function Compare-WinGetBaseline {
    <#
    .SYNOPSIS
    将本机已安装软件与基准版本清单对比，输出偏差报告
    .PARAMETER BaselinePath
    基准 JSON 文件路径，包含期望的软件版本
    .PARAMETER ExportCurrent
    将当前已安装软件导出为基准文件（用于首次建立基准）
    #>
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$BaselinePath,
        [switch]$ExportCurrent
    )

    # 采集当前已安装软件
    $rawOutput = winget list --accept-source-agreements 2>&1
    $installed = $rawOutput | Where-Object {
        $_ -match '^\S' -and
        $_ -notmatch '^Name\s+Id' -and
        $_ -notmatch '^\d+ packages'
    } | ForEach-Object {
        $parts = $_ -split '\s{2,}'
        if ($parts.Count -ge 3) {
            [PSCustomObject]@{
                Name      = $parts[0].Trim()
                Id        = $parts[1].Trim()
                Version   = if ($parts.Count -ge 4) { $parts[2].Trim() } else { '未知' }
                Available = if ($parts.Count -ge 4) { $parts[3].Trim() } else {
                    if ($parts.Count -eq 3) { $parts[2].Trim() } else { '' }
                }
            }
        }
    }

    # 导出模式：将当前状态保存为基准
    if ($ExportCurrent) {
        $baseline = $installed | ForEach-Object {
            [ordered]@{ Id = $_.Id; Version = $_.Version }
        }
        $baseline | ConvertTo-Json -Depth 3 | Set-Content $BaselinePath -Encoding UTF8
        Write-Host "基准已导出至 $BaselinePath ($($baseline.Count) 个软件包)" `
            -ForegroundColor Green
        return
    }

    # 对比模式：加载基准并与当前状态比较
    $baselineRaw = Get-Content $BaselinePath -Raw | ConvertFrom-Json
    $baselineMap = @{}
    foreach ($item in $baselineRaw) {
        $baselineMap[$item.Id] = $item.Version
    }

    $results = foreach ($pkg in $installed) {
        if ($baselineMap.ContainsKey($pkg.Id)) {
            $expected = $baselineMap[$pkg.Id]
            $status = if ($pkg.Version -eq $expected) { '匹配' }
                      elseif ([version]::TryParse($pkg.Version, [ref]$null) -and
                              [version]::TryParse($expected, [ref]$null)) {
                          if ([version]$pkg.Version -gt [version]$expected) { '更新' }
                          else { '过旧' }
                      } else { '不同' }
            [PSCustomObject]@{
                Name     = $pkg.Name
                Id       = $pkg.Id
                Current  = $pkg.Version
                Expected = $expected
                Status   = $status
            }
        }
    }

    $results | Sort-Object Status | Format-Table -AutoSize
    $summary = $results | Group-Object Status | ForEach-Object {
        "$($_.Name): $($_.Count)"
    }
    Write-Host "版本偏差汇总: $($summary -join ', ')" -ForegroundColor Cyan
}

# 首次建立基准
# Compare-WinGetBaseline -BaselinePath './baseline.json' -ExportCurrent

# 后续对比检查
# Compare-WinGetBaseline -BaselinePath './baseline.json'

function Invoke-WinGetDesiredState {
    <#
    .SYNOPSIS
    读取 YAML 声明式配置，确保软件状态与期望一致
    .PARAMETER ConfigPath
    YAML 配置文件路径
    .PARAMETER ReportOnly
    仅生成偏差报告，不执行实际安装或卸载
    #>
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [string]$ConfigPath,
        [switch]$ReportOnly
    )

    # 读取 YAML 配置（需要 powershell-yaml 模块或手动解析）
    $configContent = Get-Content $ConfigPath -Raw

    # 简易 YAML 解析：提取 packages 节点下的条目
    $lines = $configContent -split "`n"
    $desiredPackages = @{}
    $currentSection = ''

    foreach ($line in $lines) {
        if ($line -match '^\s*#') { continue }
        if ($line -match '^packages:') {
            $currentSection = 'packages'
            continue
        }
        if ($currentSection -eq 'packages' -and
            $line -match '^\s{2}(\S+):\s*$') {
            $pkgId = $Matches[1]
            $desiredPackages[$pkgId] = @{ State = 'present'; Version = '' }
            $currentSection = "pkg_$pkgId"
        }
        if ($line -match '^\s{4}state:\s*(\S+)') {
            $desiredPackages[$pkgId]['State'] = $Matches[1]
        }
        if ($line -match '^\s{4}version:\s*(\S+)') {
            $desiredPackages[$pkgId]['Version'] = $Matches[1]
        }
        if ($line -match '^[^\s]') {
            $currentSection = ''
        }
    }

    # 获取当前已安装软件
    $rawOutput = winget list --accept-source-agreements 2>&1
    $installedIds = @()
    $installedMap = @{}

    $rawOutput | Where-Object {
        $_ -match '^\S' -and
        $_ -notmatch '^Name\s+Id' -and
        $_ -notmatch '^\d+ packages'
    } | ForEach-Object {
        $parts = $_ -split '\s{2,}'
        if ($parts.Count -ge 2) {
            $id = $parts[1].Trim()
            $installedIds += $id
            $installedMap[$id] = if ($parts.Count -ge 4) {
                $parts[2].Trim()
            } else { '未知' }
        }
    }

