215 lines
7.5 KiB
PowerShell
215 lines
7.5 KiB
PowerShell
#Requires -Version 3 -RunAsAdministrator
|
|
#Requires -Modules ActiveDirectory, GroupPolicy
|
|
|
|
<#
|
|
.Synopsis
|
|
Import TIER GPO policy
|
|
.DESCRIPTION
|
|
Import GPO policy for TIERing and the necessary structure of objects
|
|
.EXAMPLE
|
|
|
|
.EXAMPLE
|
|
|
|
.EXAMPLE
|
|
|
|
.INPUTS
|
|
|
|
.NOTES
|
|
Author: Petr Štěpán
|
|
Email: pstepan@totalservice.cz
|
|
Release date: 13.2.2024
|
|
Revision date: 13.2.2024
|
|
Version: 1.0
|
|
.LINK
|
|
https://git.totalservice.cz/xxxxxxxx
|
|
https://totalservice.atlassian.net/browse/KB-316
|
|
#>
|
|
|
|
Param
|
|
(
|
|
# WorkFolderPath - working dir for script and download assets
|
|
[String]
|
|
$WorkFolderPath = (Join-Path -Path $env:homedrive -ChildPath 'Temp\TIER'),
|
|
|
|
# TranscriptFileName - File name of script log
|
|
[String]
|
|
$TranscriptFileName = 'Script.log'
|
|
|
|
|
|
|
|
|
|
|
|
)
|
|
|
|
Begin
|
|
{
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
#Start Transcript
|
|
Start-Transcript -Path (Join-Path -Path $WorkFolderPath -ChildPath $TranscriptFileName)
|
|
|
|
#Script start running time
|
|
$StartScriptTime = Get-Date
|
|
|
|
#### FUNCTIONS ###
|
|
#Sending messages to console
|
|
function Write-Message([string]$Message, [ValidateSet("Info","Warning","Error","Success")]$Severity="Info")
|
|
{
|
|
[string]$Time = (Get-Date -Format "HH:mm:ss").Trim()
|
|
[string]$Count = ((Get-Date) - $StartScriptTime)
|
|
|
|
switch($Severity)
|
|
{
|
|
"Info" {Write-Host $Time"|"$Count "-" $Message; Break}
|
|
"Warning" {Write-Host $Time"|"$Count "-" $Message -ForegroundColor Yellow; Break}
|
|
"Error" {Write-Host $Time"|"$Count "-" $Message -ForegroundColor Red; Break}
|
|
"Success" {Write-Host $Time"|"$Count "-" $Message -ForegroundColor Green; Break}
|
|
}
|
|
}
|
|
|
|
function Create-ADTierStructure([string]$DistinguishedName)
|
|
{
|
|
Write-Message -Message "Creating OU structure"
|
|
New-ADOrganizationalUnit -Name "Admins" -Path $DistinguishedName
|
|
New-ADOrganizationalUnit -Name "Domain" -Path "OU=Admins,$DistinguishedName"
|
|
New-ADOrganizationalUnit -Name "Servers" -Path "OU=Admins,$DistinguishedName"
|
|
New-ADOrganizationalUnit -Name "Workstations" -Path "OU=Admins,$DistinguishedName"
|
|
|
|
Write-Message -Message "Creating Security Groups"
|
|
$group = New-ADGroup -Name "AD Managers" -SamAccountName "AD Managers" -GroupCategory Security -GroupScope Global -DisplayName "AD Managers" -Path "OU=Domain,OU=Admins,$DistinguishedName" -Description "Group for managing un-privileged accounts in AD." -PassThru
|
|
$ADGroupMapping.ADManagers = "$($group.SamAccountName)@$FQDN"
|
|
|
|
$group = New-ADGroup -Name "Server Admins" -SamAccountName "Server Admins" -GroupCategory Security -GroupScope Global -DisplayName "Server Admins" -Path "OU=Servers,OU=Admins,$DistinguishedName" -Description "Managing servers in TIER 1" -PassThru
|
|
$ADGroupMapping.ServerAdmins = "$($group.SamAccountName)@$FQDN"
|
|
|
|
$group = New-ADGroup -Name "Workstation Admins" -SamAccountName "Workstation Admins" -GroupCategory Security -GroupScope Global -DisplayName "Workstation Admins" -Path "OU=Workstations,OU=Admins,$DistinguishedName" -Description "Managing workstations TIER 2" -PassThru
|
|
$ADGroupMapping.WorkstationAdmins = "$($group.SamAccountName)@$FQDN"
|
|
|
|
Write-Message -Message "Moving privileged grups to Admin\Domain OU."
