mirror of
https://git.ecdf.ed.ac.uk/win_automation/windows-ansible.git
synced 2026-10-26 12:07:21 +00:00
update script
This commit is contained in:
abrown38 committed
1 parent
be0be6f36f
commit
ebcb9ff15a
1 file changed
+73
-52
@@ -1,27 +1,32 @@
|
||||
set-timezone -id UTC
|
||||
set-timezone -Id 'GMT Standard Time'
|
||||
|
||||
$DomainInfo = Get-ADDomain
|
||||
|
||||
# Get Windows Project
|
||||
$winProject = $DomainInfo.DNSRoot.split('.')[0]
|
||||
|
||||
# Get DC01 name
|
||||
$DC01 = (Get-ADComputer -Identity "$winProject-DC01").Name
|
||||
|
||||
# Set RDS Server
|
||||
$RDSServer = $DC01
|
||||
|
||||
#Gather DC IP and Name
|
||||
$domaindetails = get-adcomputer -filter 'Name -like "*DC01*"' | foreach {$_.name}
|
||||
#$domaindcdns = get-dnsserver -computername $domaindetails | foreach {$_.computername}
|
||||
$RDSServer = $domaindetails
|
||||
#Workbench OU
|
||||
$workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"'| foreach {$_.DistinguishedName}
|
||||
$DomainOU = Get-ADDomain | foreach {$_.DistinguishedName}
|
||||
$domainID = Get-ADDomain | foreach {$_.DNSRoot}
|
||||
$winProject = (Get-ADDomain).DNSRoot.split('.')[0]
|
||||
$computersOU = get-addomain | foreach {$_.ComputersContainer}
|
||||
$domaincontrollersOU = get-addomain | foreach {$_.DomainControllersContainer}
|
||||
$homepage = "https://www.epcc.ed.ac.uk/"
|
||||
$DomainOU = $DomainInfo.DistinguishedName
|
||||
$domainID = $DomainInfo.DNSRoot
|
||||
$workbenchOU = (Get-ADOrganizationalUnit -Identity "OU=Workbench,$DomainOU").DistinguishedName
|
||||
|
||||
$computersOU = $DomainInfo.ComputersContainer
|
||||
$domaincontrollersOU = $DomainInfo.DomainControllersContainer
|
||||
|
||||
#get wsus server name
|
||||
$wsusserver = get-adcomputer -Filter 'Name -like "*-wsus*"' | foreach {$_.Name}
|
||||
$wsusserver = (Get-ADComputer -Identity "$winProject-WSUS").Name
|
||||
|
||||
##New OU
|
||||
New-ADOrganizationalUnit -Name WorkBench
|
||||
#Workbench OU
|
||||
$workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"' | foreach {$_.DistinguishedName}
|
||||
#Move WB machines (when prefix is wb)
|
||||
$computers = Get-ADComputer -Filter * | Where-Object { $_.name -match "^.*(wb)[0-9]+$" } | ForEach-Object { $_.DistinguishedName }
|
||||
$computers | move-adobject -TargetPath $workbenchOU
|
||||
$homepage = "https://www.epcc.ed.ac.uk/"
|
||||
|
||||
#Move WB machines (when prefix is wb) SHOULD NOT BE NEEDED ANSIBLE DOES THIS. CAN CHANGE REGEX TO ALSO ADD APP AND GPU
|
||||
$computers = Get-ADComputer -Filter * | Where-Object { $_.name -match "^.*(wb|app|gpu)[0-9]+$" } | ForEach-Object { $_.Name }
|
||||
#$computers | move-adobject -TargetPath $workbenchOU
|
||||
|
||||
#Create RDS Settings GPO
|
||||
New-GPO -Name "RDS Settings" -comment "RDS Settings for the workbench"
|
||||
@@ -128,8 +133,8 @@ Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisableUPnPRegistr
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisableInBand802DOT11Registrar" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisableFlashConfigRegistrar" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisableWPDRegistrar" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "MaxWCNDeviceNumber" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value -Type String
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "HigherPrecedenceRegistrar" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value -Type String
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "MaxWCNDeviceNumber" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value -Type String #MISSING_VALUE
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "HigherPrecedenceRegistrar" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value -Type String #MISSING_VALUE
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisableWcnUi" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\UI" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "ScenarioExecutionEnabled" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d}" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "Disabled" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\Windows Error Reporting" -Value 1 -Type DWord
|
||||
@@ -138,10 +143,10 @@ Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "NoAUShutdownOption
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "UseWUServer" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value SGSTD-DC01 -Type String
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DeferQualityUpdates" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DeferQualityUpdatesPeriodInDays" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "PauseQualityUpdatesStartTime" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "PauseQualityUpdatesStartTime" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value -Type DWord #MISSING_VALUE
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DeferFeatureUpdates" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DeferFeatureUpdatesPeriodInDays" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "PauseFeatureUpdatesStartTime" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value -Type String
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "PauseFeatureUpdatesStartTime" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value -Type String #MISSING_VALUE
