mirror of
https://github.com/Yamato-Security/WELA.git
synced 2026-10-02 12:34:42 +02:00
11 lines
760 B
PowerShell
11 lines
760 B
PowerShell
# Read-only host observations; never change precedence, GPO or audit masks.
|
|
$ErrorActionPreference = 'Stop'
|
|
. (Join-Path $PSScriptRoot '../scripts/Configuration.ps1')
|
|
Import-Module (Join-Path $PSScriptRoot '../modules/AuditProfiles.psm1') -Force
|
|
$state = Get-WelaAuditPrecedenceState
|
|
if ($state.State -notin @('Enabled', 'Disabled', 'Not configured', 'Unknown')) { throw 'Invalid precedence observation' }
|
|
$current = Get-WelaEffectiveAuditPolicy
|
|
if ($current.Count -ne 59) { throw 'Audit policy API omitted catalog entries' }
|
|
if ($state.State -eq 'Unknown' -and -not $state.Diagnostic) { throw 'Unknown state must preserve diagnostics' }
|
|
Write-Host "Read-only precedence state: $($state.State); 59 effective masks read. No policy refresh or writes performed."
|