    # 计算偏差并执行收敛
    $actions = @()

    foreach ($id in $desiredPackages.Keys) {
        $desired = $desiredPackages[$id]
        if ($desired.State -eq 'present') {
            if ($id -notin $installedIds) {
                $actions += [PSCustomObject]@{
                    Action = '安装'
                    Id     = $id
                    Target = $desired.Version
                }
            } elseif ($desired.Version -and
                      $installedMap[$id] -ne $desired.Version) {
                $actions += [PSCustomObject]@{
                    Action = '版本调整'
                    Id     = $id
                    Target = "$($installedMap[$id]) -> $($desired.Version)"
                }
            }
        } elseif ($desired.State -eq 'absent' -and $id -in $installedIds) {
            $actions += [PSCustomObject]@{
                Action = '卸载'
                Id     = $id
                Target = $installedMap[$id]
            }
        }
    }

    Write-Host "配置偏差分析完成，共 $($actions.Count) 项操作:" `
        -ForegroundColor Cyan
    $actions | Format-Table -AutoSize

    if ($ReportOnly) {
        Write-Host "[报告模式] 不执行实际操作" -ForegroundColor DarkYellow
        return
    }

    foreach ($act in $actions) {
        switch ($act.Action) {
            '安装' {
                $args = @('install', '--id', $act.Id,
                    '--accept-package-agreements',
                    '--accept-source-agreements')
                if ($desiredPackages[$act.Id].Version) {
                    $args += @('--version', $desiredPackages[$act.Id].Version)
                }
                Write-Host "安装 $($act.Id)..." -ForegroundColor Yellow -NoNewline
                winget @args 2>&1 | Out-Null
            }
            '卸载' {
                Write-Host "卸载 $($act.Id)..." -ForegroundColor Yellow -NoNewline
                winget uninstall --id $act.Id 2>&1 | Out-Null
            }
            '版本调整' {
                Write-Host "调整 $($act.Id) 版本..." -ForegroundColor Yellow -NoNewline
                winget install --id $act.Id --version `
                    $desiredPackages[$act.Id].Version `
                    --force --accept-package-agreements `
                    --accept-source-agreements 2>&1 | Out-Null
            }
        }
        if ($LASTEXITCODE -eq 0) {
            Write-Host " 完成" -ForegroundColor Green
        } else {
            Write-Host " 失败 (退出码: $LASTEXITCODE)" -ForegroundColor Red
        }
    }
    Write-Host "`n状态收敛完成" -ForegroundColor Green
}

function Invoke-WinGetSafeUpdate {
    <#
    .SYNOPSIS
    安全更新：更新前快照，支持回滚
    .PARAMETER SnapshotDir
    快照存储目录
    .PARAMETER MaxRetries
    单个软件包更新失败后的最大重试次数
    .PARAMETER RollbackOnFailure
    任一软件更新失败时自动回滚所有已更新的软件
    #>
    [CmdletBinding()]
    param(
        [string]$SnapshotDir = (Join-Path $env:TEMP 'WinGetSnapshots'),
        [int]$MaxRetries = 2,
        [switch]$RollbackOnFailure
    )

    if (-not (Test-Path $SnapshotDir)) {
        New-Item -ItemType Directory -Path $SnapshotDir | Out-Null
    }

    $timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'
    $snapshotPath = Join-Path $SnapshotDir "snapshot_$timestamp.json"

    # 第一步：创建当前软件版本快照
    Write-Host "[1/4] 正在创建软件版本快照..." -ForegroundColor Cyan
    $rawOutput = winget list --accept-source-agreements 2>&1
    $snapshot = $rawOutput | Where-Object {
        $_ -match '^\S' -and
        $_ -notmatch '^Name\s+Id' -and
        $_ -notmatch '^\d+ packages'
    } | ForEach-Object {
        $parts = $_ -split '\s{2,}'
        if ($parts.Count -ge 3) {
            [ordered]@{
                Name    = $parts[0].Trim()
                Id      = $parts[1].Trim()
                Version = if ($parts.Count -ge 4) {
                    $parts[2].Trim()
                } else { '未知' }
            }
        }
    }

    $snapshot | ConvertTo-Json -Depth 3 | Set-Content $snapshotPath -Encoding UTF8
    Write-Host "快照已保存: $snapshotPath ($($snapshot.Count) 个软件包)" `
        -ForegroundColor Green

    # 第二步：扫描可更新的软件
    Write-Host "`n[2/4] 正在扫描可更新的软件..." -ForegroundColor Cyan
    $upgradeOutput = winget upgrade 2>&1
    $upgradable = $upgradeOutput | Where-Object {
        $_ -match '^\S' -and
        $_ -notmatch '^Name\s+Id' -and
        $_ -notmatch '^\d+ upgrades'
    } | ForEach-Object {
        $parts = $_ -split '\s{2,}'
        if ($parts.Count -ge 4) {
            [PSCustomObject]@{
                Name     = $parts[0].Trim()
                Id       = $parts[1].Trim()
                OldVer   = $parts[2].Trim()
                NewVer   = $parts[3].Trim()
            }
        }
    }

    if (-not $upgradable) {
        Write-Host "所有软件已是最新版本，无需更新" -ForegroundColor Green
        return
    }

