From 372ac164add9e272b85eeb2ba4515438fddc3d78 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Mon, 15 Apr 2024 13:26:21 +0000 Subject: [PATCH] win_fileserver role --- ansible/playbooks/win_fileserver.yml | 9 + .../files/OpenStackADBuildv5.ps1 | 202 ++++++++++++++++++ .../files/schedule_transfer_Import_v1.3.ps1 | 38 ++++ .../files/scheduled_transfer_Export_v1.3.ps1 | 57 +++++ ansible/roles/win_fileserver/tasks/disks.yml | 93 ++++++++ ansible/roles/win_fileserver/tasks/main.yml | 4 + ansible/roles/win_fileserver/tasks/share.yml | 0 ansible/roles/win_fileserver/vars/main.yml | 4 + ansible/vars/standard.yml | 2 +- 9 files changed, 408 insertions(+), 1 deletion(-) create mode 100644 ansible/playbooks/win_fileserver.yml create mode 100644 ansible/roles/win_fileserver/files/OpenStackADBuildv5.ps1 create mode 100644 ansible/roles/win_fileserver/files/schedule_transfer_Import_v1.3.ps1 create mode 100644 ansible/roles/win_fileserver/files/scheduled_transfer_Export_v1.3.ps1 create mode 100644 ansible/roles/win_fileserver/tasks/disks.yml create mode 100644 ansible/roles/win_fileserver/tasks/main.yml create mode 100644 ansible/roles/win_fileserver/tasks/share.yml create mode 100644 ansible/roles/win_fileserver/vars/main.yml diff --git a/ansible/playbooks/win_fileserver.yml b/ansible/playbooks/win_fileserver.yml new file mode 100644 index 0000000..9d5e532 --- /dev/null +++ b/ansible/playbooks/win_fileserver.yml @@ -0,0 +1,9 @@ +--- +- hosts: "meta-variant_file_server" # Change this to fileserver (common.yml and standard.yml) + gather_facts: false + vars_files: + - ../vars/common.yml + - ../vars/connection.yml + roles: + - role: win_fileserver + tags: win_fileserver \ No newline at end of file diff --git a/ansible/roles/win_fileserver/files/OpenStackADBuildv5.ps1 b/ansible/roles/win_fileserver/files/OpenStackADBuildv5.ps1 new file mode 100644 index 0000000..a38928d --- /dev/null +++ b/ansible/roles/win_fileserver/files/OpenStackADBuildv5.ps1 @@ -0,0 +1,202 @@ +set-timezone -id UTC + +#Gather DC IP and Name +$domaindetails = get-adcomputer -filter 'Name -like "*DC01*"' | foreach {$_.name} +#$domaindcdns = get-dnsserver -computername $domaindetails | foreach {$_.computername} +$RDSServer = $domaindetails +#Workbench OU +$workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"'| foreach {$_.DistinguishedName} +$DomainOU = Get-ADDomain | foreach {$_.DistinguishedName} +$domainID = Get-ADDomain | foreach {$_.DNSRoot} +$computersOU = get-addomain | foreach {$_.ComputersContainer} +$domaincontrollersOU = get-addomain | foreach {$_.DomainControllersContainer} +$homepage = "https://www.epcc.ed.ac.uk/" +#get wsus server name +$wsusserver = get-adcomputer -Filter 'Name -like "*-wsus*"' | foreach {$_.Name} + +##New OU +New-ADOrganizationalUnit -Name WorkBench +#Workbench OU +$workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"' | foreach {$_.DistinguishedName} +#Move WB machines (when prefix is wb) +$computers = Get-ADcomputer -filter { CN -like "*wb*"} | foreach {$_.DistinguishedName} +$computers | move-adobject -TargetPath $workbenchOU + +#Create RDS Settings GPO +New-GPO -Name "RDS Settings" -comment "RDS Settings for the workbench" +Set-GPRegistryValue -Name "RDS Settings" -ValueName "LicensingMode" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 4 -Type DWord +Set-GPRegistryValue -Name "RDS Settings" -ValueName "LicenseServers" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value $RDSServer -Type String +Set-GPRegistryValue -Name "RDS Settings" -ValueName "MaxInstanceCount" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 999999 -Type DWord +Set-GPRegistryValue -Name "RDS Settings" -ValueName "fDenyTSCConnections" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 0 -Type DWord + +#Create Default Domain Policy GPO +Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "NoAUShutdownOption" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord +Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "UseWUServer" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value $RDSServer -Type String +Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "IncludeRecommendedUpdates" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 999999 -Type DWord +Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "NoAutoRebootWithLoggedOnUsers" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 