849 lines
37 KiB
PowerShell
849 lines
37 KiB
PowerShell
#Requires -Version 5.1
|
|
[CmdletBinding(SupportsShouldProcess)]
|
|
param(
|
|
[ipaddress]$ServerIPv4Address,
|
|
[ValidateRange(1, 32)]
|
|
[int]$PrefixLength = 24,
|
|
[string]$NetworkInterfaceAlias,
|
|
[ipaddress]$DefaultGateway,
|
|
[ValidateSet('GuestStatic', 'PlatformManaged')]
|
|
[string]$NetworkConfigurationMode = 'GuestStatic',
|
|
[string[]]$TrustedClientNetworks = @(),
|
|
[ipaddress[]]$DnsForwarders = @(),
|
|
[string]$DomainName = 'lci.lasalle.mx',
|
|
[string]$DomainNetbios = 'LCI',
|
|
[string]$BrokerRecordName = 'sgu-auth',
|
|
[string]$RustDeskRecordName = 'rustdesk',
|
|
[string]$PackageSharePath = 'C:\Packages',
|
|
[securestring]$SafeModeAdministratorPassword,
|
|
[switch]$SkipRestart,
|
|
[switch]$Resume
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
$bootstrapRoot = Join-Path $env:ProgramData 'SGU\Bootstrap\Server'
|
|
$statePath = Join-Path $bootstrapRoot 'bootstrap-state.json'
|
|
$completionPath = Join-Path $bootstrapRoot 'bootstrap-complete.json'
|
|
$logPath = Join-Path $bootstrapRoot 'bootstrap.log'
|
|
$taskName = 'SGU-Complete-Domain-Controller-Bootstrap'
|
|
|
|
function Write-BootstrapLog {
|
|
param([Parameter(Mandatory)][string]$Message)
|
|
|
|
$line = '{0:u} {1}' -f (Get-Date), $Message
|
|
Write-Host $line
|
|
if (Test-Path -LiteralPath $bootstrapRoot) {
|
|
Add-Content -LiteralPath $logPath -Value $line -Encoding UTF8
|
|
}
|
|
}
|
|
|
|
function Assert-Administrator {
|
|
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
|
$principal = [Security.Principal.WindowsPrincipal]::new($identity)
|
|
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
|
throw 'Run this bootstrap from an elevated Windows PowerShell session.'
|
|
}
|
|
}
|
|
|
|
function Assert-PackageManifest {
|
|
param([Parameter(Mandatory)][string]$PackageRoot)
|
|
|
|
$manifestPath = Join-Path $PackageRoot 'package-manifest.json'
|
|
if (-not (Test-Path -LiteralPath $manifestPath -PathType Leaf)) {
|
|
throw 'package-manifest.json is missing. Use the complete SGU server bootstrap release.'
|
|
}
|
|
|
|
$manifest = Get-Content -LiteralPath $manifestPath -Raw | ConvertFrom-Json
|
|
foreach ($entry in $manifest.Files) {
|
|
$path = Join-Path $PackageRoot ([string]$entry.Path)
|
|
if (-not (Test-Path -LiteralPath $path -PathType Leaf)) {
|
|
throw "Bootstrap package file is missing: $($entry.Path)"
|
|
}
|
|
$actual = (Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash
|
|
if ($actual -ne [string]$entry.Sha256) {
|
|
throw "Bootstrap package integrity check failed: $($entry.Path)"
|
|
}
|
|
}
|
|
}
|
|
|
|
function Get-DomainBaseDn {
|
|
param([Parameter(Mandatory)][string]$DnsDomainName)
|
|
|
|
return (($DnsDomainName -split '\.') | ForEach-Object { "DC=$_" }) -join ','
|
|
}
|
|
|
|
function Test-PrivateIPv4Address {
|
|
param([Parameter(Mandatory)][ipaddress]$Address)
|
|
|
|
if ($Address.AddressFamily -ne [Net.Sockets.AddressFamily]::InterNetwork) {
|
|
return $false
|
|
}
|
|
$bytes = $Address.GetAddressBytes()
|
|
return $bytes[0] -eq 10 -or
|
|
($bytes[0] -eq 172 -and $bytes[1] -ge 16 -and $bytes[1] -le 31) -or
|
|
($bytes[0] -eq 192 -and $bytes[1] -eq 168)
|
|
}
|
|
|
|
function ConvertTo-NetworkCidr {
|
|
param(
|
|
[Parameter(Mandatory)][ipaddress]$Address,
|
|
[Parameter(Mandatory)][ValidateRange(1, 32)][int]$NetworkPrefixLength
|
|
)
|
|
|
|
if ($Address.AddressFamily -ne [Net.Sockets.AddressFamily]::InterNetwork) {
|
|
throw 'Only IPv4 networks are supported by the SGU bootstrap.'
