{"id":353651,"date":"2024-08-27T09:26:18","date_gmt":"2024-08-27T09:26:18","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/surveiller-les-modifications-de-fichiers-powershell\/"},"modified":"2024-10-13T19:08:05","modified_gmt":"2024-10-13T19:08:05","slug":"surveiller-les-modifications-de-fichiers-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/fr\/script-hub\/surveiller-les-modifications-de-fichiers-powershell\/","title":{"rendered":"Comment surveiller les modifications de fichiers et garantir l’int\u00e9grit\u00e9 \u00e0 l’aide de PowerShell"},"content":{"rendered":"

Dans le monde de l’informatique, le maintien de l’int\u00e9grit\u00e9 et de la s\u00e9curit\u00e9 des fichiers est primordial. Les professionnels de l’informatique et les fournisseurs de services g\u00e9r\u00e9s (MSP)<\/a> ont besoin de m\u00e9thodes fiables pour surveiller les modifications de fichiers<\/strong> afin d’emp\u00eacher les changements non autoris\u00e9s, de garantir la conformit\u00e9 et de maintenir la stabilit\u00e9 du syst\u00e8me. Cet article pr\u00e9sente un puissant script PowerShell<\/a> con\u00e7u pour v\u00e9rifier l’existence d’un fichier, d\u00e9terminer s’il a \u00e9t\u00e9 modifi\u00e9 dans un laps de temps donn\u00e9 et v\u00e9rifier son int\u00e9grit\u00e9 \u00e0 l’aide d’un contr\u00f4le de hachage.<\/p>\n

Contexte<\/h2>\n

Les professionnels de l’informatique et les MSP sont souvent confront\u00e9s au d\u00e9fi de s’assurer que les fichiers restent inchang\u00e9s \u00e0 moins d’\u00eatre explicitement modifi\u00e9s par le personnel autoris\u00e9. Les modifications non autoris\u00e9es peuvent entra\u00eener des failles de s\u00e9curit\u00e9<\/a>, des corruptions de donn\u00e9es et des probl\u00e8mes de conformit\u00e9. Pour relever ces d\u00e9fis, une solution robuste est n\u00e9cessaire pour surveiller les modifications des fichiers et garantir leur int\u00e9grit\u00e9. Ce script PowerShell offre une approche rationalis\u00e9e pour r\u00e9pondre \u00e0 ces besoins, en fournissant des alertes bas\u00e9es sur des conditions sp\u00e9cifiques, telles que les modifications de fichiers ou l’absence de modifications.<\/p>\n

Le script<\/h2>\n
<#\r\n.SYNOPSIS\r\n    Checks whether a file is present and if it has been updated within your specified time frame or fails a hash check.\r\n.DESCRIPTION\r\n    Checks whether a file is present and if it has been updated within your specified time frame or fails a hash check.\r\n\r\nPARAMETER: -Alert \"Alert If Change\" or -Alert \"Alert If No Change\"\r\n    Raise an alert if the file has or hasn't been modified based on your other parameters.\r\n\r\nPARAMETER: -Hash \"REPLACEMEC32D73431CED24FF114B2A216671C60117AF5012B40\"\r\n    The hash or checksum to verify that the file hasn't been modified.\r\nPARAMETER: -Algorithm \"SHA256\"\r\n    The hashing algorithm used for your inputted hash.\r\n.EXAMPLE\r\n    -Path \"C:\\TestFile.txt\" -Hash \"REPLACEME04C6F26CC32D73431CED24FF114B2A216671C60117AF5012B40\" -Alert \"Alert If No Change\"\r\n\r\n    C:\\TestFile.txt exists!\r\n    Hash Given: REPLACEME04C6F26CC32D73431CED24FF114B2A216671C60117AF5012B40\r\n    Current Hash: 35BAFB1CE99AEF3AB068AFBAABAE8F21FD9B9F02D3A9442E364FA92C0B3EEEF0\r\n    Hash mismatch!\r\n\r\n.EXAMPLE\r\n    -Path \"C:\\TestFile.txt\" -Hash \"35BAFB1CE99AEF3AB068AFBAABAE8F21FD9B9F02D3A9442E364FA92C0B3BEEF0\" -Alert \"Alert If No Change\"\r\n\r\n    C:\\TestFile.txt exists!