Compliance validation scripts — Proxmox / Linux + Windows - for Brandon and Z

 Compliance validation scripts — Proxmox / Linux + Windows

Below are two ready-to-run validation scripts you can drop into staging to produce an automated compliance report:

• validate-proxmox-compliance.sh — Bash script that runs locally on a Proxmox / Debian host (or via SSH). Produces JSON + human summary. Checks cover OS hardening items from your playbook (service status, firewall, corosync, auditd/aide, SSH config, rsyslog forwarding, chrony, AppArmor, packages, Proxmox-specific checks like pvecm, pve-firewall, LDAP/AD realm visibility, proxmox-backup-client verification if installed, Ceph health if present).
• validate-windows-compliance.ps1 — PowerShell script for Windows Server hosts to check common hardening baselines (BitLocker, WinRM/SMBv1, Windows Update status, Sysmon presence, event forwarding config, local admin count, firewall profile, and basic GPO/audit settings). Produces JSON + console summary.

Both scripts are conservative: they detect presence of tools/commands first, skip checks if the tool isn't installed (and mark them as skipped). They are intended for staging — run as root (Linux) or Administrator (Windows) and do not make changes.

---

1) validate-proxmox-compliance.sh (Bash)

Save as validate-proxmox-compliance.sh, chmod +x and run as root (or run via SSH on each node). It prints progress and writes /var/log/proxmox-compliance-YYYYMMDD-HHMMSS.json with the detailed results.

#!/usr/bin/env bash

# validate-proxmox-compliance.sh

# Run as root. Produces JSON report + human summary.

set -euo pipefail

 

TS=$(date +%F_%H%M%S)

HOST=$(hostname --fqdn 2>/dev/null || hostname)

OUT="/var/log/proxmox-compliance-${TS}.json"

TMP="/tmp/proxmox-compliance-${TS}.tmp.json"

 

# Helper: emit JSON-safe strings

json_escape() {

  python3 - <<PY

import json,sys

print(json.dumps(sys.stdin.read().strip()))

PY

}

 

# Helper: record check result

# args: key, status(passed/failed/skipped), message, extra (optional json)

add_result() {

  local key="$1"; shift

  local status="$1"; shift

  local msg="$1"; shift

  local extra="$1"; shift || extra="{}"

  printf '%s\n' "{\"check\":\"$key\",\"status\":\"$status\",\"message\":$(echo "$msg" | python3 -c "import json,sys; print(json.dumps(sys.stdin.read()))") ,\"extra\":$extra}" >> "$TMP"

}

 

# Start

echo "Starting Proxmox compliance validation on $HOST — writing to $OUT"

: > "$TMP"

 

# 1) Basic system info

OS="$(awk -F= '/^PRETTY_NAME/ {print $2}' /etc/os-release 2>/dev/null || uname -a)"

KERNEL="$(uname -r)"

add_result "system_info" "passed" "Collected OS and kernel" "{\"os\": $(echo "$OS" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read().strip()))'), \"kernel\": $(echo "$KERNEL" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read().strip()))') }"

 

# 2) Time sync: chrony or systemd-timesyncd

if command -v chronyd >/dev/null 2>&1 || command -v chronyc >/dev/null 2>&1; then

  if systemctl is-active --quiet chronyd || systemctl is-active --quiet chrony; then

    add_result "chrony" "passed" "chrony active and running" "{}"

  else

    add_result "chrony" "failed" "chrony installed but not running" "{}"

  fi

elif systemctl list-units --type=service | grep -q timesyncd; then

  if systemctl is-active --quiet systemd-timesyncd; then

    add_result "timesyncd" "passed" "systemd-timesyncd active" "{}"

  else

    add_result "timesyncd" "failed" "systemd-timesyncd not active" "{}"

  fi

else

  add_result "time_sync" "skipped" "No chrony or timesyncd found" "{}"

fi

 

# 3) Package updates (are there upgrades available?)

if command -v apt-get >/dev/null 2>&1; then

  apt-get -s upgrade >/tmp/apt-sim-${TS}.txt 2>/dev/null || true

  UPGRADE_COUNT=$(grep -c "Inst " /tmp/apt-sim-${TS}.txt || true)

  if [ -n "$UPGRADE_COUNT" ] && [ "$UPGRADE_COUNT" -gt 0 ]; then

    add_result "apt_pending_upgrades" "failed" "There are pending upgrades" "{\"pending\": $UPGRADE_COUNT}"

  else

    add_result "apt_pending_upgrades" "passed" "No pending upgrades" "{}"

  fi

else

  add_result "pkg_manager" "skipped" "apt-get not found; skipped package update check" "{}"

fi

 

