Enforce SGU sign-in and session policies

2026-09-01 15:48:26 -06:00
parent 0391320a3e
commit a166193b66
9 changed files with 227 additions and 29 deletions
@@ -0,0 +1,95 @@
+[CmdletBinding(SupportsShouldProcess)]
+param(
+    [string]$TargetOuDn = 'OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx',
+    [string]$GpoName = 'SGU - User session restrictions',
+    [string]$DomainController = $env:COMPUTERNAME
+)
+
+$ErrorActionPreference = 'Stop'
+$policyKey = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System'
+$policyValueName = 'DisableLockWorkstation'
+
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$principal = [Security.Principal.WindowsPrincipal]::new($identity)
+if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'Run this script from an elevated Windows PowerShell session on a domain controller or management host.'
+}
+
+Import-Module ActiveDirectory -ErrorAction Stop
+Import-Module GroupPolicy -ErrorAction Stop
+
+$targetOu = Get-ADOrganizationalUnit `
+    -Identity $TargetOuDn `
+    -Server $DomainController `
+    -ErrorAction Stop
+$domainDn = ($targetOu.DistinguishedName -split ',DC=', 2)[1]
+if (-not $domainDn) {
+    throw 'TargetOuDn does not contain a domain distinguished name.'
+}
+$domainName = ($domainDn -replace ',DC=', '.')
+
+$gpo = Get-GPO -Name $GpoName -Domain $domainName -Server $DomainController -ErrorAction SilentlyContinue
+if (-not $gpo -and $PSCmdlet.ShouldProcess($GpoName, 'Create the SGU user policy GPO')) {
+    $gpo = New-GPO -Name $GpoName -Domain $domainName -Server $DomainController
+}
+if (-not $gpo) {
+    throw "The GPO '$GpoName' does not exist and was not created."
+}
+
+$existingLink = @(Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
+    Where-Object DisplayName -eq $GpoName |
+    Select-Object -First 1
+$existingLinkEnabled = $existingLink -and (
+    $existingLink.Enabled -eq $true -or
+    [string]$existingLink.Enabled -eq 'Yes')
+if (-not $existingLink) {
+    if ($PSCmdlet.ShouldProcess($TargetOuDn, "Link and enable '$GpoName'")) {
+        New-GPLink `
+            -Name $GpoName `
+            -Target $TargetOuDn `
+            -Domain $domainName `
+            -Server $DomainController `
+            -LinkEnabled Yes | Out-Null
+    }
+}
+elseif (-not $existingLinkEnabled -and
+    $PSCmdlet.ShouldProcess($TargetOuDn, "Enable the '$GpoName' link")) {
+    Set-GPLink `
+        -Name $GpoName `
+        -Target $TargetOuDn `
+        -Domain $domainName `
+        -Server $DomainController `
+        -LinkEnabled Yes | Out-Null
+}
+
+if ($PSCmdlet.ShouldProcess($GpoName, 'Prevent SGU users from manually locking workstations')) {
+    Set-GPRegistryValue `
+        -Name $GpoName `
+        -Domain $domainName `
+        -Server $DomainController `
+        -Key $policyKey `
+        -ValueName $policyValueName `
+        -Type DWord `
+        -Value 1 | Out-Null
+}
+
+$configuredValue = Get-GPRegistryValue `
+    -Name $GpoName `
+    -Domain $domainName `
+    -Server $DomainController `
+    -Key $policyKey `
+    -ValueName $policyValueName
+$link = @(Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
+    Where-Object DisplayName -eq $GpoName |
+    Select-Object -First 1
+$linkEnabled = $link -and (
+    $link.Enabled -eq $true -or
+    [string]$link.Enabled -eq 'Yes')
+
+[pscustomobject]@{
+    GpoName = $GpoName
+    GpoId = $gpo.Id
+    TargetOu = $TargetOuDn
+    LinkEnabled = [bool]$linkEnabled
+    DisableLockWorkstation = [int]$configuredValue.Value
+}