Add branded default provider and enforced enrollment

2026-09-01 11:20:06 -06:00
parent da01343985
commit f3afd62993
22 changed files with 787 additions and 17 deletions
@@ -0,0 +1,134 @@
+[CmdletBinding(SupportsShouldProcess)]
+param(
+    [Parameter(Mandatory)]
+    [string]$PublishPath,
+
+    [Parameter(Mandatory)]
+    [ValidatePattern('^https://')]
+    [string]$BrokerEndpoint,
+
+    [Parameter(Mandatory)]
+    [ValidatePattern('^[0-9A-Fa-f ]{40,59}$')]
+    [string]$ClientCertificateThumbprint,
+
+    [Parameter(Mandatory)]
+    [ValidatePattern('^[0-9A-Fa-f ]{40,59}$')]
+    [string]$ServerCertificateThumbprint,
+
+    [string]$DomainNetbios = 'LCI',
+    [ValidateRange(2, 60)]
+    [int]$TimeoutSeconds = 20,
+    [string]$RemoteDesktopPrincipal = 'LCI\SG-Laboratorio-Usuarios-RDP',
+    [string]$DotNetRuntimeInstallerPath
+)
+
+$ErrorActionPreference = 'Stop'
+$taskName = 'SGU-CredentialProvider-EnrollmentGuard'
+$enrollmentRoot = Join-Path $env:ProgramData 'SGU\Enrollment'
+$sourceScripts = @(
+    'Install-CredentialProvider.ps1',
+    'Enable-LabRemoteAccess.ps1',
+    'Test-SguClientEnrollment.ps1',
+    'Repair-SguClientEnrollment.ps1'
+)
+
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$principal = [Security.Principal.WindowsPrincipal]::new($identity)
+if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'Run this script from an elevated Windows PowerShell session.'
+}
+
+foreach ($scriptName in $sourceScripts) {
+    if (-not (Test-Path -LiteralPath (Join-Path $PSScriptRoot $scriptName) -PathType Leaf)) {
+        throw "$scriptName must be beside Install-SguEnrollmentGuard.ps1."
+    }
+}
+
+$requiredProviderFile = Join-Path $PublishPath 'SGU.CredentialProvider.comhost.dll'
+if (-not (Test-Path -LiteralPath $requiredProviderFile -PathType Leaf)) {
+    throw 'PublishPath does not contain the Credential Provider package.'
+}
+
+if ($DotNetRuntimeInstallerPath -and
+    -not (Test-Path -LiteralPath $DotNetRuntimeInstallerPath -PathType Leaf)) {
+    throw 'DotNetRuntimeInstallerPath does not exist.'
+}
+
+if ($PSCmdlet.ShouldProcess($enrollmentRoot, 'Install the SGU enrollment repair guard')) {
+    New-Item -ItemType Directory -Path $enrollmentRoot -Force | Out-Null
+    $packageId = '{0}-{1}' -f (Get-Date -Format 'yyyyMMddHHmmss'), ([Guid]::NewGuid().ToString('N').Substring(0, 8))
+    $guardPublishPath = Join-Path $enrollmentRoot "packages\$packageId"
+    New-Item -ItemType Directory -Path $guardPublishPath -Force | Out-Null
+    Copy-Item -Path (Join-Path $PublishPath '*') -Destination $guardPublishPath -Recurse -Force
+
+    foreach ($scriptName in $sourceScripts) {
+        Copy-Item -LiteralPath (Join-Path $PSScriptRoot $scriptName) `
+            -Destination (Join-Path $enrollmentRoot $scriptName) -Force
+    }
+
+    $guardRuntimeInstaller = $null
+    if ($DotNetRuntimeInstallerPath) {
+        $runtimeDirectory = Join-Path $enrollmentRoot 'prerequisites'
+        New-Item -ItemType Directory -Path $runtimeDirectory -Force | Out-Null
+        $guardRuntimeInstaller = Join-Path $runtimeDirectory (Split-Path $DotNetRuntimeInstallerPath -Leaf)
+        Copy-Item -LiteralPath $DotNetRuntimeInstallerPath -Destination $guardRuntimeInstaller -Force
+    }
+
+    $guardConfiguration = [ordered]@{
+        PublishPath = $guardPublishPath
+        BrokerEndpoint = $BrokerEndpoint
+        ClientCertificateThumbprint = ($ClientCertificateThumbprint -replace ' ', '')
+        ServerCertificateThumbprint = ($ServerCertificateThumbprint -replace ' ', '')
+        DomainNetbios = $DomainNetbios
+        TimeoutSeconds = $TimeoutSeconds
+        RemoteDesktopPrincipal = $RemoteDesktopPrincipal
+        DotNetRuntimeInstallerPath = $guardRuntimeInstaller
+    }
+    $configurationPath = Join-Path $enrollmentRoot 'enrollment.json'
+    [IO.File]::WriteAllText(
+        $configurationPath,
+        ($guardConfiguration | ConvertTo-Json),
+        [Text.UTF8Encoding]::new($false))
+
+    $acl = Get-Acl -LiteralPath $enrollmentRoot
+    $acl.SetAccessRuleProtection($true, $false)
+    $acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new(
+        'SYSTEM', 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow'))
+    $acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new(
+        'BUILTIN\Administrators', 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow'))
+    Set-Acl -LiteralPath $enrollmentRoot -AclObject $acl
+
+    $repairScript = Join-Path $enrollmentRoot 'Repair-SguClientEnrollment.ps1'
+    $powerShell = "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe"
+    $action = New-ScheduledTaskAction -Execute $powerShell `
+        -Argument "-NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File `"$repairScript`""
+    $startupTrigger = New-ScheduledTaskTrigger -AtStartup
+    # Give domain networking and Group Policy time to initialize before the
+    # repair script resolves domain principals and validates remote access.
+    $startupTrigger.Delay = 'PT1M'
+    $triggers = @(
+        $startupTrigger,
+        (New-ScheduledTaskTrigger -Daily -At '3:00 AM')
+    )
+    $settings = New-ScheduledTaskSettingsSet `
+        -StartWhenAvailable `
+        -ExecutionTimeLimit (New-TimeSpan -Minutes 5) `
+        -RestartCount 3 `
+        -RestartInterval (New-TimeSpan -Minutes 1)
+    Register-ScheduledTask -TaskName $taskName `
+        -Action $action `
+        -Trigger $triggers `
+        -Settings $settings `
+        -User 'SYSTEM' `
+        -RunLevel Highest `
+        -Force | Out-Null
+
+    & $repairScript -ConfigurationPath $configurationPath | Out-Null
+}
+
+[pscustomobject]@{
+    EnrollmentRoot = $enrollmentRoot
+    TaskName = $taskName
+    TaskState = (Get-ScheduledTask -TaskName $taskName).State
+    ConfigurationPath = Join-Path $enrollmentRoot 'enrollment.json'
+}