diff --git a/AuthPolicy_steps.ps1 b/AuthPolicy_steps.ps1 new file mode 100644 index 0000000..06891df --- /dev/null +++ b/AuthPolicy_steps.ps1 @@ -0,0 +1,73 @@ +Throw "this is not a robust file" +$location = Get-Location +$oldVerbosePreference = $VerbosePreference +$VerbosePreference = 'Continue' +Set-Location C:\Tools\AuthPolicy + +#Region ProtectedUsers +$providedgroup = Read-Host "Please provide group that members should be added to other group." +$groupToUpdate = Read-Host "Please provide group that should be updated with new members from '$providedgroup'" +$groupMembers = Get-ADGroupMember -Identity $providedgroup +foreach ($member in $groupMembers){ + Write-Verbose "Updating group '$groupToUpdate' with '$member'" + Add-ADGroupMember -Identity $groupToUpdate -Members $member +} +#endregion + +#region Create Tier 1 Servers Group +$csv = Read-Host -Prompt "Please provide full path to Groups csv file" +.\Create-Group.ps1 -CSVfile $csv -Verbose +$srv = Get-ADComputer -Identity srv01 +$group = Get-ADGroup -Identity 'Tier1Servers' +Write-Verbose "Adding computer '$($srv.name)' to group '$($group.name)'" +Add-ADGroupMember -Identity $group -Members $srv +#endregion + +#region import GPO +$BackupPath = Read-Host -Prompt "Please provide full path to GPO backups" +.\Import-GPO.ps1 -BackupPath $BackupPath -Verbose +Set-Location C:\Tools\AuthPolicy +#endregion + + +#region Link gpo +$GpoLinks = @( + $(New-Object PSObject -Property @{ Name = "KDC Support for claims"; OU = "OU=Domain Controllers"; Order = 2 ;LinkEnabled = 'YES'}), + $(New-Object PSObject -Property @{ Name = "Kerberos client support for claims" ; OU = ""; Order = 2 ;LinkEnabled = 'YES'}) +) +.\Link-GpoToOU.ps1 -GpoLinks $GpoLinks -Verbose + +#Region AuthPolicy +.\New-AuthenticationPolicy -GroupName "Tier1Servers" -PolicyName "Tier1Servers" -Description "Assigned principals can authenticate to tier-0 PAWs only" -UserTGTLifetimeMins 121 +#endregion + +#Region ScheduledTask +.\Register-NewScheduledTask.ps1 -DomainGroup "Tier1PAWMaint" -PolicyName "Tier1Servers" +Get-ScheduledTask -TaskName "Update_Tier1Servers_Users" | Start-ScheduledTask +#endregion + +#region EventLog +$Logs = @( + 'Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController', + 'Microsoft-Windows-Authentication/ProtectedUser-Client', + 'Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController', + 'Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController' +) +foreach ($logname in $logs){ + Write-Verbose "Enabling logs for '$logname'" + $log = New-Object System.Diagnostics.Eventing.Reader.EventLogConfiguration $logName + $log.IsEnabled=$true + $log.SaveChanges() +} +#endregion + +#region switch Auth Policy to Audit +Get-ADAuthenticationPolicy -Identity "Tier1Servers" | Set-ADAuthenticationPolicy -Enforce $false +#endregion + +#region switch Auth Policy to Enforce +Get-ADAuthenticationPolicy -Identity "Tier1Servers" | Set-ADAuthenticationPolicy -Enforce $true +#endregion + +$VerbosePreference = $oldVerbosePreference +Set-Location $location diff --git a/Backup/manifest.xml b/Backup/manifest.xml new file mode 100644 index 0000000..d4b599b --- /dev/null +++ b/Backup/manifest.xml @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/Backup.xml b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/Backup.xml new file mode 100644 index 0000000..035b3ec --- /dev/null +++ b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/Backup.xml @@ -0,0 +1,18 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 49 a8 35 27 b4 8d fc 70 74 ba 9b 68 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 49 a8 35 27 b4 8d fc 70 74 ba 9b 68 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 49 a8 35 