{"id":208371,"date":"2024-01-03T11:08:30","date_gmt":"2024-01-03T11:08:30","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/surveiller-les-modifications-du-fichier-bootconfig-windows-powershell\/"},"modified":"2024-03-04T18:33:32","modified_gmt":"2024-03-04T18:33:32","slug":"surveiller-les-modifications-du-fichier-bootconfig-windows-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/fr\/script-hub\/surveiller-les-modifications-du-fichier-bootconfig-windows-powershell\/","title":{"rendered":"Comment surveiller les modifications du fichier BootConfig sur Windows [PowerShell Script]"},"content":{"rendered":"

Dans le monde complexe de l’informatique, le maintien de l’int\u00e9grit\u00e9 des syst\u00e8mes est de la plus haute importance. Le fichier BootConfig est un \u00e9l\u00e9ment essentiel du syst\u00e8me d’exploitation Windows. Le contr\u00f4le des modifications apport\u00e9es \u00e0 ce fichier est essentiel pour les administrateurs syst\u00e8me et les professionnels de l’informatique afin de garantir la s\u00e9curit\u00e9 et la stabilit\u00e9 du syst\u00e8me. Ce guide pr\u00e9sente un script PowerShell qui v\u00e9rifie les modifications apport\u00e9es au fichier BootConfig<\/strong>, offrant ainsi une approche proactive de la gestion du syst\u00e8me.<\/p>\n

Contexte<\/h2>\n

Le fichier BootConfig de Windows est un \u00e9l\u00e9ment fondamental qui contient les donn\u00e9es de configuration du d\u00e9marrage. Il d\u00e9termine la mani\u00e8re dont le syst\u00e8me d\u00e9marre, les versions du syst\u00e8me d’exploitation \u00e0 charger et d’autres param\u00e8tres de d\u00e9marrage. Compte tenu de son r\u00f4le dans le processus de d\u00e9marrage, toute modification non autoris\u00e9e ou inattendue peut entra\u00eener des dysfonctionnements ou des vuln\u00e9rabilit\u00e9s du syst\u00e8me. Cela en fait une cible de choix pour les personnes et les logiciels malveillants. Pour les professionnels de l’informatique et les fournisseurs de services g\u00e9r\u00e9s (MSP), disposer d’un outil capable de d\u00e9tecter ces changements est d’une valeur inestimable. Il aide \u00e0 la gestion proactive du syst\u00e8me et \u00e0 l’analyse criminalistique en cas de violation de la s\u00e9curit\u00e9.<\/p>\n

Le script<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    Checks if the BootConfig file was modified from last run.\r\n.DESCRIPTION\r\n    Checks if the BootConfig file was modified from last run.\r\n    On first run this will not produce an error, but will create a cache file for later comparison.\r\n.EXAMPLE\r\n    No parameters needed.\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 10, Windows Server 2016\r\n    Release Notes:\r\n    Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    # Path and file where the cache file will be saved for comparison\r\n    [string]\r\n    $CachePath = \"C:ProgramDataNinjaRMMAgentscriptingTest-BootConfig.clixml\"\r\n)\r\n\r\nbegin {\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n}\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n\r\n    # Get content and create hash of BootConfig file\r\n    $BootConfigContent = bcdedit.exe \/enum\r\n    $Stream = [IO.MemoryStream]::new([byte[]][char[]]\"$BootConfigContent\")\r\n    $BootConfigHash = Get-FileHash -InputStream $Stream -Algorithm SHA256\r\n\r\n    $Current = [PSCustomObject]@{\r\n        Content = $BootConfigContent\r\n        Hash    = $BootConfigHash\r\n    }\r\n\r\n    # Check if this is first run or not\r\n    if ($(Test-Path -Path $CachePath)) {\r\n        # Compare last content and hash\r\n        $Cache = Import-Clixml -Path $CachePath\r\n        $ContentDifference = Compare-Object -ReferenceObject $Cache.Content -DifferenceObject $Current.Content -CaseSensitive\r\n        $HashDifference = $Cache.Hash -like $Current.Hash\r\n        $Current | Export-Clixml -Path $CachePath -Force -Confirm:$false\r\n        if (-not $HashDifference) {\r\n            Write-Host \"BootConfig file has changed since last run!\"\r\n            Write-Host \"\"\r\n            $ContentDifference | ForEach-Object {\r\n                if ($_.SideIndicator -like '=>') {\r\n                    Write-Host \"Added: $($_.InputObject)\"\r\n                }\r\n                elseif ($_.SideIndicator -like '<=') {\r\n                    Write-Host \"Removed: $($_.InputObject)\"\r\n                }\r\n            }\r\n            exit 1\r\n        }\r\n    }\r\n    else {\r\n        Write-Host \"First run, saving comparison cache file.\"\r\n        $Current | Export-Clixml -Path $CachePath -Force -Confirm:$false\r\n    }\r\n    exit 0\r\n}\r\nend {}<\/pre>\n
 <\/p>\n\n
Acc\u00e9dez \u00e0 ce script et \u00e0 des centaines d’autres dans le Dojo NinjaOne<\/p>\n
Obtenez l’acc\u00e8s<\/a><\/p>\n<\/div>\n
R\u00e9sum\u00e9 d\u00e9taill\u00e9<\/h2>\n
Le script fourni est un script PowerShell m\u00e9ticuleusement con\u00e7u pour surveiller les modifications apport\u00e9es au fichier BootConfig depuis sa derni\u00e8re ex\u00e9cution. Voici une description plus d\u00e9taill\u00e9e, \u00e9tape par \u00e9tape :<\/p>\n
    \n
  1. Pr\u00e9requis\u00a0:<\/strong> Le script n\u00e9cessite la version 5.1 de PowerShell.<\/li>\n
  2. V\u00e9rification de l’\u00e9l\u00e9vation :<\/strong> Avant de se lancer dans sa fonction principale, le script v\u00e9rifie s’il est ex\u00e9cut\u00e9 avec les privil\u00e8ges d’administrateur, indispensables pour acc\u00e9der \u00e0 certains fichiers et commandes du syst\u00e8me.<\/li>\n
  3. Hachage de BootConfig :<\/strong> En utilisant la commande bcdedit<\/a>.exe \/enum, le script r\u00e9cup\u00e8re le contenu de BootConfig. Il cr\u00e9e ensuite un hachage SHA256 de ce contenu, qui sert d’identifiant unique et sp\u00e9cifique \u00e0 ce contenu.<\/li>\n
  4. Comparaison des caches :<\/strong> Le script recherche alors un fichier cache pr\u00e9c\u00e9demment enregistr\u00e9. S’il existe, le script compare le contenu et le hachage actuels de BootConfig avec la version mise en cache.<\/li>\n
  5. R\u00e9sultat :<\/strong> Si des diff\u00e9rences sont d\u00e9tect\u00e9es, le script fournit un rapport d\u00e9taill\u00e9 des modifications, en pr\u00e9cisant ce qui a \u00e9t\u00e9 ajout\u00e9 ou supprim\u00e9. Si le script est ex\u00e9cut\u00e9 pour la premi\u00e8re fois, il enregistre les donn\u00e9es BootConfig actuelles en vue de comparaisons ult\u00e9rieures.<\/li>\n<\/ol>\n
    Cas d’utilisation potentiels<\/h2>\n