Install-ExploitProtectionPolicy.ps1

<#
.SYNOPSIS
    Installs and enforces Exploit Protection policy profiles.

.DESCRIPTION
    Applies an Exploit Protection policy to the local system and configures the
    Group Policy registry key for persistence. Automatically detects Windows 10
    vs Windows 11 and supports Enforce and Audit modes.

    Optionally merges the Hardened Services profile (EP-HardenedServices.xml) on
    top of the baseline policy into a unified policy file before application.

.PARAMETER Mode
    Deployment mode:
    - 'Enforce' (Default): Active mitigation enforcement (blocks violations).
    - 'Audit': Telemetry-only mode (logs violations to Event Log without blocking).

.PARAMETER IncludeHardenedServices
    Optional switch to merge the Hardened Services profile (EP-HardenedServices.xml)
    on top of the baseline policy. Defaults to false unless explicitly specified.

.PARAMETER CustomPolicyFilePath
    Explicit path to a custom Exploit Protection XML file, overriding auto-detection.

.EXAMPLE
    .\Install-ExploitProtectionPolicy.ps1
    Auto-detects OS and installs baseline in Enforce mode (Hardened Services omitted by default).

.EXAMPLE
    .\Install-ExploitProtectionPolicy.ps1 -IncludeHardenedServices
    Installs the baseline policy merged with the Hardened Services profile in Enforce mode.

.EXAMPLE
    .\Install-ExploitProtectionPolicy.ps1 -Mode Audit
    Installs only the baseline profile in Audit mode.

.EXAMPLE
    .\Install-ExploitProtectionPolicy.ps1 -Mode Audit -IncludeHardenedServices
    Installs baseline merged with Hardened Services in Audit mode.

.EXAMPLE
    .\Install-ExploitProtectionPolicy.ps1 -WhatIf
    Simulates the installation and merging without altering system state.
#>

[CmdletBinding(SupportsShouldProcess = $true)]
param (
    [Parameter()]
    [ValidateSet('Enforce', 'Audit')]
    [string]$Mode = 'Enforce',

    [Parameter()]
    [switch]$IncludeHardenedServices = $false,

    [Parameter()]
    [string]$CustomPolicyFilePath
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

# Verify Administrative Privileges
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin -and -not $WhatIfPreference) {
    throw "This script requires Administrator privileges. Please re-run from an elevated PowerShell console."
}

$scriptDirectory = Split-Path -Parent $MyInvocation.MyCommand.Path
$shouldIncludeHardened = [bool]$IncludeHardenedServices

# Determine source baseline XML policy file
if ($CustomPolicyFilePath) {
    $sourcePolicyFilePath = if ([System.IO.Path]::IsPathRooted($CustomPolicyFilePath)) {
        $CustomPolicyFilePath
    } else {
        Join-Path $scriptDirectory -ChildPath $CustomPolicyFilePath
    }
}
else {
    $isWin11 = [System.Environment]::OSVersion.Version.Build -ge 22000
    $osLabel = if ($isWin11) { 'W11' } else { 'W10' }

    $sourceFileName = if ($Mode -eq 'Audit') {
        "EP-$osLabel-Audit.xml"
    } else {
        "EP-$osLabel.xml"
    }

    $sourcePolicyFilePath = Join-Path $scriptDirectory -ChildPath $sourceFileName
}

# Validate source baseline file exists
if (-not (Test-Path $sourcePolicyFilePath)) {
    throw "Source policy file '$sourcePolicyFilePath' not found. Aborting..."
}

# Validate baseline XML syntax
Write-Verbose "Validating XML syntax of '$sourcePolicyFilePath'..."
try {
    [xml]$baselineXml = Get-Content -Path $sourcePolicyFilePath -Raw
    $baseAppCount = if ($baselineXml.MitigationPolicy.AppConfig) { $baselineXml.MitigationPolicy.AppConfig.Count } else { 0 }
    Write-Verbose "Baseline XML is well-formed with $baseAppCount AppConfig definitions."
}
catch {
    throw "Source file '$sourcePolicyFilePath' is not valid XML: $($_.Exception.Message)"
}

# Helper to auditify AppConfig nodes if deploying in Audit mode
function ConvertTo-AuditAppNode([System.Xml.XmlElement]$appNode) {
    $dc = $appNode.SelectSingleNode("DynamicCode")
    if ($dc) {
        $dc.SetAttribute("BlockDynamicCode", "false")
        $dc.SetAttribute("Audit", "true")
    }
    $cp = $appNode.SelectSingleNode("ChildProcess")
    if ($cp) {
        $cp.SetAttribute("DisallowChildProcessCreation", "false")
        $cp.SetAttribute("Audit", "true")
    }
    $il = $appNode.SelectSingleNode("ImageLoad")
    if ($il) {
        if ($il.HasAttribute("BlockRemoteImageLoads")) {
            $il.SetAttribute("BlockRemoteImageLoads", "false")
            $il.SetAttribute("AuditRemoteImageLoads", "true")
        }
        if ($il.HasAttribute("BlockLowLabelImageLoads")) {
            $il.SetAttribute("BlockLowLabelImageLoads", "false")
            $il.SetAttribute("AuditLowLabelImageLoads", "true")
        }
    }
    $sb = $appNode.SelectSingleNode("SignedBinaries")
    if ($sb) {
        if ($sb.GetAttribute("EnforceModuleDependencySigning") -eq "true") {
            $sb.SetAttribute("EnforceModuleDependencySigning", "false")
            $sb.SetAttribute("AuditEnforceModuleDependencySigning", "true")
        }
        if ($sb.GetAttribute("MicrosoftSignedOnly") -eq "true") {
            $sb.SetAttribute("MicrosoftSignedOnly", "false")
            $sb.SetAttribute("AuditMicrosoftSignedOnly", "true")
        }
    }
    $f = $appNode.SelectSingleNode("Fonts")
    if ($f) {
        if ($f.GetAttribute("DisableNonSystemFonts") -eq "true") {
            $f.SetAttribute("DisableNonSystemFonts", "false")
            $f.SetAttribute("AuditOnly", "true")
            $f.SetAttribute("Audit", "true")
        }
    }
    $sc = $appNode.SelectSingleNode("SystemCalls")
    if ($sc) {
        if ($sc.GetAttribute("DisableWin32kSystemCalls") -eq "true") {
            $sc.SetAttribute("DisableWin32kSystemCalls", "false")
            $sc.SetAttribute("Audit", "true")
        }
    }
}

