mirror of
https://git.ecdf.ed.ac.uk/win_automation/windows-ansible.git
synced 2026-10-26 15:07:21 +00:00
win_fileserver role
This commit is contained in:
abrown38 committed
1 parent
acf465f5b9
commit
372ac164ad
9 files changed
+408
-1
No files matched your search
@@ -0,0 +1,9 @@
|
||||
---
|
||||
- hosts: "meta-variant_file_server" # Change this to fileserver (common.yml and standard.yml)
|
||||
gather_facts: false
|
||||
vars_files:
|
||||
- ../vars/common.yml
|
||||
- ../vars/connection.yml
|
||||
roles:
|
||||
- role: win_fileserver
|
||||
tags: win_fileserver
|
||||
@@ -0,0 +1,202 @@
|
||||
set-timezone -id UTC
|
||||
|
||||
#Gather DC IP and Name
|
||||
$domaindetails = get-adcomputer -filter 'Name -like "*DC01*"' | foreach {$_.name}
|
||||
#$domaindcdns = get-dnsserver -computername $domaindetails | foreach {$_.computername}
|
||||
$RDSServer = $domaindetails
|
||||
#Workbench OU
|
||||
$workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"'| foreach {$_.DistinguishedName}
|
||||
$DomainOU = Get-ADDomain | foreach {$_.DistinguishedName}
|
||||
$domainID = Get-ADDomain | foreach {$_.DNSRoot}
|
||||
$computersOU = get-addomain | foreach {$_.ComputersContainer}
|
||||
$domaincontrollersOU = get-addomain | foreach {$_.DomainControllersContainer}
|
||||
$homepage = "https://www.epcc.ed.ac.uk/"
|
||||
#get wsus server name
|
||||
$wsusserver = get-adcomputer -Filter 'Name -like "*-wsus*"' | foreach {$_.Name}
|
||||
|
||||
##New OU
|
||||
New-ADOrganizationalUnit -Name WorkBench
|
||||
#Workbench OU
|
||||
$workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"' | foreach {$_.DistinguishedName}
|
||||
#Move WB machines (when prefix is wb)
|
||||
$computers = Get-ADcomputer -filter { CN -like "*wb*"} | foreach {$_.DistinguishedName}
|
||||
$computers | move-adobject -TargetPath $workbenchOU
|
||||
|
||||
#Create RDS Settings GPO
|
||||
New-GPO -Name "RDS Settings" -comment "RDS Settings for the workbench"
|
||||
Set-GPRegistryValue -Name "RDS Settings" -ValueName "LicensingMode" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 4 -Type DWord
|
||||
Set-GPRegistryValue -Name "RDS Settings" -ValueName "LicenseServers" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value $RDSServer -Type String
|
||||
Set-GPRegistryValue -Name "RDS Settings" -ValueName "MaxInstanceCount" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 999999 -Type DWord
|
||||
Set-GPRegistryValue -Name "RDS Settings" -ValueName "fDenyTSCConnections" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 0 -Type DWord
|
||||
|
||||
#Create Default Domain Policy GPO
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "NoAUShutdownOption" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "UseWUServer" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value $RDSServer -Type String
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "IncludeRecommendedUpdates" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 999999 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "NoAutoRebootWithLoggedOnUsers" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "LicensingMode" -key "HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\Lsa\LmCompatibility" -Value 0 -Type DWord
|
||||
|
||||
#Folder redirection
|
||||
enable-folderredirection -AllFolder
|
||||
|
||||
#Domain Password Policy
|
||||
#---Example - https://activedirectorypro.com/how-to-configure-a-domain-password-policy/
|
||||
#Set-ADDefaultDomainPasswordPolicy -identity $DomainID -MaxPasswordAge 42 -MinPasswordAge 1 -MinPasswordLength 12 -PasswordHistoryCount 24 -ComplexityEnabled $true -ReversibleEncryptionEnabled $false -LockoutThreshold 0
|
||||
|
||||
#Create WSUS GPO
|
||||
New-GPO -Name "WSUS" -comment "WSUS Settings for the workbench"
|
||||
Set-GPRegistryValue -Name "WSUS" -ValueName "DoNotConnectToWindowsUpdateInternetLocations" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "WSUS" -ValueName "SetProxyBehaviorForUpdateDetection" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value 0 -Type DWord
|
||||
#Value is a varible we'll need to change
|
||||
#Set-GPRegistryValue -Name "WSUS" -ValueName "TargetGroup" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value Space_Std -Type DWord
|
||||
Set-GPRegistryValue -Name "WSUS" -ValueName "TargetGroupEnabled" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value 1 -Type DWord
|
||||
#WSUS server IP address
|
||||
#Doesn't work
|
||||