    Write-Host "发现 $($upgradable.Count) 个可更新软件包:" -ForegroundColor Yellow
    $upgradable | Format-Table Name, Id, OldVer, NewVer -AutoSize

    # 第三步：逐个执行更新并记录结果
    Write-Host "`n[3/4] 开始安全更新..." -ForegroundColor Cyan
    $results = @()
    $failed = @()

    foreach ($pkg in $upgradable) {
        $success = $false
        $attempt = 0

        while (-not $success -and $attempt -lt $MaxRetries) {
            $attempt++
            Write-Host "  更新 $($pkg.Id) ($($pkg.OldVer) -> $($pkg.NewVer))" `
                -ForegroundColor Yellow -NoNewline
            if ($attempt -gt 1) {
                Write-Host " [重试 $attempt]" -ForegroundColor DarkYellow -NoNewline
            }

            winget upgrade --id $pkg.Id --accept-package-agreements `
                --accept-source-agreements 2>&1 | Out-Null

            if ($LASTEXITCODE -eq 0) {
                Write-Host " 完成" -ForegroundColor Green
                $success = $true
                $results += [PSCustomObject]@{
                    Id       = $pkg.Id
                    OldVer   = $pkg.OldVer
                    NewVer   = $pkg.NewVer
                    Status   = '成功'
                    Attempts = $attempt
                }
            } else {
                Write-Host " 失败" -ForegroundColor Red
            }
        }

        if (-not $success) {
            $failed += $pkg
            $results += [PSCustomObject]@{
                Id       = $pkg.Id
                OldVer   = $pkg.OldVer
                NewVer   = $pkg.NewVer
                Status   = '失败'
                Attempts = $MaxRetries
            }
        }
    }

    # 第四步：失败时自动回滚
    Write-Host "`n[4/4] 更新结果汇总:" -ForegroundColor Cyan
    $results | Format-Table Id, OldVer, NewVer, Status, Attempts -AutoSize

    if ($failed -and $RollbackOnFailure) {
        Write-Host "`n检测到更新失败，正在回滚到快照版本..." -ForegroundColor Red
        $snapshotData = Get-Content $snapshotPath -Raw | ConvertFrom-Json
        $updatedIds = $results | Where-Object { $_.Status -eq '成功' } |
            Select-Object -ExpandProperty Id

        foreach ($id in $updatedIds) {
            $entry = $snapshotData | Where-Object { $_.Id -eq $id }
            if ($entry -and $entry.Version -ne '未知') {
                Write-Host "  回滚 $($entry.Id) 到 $($entry.Version)..." `
                    -ForegroundColor Yellow -NoNewline
                winget install --id $entry.Id --version $entry.Version `
                    --force --accept-package-agreements `
                    --accept-source-agreements 2>&1 | Out-Null
                if ($LASTEXITCODE -eq 0) {
                    Write-Host " 完成" -ForegroundColor Green
                } else {
                    Write-Host " 回滚失败" -ForegroundColor Red
                }
            }
        }
        Write-Host "回滚流程结束" -ForegroundColor Cyan
    } elseif ($failed) {
        Write-Host "`n提示: 更新失败的软件可使用以下命令手动回滚:" -ForegroundColor Yellow
        Write-Host "  回滚快照文件: $snapshotPath" -ForegroundColor DarkYellow
        foreach ($f in $failed) {
            Write-Host "  winget install --id $($f.Id) " + `
                "--version $($f.OldVer) --force" -ForegroundColor DarkYellow
        }
    }

    Write-Host "`n快照文件: $snapshotPath" -ForegroundColor DarkGray
    Write-Host "可使用以下命令查看历史快照: Get-ChildItem $SnapshotDir" `
        -ForegroundColor DarkGray
}

# 导入 PrintManagement 模块（Windows 8/Server 2012 及以上自带）
Import-Module PrintManagement

# 定义打印机配置参数
$PrinterConfig = @{
    DriverName = 'HP Universal Printing PCL 6'
    DriverInf  = '\\fileserver\drivers\HP\hpcu250u.inf'
    PortName   = 'IP_192.168.1.100'
    IPAddress  = '192.168.1.100'
    PrinterName = 'HP-LaserJet-Finance-3F'
    Location   = '3F-Finance-Dept'
    Comment    = '财务部3楼共享打印机'
}

# 第一步：安装打印机驱动（如果尚未安装）
$existingDriver = Get-PrinterDriver -Name $PrinterConfig.DriverName -ErrorAction SilentlyContinue

if (-not $existingDriver) {
    Add-PrinterDriver -Name $PrinterConfig.DriverName -InfPath $PrinterConfig.DriverInf
    Write-Host "已安装驱动: $($PrinterConfig.DriverName)" -ForegroundColor Green
} else {
    Write-Host "驱动已存在，跳过安装: $($PrinterConfig.DriverName)" -ForegroundColor Yellow
}

# 第二步：创建 TCP/IP 打印端口
$existingPort = Get-PrinterPort -Name $PrinterConfig.PortName -ErrorAction SilentlyContinue

if (-not $existingPort) {
    Add-PrinterPort -Name $PrinterConfig.PortName -PrinterHostAddress $PrinterConfig.IPAddress
    Write-Host "已创建端口: $($PrinterConfig.PortName)" -ForegroundColor Green
} else {
    Write-Host "端口已存在，跳过创建: $($PrinterConfig.PortName)" -ForegroundColor Yellow
}

