diff --git a/LAPS/Binaries/Laps/LAPS.x64.msi b/LAPS/Binaries/Laps/LAPS.x64.msi new file mode 100644 index 0000000..8a62c59 Binary files /dev/null and b/LAPS/Binaries/Laps/LAPS.x64.msi differ diff --git a/LAPS/Binaries/Laps/LAPS.x86.msi b/LAPS/Binaries/Laps/LAPS.x86.msi new file mode 100644 index 0000000..3fa5fff Binary files /dev/null and b/LAPS/Binaries/Laps/LAPS.x86.msi differ diff --git a/LAPS/GPO/manifest.xml b/LAPS/GPO/manifest.xml new file mode 100644 index 0000000..047e2e7 --- /dev/null +++ b/LAPS/GPO/manifest.xml @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/Backup.xml b/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/Backup.xml new file mode 100644 index 0000000..d0a017f --- /dev/null +++ b/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/Backup.xml @@ -0,0 +1,18 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/DomainSysvol/GPO/Machine/comment.cmtx b/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/DomainSysvol/GPO/Machine/comment.cmtx new file mode 100644 index 0000000..4b8fa9f --- /dev/null +++ b/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/DomainSysvol/GPO/Machine/comment.cmtx @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/DomainSysvol/GPO/Machine/registry.pol b/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/DomainSysvol/GPO/Machine/registry.pol new file mode 100644 index 0000000..22ff46f Binary files /dev/null and b/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/DomainSysvol/GPO/Machine/registry.pol differ diff --git a/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/bkupInfo.xml b/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/bkupInfo.xml new file mode 100644 index 0000000..6a4b760 --- /dev/null +++ b/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/gpreport.xml b/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/gpreport.xml new file mode 100644 index 0000000..20bce26 Binary files /dev/null and b/LAPS/GPO/{65AEE3FE-FDB4-408C-AD59-E6E1D368343D}/gpreport.xml differ diff --git a/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/Backup.xml b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/Backup.xml new file mode 100644 index 0000000..c428c16 --- /dev/null +++ b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/Backup.xml @@ -0,0 +1,118 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + + + + 01 00 04 8c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 14 01 0a 00 00 00 00 00 24 00 ff 01 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 00 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 14 00 ff 01 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 05 12 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 12 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 12 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 12 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 12 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 12 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 1a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 01 00 04 8c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 14 01 0a 00 00 00 00 00 24 00 ff 01 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 00 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 14 00 ff 01 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 05 12 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 12 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 12 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 12 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 12 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 12 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 1a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + LDAP://%GPO_DSPATH% + + + + + \ No newline at end of file diff --git a/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/Applications/{B317FB0C-A29C-41BA-9030-686D4920EFFC}.aas b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/Applications/{B317FB0C-A29C-41BA-9030-686D4920EFFC}.aas new file mode 100644 index 0000000..cbe28c8 Binary files /dev/null and b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/Applications/{B317FB0C-A29C-41BA-9030-686D4920EFFC}.aas differ diff --git a/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/Applications/{CB506314-48D4-420C-B7A0-20B98E314140}.aas b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/Applications/{CB506314-48D4-420C-B7A0-20B98E314140}.aas new file mode 100644 index 0000000..8da8d7e Binary files /dev/null and b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/Applications/{CB506314-48D4-420C-B7A0-20B98E314140}.aas differ diff --git a/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf new file mode 100644 index 0000000..91061e3 Binary files /dev/null and b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf differ diff --git a/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/comment.cmtx b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/comment.cmtx new file mode 100644 index 0000000..4b8fa9f --- /dev/null +++ b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/comment.cmtx @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/registry.pol b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/registry.pol new file mode 100644 index 0000000..75e2a09 Binary files /dev/null and b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/DomainSysvol/GPO/Machine/registry.pol differ diff --git a/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/bkupInfo.xml b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/bkupInfo.xml new file mode 100644 index 0000000..28644dd --- /dev/null +++ b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/gpreport.xml b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/gpreport.xml new file mode 100644 index 0000000..96e24b5 Binary files /dev/null and b/LAPS/GPO/{8A583568-6BE3-4D47-B7C3-65D6AA4C8F5F}/gpreport.xml differ diff --git a/LAPS/LAPS_steps.ps1 b/LAPS/LAPS_steps.ps1 index cd89862..de8c433 100644 --- a/LAPS/LAPS_steps.ps1 +++ b/LAPS/LAPS_steps.ps1 @@ -1,18 +1,18 @@ Throw "this is not a robust file" $location = Get-Location -Set-Location C:\Tools\LAPS $dsnAME = (Get-ADDomain).DistinguishedName $domain = $env:USERDNSDOMAIN - -Throw "Please download LAPS from aka.ms/laps and put the msi files into the C:\Tools\LAPS\LAPS" +$ScriptsLocation = "C:\Tools\ADSecurity\LAPS" +Set-Location $ScriptsLocation #Copy LAPS msi files to sysvol - .\CopyTo-Sysvol.ps1 -FilesPath C:\ADSecurity\LAPS\LAPS -Verbose + Get-ChildItem -Path "$ScriptsLocation\LAPS\Binaries\Laps" |Unblock-File + .$ScriptsLocation\LAPS\Scripts\CopyTo-Sysvol.ps1 -FilesPath "$ScriptsLocation\LAPS\Binaries\LAPS" -DefaultSysvolPlacement -Verbose #schema extension with LAPS #64 on DC LAB - $lapsPath = "\\$Domain\SysVol\$Domain\Scripts\LAPS\LAPS.x64.msi" - $expression = "C:\Windows\System32\msiexec.exe /i $lapsPath ADDLOCAL=CSE,Management,Management.UI,Management.PS,Management.ADMX /quiet" - Invoke-Expression $expression + $lapsPath = "\\$Domain\SysVol\$Domain\Scripts\Laps\LAPS.x64.msi" + $expression = "C:\Windows\System32\msiexec.exe /i $LapsPath ADDLOCAL=CSE,Management,Management.UI,Management.PS,Management.ADMX /quiet" + Invoke-Expression $expression <# #64 on PAW $lapsPath = "\\$Domain\SysVol\$Domain\Scripts\LAPS.x64.msi" @@ -24,50 +24,39 @@ Throw "Please download LAPS from aka.ms/laps and put the msi files into the C:\T Invoke-Expression $expression #> #run as a member of schema admins group + start-sleep 60 Import-module AdmPwd.PS Update-AdmPwdADSchema + Import-module AdmPwd.PS #Allow computers to store passwords Import-module AdmPwd.PS - Set-AdmPwdComputerSelfPermission -Identity "OU=Devices,OU=Tier0,OU=Admin,$dsname" - Set-AdmPwdComputerSelfPermission -Identity "OU=Tier0 Servers,OU=Tier0,OU=Admin,$dsname" - Set-AdmPwdComputerSelfPermission -Identity "OU=Devices,OU=Tier1,OU=Admin,$dsname" - Set-AdmPwdComputerSelfPermission -Identity "OU=Tier 1 Servers,$dsname" - Set-AdmPwdComputerSelfPermission -Identity "OU=Workstations,$dsname" + Set-AdmPwdComputerSelfPermission -Identity "OU=PAW,OU=Tier0,OU=Admin,$dsname" + Set-AdmPwdComputerSelfPermission -Identity "OU=Servers,OU=Tier0,OU=Admin,$dsname" + Set-AdmPwdComputerSelfPermission -Identity "OU=PAW,OU=Tier1,OU=Admin,$dsname" + Set-AdmPwdComputerSelfPermission -Identity "OU=Servers,OU=Tier1,OU=Admin,$dsname" + Set-AdmPwdComputerSelfPermission -Identity "OU=Computers,OU=AzureBlog,$dsname" Set-AdmPwdComputerSelfPermission -Identity "OU=Quarantine,$dsname" #Allow users to read passwords Import-module AdmPwd.PS - Set-AdmPwdReadPasswordPermission -Identity "OU=Devices,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins" - Set-AdmPwdReadPasswordPermission -Identity "OU=Tier0 Servers,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins" - Set-AdmPwdReadPasswordPermission -Identity "OU=Devices,OU=Tier1,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins","tier1admins" - Set-AdmPwdReadPasswordPermission -Identity "OU=Tier 1 Servers,$dsname" -AllowedPrincipals "Domain Admins","tier1admins" - Set-AdmPwdReadPasswordPermission -Identity "OU=Workstations,$dsname" -AllowedPrincipals "Domain Admins","tier1admins" - Set-AdmPwdReadPasswordPermission -Identity "OU=Quarantine,$dsname" -AllowedPrincipals "Domain Admins","tier2admins" + Set-AdmPwdReadPasswordPermission -Identity "OU=PAW,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "t0-admins" + Set-AdmPwdReadPasswordPermission -Identity "OU=Servers,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "t0-admins" + Set-AdmPwdReadPasswordPermission -Identity "OU=PAW,OU=Tier1,OU=Admin,$dsname" -AllowedPrincipals "t0-admins","t1-admins" + Set-AdmPwdReadPasswordPermission -Identity "OU=Servers,OU=Tier1,OU=Admin,$dsname" -AllowedPrincipals "t0-admins","t1-admins" + Set-AdmPwdReadPasswordPermission -Identity "OU=Computers,OU=AzureBlog,$dsname" -AllowedPrincipals "t0-admins","t1-admins" + Set-AdmPwdReadPasswordPermission -Identity "OU=Quarantine,$dsname" -AllowedPrincipals "t0-admins","t2-admins" #Alow users to reset passwords Import-module AdmPwd.PS - Set-AdmPwdResetPasswordPermission -Identity "OU=Devices,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins" - Set-AdmPwdResetPasswordPermission -Identity "OU=Tier0 Servers,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins" - Set-AdmPwdResetPasswordPermission -Identity "OU=Devices,OU=Tier1,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins","tier1admins" - Set-AdmPwdResetPasswordPermission -Identity "OU=Tier 1 Servers,$dsname" -AllowedPrincipals "Domain Admins","tier1admins" - Set-AdmPwdResetPasswordPermission -Identity "OU=Workstations,$dsname" -AllowedPrincipals "Domain Admins","tier1admins" - Set-AdmPwdResetPasswordPermission -Identity "OU=Quarantine,$dsname" -AllowedPrincipals "Domain Admins","tier2admins" - -#LAPS Installation GPO - Name: LAPSInstallation-v1.0 - Source Starter GPO: (none) - GPO Status: User configuration settings disabled - Category Package Placement Deploy Software Additional Info - Software Installation \\$domain\sysvol\$domain\scripts\LAPS\LAPS.x64.msi Assigned - Category Package Placement Deploy Software Additional Info - Software Installation \\$domain\sysvol\$domainscripts\LAPS\LAPS.x86.msi Assigned Uncheck Make this 32-bit x86 appliction available to Win64 machines - -#LAPS Configuration Policy - Name: LAPSConfiguration-v1.0 - Source Starter GPO: (none) - GPO Status: User configuration settings disabled - Category Subcategory Policy Setting - - Administrative Templates LAPS Password Settings Enabled - Password Complexity: Large letters + small letters + numbers + specials + Set-AdmPwdResetPasswordPermission -Identity "OU=PAW,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "t0-admins" + Set-AdmPwdResetPasswordPermission -Identity "OU=Servers,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "t0-admins" + Set-AdmPwdResetPasswordPermission -Identity "OU=PAW,OU=Tier1,OU=Admin,$dsname" -AllowedPrincipals "t0-admins","t1-admins" + Set-AdmPwdResetPasswordPermission -Identity "OU=Servers,OU=Tier1,OU=Admin,$dsname" -AllowedPrincipals "t0-admins","t1-admins" + Set-AdmPwdResetPasswordPermission -Identity "OU=Computers,OU=AzureBlog,$dsname" -AllowedPrincipals "t0-admins","t1-admins" + Set-AdmPwdResetPasswordPermission -Identity "OU=Quarantine,$dsname" -AllowedPrincipals "t0-admins","t2-admins" + +#Gpo Import + $backupPath = "$ScriptsLocation\LAPS\GPO" + .