Network Unisolation Security Commands#

1
# Restore security-critical registry settings
2
function Restore-SecurityRegistry {
3
    $securitySettings = @{
4
        'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' = @{
5
            'RestrictAnonymous' = 1
6
            'RestrictAnonymousSAM' = 1
7
        }
8
        'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' = @{
9
            'RequireSecuritySignature' = 1
10
            'EnableSecuritySignature' = 1
11
        }
12
    }
13

14
    foreach ($regPath in $securitySettings.Keys) {
15
        if (-not (Test-Path $regPath)) {
16
            New-Item -Path $regPath -Force | Out-Null
17
        }
18

19
        foreach ($setting in $securitySettings[$regPath].GetEnumerator()) {
20
            Set-ItemProperty -Path $regPath -Name $setting.Key -Value $setting.Value
21
            Write-Host "Set $regPath\$($setting.Key) = $($setting.Value)" -ForegroundColor Green
22
        }
23
    }
24
}
25

26
Restore-SecurityRegistry

1
function Test-PostUnisolationSecurity {
2
    Write-Host "=== POST-UNISOLATION SECURITY VALIDATION ===" -ForegroundColor Cyan
3

4
    # Test firewall status
5
    $firewallStatus = netsh advfirewall show allprofiles state
6
    if ($firewallStatus -match "State\s+ON") {
7
        Write-Host "✓ Firewall is enabled" -ForegroundColor Green
8
    } else {
9
        Write-Host "✗ Firewall is not properly enabled" -ForegroundColor Red
10
    }
11

12
    # Test network connectivity
13
    $connectivityTests = @{
14
        'DNS Resolution' = { Resolve-DnsName google.com -ErrorAction SilentlyContinue }
15
        'HTTP Connectivity' = { Test-NetConnection -ComputerName google.com -Port 80 -InformationLevel Quiet }
16
        'HTTPS Connectivity' = { Test-NetConnection -ComputerName google.com -Port 443 -InformationLevel Quiet }
17
    }
18

19
    foreach ($test in $connectivityTests.GetEnumerator()) {
20
        try {
21
            $result = & $test.Value
22
            if ($result) {
23
                Write-Host "✓ $($test.Key): Success" -ForegroundColor Green
24
            } else {
25
                Write-Host "✗ $($test.Key): Failed" -ForegroundColor Red
26
            }
27
        } catch {
28
            Write-Host "✗ $($test.Key): Error - $($_.Exception.Message)" -ForegroundColor Red
29
        }
30
    }
31

32
    # Verify Group Policy application
33
    $gpResult = gpresult /r 2>&1
34
    if ($gpResult -match "successfully") {
35
        Write-Host "✓ Group Policy applied successfully" -ForegroundColor Green
36
    } else {
37
        Write-Host "✗ Group Policy application issues detected" -ForegroundColor Red
38
    }
39

40
    Write-Host "Security validation completed" -ForegroundColor Cyan
41
}
42

43
Test-PostUnisolationSecurity

1
REM Comprehensive connectivity tests
2
echo === CONNECTIVITY VERIFICATION ===
3

4
REM Test internal connectivity
5
ping -n 4 127.0.0.1
6
ping -n 4 %COMPUTERNAME%
7

8
REM Test domain connectivity (if domain-joined)
9
nltest /dsgetdc:%USERDOMAIN%
10

11
REM Test external connectivity
12
nslookup google.com
13
ping -n 2 8.8.8.8
14

15
echo Connectivity verification completed

1
# Diagnose firewall problems
2
function Diagnose-FirewallIssues {
3
    Write-Host "=== FIREWALL DIAGNOSTICS ===" -ForegroundColor Yellow
4

5
    # Check firewall service
6
    $fwService = Get-Service -Name "MpsSvc" -ErrorAction SilentlyContinue
7
    if ($fwService) {
8
        Write-Host "Firewall Service Status: $($fwService.Status)" -ForegroundColor $(if ($fwService.Status -eq "Running") { "Green" } else { "Red" })
9

