Triển khai Sysmon built-in cho toàn bộ Windows bằng Intune

IntuneWinAppUtil.exe -c "C:\IntunePkg\Sysmon_BuiltIn" -s "Install_Sysmon_BuiltIn.ps1" -o "C:\IntunePkg\Output"

Get-Service Sysmon
(Get-WindowsOptionalFeature -Online -FeatureName Sysmon).State
sysmon -c
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 5

# ---------- LOG SETUP ----------
$TimeStamp = (Get-Date).ToString("yyyy-MM-dd_HH-mm-ss")
$LogFile = "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\Sysmon_Built_In_Install_$TimeStamp.log"

Start-Transcript -Path $LogFile -Force

# ================================
# Sysmon Migration Script
# Standalone -> Built-in
# ================================

$ErrorActionPreference = "Continue"

Write-Output "====================================="
Write-Output "SYSMON MIGRATION START"
Write-Output "====================================="

# ================================
# 0. Cleanup Hung Uninstall Process
# ================================

Write-Output ""
Write-Output "Checking for hung Sysmon uninstall processes..."

Get-CimInstance Win32_Process -ErrorAction SilentlyContinue |
Where-Object {
    $_.Name -eq "Sysmon64.exe" -and
    $_.CommandLine -match "-u"
} |
ForEach-Object {
    Write-Output "Killing hung process PID $($_.ProcessId)"
    Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue
}

# ================================
# 1. Detect Legacy Sysmon
# ================================

Write-Output ""
Write-Output "Checking for legacy Sysmon installation..."

$LegacyServices = Get-CimInstance Win32_Service -ErrorAction SilentlyContinue |
    Where-Object {
        $_.Name -match "^Sysmon" -and
        $_.PathName -notmatch "\\System32\\sysmon\.exe"
    }

if ($LegacyServices) {
    foreach ($Svc in $LegacyServices) {
        Write-Output ""
        Write-Output "Legacy service detected"
        Write-Output "Service Name : $($Svc.Name)"
        Write-Output "Path Name    : $($Svc.PathName)"

        $ServiceName = $Svc.Name
        $ExePath = ($Svc.PathName -replace '"','').Split(" ")[0]

        Write-Output "Executable   : $ExePath"

        if (Test-Path $ExePath) {
            Write-Output "Running uninstall command..."

            try {
                $Proc = Start-Process `
                    -FilePath $ExePath `
                    -ArgumentList "-u force" `
                    -PassThru `
                    -WindowStyle Hidden

                if (-not $Proc.WaitForExit(60000)) {
                    Write-Output "WARNING: Uninstall timeout after 60 seconds"
                    Stop-Process -Id $Proc.Id -Force -ErrorAction SilentlyContinue
                }
                else {
                    Write-Output "Uninstall ExitCode: $($Proc.ExitCode)"
                }

                Start-Sleep -Seconds 10
            }
            catch {
                Write-Output "Binary uninstall failed."
                Write-Output $_.Exception.Message
            }
        }
        else {
            Write-Output "Legacy binary not found."
        }

        # Delete service if it remains after uninstall.
        if (Get-Service $ServiceName -ErrorAction SilentlyContinue) {
            Write-Output "Deleting leftover service..."
            sc.exe delete $ServiceName | Out-Null
            Start-Sleep 5
        }

        # Wait for service removal.
        $Timeout = 60

        while ($Timeout -gt 0) {
            if (-not (Get-Service $ServiceName -ErrorAction SilentlyContinue)) {
                break
            }

            Write-Output "Waiting for service removal..."
            Start-Sleep 2
            $Timeout -= 2
        }

        if (Get-Service $ServiceName -ErrorAction SilentlyContinue) {
            Write-Output "WARNING: $ServiceName still exists"
        }
        else {
            Write-Output "$ServiceName removed successfully"
        }

        # Remove Sysmon64.exe if it remains.
        if (Test-Path $ExePath) {
            try {
                Write-Output "Removing leftover binary..."
                Remove-Item $ExePath -Force -ErrorAction SilentlyContinue

                if (-not (Test-Path $ExePath)) {
                    Write-Output "Legacy binary removed"
                }
                else {
                    Write-Output "WARNING: Legacy binary still exists"
                }
            }
            catch {
                Write-Output $_.Exception.Message
            }
        }
    }
}
else {
    Write-Output "No legacy Sysmon installation found"
}

# ================================
# 2. Remove Scheduled Task
# ================================

Write-Output ""
Write-Output "Checking scheduled task Install_Sysmon_Update..."

if (Get-ScheduledTask -TaskName "Install_Sysmon_Update" -ErrorAction SilentlyContinue) {
    Write-Output "Scheduled task found, removing..."