# 4) SSH hardening checks: PasswordAuthentication no, PermitRootLogin not yes, PubkeyAuthentication yes

SSHD="/etc/ssh/sshd_config"

if [ -f "$SSHD" ]; then

  PA=$(grep -Ei '^\s*PasswordAuthentication' $SSHD || true)

  PR=$(grep -Ei '^\s*PermitRootLogin' $SSHD || true)

  PB=$(grep -Ei '^\s*PubkeyAuthentication' $SSHD || true)

  status="passed"

  msg=""

  if echo "$PA" | grep -Eq 'no'; then msg="$msg PasswordAuthentication=no;"; else status="failed"; msg="$msg PasswordAuthentication!=no;"; fi

  if echo "$PR" | grep -Eq 'no|prohibit-password'; then msg="$msg PermitRootLogin ok;"; else status="failed"; msg="$msg PermitRootLogin unsafe;"; fi

  if echo "$PB" | grep -Eq 'yes'; then msg="$msg PubkeyAuthentication=yes;"; else status="failed"; msg="$msg PubkeyAuthentication!=yes;"; fi

  add_result "sshd_config" "$status" "$msg" "{}"

else

  add_result "sshd_config" "skipped" "sshd_config not found" "{}"

fi

 

# 5) Auditd running + rules file exists

if command -v auditctl >/dev/null 2>&1; then

  if systemctl is-active --quiet auditd; then

    # simple check: ensure some user-file watches exist

    RULES=$(auditctl -l 2>/dev/null || true)

    if echo "$RULES" | grep -q '/etc/ssh/sshd_config' || echo "$RULES" | grep -q '/etc/passwd'; then

      add_result "auditd" "passed" "auditd running and basic rules present" "{}"

    else

      add_result "auditd" "failed" "auditd running but expected rules not found (e.g., /etc/ssh/sshd_config, /etc/passwd)" "{}"

    fi

  else

    add_result "auditd" "failed" "auditd not running" "{}"

  fi

else

  add_result "auditd" "skipped" "auditctl not installed" "{}"

fi

 

# 6) AIDE database check (if installed)

if command -v aide >/dev/null 2>&1; then

  AIDE_CHECK=$(aide --check 2>&1 || true)

  if echo "$AIDE_CHECK" | grep -Eq "database.*not found|No.*database"; then

    add_result "aide" "skipped" "AIDE installed but DB not initialized" "{}"

  elif echo "$AIDE_CHECK" | grep -q 'changed'; then

    add_result "aide" "failed" "AIDE reported changes" "{}"

  else

    add_result "aide" "passed" "AIDE check completed (no changes reported)" "{}"

  fi

else

  add_result "aide" "skipped" "aide not installed" "{}"

fi

 

# 7) Firewall: UFW or firewalld or pve-firewall

if command -v ufw >/dev/null 2>&1; then

  UFW_STATUS=$(ufw status verbose 2>/dev/null || true)

  if echo "$UFW_STATUS" | grep -q "Status: active"; then

    add_result "ufw" "passed" "UFW active" "{}"

  else

    add_result "ufw" "failed" "UFW not active" "{}"

  fi

elif command -v firewall-cmd >/dev/null 2>&1; then

  if systemctl is-active --quiet firewalld; then

    add_result "firewalld" "passed" "firewalld active" "{}"

  else

    add_result "firewalld" "failed" "firewalld not active" "{}"

  fi

else

  # Check pve-firewall if Proxmox tools are present

  if command -v pve-firewall >/dev/null 2>&1 || [ -d /etc/pve/firewall ]; then

    if pve-firewall status 2>/dev/null | grep -q "running"; then

      add_result "pve-firewall" "passed" "pve-firewall running" "{}"

    else

      add_result "pve-firewall" "failed" "pve-firewall present but not running" "{}"

    fi

  else

    add_result "firewall" "skipped" "No UFW/firewalld/pve-firewall detected" "{}"

  fi

fi

 