# 第三步：添加打印机
$existingPrinter = Get-Printer -Name $PrinterConfig.PrinterName -ErrorAction SilentlyContinue

if (-not $existingPrinter) {
    Add-Printer `
        -Name $PrinterConfig.PrinterName `
        -DriverName $PrinterConfig.DriverName `
        -PortName $PrinterConfig.PortName `
        -Location $PrinterConfig.Location `
        -Comment $PrinterConfig.Comment

    Write-Host "已添加打印机: $($PrinterConfig.PrinterName)" -ForegroundColor Green
} else {
    Write-Host "打印机已存在: $($PrinterConfig.PrinterName)" -ForegroundColor Yellow
}

# 验证安装结果
Get-Printer -Name $PrinterConfig.PrinterName |
    Select-Object Name, DriverName, PortName, Location, PrinterStatus |
    Format-List

# 定义部门与打印机的映射关系
$PrinterMapping = @(
    @{
        Department      = 'Finance'
        Printers        = @('HP-LaserJet-Finance-3F', 'HP-ColorJet-Finance-3F')
        DefaultPrinter  = 'HP-LaserJet-Finance-3F'
    }
    @{
        Department      = 'HR'
        Printers        = @('HP-LaserJet-HR-5F')
        DefaultPrinter  = 'HP-LaserJet-HR-5F'
    }
    @{
        Department      = 'Engineering'
        Printers        = @('HP-LaserJet-Eng-8F', 'Canon-Eng-LargeFormat')
        DefaultPrinter  = 'HP-LaserJet-Eng-8F'
    }
)

# 远程打印服务器
$PrintServer = 'PRINTSRV01'

# 根据当前用户所属部门自动映射打印机
function Install-DepartmentPrinters {
    param(
        [string[]]$UserDepartments,
        [string]$Server = 'PRINTSRV01'
    )

    foreach ($dept in $UserDepartments) {
        $mapping = $PrinterMapping | Where-Object { $_.Department -eq $dept }

        if (-not $mapping) {
            Write-Warning "未找到部门 '$dept' 的打印机映射配置"
            continue
        }

        Write-Host "`n=== 正在为部门 [$dept] 映射打印机 ===" -ForegroundColor Cyan

        foreach ($printerName in $mapping.Printers) {
            $fullPath = "\\$Server\$printerName"

            try {
                # 检查打印机是否已映射
                $existing = Get-Printer -Name $fullPath -ErrorAction SilentlyContinue

                if (-not $existing) {
                    Add-Printer -ConnectionName $fullPath
                    Write-Host "  已映射: $printerName" -ForegroundColor Green
                } else {
                    Write-Host "  已存在: $printerName" -ForegroundColor Yellow
                }
            } catch {
                Write-Host "  映射失败: $printerName - $($_.Exception.Message)" -ForegroundColor Red
            }
        }

        # 设置默认打印机
        if ($mapping.DefaultPrinter) {
            $defaultPath = "\\$Server\$($mapping.DefaultPrinter)"
            $defaultPrinter = Get-Printer -Name $defaultPath -ErrorAction SilentlyContinue

            if ($defaultPrinter) {
                # 使用 rundll32 设置默认打印机（兼容性好）
                $null = rundll32.exe printui.dll,PrintUIEntry /y /n $defaultPath
                Write-Host "  已设为默认: $($mapping.DefaultPrinter)" -ForegroundColor Green
            }
        }
    }
}

# 模拟：从 Active Directory 获取用户部门信息
$userDepartment = 'Finance'

# 执行映射
Install-DepartmentPrinters -UserDepartments $userDepartment -Server $PrintServer

# 输出当前已安装的打印机列表
Write-Host "`n=== 当前已映射的打印机 ===" -ForegroundColor Cyan
Get-Printer | Where-Object { $_.Type -eq 'Connection' } |
    Select-Object Name, Location, Comment |
    Format-Table -AutoSize

# 打印服务器监控脚本
$PrintServer = 'PRINTSRV01'

# 获取所有打印机及其队列状态
Write-Host "=== 打印机状态总览 ===" -ForegroundColor Cyan
$allPrinters = Get-Printer -ComputerName $PrintServer

$allPrinters |
    Select-Object Name,
        @{N='状态';E={
            switch ($_.PrinterStatus) {
                0 { 'Paused' }
                1 { 'Error' }
                2 { 'Pending Deletion' }
                3 { 'Paper Jam' }
                4 { 'Paper Out' }
                5 { 'Manual Feed' }
                6 { 'Offline' }
                7 { 'IO Active' }
                8 { 'Busy' }
                9 { 'Printing' }
                10 { 'Output Bin Full' }
                default { 'Ready' }
            }
        }},
        @{N='队列作业数';E={ (Get-PrintJob -PrinterName $_.Name -ErrorAction SilentlyContinue |
            Measure-Object).Count }},
        JobCountUntilNotification,
        Location |
    Format-Table -AutoSize