#Set-GPRegistryValue -Name "WSUS" -ValueName "WUServer" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value $wsusserver -Type DWord
|
||||
#Set-GPRegistryValue -Name "WSUS" -ValueName "WUStatusServer" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value $wsusserver -Type DWord
|
||||
Set-GPRegistryValue -Name "WSUS" -ValueName "AUOptions" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 4 -Type DWord
|
||||
Set-GPRegistryValue -Name "WSUS" -ValueName "AutoInstallMinorUpdates" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "WSUS" -ValueName "DetectionFrequency" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 2 -Type DWord
|
||||
Set-GPRegistryValue -Name "WSUS" -ValueName "DetectionFrequencyEnabled" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "WSUS" -ValueName "NoAutoUpdate" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "WSUS" -ValueName "ScheduledInstallDay" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "WSUS" -ValueName "ScheduledInstallEveryWeek" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "WSUS" -ValueName "ScheduledInstallTime" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 3 -Type DWord
|
||||
Set-GPRegistryValue -Name "WSUS" -ValueName "UseWUServer" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord
|
||||
|
||||
#Create Log on Notification GPO - chaned to string
|
||||
New-GPO -Name "Logon message" -comment "Log on Message for the workbench"
|
||||
Set-GPRegistryValue -Name "Logon message" -ValueName "LegalNoticeCaption" -key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value "NOTICE TO USERS" -Type String
|
||||
Set-GPRegistryValue -Name "Logon message" -ValueName "LegalNoticeText" -key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value "Please adhere to the agreed terms and conditions accepted during account creation." -Type String
|
||||
|
||||
#Create Disable Internet Explorer GPO
|
||||
New-GPO -Name "Disable Internet Explorer" -comment "IE Settings for the workbench"
|
||||
Set-GPRegistryValue -Name "Disable Internet Explorer" -ValueName "NotifyDisableIEOptions" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main" -Value 1 -Type DWord
|
||||
|
||||
#Create File History
|
||||
New-GPO -Name "File History" -comment "File History Settings for the workbench"
|
||||
Set-GPRegistryValue -Name "File History" -ValueName "Disabled" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\FileHistory" -Value 0 -Type DWord
|
||||
|
||||
#Create Chrome GPO
|
||||
New-GPO -Name "Chrome" -comment "Chrome Settings for the workbench"
|
||||
|
||||
Set-GPRegistryValue -Name "Chrome" -ValueName "ImportBookmarks" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Chrome" -ValueName "ImportHistory" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Chrome" -ValueName "ImportHomepage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Chrome" -ValueName "ImportSavedPasswords" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Chrome" -ValueName "ImportSearchEngine" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Chrome" -ValueName "UserFeedbackAllowed" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Chrome" -ValueName "ProxySettings" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value $homepage -Type String
|
||||
|
||||
|
||||
#Create Firefox GPO
|
||||
New-GPO -Name "Firefox" -comment "Firefox Settings for the workbench"
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "installlanguage" -key "HKEY_CURRENT_USER\Software\Policies\microsoft\office\16.0\common\languageresources" -Value 2057 -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "preferrededitinglanguage" -key "HKEY_CURRENT_USER\Software\Policies\microsoft\office\16.0\common\languageresources" -Value en-GB -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "SkipOnboarding" -key "HKEY_CURRENT_USER\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "WhatsNew" -key "HKEY_CURRENT_USER\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "DisableProfileImport" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "DisableTelemetry" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "ExtensionRecommendations" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "FeatureRecommendations" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "MoreFromMozilla" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "SkipOnboarding" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "WhatsNew" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "URL" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\Homepage" -Value $homepage -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\Homepage" -Value homepage -Type DWord
