113 lines
3.9 KiB
PowerShell
113 lines
3.9 KiB
PowerShell
[CmdletBinding(SupportsShouldProcess)]
|
|
param(
|
|
[string]$TargetOuDn = 'OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx',
|
|
[string]$GpoName = 'SGU - User session restrictions',
|
|
[string]$DomainController = $env:COMPUTERNAME
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
$policyKey = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System'
|
|
$policyValueName = 'DisableLockWorkstation'
|
|
$desktopPolicyKey = 'HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop'
|
|
|
|
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
|
$principal = [Security.Principal.WindowsPrincipal]::new($identity)
|
|
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
|
throw 'Run this script from an elevated Windows PowerShell session on a domain controller or management host.'
|
|
}
|
|
|
|
Import-Module ActiveDirectory -ErrorAction Stop
|
|
Import-Module GroupPolicy -ErrorAction Stop
|
|
|
|
$targetOu = Get-ADOrganizationalUnit `
|
|
-Identity $TargetOuDn `
|
|
-Server $DomainController `
|
|
-ErrorAction Stop
|
|
$domainDn = ($targetOu.DistinguishedName -split ',DC=', 2)[1]
|
|
if (-not $domainDn) {
|
|
throw 'TargetOuDn does not contain a domain distinguished name.'
|
|
}
|
|
$domainName = ($domainDn -replace ',DC=', '.')
|
|
|
|
$gpo = Get-GPO -Name $GpoName -Domain $domainName -Server $DomainController -ErrorAction SilentlyContinue
|
|
if (-not $gpo -and $PSCmdlet.ShouldProcess($GpoName, 'Create the SGU user policy GPO')) {
|
|
$gpo = New-GPO -Name $GpoName -Domain $domainName -Server $DomainController
|
|
}
|
|
if (-not $gpo) {
|
|
throw "The GPO '$GpoName' does not exist and was not created."
|
|
}
|
|
|
|
$existingLink = @(Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
|
|
Where-Object DisplayName -eq $GpoName |
|
|
Select-Object -First 1
|
|
$existingLinkEnabled = $existingLink -and (
|
|
$existingLink.Enabled -eq $true -or
|
|
[string]$existingLink.Enabled -eq 'Yes')
|
|
if (-not $existingLink) {
|
|
if ($PSCmdlet.ShouldProcess($TargetOuDn, "Link and enable '$GpoName'")) {
|
|
New-GPLink `
|
|
-Name $GpoName `
|
|
-Target $TargetOuDn `
|
|
-Domain $domainName `
|
|
-Server $DomainController `
|
|
-LinkEnabled Yes | Out-Null
|
|
}
|
|
}
|
|
elseif (-not $existingLinkEnabled -and
|
|
$PSCmdlet.ShouldProcess($TargetOuDn, "Enable the '$GpoName' link")) {
|
|
Set-GPLink `
|
|
-Name $GpoName `
|
|
-Target $TargetOuDn `
|
|
-Domain $domainName `
|
|
-Server $DomainController `
|
|
-LinkEnabled Yes | Out-Null
|
|
}
|
|
|
|
if ($PSCmdlet.ShouldProcess($GpoName, 'Prevent SGU users from manually locking workstations')) {
|
|
Set-GPRegistryValue `
|
|
-Name $GpoName `
|
|
-Domain $domainName `
|
|
-Server $DomainController `
|
|
-Key $policyKey `
|
|
-ValueName $policyValueName `
|
|
-Type DWord `
|
|
-Value 1 | Out-Null
|
|
|
|
Set-GPRegistryValue `
|
|
-Name $GpoName `
|
|
-Domain $domainName `
|
|
-Server $DomainController `
|
|
-Key $desktopPolicyKey `
|
|
-ValueName 'ScreenSaveActive' `
|
|
-Type String `
|
|
-Value '0' | Out-Null
|
|
}
|
|
|
|
$configuredValue = Get-GPRegistryValue `
|
|
-Name $GpoName `
|
|
-Domain $domainName `
|
|
-Server $DomainController `
|
|
-Key $policyKey `
|
|
-ValueName $policyValueName
|
|
$screenSaverValue = Get-GPRegistryValue `
|
|
-Name $GpoName `
|
|
-Domain $domainName `
|
|
-Server $DomainController `
|
|
-Key $desktopPolicyKey `
|
|
-ValueName 'ScreenSaveActive'
|
|
$link = @(Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
|
|
Where-Object DisplayName -eq $GpoName |
|
|
Select-Object -First 1
|
|
$linkEnabled = $link -and (
|
|
$link.Enabled -eq $true -or
|
|
[string]$link.Enabled -eq 'Yes')
|
|
|
|
[pscustomobject]@{
|
|
GpoName = $GpoName
|
|
GpoId = $gpo.Id
|
|
TargetOu = $TargetOuDn
|
|
LinkEnabled = [bool]$linkEnabled
|
|
DisableLockWorkstation = [int]$configuredValue.Value
|
|
ScreenSaverDisabled = [string]$screenSaverValue.Value -eq '0'
|
|
}
|