27 b4 8d fc 70 74 ba 9b 68 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/DomainSysvol/GPO/Machine/comment.cmtx b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/DomainSysvol/GPO/Machine/comment.cmtx new file mode 100644 index 0000000..a8d4b32 --- /dev/null +++ b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/DomainSysvol/GPO/Machine/comment.cmtx @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/DomainSysvol/GPO/Machine/registry.pol b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/DomainSysvol/GPO/Machine/registry.pol new file mode 100644 index 0000000..1cf1246 Binary files /dev/null and b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/DomainSysvol/GPO/Machine/registry.pol differ diff --git a/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/bkupInfo.xml b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/bkupInfo.xml new file mode 100644 index 0000000..a6316ac --- /dev/null +++ b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/gpreport.xml b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/gpreport.xml new file mode 100644 index 0000000..09fbad6 Binary files /dev/null and b/Backup/{40C19FA1-1F6F-40BE-A36C-4B187C8D57B8}/gpreport.xml differ diff --git a/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/Backup.xml b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/Backup.xml new file mode 100644 index 0000000..e3bf3b4 --- /dev/null +++ b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/Backup.xml @@ -0,0 +1,18 @@ + + 01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 49 a8 35 27 b4 8d fc 70 74 ba 9b 68 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 49 a8 35 27 b4 8d fc 70 74 ba 9b 68 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 49 a8 35 27 b4 8d fc 70 74 ba 9b 68 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00 + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/DomainSysvol/GPO/Machine/comment.cmtx b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/DomainSysvol/GPO/Machine/comment.cmtx new file mode 100644 index 0000000..a8d4b32 --- /dev/null +++ b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/DomainSysvol/GPO/Machine/comment.cmtx @@ -0,0 +1,12 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/DomainSysvol/GPO/Machine/registry.pol b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/DomainSysvol/GPO/Machine/registry.pol new file mode 100644 index 0000000..19de178 Binary files /dev/null and b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/DomainSysvol/GPO/Machine/registry.pol differ diff --git a/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/bkupInfo.xml b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/bkupInfo.xml new file mode 100644 index 0000000..a54665a --- /dev/null +++ b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/bkupInfo.xml @@ -0,0 +1 @@ + diff --git a/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/gpreport.xml b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/gpreport.xml new file mode 100644 index 0000000..8459b9e Binary files /dev/null and b/Backup/{8F0D3219-2D5E-44F5-BD27-478395FD744B}/gpreport.xml differ diff --git a/Import-GPO.ps1 b/Import-GPO.ps1 new file mode 100644 index 0000000..ef1d78e --- /dev/null +++ b/Import-GPO.ps1 @@ -0,0 +1,35 @@ +<# + .Example + $BackupPath = Read-Host -Prompt "Please provide full path to GPO backups" + .\Import-GPO.ps1 -BackupPath $BackupPath -Verbose + +#> + +[CmdletBinding()] +param( + [Parameter(Mandatory = $True)][string] $BackupPath, + [string] $GPOMigrationTable +) + +$backupList = Get-ChildItem -Path $BackupPath +Set-Location $BackupPath +$location = Get-Location +foreach ($item in $backupList) { + $backupID = $null + $xmlFilePath = $null + $gpoName = $null + $backupID = $item.name -replace "{", "" -replace "}", "" + $xmlFilePath = ".