mirror of
https://git.ecdf.ed.ac.uk/win_automation/windows-ansible.git
synced 2026-10-26 20:47:21 +00:00
203 lines
18 KiB
PowerShell
203 lines
18 KiB
PowerShell
set-timezone -id UTC
|
|
|
|
#Gather DC IP and Name
|
|
$domaindetails = get-adcomputer -filter 'Name -like "*DC01*"' | foreach {$_.name}
|
|
#$domaindcdns = get-dnsserver -computername $domaindetails | foreach {$_.computername}
|
|
$RDSServer = $domaindetails
|
|
#Workbench OU
|
|
$workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"'| foreach {$_.DistinguishedName}
|
|
$DomainOU = Get-ADDomain | foreach {$_.DistinguishedName}
|
|
$domainID = Get-ADDomain | foreach {$_.DNSRoot}
|
|
$computersOU = get-addomain | foreach {$_.ComputersContainer}
|
|
$domaincontrollersOU = get-addomain | foreach {$_.DomainControllersContainer}
|
|
$homepage = "https://www.epcc.ed.ac.uk/"
|
|
#get wsus server name
|
|
$wsusserver = get-adcomputer -Filter 'Name -like "*-wsus*"' | foreach {$_.Name}
|
|
|
|
##New OU
|
|
New-ADOrganizationalUnit -Name WorkBench
|
|
#Workbench OU
|
|
$workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"' | foreach {$_.DistinguishedName}
|
|
#Move WB machines (when prefix is wb)
|
|
$computers = Get-ADcomputer -filter { CN -like "*wb*"} | foreach {$_.DistinguishedName}
|
|
$computers | move-adobject -TargetPath $workbenchOU
|
|
|
|
#Create RDS Settings GPO
|
|
New-GPO -Name "RDS Settings" -comment "RDS Settings for the workbench"
|
|
Set-GPRegistryValue -Name "RDS Settings" -ValueName "LicensingMode" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 4 -Type DWord
|
|
Set-GPRegistryValue -Name "RDS Settings" -ValueName "LicenseServers" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value $RDSServer -Type String
|
|
Set-GPRegistryValue -Name "RDS Settings" -ValueName "MaxInstanceCount" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 999999 -Type DWord
|
|
Set-GPRegistryValue -Name "RDS Settings" -ValueName "fDenyTSCConnections" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 0 -Type DWord
|
|
|
|
#Create Default Domain Policy GPO
|
|
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "NoAUShutdownOption" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "UseWUServer" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value $RDSServer -Type String
|
|
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "IncludeRecommendedUpdates" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 999999 -Type DWord
|
|
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "NoAutoRebootWithLoggedOnUsers" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "LicensingMode" -key "HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\Lsa\LmCompatibility" -Value 0 -Type DWord
|
|
|
|
#Folder redirection
|
|
enable-folderredirection -AllFolder
|
|
|
|
#Domain Password Policy
|
|
#---Example - https://activedirectorypro.com/how-to-configure-a-domain-password-policy/
|
|
#Set-ADDefaultDomainPasswordPolicy -identity $DomainID -MaxPasswordAge 42 -MinPasswordAge 1 -MinPasswordLength 12 -PasswordHistoryCount 24 -ComplexityEnabled $true -ReversibleEncryptionEnabled $false -LockoutThreshold 0
|
|
|
|
#Create WSUS GPO
|
|
New-GPO -Name "WSUS" -comment "WSUS Settings for the workbench"
|
|
Set-GPRegistryValue -Name "WSUS" -ValueName "DoNotConnectToWindowsUpdateInternetLocations" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "WSUS" -ValueName "SetProxyBehaviorForUpdateDetection" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value 0 -Type DWord
|
|
#Value is a varible we'll need to change
|
|
#Set-GPRegistryValue -Name "WSUS" -ValueName "TargetGroup" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value Space_Std -Type DWord
|
|
Set-GPRegistryValue -Name "WSUS" -ValueName "TargetGroupEnabled" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value 1 -Type DWord
|
|
#WSUS server IP address
|
|
#Doesn't work
|
|
#Set-GPRegistryValue -Name "WSUS" -ValueName "WUServer" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value $wsusserver -Type DWord
|
|
#Set-GPRegistryValue -Name "WSUS" -ValueName "WUStatusServer" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate" -Value $wsusserver -Type DWord
|
|
Set-GPRegistryValue -Name "WSUS" -ValueName "AUOptions" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 4 -Type DWord
|
|
Set-GPRegistryValue -Name "WSUS" -ValueName "AutoInstallMinorUpdates" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "WSUS" -ValueName "DetectionFrequency" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 2 -Type DWord
|
|
Set-GPRegistryValue -Name "WSUS" -ValueName "DetectionFrequencyEnabled" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "WSUS" -ValueName "NoAutoUpdate" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "WSUS" -ValueName "ScheduledInstallDay" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "WSUS" -ValueName "ScheduledInstallEveryWeek" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "WSUS" -ValueName "ScheduledInstallTime" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 3 -Type DWord
