安装适用于 Microsoft Windows 的全局安全访问客户端

# Define log file

$logFile = "$env:ProgramData\GSAInstall\install.log" New-Item -ItemType Directory -Path (Split-Path $logFile) -Force | Out-Null 

function Write-Log { param ([string]$message) $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" Add-Content -Path $logFile -Value "$timestamp - $message" } 

try { $ErrorActionPreference = 'Stop' Write-Log "Starting Global Secure Access client installation." 

# IPv4 preferred via DisabledComponents registry value 
$ipv4RegPath   = "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" 
$ipv4RegName   = "DisabledComponents" 
$ipv4RegValue  = 0x20   # Prefer IPv4 over IPv6 
$rebootRequired = $false 
 
# Ensure the key exists 
if (-not (Test-Path $ipv4RegPath)) { 
    New-Item -Path $ipv4RegPath -Force | Out-Null 
    Write-Log "Created registry key: $ipv4RegPath" 
} 
 
# Get current value if present 
$existingValue = $null 
$valueExists = $false 
try { 
    $existingValue = Get-ItemPropertyValue -Path $ipv4RegPath -Name $ipv4RegName -ErrorAction Stop 
    $valueExists = $true 
} catch { 
    $valueExists = $false 
} 
 
# Determine if we must change it 
$expected = [int]$ipv4RegValue 
$needsChange = -not $valueExists -or ([int]$existingValue -ne $expected) 
 
if ($needsChange) { 
    if (-not $valueExists) { 
        # Create as DWORD when missing 
        New-ItemProperty -Path $ipv4RegPath -Name $ipv4RegName -PropertyType DWord -Value $expected -Force | Out-Null 
        Write-Log "IPv4Preferred value missing. Created '$ipv4RegName' with value 0x{0} (dec {1})." -f ([Convert]::ToString($expected,16)), $expected 
    } else { 
        # Update if different 
        Set-ItemProperty -Path $ipv4RegPath -Name $ipv4RegName -Value $expected 
        Write-Log ("IPv4Preferred value differed. Updated '{0}' from 0x{1} (dec {2}) to 0x{3} (dec {4})." -f ` 
            $ipv4RegName, ([Convert]::ToString([int]$existingValue,16)), [int]$existingValue, ([Convert]::ToString($expected,16)), $expected) 
    } 
    $rebootRequired = $true 
} else { 
    Write-Log ("IPv4Preferred already set correctly: {0}=0x{1} (dec {2}). No change." -f ` 
        $ipv4RegName, ([Convert]::ToString($expected,16)), $expected) 
} 
 
# Run installer from local path 
$installerPath = Join-Path -Path $PSScriptRoot -ChildPath "GlobalSecureAccessClient.exe" 
Write-Log "Running installer from $installerPath" 
 
if (Test-Path $installerPath) { 
    $installProcess = Start-Process -FilePath $installerPath -ArgumentList "/quiet" -Wait -PassThru 
 
    if ($installProcess.ExitCode -eq 1618) { 
        Write-Log "Another installation is in progress. Exiting with code 1618." 
        exit 1618 
    } elseif ($installProcess.ExitCode -ne 0) { 
        Write-Log "Installer exited with code $($installProcess.ExitCode)." 
        exit $installProcess.ExitCode 
    } 
 
    Write-Log "Installer completed successfully." 
} else { 
    Write-Log "Installer not found at $installerPath" 
    exit 1 
} 
 
if ($rebootRequired) { 
    Write-Log "Reboot required due to registry value creation or update." 
    exit 3010  # Soft reboot required 
} else { 
    Write-Log "Installation complete. No reboot required." 
    exit 0 
} 
  

} catch { Write-Log "Fatal error: $_" exit 1603 } 

检测脚本

# Check GSA registry keys 

$gsaPath = "HKLM:\SOFTWARE\Microsoft\Global Secure Access Client" 

$gsaSettings = @{ 

"HideSignOutButton" = 1 
 
"HideDisablePrivateAccessButton" = 1 
 
"HideDisableButton" = 0 
 
"RestrictNonPrivilegedUsers" = 0 

} 

$nonCompliant = $false 

foreach ($setting in $gsaSettings.GetEnumerator()) { 

$currentValue = (Get-ItemProperty -Path $gsaPath -Name $setting.Key -ErrorAction SilentlyContinue).$($setting.Key) 
 
if ($currentValue -ne $setting.Value) { 
 
    Write-Output "Non-compliant: $($setting.Key) is $currentValue, expected $($setting.Value)" 
 
    $nonCompliant = $true 
 
} 
  

} 

if (-not $nonCompliant) { 

Write-Output "Compliant" 
 
exit 0 
  

} else { 

Write-Output "Non-compliant" 
 
exit 1 
 

} 

补救脚本

# Ensure GSA registry keys are present 

$gsaPath = "HKLM:\SOFTWARE\Microsoft\Global Secure Access Client" 