# 检查卡住的打印作业（超过 30 分钟仍在队列中）
Write-Host "`n=== 超时打印作业检查 ===" -ForegroundColor Cyan
$threshold = (Get-Date).AddMinutes(-30)
$stuckJobs = @()

foreach ($printer in $allPrinters) {
    $jobs = Get-PrintJob -PrinterName $printer.Name -ErrorAction SilentlyContinue

    foreach ($job in $jobs) {
        if ($job.SubmitTime -and $job.SubmitTime -lt $threshold) {
            $stuckJobs += [PSCustomObject]@{
                PrinterName = $printer.Name
                JobId       = $job.Id
                Document    = $job.DocumentName
                SubmitTime  = $job.SubmitTime
                UserName    = $job.UserName
                Size(KB)    = [math]::Round($job.Size / 1KB, 2)
            }
        }
    }
}

if ($stuckJobs) {
    Write-Host "发现 $($stuckJobs.Count) 个超时作业:" -ForegroundColor Yellow
    $stuckJobs | Format-Table -AutoSize

    # 自动清理超时作业
    $confirm = Read-Host "是否清理这些超时作业？(Y/N)"
    if ($confirm -eq 'Y') {
        foreach ($job in $stuckJobs) {
            Remove-PrintJob -PrinterName $job.PrinterName -ID $job.JobId
            Write-Host "  已删除作业: $($job.Document) (ID: $($job.JobId))" -ForegroundColor Green
        }
    }
} else {
    Write-Host "没有发现超时的打印作业" -ForegroundColor Green
}

# 驱动兼容性检查
Write-Host "`n=== 打印机驱动诊断 ===" -ForegroundColor Cyan
$drivers = Get-PrinterDriver -ComputerName $PrintServer

$drivers |
    Select-Object Name,
        @{N='环境';E={ $_.PrinterEnvironment -join ', ' }},
        @{N='驱动版本';E={ $_.DriverVersion }},
        @{N='依赖文件数';E={ ($_.DependentFiles | Measure-Object).Count }} |
    Format-Table -AutoSize

# 检查是否有驱动文件缺失
foreach ($driver in $drivers) {
    $driverPath = Join-Path $env:SystemRoot "System32\spool\drivers"
    $missingFiles = @()

    if ($driver.DependentFiles) {
        foreach ($file in $driver.DependentFiles) {
            $fullPath = Join-Path $driverPath $file
            if (-not (Test-Path $fullPath)) {
                $missingFiles += $file
            }
        }
    }

    if ($missingFiles.Count -gt 0) {
        Write-Host "驱动 '$($driver.Name)' 缺失 $($missingFiles.Count) 个文件:" -ForegroundColor Red
        $missingFiles | ForEach-Object { Write-Host "  - $_" -ForegroundColor Red }
    }
}

# 导入 GroupPolicy 模块
Import-Module GroupPolicy

# 定义常用变量
$Domain = "contoso.com"
$BackupPath = "C:\GPOBackup\$(Get-Date -Format 'yyyyMMdd')"

# 创建新的 GPO
$GPO = New-GPO -Name "Security Baseline 2026" -Comment "年度安全基线策略"

# 将 GPO 链接到指定的 OU，并设置优先级
New-GPLink -Name "Security Baseline 2026" -Target "OU=Servers,DC=contoso,DC=com" -LinkEnabled Yes -Order 1

# 禁用 GPO 的用户配置部分（仅保留计算机配置）
$GPO | Set-GPO -GpoStatus UserSettingsDisabled

# 创建备份目录并备份所有 GPO
if (-not (Test-Path $BackupPath)) {
    New-Item -Path $BackupPath -ItemType Directory -Force | Out-Null
}

$BackupReport = Backup-GPO -All -Path $BackupPath
$BackupReport | Select-Object DisplayName, GpoId, BackupId, Timestamp |
    Format-Table -AutoSize

# 导出备份清单为 CSV，便于后续还原时查找
$BackupReport | Export-Csv -Path "$BackupPath\BackupInventory.csv" -NoTypeInformation -Encoding UTF8

# 从备份还原单个 GPO（模拟灾难恢复场景）
$LatestBackup = $BackupReport | Where-Object { $_.DisplayName -eq "Security Baseline 2026" }
Restore-GPO -Name "Security Baseline 2026" -Path $BackupPath -BackupId $LatestBackup.BackupId

# 查看域中所有 GPO 的概览
Get-GPO -All | Select-Object DisplayName, GpoStatus, CreationTime, ModificationTime |
    Sort-Object ModificationTime -Descending |
    Format-Table -AutoSize

# --- 注册表首选项：通过 GPO 推送注册表项 ---
$GPOName = "Security Baseline 2026"
$Domain = "contoso.com"

# 设置注册表项：禁用 SMBv1（安全加固）
Set-GPPrefRegistryValue -Name $GPOName -Context Computer -Action Create `
    -Key "SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" `
    -ValueName "SMB1" -Value 0 -Type DWord -Order 1

# 设置注册表项：启用 PowerShell 脚本块日志记录
Set-GPPrefRegistryValue -Name $GPOName -Context Computer -Action Create `
    -Key "SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
    -ValueName "EnableScriptBlockLogging" -Value 1 -Type DWord -Order 2

# 设置注册表项：配置 Windows Defender 实时保护
Set-GPPrefRegistryValue -Name $GPOName -Context Computer -Action Create `
    -Key "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" `
    -ValueName "DisableRealtimeMonitoring" -Value 0 -Type DWord -Order 3