|
||||
|
||||
#Create Edge GPO
|
||||
New-GPO -Name "Edge" -comment "Edge Settings for the workbench"
|
||||
Set-GPRegistryValue -Name "Edge" -ValueName "AllowSurfGame" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Edge" -ValueName "ConfigureDoNotTrack" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Edge" -ValueName "EnhanceSecurityModeOptOutUXEnabled" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Edge" -ValueName "URL" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value $homepage -Type DWord
|
||||
Set-GPRegistryValue -Name "Edge" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value homepage -Type DWord
|
||||
|
||||
|
||||
#Create Profile redirection GPO
|
||||
#New-GPO -Name "Profile Redirection" -comment "Profile Settings for the workbench"
|
||||
#there must be more
|
||||
|
||||
#Create StartMenu GPO - sort out file name
|
||||
New-GPO -Name "StartMenu" -comment "StartMenu Settings for the workbench"
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "HideSCAPower" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "NoClose" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "NoStartMenuEjectPC" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "NoStartMenuMYGames" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "LockedStartLayout" -key "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "StartLayoutFile" -key "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" -Value "C:\eidf\wawb01.xml" -Type DWord
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "LockedStartLayout" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "StartLayoutFile" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer" -Value "C:\eidf\wawb01.xml" -Type DWord
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Appx" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Dll" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Exe" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Msi" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Script" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "StartMenu" -ValueName "UserPolicyMode" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System" -Value 2 -Type DWord
|
||||
|
||||
#Create wb_server GPO
|
||||
New-GPO -Name "wb servers" -comment "WorkBench Settings for the workbench"
|
||||
Set-GPRegistryValue -Name "wb servers" -ValueName "ShutdownReasonOn" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Reliability" -Value 0 -Type DWord
|
||||
# Delete this key - Set-GPRegistryValue -Name "wb servers" -ValueName "ShutdownReasonUI" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Reliability" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "wb servers" -ValueName "fEnableWddmDriver" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 1 -Type DWord
|
||||
# four group memberships to add
|
||||
#Security Template Group Membership *S-1-5-32-544__Memberof
|
||||
#Security Template Group Membership *S-1-5-32-544__Members *S-1-5-21-1607635393-2609548545-3408924799-512
|
||||
#Security Template Group Membership *S-1-5-32-555__Memberof
|
||||
# *S-1-5-21-1607635393-2609548545-3408924799-1109
|
||||
# *S-1-5-21-1607635393-2609548545-3408924799-512
|
||||
|
||||
# set sebackup privilege
|
||||
|
||||
#https://www.powershellgallery.com/packages/PoshPrivilege/0.3.0.0/Content/Scripts%5CEnable-Privilege.ps1
|
||||
#https://blakedrumm.com/blog/set-and-check-user-rights-assignment/
|
||||
|
||||
#maybe food for access rights - https://stackoverflow.com/questions/74256553/how-to-enable-local-account-lockout-policies-through-powershell
|
||||
|
||||
#Set up Auditing
|
||||
#https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
|
||||
|
||||
#Set permissions
|
||||
Set-GPPermission -Name "rds settings" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "rds settings" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "NTLM" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "NTLM" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Chrome" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Chrome" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Firefox" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Firefox" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Edge" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Edge" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "wb servers" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "wb servers" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "WSUS" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "WSUS" -TargetName "Domain computers" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Default Domain Policy" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Default Domain Controllers Policy" -TargetName "Domain Controllers" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "WSUS" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply
|
||||
|
||||
#Link to OU
|
||||
New-GPLink -name "rds settings" -Target $workbenchOU
|
||||
New-GPLink -Name "NTLM" -Target $domaincontrollersOU
|
||||
New-GPLink -Name "WSUS" -Target $DomainOU
|
||||
New-GPLink -Name "Logon message" -Target $workbenchOU
|
||||
New-GPLink -Name "Disable Internet Explorer" -Target $DomainOU
|
||||
New-GPLink -Name "File History" -Target $workbenchOU
|
||||
New-GPLink -Name "StartMenu" -Target $workbenchou
|
||||
New-GPLink -Name "wb servers" -Target $workbenchou
|
||||
New-GPLink -Name "Edge" -Target $workbenchou
|
||||
New-GPLink -Name "Firefox" -Target $workbenchou
|
||||
New-GPLink -Name "Chrome" -Target $workbenchou
|
||||
|
||||
#add entry for WSUS
|
||||
|
||||
|
||||
#Profile Redirection
|
||||
#keyboard settings
|
||||
@@ -0,0 +1,38 @@
|
||||
$Directory = "T:\Import\"
|
||||
Get-ChildItem -Path $Directory -Recurse -Force -File -Exclude ".*" | ForEach {
|
||||
$filename= "$($_.Name)"
|
||||
$ParentDirectoryName = "$($_.Directory.Name)"
|
||||
|
||||
Write-host $ParentDirectoryName, $filename
|
||||
$Source = "T:\Import\" +"$($_.Directory.Name)" + "\" + $filename
|
||||
$Destination = "S:\" + "$($_.Directory.Name)" + "\" + "Import" + "\"
|
||||
|
||||
#Write-Host $Source
|
||||
#Write-Host $Destination
|
||||
|
||||
$size=Format-FileSize((Get-Item $source).length)
|
||||
|
||||
Move-Item -path $Source -Destination $Destination
|
||||
|
||||
$Logfile="T:\Logs\TransferLog.txt"
|
||||
$date = (Get-Date)
|
||||
$date, $Source, $size, $Destination | out-file $Logfile -Append
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#Change permissions
|
||||
Function Format-FileSize() {
|
||||
Param ([int]$size)
|
||||
If ($size -gt 1TB) {[string]::Format("{0:0.00} TB", $size / 1TB)}
|
||||
ElseIf ($size -gt 1GB) {[string]::Format("{0:0.00} GB", $size / 1GB)}
|
||||
ElseIf ($size -gt 1MB) {[string]::Format("{0:0.00} MB", $size / 1MB)}
|
||||
ElseIf ($size -gt 1KB) {[string]::Format("{0:0.00} kB", $size / 1KB)}
|
||||
ElseIf ($size -gt 0) {[string]::Format("{0:0.00} B", $size)}
|
||||
Else {""}
|
||||
}
|
||||
|
||||
|
||||
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
|
||||
$Directoryex = Get-ChildItem -Path "S:\" -Recurse -Force -ErrorAction SilentlyContinue | Where-Object {$_.Name -eq "Export"}
|
||||
$Directoryex | ForEach {
|
||||
$fullnameex= "$($_.FullName)"
|
||||
$ParentDirectoryNameex = "$($_.parent)"
|
||||
|
||||
$filenameex = Get-ChildItem -path $fullnameex -Force -File | Foreach {
|
||||
|
||||
$Sourceex = $fullnameex + "\" + "$($_.name)"
|
||||
$Destinationex = "T:\Export\" + $ParentDirectoryNameex + "\"
|
||||
Move-Item -path $Sourceex -Destination $Destinationex
|
||||
|
||||
#logging
|
||||
$Logfileex2="T:\Logs\TransferexportLog.txt"
|
||||
$dateex2 = (Get-Date)
|
||||
$dateex2, $Sourceex, $Destinationex | out-file $Logfileex2 -Append}}
|
||||
write-host $sourceex
|
||||
$Sourceex = $fullnameex + "\" + "$($_.name)"
|
||||
$NewName = "Standard" + "_" + $ParentDirectoryNameex + "_" + "$($_.name)"
|
||||
Rename-Item -Path $Sourceex -NewName $NewName
|
||||
write-host $sourceeex
|
||||
|
||||
Write-Host $Sourceex
|
||||
Write-Host $Destinationex
|
||||
|
||||
$sizeex=Format-FileSize((Get-Item $sourceex).length)
|
||||
|
||||
|
||||
$Directoryex2 = Get-ChildItem -Path "S:\" -Recurse -Force | Where-Object {$_.Name -eq "Export"}
|
||||
$Directoryex2 | ForEach {
|
||||
$fullnameex2= "$($_.FullName)"
|
||||
$ParentDirectoryNameex2 = "$($_.parent)"
|
||||
|
||||
$filenameex2 = Get-ChildItem -path $fullnameex2 -Force -File | Foreach {
|
||||
|
||||
$Sourceex2 = $fullnameex2 + "\" + "$($_.name)"
|
||||
$Destinationex2 = "T:\Export\" + $ParentDirectoryNameex2 + "\"
|
||||
|
||||
Move-Item -path $Sourceex2 -Destination $Destinationex2
|
||||
|
||||
$Logfileex2="T:\Logs\TransferexportLog.txt"
|
||||
$dateex2 = (Get-Date)
|
||||
$dateex2, $Sourceex, $Destinationex | out-file $Logfileex2 -Append