|
|
}
|
|
$addressBytes = $Address.GetAddressBytes()
|
|
$networkBytes = [byte[]]::new(4)
|
|
$remainingBits = $NetworkPrefixLength
|
|
for ($index = 0; $index -lt 4; $index++) {
|
|
$mask = if ($remainingBits -ge 8) {
|
|
255
|
|
}
|
|
elseif ($remainingBits -le 0) {
|
|
0
|
|
}
|
|
else {
|
|
256 - [Math]::Pow(2, 8 - $remainingBits)
|
|
}
|
|
$networkBytes[$index] = [byte]($addressBytes[$index] -band [int]$mask)
|
|
$remainingBits -= 8
|
|
}
|
|
return "$(($networkBytes | ForEach-Object { [string]$_ }) -join '.')/$NetworkPrefixLength"
|
|
}
|
|
|
|
function ConvertTo-PrivateNetworkCidr {
|
|
param([Parameter(Mandatory)][string]$Cidr)
|
|
|
|
if ($Cidr -notmatch '^([^/]+)/(\d{1,2})$') {
|
|
throw "Trusted client network '$Cidr' must use IPv4 CIDR notation, for example 172.30.0.0/24."
|
|
}
|
|
$address = $null
|
|
if (-not [ipaddress]::TryParse($Matches[1], [ref]$address) -or
|
|
$address.AddressFamily -ne [Net.Sockets.AddressFamily]::InterNetwork) {
|
|
throw "Trusted client network '$Cidr' is not a valid IPv4 network."
|
|
}
|
|
$networkPrefixLength = [int]$Matches[2]
|
|
if ($networkPrefixLength -lt 1 -or $networkPrefixLength -gt 32) {
|
|
throw "Trusted client network '$Cidr' has an invalid prefix length."
|
|
}
|
|
if (-not (Test-PrivateIPv4Address -Address $address)) {
|
|
throw "Trusted client network '$Cidr' is not private RFC1918 space. The bootstrap never exposes AD services to public client addresses."
|
|
}
|
|
return ConvertTo-NetworkCidr -Address $address -NetworkPrefixLength $networkPrefixLength
|
|
}
|
|
|
|
function Resolve-PrivateInterfaceAlias {
|
|
param([string]$RequestedAlias)
|
|
|
|
if ($RequestedAlias) {
|
|
Get-NetAdapter -Name $RequestedAlias -ErrorAction Stop | Out-Null
|
|
return $RequestedAlias
|
|
}
|
|
|
|
$upAdapters = @(Get-NetAdapter | Where-Object Status -eq 'Up')
|
|
$withoutGateway = @($upAdapters | Where-Object {
|
|
-not (Get-NetIPConfiguration -InterfaceIndex $_.ifIndex).IPv4DefaultGateway
|
|
})
|
|
if ($withoutGateway.Count -eq 1) {
|
|
return [string]$withoutGateway[0].Name
|
|
}
|
|
if ($upAdapters.Count -eq 1) {
|
|
return [string]$upAdapters[0].Name
|
|
}
|
|
|
|
$aliases = ($upAdapters.Name | Sort-Object) -join ', '
|
|
throw "Could not select the private domain adapter unambiguously. Re-run with -NetworkInterfaceAlias. Available adapters: $aliases"
|
|
}
|
|
|
|
function Set-StaticDomainAddress {
|
|
param(
|
|
[Parameter(Mandatory)][string]$InterfaceAlias,
|
|
[Parameter(Mandatory)][ipaddress]$Address,
|
|
[Parameter(Mandatory)][int]$NetworkPrefixLength,
|
|
[ipaddress]$Gateway
|
|
)
|
|
|
|
$adapter = Get-NetAdapter -Name $InterfaceAlias -ErrorAction Stop
|
|
Set-NetIPInterface -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 -Dhcp Disabled
|
|
|
|
$addresses = @(Get-NetIPAddress -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 -ErrorAction SilentlyContinue |
