alexrg/SGU-CredentialProvider
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 25 Wiki Activity

Automate direct domain enrollment across Windows versions

Browse Source
This commit is contained in:
alexrg
2026-09-11 17:34:19 -06:00
parent 7f8a9eed4e
commit 520b4be955
23 changed files with 1244 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security.md
+6 -6
View File
@@ -2,12 +2,12 @@
## Public Azure deployment
Owning a public Azure IP does not make the domain controller an Internet-facing
directory service. The supported cloud topology exposes no AD DS, DNS, SMB,
RPC, WinRM, broker, monitoring, or RustDesk port publicly. Hyper-V and later
physical Windows clients enter the VNet through certificate-authenticated Azure
VPN Gateway P2S; the Azure NSG and Windows firewall accept the P2S pool and the
private VNet only. See [azure-vpn-deployment.md](azure-vpn-deployment.md).
The Azure topology supports certificate-authenticated P2S or direct enrollment.
P2S keeps AD services inside the VNet. Direct enrollment exposes the required
AD, DNS/DoH, WinRM, broker and RustDesk ports only to explicit public IPv4 CIDRs;
an empty allowlist exposes none of them. Azure NSG and Windows Firewall enforce
the same source list. RDP uses a separate allowlist. See
[azure-vpn-deployment.md](azure-vpn-deployment.md).
## Password handling