$ScriptsLocation\LAPS\Scripts\Import-GPO.ps1 -BackupPath $backupPath -Verbose + cd $location diff --git a/LAPS/Scripts/CopyTo-Sysvol.ps1 b/LAPS/Scripts/CopyTo-Sysvol.ps1 new file mode 100644 index 0000000..ade6ea6 --- /dev/null +++ b/LAPS/Scripts/CopyTo-Sysvol.ps1 @@ -0,0 +1,74 @@ +<# + .SYNOPSIS + Run get-help -example CopyTo-Sysvol.ps1 for examples + + .EXAMPLE + .\CopyTo-Sysvol.ps1 -FilesPath C:\LAPS -DefaultSysvolPlacement -Verbose + VERBOSE: Declared SYSVOL path: 'C:\Windows\Sysvol\' + VERBOSE: Folder :'C:\Windows\Sysvol\\Sysvol\azureblog.pl\scripts' already exists + VERBOSE: Copying files from path 'C:\LAPS' to 'C:\Windows\Sysvol\Sysvol\azureblog.pl\scripts' using Recurse mode + + + Directory: C:\Windows\Sysvol\Sysvol\azureblog.pl\scripts + + + Mode LastWriteTime Length Name + ---- ------------- ------ ---- + d----- 02.02.2020 13:02 LAPS + + .EXAMPLE + .\CopyTo-Sysvol.ps1 -filesPath C:\LAPS -CustomSysvolPlacement -CustomSysvolPath C:\test -Verbose + VERBOSE: Declared SYSVOL path: 'C:\test' + VERBOSE: Folder :'C:\test\Sysvol\azureblog.pl\scripts' already exists + VERBOSE: Copying files from path 'C:\LAPS' to 'C:\test\Sysvol\azureblog.pl\scripts' using Recurse mode + + + Directory: C:\LAPS + + + Mode LastWriteTime Length Name + ---- ------------- ------ ---- + -a---- 05.12.2019 19:56 1019904 LAPS.x64.msi + -a---- 05.12.2019 19:56 991232 LAPS.x86.msi + +#> +[CmdletBinding(DefaultParametersetName = "DefaultSysvolPath")] +param ( + [parameter(Mandatory = $true)] + [ValidateScript( { Test-Path $_ })] + [string]$FilesPath, + [parameter(ParameterSetName = "DefaultSysvolPath")] + [switch]$DefaultSysvolPlacement, + [parameter(ParameterSetName = "CustomSysvolPath")] + [switch]$CustomSysvolPlacement, + [parameter(ParameterSetName = "CustomSysvolPath", Mandatory = $true)] + [ValidateScript( { Test-Path $_ })] + [string]$CustomSysvolPath +) + +$domain = $env:USERDNSDOMAIN +switch ($PsCmdlet.ParameterSetName) { + "DefaultSysvolPath" { + $sysvolPath = "C:\Windows\Sysvol" + } + "CustomSysvolPath" { + $sysvolPath = $CustomSysvolPath + } +} +Write-Host "Declared SYSVOL path: '$sysvolPath'" -ForegroundColor Green + +$scriptsPath = "$sysvolPath\Sysvol\$domain\scripts" +$scriptsTest = Test-Path -Path $scriptsPath +if ($scriptstest -eq $false) { + Write-Error "There is no such a folder: '$scriptsPath'" +} +$filesPathTest = Test-Path -Path $scriptsPath +if ($filesPathTest -eq $true) { + Write-Host "Folder :'$scriptsPath' already exists" -ForegroundColor Yellow +} + +Write-Host "Copying files from path '$FilesPath' to '$scriptsPath' using Recurse mode" -ForegroundColor Green +Write-Verbose 'Copy-Item -Path $FilesPath -Destination $scriptsPath -Recurse -Force' +Copy-Item -Path $FilesPath -Destination $scriptsPath -Recurse -Force + +Get-ChildItem -Path $scriptsPath diff --git a/LAPS/Scripts/Import-GPO.ps1 b/LAPS/Scripts/Import-GPO.ps1 new file mode 100644 index 0000000..624e346 --- /dev/null +++ b/LAPS/Scripts/Import-GPO.ps1 @@ -0,0 +1,36 @@ +<# + .Example + $BackupPath = Read-Host -Prompt "Please provide full path to GPO backups" + .\Import-GPO.ps1 -BackupPath $BackupPath -Verbose + +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $True)][string] $BackupPath, + [string] $GPOMigrationTable +) + +$backupList = Get-ChildItem -Path $BackupPath -Exclude "manifest.xml" +Set-Location $BackupPath +$location = Get-Location +foreach ($item in $backupList){ + $backupID = $null + $xmlFilePath = $null + $gpoName = $null + $backupID = $item.name -replace "{","" -replace "}","" + $xmlFilePath = ".\$($item.name)\gpreport.xml" + [xml]$xmlFile = Get-Content -Path $xmlFilePath + $gpoName = $xmlFile.GPO.Name + Write-Host "Importing new GPO '$gpoName' with GUID '$backupID'" -ForegroundColor Green + Write-Host "Please remember to update proper groups in GPO settings" -ForegroundColor Green + if ($GPOMigrationTable -eq "") { + Write-Verbose 'Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -CreateIfNeeded' + Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -CreateIfNeeded + } + else { + Write-Verbose 'Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -MigrationTable $GPOMigrationTable -CreateIfNeeded' + Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -MigrationTable $GPOMigrationTable -CreateIfNeeded + } + Set-Location $location +} \ No newline at end of file diff --git a/PAW/GPO/manifest.xml b/PAW/GPO/manifest.xml new file mode 100644 index 0000000..bf1020d --- /dev/null +++ b/PAW/GPO/manifest.xml @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/PAW/GPO/{09643CDF-4D0B-4865-9836-F7432F213B4A}/Backup.xml b/PAW/GPO/{09643CDF-4D0B-4865-9836-F7432F213B4A}/Backup.xml new file mode 100644 index 0000000..1dbd182 --- /dev/null +++ b/PAW/GPO/{09643CDF-4D0B-4865-9836-F7432F213B4A}/Backup.xml @@ -0,0 +1,20 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{09643CDF-4D0B-4865-9836-F7432F213B4A}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf b/PAW/GPO/{09643CDF-4D0B-4865-9836-F7432F213B4A}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf new file mode 100644 index 0000000..d3a6b02 Binary files /dev/null and b/PAW/GPO/{09643CDF-4D0B-4865-9836-F7432F213B4A}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf differ diff --git a/PAW/GPO/{09643CDF-4D0B-4865-9836-F7432F213B4A}/bkupInfo.xml b/PAW/GPO/{09643CDF-4D0B-4865-9836-F7432F213B4A}/bkupInfo.xml new file mode 100644 index 0000000..ce65ae8 --- /dev/null +++ b/PAW/GPO/{09643CDF-4D0B-4865-9836-F7432F213B4A}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/PAW/GPO/{09643CDF-4D0B-4865-9836-F7432F213B4A}/gpreport.xml b/PAW/GPO/{09643CDF-4D0B-4865-9836-F7432F213B4A}/gpreport.xml new file mode 100644 index 0000000..3c73701 Binary files /dev/null and b/PAW/GPO/{09643CDF-4D0B-4865-9836-F7432F213B4A}/gpreport.xml differ diff --git a/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/Backup.xml b/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/Backup.xml new file mode 100644 index 0000000..5b9f272 --- /dev/null +++ b/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/Backup.xml @@ -0,0 +1,20 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/DomainSysvol/GPO/Machine/Preferences/Groups/Groups.xml b/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/DomainSysvol/GPO/Machine/Preferences/Groups/Groups.xml new file mode 100644 index 0000000..a95052f --- /dev/null +++ b/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/DomainSysvol/GPO/Machine/Preferences/Groups/Groups.xml @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf b/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf new file mode 100644 index 0000000..b661eb8 Binary files /dev/null and b/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf differ diff --git a/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/DomainSysvol/GPO/Machine/registry.pol b/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/DomainSysvol/GPO/Machine/registry.pol new file mode 100644 index 0000000..5a00da1 Binary files /dev/null and b/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/DomainSysvol/GPO/Machine/registry.pol differ diff --git a/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/bkupInfo.xml b/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/bkupInfo.xml new file mode 100644 index 0000000..3250464 --- /dev/null +++ b/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/gpreport.xml b/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/gpreport.xml new file mode 100644 index 0000000..0f5b256 Binary files /dev/null and b/PAW/GPO/{28C348CE-97B1-49B9-BF68-B62BB1B2B6F2}/gpreport.xml differ diff --git a/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/Backup.xml b/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/Backup.xml new file mode 100644 index 0000000..6be6b8d --- /dev/null +++ b/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/Backup.xml @@ -0,0 +1,18 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/DomainSysvol/GPO/User/Preferences/Registry/Registry.xml b/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/DomainSysvol/GPO/User/Preferences/Registry/Registry.xml new file mode 100644 index 0000000..b6a9ae3 --- /dev/null +++ b/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/DomainSysvol/GPO/User/Preferences/Registry/Registry.xml @@ -0,0 +1,4 @@ + + + + diff --git a/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/DomainSysvol/GPO/User/comment.cmtx b/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/DomainSysvol/GPO/User/comment.cmtx new file mode 100644 index 0000000..1e4e4d5 --- /dev/null +++ b/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/DomainSysvol/GPO/User/comment.cmtx @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/DomainSysvol/GPO/User/registry.pol b/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/DomainSysvol/GPO/User/registry.pol new file mode 100644 index 0000000..aac722b Binary files /dev/null and b/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/DomainSysvol/GPO/User/registry.pol differ diff --git a/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/bkupInfo.xml b/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/bkupInfo.xml new file mode 100644 index 0000000..af580ef --- /dev/null +++ b/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/gpreport.xml b/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/gpreport.xml new file mode 100644 index 0000000..dc517e4 Binary files /dev/null and b/PAW/GPO/{40241693-44C9-4170-9290-8E8BE7A271FA}/gpreport.xml differ diff --git a/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/Backup.xml b/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/Backup.xml new file mode 100644 index 0000000..1b7d3b4 --- /dev/null +++ b/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/Backup.xml @@ -0,0 +1,18 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/DomainSysvol/GPO/User/Preferences/Registry/Registry.xml b/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/DomainSysvol/GPO/User/Preferences/Registry/Registry.xml new file mode 100644 index 0000000..f9fb30f --- /dev/null +++ b/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/DomainSysvol/GPO/User/Preferences/Registry/Registry.xml @@ -0,0 +1,3 @@ + + + diff --git a/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/DomainSysvol/GPO/User/comment.cmtx b/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/DomainSysvol/GPO/User/comment.cmtx new file mode 100644 index 0000000..1e4e4d5 --- /dev/null +++ b/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/DomainSysvol/GPO/User/comment.cmtx @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/DomainSysvol/GPO/User/registry.pol