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
Function Format-FileSize() {
|
||||
Param ([int]$sizeex)
|
||||
If ($sizeex -gt 1TB) {[string]::Format("{0:0.00} TB", $sizeex / 1TB)}
|
||||
ElseIf ($sizeex -gt 1GB) {[string]::Format("{0:0.00} GB", $sizeex / 1GB)}
|
||||
ElseIf ($sizeex -gt 1MB) {[string]::Format("{0:0.00} MB", $sizeex / 1MB)}
|
||||
ElseIf ($sizeex -gt 1KB) {[string]::Format("{0:0.00} kB", $sizeex / 1KB)}
|
||||
ElseIf ($sizeex -gt 0) {[string]::Format("{0:0.00} B", $sizeex)}
|
||||
Else {""}
|
||||
}
|
||||
@@ -0,0 +1,93 @@
|
||||
---
|
||||
- name: Study data disks
|
||||
tags: studydata_disk
|
||||
block:
|
||||
- name: Initialise study data disk
|
||||
win_initialize_disk:
|
||||
disk_number: 1
|
||||
|
||||
- name: Partition study data disk
|
||||
win_partition:
|
||||
drive_letter: "{{ studydata_drive_letter }}"
|
||||
disk_number: 1
|
||||
partition_size: -1
|
||||
state: present
|
||||
|
||||
- name: Create NTFS filesystem on data disk
|
||||
win_format:
|
||||
drive_letter: "{{ studydata_drive_letter }}"
|
||||
file_system: NTFS
|
||||
new_label: "{{ studydata_volume_label }}"
|
||||
|
||||
- name: "Create study data share"
|
||||
win_share:
|
||||
name: "{{ studydata_volume_label }}"
|
||||
description: "{{ studydata_volume_label }} Drive"
|
||||
path: "{{ studydata_drive_letter }}:\\"
|
||||
list: no
|
||||
full: Administrators,Administrator,Everyone # is everyone needed
|
||||
tags: studydata_share
|
||||
|
||||
- name: File transfer disk
|
||||
tags: filetransfer_disk
|
||||
block:
|
||||
- name: Initialise File Transfer disk
|
||||
win_initialize_disk:
|
||||
disk_number: 2
|
||||
|
||||
- name: Partition file transfer disk
|
||||
win_partition:
|
||||
drive_letter: "{{ filetransfer_drive_letter }}"
|
||||
disk_number: 2
|
||||
partition_size: -1
|
||||
state: present
|
||||
|
||||
- name: Create NTFS filesystem on file transfer disk
|
||||
win_format:
|
||||
drive_letter: "{{ filetransfer_drive_letter }}"
|
||||
file_system: NTFS
|
||||
new_label: "{{ filetransfer_volume_label }}"
|
||||
|
||||
- name: "Create File Transfer share"
|
||||
win_share:
|
||||
name: "{{ filetransfer_volume_label }}"
|
||||
description: "File Transfer Script shared drive"
|
||||
path: "{{ filetransfer_drive_letter }}:\\"
|
||||
list: no
|
||||
full: Administrators,Administrator,file-transfer
|
||||
tags: filetransfer_share
|
||||
|
||||
- name: Create EIDF directory in system drive for File Transfer script if it doesn't exist
|
||||
win_file:
|
||||
path: "C:\\eidf"
|
||||
state: directory
|
||||
|
||||
- name: Create Import and Export directories in T drive for File Transfer script
|
||||
win_file:
|
||||
path: "T:\\{{ item }}"
|
||||
state: directory
|
||||
with_items: ["Import", "Export"]
|
||||
|
||||
- name: Create logs directory in T drive
|
||||
win_file:
|
||||
path: "T:\\Logs"
|
||||
state: directory
|
||||
|
||||
- name: Set permissions on logs folder on T drive
|
||||
win_acl:
|
||||
path: "T:\\logs"
|
||||
user: file-transfer
|
||||
type: allow
|
||||
rights: Read,Write,Modify
|
||||
state: present
|
||||
|
||||
- name: Copy transfer scripts to fileserver
|
||||
win_copy:
|
||||
src: "/deployments/{{ os_project }}-{{ win_project }}/ansible/roles/win_fileserver/files/"
|
||||
dest: "C:\\eidf"
|
||||
force: true
|
||||
with_items:
|
||||
- schedule_transfer_Import_v1.3.ps1
|
||||
- scheduled_transfer_Export_v1.3.ps1
|
||||
- OpenStackADBuildv5.ps1
|
||||
when: inventory_hostname in groups['meta-name_fs01']
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
- import_tasks: disks.yml
|
||||
- import_tasks: share.yml
|
||||
|
||||
Whitespace-only changes.
@@ -0,0 +1,4 @@
|
||||
studydata_drive_letter: S
|
||||
studydata_volume_label: Study_Data_DFS
|
||||
filetransfer_drive_letter: T
|
||||
filetransfer_volume_label: File_Transfer
|
||||
@@ -44,7 +44,7 @@ remote_ip_rules:
|
||||
# User VMs
|
||||
- { direction: "ingress", protocol: "tcp", port_min: 3389, port_max: 3389, group: "user_vms", remote_ip: "0.0.0.0/0", comment: "RDP"}
|
||||
# File servers
|
||||
#- { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "<transfer ip>", comment: "SMB"}
|
||||
- { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.1.220", comment: "SMB os-transfer"}
|
||||
|
||||
# All Winwdows VMs
|
||||
- { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.4.71/32", comment: "WinRM rundeck 1"}
|
||||
|
||||
Reference in new issue
Block a user