    Unregister-ScheduledTask `
        -TaskName "Install_Sysmon_Update" `
        -Confirm:$false
}
else {
    Write-Output "Scheduled task not found"
}

# ================================
# 3. Enable Built-In Sysmon
# ================================

Write-Output ""
Write-Output "Checking Windows Sysmon feature..."

$Feature = Get-WindowsOptionalFeature `
    -Online `
    -FeatureName Sysmon `
    -ErrorAction SilentlyContinue

if (-not $Feature) {
    Write-Output "ERROR: Sysmon feature not available"
    Stop-Transcript
    exit 1
}

Write-Output "Current State: $($Feature.State)"

if ($Feature.State -ne "Enabled") {
    Write-Output "Enabling Sysmon feature..."

    Enable-WindowsOptionalFeature `
        -Online `
        -FeatureName Sysmon `
        -NoRestart `
        -All

    Start-Sleep 20
}

# Verify feature.
$Feature = Get-WindowsOptionalFeature `
    -Online `
    -FeatureName Sysmon

Write-Output "Feature State After Enable: $($Feature.State)"

if ($Feature.State -ne "Enabled") {
    Write-Output "ERROR: Failed to enable Sysmon feature"
    Stop-Transcript
    exit 1
}

# ================================
# 4. Verify Built-In Binary
# ================================

Write-Output ""
Write-Output "Checking Built-In Sysmon binary..."

$BuiltInSysmon = "$env:windir\System32\sysmon.exe"

if (-not (Test-Path $BuiltInSysmon)) {
    Write-Output "ERROR: sysmon.exe not found"
    Stop-Transcript
    exit 1
}

Write-Output "Built-In Sysmon found:"
Write-Output $BuiltInSysmon

# ================================
# 5. Apply Sysmon Config
# ================================

$configPath = Join-Path $PSScriptRoot "Sysmon_Config.xml"

Write-Output ""
Write-Output "Checking config file..."

if (Test-Path $configPath) {
    Write-Output "Applying Sysmon configuration..."
    Write-Output "Config Path: $configPath"

    & $BuiltInSysmon `
        -accepteula `
        -i $configPath

    Write-Output "Sysmon configuration applied"
}
else {
    Write-Output "WARNING: Sysmon_Config.xml not found"
}

# ================================
# 6. Start Sysmon Service
# ================================

Write-Output ""
Write-Output "Starting Sysmon service..."

try {
    Start-Service Sysmon -ErrorAction SilentlyContinue
    Start-Sleep 5
}
catch {
    Write-Output $_.Exception.Message
}

# ================================
# 7. Final Validation
# ================================

Write-Output ""
Write-Output "====================================="
Write-Output "FINAL VALIDATION"
Write-Output "====================================="

Write-Output ""
Write-Output "Built-In Sysmon Service:"

Get-Service Sysmon -ErrorAction SilentlyContinue |
    Format-Table Status,Name,DisplayName -AutoSize

Write-Output ""
Write-Output "Feature State:"

(Get-WindowsOptionalFeature `
    -Online `
    -FeatureName Sysmon).State

Write-Output ""
Write-Output "Binary:"

Test-Path "$env:windir\System32\sysmon.exe"

Write-Output ""
Write-Output "SYSMON MIGRATION COMPLETED"

Stop-Transcript

exit 0

$Feature = Get-WindowsOptionalFeature `
    -Online `
    -FeatureName Sysmon `
    -ErrorAction SilentlyContinue

if (
    $Feature -and
    $Feature.State -eq "Enabled" -and
    (Test-Path "$env:windir\System32\sysmon.exe")
)
{
    Write-Output "Installed"
    exit 0
}

exit 1