#Requires -Version 5.1
<#
    JbTecWiz Support Centre -- generated fix script

    Fault : Group Policy events 1058 and 1030 -- cannot read gpt.ini
    Fix   : Fix authentication and SMB hardening on the SYSVOL path
    Source: https://jbtecwiz.com/support/srv-gpo-1058

    Run as     : Elevated PowerShell
    Expect     : 40 minutes
    Risk       : medium
    Reversible : yes

    WHEN THIS IS THE RIGHT FIX
    SYSVOL opens interactively but policy still fails -- the machine
    account, not your account, is what has to read it.

    HOW TO UNDO IT
    Remove any permission you added with Set-GPPermission -PermissionLevel
    None.

    This script walks the fix one step at a time and asks before each
    one. Steps with no command are things you do yourself -- it prints
    those and waits. Run with -DryRun to print without executing.

    --------------------------------------------------------------------
    NO WARRANTY - USE AT YOUR OWN RISK

    This script is provided by JbTecWiz as-is and with no warranty of any
    kind, express or implied. You run it entirely at your own risk.

    JbTecWiz accepts no liability for any loss or damage arising from its
    use, including but not limited to data loss, downtime, or configuration
    changes that turn out to be wrong for your system.

    You are responsible for reading this script before running it, for
    satisfying yourself that it suits the machine in front of you, and for
    having a working backup first. Some steps cannot be undone.
    --------------------------------------------------------------------
#>

[CmdletBinding()]
param(
    # Print every step and command without running anything.
    [switch]$DryRun,
    # Do not ask before each step. Read the script first if you use this.
    [switch]$Unattended
)

$ErrorActionPreference = 'Stop'
$script:Failed = 0

function Write-Rule { param([string]$Text)
    Write-Host ''
    Write-Host ('-' * 70) -ForegroundColor DarkGray
    if ($Text) { Write-Host $Text -ForegroundColor Cyan }
}

function Show-Prose { param([string]$Text, [string]$Colour = "Gray")
    if (-not $Text) { return }
    $words = $Text -split "\s+"; $line = "  "
    foreach ($w in $words) {
        if (($line.Length + $w.Length) -gt 74) { Write-Host $line -ForegroundColor $Colour; $line = "  " }
        $line += "$w "
    }
    if ($line.Trim()) { Write-Host $line -ForegroundColor $Colour }
}

function Invoke-Step {
    param(
        [int]$Number, [string]$Do, [string]$Why,
        [scriptblock]$Command, [switch]$Manual, [string]$Shell = "powershell"
    )
    Write-Rule "  Step $Number of 6"
    Show-Prose $Do "White"
    if ($Why) { Write-Host ""; Show-Prose $Why "DarkGray" }

    if ($Manual) {
        Write-Host ''
        Write-Host '  -> Do this yourself, then press Enter to carry on.' -ForegroundColor Yellow
        if (-not $Unattended -and -not $DryRun) { [void](Read-Host) }
        return
    }

    Write-Host ''
    foreach ($l in ($Command.ToString().Trim() -split "`n")) {
        Write-Host ("    " + $l.Trim()) -ForegroundColor Green
    }
    Write-Host ''

    if ($DryRun) { Write-Host "  (dry run -- not executed)" -ForegroundColor DarkGray; return }
    if (-not $Unattended) {
        $a = Read-Host "  Run this step? [Y]es / [S]kip / [Q]uit"
        if ($a -match "^[Qq]") { Write-Host "  Stopped at your request."; exit 0 }
        if ($a -match "^[Ss]") { Write-Host "  Skipped." -ForegroundColor DarkGray; return }
    }
    try { & $Command }
    catch {
        $script:Failed++
        Write-Host ("  Step $Number failed: " + $_.Exception.Message) -ForegroundColor Red
        Show-Prose "The rest of the fix may depend on this. Read the write-up before carrying on." "Red"
        if (-not $Unattended) {
            $c = Read-Host "  Carry on anyway? [y/N]"
            if ($c -notmatch "^[Yy]") { exit 1 }
        }
    }
}

Write-Rule
Write-Host '  Group Policy events 1058 and 1030 -- cannot read gpt.ini' -ForegroundColor White
Write-Host '  Fix authentication and SMB hardening on the SYSVOL path' -ForegroundColor Cyan
Write-Host ''
Write-Host '  Risk: medium   Reversible   40 minutes'
Write-Host ''
Show-Prose 'No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.' 'DarkYellow'
Write-Rule

if (-not $Unattended -and -not $DryRun) {
    $go = Read-Host '  Ready? [y/N]'
    if ($go -notmatch "^[Yy]") { Write-Host "  Nothing was changed."; exit 0 }
}

Invoke-Step -Number 1 -Do 'Remember that policy is read by the COMPUTER account for computer policy. Your ability to browse the share proves nothing about it.' -Why 'This is the single most common misdiagnosis of 1058 -- the admin opens SYSVOL successfully and concludes the path is fine.' -Manual

Invoke-Step -Number 2 -Do 'Confirm the machine''s secure channel to the domain is intact.' -Command {
    Test-ComputerSecureChannel -Verbose
}

Invoke-Step -Number 3 -Do 'Repair it if broken.' -Command {
    Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
}

Invoke-Step -Number 4 -Do 'Check the SMB client and server signing settings on both ends -- a mismatch after a hardening baseline blocks exactly this.' -Command {
    Get-SmbClientConfiguration | Format-List RequireSecuritySignature, EnableSecuritySignature
    Get-SmbServerConfiguration | Format-List RequireSecuritySignature, EnableSecuritySignature, EnableSMB1Protocol
}

Invoke-Step -Number 5 -Do 'Confirm Authenticated Users still has Read on the policy objects -- a delegation change that removes it breaks every client at once.' -Command {
    Get-GPO -All | ForEach-Object { $g=$_; Get-GPPermission -Guid $g.Id -All | Where-Object { $_.Trustee.Name -eq 'Authenticated Users' } | Select-Object @{n='GPO';e={$g.DisplayName}}, Permission }
}

Invoke-Step -Number 6 -Do 'Restore it where missing.' -Command {
    Set-GPPermission -Name 'Default Domain Policy' -TargetName 'Authenticated Users' -TargetType Group -PermissionLevel GpoRead
}

Write-Rule "  Confirm it worked"
Show-Prose 'gpupdate /force completes with no errors on an affected client.' 'White'

Write-Rule
if ($script:Failed -gt 0) {
    Write-Host ("  Finished with " + $script:Failed + " failed step(s).") -ForegroundColor Yellow
    Show-Prose 'Read the full write-up at https://jbtecwiz.com/support/srv-gpo-1058' 'Yellow'
} else {
    Write-Host '  Finished.' -ForegroundColor Green
}
Write-Host ''
Show-Prose 'To undo: Remove any permission you added with Set-GPPermission -PermissionLevel None.' 'DarkGray'
Write-Rule