|
|
Get-ADGroup "Domain Admins" | Move-ADObject -TargetPath "OU=Domain,OU=Admins,$DistinguishedName"
|
|
Get-ADGroup "Enterprise Admins" | Move-ADObject -TargetPath "OU=Domain,OU=Admins,$DistinguishedName"
|
|
Get-ADGroup "Schema Admins" | Move-ADObject -TargetPath "OU=Domain,OU=Admins,$DistinguishedName"
|
|
|
|
|
|
}
|
|
|
|
#### FUNCTIONS END ###
|
|
|
|
#Find FQDN and NetBIOS names
|
|
Write-Message -Message "Finding FQDN and NetBIOS name"
|
|
$FQDN = (Get-ADDomain).DNSRoot
|
|
$DistinguishedName = (Get-ADDomain).DistinguishedName
|
|
Write-Message -Message ('FQDN is: {0} and DistinguishedName is: {1}' -f $FQDN, $DistinguishedName)
|
|
|
|
#### VARIABLES ####
|
|
$ADGroupMapping = @{
|
|
"ServerAdmins" = ""
|
|
"WorkstationAdmins" = ""
|
|
"ADManagers" = ""
|
|
"Administrator" = "Administrator@$FQDN"
|
|
"DomainAdmins" = "Domain Admins@$FQDN"
|
|
"EnterpriseAdmins" = "Enterprise Admins@$FQDN"
|
|
}
|
|
#### END VARIABLES ####
|
|
|
|
|
|
}
|
|
Process
|
|
{
|
|
Write-Host "Example:
|
|
fqdn.contoso.com/
|
|
├─ Admins/
|
|
│ ├─ Domain/
|
|
│ │ ├─ AD Managers
|
|
│ ├─ Servers/
|
|
│ │ ├─ Server Admins
|
|
│ ├─ Workstations/
|
|
│ │ ├─ Workstation Admins
|
|
├─ .../
|
|
├─ .../
|
|
├─ Computers/"
|
|
|
|
$createDefaultADStructure = ''
|
|
do {
|
|
$answer = $(Write-Host "Do you want to import default OU and Security Groups structure? [Y/N] " -ForegroundColor Yellow -NoNewline; Read-Host)
|
|
|
|
switch (($answer).ToLower()) {
|
|
"y" { $createDefaultADStructure = $true; break; }
|
|
"n" { $createDefaultADStructure = $false; break;}
|
|
Default {}
|
|
}
|
|
} until (
|
|
($createDefaultADStructure -eq $true) -or ($createDefaultADStructure -eq $false)
|
|
)
|
|
|
|
if($createDefaultADStructure){
|
|
Write-Message -Message "Generating OU a Security Groups structure"
|
|
Create-ADTierStructure($DistinguishedName)
|
|
|
|
}else {
|
|
Write-Message -Message "Manual Security Group mapping choosen"
|
|
|
|
Write-Message -Message "Getting group name for Server Admins"
|
|
# Server Admins
|
|
do {
|
|
$exist = $false
|
|
$group = $(Write-Host "Enter SamAccount name of group for SERVER ADMINS: " -ForegroundColor Yellow -NoNewline; Read-Host)
|
|
$exist = Get-ADGroup -Filter {SamAccountName -eq $group}
|
|
|
|
if($exist -eq $null) {
|
|
Write-Message -Message ("Group {0} doesn't exist" -f $group) -Severity Error
|
|
}else{
|
|
$ADGroupMapping.ServerAdmins = "$($group)@$FQDN"
|
|
}
|
|
} until (
|
|
$exist -ne $null
|
|
)
|
|
|
|
Write-Message -Message "Getting group name for Workstation Admins"
|
|
# Workstation Admins
|
|
do {
|
|
$exist = $false
|
|
$group = $(Write-Host "Enter SamAccount name of group for WORKSTATION ADMINS: " -ForegroundColor Yellow -NoNewline; Read-Host)
|
|
$exist = Get-ADGroup -Filter {SamAccountName -eq $group}
|
|
|
|
if($exist -eq $null) {
|
|
Write-Message -Message ("Group {0} doesn't exist" -f $group) -Severity Error
|
|
}else{
|
|
$ADGroupMapping.WorkstationAdmins = "$($group)@$FQDN"
|
|
}
|
|
} until (
|
|
$exist -ne $null
|
|
)
|
|
|
|
Write-Message -Message "Getting group name for AD Managers"
|
|
# AD Managers
|
|
do {
|
|
$exist = $false
|
|
$group = $(Write-Host "Enter SamAccount name of group for AD MANAGERS: " -ForegroundColor Yellow -NoNewline; Read-Host)
|
|
$exist = Get-ADGroup -Filter {SamAccountName -eq $group}
|
|
|
|
if($exist -eq $null) {
|
|
Write-Message -Message ("Group {0} doesn't exist" -f $group) -Severity Error
|
|
}else{
|
|
$ADGroupMapping.ADManagers = "$($group)@$FQDN"
|
|
}
|
|
} until (
|
|
$exist -ne $null
|
|
)
|
|
}
|
|
|
|
# DEBUG
|
|
$ADGroupMapping
|
|
|
|
# TODO
|
|
#- přepsat hodnoty v migration tabulce
|
|
#- importovat GPO a zeptat se na názvy
|
|
|
|
}
|
|
End
|
|
{
|
|
#Stop Transcript
|
|
Write-Message -Message $(Stop-Transcript)
|
|
|
|
|
|
} |