Enrich professor profiles and harden client policy

2026-09-03 15:40:40 -06:00
parent 403132f869
commit 742ae9c2b5
12 changed files with 338 additions and 33 deletions
@@ -0,0 +1,124 @@
+[CmdletBinding(SupportsShouldProcess)]
+param(
+    [string]$TargetOuDn = 'OU=Laboratorio,DC=lci,DC=lasalle,DC=mx',
+    [string]$GpoName = 'SGU - Windows client experience',
+    [string]$DomainController = $env:COMPUTERNAME
+)
+
+$ErrorActionPreference = 'Stop'
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$principal = [Security.Principal.WindowsPrincipal]::new($identity)
+if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'Run this script from an elevated Windows PowerShell session on a domain controller or management host.'
+}
+
+Import-Module ActiveDirectory -ErrorAction Stop
+Import-Module GroupPolicy -ErrorAction Stop
+
+$targetOu = Get-ADOrganizationalUnit `
+    -Identity $TargetOuDn `
+    -Server $DomainController `
+    -ErrorAction Stop
+$domainDn = ($targetOu.DistinguishedName -split ',DC=', 2)[1]
+if (-not $domainDn) {
+    throw 'TargetOuDn does not contain a domain distinguished name.'
+}
+$domainName = ($domainDn -replace ',DC=', '.')
+
+$gpo = Get-GPO -Name $GpoName -Domain $domainName -Server $DomainController -ErrorAction SilentlyContinue
+if (-not $gpo -and $PSCmdlet.ShouldProcess($GpoName, 'Create the SGU Windows client policy GPO')) {
+    $gpo = New-GPO -Name $GpoName -Domain $domainName -Server $DomainController
+}
+if (-not $gpo) {
+    throw "The GPO '$GpoName' does not exist and was not created."
+}
+
+$existingLink = @(Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
+    Where-Object DisplayName -eq $GpoName |
+    Select-Object -First 1
+$existingLinkEnabled = $existingLink -and (
+    $existingLink.Enabled -eq $true -or
+    [string]$existingLink.Enabled -eq 'Yes')
+if (-not $existingLink) {
+    if ($PSCmdlet.ShouldProcess($TargetOuDn, "Link and enable '$GpoName'")) {
+        New-GPLink `
+            -Name $GpoName `
+            -Target $TargetOuDn `
+            -Domain $domainName `
+            -Server $DomainController `
+            -LinkEnabled Yes | Out-Null
+    }
+}
+elseif (-not $existingLinkEnabled -and
+    $PSCmdlet.ShouldProcess($TargetOuDn, "Enable the '$GpoName' link")) {
+    Set-GPLink `
+        -Name $GpoName `
+        -Target $TargetOuDn `
+        -Domain $domainName `
+        -Server $DomainController `
+        -LinkEnabled Yes | Out-Null
+}
+
+$dataCollectionKey = 'HKLM\Software\Policies\Microsoft\Windows\DataCollection'
+$powerPolicyRoot = 'HKLM\Software\Policies\Microsoft\Power\PowerSettings'
+$policies = @(
+    @{ Key = $dataCollectionKey; Name = 'AllowTelemetry'; Value = 0 },
+    @{ Key = $dataCollectionKey; Name = 'DisableTelemetryOptInSettingsUx'; Value = 1 },
+    @{ Key = $dataCollectionKey; Name = 'DisableTelemetryOptInChangeNotification'; Value = 1 },
+    @{ Key = $dataCollectionKey; Name = 'DisableDiagnosticDataViewer'; Value = 1 },
+    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\OOBE'; Name = 'DisablePrivacyExperience'; Value = 1 },
+    @{ Key = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System'; Name = 'EnableFirstLogonAnimation'; Value = 0 },
+    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\LocationAndSensors'; Name = 'DisableLocation'; Value = 1 },
+    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\AppPrivacy'; Name = 'LetAppsAccessLocation'; Value = 2 }
+)
+
+$powerSettingIds = @(
+    '3c0bc021-c8a8-4e07-a973-6b14cbcb2b7e', # Turn off display after
+    '29f6c1db-86da-48c5-9fdb-f2b67b1f44da', # Sleep after
+    '9d7815a6-7ee4-497e-8888-515a05f02364', # Hibernate after
+    '94ac6d29-73ce-41a6-809f-6363ba21b47e'  # Allow hybrid sleep
+)
+foreach ($settingId in $powerSettingIds) {
+    $settingKey = "$powerPolicyRoot\$settingId"
+    $policies += @{ Key = $settingKey; Name = 'ACSettingIndex'; Value = 0 }
+    $policies += @{ Key = $settingKey; Name = 'DCSettingIndex'; Value = 0 }
+}
+
+foreach ($policy in $policies) {
+    if ($PSCmdlet.ShouldProcess($GpoName, "Set $($policy.Key)\$($policy.Name)=$($policy.Value)")) {
+        Set-GPRegistryValue `
+            -Name $GpoName `
+            -Domain $domainName `
+            -Server $DomainController `
+            -Key $policy.Key `
+            -ValueName $policy.Name `
+            -Type DWord `
+            -Value $policy.Value | Out-Null
+    }
+}
+
+$configuredPolicies = [ordered]@{}
+foreach ($policy in $policies) {
+    $configured = Get-GPRegistryValue `
+        -Name $GpoName `
+        -Domain $domainName `
+        -Server $DomainController `
+        -Key $policy.Key `
+        -ValueName $policy.Name
+    $configuredPolicies[$policy.Name + '@' + $policy.Key] = [int]$configured.Value
+}
+$link = @(Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
+    Where-Object DisplayName -eq $GpoName |
+    Select-Object -First 1
+$linkEnabled = $link -and (
+    $link.Enabled -eq $true -or
+    [string]$link.Enabled -eq 'Yes')
+
+[pscustomobject]@{
+    GpoName = $GpoName
+    GpoId = $gpo.Id
+    TargetOu = $TargetOuDn
+    LinkEnabled = [bool]$linkEnabled
+    PolicyCount = $configuredPolicies.Count
+    Policies = [pscustomobject]$configuredPolicies
+}