Add Azure user roaming and reproducible Laboratorio wallpaper policy

2026-09-17 16:40:44 -06:00
parent 7460f9316d
commit 7de6e2d867
18 changed files with 1258 additions and 6 deletions
@@ -0,0 +1,75 @@
+#Requires -Version 5.1
+[CmdletBinding(SupportsShouldProcess)]
+param(
+    [string]$TargetOuDn = 'OU=Laboratorio,DC=lci,DC=lasalle,DC=mx',
+    [string]$GpoName = 'SGU - Laboratorio wallpaper protection',
+    [string]$DomainController = $env:COMPUTERNAME,
+    [string]$WallpaperPath = '%LOCALAPPDATA%\SGU\Wallpapers\welcome-%COMPUTERNAME%.jpg'
+)
+
+$ErrorActionPreference = 'Stop'
+Import-Module ActiveDirectory -ErrorAction Stop
+Import-Module GroupPolicy -ErrorAction Stop
+$domainName = (Get-ADDomain -Server $DomainController).DNSRoot
+Get-ADOrganizationalUnit -Identity $TargetOuDn -Server $DomainController -ErrorAction Stop | Out-Null
+if (-not $PSCmdlet.ShouldProcess($TargetOuDn, "Apply '$GpoName' with enforced loopback Merge")) {
+    return
+}
+
+$backupPath = $null
+$gpo = Get-GPO -Name $GpoName -Domain $domainName -Server $DomainController -ErrorAction SilentlyContinue
+if ($gpo) {
+    $backupPath = Join-Path $env:ProgramData ('SGU\PolicyBackups\Wallpaper-' + [guid]::NewGuid().ToString('N'))
+    New-Item -ItemType Directory -Path $backupPath -Force | Out-Null
+    Backup-GPO -Guid $gpo.Id -Path $backupPath -Domain $domainName -Server $DomainController | Out-Null
+}
+else {
+    $gpo = New-GPO -Name $GpoName -Domain $domainName -Server $DomainController `
+        -Comment 'Protects the SGU desktop wallpaper on Laboratorio computers and child OUs; loopback Merge preserves existing user policies.'
+}
+
+# These are user policies scoped by the computer OU, not by the user OU.
+# Match the per-user/per-computer output of Set-SguWelcomeWallpaper.ps1.
+$settings = @(
+    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\System'; Name = 'UserPolicyMode'; Type = 'DWord'; Value = 1 },
+    @{ Key = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop'; Name = 'NoChangingWallPaper'; Type = 'DWord'; Value = 1 },
+    @{ Key = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System'; Name = 'Wallpaper'; Type = 'ExpandString'; Value = $WallpaperPath },
+    @{ Key = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System'; Name = 'WallpaperStyle'; Type = 'String'; Value = '10' }
+)
+foreach ($setting in $settings) {
+    Set-GPRegistryValue -Guid $gpo.Id -Domain $domainName -Server $DomainController `
+        -Key $setting.Key -ValueName $setting.Name -Type $setting.Type -Value $setting.Value | Out-Null
+}
+$linkParameters = @{
+    Guid = $gpo.Id
+    Target = $TargetOuDn
+    Domain = $domainName
+    Server = $DomainController
+    LinkEnabled = 'Yes'
+    Enforced = 'Yes'
+    Order = 1
+}
+$existingLink = (Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
+    Where-Object GpoId -eq $gpo.Id
+if ($existingLink) {
+    Set-GPLink @linkParameters | Out-Null
+}
+else {
+    New-GPLink @linkParameters | Out-Null
+}
+foreach ($setting in $settings) {
+    $actual = Get-GPRegistryValue -Guid $gpo.Id -Domain $domainName -Server $DomainController `
+        -Key $setting.Key -ValueName $setting.Name
+    if ([string]$actual.Value -ne [string]$setting.Value -or [string]$actual.Type -ne $setting.Type) {
+        throw "Wallpaper policy verification failed for $($setting.Name)."
+    }
+}
+[pscustomobject]@{
+    Name = $gpo.DisplayName
+    Id = $gpo.Id
+    TargetOuDn = $TargetOuDn
+    WallpaperPath = $WallpaperPath
+    Loopback = 'Merge'
+    Enforced = $true
+    BackupPath = $backupPath
+}