Resolve SGU staff addresses and provision local student user

2026-09-09 09:48:06 -06:00
parent 8baa47fe1e
commit a6bd625e4e
15 changed files with 728 additions and 28 deletions
@@ -0,0 +1,84 @@
+#Requires -Version 5.1
+[CmdletBinding(SupportsShouldProcess)]
+param()
+
+$ErrorActionPreference = 'Stop'
+$userName = 'alumno'
+$plainTextPassword = 'ingenieria'
+$description = 'Cuenta local estandar de recuperacion para equipos SGU'
+
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$principal = [Security.Principal.WindowsPrincipal]::new($identity)
+if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'Run this script from an elevated Windows PowerShell session.'
+}
+
+if (-not $PSCmdlet.ShouldProcess($env:COMPUTERNAME, "Create or update standard local user $userName")) {
+    return
+}
+
+$securePassword = ConvertTo-SecureString $plainTextPassword -AsPlainText -Force
+try {
+    $user = Get-LocalUser -Name $userName -ErrorAction SilentlyContinue
+    if ($user -and $user.SID.Value.EndsWith('-500', [StringComparison]::Ordinal)) {
+        throw "The local account '$userName' is the built-in Administrator account and cannot be converted to a standard user."
+    }
+
+    if ($user) {
+        Set-LocalUser -Name $userName `
+            -Password $securePassword `
+            -PasswordNeverExpires $true `
+            -Description $description
+        if (-not $user.Enabled) {
+            Enable-LocalUser -Name $userName
+        }
+    }
+    else {
+        New-LocalUser -Name $userName `
+            -Password $securePassword `
+            -PasswordNeverExpires `
+            -Description $description | Out-Null
+    }
+
+    $user = Get-LocalUser -Name $userName -ErrorAction Stop
+    $administratorsSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-544')
+    $usersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-545')
+    $administratorsGroup = Get-LocalGroup -SID $administratorsSid -ErrorAction Stop
+    $usersGroup = Get-LocalGroup -SID $usersSid -ErrorAction Stop
+    $administratorMembers = @(Get-LocalGroupMember -Group $administratorsGroup -ErrorAction Stop)
+    if ($administratorMembers.SID.Value -contains $user.SID.Value) {
+        Remove-LocalGroupMember -Group $administratorsGroup -Member $user -Confirm:$false
+    }
+
+    $standardMembers = @(Get-LocalGroupMember -Group $usersGroup -ErrorAction Stop)
+    if ($standardMembers.SID.Value -notcontains $user.SID.Value) {
+        Add-LocalGroupMember -Group $usersGroup -Member $user
+    }
+}
+finally {
+    $securePassword = $null
+}
+
+$verifiedUser = Get-LocalUser -Name $userName -ErrorAction Stop
+$verifiedAdministratorsGroup = Get-LocalGroup `
+    -SID ([Security.Principal.SecurityIdentifier]::new('S-1-5-32-544')) `
+    -ErrorAction Stop
+$verifiedUsersGroup = Get-LocalGroup `
+    -SID ([Security.Principal.SecurityIdentifier]::new('S-1-5-32-545')) `
+    -ErrorAction Stop
+$verifiedAdministrators = @(Get-LocalGroupMember -Group $verifiedAdministratorsGroup -ErrorAction Stop)
+$verifiedUsers = @(Get-LocalGroupMember -Group $verifiedUsersGroup -ErrorAction Stop)
+if (@($verifiedAdministrators).SID.Value -contains $verifiedUser.SID.Value) {
+    throw "The local account '$userName' still belongs to the local Administrators group."
+}
+if ($verifiedUsers.SID.Value -notcontains $verifiedUser.SID.Value) {
+    throw "The local account '$userName' does not belong to the local Users group."
+}
+
+[pscustomobject]@{
+    UserName = $verifiedUser.Name
+    Enabled = $verifiedUser.Enabled
+    IsAdministrator = $false
+    IsStandardUser = $true
+    PasswordNeverExpires = $verifiedUser.PasswordNeverExpires
+}