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "AllowDigest" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WinRM\Client" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "AllowRemoteShellAccess" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WinRM\Service\WinRS" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisableRunAs" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WinRM\Service" -Value 1 -Type DWord
|
||||
@@ -162,10 +167,10 @@ Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "EnableAuthEpResolu
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "IncludeRecommendedUpdates" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value 999999 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "NoAutoRebootWithLoggedOnUsers" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fAllowToGetHelp" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fAllowFullControl" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "MaxTicketExpiry" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "MaxTicketExpiryUnits" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fUseMailto" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fAllowFullControl" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String #MISSING_VALUE
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "MaxTicketExpiry" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String #MISSING_VALUE
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "MaxTicketExpiryUnits" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String #MISSING_VALUE
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fUseMailto" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String #MISSING_VALUE
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisablePasswordSaving" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fDisableCcm" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fDisableLPT" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value 1 -Type DWord
|
||||
@@ -194,13 +199,13 @@ Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "UseMachineId" -Key
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "LmCompatibilityLevel" -Key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa" -Value 5 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "NTLMMinServerSec" -Key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0" -Value 537395200 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "FilterAdministratorToken" -Key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value 1 -Type Dword
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "ConsentPromptBehaviorAdmin" -Key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value ^2$ -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "ConsentPromptBehaviorAdmin" -Key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value 2 -Type DWord
|
||||
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "ConsentPromptBehaviourUser" -Key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value 0 -Type DWord
|
||||
|
||||
|
||||
|
||||
#Folder redirection
|
||||
enable-folderredirection -AllFolder
|
||||
#Folder redirection - MISSING MODULE??
|
||||
#enable-folderredirection -AllFolder
|
||||
|
||||
#Domain Password Policy
|
||||
Set-ADDefaultDomainPasswordPolicy -identity $DomainID -MaxPasswordAge "42" -MinPasswordAge "1" -MinPasswordLength "12" -PasswordHistoryCount "24" -ComplexityEnabled $true -ReversibleEncryptionEnabled $false -LockoutThreshold "0"
|
||||
@@ -268,7 +273,7 @@ Set-GPRegistryValue -Name "Firefox" -ValueName "MoreFromMozilla" -Key "HKEY_LOCA
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "SkipOnboarding" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "WhatsNew" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "URL" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\Homepage" -Value $homepage -Type String
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\Homepage" -Value homepage -Type DWord
|
||||
Set-GPRegistryValue -Name "Firefox" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\Homepage" -Value $homepage -Type DWord
|
||||
|
||||
|
||||
#Create Edge GPO
|
||||
@@ -277,7 +282,7 @@ Set-GPRegistryValue -Name "Edge" -ValueName "AllowSurfGame" -Key "HKEY_LOCAL_MAC
|
||||
Set-GPRegistryValue -Name "Edge" -ValueName "ConfigureDoNotTrack" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "Edge" -ValueName "EnhanceSecurityModeOptOutUXEnabled" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "Edge" -ValueName "URL" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value $homepage -Type String
|
||||
Set-GPRegistryValue -Name "Edge" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value homepage -Type DWord
|
||||
Set-GPRegistryValue -Name "Edge" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value $homepage -Type String
|
||||
|
||||
|
||||
#Create Profile redirection GPO
|
||||
@@ -309,21 +314,36 @@ Set-GPRegistryValue -Name "wb servers" -ValueName "ShutdownReasonOn" -key "HKEY_
|
||||
|
||||
#Create firewall GPO
|
||||
New-GPO -Name "firewall" -comment "firewall Settings for the end user servers"
|
||||
Set-GPRegistryValue -Name "firewall" -ValueName "EnableFirewall" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "firewall" -ValueName "EnableFirewall" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "firewall" -ValueName "EnableFirewall" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "firewall" -ValueName "EnableFirewall" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "firewall" -ValueName "EnableFirewall" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "firewall" -ValueName "EnableFirewall" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile" -Value 0 -Type DWord