b/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/DomainSysvol/GPO/User/registry.pol new file mode 100644 index 0000000..3fbffbe Binary files /dev/null and b/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/DomainSysvol/GPO/User/registry.pol differ diff --git a/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/bkupInfo.xml b/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/bkupInfo.xml new file mode 100644 index 0000000..abd2257 --- /dev/null +++ b/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/gpreport.xml b/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/gpreport.xml new file mode 100644 index 0000000..2a0e42f Binary files /dev/null and b/PAW/GPO/{5BF7D886-3664-4716-97F7-32AF055F38DF}/gpreport.xml differ diff --git a/PAW/GPO/{76018172-90F7-4D1B-83B4-568B7808BDBC}/Backup.xml b/PAW/GPO/{76018172-90F7-4D1B-83B4-568B7808BDBC}/Backup.xml new file mode 100644 index 0000000..48986a6 --- /dev/null +++ b/PAW/GPO/{76018172-90F7-4D1B-83B4-568B7808BDBC}/Backup.xml @@ -0,0 +1,20 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{76018172-90F7-4D1B-83B4-568B7808BDBC}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf b/PAW/GPO/{76018172-90F7-4D1B-83B4-568B7808BDBC}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf new file mode 100644 index 0000000..10d8159 Binary files /dev/null and b/PAW/GPO/{76018172-90F7-4D1B-83B4-568B7808BDBC}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf differ diff --git a/PAW/GPO/{76018172-90F7-4D1B-83B4-568B7808BDBC}/bkupInfo.xml b/PAW/GPO/{76018172-90F7-4D1B-83B4-568B7808BDBC}/bkupInfo.xml new file mode 100644 index 0000000..c095d7a --- /dev/null +++ b/PAW/GPO/{76018172-90F7-4D1B-83B4-568B7808BDBC}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/PAW/GPO/{76018172-90F7-4D1B-83B4-568B7808BDBC}/gpreport.xml b/PAW/GPO/{76018172-90F7-4D1B-83B4-568B7808BDBC}/gpreport.xml new file mode 100644 index 0000000..ed9cabb Binary files /dev/null and b/PAW/GPO/{76018172-90F7-4D1B-83B4-568B7808BDBC}/gpreport.xml differ diff --git a/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/Backup.xml b/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/Backup.xml new file mode 100644 index 0000000..91e8aa3 --- /dev/null +++ b/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/Backup.xml @@ -0,0 +1,18 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/DomainSysvol/GPO/User/Preferences/Registry/Registry.xml b/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/DomainSysvol/GPO/User/Preferences/Registry/Registry.xml new file mode 100644 index 0000000..dc57b5f --- /dev/null +++ b/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/DomainSysvol/GPO/User/Preferences/Registry/Registry.xml @@ -0,0 +1,4 @@ + + + + diff --git a/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/DomainSysvol/GPO/User/comment.cmtx b/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/DomainSysvol/GPO/User/comment.cmtx new file mode 100644 index 0000000..1e4e4d5 --- /dev/null +++ b/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/DomainSysvol/GPO/User/comment.cmtx @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/DomainSysvol/GPO/User/registry.pol b/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/DomainSysvol/GPO/User/registry.pol new file mode 100644 index 0000000..aac722b Binary files /dev/null and b/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/DomainSysvol/GPO/User/registry.pol differ diff --git a/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/bkupInfo.xml b/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/bkupInfo.xml new file mode 100644 index 0000000..c0b406b --- /dev/null +++ b/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/gpreport.xml b/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/gpreport.xml new file mode 100644 index 0000000..284f59d Binary files /dev/null and b/PAW/GPO/{9301378B-D13F-4DAB-A7E3-7B1DF17E1534}/gpreport.xml differ diff --git a/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/Backup.xml b/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/Backup.xml new file mode 100644 index 0000000..bc320d1 --- /dev/null +++ b/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/Backup.xml @@ -0,0 +1,20 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/DomainSysvol/GPO/Machine/Preferences/Groups/Groups.xml b/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/DomainSysvol/GPO/Machine/Preferences/Groups/Groups.xml new file mode 100644 index 0000000..bc79d6b --- /dev/null +++ b/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/DomainSysvol/GPO/Machine/Preferences/Groups/Groups.xml @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf b/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf new file mode 100644 index 0000000..2bceed1 Binary files /dev/null and b/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf differ diff --git a/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/DomainSysvol/GPO/Machine/registry.pol b/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/DomainSysvol/GPO/Machine/registry.pol new file mode 100644 index 0000000..23a3474 Binary files /dev/null and b/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/DomainSysvol/GPO/Machine/registry.pol differ diff --git a/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/bkupInfo.xml b/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/bkupInfo.xml new file mode 100644 index 0000000..2060e67 --- /dev/null +++ b/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/gpreport.xml b/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/gpreport.xml new file mode 100644 index 0000000..668c1a4 Binary files /dev/null and b/PAW/GPO/{A6592F94-2D7C-4FA3-8B0C-9655F3AE83CF}/gpreport.xml differ diff --git a/PAW/GPO/{B3400906-DAE7-48A1-9F3F-1E2E117CF07B}/Backup.xml b/PAW/GPO/{B3400906-DAE7-48A1-9F3F-1E2E117CF07B}/Backup.xml new file mode 100644 index 0000000..4929948 --- /dev/null +++ b/PAW/GPO/{B3400906-DAE7-48A1-9F3F-1E2E117CF07B}/Backup.xml @@ -0,0 +1,20 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{B3400906-DAE7-48A1-9F3F-1E2E117CF07B}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf b/PAW/GPO/{B3400906-DAE7-48A1-9F3F-1E2E117CF07B}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf new file mode 100644 index 0000000..74016ab Binary files /dev/null and b/PAW/GPO/{B3400906-DAE7-48A1-9F3F-1E2E117CF07B}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf differ diff --git a/PAW/GPO/{B3400906-DAE7-48A1-9F3F-1E2E117CF07B}/bkupInfo.xml b/PAW/GPO/{B3400906-DAE7-48A1-9F3F-1E2E117CF07B}/bkupInfo.xml new file mode 100644 index 0000000..b68f4e5 --- /dev/null +++ b/PAW/GPO/{B3400906-DAE7-48A1-9F3F-1E2E117CF07B}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/PAW/GPO/{B3400906-DAE7-48A1-9F3F-1E2E117CF07B}/gpreport.xml b/PAW/GPO/{B3400906-DAE7-48A1-9F3F-1E2E117CF07B}/gpreport.xml new file mode 100644 index 0000000..345aa89 Binary files /dev/null and b/PAW/GPO/{B3400906-DAE7-48A1-9F3F-1E2E117CF07B}/gpreport.xml differ diff --git a/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/Backup.xml b/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/Backup.xml new file mode 100644 index 0000000..18f6e78 --- /dev/null +++ b/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/Backup.xml @@ -0,0 +1,18 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/DomainSysvol/GPO/User/Preferences/Registry/Registry.xml b/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/DomainSysvol/GPO/User/Preferences/Registry/Registry.xml new file mode 100644 index 0000000..c2a952a --- /dev/null +++ b/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/DomainSysvol/GPO/User/Preferences/Registry/Registry.xml @@ -0,0 +1,3 @@ + + + diff --git a/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/DomainSysvol/GPO/User/comment.cmtx b/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/DomainSysvol/GPO/User/comment.cmtx new file mode 100644 index 0000000..1e4e4d5 --- /dev/null +++ b/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/DomainSysvol/GPO/User/comment.cmtx @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/DomainSysvol/GPO/User/registry.pol b/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/DomainSysvol/GPO/User/registry.pol new file mode 100644 index 0000000..3fbffbe Binary files /dev/null and b/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/DomainSysvol/GPO/User/registry.pol differ diff --git a/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/bkupInfo.xml b/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/bkupInfo.xml new file mode 100644 index 0000000..b45e7b6 --- /dev/null +++ b/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/gpreport.xml b/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/gpreport.xml new file mode 100644 index 0000000..99221a9 Binary files /dev/null and b/PAW/GPO/{CC4086FF-885D-4788-86AC-A348C91923CA}/gpreport.xml differ diff --git a/PAW/GPO/{FA607D99-8C41-4373-B6A6-D3266E99C7F7}/Backup.xml b/PAW/GPO/{FA607D99-8C41-4373-B6A6-D3266E99C7F7}/Backup.xml new file mode 100644 index 0000000..7acfabe --- /dev/null +++ b/PAW/GPO/{FA607D99-8C41-4373-B6A6-D3266E99C7F7}/Backup.xml @@ -0,0 +1,20 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{FA607D99-8C41-4373-B6A6-D3266E99C7F7}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf b/PAW/GPO/{FA607D99-8C41-4373-B6A6-D3266E99C7F7}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf new file mode 100644 index 0000000..fed3b05 Binary files /dev/null and b/PAW/GPO/{FA607D99-8C41-4373-B6A6-D3266E99C7F7}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf differ diff --git a/PAW/GPO/{FA607D99-8C41-4373-B6A6-D3266E99C7F7}/bkupInfo.xml b/PAW/GPO/{FA607D99-8C41-4373-B6A6-D3266E99C7F7}/bkupInfo.xml new file mode 100644 index 0000000..e45375f --- /dev/null +++ b/PAW/GPO/{FA607D99-8C41-4373-B6A6-D3266E99C7F7}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/PAW/GPO/{FA607D99-8C41-4373-B6A6-D3266E99C7F7}/gpreport.xml b/PAW/GPO/{FA607D99-8C41-4373-B6A6-D3266E99C7F7}/gpreport.xml new file mode 100644 index 0000000..d01b3fe Binary files /dev/null and b/PAW/GPO/{FA607D99-8C41-4373-B6A6-D3266E99C7F7}/gpreport.xml differ diff --git a/PAW/GPO/{FD46ED83-28F1-448B-B383-7FEA9D0D532A}/Backup.xml b/PAW/GPO/{FD46ED83-28F1-448B-B383-7FEA9D0D532A}/Backup.xml new file mode 100644 index 0000000..9bb3caa --- /dev/null +++ b/PAW/GPO/{FD46ED83-28F1-448B-B383-7FEA9D0D532A}/Backup.xml @@ -0,0 +1,20 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 3d e4 74 e6 5c 7d 4e ce 7a 13 02 0b 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/PAW/GPO/{FD46ED83-28F1-448B-B383-7FEA9D0D532A}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf b/PAW/GPO/{FD46ED83-28F1-448B-B383-7FEA9D0D532A}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf new file mode 100644 index 0000000..b5fc14e Binary files /dev/null and b/PAW/GPO/{FD46ED83-28F1-448B-B383-7FEA9D0D532A}/DomainSysvol/GPO/Machine/microsoft/windows nt/SecEdit/GptTmpl.inf differ diff --git a/PAW/GPO/{FD46ED83-28F1-448B-B383-7FEA9D0D532A}/bkupInfo.xml b/PAW/GPO/{FD46ED83-28F1-448B-B383-7FEA9D0D532A}/bkupInfo.xml new file mode 100644 index 0000000..1cba580 --- /dev/null +++ b/PAW/GPO/{FD46ED83-28F1-448B-B383-7FEA9D0D532A}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/PAW/GPO/{FD46ED83-28F1-448B-B383-7FEA9D0D532A}/gpreport.xml b/PAW/GPO/{FD46ED83-28F1-448B-B383-7FEA9D0D532A}/gpreport.xml new file mode 100644 index 0000000..9bfa908 Binary files /dev/null and b/PAW/GPO/{FD46ED83-28F1-448B-B383-7FEA9D0D532A}/gpreport.xml differ diff --git a/PAW/PAW_steps.ps1 b/PAW/PAW_steps.ps1 index 4733d7b..e71c52a 100644 --- a/PAW/PAW_steps.ps1 +++ b/PAW/PAW_steps.ps1 @@ -1,69 +1,77 @@ Throw "this is not a robust file" $location = Get-Location -Set-Location C:\Tools\PAW +$dsnAME = (Get-ADDomain).DistinguishedName +$dNC = (Get-ADRootDSE).defaultNamingContext +$domain = $env:USERDNSDOMAIN +$ScriptsLocation = "C:\Tools\ADSecurity\PAW" +Set-Location $ScriptsLocation + +Import-Module ActiveDirectory #Region create Groups -$csv = Read-Host -Prompt "Please provide full path to Admin Groups csv file" -.