Harden NTLM authentication and restore SGU profiles

scripts/Deploy-AuthBroker.ps1

@@ -31,8 +31,8 @@ param(
     [string]$DefaultCompany = 'Universidad La Salle',
     [ValidateRange(10, 60)]
     [int]$NtlmTimeoutSeconds = 20,
-    [ValidateRange(2, 30)]
-    [int]$ProfileTimeoutSeconds = 10,
+    [ValidateRange(2, 90)]
+    [int]$ProfileTimeoutSeconds = 60,
     [switch]$CreateMissingOus,
     [switch]$DisableCertificateRevocationCheckForLab
 )

scripts/Enroll-SguDomainClient.ps1

@@ -55,7 +55,7 @@ $installParams = @{
     ClientCertificateThumbprint = $ClientCertificateThumbprint
     ServerCertificateThumbprint = $ServerCertificateThumbprint
     DomainNetbios = $DomainNetbios
-    TimeoutSeconds = 35
+    TimeoutSeconds = 90
 }
 if ($DotNetRuntimeInstallerPath) {
     $installParams.InstallDotNetRuntime = $true
@@ -68,7 +68,7 @@ $guardParams = @{
     ClientCertificateThumbprint = $ClientCertificateThumbprint
     ServerCertificateThumbprint = $ServerCertificateThumbprint
     DomainNetbios = $DomainNetbios
-    TimeoutSeconds = 35
+    TimeoutSeconds = 90
     RemoteDesktopPrincipal = $RemoteDesktopPrincipal
     DotNetRuntimeInstallerPath = $DotNetRuntimeInstallerPath
 }

scripts/Install-CredentialProvider.ps1

@@ -17,8 +17,8 @@ param(
 
     [string]$DomainNetbios = 'LCI',
 
-    [ValidateRange(2, 60)]
-    [int]$TimeoutSeconds = 35,
+    [ValidateRange(2, 90)]
+    [int]$TimeoutSeconds = 90,
 
     [switch]$DoNotSetAsDefaultCredentialProvider,
 

scripts/Install-SguEnrollmentGuard.ps1

@@ -16,8 +16,8 @@ param(
     [string]$ServerCertificateThumbprint,
 
     [string]$DomainNetbios = 'LCI',
-    [ValidateRange(2, 60)]
-    [int]$TimeoutSeconds = 35,
+    [ValidateRange(2, 90)]
+    [int]$TimeoutSeconds = 90,
     [string]$RemoteDesktopPrincipal = 'LCI\SG-Laboratorio-Usuarios-RDP',
     [string]$DotNetRuntimeInstallerPath
 )

scripts/Test-Broker.ps1

@@ -23,7 +23,7 @@ if (-not $certificate -or -not $certificate.HasPrivateKey) {
 try {
     $body = @{ clave = $clave; password = $password } | ConvertTo-Json -Compress
     Invoke-RestMethod -Method Post -Uri $BrokerEndpoint -Certificate $certificate `
-        -ContentType 'application/json' -Body $body -TimeoutSec 20
+        -ContentType 'application/json' -Body $body -TimeoutSec 90
 }
 finally {
     $password = $null