#Requires -Version 5.1
<#  SilverMetal Enhanced - Windows | Domain F: Network & radios
    Distrust the network: firewall default-deny inbound, encrypted DNS, kill
    LAN name-resolution leak vectors, WiFi-only (no baseband module). SilverVPN
    always-on kill-switch is installed by 08-stack-install.ps1.
    Spec: ../hardening-spec.md (F)   |   SCAFFOLD (M1).
#>
[CmdletBinding()] param()
Set-StrictMode -Version Latest; $ErrorActionPreference = 'Stop'
Write-Host '[F] Network & radios'

# Firewall: default-deny inbound on all profiles.
Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultInboundAction Block -DefaultOutboundAction Allow -Enabled True

# Disable SMBv1 + LAN name-resolution leak vectors.
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart -EA SilentlyContinue | Out-Null
$dns = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient'
New-Item $dns -Force | Out-Null
Set-ItemProperty $dns -Name EnableMulticast -Type DWord -Value 0          # LLMNR off
$nbt = 'HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters'
Set-ItemProperty $nbt -Name NodeType -Type DWord -Value 2                  # NetBIOS: P-node (no broadcast)

# Encrypted DNS (DoH) auto + WPAD off.
$doh = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient'
Set-ItemProperty $doh -Name DoHPolicy -Type DWord -Value 3                 # require DoH
Set-Service WinHttpAutoProxySvc -StartupType Disabled -EA SilentlyContinue

# TODO-M1: configure DoH server template; verify NO WWAN adapter present (we do not fit the
#          4G/5G baseband module); disable Bluetooth radio unless in use.

Write-Host '   [F] firewall default-deny, SMB1 off, LLMNR/NetBIOS/WPAD off, DoH required.'
