From 937c3839ca7309e539049fbbc317473cc6daa9f4 Mon Sep 17 00:00:00 2001 From: abrown38 Date: Tue, 13 Aug 2024 21:38:58 +0100 Subject: [PATCH] small fix --- .../roles/win_domain_controller/files/serverhardening0.2.ps1 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ansible/roles/win_domain_controller/files/serverhardening0.2.ps1 b/ansible/roles/win_domain_controller/files/serverhardening0.2.ps1 index ae91753..b4a523a 100644 --- a/ansible/roles/win_domain_controller/files/serverhardening0.2.ps1 +++ b/ansible/roles/win_domain_controller/files/serverhardening0.2.ps1 @@ -219,9 +219,12 @@ Set-SystemAuditPolicy -Policy 'Security System Extension' -Value Success -UseAud # 3 LINES BELOW DONT WORK NO GPO CALLED "Default Domain Controller Policy" #DC only +New-GPO -Name "Default Domain Controller Policy" -comment "Default policy for domain controllers" Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LdapEnforceChannelBinding" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "LDAPServerIntegrity" -key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Value 2 -Type DWord Set-GPRegistryValue -Name "Default Domain Controller Policy" -ValueName "" -key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters -> NullSessionPipes" -Value LSARPC, NETLOGON, SAMR -Type MultiString +$DCOU = (Get-ADOrganizationalUnit -Identity "OU=Domain Controllers,$DomainOU").DistinguishedName +New-GPLink -Name "Default Domain Controller Policy" -Target $DCOU $domainid = $DomainInfo.Name