# --- 安全设置：通过 ini 文件方式配置账户策略 ---
# 生成安全模板 INF 文件
$SecTemplatePath = "C:\Temp\SecurityTemplate.inf"
$InfContent = @"
[Unicode]
Unicode=yes
[Version]
signature=`"`$CHICAGO`$`"
Revision=1
[Account Policies]
[Password History]
MaximumPasswordAge = 90
MinimumPasswordAge = 1
MinimumPasswordLength = 14
PasswordComplexity = 1
[Lockout]
LockoutDuration = 30
LockoutBadCount = 5
ResetLockoutCount = 30
"@

Set-Content -Path $SecTemplatePath -Value $InfContent -Encoding Unicode

# --- 脚本部署：配置启动脚本 ---
$ScriptName = "Install-EndpointAgent.ps1"
$ScriptContent = @'
# 端点代理安装脚本 - 由组策略推送执行
$AgentPath = "\\contoso.com\SYSVOL\contoso.com\scripts\EndpointAgent.msi"
$LogPath = "C:\Logs\AgentInstall.log"

if (-not (Get-Service -Name "EndpointAgent" -ErrorAction SilentlyContinue)) {
    Start-Process msiexec.exe -ArgumentList "/i `"$AgentPath`" /qn /l*v `"$LogPath`"" -Wait
    Write-Output "$(Get-Date) - Endpoint Agent installed successfully" | Out-File $LogPath -Append
}
'@

# 将脚本保存到 GPO 的启动脚本目录
$GPO = Get-GPO -Name $GPOName
$StartupScriptFolder = "\\$Domain\SYSVOL\$Domain\Policies\{$($GPO.Id)}\Machine\Scripts\Startup"
if (-not (Test-Path $StartupScriptFolder)) {
    New-Item -Path $StartupScriptFolder -ItemType Directory -Force | Out-Null
}
Set-Content -Path "$StartupScriptFolder\$ScriptName" -Value $ScriptContent -Encoding UTF8

Write-Host "策略设置编辑完成：注册表首选项 3 项、安全模板 1 份、启动脚本 1 个"

# --- RSOP 分析：获取目标计算机的实际策略应用结果 ---
$ComputerName = "SRV-DC01.contoso.com"

# 生成 GPO 报告（HTML 格式）
$ReportPath = "C:\Reports\GPOReport_$(Get-Date -Format 'yyyyMMdd_HHmmss').html"
Get-GPOReport -All -ReportType Html -Path $ReportPath
Write-Host "GPO 报告已生成: $ReportPath"

# 获取指定计算机的 RSOP 报告
$RsopReport = "C:\Reports\RSOP_$ComputerName`_$(Get-Date -Format 'yyyyMMdd').html"
gpresult /s $ComputerName /h $RsopReport /f 2>$null
Write-Host "RSOP 报告已生成: $RsopReport"

# --- 基线对比：检测 GPO 是否偏离已知良好配置 ---
$BaselinePath = "C:\GPOBaseline"
$CurrentBackupPath = "C:\GPOBackup\$(Get-Date -Format 'yyyyMMdd')"

# 比较基线和当前备份中的 GPO 数量
$BaselineGPOs = Get-ChildItem -Path $BaselinePath -Directory
$CurrentGPOs = Get-ChildItem -Path $CurrentBackupPath -Directory

$Missing = $BaselineGPOs.Name | Where-Object { $_ -notin $CurrentGPOs.Name }
$New = $CurrentGPOs.Name | Where-Object { $_ -notin $BaselineGPOs.Name }

if ($Missing) {
    Write-Warning "以下基线 GPO 在当前备份中缺失: $($Missing -join ', ')"
}
if ($New) {
    Write-Host "发现新增 GPO: $($New -join ', ')" -ForegroundColor Yellow
}

# --- 变更追踪：监控 GPO 的修改时间和设置变更 ---
$AuditLog = "C:\Reports\GPO_AuditLog_$(Get-Date -Format 'yyyyMMdd').csv"

# 获取所有 GPO 的当前状态快照
$Snapshot = Get-GPO -All | ForEach-Object {
    $Links = (Get-GPOReport -Name $_.DisplayName -ReportType Xml)
    $LinkCount = ([xml]$Links).GPO.LinksTo | Measure-Object | Select-Object -ExpandProperty Count

    [PSCustomObject]@{
        GPOName         = $_.DisplayName
        GpoId           = $_.Id
        Status          = $_.GpoStatus
        LinkCount       = $LinkCount
        ComputerEnabled = ($_.GpoStatus -ne 'ComputerSettingsDisabled' -and $_.GpoStatus -ne 'AllSettingsDisabled')
        UserEnabled     = ($_.GpoStatus -ne 'UserSettingsDisabled' -and $_.GpoStatus -ne 'AllSettingsDisabled')
        ModifiedTime    = $_.ModificationTime
        AuditTime       = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
    }
}

$Snapshot | Export-Csv -Path $AuditLog -NoTypeInformation -Encoding UTF8

# 标记最近 7 天内修改过的 GPO
$RecentChanges = $Snapshot | Where-Object { $_.ModifiedTime -gt (Get-Date).AddDays(-7) }
if ($RecentChanges) {
    Write-Host "`n最近 7 天内修改的 GPO:" -ForegroundColor Cyan
    $RecentChanges | Format-Table GPOName, ModifiedTime, LinkCount, Status -AutoSize
} else {
    Write-Host "`n最近 7 天内无 GPO 变更" -ForegroundColor Green
}