|
||||
Set-GPRegistryValue -Name "firewall" -ValueName "fEnableWddmDriver" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "firewall" -ValueName "LogFilePath" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging" -Value %systemroot%\system32\logfiles\firewall\domainfw.log -Type String
|
||||
Set-GPRegistryValue -Name "firewall" -ValueName "LogFileSize" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging" -Value 32096 -Type DWord
|
||||
Set-GPRegistryValue -Name "firewall" -ValueName "DisableNotifications" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\WindowsFirewall\DomainProfile" -Value 1 -Type DWord
|
||||
Set-GPRegistryValue -Name "firewall" -ValueName "PolicyVersion" -key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\WindowsFirewall" -Value 543 -Type DWord
|
||||
Import-Module -Name NetSecurity
|
||||
|
||||
$fwgpo = Get-GPO -Name "Firewall"
|
||||
$fwgponame = $fwgpo.DomainName + "\" + $fwgpo.DisplayName
|
||||
$FWGPOSession = Open-NetGPO -PolicyStore $fwgponame
|
||||
Net-NetFirewallRule -DisplayName "Allow Ansible" -direction Inbound -localport "5985-5986" -protocol TCP -Action Allow -GPOSession $FWGPOSession
|
||||
Save-NetGPO -GPOSession $FWGPOSession
|
||||
############# Workaround - Adam #############
|
||||
$GpoName = "Disable Windows Firewall"
|
||||
$DomainName = "$winProject.loc"
|
||||
|
||||
# Create and link GPO
|
||||
New-GPO -Name $GpoName
|
||||
New-GPLink -Name $GpoName -Target "DC=$($DomainName.Split('.')[0]),DC=$($DomainName.Split('.')[1])"
|
||||
|
||||
# Configure GPO to disable Windows Firewall
|
||||
Set-GPRegistryValue -Name $GpoName -Key "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" -ValueName "EnableFirewall" -Type DWord -Value 0
|
||||
Set-GPRegistryValue -Name $GpoName -Key "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile" -ValueName "EnableFirewall" -Type DWord -Value 0
|
||||
Set-GPRegistryValue -Name $GpoName -Key "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile" -ValueName "EnableFirewall" -Type DWord -Value 0
|
||||
############# Workaround - Adam #############
|
||||
|
||||
#Import-Module -Name NetSecurity
|
||||
#
|
||||
#$fwgpo = Get-GPO -Name "Firewall"
|
||||
#$fwgponame = $fwgpo.DomainName + "\" + $fwgpo.DisplayName
|
||||
#$FWGPOSession = Open-NetGPO -PolicyStore $fwgponame
|
||||
#New-NetFirewallRule -DisplayName "Allow Ansible" -Action Allow -Direction Inbound -LocalPort 5985-5986 -Protocol TCP -GPOSession $FWGPOSession
|
||||
#Save-NetGPO -GPOSession $FWGPOSession
|
||||
|
||||
#Create proxy GPO
|
||||
New-GPO -Name "proxy" -comment "proxy Settings for the end user servers"
|
||||
@@ -351,27 +371,28 @@ Set-GPRegistryValue -Name "proxy" -ValueName "Mode" -Key "HKEY_LOCAL_MACHINE\Sof
|
||||
#Set up Auditing
|
||||
#https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
|
||||
|
||||
$computers | ForEach-Object {
|
||||
Set-GPPermission -Name "rds settings" -TargetName $_ -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Chrome" -TargetName $_ -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Firefox" -TargetName $_ -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Edge" -TargetName $_ -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "wb servers" -TargetName $_ -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName $_ -TargetType Computer -PermissionLevel GpoApply
|
||||
}
|
||||
|
||||
#Set permissions
|
||||
Set-GPPermission -Name "rds settings" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "rds settings" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
#Set-GPPermission -Name "NTLM" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
#Set-GPPermission -Name "NTLM" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Chrome" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Chrome" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Firefox" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Firefox" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Edge" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Edge" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "wb servers" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "wb servers" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "WSUS" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "WSUS" -TargetName "Domain computers" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Default Domain Policy" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "Default Domain Controllers Policy" -TargetName "Domain Controllers" -TargetType Group -PermissionLevel GpoApply
|
||||
Set-GPPermission -Name "WSUS" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply
|
||||
@@ -389,7 +410,7 @@ New-GPLink -Name "wb servers" -Target $workbenchou
|
||||
New-GPLink -Name "Edge" -Target $workbenchou
|
||||
New-GPLink -Name "Firefox" -Target $workbenchou
|
||||
New-GPLink -Name "Chrome" -Target $workbenchou
|
||||
New-GPLink -Name "firewall" -Target $workbenchou
|
||||
#New-GPLink -Name "firewall" -Target $workbenchou
|
||||
|
||||
#add entry for WSUS
|
||||
|
||||
|
||||
Reference in new issue
Block a user