# 8) Proxmox cluster & corosync

if command -v pvecm >/dev/null 2>&1; then

  PVE_STATUS=$(pvecm status 2>/dev/null || true)

  if echo "$PVE_STATUS" | grep -q "Quorum"; then

    add_result "pvecm" "passed" "pvecm status OK" "{}"

  else

    add_result "pvecm" "failed" "pvecm exists but no quorum or unexpected status" "{\"output\": $(python3 -c "import json,sys; print(json.dumps('''$PVE_STATUS'''))") }"

  fi

else

  add_result "pvecm" "skipped" "pvecm CLI not present" "{}"

fi

 

# 9) Corosync bind/interface checks (if corosync present)

if command -v corosync >/dev/null 2>&1 || [ -f /etc/pve/corosync.conf ] || [ -f /etc/corosync/corosync.conf ]; then

  CFILE=$( [ -f /etc/pve/corosync.conf ] && cat /etc/pve/corosync.conf || cat /etc/corosync/corosync.conf 2>/dev/null || true )

  if echo "$CFILE" | grep -qi "bindnetaddr\|interface"; then

    add_result "corosync_conf" "passed" "Found corosync config with binding info" "{}"

  else

    add_result "corosync_conf" "failed" "Corosync config present but binding not obvious; check dedicated NIC" "{}"

  fi

else

  add_result "corosync_conf" "skipped" "Corosync not present" "{}"

fi

 

# 10) Proxmox backup client check (if installed)

if command -v proxmox-backup-client >/dev/null 2>&1; then

  add_result "proxmox-backup-client" "passed" "proxmox-backup-client installed" "{}"

  # Optional: try a verify dry-run on a sample repo if configured (skipped to avoid destructive ops)

  add_result "proxmox-backup-verify" "skipped" "Not running verify by default; automation should run verify for sample backup" "{}"

else

  add_result "proxmox-backup-client" "skipped" "proxmox-backup-client not installed" "{}"

fi

 

# 11) Ceph health (if ceph CLI present)

if command -v ceph >/dev/null 2>&1; then

  CE=$(ceph -s 2>/dev/null || true)

  if echo "$CE" | grep -q "HEALTH_OK"; then

    add_result "ceph_health" "passed" "Ceph HEALTH_OK" "{}"

  else

    add_result "ceph_health" "failed" "Ceph not HEALTH_OK" "{\"output\": $(python3 -c "import json,sys; print(json.dumps('''$CE'''))") }"

  fi

else

  add_result "ceph" "skipped" "ceph CLI not installed" "{}"

fi

 

# 12) RSYSLOG forwarding to SIEM (TLS config file present)

if [ -d /etc/rsyslog.d ]; then

  if grep -R "siem" /etc/rsyslog.d 2>/dev/null | grep -q '@@'; then

    add_result "rsyslog_siem" "passed" "rsyslog forwarding configured (detected @@)" "{}"

  else

    add_result "rsyslog_siem" "skipped" "No obvious rsyslog SIEM forwarding configuration found in /etc/rsyslog.d" "{}"

  fi

else

  add_result "rsyslog" "skipped" "rsyslog not present" "{}"

fi

 

# 13) AppArmor / SELinux

if command -v aa-status >/dev/null 2>&1; then

  if aa-status --enabled 2>/dev/null | grep -q "apparmor module is loaded"; then

    add_result "apparmor" "passed" "AppArmor enabled" "{}"

  else

    add_result "apparmor" "failed" "AppArmor not enabled" "{}"

  fi

elif [ -f /etc/selinux/config ] || command -v getenforce >/dev/null 2>&1; then

  if command -v getenforce >/dev/null 2>&1 && [ "$(getenforce 2>/dev/null)" = "Enforcing" ]; then

    add_result "selinux" "passed" "SELinux enforcing" "{}"

  else

    add_result "selinux" "failed" "SELinux not enforcing" "{}"

  fi

else

  add_result "mac_lsm" "skipped" "No AppArmor or SELinux detected" "{}"

fi

 

# 14) Check - SSH root login blocked in pam/sshd and no password auth for root (already partially covered)

if [ -f /etc/ssh/sshd_config ]; then

  if grep -Eiq '^\s*PermitRootLogin\s+(no|prohibit-password)' /etc/ssh/sshd_config; then

    add_result "root_login_policy" "passed" "PermitRootLogin set to no/prohibit-password" "{}"

  else

    add_result "root_login_policy" "failed" "PermitRootLogin may be allowed; review /etc/ssh/sshd_config" "{}"

  fi

fi

 

