diff --git a/AuthPolicy_steps.ps1 b/AuthPolicy_steps.ps1
new file mode 100644
index 0000000..06891df
--- /dev/null
+++ b/AuthPolicy_steps.ps1
@@ -0,0 +1,73 @@
+Throw "this is not a robust file"
+$location = Get-Location
+$oldVerbosePreference = $VerbosePreference
+$VerbosePreference = 'Continue'
+Set-Location C:\Tools\AuthPolicy
+
+#Region ProtectedUsers
+$providedgroup = Read-Host "Please provide group that members should be added to other group."
+$groupToUpdate = Read-Host "Please provide group that should be updated with new members from '$providedgroup'"
+$groupMembers = Get-ADGroupMember -Identity $providedgroup
+foreach ($member in $groupMembers){
+ Write-Verbose "Updating group '$groupToUpdate' with '$member'"
+ Add-ADGroupMember -Identity $groupToUpdate -Members $member
+}
+#endregion
+
+#region Create Tier 1 Servers Group
+$csv = Read-Host -Prompt "Please provide full path to Groups csv file"
+.\Create-Group.ps1 -CSVfile $csv -Verbose
+$srv = Get-ADComputer -Identity srv01
+$group = Get-ADGroup -Identity 'Tier1Servers'
+Write-Verbose "Adding computer '$($srv.name)' to group '$($group.name)'"
+Add-ADGroupMember -Identity $group -Members $srv
+#endregion
+
+#region import GPO
+$BackupPath = Read-Host -Prompt "Please provide full path to GPO backups"
+.\Import-GPO.ps1 -BackupPath $BackupPath -Verbose
+Set-Location C:\Tools\AuthPolicy
+#endregion
+
+
+#region Link gpo
+$GpoLinks = @(
+ $(New-Object PSObject -Property @{ Name = "KDC Support for claims"; OU = "OU=Domain Controllers"; Order = 2 ;LinkEnabled = 'YES'}),
+ $(New-Object PSObject -Property @{ Name = "Kerberos client support for claims" ; OU = ""; Order = 2 ;LinkEnabled = 'YES'})
+)
+.\Link-GpoToOU.ps1 -GpoLinks $GpoLinks -Verbose
+
+#Region AuthPolicy
+.\New-AuthenticationPolicy -GroupName "Tier1Servers" -PolicyName "Tier1Servers" -Description "Assigned principals can authenticate to tier-0 PAWs only" -UserTGTLifetimeMins 121
+#endregion
+
+#Region ScheduledTask
+.\Register-NewScheduledTask.ps1 -DomainGroup "Tier1PAWMaint" -PolicyName "Tier1Servers"
+Get-ScheduledTask -TaskName "Update_Tier1Servers_Users" | Start-ScheduledTask
+#endregion
+
+#region EventLog
+$Logs = @(
+ 'Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController',
+ 'Microsoft-Windows-Authentication/ProtectedUser-Client',
+ 'Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController',
+ 'Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController'
+)
+foreach ($logname in $logs){
+ Write-Verbose "Enabling logs for '$logname'"
+ $log = New-Object System.Diagnostics.Eventing.Reader.EventLogConfiguration $logName
+ $log.IsEnabled=$true
+ $log.SaveChanges()
+}
+#endregion
+
+#region switch Auth Policy to Audit
+Get-ADAuthenticationPolicy -Identity "Tier1Servers" | Set-ADAuthenticationPolicy -Enforce $false
+#endregion
+
+#region switch Auth Policy to Enforce
+Get-ADAuthenticationPolicy -Identity "Tier1Servers" | Set-ADAuthenticationPolicy -Enforce $true
+#endregion
+
+$VerbosePreference = $oldVerbosePreference
+Set-Location $location
diff --git a/Backup/manifest.xml b/Backup/manifest.xml
new file mode 100644
index 0000000..d4b599b
--- /dev/null
+++ b/Backup/manifest.xml
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/Backup.xml b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/Backup.xml
new file mode 100644
index 0000000..035b3ec
--- /dev/null
+++ b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/Backup.xml
@@ -0,0 +1,18 @@
+
+ 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 49 a8 35 27 b4 8d fc 70 74 ba 9b 68 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 49 a8 35 27 b4 8d fc 70 74 ba 9b 68 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 49 a8 35 27 b4 8d fc 70 74 ba 9b 68 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/DomainSysvol/GPO/Machine/comment.cmtx b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/DomainSysvol/GPO/Machine/comment.cmtx
