From 404a25bdf7fb386e369adcbf1c8cc3f3651f1948 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Fri, 23 Aug 2024 15:01:04 +0100 Subject: [PATCH 1/7] Change tags on username swap task --- ansible/roles/win_domain_membership/tasks/username.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/roles/win_domain_membership/tasks/username.yml b/ansible/roles/win_domain_membership/tasks/username.yml index 94f51cd..a15b72b 100644 --- a/ansible/roles/win_domain_membership/tasks/username.yml +++ b/ansible/roles/win_domain_membership/tasks/username.yml @@ -1,8 +1,8 @@ --- - name: Swap to domain Administrator tags: + - join_clients - change_username - - always vars: ansible_connection: local lineinfile: From e1557aede769cb1dbce67ecdf85511ff12f76112 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Fri, 23 Aug 2024 22:43:38 +0100 Subject: [PATCH 2/7] Create GPO to configure proxy for clients --- .../win_domain_controller/tasks/setup.yml | 20 +++++++++++++++++++ .../templates/proxy_gpo.ps1.j2 | 13 ++++++++++++ .../roles/win_domain_controller/vars/main.yml | 3 +++ 3 files changed, 36 insertions(+) create mode 100644 ansible/roles/win_domain_controller/templates/proxy_gpo.ps1.j2 diff --git a/ansible/roles/win_domain_controller/tasks/setup.yml b/ansible/roles/win_domain_controller/tasks/setup.yml index 24663e0..b53b7a4 100644 --- a/ansible/roles/win_domain_controller/tasks/setup.yml +++ b/ansible/roles/win_domain_controller/tasks/setup.yml @@ -120,3 +120,23 @@ win_shell: powershell C:\eidf\{{ server_hardening_script }} tags: apply_hardening_scripts when: inventory_hostname in groups['meta-name_dc01'] + +- name: Squid Proxy GPO Script + tags: proxy_script + block: + - name: Copy Squid GPO Script + vars: + proxy_vm: "{{ os_project }}-{{ win_project }}-proxy" + proxy_address: "{{ hostvars[proxy_vm].ansible_host }}:3128" + ansible.builtin.template: + src: "{{ squid_proxy_script_tmpl }}" + dest: "{{ script_dir }}\\{{ squid_proxy_script }}" + force: true + tags: copy_proxy_script + + - name: Apply Squid GPO Script + win_shell: "powershell {{ script_dir }}\\{{ squid_proxy_script }}" + tags: create_proxy_gpo + when: | + inventory_hostname in groups['meta-name_dc01'] and + project_zone == 'protected' diff --git a/ansible/roles/win_domain_controller/templates/proxy_gpo.ps1.j2 b/ansible/roles/win_domain_controller/templates/proxy_gpo.ps1.j2 new file mode 100644 index 0000000..ceaf70e --- /dev/null +++ b/ansible/roles/win_domain_controller/templates/proxy_gpo.ps1.j2 @@ -0,0 +1,13 @@ +New-GPO -Name "Squid Proxy" -comment "Configure Client VMs to use Squid HTTP proxy" +Set-GPRegistryValue -Name "Squid Proxy" -ValueName "ProxyEnable" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Value 1 -Type DWord +Set-GPRegistryValue -Name "Squid Proxy" -ValueName "ProxyServer" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Value "{{ proxy_address }}" -Type String +Set-GPRegistryValue -Name "Squid Proxy" -ValueName "ProxyOverride" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Value "" -Type String +Set-GPRegistryValue -Name "Squid Proxy" -ValueName "Proxy" -key "HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel" -Value 1 -Type DWord + +$DomainInfo = Get-ADDomain +$DomainOU = $DomainInfo.DistinguishedName +$workbenchOU = (Get-ADOrganizationalUnit -Identity "OU=Workbench,$DomainOU").DistinguishedName + +New-GPLink -Name "Squid Proxy" -Target $workbenchOU + +Write-Output "THIS SCRIPT ACTUALLY RAN" | Out-File -FilePath 'C:\eidf\ProxyScript.txt' \ No newline at end of file diff --git a/ansible/roles/win_domain_controller/vars/main.yml b/ansible/roles/win_domain_controller/vars/main.yml index 5a09703..30ad142 100644 --- a/ansible/roles/win_domain_controller/vars/main.yml +++ b/ansible/roles/win_domain_controller/vars/main.yml @@ -1,5 +1,8 @@ group_policy_script: OpenStackADBuild.ps1 server_hardening_script: serverhardening.ps1 +squid_proxy_script: proxy_gpo.ps1 +squid_proxy_script_tmpl: proxy_gpo.ps1.j2 +script_dir: C:\eidf OUs: - Project Users From 20aeb16c901245940485b3afbb37386e8804b0cd Mon Sep 17 00:00:00 2001 From: abrown38 Date: Sat, 24 Aug 2024 00:01:46 +0100 Subject: [PATCH 3/7] Create OUs before GPO