{
        Control    = "AC-2"
        ControlName = "Account Management"
        Asset      = $env:COMPUTERNAME
        Item       = $user.Name
        Status     = "PASS"
        Finding    = ""
    }
    # Kiểm tra: account Guest phải disabled
    if ($user.Name -eq "Guest" -and $user.Enabled) {
        $finding.Status  = "FAIL"
        $finding.Finding = "Guest account is enabled — violates AC-2(a)"
    }
    # Kiểm tra: account không có password expiry là rủi ro
    if ($user.PasswordNeverExpires -and $user.Enabled) {
        $finding.Status  = "WARN"
        $finding.Finding = "PasswordNeverExpires=True — review per IA-5(f)"
    }
    $report += $finding
}

# AU-2: Kiểm tra Windows Audit Policy
$auditPolicy = auditpol /get /subcategory:"Logon" /r | ConvertFrom-Csv
$logonAudit = $auditPolicy | Where-Object { $_.'Subcategory' -like "*Logon*" }

$auFinding = [PSCustomObject]@{
    Control     = "AU-2"
    ControlName = "Event Logging"
    Asset       = $env:COMPUTERNAME
    Item        = "Logon Audit"
    Status      = if ($logonAudit.'Inclusion Setting' -match "Success and Failure") { "PASS" } else { "FAIL" }
    Finding     = if ($logonAudit.'Inclusion Setting' -match "Success and Failure") { "" } else { "Logon audit not set to Success+Failure" }
}
$report += $auFinding

# CM-7: Kiểm tra services không cần thiết (Telnet)
$telnet = Get-WindowsOptionalFeature -Online -FeatureName TelnetClient -ErrorAction SilentlyContinue
$cmFinding = [PSCustomObject]@{
    Control     = "CM-7"
    ControlName = "Least Functionality"
    Asset       = $env:COMPUTERNAME
    Item        = "TelnetClient"
    Status      = if ($telnet.State -eq "Enabled") { "FAIL" } else { "PASS" }
    Finding     = if ($telnet.State -eq "Enabled") { "TelnetClient enabled — remove per CM-7(a)" } else { "" }
}
$report += $cmFinding

# Xuất report
$report | Export-Csv -Path "C:\GRC\nist-compliance-report.csv" -NoTypeInformation -Encoding UTF8
$report | Format-Table -AutoSize

# Summary
$fails  = ($report | Where-Object Status -eq "FAIL").Count
$warns  = ($report | Where-Object Status -eq "WARN").Count
$passes = ($report | Where-Object Status -eq "PASS").Count
Write-Host "PASS: $passes | WARN: $warns | FAIL: $fails" -ForegroundColor Cyan