PowershellDSCConfigurations/DSC-DisableCertificateRevokationCheck.ps1 at master · rysstad/PowershellDSCConfigurations · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
Script DisableCertificateRevokationCheck {

	SetScript = {
		# Disables certificate CRL checking
		# More info here: http://blogs.msdn.com/b/chaun/archive/2014/05/01/best-practices-for-crl-checking-on-sharepoint-servers.aspx
		# Disables the certificate CRL checking for all users in HKEY_USERS, including Default
		$HKEYUSERS = get-childitem $(Resolve-Path Registry::HKEY_USERS\)

		foreach ($userKey in $HKEYUSERS) {
			$RegPath = $userKey.PSPath
			$RegPath = $RegPath + "\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\"

			if ($(Test-Path $RegPath)) {
				Set-ItemProperty -Path $RegPath -Name "State" -Value 146944
			}
		}

		Write-Verbose "Requesting a reboot from the DSC Local Configuration Manager"
		$global:DSCMachineStatus = 1

	} # End of SetScript


	GetScript = {
		$HKEYUSERS = get-childitem $(Resolve-Path Registry::HKEY_USERS\)
        $a = 0
		foreach ($userKey in $HKEYUSERS) {
			$RegPath = $userKey.PSPath
			$RegPath = $RegPath + "\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\"
			if ($(Test-Path $RegPath)) {
				# Set-ItemProperty -Path $RegPath -Name "State" -Value 146944
                $StateSetting = Get-ItemProperty -Path $RegPath -Name "State"
                if ($StateSetting.State -ne "146944") {
                    Write-Verbose "CRL-checking not disabled, Setscript required"
                    $a++
                } else {
                    Write-Verbose "CRL-checking disabled, Setscript not required"
                }
            }
		} # End of foreach


        if ($a -gt 0) {
            return @{CertificateRevokationCheckDisabled = $false}
        } else {
            return @{CertificateRevokationCheckDisabled = $true}
        }
	} #  End  of GetScript


TestScript = {
$HKEYUSERS = get-childitem $(Resolve-Path Registry::HKEY_USERS\)
        $a = 0
		foreach ($userKey in $HKEYUSERS) {
			$RegPath = $userKey.PSPath
			$RegPath = $RegPath + "\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing\"
			if ($(Test-Path $RegPath)) {
				# Set-ItemProperty -Path $RegPath -Name "State" -Value 146944
                $StateSetting = Get-ItemProperty -Path $RegPath -Name "State"
                if ($StateSetting.State -ne "146944") {
                    Write-Verbose "CRL-checking not disabled, Setscript required"
                    $a++
                } else {
                    Write-Verbose "CRL-checking disabled, Setscript not required"
                }
            }
		} # End of foreach


        if ($a -gt 0) {
            return $false
        } else {
            return $true
        }

	} # End of TestScript
} # End of DisableCertificateRevokationCheck