Zero-Trust Endpoint Isolation: Containment via Offline SIDs

# ============================================================================
# Script: Endpoint Containment & Session Purge (Local & RDP Lockdown)
# Purpose: Deny local AND remote desktop logon for all local users and local 
#          admins (excluding Domain Admins and built-in Admin), then logoff.
# Execution: Designed to run locally via SYSTEM (Intune/XDR/EDR Solutions).
# ============================================================================

try {
    # 1. Initialize a list to hold all the account SIDs we need to block
    $sidsToBlock = New-Object System.Collections.Generic.List[string]

    # Helper function to safely add SIDs
    function Add-BlockSID ($sid) {
        # Exclude Built-in Admin (-500), Domain Admins (-512), System (-18), Local Service (-19), Network Service (-20)
        if ($sid -and 
            $sid -notmatch "-500$" -and 
            $sid -notmatch "-512$" -and 
            $sid -notmatch "^S-1-5-18$" -and
            $sid -notmatch "^S-1-5-19$" -and
            $sid -notmatch "^S-1-5-20$") {
            if (-not $sidsToBlock.Contains($sid)) {
                $sidsToBlock.Add($sid)
            }
        }
    }

    # 2. Get the Local Administrators group using its well-known SID 
    $localAdminGroup = Get-LocalGroup | Where-Object { $_.SID -eq "S-1-5-32-544" }
    
    if ($localAdminGroup) {
        # Get all members of the Local Administrators group
        $adminMembers = Get-LocalGroupMember -Group $localAdminGroup.Name -ErrorAction SilentlyContinue
        
        foreach ($member in $adminMembers) {
            if ($member.ObjectClass -ne "Group" -and $member.PrincipalSource -ne "Unknown") {
                Add-BlockSID $member.SID.Value
            }
        }
    }

    # 3. Get all local users
    $localUsers = Get-LocalUser | Where-Object { $_.Enabled -eq $true }

    foreach ($user in $localUsers) {
        Add-BlockSID $user.SID.Value
    }

    # 4. Get all cached user profiles (offline Domain Users)
    $userProfiles = Get-CimInstance Win32_UserProfile -ErrorAction SilentlyContinue | Where-Object { $_.Special -eq $false }
    
    foreach ($profile in $userProfiles) {
        Add-BlockSID $profile.SID
    }

    # 5. Optionally Block well-known groups like Remote Desktop Users (S-1-5-32-555) by default
    Add-BlockSID "S-1-5-32-555"

    if ($sidsToBlock.Count -gt 0) {
        Write-Output "Accounts (SIDs) targeted for Deny Interactive & Remote Logon:"
        $sidsToBlock | ForEach-Object { Write-Output " - $_" }

        # --- PART 1: Apply Deny Local and Remote Logon Policies ---
        
        # Define temporary paths for secpol manipulation
        $exportPath = "$env:TEMP\secpol_export.inf"
        $importPath = "$env:TEMP\secpol_import.inf"
        $dbPath = "$env:TEMP\secpol_temp.sdb"

        # Export current user rights assignment policy
        secedit /export /cfg $exportPath /areas USER_RIGHTS | Out-Null

        # Read carefully handling potential Unicode BOM from secedit
        $policyContent = Get-Content -Path $exportPath -Encoding Unicode -ErrorAction Stop
        
        # Format for secedit INF requires asterisk prefix (*S-1-5-21-...)
        $formattedSids = $sidsToBlock | ForEach-Object { "*$_" }
        $accountsString = $formattedSids -join ","
        
        $newPolicyContent = New-Object System.Collections.Generic.List[string]
        $localLogonFound = $false
        $remoteLogonFound = $false
        $privilegeRightsFound = $false

        # Parse and modify the INF file contents
        foreach ($line in $policyContent) {
            if ($line -match "^\[Privilege Rights\]") {
                $privilegeRightsFound = $true
                $newPolicyContent.Add($line)
            }
            elseif ($line -match "^SeDenyInteractiveLogonRight") {
                $newPolicyContent.Add("SeDenyInteractiveLogonRight = $accountsString")
                $localLogonFound = $true
            }
            elseif ($line -match "^SeDenyRemoteInteractiveLogonRight") {
                $newPolicyContent.Add("SeDenyRemoteInteractiveLogonRight = $accountsString")
                $remoteLogonFound = $true
            }
            else {
                $newPolicyContent.Add($line)
            }
        }

        # If [Privilege Rights] didn't exist at all, add it at the end
        if (-not $privilegeRightsFound) {
            $newPolicyContent.Add("[Privilege Rights]")
        }

        # Inject the rights if they didn't exist previously under [Privilege Rights]
        for ($i = 0; $i -lt $newPolicyContent.Count; $i++) {
            if ($newPolicyContent[$i] -match "^\[Privilege Rights\]") {
                if (-not $localLogonFound) {
                    $newPolicyContent.Insert($i + 1, "SeDenyInteractiveLogonRight = $accountsString")
                }
                if (-not $remoteLogonFound) {
                    $newPolicyContent.Insert($i + 1, "SeDenyRemoteInteractiveLogonRight = $accountsString")
                }
                break
            }
        }

        # Save and apply the modified policy (secedit relies on Unicode natively)
        $newPolicyContent | Out-File -FilePath $importPath -Encoding Unicode
        secedit /configure /db $dbPath /cfg $importPath /areas USER_RIGHTS | Out-Null

        # Cleanup policy temp files
        Remove-Item -Path $exportPath, $importPath, $dbPath -ErrorAction SilentlyContinue
        
        Write-Output "Security policies (Local & RDP Deny) applied successfully using SIDs."
    } else {
        Write-Output "No matching accounts found to block. Proceeding to terminate sessions."
    }
    
    # --- PART 2: Force Immediate Logoff for EVERYONE ---
    
    # Retrieve all active and disconnected sessions
    $quserOutput = quser 2>$null
    
    if ($quserOutput) {
        $sessions = $quserOutput[1..($quserOutput.Length - 1)]
        
        foreach ($session in $sessions) {
            $tokens = $session -split '\s+' | Where-Object { $_ -ne '' }
            
            # The session ID is usually at index 1 or 2 depending on the session state
            $sessionId = if ($tokens[1] -match '^\d+$') { $tokens[1] } else { $tokens[2] }

            # Ensure we captured a valid integer session ID before terminating
            if ($sessionId -match '^\d+$') {
                Write-Output "Terminating session ID: $sessionId"
                logoff $sessionId
            }
        }
    } else {
        Write-Output "No active user sessions found to terminate."
    }

    Write-Output "Endpoint containment protocol completed."

} catch {
    Write-Error "An error occurred during containment: $_"
}