# 15) Local accounts: check for passwordless root or UID 0 duplicates

if getent passwd root >/dev/null 2>&1; then

  ROOT_LINE=$(getent passwd root)

  if echo "$ROOT_LINE" | cut -d: -f2 | grep -q '^!'; then

    add_result "root_account_shadow" "passed" "root account shadow locked or not directly password-authenticated" "{}"

  else

    add_result "root_account_shadow" "skipped" "Could not determine shadow status; manual check recommended" "{}"

  fi

fi

DUP_UID0=$(awk -F: '($3==0){print $1}' /etc/passwd | wc -l || true)

if [ "$DUP_UID0" -gt 1 ]; then

  add_result "uid0_accounts" "failed" "Multiple UID 0 accounts present" "{\"count\":$DUP_UID0}"

else

  add_result "uid0_accounts" "passed" "No duplicate UID 0 accounts" "{}"

fi

 

# 16) Disk space & SMART (low disk may affect logging/backups)

DISK_FREE=$(df -h / | awk 'NR==2{print $5}')

add_result "root_fs_usage" "info" "Root filesystem usage: $DISK_FREE" "{}"

 

# 17) PVE API/LDAP (pveum) checks

if command -v pveum >/dev/null 2>&1; then

  PVEUM_LIST=$(pveum realm list 2>/dev/null || true)

  if echo "$PVEUM_LIST" | grep -q 'ldap\|Active Directory\|AD'; then

    add_result "pveum_realm" "passed" "LDAP/AD realm configured" "{}"

  else

    add_result "pveum_realm" "skipped" "No LDAP/AD realm detected in pveum realm list" "{}"

  fi

else

  add_result "pveum" "skipped" "pveum CLI not present" "{}"

fi

 

# 18) Prometheus/Node exporter presence

if command -v node_exporter >/dev/null 2>&1 || ss -ltnp 2>/dev/null | grep -q '9100'; then

  add_result "node_exporter" "passed" "Node exporter detected (port 9100 or binary found)" "{}"

else

  add_result "node_exporter" "skipped" "node_exporter not detected" "{}"

fi

 

# 19) Secure Boot check (UEFI efivars presence)

if [ -d /sys/firmware/efi ]; then

  # Check secure boot variable if available

  if [ -f /sys/firmware/efi/vars/SecureBoot-*/data ] 2>/dev/null; then

    SB=$(hexdump -v -e '1/1 "%02x"' /sys/firmware/efi/vars/SecureBoot-*/data 2>/dev/null | tail -c 2 || true)

    if [ "$SB" = "01" ]; then

      add_result "secure_boot" "passed" "Secure Boot appears enabled" "{}"

    else

      add_result "secure_boot" "failed" "Secure Boot variable present but not enabled" "{}"

    fi

  else

    add_result "secure_boot" "skipped" "SecureBoot efivar not readable or not present" "{}"

  fi

else

  add_result "secure_boot" "skipped" "Non-UEFI system; secure boot N/A" "{}"

fi

 

# 20) Final: build JSON array and summary

echo "[" > "${OUT}"

first=1

while IFS= read -r line; do

  if [ $first -eq 1 ]; then

    printf '%s\n' "  $line" >> "${OUT}"

    first=0

  else

    printf '%s\n' "  ,$line" >> "${OUT}"

  fi

done < "$TMP"

echo "]" >> "${OUT}"

 

# Human summary

echo

echo "==== Compliance summary for $HOST ===="

jq -r '.[] | "\(.check) \t \(.status) \t \(.message)"' "${OUT}" || true

echo

echo "Detailed JSON report: $OUT"

Notes & usage

• Script assumes python3 and jq are available for JSON handling/printing. Install if missing (apt-get install python3 jq).
• The script purposely does not run intrusive checks (no automatic restores, no proxmox-backup-client verify on repos you didn't configure).
• Extend/add checks to match your exact baseline (e.g., check specific pve-firewall aliases and datacenter rules).
• You can run this via SSH from your jump host: ssh root@pve1 'bash -s' < validate-proxmox-compliance.sh.

---

2) validate-windows-compliance.ps1 (PowerShell)

Save as validate-windows-compliance.ps1 and run in an elevated PowerShell (Administrator). Produces a JSON file in C:\Logs\windows-compliance-YYYYMMDD-HHMMSS.json.

<#

.SYNOPSIS

  validate-windows-compliance.ps1 - Basic Windows Server hardening checks

  Run as Administrator. Produces a JSON report and prints a human summary.