|
|
Set-GPRegistryValue -Name "WSUS" -ValueName "UseWUServer" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value 1 -Type DWord
|
|
|
|
#Create Log on Notification GPO - chaned to string
|
|
New-GPO -Name "Logon message" -comment "Log on Message for the workbench"
|
|
Set-GPRegistryValue -Name "Logon message" -ValueName "LegalNoticeCaption" -key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value "NOTICE TO USERS" -Type String
|
|
Set-GPRegistryValue -Name "Logon message" -ValueName "LegalNoticeText" -key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value "Please adhere to the agreed terms and conditions accepted during account creation." -Type String
|
|
|
|
#Create Disable Internet Explorer GPO
|
|
New-GPO -Name "Disable Internet Explorer" -comment "IE Settings for the workbench"
|
|
Set-GPRegistryValue -Name "Disable Internet Explorer" -ValueName "NotifyDisableIEOptions" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main" -Value 1 -Type DWord
|
|
|
|
#Create File History
|
|
New-GPO -Name "File History" -comment "File History Settings for the workbench"
|
|
Set-GPRegistryValue -Name "File History" -ValueName "Disabled" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\FileHistory" -Value 0 -Type DWord
|
|
|
|
#Create Chrome GPO
|
|
New-GPO -Name "Chrome" -comment "Chrome Settings for the workbench"
|
|
|
|
Set-GPRegistryValue -Name "Chrome" -ValueName "ImportBookmarks" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "Chrome" -ValueName "ImportHistory" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "Chrome" -ValueName "ImportHomepage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "Chrome" -ValueName "ImportSavedPasswords" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "Chrome" -ValueName "ImportSearchEngine" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "Chrome" -ValueName "UserFeedbackAllowed" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "Chrome" -ValueName "ProxySettings" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome" -Value $homepage -Type String
|
|
|
|
|
|
#Create Firefox GPO
|
|
New-GPO -Name "Firefox" -comment "Firefox Settings for the workbench"
|
|
Set-GPRegistryValue -Name "Firefox" -ValueName "installlanguage" -key "HKEY_CURRENT_USER\Software\Policies\microsoft\office\16.0\common\languageresources" -Value 2057 -Type DWord
|
|
Set-GPRegistryValue -Name "Firefox" -ValueName "preferrededitinglanguage" -key "HKEY_CURRENT_USER\Software\Policies\microsoft\office\16.0\common\languageresources" -Value en-GB -Type DWord
|
|
Set-GPRegistryValue -Name "Firefox" -ValueName "SkipOnboarding" -key "HKEY_CURRENT_USER\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "Firefox" -ValueName "WhatsNew" -key "HKEY_CURRENT_USER\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "Firefox" -ValueName "DisableProfileImport" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "Firefox" -ValueName "DisableTelemetry" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "Firefox" -ValueName "ExtensionRecommendations" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "Firefox" -ValueName "FeatureRecommendations" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "Firefox" -ValueName "MoreFromMozilla" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "Firefox" -ValueName "SkipOnboarding" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "Firefox" -ValueName "WhatsNew" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "Firefox" -ValueName "URL" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\Homepage" -Value $homepage -Type DWord
|
|
Set-GPRegistryValue -Name "Firefox" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\Homepage" -Value homepage -Type DWord
|
|
|
|
#Create Edge GPO
|
|
New-GPO -Name "Edge" -comment "Edge Settings for the workbench"
|
|
Set-GPRegistryValue -Name "Edge" -ValueName "AllowSurfGame" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "Edge" -ValueName "ConfigureDoNotTrack" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "Edge" -ValueName "EnhanceSecurityModeOptOutUXEnabled" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "Edge" -ValueName "URL" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value $homepage -Type DWord
|
|
Set-GPRegistryValue -Name "Edge" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value homepage -Type DWord
|
|
|
|
|
|
#Create Profile redirection GPO
|
|
#New-GPO -Name "Profile Redirection" -comment "Profile Settings for the workbench"
|
|
#there must be more
|
|
|
|
#Create StartMenu GPO - sort out file name
|
|
