Add six-month domain and broker monitoring

scripts/Set-SguDomainComputerPolicies.ps1

@@ -2,7 +2,8 @@
 param(
     [string]$TargetOuDn = 'OU=Laboratorio,DC=lci,DC=lasalle,DC=mx',
     [string]$GpoName = 'SGU - Windows client experience',
-    [string]$DomainController = $env:COMPUTERNAME
+    [string]$DomainController = $env:COMPUTERNAME,
+    [string]$EventCollectorFqdn
 )
 
 $ErrorActionPreference = 'Stop'
@@ -24,6 +25,14 @@ if (-not $domainDn) {
     throw 'TargetOuDn does not contain a domain distinguished name.'
 }
 $domainName = ($domainDn -replace ',DC=', '.')
+if (-not $EventCollectorFqdn) {
+    $collectorComputer = Get-ADComputer -Identity $DomainController -Properties DNSHostName `
+        -Server $DomainController -ErrorAction Stop
+    $EventCollectorFqdn = $collectorComputer.DNSHostName
+}
+if (-not $EventCollectorFqdn) {
+    throw 'Could not determine the event collector FQDN.'
+}
 
 $gpo = Get-GPO -Name $GpoName -Domain $domainName -Server $DomainController -ErrorAction SilentlyContinue
 if (-not $gpo -and $PSCmdlet.ShouldProcess($GpoName, 'Create the SGU Windows client policy GPO')) {
@@ -64,6 +73,8 @@ $powerPolicyRoot = 'HKLM\Software\Policies\Microsoft\Power\PowerSettings'
 $credentialProviderPolicyKey = 'HKLM\Software\Policies\Microsoft\Windows\System'
 $interactiveLogonPolicyKey = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System'
 $accountPicturePolicyKey = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
+$eventForwardingPolicyKey = 'HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager'
+$auditPolicyKey = 'HKLM\System\CurrentControlSet\Control\Lsa'
 $providerClassId = '{D789CFD8-5AD4-489F-9B83-7EB5D9D09335}'
 $policies = @(
     @{ Key = $dataCollectionKey; Name = 'AllowTelemetry'; Type = 'DWord'; Value = 0 },
@@ -83,7 +94,12 @@ $policies = @(
 
     # Use Windows' native default account image for named user tiles. LogonUI
     # retains ownership of the anonymous Other user tile and its circular mask.
-    @{ Key = $accountPicturePolicyKey; Name = 'UseDefaultTile'; Type = 'DWord'; Value = 1 }
+    @{ Key = $accountPicturePolicyKey; Name = 'UseDefaultTile'; Type = 'DWord'; Value = 1 },
+
+    # Source-initiated Windows Event Forwarding. Kerberos authenticates domain
+    # computers to the collector; no SGU password or reusable secret is logged.
+    @{ Key = $eventForwardingPolicyKey; Name = '1'; Type = 'String'; Value = "Server=http://${EventCollectorFqdn}:5985/wsman/SubscriptionManager/WEC,Refresh=300" },
+    @{ Key = $auditPolicyKey; Name = 'SCENoApplyLegacyAuditPolicy'; Type = 'DWord'; Value = 1 }
 )
 
 $powerSettingIds = @(
@@ -134,5 +150,6 @@ $linkEnabled = $link -and (
     TargetOu = $TargetOuDn
     LinkEnabled = [bool]$linkEnabled
     PolicyCount = $configuredPolicies.Count
+    EventCollector = $EventCollectorFqdn
     Policies = [pscustomobject]$configuredPolicies
 }