Enrich professor profiles and harden client policy

2026-09-03 15:40:40 -06:00
parent 403132f869
commit 742ae9c2b5
12 changed files with 338 additions and 33 deletions
@@ -20,6 +20,23 @@ $remoteDesktopUsersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-
 $remoteDesktopUsersGroup = ($remoteDesktopUsersSid.Translate([Security.Principal.NTAccount]).Value -split '\\', 2)[1]

 if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, "Enable RDP and grant $RemoteDesktopPrincipal access")) {
+    foreach ($powerChange in @(
+        @('monitor-timeout-ac', '0'),
+        @('monitor-timeout-dc', '0'),
+        @('standby-timeout-ac', '0'),
+        @('standby-timeout-dc', '0'),
+        @('hibernate-timeout-ac', '0'),
+        @('hibernate-timeout-dc', '0'))) {
+        & powercfg.exe /change $powerChange[0] $powerChange[1]
+        if ($LASTEXITCODE -ne 0) {
+            throw "powercfg /change $($powerChange[0]) failed with exit code $LASTEXITCODE."
+        }
+    }
+    & powercfg.exe /hibernate off
+    if ($LASTEXITCODE -ne 0) {
+        throw "powercfg /hibernate off failed with exit code $LASTEXITCODE."
+    }
+
    Set-ItemProperty -LiteralPath 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
        -Name fDenyTSConnections -Type DWord -Value 0
    Set-ItemProperty -LiteralPath 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
@@ -87,4 +104,5 @@ $rdpMembers = @(Get-LocalGroupMember -Group $remoteDesktopUsersGroup -ErrorActio
    TermService = (Get-Service TermService).Status
    WinRM = (Get-Service WinRM).Status
    FirewallProfile = 'Domain'
+    AlwaysOnPowerPolicyApplied = $true
 }
@@ -0,0 +1,124 @@
+[CmdletBinding(SupportsShouldProcess)]
+param(
+    [string]$TargetOuDn = 'OU=Laboratorio,DC=lci,DC=lasalle,DC=mx',
+    [string]$GpoName = 'SGU - Windows client experience',
+    [string]$DomainController = $env:COMPUTERNAME
+)
+
+$ErrorActionPreference = 'Stop'
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$principal = [Security.Principal.WindowsPrincipal]::new($identity)
+if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'Run this script from an elevated Windows PowerShell session on a domain controller or management host.'
+}
+
+Import-Module ActiveDirectory -ErrorAction Stop
+Import-Module GroupPolicy -ErrorAction Stop
+
+$targetOu = Get-ADOrganizationalUnit `
+    -Identity $TargetOuDn `
+    -Server $DomainController `
+    -ErrorAction Stop
+$domainDn = ($targetOu.DistinguishedName -split ',DC=', 2)[1]
+if (-not $domainDn) {
+    throw 'TargetOuDn does not contain a domain distinguished name.'
+}
+$domainName = ($domainDn -replace ',DC=', '.')
+
+$gpo = Get-GPO -Name $GpoName -Domain $domainName -Server $DomainController -ErrorAction SilentlyContinue
+if (-not $gpo -and $PSCmdlet.ShouldProcess($GpoName, 'Create the SGU Windows client policy GPO')) {
+    $gpo = New-GPO -Name $GpoName -Domain $domainName -Server $DomainController
+}
+if (-not $gpo) {
+    throw "The GPO '$GpoName' does not exist and was not created."
+}
+
+$existingLink = @(Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
+    Where-Object DisplayName -eq $GpoName |
+    Select-Object -First 1
+$existingLinkEnabled = $existingLink -and (
+    $existingLink.Enabled -eq $true -or
+    [string]$existingLink.Enabled -eq 'Yes')
+if (-not $existingLink) {
+    if ($PSCmdlet.ShouldProcess($TargetOuDn, "Link and enable '$GpoName'")) {
+        New-GPLink `
+            -Name $GpoName `
+            -Target $TargetOuDn `
+            -Domain $domainName `
+            -Server $DomainController `
+            -LinkEnabled Yes | Out-Null
+    }
+}
+elseif (-not $existingLinkEnabled -and
+    $PSCmdlet.ShouldProcess($TargetOuDn, "Enable the '$GpoName' link")) {
+    Set-GPLink `
+        -Name $GpoName `
+        -Target $TargetOuDn `
+        -Domain $domainName `
+        -Server $DomainController `
+        -LinkEnabled Yes | Out-Null
+}
+
+$dataCollectionKey = 'HKLM\Software\Policies\Microsoft\Windows\DataCollection'
+$powerPolicyRoot = 'HKLM\Software\Policies\Microsoft\Power\PowerSettings'
+$policies = @(
+    @{ Key = $dataCollectionKey; Name = 'AllowTelemetry'; Value = 0 },
+    @{ Key = $dataCollectionKey; Name = 'DisableTelemetryOptInSettingsUx'; Value = 1 },
+    @{ Key = $dataCollectionKey; Name = 'DisableTelemetryOptInChangeNotification'; Value = 1 },
+    @{ Key = $dataCollectionKey; Name = 'DisableDiagnosticDataViewer'; Value = 1 },
+    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\OOBE'; Name = 'DisablePrivacyExperience'; Value = 1 },
+    @{ Key = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System'; Name = 'EnableFirstLogonAnimation'; Value = 0 },
+    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\LocationAndSensors'; Name = 'DisableLocation'; Value = 1 },
+    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\AppPrivacy'; Name = 'LetAppsAccessLocation'; Value = 2 }
+)
+
+$powerSettingIds = @(
+    '3c0bc021-c8a8-4e07-a973-6b14cbcb2b7e', # Turn off display after
+    '29f6c1db-86da-48c5-9fdb-f2b67b1f44da', # Sleep after
+    '9d7815a6-7ee4-497e-8888-515a05f02364', # Hibernate after
+    '94ac6d29-73ce-41a6-809f-6363ba21b47e'  # Allow hybrid sleep
+)
+foreach ($settingId in $powerSettingIds) {
+    $settingKey = "$powerPolicyRoot\$settingId"
+    $policies += @{ Key = $settingKey; Name = 'ACSettingIndex'; Value = 0 }
+    $policies += @{ Key = $settingKey; Name = 'DCSettingIndex'; Value = 0 }
+}
+
+foreach ($policy in $policies) {
+    if ($PSCmdlet.ShouldProcess($GpoName, "Set $($policy.Key)\$($policy.Name)=$($policy.Value)")) {
+        Set-GPRegistryValue `
+            -Name $GpoName `
+            -Domain $domainName `
+            -Server $DomainController `
+            -Key $policy.Key `
+            -ValueName $policy.Name `
+            -Type DWord `
+            -Value $policy.Value | Out-Null
+    }
+}
+
+$configuredPolicies = [ordered]@{}
+foreach ($policy in $policies) {
+    $configured = Get-GPRegistryValue `
+        -Name $GpoName `
+        -Domain $domainName `
+        -Server $DomainController `
+        -Key $policy.Key `
+        -ValueName $policy.Name
+    $configuredPolicies[$policy.Name + '@' + $policy.Key] = [int]$configured.Value
+}
+$link = @(Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
+    Where-Object DisplayName -eq $GpoName |
+    Select-Object -First 1
+$linkEnabled = $link -and (
+    $link.Enabled -eq $true -or
+    [string]$link.Enabled -eq 'Yes')
+
+[pscustomobject]@{
+    GpoName = $GpoName
+    GpoId = $gpo.Id
+    TargetOu = $TargetOuDn
+    LinkEnabled = [bool]$linkEnabled
+    PolicyCount = $configuredPolicies.Count
+    Policies = [pscustomobject]$configuredPolicies
+}
@@ -8,6 +8,7 @@ param(
 $ErrorActionPreference = 'Stop'
 $policyKey = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System'
 $policyValueName = 'DisableLockWorkstation'
+$desktopPolicyKey = 'HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop'