New-GPO -Name "StartMenu" -comment "StartMenu Settings for the workbench"
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "HideSCAPower" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "NoClose" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "NoStartMenuEjectPC" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "NoStartMenuMYGames" -key "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "LockedStartLayout" -key "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "StartLayoutFile" -key "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" -Value "C:\eidf\wawb01.xml" -Type DWord
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "LockedStartLayout" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer" -Value 1 -Type DWord
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "StartLayoutFile" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer" -Value "C:\eidf\wawb01.xml" -Type DWord
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Appx" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Dll" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Exe" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Msi" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "AllowWindows" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\SrpV2\Script" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "StartMenu" -ValueName "UserPolicyMode" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System" -Value 2 -Type DWord
|
|
|
|
#Create wb_server GPO
|
|
New-GPO -Name "wb servers" -comment "WorkBench Settings for the workbench"
|
|
Set-GPRegistryValue -Name "wb servers" -ValueName "ShutdownReasonOn" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Reliability" -Value 0 -Type DWord
|
|
# Delete this key - Set-GPRegistryValue -Name "wb servers" -ValueName "ShutdownReasonUI" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Reliability" -Value 0 -Type DWord
|
|
Set-GPRegistryValue -Name "wb servers" -ValueName "fEnableWddmDriver" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 1 -Type DWord
|
|
# four group memberships to add
|
|
#Security Template Group Membership *S-1-5-32-544__Memberof
|
|
#Security Template Group Membership *S-1-5-32-544__Members *S-1-5-21-1607635393-2609548545-3408924799-512
|
|
#Security Template Group Membership *S-1-5-32-555__Memberof
|
|
# *S-1-5-21-1607635393-2609548545-3408924799-1109
|
|
# *S-1-5-21-1607635393-2609548545-3408924799-512
|
|
|
|
# set sebackup privilege
|
|
|
|
#https://www.powershellgallery.com/packages/PoshPrivilege/0.3.0.0/Content/Scripts%5CEnable-Privilege.ps1
|
|
#https://blakedrumm.com/blog/set-and-check-user-rights-assignment/
|
|
|
|
#maybe food for access rights - https://stackoverflow.com/questions/74256553/how-to-enable-local-account-lockout-policies-through-powershell
|
|
|
|
#Set up Auditing
|
|
#https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
|
|
|
|
#Set permissions
|
|
Set-GPPermission -Name "rds settings" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "rds settings" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "NTLM" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "NTLM" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Chrome" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Chrome" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Firefox" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Firefox" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Edge" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Edge" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "wb servers" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "wb servers" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "WSUS" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "WSUS" -TargetName "Domain computers" -TargetType Group -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Default Domain Policy" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "Default Domain Controllers Policy" -TargetName "Domain Controllers" -TargetType Group -PermissionLevel GpoApply
|
|
Set-GPPermission -Name "WSUS" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply
|
|
|
|
#Link to OU
|
|
New-GPLink -name "rds settings" -Target $workbenchOU
|
|
New-GPLink -Name "NTLM" -Target $domaincontrollersOU
|
|
New-GPLink -Name "WSUS" -Target $DomainOU
|
|
New-GPLink -Name "Logon message" -Target $workbenchOU
|
|
New-GPLink -Name "Disable Internet Explorer" -Target $DomainOU
|
|
New-GPLink -Name "File History" -Target $workbenchOU
|
|
New-GPLink -Name "StartMenu" -Target $workbenchou
|
|
New-GPLink -Name "wb servers" -Target $workbenchou
|
|
New-GPLink -Name "Edge" -Target $workbenchou
|
|
New-GPLink -Name "Firefox" -Target $workbenchou
|
|
New-GPLink -Name "Chrome" -Target $workbenchou
|
|
|
|
#add entry for WSUS
|
|
|
|
|
|
#Profile Redirection
|
|
#keyboard settings
|