# High memory remediation consent tier
# Lever 6 pagefile sizing with dump type check
# Runs elevated as SYSTEM idempotent safe to repeat
# Takes effect at next boot and needs disk space for the new pagefile size
# Dump type policy
#   0 none and 3 small minidump are safe to convert
#   1 full and 2 kernel and 7 automatic need guaranteed pagefile space
#   absent or any other value is unknown and we fail closed to protect dump capture
# State changes dual write to stdout and the Application event log for a tamper evident trail

$eventLogName = 'Application'
$eventSourceName = 'ZohoDEXRemediation'

function Write-RemediationEvent {
    param(
        [string]$Message,
        [int]$EventId,
        [string]$EntryType = 'Information'
    )
    Write-Output $Message
    try {
        $sourceExists = [System.Diagnostics.EventLog]::SourceExists($eventSourceName)
        if ($sourceExists -eq $false) {
            [System.Diagnostics.EventLog]::CreateEventSource($eventSourceName, $eventLogName)
        }
        $entryTypeValue = [System.Diagnostics.EventLogEntryType]::Information
        if ($EntryType -eq 'Warning') {
            $entryTypeValue = [System.Diagnostics.EventLogEntryType]::Warning
        }
        [System.Diagnostics.EventLog]::WriteEntry($eventSourceName, $Message, $entryTypeValue, $EventId)
    } catch {
        Write-Output ('audit_warn: event log write failed for event {0}' -f $EventId)
    }
}

$computerSystem = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop

if ($computerSystem.AutomaticManagedPagefile -eq $true) {
    Write-Output 'skip: pagefile already system managed'
} else {
    $crashControlPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl'
    $crashDumpProperty = Get-ItemProperty -Path $crashControlPath -Name CrashDumpEnabled -ErrorAction SilentlyContinue
    $crashDumpEnabled = $null
    if ($crashDumpProperty -ne $null) {
        $crashDumpEnabled = $crashDumpProperty.CrashDumpEnabled
    }

    $crashDumpDisplay = 'absent'
    if ($crashDumpEnabled -ne $null) {
        $crashDumpDisplay = $crashDumpEnabled
    }

    $safeToConvert = ($crashDumpEnabled -eq 0) -or ($crashDumpEnabled -eq 3)
    $needsGuaranteedSpace = ($crashDumpEnabled -eq 1) -or ($crashDumpEnabled -eq 2) -or ($crashDumpEnabled -eq 7)

    if ($safeToConvert) {
        Set-CimInstance -InputObject $computerSystem -Property @{AutomaticManagedPagefile = $true} -ErrorAction Stop
        Write-RemediationEvent -Message ('changed: pagefile set to system managed dump type {0} needs no guaranteed space' -f $crashDumpDisplay) -EventId 5206
    } elseif ($needsGuaranteedSpace) {
        $systemDrive = $env:SystemDrive
        $allDrives = Get-CimInstance -ClassName Win32_LogicalDisk -ErrorAction SilentlyContinue
        $driveInfo = $allDrives | Where-Object { $_.DeviceID -eq $systemDrive }
        $freeSpaceKnown = ($driveInfo -ne $null) -and ($driveInfo.FreeSpace -ne $null)
        $freeSpaceSufficient = $freeSpaceKnown -and ($driveInfo.FreeSpace -ge $computerSystem.TotalPhysicalMemory)
        if ($freeSpaceSufficient) {
            Set-CimInstance -InputObject $computerSystem -Property @{AutomaticManagedPagefile = $true} -ErrorAction Stop
            Write-RemediationEvent -Message ('changed: pagefile set to system managed dump type {0} has sufficient free disk' -f $crashDumpDisplay) -EventId 5206
        } else {
            Write-Output ('skip: dump type {0} needs guaranteed pagefile space and free disk is short or unknown' -f $crashDumpDisplay)
        }
    } else {
        Write-Output ('skip: crash dump configuration {0} is unknown failing closed to protect dump capture' -f $crashDumpDisplay)
    }
}