|
|
Where-Object PrefixOrigin -ne 'WellKnown')
|
|
foreach ($existingAddress in $addresses) {
|
|
if ($existingAddress.IPAddress -ne $Address.IPAddressToString -or
|
|
[int]$existingAddress.PrefixLength -ne $NetworkPrefixLength) {
|
|
Remove-NetIPAddress -InputObject $existingAddress -Confirm:$false
|
|
}
|
|
}
|
|
|
|
$matchingAddress = Get-NetIPAddress -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 `
|
|
-IPAddress $Address.IPAddressToString -ErrorAction SilentlyContinue
|
|
if (-not $matchingAddress) {
|
|
$addressParameters = @{
|
|
InterfaceIndex = $adapter.ifIndex
|
|
IPAddress = $Address.IPAddressToString
|
|
PrefixLength = $NetworkPrefixLength
|
|
AddressFamily = 'IPv4'
|
|
}
|
|
if ($Gateway) {
|
|
$addressParameters.DefaultGateway = $Gateway.IPAddressToString
|
|
}
|
|
New-NetIPAddress @addressParameters | Out-Null
|
|
}
|
|
|
|
if ($Gateway) {
|
|
$defaultRoutes = @(Get-NetRoute -InterfaceIndex $adapter.ifIndex `
|
|
-AddressFamily IPv4 -DestinationPrefix '0.0.0.0/0' -ErrorAction SilentlyContinue)
|
|
foreach ($route in $defaultRoutes) {
|
|
if ($route.NextHop -ne $Gateway.IPAddressToString) {
|
|
Remove-NetRoute -InputObject $route -Confirm:$false
|
|
}
|
|
}
|
|
if (-not (Get-NetRoute -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 `
|
|
-DestinationPrefix '0.0.0.0/0' -ErrorAction SilentlyContinue |
|
|
Where-Object NextHop -eq $Gateway.IPAddressToString)) {
|
|
New-NetRoute -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 `
|
|
-DestinationPrefix '0.0.0.0/0' -NextHop $Gateway.IPAddressToString | Out-Null
|
|
}
|
|
}
|
|
|
|
Set-DnsClientServerAddress -InterfaceIndex $adapter.ifIndex `
|
|
-ServerAddresses $Address.IPAddressToString
|
|
}
|
|
|
|
function Assert-PlatformManagedDomainAddress {
|
|
param(
|
|
[Parameter(Mandatory)][string]$InterfaceAlias,
|
|
[Parameter(Mandatory)][ipaddress]$Address,
|
|
[Parameter(Mandatory)][int]$NetworkPrefixLength
|
|
)
|
|
|
|
$adapter = Get-NetAdapter -Name $InterfaceAlias -ErrorAction Stop
|
|
$matchingAddress = Get-NetIPAddress -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 `
|
|
-IPAddress $Address.IPAddressToString -ErrorAction SilentlyContinue |
|
|
Where-Object PrefixLength -eq $NetworkPrefixLength |
|
|
Select-Object -First 1
|
|
if (-not $matchingAddress) {
|
|
$observed = @(Get-NetIPAddress -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 `
|
|
-ErrorAction SilentlyContinue |
|
|
Where-Object PrefixOrigin -ne 'WellKnown' |
|
|
ForEach-Object { "$($_.IPAddress)/$($_.PrefixLength)" }) -join ', '
|
|
throw "PlatformManaged mode expected $Address/$NetworkPrefixLength on $InterfaceAlias, but found: $observed. Configure a static private IP on the Azure NIC before running the bootstrap; do not assign it inside Windows."