 $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
 $principal = [Security.Principal.WindowsPrincipal]::new($identity)
@@ -71,6 +72,15 @@ if ($PSCmdlet.ShouldProcess($GpoName, 'Prevent SGU users from manually locking w
        -ValueName $policyValueName `
        -Type DWord `
        -Value 1 | Out-Null
+
+    Set-GPRegistryValue `
+        -Name $GpoName `
+        -Domain $domainName `
+        -Server $DomainController `
+        -Key $desktopPolicyKey `
+        -ValueName 'ScreenSaveActive' `
+        -Type String `
+        -Value '0' | Out-Null
 }

 $configuredValue = Get-GPRegistryValue `
@@ -79,6 +89,12 @@ $configuredValue = Get-GPRegistryValue `
    -Server $DomainController `
    -Key $policyKey `
    -ValueName $policyValueName
+$screenSaverValue = Get-GPRegistryValue `
+    -Name $GpoName `
+    -Domain $domainName `
+    -Server $DomainController `
+    -Key $desktopPolicyKey `
+    -ValueName 'ScreenSaveActive'
 $link = @(Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
    Where-Object DisplayName -eq $GpoName |
    Select-Object -First 1
@@ -92,4 +108,5 @@ $linkEnabled = $link -and (
    TargetOu = $TargetOuDn
    LinkEnabled = [bool]$linkEnabled
    DisableLockWorkstation = [int]$configuredValue.Value
+    ScreenSaverDisabled = [string]$screenSaverValue.Value -eq '0'
 }