Add branded default provider and enforced enrollment

2026-09-01 11:20:06 -06:00
parent da01343985
commit f3afd62993
22 changed files with 787 additions and 17 deletions
@@ -0,0 +1,47 @@
+[CmdletBinding()]
+param(
+    [string]$ConfigurationPath = "$env:ProgramData\SGU\Enrollment\enrollment.json"
+)
+
+$ErrorActionPreference = 'Stop'
+$configuration = Get-Content -LiteralPath $ConfigurationPath -Raw | ConvertFrom-Json
+$enrollmentRoot = Split-Path $ConfigurationPath -Parent
+$testScript = Join-Path $enrollmentRoot 'Test-SguClientEnrollment.ps1'
+$installScript = Join-Path $enrollmentRoot 'Install-CredentialProvider.ps1'
+$remoteAccessScript = Join-Path $enrollmentRoot 'Enable-LabRemoteAccess.ps1'
+
+$before = & $testScript
+if (-not $before.IsValid) {
+    $installParams = @{
+        PublishPath = [string]$configuration.PublishPath
+        BrokerEndpoint = [string]$configuration.BrokerEndpoint
+        ClientCertificateThumbprint = [string]$configuration.ClientCertificateThumbprint
+        ServerCertificateThumbprint = [string]$configuration.ServerCertificateThumbprint
+        DomainNetbios = [string]$configuration.DomainNetbios
+        TimeoutSeconds = [int]$configuration.TimeoutSeconds
+    }
+    if ($configuration.DotNetRuntimeInstallerPath) {
+        $installParams.InstallDotNetRuntime = $true
+        $installParams.DotNetRuntimeInstallerPath = [string]$configuration.DotNetRuntimeInstallerPath
+    }
+    & $installScript @installParams | Out-Null
+}
+
+$computer = Get-CimInstance Win32_ComputerSystem
+if ($computer.PartOfDomain) {
+    & $remoteAccessScript `
+        -RemoteDesktopPrincipal ([string]$configuration.RemoteDesktopPrincipal) `
+        -EnableAdministrativeFirewallGroups | Out-Null
+}
+
+$verificationParams = @{}
+if ($computer.PartOfDomain) {
+    $verificationParams.RequireDomainJoined = $true
+    $verificationParams.RequireRemoteAccess = $true
+    $verificationParams.RemoteDesktopPrincipal = [string]$configuration.RemoteDesktopPrincipal
+}
+$after = & $testScript @verificationParams
+$after
+if (-not $after.IsValid) {
+    throw "SGU enrollment repair did not reach a valid state: $($after.Issues -join ' ')"
+}