\Create-Group.ps1 -CSVfile $csv -Verbose -$csv = Read-Host -Prompt "Please provide full path to Standard Groups csv file" -.\Create-Group.ps1 -CSVfile $csv -Verbose + $csv = Read-Host -Prompt "Please provide full path to Admin Groups csv file (without quotation marks)" + .$ScriptsLocation\Scripts\Create-Group.ps1 -CSVfile $csv -Verbose + $csv = Read-Host -Prompt "Please provide full path to Standard Groups csv file (without quotation marks)" + .$ScriptsLocation\Scripts\Create-Group.ps1 -CSVfile $csv -Verbose #endRegion #Region create Users -$csv = Read-Host -Prompt "Please provide full path to Users csv file" -.\Create-User.ps1 -CSVfile $csv -password zaq12WSXcde3 -Verbose + $csv = Read-Host -Prompt "Please provide full path to Users csv file (without quotation marks)" + .$ScriptsLocation\Scripts\Create-User.ps1 -CSVfile $csv -password zaq12WSXcde3 -Verbose #endRegion #region import GPO - Throw "Please update migration table file" - $BackupPath = Read-Host -Prompt "Please provide full path to GPO backups" - $GPOMigrationTable = Read-Host -Prompt "Please provide full path to GPO Migration Table" - .\Import-GPO.ps1 -BackupPath $BackupPath -GPOMigrationTable $GPOMigrationTable -Verbose - Set-Location C:\Tools\PAW - Write-Host "!!!!!!!!!!!!!!!! Please copy proxy.pac file to the Sysvol\Scripts\" -ForegroundColor Green + $backupPath = "$ScriptsLocation\GPO" + $migTable = "gpo_backup_" + $((Get-ADDOmain).NetBIOSName) + ".migtable" + $migTablePath = "$ScriptsLocation\Scripts\" + $migTable + Copy-Item -Path $ScriptsLocation\Scripts\gpo_backup.migtable -Destination $migTablePath + ((Get-Content -path $migTablePath -Raw) -replace 'CHANGEME', $dnsRoot )| Set-Content -Path $migTablePath + $gPOMigrationTable = (Get-ChildItem -Path "$ScriptsLocation\Scripts\" -Filter "$migTable").fullname + .$ScriptsLocation\Scripts\Import-GPO.ps1 -BackupPath $backupPath -GPOMigrationTable $gPOMigrationTable -Verbose + Set-Location $location #endregion #region Link gpo $GpoLinks = @( - $(New-Object PSObject -Property @{ Name = "Do Not Display Logon Information" ; OU = "OU=Devices,OU=Tier0,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Do Not Display Logon Information" ; OU = "OU=Tier0 Servers,OU=Tier0,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Do Not Display Logon Information" ; OU = "OU=Devices,OU=Tier1,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Do Not Display Logon Information" ; OU = "OU=Devices,OU=Tier2,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Do Not Display Logon Information" ; OU = "OU=Tier 1 Servers"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Do Not Display Logon Information" ; OU = "OU=Workstations"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Restrict Quarantine Logon" ; OU = "OU=Quarantine"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Tier0 Restrict Server Logon" ; OU = "OU=Devices,OU=Tier0,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Tier0 Restrict Server Logon" ; OU = "OU=Tier0 Servers,OU=Tier0,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Tier1 Restrict Server Logon" ; OU = "OU=Devices,OU=Tier1,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Tier1 Restrict Server Logon" ; OU = "OU=Tier 1 Servers"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Tier2 Restrict Workstation Logon" ; OU = "OU=Devices,OU=Tier2,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Tier2 Restrict Workstation Logon" ; OU = "OU=Workstations"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Tier0 PAW Configuration - Computer" ; OU = "OU=Devices,OU=Tier0,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Tier0 PAW Configuration - User" ; OU = "OU=Accounts,OU=Tier0,OU=Admin"; Order = 1 ;LinkEnabled = 'No'}), - $(New-Object PSObject -Property @{ Name = "Tier0 PAW Configuration - User PAC" ; OU = "OU=Accounts,OU=Tier0,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Tier1 PAW Configuration - Computer" ; OU = "OU=Devices,OU=Tier1,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), - $(New-Object PSObject -Property @{ Name = "Tier1 PAW Configuration - User" ; OU = "OU=Accounts,OU=Tier1,OU=Admin"; Order = 1 ;LinkEnabled = 'NO'}) - $(New-Object PSObject -Property @{ Name = "Tier1 PAW Configuration - User PAC" ; OU = "OU=Accounts,OU=Tier1,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}) + $(New-Object PSObject -Property @{ Name = "Do Not Display Logon Information" ; OU = "OU=Devices,OU=Tier0,OU=Admin"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Do Not Display Logon Information" ; OU = "OU=Devices,OU=Tier1,OU=Admin"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Do Not Display Logon Information" ; OU = "OU=Devices,OU=Tier2,OU=Admin"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Do Not Display Logon Information" ; OU = "OU=Tier 1 Servers"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Do Not Display Logon Information" ; OU = "OU=Workstations"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Restrict Quarantine Logon" ; OU = "OU=Quarantine"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Tier0 Restrict Server Logon" ; OU = "OU=Devices,OU=Tier0,OU=Admin"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Tier1 Restrict Server Logon" ; OU = "OU=Devices,OU=Tier1,OU=Admin"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Tier1 Restrict Server Logon" ; OU = "OU=Tier 1 Servers"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Tier2 Restrict Workstation Logon" ; OU = "OU=Devices,OU=Tier2,OU=Admin"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Tier2 Restrict Workstation Logon" ; OU = "OU=Workstations"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Tier0 PAW Configuration - Computer" ; OU = "OU=Devices,OU=Tier0,OU=Admin"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Tier0 PAW Configuration - User" ; OU = "OU=Accounts,OU=Tier0,OU=Admin"; Order = 1 ; LinkEnabled = 'No' }), + $(New-Object PSObject -Property @{ Name = "Tier0 PAW Configuration - User PAC" ; OU = "OU=Accounts,OU=Tier0,OU=Admin"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Tier1 PAW Configuration - Computer" ; OU = "OU=Devices,OU=Tier1,OU=Admin"; Order = 1 ; LinkEnabled = 'YES' }), + $(New-Object PSObject -Property @{ Name = "Tier1 PAW Configuration - User" ; OU = "OU=Accounts,OU=Tier1,OU=Admin"; Order = 1 ; LinkEnabled = 'NO' }) + $(New-Object PSObject -Property @{ Name = "Tier1 PAW Configuration - User PAC" ; OU = "OU=Accounts,OU=Tier1,OU=Admin"; Order = 1 ; LinkEnabled = 'YES' }) ) - .\Link-GpoToOU.ps1 -GpoLinks $GpoLinks -Verbose + .$ScriptsLocation\Scripts\Link-GpoToOU.ps1 -GpoLinks $GpoLinks -Verbose + Set-Location $location + dsa.msc gpmc.msc #endregion #region Setup Computer Objects - Get-ADComputer -Identity W10 | Move-ADObject -TargetPath "OU=Quarantine,DC=Azureblog,DC=pl" - Get-ADComputer -Identity SRV01 | Move-ADObject -TargetPath "OU=Devices,OU=Tier0,OU=Admin,DC=Azureblog,DC=pl" - Get-ADCOmputer -Identity W10 - Get-ADComputer -Identity SRV01 + Get-ADComputer -Identity vm-cl01-plc | Move-ADObject -TargetPath "OU=Quarantine,DC=Azureblog,DC=pl" + Get-ADComputer -Identity vm-srv01-plc | Move-ADObject -TargetPath "OU=Devices,OU=Tier0,OU=Admin,DC=Azureblog,DC=pl" + Get-ADCOmputer -Identity vm-cl01-plc + Get-ADComputer -Identity vm-srv01-plc #endregion -#region Tier0PAWUser on SRV01 +#region Tier0PAWUser on vm-srv01-plc whoami /groups net user testuser zaq12WSX /add [System.Net.WebProxy]::GetDefaultProxy() | select address #endregion -#region Tier0PAWMAintenancer on SRV01 +#region Tier0PAWMAintenancer on vm-srv01-plc whoami /groups net user testuser zaq12WSX /add net user testuser @@ -72,5 +80,3 @@ gpmc.msc #endregion Set-Location $location - - diff --git a/PAW/Reports/Do Not Display Logon Information.htm b/PAW/Reports/Do Not Display Logon Information.htm new file mode 100644 index 0000000..6c22032 Binary files /dev/null and b/PAW/Reports/Do Not Display Logon Information.htm differ diff --git a/PAW/Reports/Kerberos client support for claims.htm b/PAW/Reports/Kerberos client support for claims.htm new file mode 100644 index 0000000..e9ee847 Binary files /dev/null and b/PAW/Reports/Kerberos client support for claims.htm differ diff --git a/PAW/Reports/Restrict Quarantine Logon.htm b/PAW/Reports/Restrict Quarantine Logon.htm new file mode 100644 index 0000000..c19b319 Binary files /dev/null and b/PAW/Reports/Restrict Quarantine Logon.htm differ diff --git a/PAW/Reports/Tier0 PAW Configuration - Computer.htm b/PAW/Reports/Tier0 PAW Configuration - Computer.htm new file mode 100644 index 0000000..1f690a5 Binary files /dev/null and b/PAW/Reports/Tier0 PAW Configuration - Computer.htm differ diff --git a/PAW/Reports/Tier0 PAW Configuration - User PAC.htm b/PAW/Reports/Tier0 PAW Configuration - User PAC.htm new file mode 100644 index 0000000..8617d80 Binary files /dev/null and b/PAW/Reports/Tier0 PAW Configuration - User PAC.htm differ diff --git a/PAW/Reports/Tier0 PAW Configuration - User.htm b/PAW/Reports/Tier0 PAW Configuration - User.htm new file mode 100644 index 0000000..f35d96d Binary files /dev/null and b/PAW/Reports/Tier0 PAW Configuration - User.htm differ diff --git a/PAW/Reports/Tier0 Restrict Server Logon.htm b/PAW/Reports/Tier0 Restrict Server Logon.htm new file mode 100644 index 0000000..87faf71 Binary files /dev/null and b/PAW/Reports/Tier0 Restrict Server Logon.htm differ diff --git a/PAW/Reports/Tier1 PAW Configuration - Computer.htm b/PAW/Reports/Tier1 PAW Configuration - Computer.htm new file mode 100644 index 0000000..9021b18 Binary files /dev/null and b/PAW/Reports/Tier1 PAW Configuration - Computer.htm differ diff --git a/PAW/Reports/Tier1 PAW Configuration - User PAC.htm b/PAW/Reports/Tier1 PAW Configuration - User PAC.htm new file mode 100644 index 0000000..6aecfc0 Binary files /dev/null and b/PAW/Reports/Tier1 PAW Configuration - User PAC.htm differ diff --git a/PAW/Reports/Tier1 PAW Configuration - User.htm b/PAW/Reports/Tier1 PAW Configuration - User.htm new file mode 100644 index 0000000..1498b21 Binary files /dev/null and b/PAW/Reports/Tier1 PAW Configuration - User.htm differ diff --git a/PAW/Reports/Tier1 Restrict Server Logon.htm b/PAW/Reports/Tier1 Restrict Server Logon.htm new file mode 100644 index 0000000..90c9cc3 Binary files /dev/null and b/PAW/Reports/Tier1 Restrict Server Logon.htm differ diff --git a/PAW/Reports/Tier2 Restrict Workstation Logon.htm b/PAW/Reports/Tier2 Restrict Workstation Logon.htm new file mode 100644 index 0000000..bc92180 Binary files /dev/null and b/PAW/Reports/Tier2 Restrict Workstation Logon.htm differ diff --git a/PAW/Scripts/Create-Group.ps1 b/PAW/Scripts/Create-Group.ps1 new file mode 100644 index 0000000..94afb01 --- /dev/null +++ b/PAW/Scripts/Create-Group.ps1 @@ -0,0 +1,40 @@ +<# + .Example + $csv = Read-Host -Prompt "Please provide full path to Groups csv file" + .