10
        if ($fwService.Status -ne "Running") {
11
            Write-Host "Attempting to start firewall service..." -ForegroundColor Yellow
12
            Start-Service -Name "MpsSvc"
13
        }
14
    }
15

16
    # Check firewall profiles
17
    $profiles = @("Domain", "Private", "Public")
18
    foreach ($profile in $profiles) {
19
        $status = (netsh advfirewall show $profile.ToLower()profile state) -match "State\s+(\w+)"
20
        if ($matches) {
21
            Write-Host "$profile Profile: $($matches[1])" -ForegroundColor $(if ($matches[1] -eq "ON") { "Green" } else { "Red" })
22
        }
23
    }
24
}
25

26
Diagnose-FirewallIssues

1
REM Network troubleshooting commands
2
echo === NETWORK TROUBLESHOOTING ===
3

4
REM Check network adapters
5
ipconfig /all
6

7
REM Check routing table
8
route print
9

10
REM Check ARP table
11
arp -a
12

13
REM Reset network if needed
14
netsh int ip reset
15
netsh winsock reset

1
# Group Policy troubleshooting
2
function Repair-GroupPolicy {
3
    Write-Host "=== GROUP POLICY REPAIR ===" -ForegroundColor Yellow
4

5
    try {
6
        # Check GP service
7
        $gpService = Get-Service -Name "gpsvc"
8
        if ($gpService.Status -ne "Running") {
9
            Start-Service -Name "gpsvc"
10
            Write-Host "Started Group Policy Client service" -ForegroundColor Green
11
        }
12

13
        # Clear GP cache and force refresh
14
        Remove-Item -Path "C:\Windows\System32\GroupPolicy\*" -Recurse -Force -ErrorAction SilentlyContinue
15
        gpupdate /force /wait:0
16

17
        Write-Host "Group Policy repair completed" -ForegroundColor Green
18

19
    } catch {
20
        Write-Host "Group Policy repair failed: $($_.Exception.Message)" -ForegroundColor Red
21
    }
22
}
23

24
Repair-GroupPolicy

1
@echo off
2
REM EMERGENCY UNISOLATION SCRIPT
3
REM Use only when immediate network access is critical
4

5
echo === EMERGENCY UNISOLATION ===
6
echo WARNING: This bypasses some security checks
7

8
REM Immediate firewall reset and enable
9
netsh advfirewall reset
10
netsh advfirewall set allprofiles state on
11
netsh advfirewall set allprofiles firewallpolicy allowinbound,allowoutbound
12

13
REM DNS and network reset
14
ipconfig /flushdns
15
ipconfig /release
16
ipconfig /renew
17

18
REM Force GP update
19
gpupdate /force /wait:0
20

21
echo Emergency unisolation completed
22
echo IMPORTANT: Run full security validation immediately

1
REM Emergency re-isolation if threats detected
2
echo === EMERGENCY RE-ISOLATION ===
3

4
REM Block all network access
5
netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
6

7
REM Set isolation markers
8
set ISOLATION_STATUS=ACTIVE
9
set QUARANTINE_FLAG=TRUE
10

11
echo System re-isolated. Contact security team immediately.

1
# Enable audit logging for unisolation activities
2
function Enable-UnisolationAuditLogging {
3
    $auditSettings = @{
4
        "System\Audit Policy\System\Other System Events" = "Success,Failure"
5
        "System\Audit Policy\System\Security System Extension" = "Success,Failure"
6
        "System\Audit Policy\Logon-Logoff\Network Policy Server" = "Success,Failure"
7
    }
8

9
    foreach ($setting in $auditSettings.GetEnumerator()) {
10
        auditpol /set /subcategory:"$($setting.Key)" /success:enable /failure:enable
11
        Write-Host "Enabled audit for: $($setting.Key)" -ForegroundColor Green
12
    }
13
}