init 11152022

.gitignore

@@ -0,0 +1,5 @@
+################################################################################
+# This .gitignore file was automatically created by Microsoft(R) Visual Studio.
+################################################################################
+
+/.vs

1-AD/DSC/src/ADCS.ps1

@@ -0,0 +1,105 @@
+
+configuration ADCSDeploy {
+    param 
+    ( 
+        [Parameter(Mandatory)]
+        [String]$DomainFQDN,
+
+        [Parameter(Mandatory)]
+        [System.Management.Automation.PSCredential]$AdminCreds
+
+    ) 
+
+    Import-DscResource -ModuleName ActiveDirectoryDsc, NetworkingDsc, xPSDesiredStateConfiguration, ComputerManagementDsc
+
+    [String] $DomainNetbiosName = (Get-NetBIOSName -DomainFQDN $DomainFQDN)
+    [System.Management.Automation.PSCredential]$DomainCreds = New-Object System.Management.Automation.PSCredential ("${DomainNetbiosName}\$($Admincreds.UserName)", $Admincreds.Password)
+
+    $Interface = Get-NetAdapter | Where-Object Name -Like "Ethernet*" | Select-Object -First 1
+    $InterfaceAlias = $($Interface.Name)
+    $bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($AdminCreds.Password)
+    $AdminPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)
+    $ComputerName = Get-Content env:computername
+
+    Node localhost
+    {
+        LocalConfigurationManager
+        {           
+            ConfigurationMode   = 'ApplyOnly'
+            RebootNodeIfNeeded  = $true
+        }
+
+        # ***** Create Domain Users *****
+        xScript ADCSdeploy
+        {
+            SetScript = 
+            {
+                Write-Host "add ADCS "
+
+
+                Write-Host "Get ADCS "
+                try 
+                {
+                    Get-WindowsFeature -Name AD-Certificate | Install-WindowsFeature
+                }
+                catch
+                {
+                    Write-Host "error getting ADCS"
+                }
+
+                 Write-Host "Install ADCS "
+                try 
+                {
+                    Install-AdcsCertificationAuthority -CAType EnterpriseRootCa -CryptoProviderName "ECDSA_P256#Microsoft Software Key Storage Provider" -KeyLength 256 -HashAlgorithmName SHA256
+                }
+                catch
+                {
+                    Write-Host "error installing ADCS"
+                }
+
+
+
+
+
+                 Write-Host "add ADCS DSC complete "
+
+            }
+
+            GetScript =  
+            {
+                # This block must return a hashtable. The hashtable must only contain one key Result and the value must be of type String.
+                return @{ "Result" = "false" }
+            }
+            TestScript = 
+            {
+                # If it returns $false, the SetScript block will run. If it returns $true, the SetScript block will not run.
+                return $false
+            }
+        }
+    }
+}
+
+
+
+function Get-NetBIOSName {
+    [OutputType([string])]
+    param(
+        [string]$DomainFQDN
+    )
+
+    if ($DomainFQDN.Contains('.')) {
+        $length = $DomainFQDN.IndexOf('.')
+        if ( $length -ge 16) {
+            $length = 15
+        }
+        return $DomainFQDN.Substring(0, $length)
+    }
+    else {
+        if ($DomainFQDN.Length -gt 15) {
+            return $DomainFQDN.Substring(0, 15)
+        }
+        else {
+            return $DomainFQDN
+        }
+    }
+}