\Create-Group.ps1 -CSVfile $csv -Verbose + PS C:\Tools> $csv = Read-Host -Prompt "Please provide full path to Groups csv file" + Please provide full path to Groups csv file: c:\tools\groups.csv + PS C:\Tools> .\Create-Group.ps1 -CSVfile $csv -Verbose + VERBOSE: Creating new Group 'Tier0ReplicationMaintenance' under 'OU=Groups,OU=Tier0,OU=Admin,DC=azureblog,DC=pl' + VERBOSE: Creating new Group 'Tier1ServerMaintenance' under 'OU=Groups,OU=Tier1,OU=Admin,DC=azureblog,DC=pl' + VERBOSE: Creating new Group 'ServiceDeskOperators' under 'OU=Groups,OU=Tier2,OU=Admin,DC=azureblog,DC=pl' + VERBOSE: Creating new Group 'WorkstationMaintenance' under 'OU=Groups,OU=Tier2,OU=Admin,DC=azureblog,DC=pl' + VERBOSE: Group 'tier1admins'already exists. + VERBOSE: Group 'tier2admins'already exists. +#> + +[CmdletBinding()] +param( + [string] $CSVfile +) +$dNC = (Get-ADRootDSE).defaultNamingContext +$groups = Import-Csv $CSVfile +foreach ($group in $groups) { + $groupName = $group.Name + $groupOUPrefix = $group.OU + $destOU = $group.OU + "," + $dNC + $groupDN = "CN=" + $groupName + "," + $destOU + $checkForGroup = Get-ADGroup -filter 'Name -eq $groupName' -ErrorAction SilentlyContinue + If ($checkForGroup.count -eq 0 ) { + Write-Verbose "Creating new Group '$($Group.samAccountName)' under '$destOU'" + New-ADGroup -Name $Group.Name -SamAccountName $Group.samAccountName -GroupCategory $Group.GroupCategory -GroupScope $Group.GroupScope -DisplayName $Group.DisplayName -Path $destOU -Description $Group.Description + If ($Group.Membership -ne "") { + Write-Verbose "Adding Group Membership '$($Group.Membership)' for group '$($Group.samAccountName)'" + Add-ADPrincipalGroupMembership -Identity $Group.samAccountName -MemberOf $Group.Membership + } + $error.Clear() + } + Else { + Write-Verbose "Group '$($Group.samAccountName)'already exists." + } +} diff --git a/PAW/Scripts/Create-User.ps1 b/PAW/Scripts/Create-User.ps1 new file mode 100644 index 0000000..d13a76f --- /dev/null +++ b/PAW/Scripts/Create-User.ps1 @@ -0,0 +1,40 @@ +<# + .Example + $csv = Read-Host -Prompt "Please provide full path to Groups csv file" + .\Create-User.ps1 -CSVfile $csv -Password zaq12WSXcde3 -Verbose + +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory=$True)][string] $CSVfile, + [Parameter(Mandatory=$True)][string] $Password +) +$DNSRoot = (Get-ADDomain).DNSRoot +$DSN = (Get-ADDomain).DistinguishedName +$users = Import-Csv $CSVfile +foreach ($user in $users) { + $name = $user.name + $samAccountName = $user.samAccountName + $UserPrincipalName = $samAccountName + '@' + $DNSRoot + $parentOU = $user.ParentOU + ',' + $DSN + $groupMembership = $user.GroupMembership + $enabled = [bool]$user.enabled + $checkForUser = [bool]( Get-ADUSer -Filter {SamAccountname -eq $samaccountname}) + If ($checkForUser -eq $false) { + Write-Verbose "Creating new user '$samAccountName' under '$parentOU'" + New-ADUser -Name $name -Path $ParentOU -SamAccountName $samAccountName -UserPrincipalName $UserPrincipalName -AccountPassword (ConvertTo-SecureString $password -AsPlainText -Force) -ChangePasswordAtLogon $false -Enabled $enabled -EmailAddress $UserPrincipalName + start-sleep -Seconds 5 + if ($groupMembership -ne "") { + $groupMembership = ($user.GroupMembership) -split ',' + foreach ($group in $groupMembership){ + Write-Verbose "Adding User '$samAccountName' to Group '$group'" + Add-ADGroupMember -Identity $group -Members $samAccountName + } + } + $error.Clear() + } + Else { + Write-Verbose "User '$samAccountName' already exists." + } +} diff --git a/PAW/Scripts/Import-GPO.ps1 b/PAW/Scripts/Import-GPO.ps1 new file mode 100644 index 0000000..624e346 --- /dev/null +++ b/PAW/Scripts/Import-GPO.ps1 @@ -0,0 +1,36 @@ +<# + .Example + $BackupPath = Read-Host -Prompt "Please provide full path to GPO backups" + .\Import-GPO.ps1 -BackupPath $BackupPath -Verbose + +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $True)][string] $BackupPath, + [string] $GPOMigrationTable +) + +$backupList = Get-ChildItem -Path $BackupPath -Exclude "manifest.xml" +Set-Location $BackupPath +$location = Get-Location +foreach ($item in $backupList){ + $backupID = $null + $xmlFilePath = $null + $gpoName = $null + $backupID = $item.name -replace "{","" -replace "}","" + $xmlFilePath = ".\$($item.name)\gpreport.xml" + [xml]$xmlFile = Get-Content -Path $xmlFilePath + $gpoName = $xmlFile.GPO.Name + Write-Host "Importing new GPO '$gpoName' with GUID '$backupID'" -ForegroundColor Green + Write-Host "Please remember to update proper groups in GPO settings" -ForegroundColor Green + if ($GPOMigrationTable -eq "") { + Write-Verbose 'Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -CreateIfNeeded' + Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -CreateIfNeeded + } + else { + Write-Verbose 'Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -MigrationTable $GPOMigrationTable -CreateIfNeeded' + Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -MigrationTable $GPOMigrationTable -CreateIfNeeded + } + Set-Location $location +} \ No newline at end of file diff --git a/PAW/Scripts/Link-GpoToOU.ps1 b/PAW/Scripts/Link-GpoToOU.ps1 new file mode 100644 index 0000000..f710fa5 --- /dev/null +++ b/PAW/Scripts/Link-GpoToOU.ps1 @@ -0,0 +1,31 @@ +<# + .EXAMPLE + $GpoLinks = @( + $(New-Object PSObject -Property @{ Name = "POLICYNAME" ; OU = "OUPATH"; Order = 1; LinkEnabled = 'YES'}), + ) + .\Link-GpoToOU.ps1 -GpoLinks $GpoLinks -Verbose +#> + + +[CmdletBinding()] +param( + [Parameter(Mandatory = $True)][PSObject] $GpoLinks +) +Import-Module ActiveDirectory +$DC = (Get-ADDomain).DistinguishedName + +$GpoLinks | foreach-Object { + $name = $_.Name + $OU = $_.ou + $order = $_.Order + $LinkEnabled = $_.LinkEnabled + if ($OU -eq "") { + + $ouPath = $DC + } + else { + $ouPath = "$OU,$DC" + } + Write-Verbose "Linking GPO '$name' into OU '$ouPath'" + New-GPLink -Name $name -Target $ouPath -LinkEnabled $LinkEnabled -Order $order +} diff --git a/PAW/Scripts/gpo_backup.migtable b/PAW/Scripts/gpo_backup.migtable new file mode 100644 index 0000000..162de06 Binary files /dev/null and b/PAW/Scripts/gpo_backup.migtable differ diff --git a/PAW/Scripts/proxy.pac b/PAW/Scripts/proxy.pac new file mode 100644 index 0000000..7660af1 --- /dev/null +++ b/PAW/Scripts/proxy.pac @@ -0,0 +1,52 @@ +function FindProxyForURL(url, host) { + +if (shExpMatch(host, "*.aspnetcdn.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.aadrm.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.appex.bing.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.appex-rf.msn.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.assets-yammer.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.azure.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.azurecomcdn.net")) { return "DIRECT"; } +if (shExpMatch(host, "*.cloudappsecurity.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.c.bing.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.gfx.ms")) { return "DIRECT"; } +if (shExpMatch(host, "*.live.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.live.net")) { return "DIRECT"; } +if (shExpMatch(host, "*.lync.com")) { return "DIRECT"; } +if (shExpMatch(host, "maodatafeedsservice.cloudapp.net")) { return "DIRECT"; } +if (shExpMatch(host, "*.microsoft.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.microsoftonline.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.microsoftonline-p.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.microsoftonline-p.net")) { return "DIRECT"; } +if (shExpMatch(host, "*.microsoftonlineimages.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.microsoftonlinesupport.net")) { return "DIRECT"; } +if (shExpMatch(host, "ms.tific.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.msecnd.net")) { return "DIRECT"; } +if (shExpMatch(host, "*.msedge.net")) { return "DIRECT"; } +if (shExpMatch(host, "*.msft.net")) { return "DIRECT"; } +if (shExpMatch(host, "*.msocdn.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.onenote.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.outlook.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.office365.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.office.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.office.net")) { return "DIRECT"; } +if (shExpMatch(host, "*.onmicrosoft.com")) { return "DIRECT"; } +if (shExpMatch(host, "partnerservices.getmicrosoftkey.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.passport.net")) { return "DIRECT"; } +if (shExpMatch(host, "*.phonefactor.net")) { return "DIRECT"; } +if (shExpMatch(host, "*.s-microsoft.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.s-msn.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.sharepoint.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.sharepointonline.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.s-msn.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.symcb.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.yammer.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.yammerusercontent.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.verisign.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.windows.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.windows.net")) { return "DIRECT"; } +if (shExpMatch(host, "*.windowsazure.com")) { return "DIRECT"; } +if (shExpMatch(host, "*.windowsupdate.com")) { return "DIRECT"; } + +return "PROXY 127.0.0.2:8080"; +} \ No newline at end of file diff --git a/Tiering/DomainOUs.csv b/Tiering/DomainOUs.csv new file mode 100644 index 0000000..85f53a5 --- /dev/null +++ b/Tiering/DomainOUs.csv @@ -0,0 +1,38 @@ +Name,ParentOU +Admin, +Groups, +Tier 1 Servers, +Workstations, +User Accounts, +Quarantine, +Tier0,ou=Admin +Tier1,ou=Admin +Tier2,ou=Admin +Accounts,"ou=Tier0,ou=Admin" +Groups,"ou=Tier0,ou=Admin" +Service Accounts,"ou=Tier0,ou=Admin" +Devices,"ou=Tier0,ou=Admin" +Tier0 Servers,"ou=Tier0,ou=Admin" +Synchronisation,"ou=Tier0 Servers,ou=Tier0,ou=Admin" +Accounts,"ou=Tier1,ou=Admin" +Groups,"ou=Tier1,ou=Admin" +Service Accounts,"ou=Tier1,ou=Admin" +Devices,"ou=Tier1,ou=Admin" +Accounts,"ou=Tier2,ou=Admin" +Groups,"ou=Tier2,ou=Admin" +Service Accounts,"ou=Tier2,ou=Admin" +Devices,"ou=Tier2,ou=Admin" +Security Groups,ou=Groups +Distribution Groups,ou=Groups +Contacts,ou=Groups +Application,ou=Tier 1 Servers +Collaboration,ou=Tier 1 Servers +Database,ou=Tier 1 Servers +Messaging,ou=Tier 1 Servers +Staging,ou=Tier 1 Servers +Desktops,ou=Workstations +Kiosks,ou=Workstations +Laptops,ou=Workstations +Staging,ou=Workstations +Enabled Users,ou=User Accounts +Disabled Users,ou=User Accounts diff --git a/Tiering/Scripts/Create-Group.ps1 b/Tiering/Scripts/Create-Group.ps1 new file mode 100644 index 0000000..791f4ab --- /dev/null +++ b/Tiering/Scripts/Create-Group.ps1 @@ -0,0 +1,42 @@ +<# + .Example + $csv = Read-Host -Prompt "Please provide full path to Groups csv file" + .\Create-Group.ps1 -CSVfile $csv -Verbose + PS C:\Tools> $csv = Read-Host -Prompt "Please provide full path to Groups csv file" + Please provide full path to Groups csv file: c:\tools\groups.csv + PS C:\Tools> .