new file mode 100644
index 0000000..a8d4b32
--- /dev/null
+++ b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/DomainSysvol/GPO/Machine/comment.cmtx
@@ -0,0 +1,12 @@
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/DomainSysvol/GPO/Machine/registry.pol b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/DomainSysvol/GPO/Machine/registry.pol
new file mode 100644
index 0000000..1cf1246
Binary files /dev/null and b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/DomainSysvol/GPO/Machine/registry.pol differ
diff --git a/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/bkupInfo.xml b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/bkupInfo.xml
new file mode 100644
index 0000000..a6316ac
--- /dev/null
+++ b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/bkupInfo.xml
@@ -0,0 +1 @@
+
diff --git a/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/gpreport.xml b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/gpreport.xml
new file mode 100644
index 0000000..09fbad6
Binary files /dev/null and b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/gpreport.xml differ
diff --git a/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/Backup.xml b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/Backup.xml
new file mode 100644
index 0000000..e3bf3b4
--- /dev/null
+++ b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/Backup.xml
@@ -0,0 +1,18 @@
+
+ 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 49 a8 35 27 b4 8d fc 70 74 ba 9b 68 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 49 a8 35 27 b4 8d fc 70 74 ba 9b 68 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 49 a8 35 27 b4 8d fc 70 74 ba 9b 68 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/DomainSysvol/GPO/Machine/comment.cmtx b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/DomainSysvol/GPO/Machine/comment.cmtx
new file mode 100644
index 0000000..a8d4b32
--- /dev/null
+++ b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/DomainSysvol/GPO/Machine/comment.cmtx
@@ -0,0 +1,12 @@
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/DomainSysvol/GPO/Machine/registry.pol b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/DomainSysvol/GPO/Machine/registry.pol
new file mode 100644
index 0000000..19de178
Binary files /dev/null and b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/DomainSysvol/GPO/Machine/registry.pol differ
diff --git a/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/bkupInfo.xml b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/bkupInfo.xml
new file mode 100644
index 0000000..a54665a
--- /dev/null
+++ b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/bkupInfo.xml
@@ -0,0 +1 @@
+
diff --git a/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/gpreport.xml b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/gpreport.xml
new file mode 100644
index 0000000..8459b9e
Binary files /dev/null and b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/gpreport.xml differ
diff --git a/Import-GPO.ps1 b/Import-GPO.ps1
new file mode 100644
index 0000000..ef1d78e
--- /dev/null
+++ b/Import-GPO.ps1
@@ -0,0 +1,35 @@
+<#
+ .Example
+ $BackupPath = Read-Host -Prompt "Please provide full path to GPO backups"
+ .\Import-GPO.ps1 -BackupPath $BackupPath -Verbose
+
+#>
+
+[CmdletBinding()]
+param(
+ [Parameter(Mandatory = $True)][string] $BackupPath,
+ [string] $GPOMigrationTable
+)
+
+$backupList = Get-ChildItem -Path $BackupPath
+Set-Location $BackupPath
+$location = Get-Location
+foreach ($item in $backupList) {
