基于powershell的windows基线核查脚本，需要检查的项目有：1、组策略中是否禁用来宾账户状态 2、组策略中是否启用密码必须符合复杂性要求

3、防火墙是否启用 4、是否存在默认的管理员账户 5、是否启用UAC（用户账户控制） 6、是否启用BitLocker（数据加密） 7、是否启用Windows更新 8、是否启用远程桌面连接 9、是否启用自动登录功能 10、是否启用自动运行功能。

以下是基于powershell的Windows基线核查脚本：

#检查组策略中是否禁用来宾账户状态

$GuestAccount = Get-WmiObject -Class Win32_UserAccount -Filter "Name='Guest'"
if ($GuestAccount.Disabled) {
Write-Host "Guest account is disabled." -ForegroundColor Green
} else {
Write-Host "Guest account is not disabled." -ForegroundColor Red
}

#检查组策略中是否启用密码必须符合复杂性要求

$ComplexityPolicy = Get-WmiObject -Class Win32_PasswordSetting
if ($ComplexityPolicy.PasswordComplexity) {
Write-Host "Password complexity policy is enabled." -ForegroundColor Green
} else {
Write-Host "Password complexity policy is not enabled." -ForegroundColor Red
}

#检查防火墙是否启用

$FirewallStatus = Get-Service -Name MpsSvc
if ($FirewallStatus.Status -eq "Running") {
Write-Host "Firewall is enabled." -ForegroundColor Green
} else {
Write-Host "Firewall is not enabled." -ForegroundColor Red
}

#检查是否存在默认的管理员账户

$AdminAccount = Get-WmiObject -Class Win32_UserAccount -Filter "Name='Administrator'"
if ($AdminAccount.SID -eq "S-1-5-21-958484058-4061377436-1996490449-500") {
Write-Host "Default Administrator account exists." -ForegroundColor Red
} else {
Write-Host "Default Administrator account does not exist." -ForegroundColor Green
}

#检查是否启用UAC（用户账户控制）

$UACStatus = Get-WmiObject -Class Win32_UserAccountControlSetting
if ($UACStatus.EnableLUA) {
Write-Host "UAC is enabled." -ForegroundColor Green
} else {
Write-Host "UAC is not enabled." -ForegroundColor Red
}

#检查是否启用BitLocker（数据加密）

$BitLockerStatus = Get-Service -Name BDESVC
if ($BitLockerStatus.Status -eq "Running") {
Write-Host "BitLocker is enabled." -ForegroundColor Green
} else {
Write-Host "BitLocker is not enabled." -ForegroundColor Red
}

#检查是否启用Windows更新

$WindowsUpdateStatus = Get-Service -Name wuauserv
if ($WindowsUpdateStatus.Status -eq "Running") {
Write-Host "Windows Update is enabled." -ForegroundColor Green
} else {
Write-Host "Windows Update is not enabled." -ForegroundColor Red
}

#检查是否启用远程桌面连接

$RemoteDesktopStatus = Get-WmiObject -Class Win32_TerminalServiceSetting -Namespace root\cimv2\terminalservices
if ($RemoteDesktopStatus.AllowTSConnections) {
Write-Host "Remote Desktop is enabled." -ForegroundColor Green
} else {
Write-Host "Remote Desktop is not enabled." -ForegroundColor Red
}

#检查是否启用自动登录功能

$AutoLogonStatus = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" -Name AutoAdminLogon
if ($AutoLogonStatus.AutoAdminLogon -eq "1") {
Write-Host "Auto Logon is enabled." -ForegroundColor Red
} else {
Write-Host "Auto Logon is not enabled." -ForegroundColor Green
}

#检查是否启用自动运行功能

$AutoRunStatus = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name NoDriveTypeAutoRun
if ($AutoRunStatus.NoDriveTypeAutoRun -eq "0") {
Write-Host "Auto Run is enabled." -ForegroundColor Red
} else {
Write-Host "Auto Run is not enabled." -ForegroundColor Green
}