\$($item.name)\gpreport.xml" + [xml]$xmlFile = Get-Content -Path $xmlFilePath + $gpoName = $xmlFile.GPO.Name + Write-Verbose "Importing new GPO '$gpoName' with GUID '$backupID'" + Write-Verbose "Please remember to update proper groups in GPO settings" + if ($GPOMigrationTable -ne $null) { + Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -CreateIfNeeded + } + else { + Import-GPO -BackupId $backupID -TargetName $gpoName -Path $BackupPath -MigrationTable $GPOMigrationTable -CreateIfNeeded + } + Set-Location $location + +} diff --git a/Link-GpoToOU.ps1 b/Link-GpoToOU.ps1 new file mode 100644 index 0000000..f710fa5 --- /dev/null +++ b/Link-GpoToOU.ps1 @@ -0,0 +1,31 @@ +<# + .EXAMPLE + $GpoLinks = @( + $(New-Object PSObject -Property @{ Name = "POLICYNAME" ; OU = "OUPATH"; Order = 1; LinkEnabled = 'YES'}), + ) + .\Link-GpoToOU.ps1 -GpoLinks $GpoLinks -Verbose +#> + + +[CmdletBinding()] +param( + [Parameter(Mandatory = $True)][PSObject] $GpoLinks +) +Import-Module ActiveDirectory +$DC = (Get-ADDomain).DistinguishedName + +$GpoLinks | foreach-Object { + $name = $_.Name + $OU = $_.ou + $order = $_.Order + $LinkEnabled = $_.LinkEnabled + if ($OU -eq "") { + + $ouPath = $DC + } + else { + $ouPath = "$OU,$DC" + } + Write-Verbose "Linking GPO '$name' into OU '$ouPath'" + New-GPLink -Name $name -Target $ouPath -LinkEnabled $LinkEnabled -Order $order +} diff --git a/New-AuthenticationPolicy.ps1 b/New-AuthenticationPolicy.ps1 new file mode 100644 index 0000000..f0fcb99 --- /dev/null +++ b/New-AuthenticationPolicy.ps1 @@ -0,0 +1,20 @@ +[CmdletBinding()] +param( + [Parameter(Mandatory=$True)] [string] $GroupName, + [Parameter(Mandatory=$True)] [string] $PolicyName, + [Parameter(Mandatory=$True)] [string] $Description, + [Parameter(Mandatory=$True)] [string] $UserTGTLifetimeMins +) + +Write-Verbose "Creating new AuthenticationPolicy '$PolicyName' with UserTGTLifetimeMins '$UserTGTLifetimeMins'" +New-ADAuthenticationPolicy -Name $PolicyName -Description $Description -UserTGTLifetimeMins $UserTGTLifetimeMins -ProtectedFromAccidentalDeletion $true -Enforce + +$sids = @() +Get-ADGroupMember -Identity $GroupName | ForEach-Object { + $sid = $_.SID.value + $sids += "SID($sid)" +} +if (($sids | Measure-Object).count -gt 1){$sidsj = $sids -join ", "}else{$sidsj = $sids} + +Write-Verbose "Adding members from group '$GroupName' to User Sign On section under Authentication Policy '$PolicyName'" +Set-ADAuthenticationPolicy -Identity $PolicyName -UserAllowedToAuthenticateFrom "O:SYG:SYD:(XA;OICI;CR;;;WD;(Member_of_any {$sidsj}))" diff --git a/Register-NewScheduledTask.ps1 b/Register-NewScheduledTask.ps1 new file mode 100644 index 0000000..d7423b1 --- /dev/null +++ b/Register-NewScheduledTask.ps1 @@ -0,0 +1,13 @@ +[CmdletBinding()] +param( + [Parameter(Mandatory=$True)] [string] $DomainGroup, + [Parameter(Mandatory=$True)] [string] $PolicyName +) + +$taskName = "Update_$($PolicyName)_Users" + +$argument = "-NoProfile -command " + '"' + "& Get-ADGroupMember -Recursive -Identity " + "'" + $DomainGroup + "'" + "| ForEach-Object {Set-ADAccountAuthenticationPolicySilo -AuthenticationPolicy " + $PolicyName + " -Identity " + '$_' + ".SamAccountName}" + '"' +$action = New-ScheduledTaskAction -Execute 'Powershell.exe' -Argument $argument +$trigger = New-ScheduledTaskTrigger -Daily -At 12am +$STPrin = New-ScheduledTaskPrincipal -GroupId "System" -RunLevel Highest +Register-ScheduledTask -Action $action -Trigger $trigger -TaskName $taskName -Principal $STPrin -Description "Update Authentication policy '$PolicyName' users with '$DomainGroup' members"