SGU-CredentialProvider/scripts/Install-SguDomainMonitoring.ps1

#Requires -Version 5.1
[CmdletBinding(SupportsShouldProcess)]
param(
    [string]$CollectorFqdn = "$env:COMPUTERNAME.$env:USERDNSDOMAIN",
    [string]$ComputerOuDn = 'OU=Laboratorio,DC=lci,DC=lasalle,DC=mx',
    [string]$MonitoringRoot = 'C:\ProgramData\SGU\Monitoring',
    [ValidateRange(30, 730)]
    [int]$RetentionDays = 183
)

$ErrorActionPreference = 'Stop'
$subscriptionId = 'SGU-Lab-Monitoring'
$maintenanceScriptName = 'Invoke-SguMonitoringMaintenance.ps1'
$reportScriptName = 'Get-SguUsageReport.ps1'
$brokerReportScriptName = 'Get-SguBrokerLog.ps1'

$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = [Security.Principal.WindowsPrincipal]::new($identity)
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    throw 'Run this script from an elevated Windows PowerShell session on the domain event collector.'
}

Import-Module ActiveDirectory -ErrorAction Stop
Get-ADOrganizationalUnit -Identity $ComputerOuDn -ErrorAction Stop | Out-Null

foreach ($requiredScript in $maintenanceScriptName,$reportScriptName,$brokerReportScriptName) {
    if (-not (Test-Path -LiteralPath (Join-Path $PSScriptRoot $requiredScript) -PathType Leaf)) {
        throw "$requiredScript must be beside Install-SguDomainMonitoring.ps1."
    }
}

if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Install the SGU domain monitoring collector')) {
    Set-Service EventLog -StartupType Automatic
    if ((Get-Service EventLog).Status -ne 'Running') {
        Start-Service EventLog
    }
    & wecutil.exe quick-config /quiet
    if ($LASTEXITCODE -ne 0) {
        throw "wecutil quick-config failed with exit code $LASTEXITCODE."
    }
    Set-Service Wecsvc -StartupType Automatic
    Start-Service Wecsvc
    & wevtutil.exe set-log ForwardedEvents /enabled:true /maxsize:536870912 /retention:false /autobackup:false
    if ($LASTEXITCODE -ne 0) {
        throw "wevtutil failed to configure ForwardedEvents with exit code $LASTEXITCODE."
    }

    $query = @'
<QueryList>
  <Query Id="0">
    <Select Path="Security">*[System[(EventID=4624 or EventID=4625 or EventID=4634 or EventID=4647 or EventID=4778 or EventID=4779)]]</Select>
    <Select Path="System">*[System[(EventID=12 or EventID=13 or EventID=41 or EventID=1074 or EventID=6005 or EventID=6006 or EventID=6008)]]</Select>
  </Query>
</QueryList>
'@
    $escapedQuery = [Security.SecurityElement]::Escape($query)
    $subscriptionXml = @"
<?xml version="1.0" encoding="UTF-8"?>
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>$subscriptionId</SubscriptionId>
  <SubscriptionType>SourceInitiated</SubscriptionType>
  <Description>SGU interactive sessions, failures, reconnects, and workstation power state.</Description>
  <Enabled>true</Enabled>
  <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
  <ConfigurationMode>Custom</ConfigurationMode>
  <Delivery Mode="Push">
    <Batching><MaxItems>5</MaxItems><MaxLatencyTime>30000</MaxLatencyTime></Batching>
    <PushSettings><Heartbeat Interval="60000"/></PushSettings>
  </Delivery>
  <Query>$escapedQuery</Query>
  <ReadExistingEvents>false</ReadExistingEvents>
  <TransportName>HTTP</TransportName>
  <ContentFormat>Events</ContentFormat>
  <Locale Language="es-MX"/>
  <LogFile>ForwardedEvents</LogFile>
  <AllowedSourceDomainComputers>O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS)</AllowedSourceDomainComputers>
</Subscription>
"@