|
|
}
|
|
}
|
|
|
|
function Register-ResumeTask {
|
|
param([Parameter(Mandatory)][string]$ScriptPath)
|
|
|
|
$powerShell = "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe"
|
|
$action = New-ScheduledTaskAction -Execute $powerShell `
|
|
-Argument "-NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File `"$ScriptPath`" -Resume"
|
|
$trigger = New-ScheduledTaskTrigger -AtStartup
|
|
$trigger.Delay = 'PT1M'
|
|
$settings = New-ScheduledTaskSettingsSet `
|
|
-StartWhenAvailable `
|
|
-ExecutionTimeLimit (New-TimeSpan -Minutes 30) `
|
|
-RestartCount 3 `
|
|
-RestartInterval (New-TimeSpan -Minutes 2)
|
|
Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger `
|
|
-Settings $settings -User 'SYSTEM' -RunLevel Highest -Force | Out-Null
|
|
}
|
|
|
|
function Ensure-OrganizationalUnit {
|
|
param(
|
|
[Parameter(Mandatory)][string]$Name,
|
|
[Parameter(Mandatory)][string]$Path,
|
|
[Parameter(Mandatory)][string]$Server
|
|
)
|
|
|
|
$distinguishedName = "OU=$Name,$Path"
|
|
$escapedName = $Name.Replace('\', '\5c').Replace('*', '\2a').Replace('(', '\28').Replace(')', '\29')
|
|
$existing = Get-ADOrganizationalUnit -LDAPFilter "(ou=$escapedName)" `
|
|
-SearchBase $Path -SearchScope OneLevel -Server $Server -ErrorAction Stop |
|
|
Select-Object -First 1
|
|
if (-not $existing) {
|
|
New-ADOrganizationalUnit -Name $Name -Path $Path `
|
|
-ProtectedFromAccidentalDeletion $true -Server $Server | Out-Null
|
|
}
|
|
return $distinguishedName
|
|
}
|
|
|
|
function Wait-ActiveDirectoryReady {
|
|
param(
|
|
[Parameter(Mandatory)][string]$ExpectedBaseDn,
|
|
[ValidateRange(1, 120)][int]$Attempts = 36,
|
|
[ValidateRange(1, 30)][int]$DelaySeconds = 5
|
|
)
|
|
|
|
for ($attempt = 1; $attempt -le $Attempts; $attempt++) {
|
|
try {
|
|
$rootDse = Get-ADRootDSE -Server localhost -ErrorAction Stop
|
|
if ($rootDse.DefaultNamingContext -eq $ExpectedBaseDn) {
|
|
return
|
|
}
|
|
}
|
|
catch {
|
|
if ($attempt -eq $Attempts) {
|
|
throw
|
|
}
|
|
}
|
|
Start-Sleep -Seconds $DelaySeconds
|
|
}
|
|
throw "Active Directory did not publish $ExpectedBaseDn before the readiness timeout."
|
|
}
|
|
|
|
function Wait-DnsZoneReady {
|
|
param(
|
|
[Parameter(Mandatory)][string]$ZoneName,
|
|
[Parameter(Mandatory)][ipaddress]$DnsServer,
|
|
[ValidateRange(1, 120)][int]$Attempts = 30,
|
|
[ValidateRange(1, 30)][int]$DelaySeconds = 2
|
|
)
|
|
|
|
for ($attempt = 1; $attempt -le $Attempts; $attempt++) {
|
|
try {
|
|
$soa = @(Resolve-DnsName $ZoneName -Type SOA -DnsOnly `
|
|
-Server $DnsServer.IPAddressToString -ErrorAction Stop |
|
|
Where-Object Type -eq SOA)
|
|
if ($soa.Count -gt 0) {
|
|
return
|
|
}
|
|
}
|
|
catch {
|
|
if ($attempt -eq $Attempts) {
|
|
throw
|
|
}
|
|
}
|
|
Start-Sleep -Seconds $DelaySeconds
|
|
}
|
|
throw "DNS did not load the $ZoneName zone before the readiness timeout."
|
|
}
|
|
|
|
function Set-PackageShare {
|
|
param(
|
|
[Parameter(Mandatory)][string]$Path,
|
|
[Parameter(Mandatory)][string]$NetbiosName,
|
|
[Parameter(Mandatory)][string]$DomainSid
|
|
)
|
|
|
|
New-Item -ItemType Directory -Path $Path -Force | Out-Null
|
|
$domainAdminsSid = [Security.Principal.SecurityIdentifier]::new("$DomainSid-512")
|
|
$domainUsersSid = [Security.Principal.SecurityIdentifier]::new("$DomainSid-513")
|
|
$domainComputersSid = [Security.Principal.SecurityIdentifier]::new("$DomainSid-515")
|
|
$systemSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-18')
|
|
|
|
$acl = New-Object Security.AccessControl.DirectorySecurity
|
|
$acl.SetAccessRuleProtection($true, $false)
|
|
$inheritance = [Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'
|
|
$propagation = [Security.AccessControl.PropagationFlags]::None
|
|
$allow = [Security.AccessControl.AccessControlType]::Allow
|
|
$acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new(
|
|
$systemSid, [Security.AccessControl.FileSystemRights]::FullControl,
|
|
$inheritance, $propagation, $allow))
|
|
$acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new(
|
|
$domainAdminsSid, [Security.AccessControl.FileSystemRights]::FullControl,
|
|
$inheritance, $propagation, $allow))
|
|
$acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new(
|
|
$domainComputersSid, [Security.AccessControl.FileSystemRights]'ReadAndExecute, Synchronize',
|
|
$inheritance, $propagation, $allow))
|
|
$acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new(
|
|
$domainUsersSid, [Security.AccessControl.FileSystemRights]'ReadAndExecute, Synchronize',
|
|
$inheritance, $propagation, $allow))
|
|
Set-Acl -LiteralPath $Path -AclObject $acl
|
|
|
|
$domainAdmins = $domainAdminsSid.Translate([Security.Principal.NTAccount]).Value
|
|
$domainUsers = $domainUsersSid.Translate([Security.Principal.NTAccount]).Value
|
|
$domainComputers = $domainComputersSid.Translate([Security.Principal.NTAccount]).Value
|
|
$share = Get-SmbShare -Name Packages -ErrorAction SilentlyContinue
|
|
if ($share -and $share.Path -ne $Path) {
|
|
throw "The existing Packages share points to $($share.Path), not $Path."