script runs --- .../win_domain_controller/tasks/main.yml | 2 -- .../win_domain_controller/tasks/setup.yml | 23 +++++++++++++++++++ .../win_domain_controller/tasks/users.yml | 21 ----------------- 3 files changed, 23 insertions(+), 23 deletions(-) delete mode 100644 ansible/roles/win_domain_controller/tasks/users.yml diff --git a/ansible/roles/win_domain_controller/tasks/main.yml b/ansible/roles/win_domain_controller/tasks/main.yml index 49f47c7..7663b70 100644 --- a/ansible/roles/win_domain_controller/tasks/main.yml +++ b/ansible/roles/win_domain_controller/tasks/main.yml @@ -1,5 +1,3 @@ --- - import_tasks: features.yml - import_tasks: setup.yml -- import_tasks: users.yml -#- import_tasks: remote_desktop.yml diff --git a/ansible/roles/win_domain_controller/tasks/setup.yml b/ansible/roles/win_domain_controller/tasks/setup.yml index b53b7a4..8f30122 100644 --- a/ansible/roles/win_domain_controller/tasks/setup.yml +++ b/ansible/roles/win_domain_controller/tasks/setup.yml @@ -91,6 +91,29 @@ when: dc02_promotion.reboot_required | default(false) == true when: inventory_hostname in groups['meta-name_dc02'] + +- name: Create Required OUs and Users + tags: post_promotion_tasks + block: + - name: Create various OUs + community.windows.win_domain_ou: + name: "{{ item }}" + path: "DC={{ win_project }},DC=loc" + state: present + protected: true + loop: "{{ OUs }}" + + - name: Create file-transfer user for + community.windows.win_domain_user: + name: "{{ filetransfer_user }}" + firstname: File + surname: Transfer + password: "{{ transfer_user_password }}" + state: present + password_never_expires: yes + when: inventory_hostname in groups['meta-name_dc01'] + + - name: Group policy script tags: gpo_script block: diff --git a/ansible/roles/win_domain_controller/tasks/users.yml b/ansible/roles/win_domain_controller/tasks/users.yml deleted file mode 100644 index 571acf0..0000000 --- a/ansible/roles/win_domain_controller/tasks/users.yml +++ /dev/null @@ -1,21 +0,0 @@ ---- -- name: Create Required OUs and Users - tags: post_promotion_tasks - block: - - name: Create various OUs - community.windows.win_domain_ou: - name: "{{ item }}" - path: "DC={{ win_project }},DC=loc" - state: present - protected: true - loop: "{{ OUs }}" - - - name: Create file-transfer user for - community.windows.win_domain_user: - name: "{{ filetransfer_user }}" - firstname: File - surname: Transfer - password: "{{ transfer_user_password }}" - state: present - password_never_expires: yes - when: inventory_hostname in groups['meta-name_dc01'] From f1f9387e63ba4b76187fea0fcc9237a36ac26c8b Mon Sep 17 00:00:00 2001 From: abrown38 Date: Sat, 24 Aug 2024 18:57:39 +0100 Subject: [PATCH 4/7] add additional tag --- ansible/roles/win_domain_controller/tasks/setup.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ansible/roles/win_domain_controller/tasks/setup.yml b/ansible/roles/win_domain_controller/tasks/setup.yml index 8f30122..0ae1c10 100644 --- a/ansible/roles/win_domain_controller/tasks/setup.yml +++ b/ansible/roles/win_domain_controller/tasks/setup.yml @@ -93,7 +93,9 @@ - name: Create Required OUs and Users - tags: post_promotion_tasks + tags: + - promote_dc01 + - post_promotion_tasks block: - name: Create various OUs community.windows.win_domain_ou: From 2b452a9fbfe52cff0f547612e4da71f052565643 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Sat, 24 Aug 2024 18:58:08 +0100 Subject: [PATCH 5/7] remove loop and install each package in its own task --- ansible/roles/win_client/tasks/chocolatey.yml | 87 ++++++++++--------- 1 file changed, 46 insertions(+), 41 deletions(-) diff --git a/ansible/roles/win_client/tasks/chocolatey.yml b/ansible/roles/win_client/tasks/chocolatey.yml index 7388c92..5558cb3 100644 --- a/ansible/roles/win_client/tasks/chocolatey.yml +++ b/ansible/roles/win_client/tasks/chocolatey.yml @@ -8,7 +8,7 @@ package_params: "'/Global'" source: "{{ repo_url }}" - - name: Add new internal Choco source (client machines) + - name: Add new internal Choco source win_chocolatey_source: name: EPCC state: present @@ -20,7 +20,7 @@ # reboot_timeout_sec: 1200 # ??? - - name: Disable the default public Choco source (client machines) + - name: Disable the default public Choco source win_chocolatey_source: name: chocolatey state: disabled @@ -29,80 +29,85 @@ - name: Client Packages tags: client_packages block: - - name: Install Chocolatey GUI (client machines) + - name: Install Chocolatey GUI win_chocolatey: name: ChocolateyGUI state: present package_params: "'/Global'" - - name: Install Microsoft office (client machines) + - name: Install Microsoft office win_chocolatey: name: microsoft-office-deployment state: present package_params: "'/Product:ProPlus2021Volume /LicenseKey:FXYTK-NJJ8C-GB6DW-3DYQT-6F7TH'" tags: install_office - - name: Install Firefox (client machines) + - name: Install Firefox win_chocolatey: name: firefox state: present + tags: install_firefox - - name: Install Google Chrome (client machines) + - name: Install Google Chrome win_chocolatey: name: GoogleChrome state: present ignore_checksums: true # workaround for chrome checksum issues. + tags: install_chrome - - name: Install R (client machines) + - name: Install R win_chocolatey: name: R.Project state: present + tags: install_r - #- name: Install Python3.10 (client machines) - # win_chocolatey: - # name: python310 - # state: present - # when: inventory_hostname in groups['meta-Tags_client'] + - name: Install Python3.12 + win_chocolatey: + name: python312 + state: present + tags: install_python - - name: Install RStudio (client machines) + - name: Install RStudio win_chocolatey: name: r.studio state: present + tags: install_rstudio - - name: Install Other Software (client machines) + - name: Install vscode win_chocolatey: - name: "{{ item }}" + name: vscode state: present - loop: - #- vscode.install - - vscode - #- KB4019990 - - python312 - - notepadplusplus - - windirstat - - adobereader - - DotNet4.6 - - dotnet4.7.2 - # loop control ??? + tags: install_vscode - #- name: Install office365proplus (client machines) - # win_chocolatey: - # name: office365proplus - # state: present - # package_params: "'/Global /language:en-GB'" + - name: Install notepadplusplus + win_chocolatey: + name: notepadplusplus + state: present + tags: install_notepadplusplus + - name: Install windirstat + win_chocolatey: + name: windirstat + state: present + tags: install_windirstat - #- name: Install veeam-agent (client machines) - # win_chocolatey: - # name: veeam-agent - # state: present + - name: Install adobereader + win_chocolatey: + name: adobereader + state: present + tags: install_adobereader - # I think Firefox adds one automatically... - #- name: Create Firefox shortcut on the desktop - # community.windows.win_shortcut: - # src: C:\Program Files\Mozilla Firefox\Firefox.exe - # dest: C:\Users\Public\Desktop\Mozilla Firefox.lnk - # icon: C:\Program Files\Mozilla Firefox\Firefox.exe,0 + - name: Install DotNet4.6 + win_chocolatey: + name: DotNet4.6 + state: present + tags: install_dotnet46 + + - name: Install dotnet4.7.2 + win_chocolatey: + name: dotnet4.7.2 + state: present + tags: install_dotnet472 - name: Create RStudio shortcut on the desktop community.windows.win_shortcut: From 84fb2faf38a57833a42bc8f664855a42166fa3ff Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 27 Aug 2024 10:22:01 +0100 Subject: [PATCH 6/7] fix indentation --- ansible/roles/win_client/tasks/chocolatey.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/roles/win_client/tasks/chocolatey.yml b/ansible/roles/win_client/tasks/chocolatey.yml index 5558cb3..db057b3 100644 --- a/ansible/roles/win_client/tasks/chocolatey.yml +++ b/ansible/roles/win_client/tasks/chocolatey.yml @@ -103,7 +103,7 @@ state: present tags: install_dotnet46 - - name: Install dotnet4.7.2 + - name: Install dotnet4.7.2 win_chocolatey: name: dotnet4.7.2 state: present From 1338ab6f08090baefcc7745f03934ed74d91f415 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 27 Aug 2024 10:22:38 +0100 Subject: [PATCH 7/7] update to new hardening script --- .../files/serverhardening.ps1 | 2 +- .../files/serverhardening0.3.ps1 | 27 ++++++++++++------- 2 files changed, 18 insertions(+), 11 deletions(-) diff --git a/ansible/roles/win_domain_controller/files/serverhardening.ps1 b/ansible/roles/win_domain_controller/files/serverhardening.ps1 