\Create-Group.ps1 -CSVfile $csv -Verbose + VERBOSE: Creating new Group 'Tier0ReplicationMaintenance' under 'OU=Groups,OU=Tier0,OU=Admin,DC=azureblog,DC=pl' + VERBOSE: Creating new Group 'Tier1ServerMaintenance' under 'OU=Groups,OU=Tier1,OU=Admin,DC=azureblog,DC=pl' + VERBOSE: Creating new Group 'ServiceDeskOperators' under 'OU=Groups,OU=Tier2,OU=Admin,DC=azureblog,DC=pl' + VERBOSE: Creating new Group 'WorkstationMaintenance' under 'OU=Groups,OU=Tier2,OU=Admin,DC=azureblog,DC=pl' + VERBOSE: Group 'tier1admins'already exists. + VERBOSE: Group 'tier2admins'already exists. +#> + +[CmdletBinding()] +param( + [parameter(Mandatory = $true)][string] $CSVfile +) +$dNC = (Get-ADRootDSE).defaultNamingContext +$groups = Import-Csv $CSVfile +foreach ($group in $groups) { + $groupName = $group.Name + $groupOUPrefix = $group.OU + $destOU = $group.OU + "," + $dNC + $groupDN = "CN=" + $groupName + "," + $destOU + $checkForGroup = Get-ADGroup -filter 'Name -eq $groupName' -ErrorAction SilentlyContinue + If ($checkForGroup.count -eq 0 ) { + Write-Host "Creating new Group '$($Group.samAccountName)' under '$destOU'" -ForegroundColor Green + Write-Verbose 'New-ADGroup -Name $Group.Name -SamAccountName $Group.samAccountName -GroupCategory $Group.GroupCategory -GroupScope $Group.GroupScope -DisplayName $Group.DisplayName -Path $destOU -Description $Group.Description' + New-ADGroup -Name $Group.Name -SamAccountName $Group.samAccountName -GroupCategory $Group.GroupCategory -GroupScope $Group.GroupScope -DisplayName $Group.DisplayName -Path $destOU -Description $Group.Description + If ($Group.Membership -ne "") { + Write-Host "Adding Group Membership '$($Group.Membership)' for group '$($Group.samAccountName)'" -foreground Green + Write-Verbose 'Add-ADPrincipalGroupMembership -Identity $Group.samAccountName -MemberOf $Group.Membership' + Add-ADPrincipalGroupMembership -Identity $Group.samAccountName -MemberOf $Group.Membership + } + $error.Clear() + } + Else { + Write-Host "Group '$($Group.samAccountName)'already exists." -ForegroundColor Yellow + } +} diff --git a/Tiering/Scripts/Create-OU.ps1 b/Tiering/Scripts/Create-OU.ps1 new file mode 100644 index 0000000..0595989 --- /dev/null +++ b/Tiering/Scripts/Create-OU.ps1 @@ -0,0 +1,59 @@ +<# + .Example + Atempt to create OU that not exists in the desired path + $OUs = @( + $(New-Object PSObject -Property @{Name = "Desktops"; ParentOU = "ou=Workstations" }), + $(New-Object PSObject -Property @{Name = "Kiosks"; ParentOU = "ou=Workstations" }), + $(New-Object PSObject -Property @{Name = "Laptops"; ParentOU = "ou=Workstations" }), + $(New-Object PSObject -Property @{Name = "Staging"; ParentOU = "ou=Workstations" }) + ) + .\Create-OU.ps1 -OUs $OUs -Verbose + PS C:\Tools> .\Create-OU.ps1 -OUs $OUs -Verbose + VERBOSE: Creating new OU 'OU=Desktops,ou=Workstations,DC=azureblog,DC=pl' + VERBOSE: Creating new OU 'OU=Kiosks,ou=Workstations,DC=azureblog,DC=pl' + VERBOSE: Creating new OU 'OU=Laptops,ou=Workstations,DC=azureblog,DC=pl' + VERBOSE: Creating new OU 'OU=Staging,ou=Workstations,DC=azureblog,DC=pl' + .Example + Atempt to create OU that already exists in the desired path + $OUs = @( + $(New-Object PSObject -Property @{Name = "Desktops"; ParentOU = "ou=Workstations" }), + $(New-Object PSObject -Property @{Name = "Kiosks"; ParentOU = "ou=Workstations" }), + $(New-Object PSObject -Property @{Name = "Laptops"; ParentOU = "ou=Workstations" }), + $(New-Object PSObject -Property @{Name = "Staging"; ParentOU = "ou=Workstations" }) + ) + .\Create-OU.ps1 -OUs $OUs -Verbose + PS C:\Tools> .\Create-OU.ps1 -OUs $OUs -Verbose + VERBOSE: OU 'Desktops' already exists under 'ou=Workstations,DC=azureblog,DC=pl' + VERBOSE: OU 'Kiosks' already exists under 'ou=Workstations,DC=azureblog,DC=pl' + VERBOSE: OU 'Laptops' already exists under 'ou=Workstations,DC=azureblog,DC=pl' + VERBOSE: OU 'Staging' already exists under 'ou=Workstations,DC=azureblog,DC=pl +#> + +[CmdletBinding()] +param( + [parameter(Mandatory = $true)][PSObject] $OUs +) +$dNC = (Get-ADRootDSE).defaultNamingContext +$OUs | ForEach-Object { + $name = $_.Name + $parentOU = $_.ParentOU + + if ($ParentOU -eq '') { + $ouPath = "$dNC" + $testOUpath = "OU=$name,$dNC" + } + else { + $ouPath = "$parentOU,$dNC" + $testOUPath = "OU=$name,$parentOU,$dNC" + } + + $OUTest = (Get-ADOrganizationalUnit -Filter 'DistinguishedName -like $testOUpath' | Measure-Object).Count + if ($OUtest -eq 0) { + Write-Host "Creating new OU '$testOUPath'" -ForegroundColor Green + Write-Verbose 'New-ADOrganizationalUnit -Name $name -Path $OUPath -ProtectedFromAccidentalDeletion:$true' + New-ADOrganizationalUnit -Name $name -Path $OUPath -ProtectedFromAccidentalDeletion:$true + } + else { + Write-Host "OU '$name' already exists under '$ouPath'" -ForegroundColor Yellow + } +} diff --git a/Tiering/Scripts/Set-OUComputerPermissions.ps1 b/Tiering/Scripts/Set-OUComputerPermissions.ps1 new file mode 100644 index 0000000..dc778dc --- /dev/null +++ b/Tiering/Scripts/Set-OUComputerPermissions.ps1 @@ -0,0 +1,37 @@ +<# + .Example + $List = @( + $(New-Object PSObject -Property @{Group = "WorkstationMaintenance"; OUPrefix = "OU=Computer Quarantine"}), + $(New-Object PSObject -Property @{Group = "WorkstationMaintenance"; OUPrefix = "OU=Workstations"}), + $(New-Object PSObject -Property @{Group = "PAWMaint"; OUPrefix = "OU=Devices,OU=Tier 0,OU=Admin"}), + $(New-Object PSObject -Property @{Group = "Tier1ServerMaintenance"; OUPrefix = "OU=Tier 1 Servers"}) + ) + .\Set-OUComputerPermissions.ps1 -list $list -Verbose + +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $True)][PSOBject] $List +) +Import-Module ActiveDirectory + +$rootdse = Get-ADRootDSE +$domain = Get-ADDomain +$guidmap = @{ } +Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties lDAPDisplayName, schemaIDGUID | ForEach-Object { $guidmap[$_.lDAPDisplayName] = [System.GUID]$_.schemaIDGUID } + +$List | ForEach-Object { + $ouPrefix = $_.OUPrefix + $Group = $_.Group + $ouPath = "$OUPrefix,$($domain.DistinguishedName)" + $ou = Get-ADOrganizationalUnit -Identity $OUPAth + $adGroup = New-Object System.Security.Principal.SecurityIdentifier (Get-ADGroup -Identity $Group).SID + $acl = Get-ACL -Path "AD:$($ou.DistinguishedName)" + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "CreateChild,DeleteChild", "Allow", $guidmap["Computer"], "All")) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ReadProperty", "Allow", "Descendents", $guidmap["Computer"])) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "WriteProperty", "Allow", "Descendents", $guidmap["Computer"])) + Write-Host "Configuring Computer Permissions on '$ouPath' for group '$Group'" -ForegroundColor Green + Write-Verbose 'Set-ACL -ACLObject $acl -Path ("AD:\" + ($ou.DistinguishedName))' + Set-ACL -ACLObject $acl -Path ("AD:\" + ($ou.DistinguishedName)) +} diff --git a/Tiering/Scripts/Set-OUGPOPermissions.ps1 b/Tiering/Scripts/Set-OUGPOPermissions.ps1 new file mode 100644 index 0000000..12d40c5 --- /dev/null +++ b/Tiering/Scripts/Set-OUGPOPermissions.ps1 @@ -0,0 +1,36 @@ +<# + + .Example + $List = @( + $(New-Object PSObject -Property @{Group = "Tier1ServerMaintenance"; OUPrefix = "OU=Tier 1 Servers"}) + ) + .\Set-OUGPOPermissions.ps1 -list $list -Verbose + +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $True)][PSOBject] $List +) +Import-Module ActiveDirectory + +$rootdse = Get-ADRootDSE +$domain = Get-ADDomain +$guidmap = @{ } +Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties lDAPDisplayName, schemaIDGUID | ForEach-Object { $guidmap[$_.lDAPDisplayName] = [System.GUID]$_.schemaIDGUID } +$extendedrightsmap = @{ } +Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties displayName, rightsGuid | ForEach-Object { $extendedrightsmap[$_.displayName] = [System.GUID]$_.rightsGuid } + +$List | ForEach-Object { + $ouPrefix = $_.OUPrefix + $Group = $_.Group + $ouPath = "$OUPrefix,$($domain.DistinguishedName)" + $ou = Get-ADOrganizationalUnit -Identity $OUPAth + $adGroup = New-Object System.Security.Principal.SecurityIdentifier (Get-ADGroup -Identity $Group).SID + $acl = Get-ACL -Path "AD:$($ou.DistinguishedName)" + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ReadProperty,WriteProperty", "Allow", $guidmap["gplink"], "All")) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ReadProperty", "Allow", $guidmap["gpoptions"], "All")) + Write-Host "Configuring GPO Permissions on '$ouPath' for group '$Group'" -ForegroundColor Green + Write-Verbose 'Set-ACL -ACLObject $acl -Path ("AD:\" + ($ou.DistinguishedName))' + Set-ACL -ACLObject $acl -Path ("AD:\" + ($ou.DistinguishedName)) +} diff --git a/Tiering/Scripts/Set-OUGroupPermissions.ps1 b/Tiering/Scripts/Set-OUGroupPermissions.ps1 new file mode 100644 index 0000000..eaa6519 --- /dev/null +++ b/Tiering/Scripts/Set-OUGroupPermissions.ps1 @@ -0,0 +1,36 @@ +<# + .Example + $List = @( + $(New-Object PSObject -Property @{Group = "Tier1Admins"; OUPrefix = "OU=Groups,ou=Tier1,ou=Admin"}) + ) + .\Set-OUGroupPermissions.ps1 -list $list -Verbose +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $True)][PSOBject] $List + +) +Import-Module ActiveDirectory + +$rootdse = Get-ADRootDSE +$domain = Get-ADDomain +$guidmap = @{ } +Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties lDAPDisplayName, schemaIDGUID | ForEach-Object { $guidmap[$_.lDAPDisplayName] = [System.GUID]$_.schemaIDGUID } +$extendedrightsmap = @{ } +Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties displayName, rightsGuid | ForEach-Object { $extendedrightsmap[$_.displayName] = [System.GUID]$_.rightsGuid } + +$List | ForEach-Object { + $ouPrefix = $_.OUPrefix + $Group = $_.Group + $ouPath = "$OUPrefix,$($domain.DistinguishedName)" + $ou = Get-ADOrganizationalUnit -Identity $OUPAth + $adGroup = New-Object System.Security.Principal.SecurityIdentifier (Get-ADGroup -Identity $Group).SID + $acl = Get-ACL -Path "AD:$($ou.DistinguishedName)" + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "CreateChild", "Allow", $guidmap["group"], "ALL")) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ReadProperty", "Allow", "Descendents", $guidmap["group"])) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "WriteProperty", "Allow", "Descendents", $guidmap["group"])) + Write-Host "Configuring Group Permissions on '$ouPath' for group '$Group'" -ForegroundColor Green + Write-Verbose 'Set-ACL -ACLObject $acl -Path ("AD:\" + ($ou.DistinguishedName))' + Set-ACL -ACLObject $acl -Path ("AD:\" + ($ou.DistinguishedName)) +} diff --git a/Tiering/Scripts/Set-OUReplicationPermissions.ps1 b/Tiering/Scripts/Set-OUReplicationPermissions.ps1 new file mode 100644 index 0000000..327bb35 --- /dev/null +++ b/Tiering/Scripts/Set-OUReplicationPermissions.ps1 @@ -0,0 +1,47 @@ +<# + .Example + $List = @( + $(New-Object PSObject -Property @{Group = "Tier0ReplicationMaintenance"; OUPrefix = "" }) + ) + .