SMB Signing not required

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Checks whether SMB server signing is required (Tenable plugin 57608).
.DESCRIPTION
    Queries the local SMB server and client configuration to determine if
    RequireSecuritySignature is enabled. Outputs VULNERABLE, PATCHED, or UNKNOWN.
.NOTES
    Run locally on each target host with Administrator privileges.
    Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
#>

try {
    $smbServer = Get-SmbServerConfiguration -ErrorAction Stop
    $smbClient = Get-SmbClientConfiguration -ErrorAction Stop

    $serverSigning = $smbServer.RequireSecuritySignature
    $clientSigning = $smbClient.RequireSecuritySignature

    Write-Host "=== SMB Signing Check (Tenable 57608) ==="
    Write-Host "Hostname:                       $($env:COMPUTERNAME)"
    Write-Host "OS Version:                     $([System.Environment]::OSVersion.VersionString)"
    Write-Host "SMB Server RequireSecuritySignature: $serverSigning"
    Write-Host "SMB Client RequireSecuritySignature: $clientSigning"
    Write-Host ""

    # Plugin 57608 specifically checks server-side signing
    if ($serverSigning -eq $true) {
        Write-Host "PATCHED - SMB server signing is REQUIRED on this host."
        Write-Host "This host is NOT a valid NTLM relay target via SMB."
        if ($clientSigning -ne $true) {
            Write-Host "NOTE: SMB client signing is not required. Consider enabling for defense-in-depth."
        }
        exit 0
    } else {
        Write-Host "VULNERABLE - SMB server signing is NOT required on this host."
        Write-Host "This host CAN be used as an NTLM relay target (Tenable plugin 57608)."
        Write-Host ""
        Write-Host "Remediation:"
        Write-Host "  GPO:        Microsoft network server: Digitally sign communications (always) = Enabled"
        Write-Host "  PowerShell: Set-SmbServerConfiguration -RequireSecuritySignature `$true -Force"
        exit 1
    }
} catch {
    Write-Host "UNKNOWN - Unable to query SMB configuration."
    Write-Host "Error: $($_.Exception.Message)"
    Write-Host "Ensure you are running as Administrator on a supported Windows version."
    exit 2
}