mirror of
https://github.com/Yamato-Security/WELA.git
synced 2026-10-03 21:14:42 +02:00
15 lines
1.2 KiB
PowerShell
15 lines
1.2 KiB
PowerShell
# Real Windows reader smoke only. No native setter, SaveChanges or policy mutation.
|
|
$ErrorActionPreference = 'Stop'
|
|
Import-Module (Join-Path $PSScriptRoot '../modules/EventLogSettings.psm1') -Force
|
|
foreach ($log in @('Application', 'System', 'Setup', 'Security')) {
|
|
$before = Get-WelaEventLogState -Log $log
|
|
if ($before.ReadStatus -ne 'Available') { throw "Cannot inspect $log : $($before.Diagnostic)" }
|
|
$row = @(Get-WelaEventLogAudit -Profile 'cis-v4-source' | Where-Object Log -eq $log)
|
|
$after = Get-WelaEventLogState -Log $log
|
|
if ($row.Count -ne 1 -or $row[0].CurrentMaximumBytes -ne $before.MaximumSizeInBytes -or $row[0].RetentionDays -ne 'Unknown') { throw "Audit did not represent the live $log configuration." }
|
|
if ($before.MaximumSizeInBytes -ne $after.MaximumSizeInBytes -or $before.LogMode -ne $after.LogMode) { throw "Observed concurrent change to $log during read-only smoke." }
|
|
}
|
|
$missing = Get-WelaEventLogState -Log ('WELA-Unregistered-' + [guid]::NewGuid().ToString('N'))
|
|
if ($missing.ReadStatus -ne 'Missing') { throw "Missing Windows channel was misclassified: $($missing.ReadStatus) $($missing.Diagnostic)" }
|
|
Write-Host 'PASS: live read-only event-log audit; exact bytes, modes and missing-channel reporting verified.'
|