|
|
}
|
|
if (-not $share) {
|
|
New-SmbShare -Name Packages -Path $Path -FullAccess $domainAdmins `
|
|
-ReadAccess $domainComputers,$domainUsers -FolderEnumerationMode AccessBased | Out-Null
|
|
}
|
|
else {
|
|
Grant-SmbShareAccess -Name Packages -AccountName $domainAdmins `
|
|
-AccessRight Full -Force | Out-Null
|
|
Grant-SmbShareAccess -Name Packages -AccountName $domainComputers `
|
|
-AccessRight Read -Force | Out-Null
|
|
Grant-SmbShareAccess -Name Packages -AccountName $domainUsers `
|
|
-AccessRight Read -Force | Out-Null
|
|
}
|
|
}
|
|
|
|
Assert-Administrator
|
|
trap {
|
|
Write-BootstrapLog ("ERROR: " + $_.Exception.Message)
|
|
throw
|
|
}
|
|
$operatingSystem = Get-CimInstance Win32_OperatingSystem
|
|
if ([int]$operatingSystem.ProductType -eq 1) {
|
|
throw 'The domain controller bootstrap requires Windows Server, not a Windows client edition.'
|
|
}
|
|
|
|
$existingState = $null
|
|
if (Test-Path -LiteralPath $statePath -PathType Leaf) {
|
|
$existingState = Get-Content -LiteralPath $statePath -Raw | ConvertFrom-Json
|
|
}
|
|
|
|
if ($Resume -or (-not $ServerIPv4Address -and $existingState)) {
|
|
if (-not $existingState) {
|
|
throw 'The persisted bootstrap state is missing; start the server bootstrap normally.'
|
|
}
|
|
$ServerIPv4Address = [ipaddress][string]$existingState.ServerIPv4Address
|
|
$PrefixLength = [int]$existingState.PrefixLength
|
|
$NetworkInterfaceAlias = [string]$existingState.NetworkInterfaceAlias
|
|
$DefaultGateway = if ($existingState.DefaultGateway) { [ipaddress][string]$existingState.DefaultGateway } else { $null }
|
|
$NetworkConfigurationMode = if ($existingState.NetworkConfigurationMode) { [string]$existingState.NetworkConfigurationMode } else { 'GuestStatic' }
|
|
$TrustedClientNetworks = if ($existingState.TrustedClientNetworks) { @($existingState.TrustedClientNetworks | ForEach-Object { [string]$_ }) } else { @() }
|
|
$DnsForwarders = @($existingState.DnsForwarders | ForEach-Object { [ipaddress][string]$_ })
|
|
$DomainName = [string]$existingState.DomainName
|
|
$DomainNetbios = [string]$existingState.DomainNetbios
|
|
$BrokerRecordName = [string]$existingState.BrokerRecordName
|
|
$RustDeskRecordName = if ($existingState.RustDeskRecordName) { [string]$existingState.RustDeskRecordName } else { $RustDeskRecordName }
|
|
$PackageSharePath = [string]$existingState.PackageSharePath
|
|
}
|
|
|
|
if (-not $ServerIPv4Address) {
|
|
$ServerIPv4Address = [ipaddress](Read-Host 'Fixed IPv4 address for this domain controller')
|
|
}
|
|
if (-not (Test-PrivateIPv4Address -Address $ServerIPv4Address)) {
|
|
throw 'ServerIPv4Address must be the private address of the domain controller. An Azure public IP is never assigned to AD or published in domain DNS.'