Write-Host "`n审计快照已保存: $AuditLog"

# 查看可用的注册表驱动器
Get-PSDrive -PSProvider Registry | Format-Table Name, Root

# 读取 Windows 当前版本信息
$osInfo = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
Write-Host "系统版本: $($osInfo.ProductName)"
Write-Host "当前版本号: $($osInfo.DisplayVersion)"
Write-Host "构建号: $($osInfo.CurrentBuild)"

# 批量修改远程桌面相关注册表项
$rdpSettings = @{
    'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' = @{
        fDenyTSConnections = 0  # 允许远程桌面连接
    }
    'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' = @{
        UserAuthentication = 1  # 要求网络级别身份验证
    }
}

foreach ($path in $rdpSettings.Keys) {
    foreach ($name in $rdpSettings[$path].Keys) {
        $value = $rdpSettings[$path][$name]
        Set-ItemProperty -Path $path -Name $name -Value $value
        Write-Host "已设置 $path\$name = $value"
    }
}

# 搜索注册表中的特定键值（以搜索所有安装的 .NET 版本为例）
$dotnetKey = 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full'
if (Test-Path $dotnetKey) {
    $release = (Get-ItemProperty -Path $dotnetKey -Name Release -ErrorAction SilentlyContinue).Release
    $versions = @{
        528040 = '.NET Framework 4.8'
        533320 = '.NET Framework 4.8.1'
    }
    $found = $versions.Keys | Where-Object { $release -ge $_ } | Sort-Object -Descending | Select-Object -First 1
    Write-Host ".NET 版本: $($versions[$found]) (Release=$release)"
}

# 导出注册表项到 .reg 文件（使用 reg.exe）
$tempRegFile = "$env:TEMP\firewall_backup.reg"
reg export 'HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy' $tempRegFile /y
Write-Host "防火墙注册表已导出到: $tempRegFile"

function Invoke-RegistrySecurityAudit {
    $auditResults = @()

    # 定义安全基线检查项
    $baselineChecks = @(
        @{
            Name   = 'UAC - 管理员批准模式'
            Path   = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
            Key    = 'EnableLUA'
            Expected = 1
            Severity = '高'
        },
        @{
            Name   = 'UAC - 提示提升时切换到安全桌面'
            Path   = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
            Key    = 'PromptOnSecureDesktop'
            Expected = 1
            Severity = '高'
        },
        @{
            Name   = '远程桌面 - 空密码限制'
            Path   = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'
            Key    = 'LimitBlankPasswordUse'
            Expected = 1
            Severity = '高'
        },
        @{
            Name   = '远程桌面 - NLA 要求'
            Path   = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'
            Key    = 'UserAuthentication'
            Expected = 1
            Severity = '中'
        },
        @{
            Name   = '防火墙 - 域配置文件启用状态'
            Path   = 'HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile'
            Key    = 'EnableFirewall'
            Expected = 1
            Severity = '高'
        },
        @{
            Name   = '防火墙 - 标准配置文件启用状态'
            Path   = 'HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile'
            Key    = 'EnableFirewall'
            Expected = 1
            Severity = '高'
        },
        @{
            Name   = '审核策略 - 对象访问审计'
            Path   = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'
            Key    = 'AuditBaseObjects'
            Expected = 1
            Severity = '中'
        },
        @{
            Name   = 'WinRM - 允许远程服务器管理'
            Path   = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service'
            Key    = 'AllowAutoConfig'
            Expected = 1
            Severity = '低'
        }
    )

    foreach ($check in $baselineChecks) {
        $actual = $null
        $status = '跳过'

        if (Test-Path $check.Path) {
            $actual = (Get-ItemProperty -Path $check.Path -Name $check.Key -ErrorAction SilentlyContinue).($check.Key)
            if ($null -ne $actual) {
                $status = if ($actual -eq $check.Expected) { '通过' } else { '不合规' }
            } else {
                $status = '未配置'
            }
        } else {
            $status = '路径不存在'
        }

        $auditResults += [PSCustomObject]@{
            检查项   = $check.Name
            预期值   = $check.Expected
            实际值   = if ($null -ne $actual) { $actual } else { 'N/A' }
            状态     = $status
            严重级别 = $check.Severity
        }
    }

    # 输出审计报告
    Write-Host "`n========== 注册表安全基线审计报告 =========="
    Write-Host "审计时间: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
    Write-Host "计算机名: $env:COMPUTERNAME"
    Write-Host "==============================================`n"

    $auditResults | Format-Table -AutoSize

    # 统计摘要
    $compliant = ($auditResults | Where-Object { $_.状态 -eq '通过' }).Count
    $total = $auditResults.Count
    $nonCompliant = $auditResults | Where-Object { $_.状态 -eq '不合规' }

    Write-Host "合规项: $compliant / $total"

    if ($nonCompliant) {
        Write-Host "`n不合规项详情:" -ForegroundColor Red
        foreach ($item in $nonCompliant) {
            Write-Host "  [$($item.严重级别)] $($item.检查项): 预期=$($item.预期值), 实际=$($item.实际值)"
        }
    }

    return $auditResults
}

Invoke-RegistrySecurityAudit

function Protect-RegistryKey {
    param(
        [Parameter(Mandatory)]
        [string]$Path,