\Set-OUReplicationPermissions.ps1 -list $list -Verbose +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $True)][PSOBject] $List + +) +Import-Module ActiveDirectory + +$rootdse = Get-ADRootDSE +$domain = Get-ADDomain +$guidmap = @{ } +Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties lDAPDisplayName, schemaIDGUID | ForEach-Object { $guidmap[$_.lDAPDisplayName] = [System.GUID]$_.schemaIDGUID } +$extendedrightsmap = @{ } +Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties displayName, rightsGuid | ForEach-Object { $extendedrightsmap[$_.displayName] = [System.GUID]$_.rightsGuid } + +$location = Get-Location +Set-Location AD: +$configCN = $rootdse.ConfigurationNamingContext +$schemaNC = $rootdse.SchemaNamingContext +$forestDnsZonesDN = "DC=ForestDnsZones," + $rootdse.RootDomainNamingContext +$sitesDN = "CN=Sites," + $configCN +$config = @($configCN, $schemaNC, $forestDnsZonesDN, $sitesDN) +$List | ForEach-Object { + $group = $_.Group + $adGroup = New-Object System.Security.Principal.SecurityIdentifier (Get-ADGroup -Identity $group).SID + foreach ($configEntry in $config) { + $acl = Get-ACL -Path($configEntry) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ExtendedRight", "Allow", $extendedrightsmap["Manage Replication Topology"], "Descendents")) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ExtendedRight", "Allow", $extendedrightsmap["Replicating Directory Changes"], "Descendents")) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ExtendedRight", "Allow", $extendedrightsmap["Replicating Directory Changes All"], "Descendents")) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ExtendedRight", "Allow", $extendedrightsmap["Replication Synchronization"], "Descendents")) + if ($configEntry -like "CN=Configuration*" -or $configEntry -like "CN=Schema*") { + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ExtendedRight", "Allow", $extendedrightsmap["Monitor active directory Replication"], "Descendents")) + } + Write-Host "Configuring Replication Maintenance Role Delegation on '$configEntry' for group '$group'" -ForegroundColor Green + Write-Verbose 'Set-ACL -ACLObject $acl -Path ("AD:\" + ($domain.DistinguishedName))' + Set-ACL -ACLObject $acl -Path ("AD:\" + ($domain.DistinguishedName)) + } +} +Set-Location $Location diff --git a/Tiering/Scripts/Set-OUUserPermissions.ps1 b/Tiering/Scripts/Set-OUUserPermissions.ps1 new file mode 100644 index 0000000..623e0e7 --- /dev/null +++ b/Tiering/Scripts/Set-OUUserPermissions.ps1 @@ -0,0 +1,41 @@ +<# + .Example + $List = @( + $(New-Object PSObject -Property @{Group = "ServiceDeskOperators"; OUPrefix = "OU=User Accounts"}) + ) + .\Set-OUUserPermissions.ps1 -list $list -Verbose +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $True)][PSOBject] $List + +) +Import-Module ActiveDirectory + +$rootdse = Get-ADRootDSE +$domain = Get-ADDomain +$guidmap = @{ } +Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties lDAPDisplayName, schemaIDGUID | ForEach-Object { $guidmap[$_.lDAPDisplayName] = [System.GUID]$_.schemaIDGUID } +$extendedrightsmap = @{ } +Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties displayName, rightsGuid | ForEach-Object { $extendedrightsmap[$_.displayName] = [System.GUID]$_.rightsGuid } + +$List | ForEach-Object { + $ouPrefix = $_.OUPrefix + $Group = $_.Group + $ouPath = "$OUPrefix,$($domain.DistinguishedName)" + $ou = Get-ADOrganizationalUnit -Identity $OUPAth + $adGroup = New-Object System.Security.Principal.SecurityIdentifier (Get-ADGroup -Identity $Group).SID + $acl = Get-ACL -Path "AD:$($ou.DistinguishedName)" + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "CreateChild", "Allow", $guidmap["user"], "ALL")) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ReadProperty", "Allow", "Descendents", $guidmap["user"])) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "WriteProperty", "Allow", "Descendents", $guidmap["user"])) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ExtendedRight", "Allow", $extendedrightsmap["Reset Password"], "Descendents", $guidmap["user"])) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ReadProperty", "Allow", $guidmap["lockoutTime"], "Descendents", $guidmap["user"])) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "WriteProperty", "Allow", $guidmap["lockoutTime"], "Descendents", $guidmap["user"])) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ReadProperty", "Allow", $guidmap["pwdLastSet"], "Descendents", $guidmap["user"])) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "WriteProperty", "Allow", $guidmap["pwdLastSet"], "Descendents", $guidmap["user"])) + Write-Host "Configuring User Permissions on '$ouPath' for group '$Group'" -ForegroundColor Green + Write-Verbose 'Set-ACL -ACLObject $acl -Path ("AD:\" + ($ou.DistinguishedName))' + Set-ACL -ACLObject $acl -Path ("AD:\" + ($ou.DistinguishedName)) +} diff --git a/Tiering/Scripts/Set-OUWorkstationPermissions.ps1 b/Tiering/Scripts/Set-OUWorkstationPermissions.ps1 new file mode 100644 index 0000000..a4503d2 --- /dev/null +++ b/Tiering/Scripts/Set-OUWorkstationPermissions.ps1 @@ -0,0 +1,35 @@ +<# + .Example + $List = @( + $(New-Object PSObject -Property @{Group = "ServiceDeskOperators"; OUPrefix = "OU=Workstations"}) + .\Set-OUWorkstationPermissions.ps1 -list $list -Verbose +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $True)][PSOBject] $List +) +Import-Module ActiveDirectory + +$rootdse = Get-ADRootDSE +$domain = Get-ADDomain +$guidmap = @{ } +Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties lDAPDisplayName, schemaIDGUID | ForEach-Object { $guidmap[$_.lDAPDisplayName] = [System.GUID]$_.schemaIDGUID } +$List | ForEach-Object { + $ouPrefix = $_.OUPrefix + $Group = $_.Group + $ouPath = "$OUPrefix,$($domain.DistinguishedName)" + $ou = Get-ADOrganizationalUnit -Identity $OUPAth + $adGroup = New-Object System.Security.Principal.SecurityIdentifier (Get-ADGroup -Identity $Group).SID + $acl = Get-ACL -Path "AD:$($ou.DistinguishedName)" + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "CreateChild", "Allow", $guidmap["Computer"], "All")) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ReadProperty", "Allow", "Descendents", $guidmap["Computer"])) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "WriteProperty", "Allow", "Descendents", $guidmap["Computer"])) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ReadProperty", "Allow", $guidmap["msTPM-OwnerInformation"], "Descendents", $guidmap["computer"])) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ReadProperty", "Allow", $guidmap["msFVE-KeyPackage"], "Descendents", $guidmap["msFVE-RecoveryInformation"])) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ReadProperty", "Allow", $guidmap["msFVE-RecoveryPassword"], "Descendents", $guidmap["msFVE-RecoveryInformation"])) + $acl.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adGroup, "ReadProperty", "Allow", $guidmap["msFVE-VolumeGuid"], "Descendents", $guidmap["msFVE-RecoveryInformation"])) + Write-Host "Configuring Workstation Permissions on '$ouPath' for group '$Group'" -ForegroundColor Green + Write-Verbose 'Set-ACL -ACLObject $acl -Path ("AD:\" + ($ou.DistinguishedName))' + Set-ACL -ACLObject $acl -Path ("AD:\" + ($ou.DistinguishedName)) +} diff --git a/Tiering/Tiering_steps.ps1 b/Tiering/Tiering_steps.ps1 index c669514..1ef30f5 100644 --- a/Tiering/Tiering_steps.ps1 +++ b/Tiering/Tiering_steps.ps1 @@ -1,9 +1,13 @@ throw "This is not a robus script" $location = Get-Location -Set-Location C:\Tools +$dsnAME = (Get-ADDomain).DistinguishedName +$dNC = (Get-ADRootDSE).defaultNamingContext +$domain = $env:USERDNSDOMAIN +$ScriptsLocation = "C:\Tools\ADSecurity\Tiering" +Set-Location $ScriptsLocation Import-Module ActiveDirectory -$dNC = (Get-ADRootDSE).defaultNamingContext + #region Create Top Level OU's @@ -15,10 +19,10 @@ $OUs = @( $(New-Object PSObject -Property @{Name = "User accounts"; ParentOU = "" }), $(New-Object PSObject -Property @{Name = "Quarantine"; ParentOU = "" }) ) -.\Create-OU.ps1 -OUs $OUs -Verbose +.$ScriptsLocation\Scripts\Create-OU.ps1 -OUs $OUs #endRegion -#region Create Sub Admin OU's +#region Create Tiering OUs v1 $OUs = @( $(New-Object PSObject -Property @{Name = "Tier0"; ParentOU = "ou=Admin" }), $(New-Object PSObject -Property @{Name = "Tier1"; ParentOU = "ou=Admin" }), @@ -37,16 +41,15 @@ $OUs = @( $(New-Object PSObject -Property @{Name = "Service Accounts"; ParentOU = "ou=Tier2,ou=Admin" }), $(New-Object PSObject -Property @{Name = "Devices"; ParentOU = "ou=Tier2,ou=Admin" }) ) -.\Create-OU.ps1 -OUs $OUs -Verbose -#endRegion +.$ScriptsLocation\Scripts\Create-OU.ps1 -OUs $OUs -#region Create Sub Groups OU's $OUs = @( $(New-Object PSObject -Property @{Name = "Security Groups"; ParentOU = "ou=Groups" }), $(New-Object PSObject -Property @{Name = "Distribution Groups"; ParentOU = "ou=Groups" }), $(New-Object PSObject -Property @{Name = "Contacts"; ParentOU = "ou=Groups" }) ) -.\Create-OU.ps1 -OUs $OUs -Verbose +.$ScriptsLocation\Scripts\Create-OU.ps1 -OUs $OUs + $OUs = @( $(New-Object PSObject -Property @{Name = "Application"; ParentOU = "ou=Tier 1 Servers" }), $(New-Object PSObject -Property @{Name = "Collaboration"; ParentOU = "ou=Tier 1 Servers" }), @@ -54,24 +57,28 @@ $OUs = @( $(New-Object PSObject -Property @{Name = "Messaging"; ParentOU = "ou=Tier 1 Servers" }), $(New-Object PSObject -Property @{Name = "Staging"; ParentOU = "ou=Tier 1 Servers" }) ) -.\Create-OU.ps1 -OUs $OUs -Verbose +.$ScriptsLocation\Scripts\Create-OU.ps1 -OUs $OUs + $OUs = @( $(New-Object PSObject -Property @{Name = "Desktops"; ParentOU = "ou=Workstations" }), $(New-Object PSObject -Property @{Name = "Kiosks"; ParentOU = "ou=Workstations" }), $(New-Object PSObject -Property @{Name = "Laptops"; ParentOU = "ou=Workstations" }), $(New-Object PSObject -Property @{Name = "Staging"; ParentOU = "ou=Workstations" }) ) -.\Create-OU.ps1 -OUs $OUs -Verbose -#endRegion +.$ScriptsLocation\Scripts\Create-OU.ps1 -OUs $OUs -#region Create Sub User Accounts OU's $OUs = @( $(New-Object PSObject -Property @{Name = "Enabled Users"; ParentOU = "ou=User Accounts" }), $(New-Object PSObject -Property @{Name = "Disabled Users"; ParentOU = "ou=User Accounts" }) ) -.\Create-OU.ps1 -OUs $OUs -Verbose +.$ScriptsLocation\Scripts\Create-OU.ps1 -OUs $OUs #endRegion +#create Tiering OUs v2 +$domainOUSCsv = Import-Csv -Path "$ScriptsLocation\DomainOUs.csv" +.$ScriptsLocation\Scripts\Create-OU.ps1 -OUs $domainOUSCsv +#endregion + #Region Block inheritance for PAW OUs Set-GpInheritance -Target "OU=Devices,OU=Tier0,OU=Admin,$dnc" -IsBlocked Yes | Out-Null Set-GpInheritance -Target "OU=Devices,OU=Tier1,OU=Admin,$dnc" -IsBlocked Yes | Out-Null @@ -79,10 +86,10 @@ Set-GpInheritance -Target "OU=Devices,OU=Tier2,OU=Admin,$dnc" -IsBlocked Yes | O #endRegion #Region create Groups -$csv = Read-Host -Prompt "Please provide full path to Admin Groups csv file" -.\Create-Group.ps1 -CSVfile $csv -Verbose -$csv = Read-Host -Prompt "Please provide full path to Standard Groups csv file" -.\Create-Group.ps1 -CSVfile $csv -Verbose +$csv = "$ScriptsLocation\AdminGroups.csv" +.$ScriptsLocation\Scripts\Create-Group.ps1 -CSVfile $csv +$csv = "$ScriptsLocation\StandardGroups.csv" +.$ScriptsLocation\Scripts\Create-Group.ps1 -CSVfile $csv #endRegion @@ -94,37 +101,37 @@ $List = @( $(New-Object PSObject -Property @{Group = "Tier2Admins"; OUPrefix = "OU=Accounts,ou=Tier2,ou=Admin" }), $(New-Object PSObject -Property @{Group = "Tier2Admins"; OUPrefix = "OU=Service Accounts,ou=Tier2,ou=Admin" }) ) -.\Set-OUUserPermissions.ps1 -list $list -Verbose +.$ScriptsLocation\Scripts\Set-OUUserPermissions.ps1 -list $list $List = @( $(New-Object PSObject -Property @{Group = "Tier2ServiceDeskOperators"; OUPrefix = "OU=Workstations" }), $(New-Object PSObject -Property @{Group = "Tier1Admins"; OUPrefix = "OU=Devices,ou=Tier1,ou=Admin" }), $(New-Object PSObject -Property @{Group = "Tier2Admins"; OUPrefix = "OU=Devices,ou=Tier2,ou=Admin" }) ) -.\Set-OUWorkstationPermissions.ps1 -list $list -Verbose +.$ScriptsLocation\Scripts\Set-OUWorkstationPermissions.ps1 -list $list $List = @( $(New-Object PSObject -Property @{Group = "Tier1Admins"; OUPrefix = "OU=Groups,ou=Tier1,ou=Admin"}), $(New-Object PSObject -Property @{Group = "Tier2Admins"; OUPrefix = "OU=Groups,ou=Tier2,ou=Admin"}) ) -.\Set-OUGroupPermissions.ps1 -list $list -Verbose +.$ScriptsLocation\Scripts\Set-OUGroupPermissions.ps1 -list $list $List = @( - $(New-Object PSObject -Property @{Group = "Tier2Tier2WorkstationMaintenance"; OUPrefix = "OU=Quarantine" }), + $(New-Object PSObject -Property @{Group = "Tier2WorkstationMaintenance"; OUPrefix = "OU=Quarantine" }), $(New-Object PSObject -Property @{Group = "Tier2WorkstationMaintenance"; OUPrefix = "OU=Workstations" }), $(New-Object PSObject -Property @{Group = "Tier1ServerMaintenance"; OUPrefix = "OU=Tier 1 Servers" }) ) -.