Add branded default provider and enforced enrollment

2026-09-01 11:20:06 -06:00
parent da01343985
commit f3afd62993
22 changed files with 787 additions and 17 deletions
@@ -0,0 +1,127 @@
+[CmdletBinding(SupportsShouldProcess)]
+param(
+    [Parameter(Mandatory)]
+    [string]$PublishPath,
+
+    [Parameter(Mandatory)]
+    [ValidatePattern('^https://')]
+    [string]$BrokerEndpoint,
+
+    [Parameter(Mandatory)]
+    [ValidatePattern('^[0-9A-Fa-f ]{40,59}$')]
+    [string]$ClientCertificateThumbprint,
+
+    [Parameter(Mandatory)]
+    [ValidatePattern('^[0-9A-Fa-f ]{40,59}$')]
+    [string]$ServerCertificateThumbprint,
+
+    [PSCredential]$DomainCredential,
+    [string]$DomainName = 'lci.lasalle.mx',
+    [string]$DomainNetbios = 'LCI',
+    [string]$NewComputerName,
+    [string]$NetworkInterfaceAlias = 'Ethernet',
+    [string[]]$DomainDnsServerAddresses = @('192.168.50.10'),
+    [string]$RemoteDesktopPrincipal = 'LCI\SG-Laboratorio-Usuarios-RDP',
+    [string]$DotNetRuntimeInstallerPath,
+    [switch]$SkipRestart
+)
+
+$ErrorActionPreference = 'Stop'
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$principal = [Security.Principal.WindowsPrincipal]::new($identity)
+if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'Run this script from an elevated Windows PowerShell session.'
+}
+
+foreach ($scriptName in @(
+    'Install-CredentialProvider.ps1',
+    'Install-SguEnrollmentGuard.ps1',
+    'Test-SguClientEnrollment.ps1',
+    'Repair-SguClientEnrollment.ps1',
+    'Enable-LabRemoteAccess.ps1')) {
+    if (-not (Test-Path -LiteralPath (Join-Path $PSScriptRoot $scriptName) -PathType Leaf)) {
+        throw "$scriptName must be beside Enroll-SguDomainClient.ps1."
+    }
+}
+
+$computer = Get-CimInstance Win32_ComputerSystem
+if ($computer.PartOfDomain -and $computer.Domain -ne $DomainName) {
+    throw "The computer is already joined to the unexpected domain $($computer.Domain)."
+}
+
+$installParams = @{
+    PublishPath = $PublishPath
+    BrokerEndpoint = $BrokerEndpoint
+    ClientCertificateThumbprint = $ClientCertificateThumbprint
+    ServerCertificateThumbprint = $ServerCertificateThumbprint
+    DomainNetbios = $DomainNetbios
+    TimeoutSeconds = 20
+}
+if ($DotNetRuntimeInstallerPath) {
+    $installParams.InstallDotNetRuntime = $true
+    $installParams.DotNetRuntimeInstallerPath = $DotNetRuntimeInstallerPath
+}
+
+$guardParams = @{
+    PublishPath = $PublishPath
+    BrokerEndpoint = $BrokerEndpoint
+    ClientCertificateThumbprint = $ClientCertificateThumbprint
+    ServerCertificateThumbprint = $ServerCertificateThumbprint
+    DomainNetbios = $DomainNetbios
+    TimeoutSeconds = 20
+    RemoteDesktopPrincipal = $RemoteDesktopPrincipal
+    DotNetRuntimeInstallerPath = $DotNetRuntimeInstallerPath
+}
+
+if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Install and verify SGU before joining the domain')) {
+    & (Join-Path $PSScriptRoot 'Install-CredentialProvider.ps1') @installParams | Out-Null
+    & (Join-Path $PSScriptRoot 'Install-SguEnrollmentGuard.ps1') @guardParams | Out-Null
+
+    $preJoin = & (Join-Path $PSScriptRoot 'Test-SguClientEnrollment.ps1') `
+        -RequireBrokerHealth
+    if (-not $preJoin.IsValid) {
+        throw "Domain join refused because SGU enrollment is invalid: $($preJoin.Issues -join ' ')"
+    }
+
+    if ($computer.PartOfDomain) {
+        & (Join-Path $PSScriptRoot 'Enable-LabRemoteAccess.ps1') `
+            -RemoteDesktopPrincipal $RemoteDesktopPrincipal `
+            -EnableAdministrativeFirewallGroups | Out-Null
+        return & (Join-Path $PSScriptRoot 'Test-SguClientEnrollment.ps1') `
+            -RequireDomainJoined `
+            -RequireRemoteAccess `
+            -RemoteDesktopPrincipal $RemoteDesktopPrincipal
+    }
+
+    Set-DnsClientServerAddress `
+        -InterfaceAlias $NetworkInterfaceAlias `
+        -ServerAddresses $DomainDnsServerAddresses
+    Resolve-DnsName -Type SRV "_ldap._tcp.dc._msdcs.$DomainName" -ErrorAction Stop | Out-Null
+
+    if (-not $DomainCredential) {
+        $DomainCredential = Get-Credential `
+            -UserName "$DomainNetbios\Administrator" `
+            -Message "Credential permitted to join this computer to $DomainName"
+    }
+
+    $joinParams = @{
+        DomainName = $DomainName
+        Credential = $DomainCredential
+        Force = $true
+    }
+    if ($NewComputerName) {
+        $joinParams.NewName = $NewComputerName
+    }
+    Add-Computer @joinParams
+
+    if (-not $SkipRestart) {
+        Restart-Computer -Force
+    }
+}
+
+[pscustomobject]@{
+    ComputerName = if ($NewComputerName) { $NewComputerName } else { $env:COMPUTERNAME }
+    DomainName = $DomainName
+    ProviderValidatedBeforeJoin = $true
+    RestartRequired = [bool]$SkipRestart
+}