$tempMergedPath = $null
$policyToDeploy = $sourcePolicyFilePath

if ($shouldIncludeHardened) {
    $hardenedFilePath = Join-Path $scriptDirectory -ChildPath 'EP-HardenedServices.xml'
    if (-not (Test-Path $hardenedFilePath)) {
        throw "Hardened Services policy file '$hardenedFilePath' not found. Aborting..."
    }

    Write-Verbose "Merging Hardened Services profile from '$hardenedFilePath' on top of baseline..."
    try {
        [xml]$hardenedXml = Get-Content -Path $hardenedFilePath -Raw
        $mergedDoc = $baselineXml.Clone()

        $hardenedCount = 0
        if ($hardenedXml.MitigationPolicy.AppConfig) {
            foreach ($serviceNode in $hardenedXml.MitigationPolicy.AppConfig) {
                $serviceClone = $serviceNode.Clone()
                if ($Mode -eq 'Audit') {
                    ConvertTo-AuditAppNode $serviceClone
                }
                $imported = $mergedDoc.ImportNode($serviceClone, $true)
                $mergedDoc.MitigationPolicy.AppendChild($imported) | Out-Null
                $hardenedCount++
            }
        }

        # Create temporary merged file
        $tempMergedPath = Join-Path ([System.IO.Path]::GetTempPath()) "EP-Merged-$([Guid]::NewGuid().ToString('N')).xml"
        $mergedDoc.Save($tempMergedPath)
        $policyToDeploy = $tempMergedPath

        Write-Host "Merged $hardenedCount hardened services into baseline policy (Total: $($baseAppCount + $hardenedCount) apps)." -ForegroundColor Cyan
    }
    catch {
        throw "Failed to merge Hardened Services profile: $($_.Exception.Message)"
    }
}

Write-Host "Target Baseline File : $sourcePolicyFilePath" -ForegroundColor Cyan
Write-Host "Include Hardened Svc : $shouldIncludeHardened" -ForegroundColor Cyan
Write-Host "Deployment Mode      : $Mode" -ForegroundColor Cyan

# Destination paths
$destinationFolder = Join-Path $Env:windir -ChildPath 'EP'
$destinationPolicyFilePath = Join-Path $destinationFolder -ChildPath 'EP.xml'
$exploitProtectionRegPath = 'HKLM:\Software\Policies\Microsoft\Windows Defender ExploitGuard\Exploit Protection'

$actionDescription = if ($shouldIncludeHardened) {
    "Apply Exploit Protection policy (Baseline + Hardened Services, Mode: $Mode) to '$destinationPolicyFilePath'"
} else {
    "Apply Exploit Protection baseline policy (Mode: $Mode) from '$sourcePolicyFilePath' to '$destinationPolicyFilePath'"
}

try {
    if ($PSCmdlet.ShouldProcess("Local System", $actionDescription)) {
        # Ensure destination folder exists
        if (-not (Test-Path $destinationFolder)) {
            Write-Verbose "Creating destination folder '$destinationFolder'..."
            New-Item -Path $destinationFolder -ItemType Directory -Force | Out-Null
        }

        # Copy policy to standard destination
        Write-Verbose "Writing policy to '$destinationPolicyFilePath'..."
        Copy-Item -Path $policyToDeploy -Destination $destinationPolicyFilePath -Force

        # Ensure registry key exists
        if (-not (Test-Path $exploitProtectionRegPath)) {
            Write-Verbose "Creating registry key '$exploitProtectionRegPath'..."
            New-Item -Path $exploitProtectionRegPath -Force | Out-Null
        }

        # Apply policy via Set-ProcessMitigation
        Write-Host "Applying process mitigations from '$destinationPolicyFilePath'..." -ForegroundColor Yellow
        Set-ProcessMitigation -PolicyFilePath $destinationPolicyFilePath

        # Configure GPO persistence registry value
        Write-Verbose "Configuring GPO registry value 'ExploitProtectionSettings'..."
        Set-ItemProperty -Path $exploitProtectionRegPath -Name 'ExploitProtectionSettings' -Value $destinationPolicyFilePath -Force | Out-Null

        Write-Host "Policy deployment successful ($Mode mode)!" -ForegroundColor Green
        if ($shouldIncludeHardened) {
            Write-Host "Hardened Services profile successfully merged and enforced." -ForegroundColor Green
        }
        Write-Host "Please restart your computer for all system-level mitigations to take effect." -ForegroundColor Green
    }
}
finally {
    if ($tempMergedPath -and (Test-Path $tempMergedPath)) {
        Remove-Item -Path $tempMergedPath -Force -ErrorAction SilentlyContinue
    }
}