#>

 

$TS = (Get-Date).ToString('yyyyMMdd_HHmmss')

$HostName = $env:COMPUTERNAME

$OutDir = "C:\Logs"

If (!(Test-Path $OutDir)) { New-Item -Path $OutDir -ItemType Directory -Force | Out-Null }

$OutFile = Join-Path $OutDir "windows-compliance-$TS.json"

 

$results = @()

 

function Add-Result {

    param($Check,$Status,$Message,$Extra)

    $obj = [PSCustomObject]@{

        check = $Check

        status = $Status

        message = $Message

        extra = $Extra

    }

    $script:results += $obj

}

 

Write-Host "Starting Windows compliance checks on $HostName"

 

# 1) Windows Update pending reboots / updates

try {

    $wu = Get-WindowsUpdateLog -ErrorAction SilentlyContinue

    # fallback: check for pending reboot reason from registry

    $pending = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired" -ErrorAction SilentlyContinue)

    if ($pending) { Add-Result -Check "windows_update" -Status "failed" -Message "Pending reboot/update exists" -Extra @{pending="true"} }

    else { Add-Result -Check "windows_update" -Status "passed" -Message "No pending Windows Update reboot detected" -Extra @{} }

} catch {

    Add-Result -Check "windows_update" -Status "skipped" -Message "Could not evaluate Windows Update state" -Extra @{error=$_.Exception.Message}

}

 

# 2) SMBv1 disabled

try {

    $smb1 = Get-SmbServerConfiguration | Select-Object -ExpandProperty EnableSMB1Protocol -ErrorAction SilentlyContinue

    if ($smb1 -eq $false) { Add-Result -Check "smb1" -Status "passed" -Message "SMBv1 disabled" -Extra @{} }

    else { Add-Result -Check "smb1" -Status "failed" -Message "SMBv1 enabled - disable it" -Extra @{EnableSMB1Protocol=$smb1} }

} catch {

    Add-Result -Check "smb1" -Status "skipped" -Message "SMB check not available" -Extra @{error=$_.Exception.Message}

}

 

# 3) WinRM enabled with HTTPS listener (or at least enabled)

try {

    $listeners = winrm enumerate winrm/config/Listener 2>$null

    if ($listeners -match "Transport = HTTPS") {

        Add-Result -Check "winrm_https" -Status "passed" -Message "WinRM HTTPS listener present" -Extra @{}

    } elseif ($listeners -match "Transport = HTTP") {

        Add-Result -Check "winrm_http" -Status "failed" -Message "WinRM HTTP listener present; consider HTTPS only" -Extra @{}

    } else {

        Add-Result -Check "winrm" -Status "skipped" -Message "No WinRM listener detected" -Extra @{}

    }

} catch {

    Add-Result -Check "winrm" -Status "skipped" -Message "WinRM check failed" -Extra @{error=$_.Exception.Message}

}

 

# 4) BitLocker status (if OS volume is present and BitLocker feature exists)

try {

    $osvol = Get-BitLockerVolume -ErrorAction SilentlyContinue | Where-Object {$_.MountPoint -eq "C:"}

    if ($osvol) {

        if ($osvol.ProtectionStatus -eq "On") {

            Add-Result -Check "bitlocker" -Status "passed" -Message "BitLocker protection ON for C:" -Extra @{KeyProtectors = $osvol.KeyProtector}

        } else {

            Add-Result -Check "bitlocker" -Status "failed" -Message "BitLocker protection OFF for C:" -Extra @{}

        }

    } else {

        Add-Result -Check "bitlocker" -Status "skipped" -Message "BitLocker not configured or cmdlets unavailable" -Extra @{}

    }

} catch {

    Add-Result -Check "bitlocker" -Status "skipped" -Message "BitLocker check error" -Extra @{error=$_.Exception.Message}

}

 

# 5) Local Administrators group membership (count)

try {

    $admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue

    $count = if ($admins) { $admins.Count } else { 0 }

    if ($count -le 5) { Add-Result -Check "local_admins" -Status "passed" -Message "Local Administrators count reasonable" -Extra @{count=$count} }

    else { Add-Result -Check "local_admins" -Status "failed" -Message "Too many local admins" -Extra @{count=$count} }

} catch {

    Add-Result -Check "local_admins" -Status "skipped" -Message "Could not enumerate local administrators" -Extra @{error=$_.Exception.Message}

}

 