$gsaSettings = @{ 

"HideSignOutButton" = 1 
 
"HideDisablePrivateAccessButton" = 1 
 
"HideDisableButton" = 0 
 
"RestrictNonPrivilegedUsers" = 0 
  

} 

if (-Not (Test-Path $gsaPath)) { 

New-Item -Path $gsaPath -Force | Out-Null 
  

} 

foreach ($setting in $gsaSettings.GetEnumerator()) { 

Set-ItemProperty -Path $gsaPath -Name $setting.Key -Value $setting.Value -Type DWord -Force | Out-Null 
 
Write-Output "Set $($setting.Key) to $($setting.Value)" 
  

}

检测脚本

# Define the path to the Firefox policies.json file 

$destination = "C:\Program Files\Mozilla Firefox\distribution\policies.json" $compliant = $false 

# Check if the file exists 

if (Test-Path $destination) { try { # Read the file content $fileContent = Get-Content $destination -Raw if ($fileContent -and $fileContent.Trim().Length -gt 0) { # Parse JSON content $json = $fileContent | ConvertFrom-Json 

       # Check if Preferences exist under policies 
        if ($json.policies -and $json.policies.Preferences) { 
            $prefs = $json.policies.Preferences 
 
            # Convert Preferences to hashtable if needed 
            if ($prefs -isnot [hashtable]) { 
                $temp = @{} 
                $prefs.psobject.Properties | ForEach-Object { 
                    $temp[$_.Name] = $_.Value 
                } 
                $prefs = $temp 
            } 
 
            # Initialize compliance flags 
            $quicCompliant = $false 
            $dohCompliant = $false 
 
            # Check if QUIC is disabled and locked 
            if ($prefs.ContainsKey("network.http.http3.enable")) { 
                $val = $prefs["network.http.http3.enable"] 
                if ($val.Value -eq $false -and $val.Status -eq "locked") { 
                    $quicCompliant = $true 
                } 
            } 
 
            # Check if DNS over HTTPS is disabled and locked 
            if ($prefs.ContainsKey("network.trr.mode")) { 
                $val = $prefs["network.trr.mode"] 
                if ($val.Value -eq 0 -and $val.Status -eq "locked") { 
                    $dohCompliant = $true 
                } 
            } 
 
            # Set overall compliance if both settings are correct 
            if ($quicCompliant -and $dohCompliant) { 
                $compliant = $true 
            } 
        } 
    } 
} catch { 
    Write-Warning "Failed to parse policies.json: $_" 
} 
  

} 

# Output compliance result 

if ($compliant) { Write-Output "Compliant" Exit 0 } else { Write-Output "Non-compliant" Exit 1 } 

修复脚本

# Define paths 

$distributionDir = "C:\Program Files\Mozilla Firefox\distribution" $destination = Join-Path $distributionDir "policies.json" $backup = "$destination.bak" 

# Initialize variable for existing JSON 

$existingJson = $null 

# Try to read and parse existing policies.json 

if (Test-Path $destination) { $fileContent = Get-Content $destination -Raw if ($fileContent -and $fileContent.Trim().Length -gt 0) { try { $existingJson = $fileContent | ConvertFrom-Json } catch { Write-Warning "Existing policies.json is malformed. Starting fresh." } } } 

#Create a new JSON structure if none exists 

if (-not $existingJson) { $existingJson = [PSCustomObject]@{ policies = [PSCustomObject]@{ Preferences = @{} } } } 

# Ensure policies and Preferences nodes exist 

if (-not $existingJson.policies) { $existingJson | Add-Member -MemberType NoteProperty -Name policies -Value ([PSCustomObject]@{}) } if (-not $existingJson.policies.Preferences) { $existingJson.policies | Add-Member -MemberType NoteProperty -Name Preferences -Value @{} } 

# Convert Preferences to hashtable if needed 

if ($existingJson.policies.Preferences -isnot [hashtable]) { $prefs = @{} $existingJson.policies.Preferences.psobject.Properties | ForEach-Object { $prefs[$.Name] = $.Value } $existingJson.policies.Preferences = $prefs } 

$prefObj = $existingJson.policies.Preferences $updated = $false 

# Ensure QUIC is disabled and locked

if (-not $prefObj.ContainsKey("network.http.http3.enable") -or $prefObj["network.http.http3.enable"].Value -ne $false -or $prefObj["network.http.http3.enable"].Status -ne "locked") { 

$prefObj["network.http.http3.enable"] = @{ 
    Value = $false 
    Status = "locked" 
} 
$updated = $true 
  

} 

# Ensure DNS over HTTPS is disabled and locked 

if (-not $prefObj.ContainsKey("network.trr.mode") -or $prefObj["network.trr.mode"].Value -ne 0 -or $prefObj["network.trr.mode"].Status -ne "locked") { 

$prefObj["network.trr.mode"] = @{ 
    Value = 0 
    Status = "locked" 
} 
$updated = $true 
} 

# If any updates were made, back up and write the new JSON 

if ($updated) { if (Test-Path $destination) { Copy-Item $destination $backup -Force } 

$jsonOut = $existingJson | ConvertTo-Json -Depth 10 -Compress 
$utf8NoBomEncoding = New-Object System.Text.UTF8Encoding($false) 
[System.IO.File]::WriteAllText($destination, $jsonOut, $utf8NoBomEncoding) 
}