128 lines
4.4 KiB
PowerShell
128 lines
4.4 KiB
PowerShell
[CmdletBinding(SupportsShouldProcess)]
|
|
param(
|
|
[Parameter(Mandatory)]
|
|
[string]$PublishPath,
|
|
|
|
[Parameter(Mandatory)]
|
|
[ValidatePattern('^https://')]
|
|
[string]$BrokerEndpoint,
|
|
|
|
[Parameter(Mandatory)]
|
|
[ValidatePattern('^[0-9A-Fa-f ]{40,59}$')]
|
|
[string]$ClientCertificateThumbprint,
|
|
|
|
[Parameter(Mandatory)]
|
|
[ValidatePattern('^[0-9A-Fa-f ]{40,59}$')]
|
|
[string]$ServerCertificateThumbprint,
|
|
|
|
[PSCredential]$DomainCredential,
|
|
[string]$DomainName = 'lci.lasalle.mx',
|
|
[string]$DomainNetbios = 'LCI',
|
|
[string]$NewComputerName,
|
|
[string]$NetworkInterfaceAlias = 'Ethernet',
|
|
[string[]]$DomainDnsServerAddresses = @('192.168.50.10'),
|
|
[string]$RemoteDesktopPrincipal = 'LCI\SG-Laboratorio-Usuarios-RDP',
|
|
[string]$DotNetRuntimeInstallerPath,
|
|
[switch]$SkipRestart
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
|
$principal = [Security.Principal.WindowsPrincipal]::new($identity)
|
|
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
|
throw 'Run this script from an elevated Windows PowerShell session.'
|
|
}
|
|
|
|
foreach ($scriptName in @(
|
|
'Install-CredentialProvider.ps1',
|
|
'Install-SguEnrollmentGuard.ps1',
|
|
'Test-SguClientEnrollment.ps1',
|
|
'Repair-SguClientEnrollment.ps1',
|
|
'Enable-LabRemoteAccess.ps1')) {
|
|
if (-not (Test-Path -LiteralPath (Join-Path $PSScriptRoot $scriptName) -PathType Leaf)) {
|
|
throw "$scriptName must be beside Enroll-SguDomainClient.ps1."
|
|
}
|
|
}
|
|
|
|
$computer = Get-CimInstance Win32_ComputerSystem
|
|
if ($computer.PartOfDomain -and $computer.Domain -ne $DomainName) {
|
|
throw "The computer is already joined to the unexpected domain $($computer.Domain)."
|
|
}
|
|
|
|
$installParams = @{
|
|
PublishPath = $PublishPath
|
|
BrokerEndpoint = $BrokerEndpoint
|
|
ClientCertificateThumbprint = $ClientCertificateThumbprint
|
|
ServerCertificateThumbprint = $ServerCertificateThumbprint
|
|
DomainNetbios = $DomainNetbios
|
|
TimeoutSeconds = 35
|
|
}
|
|
if ($DotNetRuntimeInstallerPath) {
|
|
$installParams.InstallDotNetRuntime = $true
|
|
$installParams.DotNetRuntimeInstallerPath = $DotNetRuntimeInstallerPath
|
|
}
|
|
|
|
$guardParams = @{
|
|
PublishPath = $PublishPath
|
|
BrokerEndpoint = $BrokerEndpoint
|
|
ClientCertificateThumbprint = $ClientCertificateThumbprint
|
|
ServerCertificateThumbprint = $ServerCertificateThumbprint
|
|
DomainNetbios = $DomainNetbios
|
|
TimeoutSeconds = 35
|
|
RemoteDesktopPrincipal = $RemoteDesktopPrincipal
|
|
DotNetRuntimeInstallerPath = $DotNetRuntimeInstallerPath
|
|
}
|
|
|
|
if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Install and verify SGU before joining the domain')) {
|
|
& (Join-Path $PSScriptRoot 'Install-CredentialProvider.ps1') @installParams | Out-Null
|
|
& (Join-Path $PSScriptRoot 'Install-SguEnrollmentGuard.ps1') @guardParams | Out-Null
|
|
|
|
$preJoin = & (Join-Path $PSScriptRoot 'Test-SguClientEnrollment.ps1') `
|
|
-RequireBrokerHealth
|
|
if (-not $preJoin.IsValid) {
|
|
throw "Domain join refused because SGU enrollment is invalid: $($preJoin.Issues -join ' ')"
|
|
}
|
|
|
|
if ($computer.PartOfDomain) {
|
|
& (Join-Path $PSScriptRoot 'Enable-LabRemoteAccess.ps1') `
|
|
-RemoteDesktopPrincipal $RemoteDesktopPrincipal `
|
|
-EnableAdministrativeFirewallGroups | Out-Null
|
|
return & (Join-Path $PSScriptRoot 'Test-SguClientEnrollment.ps1') `
|
|
-RequireDomainJoined `
|
|
-RequireRemoteAccess `
|
|
-RemoteDesktopPrincipal $RemoteDesktopPrincipal
|
|
}
|
|
|
|
Set-DnsClientServerAddress `
|
|
-InterfaceAlias $NetworkInterfaceAlias `
|
|
-ServerAddresses $DomainDnsServerAddresses
|
|
Resolve-DnsName -Type SRV "_ldap._tcp.dc._msdcs.$DomainName" -ErrorAction Stop | Out-Null
|
|
|
|
if (-not $DomainCredential) {
|
|
$DomainCredential = Get-Credential `
|
|
-UserName "$DomainNetbios\Administrator" `
|
|
-Message "Credential permitted to join this computer to $DomainName"
|
|
}
|
|
|
|
$joinParams = @{
|
|
DomainName = $DomainName
|
|
Credential = $DomainCredential
|
|
Force = $true
|
|
}
|
|
if ($NewComputerName) {
|
|
$joinParams.NewName = $NewComputerName
|
|
}
|
|
Add-Computer @joinParams
|
|
|
|
if (-not $SkipRestart) {
|
|
Restart-Computer -Force
|
|
}
|
|
}
|
|
|
|
[pscustomobject]@{
|
|
ComputerName = if ($NewComputerName) { $NewComputerName } else { $env:COMPUTERNAME }
|
|
DomainName = $DomainName
|
|
ProviderValidatedBeforeJoin = $true
|
|
RestartRequired = [bool]$SkipRestart
|
|
}
|