1-AD/DSC/src/Create-AD.ps1

@@ -0,0 +1,270 @@
+# Author: Roberto Rodriguez @Cyb3rWard0g
+# License: GPLv3
+# References:
+# https://github.com/Azure/azure-quickstart-templates/blob/master/sharepoint-adfs/dsc/ConfigureDCVM.ps1
+configuration Create-AD {
+    param 
+    ( 
+        [Parameter(Mandatory)]
+        [String]$DomainFQDN,
+
+        [Parameter(Mandatory)]
+        [System.Management.Automation.PSCredential]$AdminCreds,
+
+        [Parameter(Mandatory)]
+        [Object]$DomainUsers
+    ) 
+
+    Import-DscResource -ModuleName ActiveDirectoryDsc, NetworkingDsc, xPSDesiredStateConfiguration, xDnsServer, ComputerManagementDsc
+
+    [String] $DomainNetbiosName = (Get-NetBIOSName -DomainFQDN $DomainFQDN)
+    [System.Management.Automation.PSCredential]$DomainCreds = New-Object System.Management.Automation.PSCredential ("${DomainNetbiosName}\$($Admincreds.UserName)", $Admincreds.Password)
+
+    $Interface = Get-NetAdapter | Where-Object Name -Like "Ethernet*" | Select-Object -First 1
+    $InterfaceAlias = $($Interface.Name)
+    $bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($AdminCreds.Password)
+    $AdminPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)
+    $ComputerName = Get-Content env:computername
+
+    Node localhost
+    {
+        LocalConfigurationManager
+        {           
+            ConfigurationMode   = 'ApplyOnly'
+            RebootNodeIfNeeded  = $true
+        }
+
+        # ***** Add DNS and AD Features *****
+        WindowsFeature DNS 
+        { 
+            Ensure  = "Present" 
+            Name    = "DNS"		
+        }
+
+        Script EnableDNSDiags
+        {
+            SetScript = { 
+                Set-DnsServerDiagnostics -All $true
+                Write-Verbose -Verbose "Enabling DNS client diagnostics" 
+            }
+            GetScript   = { @{} }
+            TestScript  = { $false }
+            DependsOn   = "[WindowsFeature]DNS"
+        }
+
+        WindowsFeature DnsTools
+        {
+            Ensure      = "Present"
+            Name        = "RSAT-DNS-Server"
+            DependsOn   = "[WindowsFeature]DNS"
+        }
+
+        DnsServerAddress SetDNS 
+        { 
+            Address         = '127.0.0.1' 
+            InterfaceAlias  = $InterfaceAlias
+            AddressFamily   = 'IPv4'
+            DependsOn       = "[WindowsFeature]DNS"
+        }
+
+        WindowsFeature ADDSInstall 
+        { 
+            Ensure      = "Present" 
+            Name        = "AD-Domain-Services"
+            DependsOn   = "[WindowsFeature]DNS" 
+        } 
+
+        WindowsFeature ADDSTools
+        {
+            Ensure      = "Present"
+            Name        = "RSAT-ADDS-Tools"
+            DependsOn   = "[WindowsFeature]ADDSInstall"
+        }
+
+        WindowsFeature ADAdminCenter
+        {
+            Ensure      = "Present"
+            Name        = "RSAT-AD-AdminCenter"
+            DependsOn   = "[WindowsFeature]ADDSInstall"
+        }
+
+        # ****** Create AD Domain *********
+        ADDomain CreateADForest 
+        {
+            DomainName                      = $DomainFQDN
+            Credential                      = $DomainCreds
+            SafemodeAdministratorPassword   = $DomainCreds
+            DatabasePath                    = "C:\NTDS"
+            LogPath                         = "C:\NTDS"
+            SysvolPath                      = "C:\SYSVOL"
+            DependsOn                       = "[DnsServerAddress]SetDNS", "[WindowsFeature]ADDSInstall"
+        }
+
+        PendingReboot RebootOnSignalFromCreateADForest
+        {
+            Name        = 'RebootOnSignalFromCreateADForest'
+            DependsOn   = "[ADDomain]CreateADForest"
+        }
+
+        WaitForADDomain WaitForDCReady
+        {
+            DomainName              = $DomainFQDN
+            WaitTimeout             = 300
+            RestartCount            = 3
+            Credential              = $DomainCreds
+            WaitForValidCredentials = $true
+            DependsOn               = "[PendingReboot]RebootOnSignalFromCreateADForest"
+        }
+
+        # ***** Create OUs *****
+        xScript CreateOUs
+        {
+            SetScript = {
+                # Verifying ADWS service is running
+                $ServiceName = 'ADWS'
+                $arrService = Get-Service -Name $ServiceName
+
+                while ($arrService.Status -ne 'Running')
+                {
+                    Start-Service $ServiceName
+                    Start-Sleep -seconds 5
+                    $arrService.Refresh()
+                }
+
+                $DomainName1,$DomainName2 = ($using:domainFQDN).split('.')
+
+                $ParentPath = "DC=$DomainName1,DC=$DomainName2"
+                $OUS = @(("Workstations","Workstations in the domain"),("Servers","Servers in the domain"),("LogCollectors","Servers collecting event logs"),("DomainUsers","Users in the domain"))
+
+                foreach($OU in $OUS)
+                {
+                    #Check if exists, if it does skip
+                    [string] $Path = "OU=$($OU[0]),$ParentPath"
+                    if(![adsi]::Exists("LDAP://$Path"))
+                    {