\r\n    Hash Given: 35BAFB1CE99AEF3AB068AFBAABAE8F21FD9B9F02D3A9442E364FA92C0B3BEEF0\r\n    Current Hash: 35BAFB1CE99AEF3AB068AFBAABAE8F21FD9B9F02D3A9442E364FA92C0B3BEEF0\r\n    Hash matches!\r\n    [Alert] File has not been modified!\r\n\r\nPARAMETER: -Days \"REPLACEMEWITHANUMBER\"\r\n    Raise an alert if the file hasn't been modified within the specified number of days. \r\n    Minutes and Hours are added to this time.\r\n\r\nPARAMETER: -Hours \"REPLACEMEWITHANUMBER\"\r\n    Raise an alert if the file hasn't been modified within the specified number of hours. \r\n    Days and Minutes are added to this time.\r\n\r\nPARAMETER: -Minutes \"REPLACEMEWITHANUMBER\"\r\n    Raise an alert if the file hasn't been modified within the specified number of minutes. \r\n    Days and Hours are added to this time.\r\n.EXAMPLE\r\n    -Path \"C:\\TestFile.txt\" -Days 365 -Alert \"Alert If Change\"\r\n\r\n    C:\\TestFile.txt exists!\r\n    Checking if the file was modified in the last 365 day(s) 00 hour(s) 00 minute(s)\r\n    File was last modified on 02\/07\/2024 14:59:56.\r\n    File has been updated within the time period.\r\n    [Alert] File has been modified!\r\n.EXAMPLE\r\n    -Path \"C:\\TestFile.txt\" -Days 30 -Alert \"Alert If Change\"\r\n\r\n    C:\\TestFile.txt exists!\r\n    Checking if the file was modified in the last 30 day(s) 00 hour(s) 00 minute(s)\r\n    File was last modified on 05\/15\/2023 15:13:55.\r\n    File has not been modified within the time period.\r\n\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 8+, Server 2012+\r\n    Release Notes:\r\n    Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [String]$Alert,\r\n    [Parameter()]\r\n    [String]$Path,\r\n    [Parameter()]\r\n    [String]$Hash,\r\n    [Parameter()]\r\n    [String]$Algorithm = \"SHA256\",\r\n    [Parameter()]\r\n    [int]$Days,\r\n    [Parameter()]\r\n    [int]$Hours,\r\n    [Parameter()]\r\n    [int]$Minutes\r\n)\r\n\r\nbegin {\r\n    # Replace parameters with dynamic script variables\r\n    if ($env:alert -and $env:alert -notlike \"null\") { $Alert = $env:alert }\r\n    if ($env:targetFilePath -and $env:targetFilePath -notlike \"null\") { $Path = $env:targetFilePath }\r\n    if ($env:hash -and $env:hash -notlike \"null\") { $Hash = $env:hash }\r\n    if ($env:algorithm -and $env:algorithm -notlike \"null\") { $Algorithm = $env:algorithm }\r\n    if ($env:daysSinceLastModification -and $env:daysSinceLastModification -notlike \"null\") { $Days = $env:daysSinceLastModification }\r\n    if ($env:hoursSinceLastModification -and $env:hoursSinceLastModification -notlike \"null\") { $Hours = $env:hoursSinceLastModification }\r\n    if ($env:minutesSinceLastModification -and $env:minutesSinceLastModification -notlike \"null\") { $Minutes = $env:minutesSinceLastModification }\r\n\r\n    # Test for local administrator permissions\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Warning -Message \"Some files or folders may require local Administrator permissions to view.\"\r\n    }\r\n\r\n    # Verify the given algorithm is supported by PowerShell\r\n    $AllowedAlgorithms = \"SHA1\", \"SHA256\", \"SHA384\", \"SHA512\", \"MD5\"\r\n    if ($AllowedAlgorithms -notcontains $Algorithm) {\r\n        Write-Host \"[Error] Invalid Algorithm selected ($Algorithm)! Allowed selections are 'SHA1','SHA256','SHA384','SHA512' and 'MD5'.