index 77658a0..b5ed1a3 120000 --- a/ansible/roles/win_domain_controller/files/serverhardening.ps1 +++ b/ansible/roles/win_domain_controller/files/serverhardening.ps1 @@ -1 +1 @@ -serverhardening0.2.ps1 \ No newline at end of file +serverhardening0.3.ps1 \ No newline at end of file diff --git a/ansible/roles/win_domain_controller/files/serverhardening0.3.ps1 b/ansible/roles/win_domain_controller/files/serverhardening0.3.ps1 index de3a912..ede28f2 100644 --- a/ansible/roles/win_domain_controller/files/serverhardening0.3.ps1 +++ b/ansible/roles/win_domain_controller/files/serverhardening0.3.ps1 @@ -1,5 +1,9 @@ -$DomainOU = Get-ADDomain | foreach {$_.DistinguishedName} -set-addefaultdomainpasswordpolicy -ComplexityEnabled True -MinPasswordLength 14 -MaxPasswordAge 30 +$DomainInfo = Get-ADDomain +$DomainOU = $DomainInfo.DistinguishedName +$Domain = $DomainInfo.DNSRoot +$workbenchOU = (Get-ADOrganizationalUnit -Identity "OU=Workbench,$DomainOU").DistinguishedName + +Set-ADDefaultDomainPasswordPolicy -Identity $Domain -ComplexityEnabled $True -MinPasswordLength 14 -MaxPasswordAge "30.00:00:00" #Create Workbench hardening GPO New-GPO -Name "RDS WB hardening" -comment "hardening for the workbench" @@ -182,7 +186,7 @@ Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "ConsentPromptBehaviorAd Set-GPRegistryValue -Name "RDS WB hardening" -ValueName "SupportedEncryptionTypes" -key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters" -Value "2147483644","2147483640" -Type MultiString - +Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force #Auditing Install-Module -Name AuditPolicy -AllowClobber -Force @@ -212,18 +216,19 @@ Set-SystemAuditPolicy -Policy 'Sensitive Privilege Use' -Value SuccessAndFailure Set-SystemAuditPolicy -Policy 'IPsec Driver' -Value SuccessAndFailure -UseAuditpol Set-SystemAuditPolicy -Policy 'Security System Extension' -Value Success -UseAuditpol +Set-GPRegistryValue -Name "Default Domain Controllers Policy" -ValueName "LdapEnforceChannelBinding" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord +Set-GPRegistryValue -Name "Default Domain Controllers Policy" -ValueName "LDAPServerIntegrity" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord +Set-GPRegistryValue -Name "Default Domain Controllers Policy" -ValueName "" -key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters -> NullSessionPipes" -Value LSARPC, NETLOGON, SAMR -Type MultiString +$DCOU = (Get-ADOrganizationalUnit -Identity "OU=Domain Controllers,$DomainOU").DistinguishedName +New-GPLink -Name "Default Domain Controllers Policy" -Target $DCOU -#DC only -Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LdapEnforceChannelBinding" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord -Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LDAPServerIntegrity" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord -Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "" -key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters -> NullSessionPipes" -Value LSARPC, NETLOGON, SAMR -Type MultiString - -$domainid = Get-addomain | foreach {$_.Name} +$domainid = $DomainInfo.Name $workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"'| foreach {$_.DistinguishedName} New-GPLink -Name "RDS WB hardening" -Target $workbenchou Set-GPPermission -Name "RDS WB hardening" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply +# Unrecognized command set-addefaultDomainPolicy -identity $domainid -complexityEnabled $true -lockoutduration 00:40:00 -LockoutObservationWindow 00:15:00 -maxPasswordAge 30 -minPasswordAge 1 -minPasswordLength 14 @@ -231,4 +236,6 @@ set-addefaultDomainPolicy -identity $domainid -complexityEnabled $true -lockoutd #$domainadminid2 = $domainid + "_" + "administrator" #get-aduser -identity 'Administrator' | Rename-AdObject -NewName $domainadminid2 $domainguestid2 = $domainid + "_" + "guest" -get-aduser -identity 'guest' | Rename-AdObject -NewName $domainguestid2 \ No newline at end of file +get-aduser -identity 'guest' | Rename-AdObject -NewName $domainguestid2 + +Write-Output "THIS SCRIPT ACTUALLY RAN" | Out-File -FilePath 'C:\eidf\HardenScript.txt' \ No newline at end of file