+ $backupID = $null
+ $xmlFilePath = $null
+ $gpoName = $null
+ $backupID = $item.name -replace "{", "" -replace "}", ""
+ $xmlFilePath = ".\$($item.name)\gpreport.xml"
+ [xml]$xmlFile = Get-Content -Path $xmlFilePath
+ $gpoName = $xmlFile.GPO.Name
+ Write-Verbose "Importing new GPO '$gpoName' with GUID '$backupID'"
+ Write-Verbose "Please remember to update proper groups in GPO settings"
+ if ($GPOMigrationTable -ne $null) {
+ Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -CreateIfNeeded
+ }
+ else {
+ Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -MigrationTable $GPOMigrationTable -CreateIfNeeded
+ }
+ Set-Location $location
+
+}
diff --git a/Link-GpoToOU.ps1 b/Link-GpoToOU.ps1
new file mode 100644
index 0000000..f710fa5
--- /dev/null
+++ b/Link-GpoToOU.ps1
@@ -0,0 +1,31 @@
+<#
+ .EXAMPLE
+ $GpoLinks = @(
+ $(New-Object PSObject -Property @{ Name = "POLICYNAME" ; OU = "OUPATH"; Order = 1; LinkEnabled = 'YES'}),
+ )
+ .\Link-GpoToOU.ps1 -GpoLinks $GpoLinks -Verbose
+#>
+
+
+[CmdletBinding()]
+param(
+ [Parameter(Mandatory = $True)][PSObject] $GpoLinks
+)
+Import-Module ActiveDirectory
+$DC = (Get-ADDomain).DistinguishedName
+
+$GpoLinks | foreach-Object {
+ $name = $_.Name
+ $OU = $_.ou
+ $order = $_.Order
+ $LinkEnabled = $_.LinkEnabled
+ if ($OU -eq "") {
+
+ $ouPath = $DC
+ }
+ else {
+ $ouPath = "$OU,$DC"
+ }
+ Write-Verbose "Linking GPO '$name' into OU '$ouPath'"
+ New-GPLink -Name $name -Target $ouPath -LinkEnabled $LinkEnabled -Order $order
+}
diff --git a/New-AuthenticationPolicy.ps1 b/New-AuthenticationPolicy.ps1
new file mode 100644
index 0000000..f0fcb99
--- /dev/null
+++ b/New-AuthenticationPolicy.ps1
@@ -0,0 +1,20 @@
+[CmdletBinding()]
+param(
+ [Parameter(Mandatory=$True)] [string] $GroupName,
+ [Parameter(Mandatory=$True)] [string] $PolicyName,
+ [Parameter(Mandatory=$True)] [string] $Description,
+ [Parameter(Mandatory=$True)] [string] $UserTGTLifetimeMins
+)
+
+Write-Verbose "Creating new AuthenticationPolicy '$PolicyName' with UserTGTLifetimeMins '$UserTGTLifetimeMins'"
+New-ADAuthenticationPolicy -Name $PolicyName -Description $Description -UserTGTLifetimeMins $UserTGTLifetimeMins -ProtectedFromAccidentalDeletion $true -Enforce
+
+$sids = @()
+Get-ADGroupMember -Identity $GroupName | ForEach-Object {
+ $sid = $_.SID.value
+ $sids += "SID($sid)"
+}
+if (($sids | Measure-Object).count -gt 1){$sidsj = $sids -join ", "}else{$sidsj = $sids}
+
+Write-Verbose "Adding members from group '$GroupName' to User Sign On section under Authentication Policy '$PolicyName'"
+Set-ADAuthenticationPolicy -Identity $PolicyName -UserAllowedToAuthenticateFrom "O:SYG:SYD:(XA;OICI;CR;;;WD;(Member_of_any {$sidsj}))"
diff --git a/Register-NewScheduledTask.ps1 b/Register-NewScheduledTask.ps1
new file mode 100644
index 0000000..d7423b1
--- /dev/null
+++ b/Register-NewScheduledTask.ps1
@@ -0,0 +1,13 @@
+[CmdletBinding()]
+param(
+ [Parameter(Mandatory=$True)] [string] $DomainGroup,
+ [Parameter(Mandatory=$True)] [string] $PolicyName
+)
+
+$taskName = "Update_$($PolicyName)_Users"
+
+$argument = "-NoProfile -command " + '"' + "& Get-ADGroupMember -Recursive -Identity " + "'" + $DomainGroup + "'" + "| ForEach-Object {Set-ADAccountAuthenticationPolicySilo -AuthenticationPolicy " + $PolicyName + " -Identity " + '$_' + ".SamAccountName}" + '"'
+$action = New-ScheduledTaskAction -Execute 'Powershell.exe' -Argument $argument
+$trigger = New-ScheduledTaskTrigger -Daily -At 12am
+$STPrin = New-ScheduledTaskPrincipal -GroupId "System" -RunLevel Highest
+Register-ScheduledTask -Action $action -Trigger $trigger -TaskName $taskName -Principal $STPrin -Description "Update Authentication policy '$PolicyName' users with '$DomainGroup' members"