\Set-OUComputerPermissions.ps1 -list $list -Verbose +.$ScriptsLocation\Scripts\Set-OUComputerPermissions.ps1 -list $list $List = @( $(New-Object PSObject -Property @{Group = "Tier0ReplicationMaintenance"; OUPrefix = "" }) ) -.\Set-OUReplicationPermissions.ps1 -list $list -Verbose +.$ScriptsLocation\Scripts\Set-OUReplicationPermissions.ps1 -list $list $List = @( $(New-Object PSObject -Property @{Group = "Tier1ServerMaintenance"; OUPrefix = "OU=Tier 1 Servers" }) ) -.\Set-OUGPOPermissions.ps1 -list $list -Verbose +.$ScriptsLocation\Scripts\Set-OUGPOPermissions.ps1 -list $list #endRegion diff --git a/WindowsLAPS/GPO/manifest.xml b/WindowsLAPS/GPO/manifest.xml new file mode 100644 index 0000000..857bbda --- /dev/null +++ b/WindowsLAPS/GPO/manifest.xml @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/Backup.xml b/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/Backup.xml new file mode 100644 index 0000000..f7d45c5 --- /dev/null +++ b/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/Backup.xml @@ -0,0 +1,18 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 92 2c 7b 90 9a 22 48 36 16 6a c5 ae 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 92 2c 7b 90 9a 22 48 36 16 6a c5 ae 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 92 2c 7b 90 9a 22 48 36 16 6a c5 ae 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/DomainSysvol/GPO/Machine/comment.cmtx b/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/DomainSysvol/GPO/Machine/comment.cmtx new file mode 100644 index 0000000..927f9a3 --- /dev/null +++ b/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/DomainSysvol/GPO/Machine/comment.cmtx @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/DomainSysvol/GPO/Machine/registry.pol b/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/DomainSysvol/GPO/Machine/registry.pol new file mode 100644 index 0000000..abb427e Binary files /dev/null and b/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/DomainSysvol/GPO/Machine/registry.pol differ diff --git a/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/bkupInfo.xml b/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/bkupInfo.xml new file mode 100644 index 0000000..4652741 --- /dev/null +++ b/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/gpreport.xml b/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/gpreport.xml new file mode 100644 index 0000000..7110156 Binary files /dev/null and b/WindowsLAPS/GPO/{22BC0CCF-E1A4-4D16-B3B9-5AA25D1735DB}/gpreport.xml differ diff --git a/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/Backup.xml b/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/Backup.xml new file mode 100644 index 0000000..2ea62f3 --- /dev/null +++ b/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/Backup.xml @@ -0,0 +1,18 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 92 2c 7b 90 9a 22 48 36 16 6a c5 ae 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 92 2c 7b 90 9a 22 48 36 16 6a c5 ae 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 92 2c 7b 90 9a 22 48 36 16 6a c5 ae 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/DomainSysvol/GPO/Machine/comment.cmtx b/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/DomainSysvol/GPO/Machine/comment.cmtx new file mode 100644 index 0000000..927f9a3 --- /dev/null +++ b/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/DomainSysvol/GPO/Machine/comment.cmtx @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/DomainSysvol/GPO/Machine/registry.pol b/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/DomainSysvol/GPO/Machine/registry.pol new file mode 100644 index 0000000..1a163b6 Binary files /dev/null and b/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/DomainSysvol/GPO/Machine/registry.pol differ diff --git a/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/bkupInfo.xml b/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/bkupInfo.xml new file mode 100644 index 0000000..a0dae09 --- /dev/null +++ b/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/gpreport.xml b/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/gpreport.xml new file mode 100644 index 0000000..c55f6c0 Binary files /dev/null and b/WindowsLAPS/GPO/{53E7FAC6-90D1-448F-9671-AC9638CC7495}/gpreport.xml differ diff --git a/WindowsLAPS/Reports/WindowsLAPS.htm b/WindowsLAPS/Reports/WindowsLAPS.htm new file mode 100644 index 0000000..241ec87 Binary files /dev/null and b/WindowsLAPS/Reports/WindowsLAPS.htm differ diff --git a/WindowsLAPS/Reports/WindowsLAPS_DSRM.htm b/WindowsLAPS/Reports/WindowsLAPS_DSRM.htm new file mode 100644 index 0000000..b1ae2fc Binary files /dev/null and b/WindowsLAPS/Reports/WindowsLAPS_DSRM.htm differ diff --git a/WindowsLAPS/Scripts/Import-GPO.ps1 b/WindowsLAPS/Scripts/Import-GPO.ps1 new file mode 100644 index 0000000..624e346 --- /dev/null +++ b/WindowsLAPS/Scripts/Import-GPO.ps1 @@ -0,0 +1,36 @@ +<# + .Example + $BackupPath = Read-Host -Prompt "Please provide full path to GPO backups" + .\Import-GPO.ps1 -BackupPath $BackupPath -Verbose + +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $True)][string] $BackupPath, + [string] $GPOMigrationTable +) + +$backupList = Get-ChildItem -Path $BackupPath -Exclude "manifest.xml" +Set-Location $BackupPath +$location = Get-Location +foreach ($item in $backupList){ + $backupID = $null + $xmlFilePath = $null + $gpoName = $null + $backupID = $item.name -replace "{","" -replace "}","" + $xmlFilePath = ".\$($item.name)\gpreport.xml" + [xml]$xmlFile = Get-Content -Path $xmlFilePath + $gpoName = $xmlFile.GPO.Name + Write-Host "Importing new GPO '$gpoName' with GUID '$backupID'" -ForegroundColor Green + Write-Host "Please remember to update proper groups in GPO settings" -ForegroundColor Green + if ($GPOMigrationTable -eq "") { + Write-Verbose 'Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -CreateIfNeeded' + Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -CreateIfNeeded + } + else { + Write-Verbose 'Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -MigrationTable $GPOMigrationTable -CreateIfNeeded' + Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -MigrationTable $GPOMigrationTable -CreateIfNeeded + } + Set-Location $location +} \ No newline at end of file diff --git a/WindowsLAPS/Scripts/Link-GpoToOU.ps1 b/WindowsLAPS/Scripts/Link-GpoToOU.ps1 new file mode 100644 index 0000000..f710fa5 --- /dev/null +++ b/WindowsLAPS/Scripts/Link-GpoToOU.ps1 @@ -0,0 +1,31 @@ +<# + .EXAMPLE + $GpoLinks = @( + $(New-Object PSObject -Property @{ Name = "POLICYNAME" ; OU = "OUPATH"; Order = 1; LinkEnabled = 'YES'}), + ) + .\Link-GpoToOU.ps1 -GpoLinks $GpoLinks -Verbose +#> + + +[CmdletBinding()] +param( + [Parameter(Mandatory = $True)][PSObject] $GpoLinks +) +Import-Module ActiveDirectory +$DC = (Get-ADDomain).DistinguishedName + +$GpoLinks | foreach-Object { + $name = $_.Name + $OU = $_.ou + $order = $_.Order + $LinkEnabled = $_.LinkEnabled + if ($OU -eq "") { + + $ouPath = $DC + } + else { + $ouPath = "$OU,$DC" + } + Write-Verbose "Linking GPO '$name' into OU '$ouPath'" + New-GPLink -Name $name -Target $ouPath -LinkEnabled $LinkEnabled -Order $order +} diff --git a/WindowsLAPS/WindowsLAPS_steps.ps1 b/WindowsLAPS/WindowsLAPS_steps.ps1 new file mode 100644 index 0000000..4b46017 --- /dev/null +++ b/WindowsLAPS/WindowsLAPS_steps.ps1 @@ -0,0 +1,63 @@ +Throw "this is not a robust file - and works on 2016 Domain Functional Level" + +$location = Get-Location +$dsnAME = (Get-ADDomain).DistinguishedName +$netbios = (Get-ADDomain).Name +$ScriptsLocation = "C:\Tools\ADSecurity\WindowsLAPS" +Set-Location $ScriptsLocation + +#Region Update Policy Definitions + Copy-Item C:\Windows\PolicyDefinitions -Recurse -Destination C:\Windows\Sysvol\domain\Policies\ -Force +#endREgion + + +#region WindowsLaps Schema + Update-LapsADSchema -Verbose +#endregion + +#region GrantPermissions + Set-LapsADComputerSelfPermission -Identity "OU=Devices,OU=Tier0,OU=Admin,$dsname" + Set-LapsADComputerSelfPermission -Identity "OU=Tier0 Servers,OU=Tier0,OU=Admin,$dsname" + Set-LapsADComputerSelfPermission -Identity "OU=Devices,OU=Tier1,OU=Admin,$dsname" + Set-LapsADComputerSelfPermission -Identity "OU=Tier 1 Servers,$dsname" + Set-LapsADComputerSelfPermission -Identity "CN=Computers,$dsname" + Set-LapsADComputerSelfPermission -Identity "OU=Quarantine,$dsname" +#endregion + +#region Allow users to read passwords + + Set-LapsADReadPasswordPermission -Identity "OU=Devices,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins" + Set-LapsADReadPasswordPermission -Identity "OU=Tier0 Servers,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins" + Set-LapsADReadPasswordPermission -Identity "OU=Devices,OU=Tier1,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins","$netbios\tier1admins" + Set-LapsADReadPasswordPermission -Identity "OU=Tier 1 Servers,$dsname" -AllowedPrincipals "Domain Admins","$netbios\tier1admins" + Set-LapsADReadPasswordPermission -Identity "CN=Computers,$dsname" -AllowedPrincipals "Domain Admins","$netbios\tier2admins" + Set-LapsADReadPasswordPermission -Identity "OU=Quarantine,$dsname" -AllowedPrincipals "Domain Admins","$netbios\tier2admins" +#endregion + +#region Alow users to reset passwords + Set-LapsADResetPasswordPermission -Identity "OU=Devices,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins" + Set-LapsADResetPasswordPermission -Identity "OU=Tier0 Servers,OU=Tier0,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins" + Set-LapsADResetPasswordPermission -Identity "OU=Devices,OU=Tier1,OU=Admin,$dsname" -AllowedPrincipals "Domain Admins","$netbios\tier1admins" + Set-LapsADResetPasswordPermission -Identity "OU=Tier 1 Servers,$dsname" -AllowedPrincipals "Domain Admins","$netbios\tier1admins" + Set-LapsADResetPasswordPermission -Identity "CN=Computers,$dsname" -AllowedPrincipals "Domain Admins","$netbios\tier2admins" + Set-LapsADResetPasswordPermission -Identity "OU=Quarantine,$dsname" -AllowedPrincipals "Domain Admins","$netbios\tier2admins" +#endregion + +#region GPOImport + $backupPath = "$ScriptsLocation\GPO" + .$ScriptsLocation\Scripts\Import-GPO.ps1 -BackupPath $backupPath -Verbose + cd $location +#endregion + +#region LinkGPO + $GpoLinks = @( + $(New-Object PSObject -Property @{ Name = "WindowsLAPS_DSRM" ; OU = "OU=Domain Controllers"; Order = 1 ;LinkEnabled = 'YES'}), + $(New-Object PSObject -Property @{ Name = "WindowsLAPS" ; OU = "OU=Devices,OU=Tier0,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), + $(New-Object PSObject -Property @{ Name = "WindowsLAPS" ; OU = "OU=Tier0 Servers,OU=Tier0,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), + $(New-Object PSObject -Property @{ Name = "WindowsLAPS" ; OU = "OU=Devices,OU=Tier1,OU=Admin"; Order = 1 ;LinkEnabled = 'YES'}), + $(New-Object PSObject -Property @{ Name = "WindowsLAPS" ; OU = "OU=Tier 1 Servers"; Order = 1 ;LinkEnabled = 'YES'}), + $(New-Object PSObject -Property @{ Name = "WindowsLAPS" ; OU = "OU=Quarantine"; Order = 1 ;LinkEnabled = 'YES'}) + ) + .$ScriptsLocation\Scripts\Link-GpoToOU.ps1 -GpoLinks $GpoLinks + cd $location +#endregion \ No newline at end of file diff --git a/WindowsLAPS/manifest.xml b/WindowsLAPS/manifest.xml new file mode 100644 index 0000000..89536c6 --- /dev/null +++ b/WindowsLAPS/manifest.xml @@ -0,0 +1 @@ + \ No newline at end of file