0 -Type DWord +Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "LicensingMode" -key "HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\Lsa\LmCompatibility" -Value 0 -Type DWord + +#Folder redirection +enable-folderredirection -AllFolder + +#Domain Password Policy +#---Example - https://activedirectorypro.com/how-to-configure-a-domain-password-policy/ +#Set-ADDefaultDomainPasswordPolicy -identity $DomainID -MaxPasswordAge 42 -MinPasswordAge 1 -MinPasswordLength 12 -PasswordHistoryCount 24 -ComplexityEnabled $true -ReversibleEncryptionEnabled $false -LockoutThreshold 0 + +#Create WSUS GPO +New-GPO -Name "WSUS" -comment "WSUS Settings for the workbench" +Set-GPRegistryValue -Name "WSUS" -ValueName "DoNotConnectToWindowsUpdateInternetLocations" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value 1 -Type DWord +Set-GPRegistryValue -Name "WSUS" -ValueName "SetProxyBehaviorForUpdateDetection" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value 0 -Type DWord +#Value is a varible we'll need to change +#Set-GPRegistryValue -Name "WSUS" -ValueName "TargetGroup" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value Space_Std -Type DWord +Set-GPRegistryValue -Name "WSUS" -ValueName "TargetGroupEnabled" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value 1 -Type DWord +#WSUS server IP address +#Doesn't work +#Set-GPRegistryValue -Name "WSUS" -ValueName "WUServer" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value $wsusserver -Type DWord +#Set-GPRegistryValue -Name "WSUS" -ValueName "WUStatusServer" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value $wsusserver -Type DWord +Set-GPRegistryValue -Name "WSUS" -ValueName "AUOptions" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 4 -Type DWord +Set-GPRegistryValue -Name "WSUS" -ValueName "AutoInstallMinorUpdates" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord +Set-GPRegistryValue -Name "WSUS" -ValueName "DetectionFrequency" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 2 -Type DWord +Set-GPRegistryValue -Name "WSUS" -ValueName "DetectionFrequencyEnabled" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord +Set-GPRegistryValue -Name "WSUS" -ValueName "NoAutoUpdate" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 0 -Type DWord +Set-GPRegistryValue -Name "WSUS" -ValueName "ScheduledInstallDay" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 0 -Type DWord +Set-GPRegistryValue -Name "WSUS" -ValueName "ScheduledInstallEveryWeek" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord +Set-GPRegistryValue -Name "WSUS" -ValueName "ScheduledInstallTime" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 3 -Type DWord +Set-GPRegistryValue -Name "WSUS" -ValueName "UseWUServer" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord + +#Create Log on Notification GPO - chaned to string +New-GPO -Name "Logon message" -comment "Log on Message for the workbench" +Set-GPRegistryValue -Name "Logon message" -ValueName "LegalNoticeCaption" -key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value "NOTICE TO USERS" -Type String +Set-GPRegistryValue -Name "Logon message" -ValueName "LegalNoticeText" -key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value "Please adhere to the agreed terms and conditions accepted during account creation." -Type String + +#Create Disable Internet Explorer GPO +New-GPO -Name "Disable Internet Explorer" -comment "IE Settings for the workbench" +Set-GPRegistryValue -Name "Disable Internet Explorer" -ValueName "NotifyDisableIEOptions" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main" -Value 1 -Type DWord + +#Create File History +New-GPO -Name "File History" -comment "File History Settings for the workbench" +Set-GPRegistryValue -Name "File History" -ValueName "Disabled" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\FileHistory" -Value 0 -Type DWord + +#Create Chrome GPO +New-GPO -Name "Chrome" -comment "Chrome Settings for the workbench" + +Set-GPRegistryValue -Name "Chrome" -ValueName "ImportBookmarks" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord +Set-GPRegistryValue -Name "Chrome" -ValueName "ImportHistory" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord +Set-GPRegistryValue -Name "Chrome" -ValueName "ImportHomepage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord +Set-GPRegistryValue -Name "Chrome" -ValueName "ImportSavedPasswords" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord +Set-GPRegistryValue -Name "Chrome" -ValueName "ImportSearchEngine" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord +Set-GPRegistryValue -Name "Chrome" -ValueName "UserFeedbackAllowed" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord +Set-GPRegistryValue -Name "Chrome" -ValueName "ProxySettings" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value $homepage -Type String + + +#Create Firefox GPO +New-GPO -Name "Firefox" -comment "Firefox Settings for the workbench" +Set-GPRegistryValue -Name "Firefox" -ValueName "installlanguage" -key "HKEY_CURRENT_USER\Software\Policies\microsoft\office\16.0\common\languageresources" -Value 2057 -Type DWord +Set-GPRegistryValue -Name "Firefox" -ValueName "preferrededitinglanguage" -key "HKEY_CURRENT_USER\Software\Policies\microsoft\office\16.0\common\languageresources" -Value en-GB -Type DWord +Set-GPRegistryValue -Name "Firefox" -ValueName "SkipOnboarding" -key "HKEY_CURRENT_USER\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 0 -Type DWord +Set-GPRegistryValue -Name "Firefox" -ValueName "WhatsNew" -key "HKEY_CURRENT_USER\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 0 -Type DWord +Set-GPRegistryValue -Name "Firefox" -ValueName "DisableProfileImport" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox" -Value 0 -Type DWord +Set-GPRegistryValue -Name "Firefox" -ValueName "DisableTelemetry" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox" -Value 1 -Type DWord +Set-GPRegistryValue -Name "Firefox" -ValueName "ExtensionRecommendations" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord +Set-GPRegistryValue -Name "Firefox" -ValueName "FeatureRecommendations" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord +Set-GPRegistryValue -Name "Firefox" -ValueName "MoreFromMozilla" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord +Set-GPRegistryValue -Name "Firefox" -ValueName "SkipOnboarding" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord +Set-GPRegistryValue -Name "Firefox" -ValueName "WhatsNew" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 0 -Type DWord +Set-GPRegistryValue -Name "Firefox" -ValueName "URL" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\Homepage" -Value $homepage -Type DWord +Set-GPRegistryValue -Name "Firefox" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\Homepage" -Value homepage -Type DWord + +#Create Edge GPO +New-GPO -Name "Edge" -comment "Edge Settings for the workbench" +Set-GPRegistryValue -Name "Edge" -ValueName "AllowSurfGame" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value 0 -Type DWord +Set-GPRegistryValue -Name "Edge" -ValueName "ConfigureDoNotTrack" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value 0 -Type DWord +Set-GPRegistryValue -Name "Edge" -ValueName "EnhanceSecurityModeOptOutUXEnabled" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value 1 -Type DWord +Set-GPRegistryValue -Name "Edge" -ValueName "URL" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value $homepage -Type DWord +Set-GPRegistryValue -Name "Edge" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value homepage -Type DWord + + +#Create Profile redirection GPO +#New-GPO -Name "Profile Redirection" -comment "Profile Settings for the workbench" +#there must be more + +#Create StartMenu GPO - sort out file name +New-GPO -Name "StartMenu" -comment "StartMenu Settings for the workbench" +Set-GPRegistryValue -Name "StartMenu" -ValueName "HideSCAPower" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Value 1 -Type DWord +Set-GPRegistryValue -Name "StartMenu" -ValueName "NoClose" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Value 1 -Type DWord +Set-GPRegistryValue -Name "StartMenu" -ValueName "NoStartMenuEjectPC" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Value 1 -Type DWord +Set-GPRegistryValue -Name "StartMenu" -ValueName "NoStartMenuMYGames" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Value 1 -Type DWord +Set-GPRegistryValue -Name "StartMenu" -ValueName "LockedStartLayout" -key "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" -Value 1 -Type DWord +Set-GPRegistryValue -Name "StartMenu" -ValueName "StartLayoutFile" -key "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" -Value "C:\eidf\wawb01.xml" -Type DWord +Set-GPRegistryValue -Name "StartMenu" -ValueName "LockedStartLayout" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer" -Value 1 -Type DWord +Set-GPRegistryValue -Name "StartMenu" -ValueName "StartLayoutFile" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer" -Value "C:\eidf\wawb01.xml" -Type DWord +Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Appx" -Value 0 -Type DWord +Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Dll" -Value 0 -Type DWord +Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Exe" -Value 0 -Type DWord +Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Msi" -Value 0 -Type DWord +Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Script" -Value 0 -Type DWord +Set-GPRegistryValue -Name "StartMenu" -ValueName "UserPolicyMode" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System" -Value 2 -Type DWord + +#Create wb_server GPO +New-GPO -Name "wb servers" -comment "WorkBench Settings for the workbench" +Set-GPRegistryValue -Name "wb servers" -ValueName "ShutdownReasonOn" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Reliability" -Value 0 -Type DWord +# Delete this key - Set-GPRegistryValue -Name "wb servers" -ValueName "ShutdownReasonUI" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Reliability" -Value 0 -Type DWord +Set-GPRegistryValue -Name "wb servers" -ValueName "fEnableWddmDriver" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 1 -Type DWord +# four group memberships to add +#Security Template Group Membership *S-1-5-32-544__Memberof +#Security Template Group Membership *S-1-5-32-544__Members *S-1-5-21-1607635393-2609548545-3408924799-512 +#Security Template Group Membership *S-1-5-32-555__Memberof +# *S-1-5-21-1607635393-2609548545-3408924799-1109 + # *S-1-5-21-1607635393-2609548545-3408924799-512 + + # set sebackup privilege + + #https://www.powershellgallery.com/packages/PoshPrivilege/0.3.0.0/Content/Scripts%5CEnable-Privilege.ps1 + #https://blakedrumm.com/blog/set-and-check-user-rights-assignment/ + + #maybe food for access rights - https://stackoverflow.com/questions/74256553/how-to-enable-local-account-lockout-policies-through-powershell + +#Set up Auditing +#https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set + +#Set permissions +Set-GPPermission -Name "rds settings" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply +Set-GPPermission -Name "rds settings" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply +Set-GPPermission -Name "NTLM" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply +Set-GPPermission -Name "NTLM" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply +Set-GPPermission -Name "Chrome" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply +Set-GPPermission -Name "Chrome" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply +Set-GPPermission -Name "Firefox" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply +Set-GPPermission -Name "Firefox" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply +Set-GPPermission -Name "Edge" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply +Set-GPPermission -Name "Edge" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply +Set-GPPermission -Name "wb servers" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply +Set-GPPermission -Name "wb servers" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply +Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply +Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply +Set-GPPermission -Name "WSUS" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply +Set-GPPermission -Name "WSUS" -TargetName "Domain computers" -TargetType Group -PermissionLevel GpoApply +Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply +Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply +Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply +Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply +Set-GPPermission -Name "Default Domain Policy" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply +Set-GPPermission -Name "Default Domain Controllers Policy" -TargetName "Domain Controllers" -TargetType Group -PermissionLevel GpoApply +Set-GPPermission -Name "WSUS" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply + +#Link to OU +New-GPLink -name "rds settings" -Target $workbenchOU +New-GPLink -Name "NTLM" -Target $domaincontrollersOU +New-GPLink -Name "WSUS" -Target $DomainOU +New-GPLink -Name "Logon message" -Target $workbenchOU +New-GPLink -Name "Disable Internet Explorer" -Target $DomainOU +New-GPLink -Name "File History" -Target $workbenchOU +New-GPLink -Name "StartMenu" -Target $workbenchou +New-GPLink -Name "wb servers" -Target $workbenchou +New-GPLink -Name "Edge" -Target $workbenchou +New-GPLink -Name "Firefox" -Target $workbenchou +New-GPLink -Name "Chrome" -Target $workbenchou + +#add entry for WSUS + + + #Profile Redirection + #keyboard settings diff --git a/ansible/roles/win_fileserver/files/schedule_transfer_Import_v1.3.ps1 b/ansible/roles/win_fileserver/files/schedule_transfer_Import_v1.3.ps1 new file mode 100644 index 0000000..5e95caa --- /dev/null +++ b/ansible/roles/win_fileserver/files/schedule_transfer_Import_v1.3.ps1 @@ -0,0 +1,38 @@ +$Directory = "T:\Import\" +Get-ChildItem -Path $Directory -Recurse -Force -File -Exclude ".*" | ForEach { + $filename= "$($_.Name)" + $ParentDirectoryName = "$($_.Directory.Name)" + + Write-host $ParentDirectoryName, $filename + $Source = "T:\Import\" +"$($_.Directory.Name)" + "\" + $filename + $Destination = "S:\" + "$($_.Directory.Name)" + "\" + "Import" + "\" + + #Write-Host $Source + #Write-Host $Destination + + $size=Format-FileSize((Get-Item $source).length) + + Move-Item -path $Source -Destination $Destination + + $Logfile="T:\Logs\TransferLog.txt" + $date = (Get-Date) + $date, $Source, $size, $Destination | out-file $Logfile -Append + + + + + + #Change permissions + Function Format-FileSize() { +Param ([int]$size) +If ($size -gt 1TB) {[string]::Format("{0:0.00} TB", $size / 1TB)} +ElseIf ($size -gt 1GB) {[string]::Format("{0:0.00} GB", $size / 1GB)} +ElseIf ($size -gt 1MB) {[string]::Format("{0:0.00} MB", $size / 1MB)} +ElseIf ($size -gt 1KB) {[string]::Format("{0:0.00} kB", $size / 1KB)} +ElseIf ($size -gt 0) {[string]::Format("{0:0.00} B", $size)} +Else {""} +} + + + + } \ No newline at end of file diff --git a/ansible/roles/win_fileserver/files/scheduled_transfer_Export_v1.3.ps1 b/ansible/roles/win_fileserver/files/scheduled_transfer_Export_v1.3.ps1 new file mode 100644 index 0000000..7a41ee2 --- /dev/null +++ b/ansible/roles/win_fileserver/files/scheduled_transfer_Export_v1.3.ps1 @@ -0,0 +1,57 @@ + + $Directoryex = Get-ChildItem -Path "S:\" -Recurse -Force -ErrorAction SilentlyContinue | Where-Object {$_.Name -eq "Export"} +$Directoryex | ForEach { + $fullnameex= "$($_.FullName)" + $ParentDirectoryNameex = "$($_.parent)" + + $filenameex = Get-ChildItem -path $fullnameex -Force -File | Foreach { + + $Sourceex = $fullnameex + "\" + "$($_.name)" + $Destinationex = "T:\Export\" + $ParentDirectoryNameex + "\" + Move-Item -path $Sourceex -Destination $Destinationex + + #logging + $Logfileex2="T:\Logs\TransferexportLog.txt" + $dateex2 = (Get-Date) + $dateex2, $Sourceex, $Destinationex | out-file $Logfileex2 -Append}} + write-host $sourceex + $Sourceex = $fullnameex + "\" + "$($_.name)" + $NewName = "Standard" + "_" + $ParentDirectoryNameex + "_" + "$($_.name)" + Rename-Item -Path $Sourceex -NewName $NewName + write-host $sourceeex + + Write-Host $Sourceex + Write-Host $Destinationex + + $sizeex=Format-FileSize((Get-Item $sourceex).length) + + + $Directoryex2 = Get-ChildItem -Path "S:\" -Recurse -Force | Where-Object {$_.Name -eq "Export"} + $Directoryex2 | ForEach { + $fullnameex2= "$($_.FullName)" + $ParentDirectoryNameex2 = "$($_.parent)" + + $filenameex2 = Get-ChildItem -path $fullnameex2 -Force -File | Foreach { + + $Sourceex2 = $fullnameex2 + "\" + "$($_.name)" + $Destinationex2 = "T:\Export\" + $ParentDirectoryNameex2 + "\" + + Move-Item -path $Sourceex2 -Destination $Destinationex2 + + $Logfileex2="T:\Logs\TransferexportLog.txt" + $dateex2 = (Get-Date) + $dateex2, $Sourceex, $Destinationex | out-file $Logfileex2 -Append + } + } + + + + Function Format-FileSize() { +Param ([int]$sizeex) +If ($sizeex -gt 1TB) {[string]::Format("{0:0.00} TB", $sizeex / 1TB)} +ElseIf ($sizeex -gt 1GB) {[string]::Format("{0:0.00} GB", $sizeex / 1GB)} +ElseIf ($sizeex -gt 1MB) {[string]::Format("{0:0.00} MB", $sizeex / 1MB)} +ElseIf ($sizeex -gt 1KB) {[string]::Format("{0:0.00} kB", $sizeex / 1KB)} +ElseIf ($sizeex -gt 0) {[string]::Format("{0:0.00} B", $sizeex)} +Else {""} +} \ No newline at end of file diff --git a/ansible/roles/win_fileserver/tasks/disks.yml b/ansible/roles/win_fileserver/tasks/disks.yml new file mode 100644 index 0000000..089464c --- /dev/null +++ b/ansible/roles/win_fileserver/tasks/disks.yml @@ -0,0 +1,93 @@ +--- +- name: Study data disks + tags: studydata_disk + block: + - name: Initialise study data disk + win_initialize_disk: + disk_number: 1 + + - name: Partition study data disk + win_partition: + drive_letter: "{{ studydata_drive_letter }}" + disk_number: 1 + partition_size: -1 + state: present + + - name: Create NTFS filesystem on data disk + win_format: + drive_letter: "{{ studydata_drive_letter }}" + file_system: NTFS + new_label: "{{ studydata_volume_label }}" + + - name: "Create study data share" + win_share: + name: "{{ studydata_volume_label }}" + description: "{{ studydata_volume_label }} Drive" + path: "{{ studydata_drive_letter }}:\\" + list: no + full: Administrators,Administrator,Everyone # is everyone needed + tags: studydata_share + +- name: File transfer disk + tags: filetransfer_disk + block: + - name: Initialise File Transfer disk + win_initialize_disk: + disk_number: 2 + + - name: Partition file transfer disk + win_partition: + drive_letter: "{{ filetransfer_drive_letter }}" + disk_number: 2 + partition_size: -1 + state: present + + - name: Create NTFS filesystem on file transfer disk + win_format: + drive_letter: "{{ filetransfer_drive_letter }}" + file_system: NTFS + new_label: "{{ filetransfer_volume_label }}" + + - name: "Create File Transfer share" + win_share: + name: "{{ filetransfer_volume_label }}" + description: "File Transfer Script shared drive" + path: "{{ filetransfer_drive_letter }}:\\" + list: no + full: Administrators,Administrator,file-transfer + tags: filetransfer_share + + - name: Create EIDF directory in system drive for File Transfer script if it doesn't exist + win_file: + path: "C:\\eidf" + state: directory + + - name: Create Import and Export directories in T drive for File Transfer script + win_file: + path: "T:\\{{ item }}" + state: directory + with_items: ["Import", "Export"] + + - name: Create logs directory in T drive + win_file: + path: "T:\\Logs" + state: directory + + - name: Set permissions on logs folder on T drive + win_acl: + path: "T:\\logs" + user: file-transfer + type: allow + rights: Read,Write,Modify + state: present + + - name: Copy transfer scripts to fileserver + win_copy: + src: "/deployments/{{ os_project }}-{{ win_project }}/ansible/roles/win_fileserver/files/" + dest: "C:\\eidf" + force: true + with_items: + - schedule_transfer_Import_v1.3.ps1 + - scheduled_transfer_Export_v1.3.ps1 + - OpenStackADBuildv5.ps1 + when: inventory_hostname in groups['meta-name_fs01'] \ No newline at end of file diff --git a/ansible/roles/win_fileserver/tasks/main.yml b/ansible/roles/win_fileserver/tasks/main.yml new file mode 100644 index 0000000..1bda549 --- /dev/null +++ b/ansible/roles/win_fileserver/tasks/main.yml @@ -0,0 +1,4 @@ +--- +- import_tasks: disks.yml +- import_tasks: share.yml + diff --git a/ansible/roles/win_fileserver/tasks/share.yml b/ansible/roles/win_fileserver/tasks/share.yml new file mode 100644 index 0000000..e69de29 diff --git a/ansible/roles/win_fileserver/vars/main.yml b/ansible/roles/win_fileserver/vars/main.yml new file mode 100644 index 0000000..848e924 --- /dev/null +++ b/ansible/roles/win_fileserver/vars/main.yml @@ -0,0 +1,4 @@ +studydata_drive_letter: S +studydata_volume_label: Study_Data_DFS +filetransfer_drive_letter: T +filetransfer_volume_label: File_Transfer \ No newline at end of file diff --git a/ansible/vars/standard.yml b/ansible/vars/standard.yml index eb86f2c..532a785 100644 --- a/ansible/vars/standard.yml +++ b/ansible/vars/standard.yml @@ -44,7 +44,7 @@ remote_ip_rules: # User VMs - { direction: "ingress", protocol: "tcp", port_min: 3389, port_max: 3389, group: "user_vms", remote_ip: "0.0.0.0/0", comment: "RDP"} # File servers - #- { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "", comment: "SMB"} + - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.1.220", comment: "SMB os-transfer"} # All Winwdows VMs - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.4.71/32", comment: "WinRM rundeck 1"}