# 6) Windows Firewall (profile enabled)

try {

    $fw = Get-NetFirewallProfile -ErrorAction Stop

    $allEnabled = $true

    foreach ($p in $fw) { if (-not $p.Enabled) { $allEnabled = $false } }

    if ($allEnabled) { Add-Result -Check "win_firewall" -Status "passed" -Message "Windows Firewall enabled for all profiles" -Extra @{} }

    else { Add-Result -Check "win_firewall" -Status "failed" -Message "One or more firewall profiles disabled" -Extra @{profiles=$fw} }

} catch {

    Add-Result -Check "win_firewall" -Status "skipped" -Message "Firewall check failed" -Extra @{error=$_.Exception.Message}

}

 

# 7) Sysmon presence (look for Sysmon service or registry)

try {

    $sysmon = Get-Service -Name "Sysmon64" -ErrorAction SilentlyContinue

    if ($sysmon -and $sysmon.Status -eq "Running") { Add-Result -Check "sysmon" -Status "passed" -Message "Sysmon running" -Extra @{} }

    else { Add-Result -Check "sysmon" -Status "skipped" -Message "Sysmon not present or not running" -Extra @{} }

} catch {

    Add-Result -Check "sysmon" -Status "skipped" -Message "Sysmon check error" -Extra @{error=$_.Exception.Message}

}

 

# 8) Event forwarding / WEF (detect subscription)

try {

    $subs = wecutil gr 2>$null

    if ($subs) { Add-Result -Check "wef" -Status "passed" -Message "Event forwarding subscription(s) exist" -Extra @{} }

    else { Add-Result -Check "wef" -Status "skipped" -Message "No WEF subscriptions found" -Extra @{} }

} catch {

    Add-Result -Check "wef" -Status "skipped" -Message "WEF check failed" -Extra @{error=$_.Exception.Message}

}

 

# 9) Audit policy (basic presence of success/failure for logon events)

try {

    $audit = auditpol /get /category:* 2>$null | Out-String

    if ($audit -match "Logon/Logoff" -and $audit -match "Success") {

        Add-Result -Check "audit_policy" -Status "passed" -Message "Audit policy contains Logon success/failure settings" -Extra @{}

    } else {

        Add-Result -Check "audit_policy" -Status "failed" -Message "Audit policy may be insufficient" -Extra @{}

    }

} catch {

    Add-Result -Check "audit_policy" -Status "skipped" -Message "Could not query audit policy" -Extra @{error=$_.Exception.Message}

}

 

# 10) Windows Defender / AV presence (basic)

try {

    $def = Get-MpComputerStatus -ErrorAction SilentlyContinue

    if ($def -and $def.AntivirusEnabled) {

        Add-Result -Check "antivirus" -Status "passed" -Message "Windows Defender/AV active" -Extra @{AMService=$def.AntivirusEnabled}

    } else {

        Add-Result -Check "antivirus" -Status "skipped" -Message "AV not detected/unknown" -Extra @{}

    }

} catch {

    Add-Result -Check "antivirus" -Status "skipped" -Message "AV check error" -Extra @{error=$_.Exception.Message}

}

 

# Save JSON

$results | ConvertTo-Json -Depth 5 | Out-File -FilePath $OutFile -Encoding UTF8

 

# Print summary

Write-Host "`n==== Windows compliance summary for $HostName ===="

$results | ForEach-Object { "{0}`t{1}`t{2}" -f $_.check, $_.status, $_.message }

Write-Host "`nDetailed JSON report: $OutFile"

Notes & usage

• Run elevated. Requires PowerShell 5+ (Windows Server 2016+). Some cmdlets (e.g., Get-BitLockerVolume, Get-WindowsUpdateLog) may require optional features or modules; script gracefully skips if not available.
• Expand the checks with exact GPO or registry paths you require, or integrate with SCCM/Intune APIs for large-scale reporting.

---

3) Integration & automation recommendations

1. Run centrally from your jump host — execute the Linux script via SSH for each PVE node and collect the JSON outputs centrally. Example wrapper (Ansible or simple parallel-ssh) can pull /var/log/proxmox-compliance-*.json and combine into a cluster report.
2. Store reports in SIEM/CMDB — forward the JSON to your SIEM (HTTP intake/Logstash/Beats) for retention and trend analysis.
3. Schedule regular runs (weekly) and compare results to detect drift. Keep previous baselines to highlight regressions.
4. Convert findings into remediation playbooks — for each failed result produce a remediation runbook or an automated Ansible task to fix (careful with firewalls/identity changes — always stage first).
5. Add unit tests / gating — integrate into CI/CD so that new nodes fail a gate until the compliance script reports passed for critical checks.