U

# peda_lock_SRP.ps1
# A lancer en administrateur

Write-Host "Création des groupes Eleves, Profs, AdminPedago..." -ForegroundColor Cyan

# Groupes
foreach ($g in @("Eleves","Profs","AdminPedago")) {
    if (-not (Get-LocalGroup -Name $g -ErrorAction SilentlyContinue)) {
        net localgroup $g /add | Out-Null
        Write-Host "Groupe créé : $g"
    } else {
        Write-Host "Groupe déjà présent : $g"
    }
}

# Comptes
function EnsureUser($user,$pass,$group) {
    if (-not (Get-LocalUser -Name $user -ErrorAction SilentlyContinue)) {
        net user $user $pass /add /y /passwordchg:no /passwordreq:yes | Out-Null
        Write-Host "Compte créé : $user"
    }
    net localgroup $group $user /add | Out-Null
    net localgroup Users $user /add | Out-Null
}

EnsureUser "eleve" "eleve" "Eleves"
EnsureUser "prof"  "prof"  "Profs"

Write-Host "`nCréation des Software Restriction Policies..." -ForegroundColor Cyan

# Base SRP
$base = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers"
New-Item -Path $base -Force | Out-Null
Set-ItemProperty -Path $base -Name "DefaultLevel" -Value 0x40000  # Unrestricted
Set-ItemProperty -Path $base -Name "PolicyScope" -Value 0          # Machine-wide
Set-ItemProperty -Path $base -Name "TransparentEnabled" -Value 1
Set-ItemProperty -Path $base -Name "AuthenticodeEnabled" -Value 0

# Créer Rules
$rules = @{
    "cmd"     = "C:\Windows\System32\cmd.exe"
    "ps"      = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    "psise"   = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe"
    "control" = "C:\Windows\System32\control.exe"
    "regedit" = "C:\Windows\regedit.exe"
    "mmc"     = "C:\Windows\System32\mmc.exe"
    "taskmgr" = "C:\Windows\System32\taskmgr.exe"
    "settings"= "C:\Windows\ImmersiveControlPanel\SystemSettings.exe"
}

$i=0
foreach ($r in $rules.GetEnumerator()) {
    $rulePath = "$base\0\Paths\$i"
    New-Item -Path $rulePath -Force | Out-Null
    Set-ItemProperty -Path $rulePath -Name "ItemData" -Value $r.Value
    Set-ItemProperty -Path $rulePath -Name "SaferFlags" -Value 0
    Set-ItemProperty -Path $rulePath -Name "Description" -Value "Block $($r.Name)"
    Set-ItemProperty -Path $rulePath -Name "LastModified" -Value (Get-Date).ToString()
    Set-ItemProperty -Path $rulePath -Name "Level" -Value 0x00000     # Disallowed
    $i++
}

Write-Host "`nLiaison SRP avec groupes Eleves et Profs..." -ForegroundColor Cyan

# Appliquer SRP aux groupes Eleves et Profs
$dlb = "$base\DefaultLevelByUser"
New-Item -Path $dlb -Force | Out-Null

foreach ($grp in @("Eleves","Profs")) {
    # Récupère le SID du groupe
    $sid = (New-Object System.Security.Principal.NTAccount($grp)).Translate([System.Security.Principal.SecurityIdentifier]).Value
    New-Item -Path "$dlb\$sid" -Force | Out-Null
    Set-ItemProperty -Path "$dlb\$sid" -Name "Level" -Value 0x00000  # Disallowed
    Write-Host "SRP appliqué au groupe : $grp (SID $sid)"
}

Write-Host "`n*** FINI ***"
Write-Host "Les membres de Eleves et Profs NE PEUVENT PLUS lancer : CMD / PS / MMC / REGEDIT / Paramètres / Control Panel / Taskmgr"
Write-Host "Les ADMIN peuvent tout faire."