+                        New-ADOrganizationalUnit -Name $OU[0] -Path $ParentPath `
+                            -Description $OU[1] `
+                            -ProtectedFromAccidentalDeletion $false -PassThru
+                    }
+                }
+            }
+            GetScript =  
+            {
+                # This block must return a hashtable. The hashtable must only contain one key Result and the value must be of type String.
+                return @{ "Result" = "false" }
+            }
+            TestScript = 
+            {
+                # If it returns $false, the SetScript block will run. If it returns $true, the SetScript block will not run.
+                return $false
+            }
+            DependsOn = "[WaitForADDomain]WaitForDCReady"
+        }
+
+        # ***** Create Domain Users *****
+        xScript CreateDomainUsers
+        {
+            SetScript = {
+                # Verifying ADWS service is running
+                $ServiceName = 'ADWS'
+                $arrService = Get-Service -Name $ServiceName
+
+                while ($arrService.Status -ne 'Running')
+                {
+                    Start-Service $ServiceName
+                    Start-Sleep -seconds 5
+                    $arrService.Refresh()
+                }
+
+                $DomainName = $using:domainFQDN
+                $DomainName1,$DomainName2 = $DomainName.split('.')
+                $ADServer = $using:ComputerName+"."+$DomainName
+
+                $NewDomainUsers = $using:DomainUsers
+
+                foreach ($DomainUser in $NewDomainUsers)
+                {
+                    $UserPrincipalName = $DomainUser.SamAccountName + "@" + $DomainName
+                    $DisplayName = $DomainUser.LastName + " " + $DomainUser.FirstName
+                    $OUPath = "OU="+$DomainUser.UserContainer+",DC=$DomainName1,DC=$DomainName2"
+                    $SamAccountName = $DomainUser.SamAccountName
+                    $ServiceName = $DomainUser.FirstName
+
+                    $UserExists = Get-ADUser -LDAPFilter "(sAMAccountName=$SamAccountName)"
+
+                    if ($UserExists -eq $Null)
+                    {
+                        write-host "Creating user $UserPrincipalName .."
+                        New-ADUser -Name $DisplayName `
+                        -DisplayName $DisplayName `
+                        -GivenName $DomainUser.FirstName `
+                        -Surname $DomainUser.LastName `
+                        -Department $DomainUser.Department `
+                        -Title $DomainUser.JobTitle `
+                        -UserPrincipalName $UserPrincipalName `
+                        -SamAccountName $DomainUser.SamAccountName `
+                        -Path $OUPath `
+                        -AccountPassword (ConvertTo-SecureString $DomainUser.Password -AsPlainText -force) `
+                        -Enabled $true `
+                        -PasswordNeverExpires $true `
+                        -Server $ADServer
+
+                        if($DomainUser.Identity -Like "Domain Admins")
+                        {
+                            $DomainAdminUser = $DomainUser.SamAccountName
+                            $Groups = @('domain admins','schema admins','enterprise admins')
+                            $Groups | ForEach-Object{
+                                $members = Get-ADGroupMember -Identity $_ -Recursive | Select-Object -ExpandProperty Name
+                                if ($members -contains $DomainAdminUser)
+                                {
+                                    Write-Host "$DomainAdminUser exists in $_ "
+                                }
+                                else {
+                                    Add-ADGroupMember -Identity $_ -Members $DomainAdminUser
+                                }
+                            }
+                        }
+                        if($DomainUser.JobTitle -Like "Service Account")
+                        {
+                            setspn -a $ServiceName/$DomainName $DomainName1\$SamAccountName
+                        }
+                    }
+                }
+            }
+            GetScript =  
+            {
+                # This block must return a hashtable. The hashtable must only contain one key Result and the value must be of type String.
+                return @{ "Result" = "false" }
+            }
+            TestScript = 
+            {
+                # If it returns $false, the SetScript block will run. If it returns $true, the SetScript block will not run.
+                return $false
+            }
+            DependsOn = "[xScript]CreateOUs"
+        }
+    }
+}
+
+function Get-NetBIOSName {
+    [OutputType([string])]
+    param(
+        [string]$DomainFQDN
+    )
+
+    if ($DomainFQDN.Contains('.')) {
+        $length = $DomainFQDN.IndexOf('.')
+        if ( $length -ge 16) {
+            $length = 15
+        }
+        return $DomainFQDN.Substring(0, $length)
+    }
+    else {
+        if ($DomainFQDN.Length -gt 15) {
+            return $DomainFQDN.Substring(0, 15)
+        }
+        else {
+            return $DomainFQDN
+        }
+    }
+}