\"\r\n        exit 1\r\n    }\r\n\r\n    # Check for required parameter\r\n    if (-Not ($Path)) {\r\n        Write-Host \"[Error] A filepath is required!\"\r\n        Exit 1\r\n    }\r\n\r\n    switch ($Alert) {\r\n        \"Alert If Change\" { Write-Verbose \"Alerting if file $Path has been modified.\" }\r\n        \"Alert If No Change\" { Write-Verbose \"Alerting if file $Path has not been modified.\" }\r\n        default { Write-Verbose \"No alert was selected.\" }\r\n    }\r\n\r\n    $ExitCode = 0\r\n}\r\nprocess {\r\n\r\n    # File existence check\r\n    if ($Path -and -Not (Test-Path $Path -ErrorAction SilentlyContinue)) {\r\n        Write-Host \"[Alert] $Path does not exist!\"\r\n        Exit 1\r\n    }\r\n    else {\r\n        Write-Host \"$Path exists!\"\r\n    }\r\n\r\n    # Confirm we were given a filepath and not a directory\r\n    $File = Get-Item -Path $Path -ErrorAction SilentlyContinue\r\n    if ($File.PSIsContainer) {\r\n        Write-Host \"[Error] Please provide a file path, not a directory.\"\r\n        Exit 1\r\n    }\r\n\r\n    # If given the files hash verify it matches\r\n    if ($Hash) {\r\n        $CurrentHash = Get-FileHash -Path $File.FullName -Algorithm $Algorithm | Select-Object -ExpandProperty Hash\r\n        Write-Host \"Hash Given: $Hash\"\r\n        Write-Host \"Current Hash: $CurrentHash\"\r\n\r\n        if ($Hash -notlike $CurrentHash) {\r\n            Write-Host \"Hash mismatch!\"\r\n\r\n            if($Alert -eq \"Alert If Change\"){\r\n                Write-Host \"[Alert] File has been modified!\"\r\n                $ExitCode = 1\r\n            }\r\n        }\r\n        else {\r\n            Write-Host \"Hash matches!\"\r\n\r\n            if($Alert -eq \"Alert If No Change\"){\r\n                Write-Host \"[Alert] File has not been modified!\"\r\n                $ExitCode = 1\r\n            }\r\n        }\r\n    }\r\n\r\n    # Get the current date and subtract the days, hours and minutes to compare with the file \r\n    $Cutoff = Get-Date\r\n    $CurrentDate = $Cutoff\r\n\r\n    if ($Days) { $Cutoff = $Cutoff.AddDays(-$Days) }\r\n    if ($Hours) { $Cutoff = $Cutoff.AddHours(-$Hours) }\r\n    if ($Minutes) { $Cutoff = $Cutoff.AddMinutes(-$Minutes) }\r\n\r\n    $TimeSpan = New-TimeSpan $Cutoff $CurrentDate\r\n\r\n    if (($Days -or $Hours -or $Minutes) -and ($Cutoff -ne $CurrentDate)) {\r\n        Write-Host \"Checking if the file was modified in the last $($TimeSpan.ToString(\"dd' day(s) 'hh' hour(s) 'mm' minute(s)'\"))\"\r\n        Write-Host \"File was last modified on $($File.LastWriteTime).\"\r\n\r\n        if ($File.LastWriteTime -ge $Cutoff) {\r\n            Write-Host \"File has been updated within the time period.\"\r\n\r\n            if($Alert -eq \"Alert If Change\"){\r\n                Write-Host \"[Alert] File has been modified!\"\r\n                $ExitCode = 1\r\n            }\r\n        }\r\n        else {\r\n            Write-Host \"File has not been updated within the time period.\"\r\n\r\n            if($Alert -eq \"Alert If No Change\"){\r\n                Write-Host \"[Alert] File has not been modified!\"\r\n                $ExitCode = 1\r\n            }\r\n        }\r\n    }\r\n\r\n    Exit $ExitCode\r\n}\r\nend {<\/pre>\n
 <\/p>\n\n
<\/h2>
<\/p><\/div>
<\/a><\/div><\/div>\n
Description d\u00e9taill\u00e9e<\/h2>\n