    New-Item -ItemType Directory -Path $MonitoringRoot -Force | Out-Null
    $subscriptionPath = Join-Path $MonitoringRoot 'SGU-Lab-Monitoring.xml'
    [IO.File]::WriteAllText($subscriptionPath, $subscriptionXml, [Text.UTF8Encoding]::new($true))
    $existingSubscriptions = @(& wecutil.exe enum-subscription 2>$null)
    if ($existingSubscriptions -contains $subscriptionId) {
        & wecutil.exe delete-subscription $subscriptionId
        if ($LASTEXITCODE -ne 0) {
            throw "Could not replace the existing $subscriptionId subscription."
        }
    }
    & wecutil.exe create-subscription $subscriptionPath
    if ($LASTEXITCODE -ne 0) {
        throw "Could not create the $subscriptionId subscription."
    }

    foreach ($scriptName in $maintenanceScriptName,$reportScriptName,$brokerReportScriptName) {
        Copy-Item -LiteralPath (Join-Path $PSScriptRoot $scriptName) `
            -Destination (Join-Path $MonitoringRoot $scriptName) -Force
    }

    $configuration = [ordered]@{
        CollectorFqdn = $CollectorFqdn
        ComputerOuDn = $ComputerOuDn
        RetentionDays = $RetentionDays
        SubscriptionId = $subscriptionId
    }
    [IO.File]::WriteAllText(
        (Join-Path $MonitoringRoot 'monitoring.json'),
        ($configuration | ConvertTo-Json),
        [Text.UTF8Encoding]::new($false))

    $powerShell = "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe"
    $maintenanceScript = Join-Path $MonitoringRoot $maintenanceScriptName
    $inventoryAction = New-ScheduledTaskAction -Execute $powerShell -Argument (
        "-NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File `"$maintenanceScript`" " +
        "-MonitoringRoot `"$MonitoringRoot`" -ComputerOuDn `"$ComputerOuDn`" -RetentionDays $RetentionDays -InventoryOnly")
    $inventoryTrigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) `
        -RepetitionInterval (New-TimeSpan -Minutes 5) `
        -RepetitionDuration (New-TimeSpan -Days 3650)
    $taskSettings = New-ScheduledTaskSettingsSet -StartWhenAvailable `
        -ExecutionTimeLimit (New-TimeSpan -Minutes 10) -RestartCount 2 `
        -RestartInterval (New-TimeSpan -Minutes 1)
    Register-ScheduledTask -TaskName 'SGU-Monitoring-Inventory' -Action $inventoryAction `
        -Trigger $inventoryTrigger -Settings $taskSettings -User 'SYSTEM' -RunLevel Highest -Force | Out-Null

    $retentionAction = New-ScheduledTaskAction -Execute $powerShell -Argument (
        "-NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File `"$maintenanceScript`" " +
        "-MonitoringRoot `"$MonitoringRoot`" -ComputerOuDn `"$ComputerOuDn`" -RetentionDays $RetentionDays")
    $retentionTrigger = New-ScheduledTaskTrigger -Daily -At '12:10 AM'
    Register-ScheduledTask -TaskName 'SGU-Monitoring-Retention' -Action $retentionAction `
        -Trigger $retentionTrigger -Settings $taskSettings -User 'SYSTEM' -RunLevel Highest -Force | Out-Null

    & $maintenanceScript -MonitoringRoot $MonitoringRoot -ComputerOuDn $ComputerOuDn `
        -RetentionDays $RetentionDays -InventoryOnly | Out-Null
}

[pscustomobject]@{
    Collector = $CollectorFqdn
    CollectorService = (Get-Service Wecsvc).Status.ToString()
    SubscriptionId = $subscriptionId
    SubscriptionEnabled = @(& wecutil.exe enum-subscription) -contains $subscriptionId
    RetentionDays = $RetentionDays
    InventoryTask = (Get-ScheduledTask -TaskName 'SGU-Monitoring-Inventory').State
    RetentionTask = (Get-ScheduledTask -TaskName 'SGU-Monitoring-Retention').State
    MachineStatusPath = Join-Path $MonitoringRoot 'Reports\machine-status.json'
    UsageReportCommand = "& '$MonitoringRoot\$reportScriptName'"
    BrokerLogCommand = "& '$MonitoringRoot\$brokerReportScriptName'"
}