        [ValidateSet('Read', 'Write', 'FullControl')]
        [string]$Permission = 'Read',

        [string]$Account = 'BUILTIN\Users'
    )

    if (-not (Test-Path $Path)) {
        Write-Warning "注册表路径不存在: $Path"
        return
    }

    # 获取当前 ACL
    $acl = Get-Acl -Path $Path

    # 定义权限映射
    $rightsMap = @{
        Read        = 'ReadKey'
        Write       = 'WriteKey'
        FullControl = 'FullControl'
    }

    $rule = New-Object System.Security.AccessControl.RegistryAccessRule(
        $Account,
        $rightsMap[$Permission],
        'ContainerInherit,ObjectInherit',
        'None',
        'Allow'
    )

    $acl.AddAccessRule($rule)
    Set-Acl -Path $Path -AclObject $acl
    Write-Host "已为 $Account 授予 $Permission 权限: $Path"
}

function New-RegistryBaseline {
    param(
        [string[]]$Paths = @(
            'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
            'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'
            'HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy'
        ),
        [string]$OutputPath = "$env:TEMP\registry_baseline.json"
    )

    $baseline = @{
        CreatedAt = Get-Date -Format 'o'
        Computer  = $env:COMPUTERNAME
        Entries   = @{}
    }

    foreach ($path in $Paths) {
        if (-not (Test-Path $path)) { continue }

        $props = Get-ItemProperty -Path $path -ErrorAction SilentlyContinue
        $entry = @{}

        # 获取所有属性（排除默认的 PS* 属性）
        $props.PSObject.Properties |
            Where-Object { $_.Name -notmatch '^PS' } |
            ForEach-Object {
                $entry[$_.Name] = $_.Value
            }

        $baseline.Entries[$path] = $entry
    }

    $baseline | ConvertTo-Json -Depth 10 | Set-Content -Path $OutputPath -Encoding UTF8
    Write-Host "基线已保存到: $OutputPath"
    return $OutputPath
}

function Compare-RegistryBaseline {
    param(
        [Parameter(Mandatory)]
        [string]$BaselineFile
    )

    if (-not (Test-Path $BaselineFile)) {
        Write-Error "基线文件不存在: $BaselineFile"
        return
    }

    $baseline = Get-Content -Path $BaselineFile -Raw | ConvertFrom-Json
    Write-Host "`n========== 注册表变更检测报告 =========="
    Write-Host "基线创建时间: $($baseline.CreatedAt)"
    Write-Host "检查时间: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
    Write-Host "========================================`n"

    $changes = @()

    foreach ($path in $baseline.Entries.PSObject.Properties.Name) {
        if (-not (Test-Path $path)) {
            $changes += [PSCustomObject]@{
                路径 = $path
                变更类型 = '已删除'
                属性 = 'N/A'
                原值 = 'N/A'
                新值 = 'N/A'
            }
            continue
        }

        $current = Get-ItemProperty -Path $path -ErrorAction SilentlyContinue
        $savedProps = $baseline.Entries.$path

        foreach ($prop in $savedProps.PSObject.Properties) {
            $currentValue = $current.($prop.Name)
            $savedValue = $prop.Value

            if ($null -ne $currentValue -and "$currentValue" -ne "$savedValue") {
                $changes += [PSCustomObject]@{
                    路径 = $path
                    变更类型 = '已修改'
                    属性 = $prop.Name
                    原值 = $savedValue
                    新值 = $currentValue
                }
            }
        }
    }

    if ($changes.Count -eq 0) {
        Write-Host "未检测到任何变更，所有配置与基线一致。" -ForegroundColor Green
    } else {
        Write-Host "检测到 $($changes.Count) 处变更:" -ForegroundColor Yellow
        $changes | Format-Table -AutoSize
    }

    return $changes
}

# 使用示例：创建基线并检测变更
$baselineFile = New-RegistryBaseline
Compare-RegistryBaseline -BaselineFile $baselineFile

# 限制 Users 组对关键注册表项的写入权限
Protect-RegistryKey -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Permission 'Read' -Account 'BUILTIN\Users'

# 搜索软件包
function Find-WinGetPackage {
    param(
        [Parameter(Mandatory)]
        [string]$Keyword
    )

    $result = winget search $Keyword --accept-source-agreements 2>&1
    $result
}

# 安装软件包
function Install-WinGetPackage {
    param(
        [Parameter(Mandatory)]
        [string]$PackageId,

        [switch]$Silent
    )

    $args = @(
        'install'
        '--id', $PackageId
        '--accept-source-agreements'
        '--accept-package-agreements'
    )

    if ($Silent) {
        $args += '--silent'
    }

    Write-Host "正在安装: $PackageId" -ForegroundColor Cyan
    winget @args 2>&1
}

# 列出已安装的软件
function Get-WinGetInstalled {
    $output = winget list --accept-source-agreements 2>&1
    $output
}

# 示例：搜索 VS Code
Find-WinGetPackage -Keyword "Visual Studio Code"

# 示例：安装 VS Code（静默模式）
Install-WinGetPackage -PackageId 'Microsoft.VisualStudioCode' -Silent

# 示例：查看已安装的软件列表
Get-WinGetInstalled