Ce script PowerShell est con\u00e7u pour v\u00e9rifier l’existence d’un fichier, v\u00e9rifier s’il a \u00e9t\u00e9 modifi\u00e9 dans un d\u00e9lai donn\u00e9 et effectuer une v\u00e9rification du hachage pour assurer l’int\u00e9grit\u00e9 du fichier. D\u00e9cortiquons le script \u00e9tape par \u00e9tape :<\/p>\n
    \n
  1. D\u00e9finition de param\u00e8tres<\/strong>: Le script commence par d\u00e9finir des param\u00e8tres, notamment Alert, Path, Hash, Algorithm, Days, Hours et Minutes. Ces param\u00e8tres permettent aux utilisateurs de sp\u00e9cifier le fichier \u00e0 surveiller, le hachage attendu, l’algorithme de hachage et le d\u00e9lai de v\u00e9rification des modifications.<\/li>\n
  2. Remplacement de la variable d’environnement<\/strong>: Le script remplace dynamiquement les param\u00e8tres par des variables d’environnement si elles sont d\u00e9finies. Cette flexibilit\u00e9 permet une int\u00e9gration ais\u00e9e dans les syst\u00e8mes automatis\u00e9s et les scripts.<\/li>\n
  3. V\u00e9rification des autorisations de l’administrateur<\/strong>: Une fonction Test-IsElevated est utilis\u00e9e pour v\u00e9rifier si le script s’ex\u00e9cute avec des privil\u00e8ges d’administrateur, afin de s’assurer qu’il dispose des autorisations n\u00e9cessaires pour acc\u00e9der aux fichiers sp\u00e9cifi\u00e9s et les contr\u00f4ler.<\/li>\n
  4. Validation de l’algorithme<\/strong>: Le script v\u00e9rifie si l’algorithme de hachage fourni est pris en charge. Les algorithmes autoris\u00e9s sont SHA1, SHA256, SHA384, SHA512 et MD5.<\/li>\n
  5. V\u00e9rification de l’existence et du type de fichier<\/strong>: Le script v\u00e9rifie si le chemin sp\u00e9cifi\u00e9 existe et confirme qu’il s’agit d’un fichier et non d’un r\u00e9pertoire.<\/li>\n
  6. V\u00e9rification du hachage<\/strong>: Si un hachage est fourni, le script calcule le hachage actuel du fichier \u00e0 l’aide de l’algorithme sp\u00e9cifi\u00e9 et le compare au hachage donn\u00e9. Il \u00e9met ensuite une alerte en cas de non-concordance ou si le fichier n’a pas \u00e9t\u00e9 modifi\u00e9 en fonction du param\u00e8tre Alert.<\/li>\n
  7. Contr\u00f4le de l’heure de modification<\/strong>: Le script calcule l’heure limite en fonction des param\u00e8tres jours, heures et minutes fournis. Il compare ensuite l’heure de la derni\u00e8re modification du fichier \u00e0 l’heure limite et \u00e9met une alerte si le fichier a \u00e9t\u00e9 modifi\u00e9 ou non dans le d\u00e9lai sp\u00e9cifi\u00e9.<\/li>\n<\/ol>\n
    Cas d’utilisation potentiels<\/h2>\n
    Imaginez un professionnel de l’informatique charg\u00e9 de maintenir la s\u00e9curit\u00e9<\/a> et l’int\u00e9grit\u00e9 des fichiers de configuration sensibles sur un serveur. \u00c0 l’aide de ce script, ils peuvent mettre en place un contr\u00f4le quotidien pour v\u00e9rifier si des fichiers critiques ont \u00e9t\u00e9 modifi\u00e9s. Par exemple, ils peuvent utiliser le script pour surveiller un fichier de configuration et s’assurer qu’il n’a pas \u00e9t\u00e9 modifi\u00e9 de mani\u00e8re inattendue. Si le script d\u00e9tecte un changement, il \u00e9met une alerte, ce qui permet \u00e0 l’informaticien d’enqu\u00eater et de prendre les mesures qui s’imposent.<\/p>\n
    Comparaisons<\/h2>\n
    Ce script PowerShell pr\u00e9sente plusieurs avantages par rapport \u00e0 d’autres m\u00e9thodes de surveillance des modifications de fichiers, telles que l’utilisation de logiciels tiers ou les v\u00e9rifications manuelles :<\/p>\n