|
|
}
|
|
$domainSubnet = ConvertTo-NetworkCidr -Address $ServerIPv4Address `
|
|
-NetworkPrefixLength $PrefixLength
|
|
$TrustedClientNetworks = @($TrustedClientNetworks |
|
|
ForEach-Object { ConvertTo-PrivateNetworkCidr -Cidr $_ } |
|
|
Where-Object { $_ -ne $domainSubnet } |
|
|
Select-Object -Unique)
|
|
$allowedRemoteAddresses = @($domainSubnet) + $TrustedClientNetworks
|
|
|
|
$sourceRoot = $PSScriptRoot
|
|
if (-not $Resume) {
|
|
Assert-PackageManifest -PackageRoot $sourceRoot
|
|
New-Item -ItemType Directory -Path $bootstrapRoot -Force | Out-Null
|
|
if ((Resolve-Path -LiteralPath $sourceRoot).Path -ne (Resolve-Path -LiteralPath $bootstrapRoot).Path) {
|
|
Copy-Item -Path (Join-Path $sourceRoot '*') -Destination $bootstrapRoot -Recurse -Force
|
|
}
|
|
Assert-PackageManifest -PackageRoot $bootstrapRoot
|
|
}
|
|
else {
|
|
Assert-PackageManifest -PackageRoot $bootstrapRoot
|
|
}
|
|
|
|
$NetworkInterfaceAlias = Resolve-PrivateInterfaceAlias -RequestedAlias $NetworkInterfaceAlias
|
|
$baseDn = Get-DomainBaseDn -DnsDomainName $DomainName
|
|
$brokerDnsName = "$BrokerRecordName.$DomainName"
|
|
$rustDeskDnsName = "$RustDeskRecordName.$DomainName"
|
|
$stagedScriptPath = Join-Path $bootstrapRoot 'Initialize-SguDomainController.ps1'
|
|
$scriptsRoot = Join-Path $bootstrapRoot 'payload\scripts'
|
|
$brokerPublishPath = Join-Path $bootstrapRoot 'payload\broker'
|
|
|
|
foreach ($requiredPath in @(
|
|
$stagedScriptPath,
|
|
(Join-Path $scriptsRoot 'Deploy-AuthBroker.ps1'),
|
|
(Join-Path $scriptsRoot 'New-LabCertificate.ps1'),
|
|
(Join-Path $scriptsRoot 'Set-LabBrokerDns.ps1'),
|
|
(Join-Path $scriptsRoot 'Set-SguDomainComputerPolicies.ps1'),
|
|
(Join-Path $scriptsRoot 'Set-SguDomainUserPolicies.ps1'),
|
|
(Join-Path $scriptsRoot 'Enable-SguServerRemoteManagement.ps1'),
|
|
(Join-Path $scriptsRoot 'Install-SguDomainMonitoring.ps1'),
|
|
(Join-Path $scriptsRoot 'Install-SguRustDeskClient.ps1'),
|
|
(Join-Path $scriptsRoot 'Install-SguRustDeskLinuxEnrollment.ps1'),
|
|
(Join-Path $scriptsRoot 'Install-SguRustDeskServer.ps1'),
|
|
(Join-Path $scriptsRoot 'Invoke-SguRustDeskLinuxRegistrationProcessor.ps1'),
|
|
(Join-Path $scriptsRoot 'Invoke-SguMonitoringMaintenance.ps1'),
|
|
(Join-Path $scriptsRoot 'Get-SguRustDeskDevice.ps1'),
|
|
(Join-Path $scriptsRoot 'Get-SguUsageReport.ps1'),
|
|
(Join-Path $scriptsRoot 'Get-SguBrokerLog.ps1'),
|
|
(Join-Path $scriptsRoot 'Register-SguRustDeskDevice.ps1'),
|
|
(Join-Path $brokerPublishPath 'SGU.AuthBroker.exe'))) {
|
|
if (-not (Test-Path -LiteralPath $requiredPath -PathType Leaf)) {
|
|
throw "The server bootstrap package is incomplete: $requiredPath"
|
|
}
|
|
}
|
|
|
|
if (-not $existingState) {
|
|
if ($DnsForwarders.Count -eq 0) {
|
|
$DnsForwarders = @(Get-DnsClientServerAddress -AddressFamily IPv4 |
|
|
Where-Object InterfaceAlias -ne $NetworkInterfaceAlias |
|
|
Select-Object -ExpandProperty ServerAddresses |
|
|
Where-Object { $_ -and $_ -ne $ServerIPv4Address.IPAddressToString } |
|
|
ForEach-Object { [ipaddress]$_ } |
|
|
Select-Object -Unique)
|
|
}
|
|
|
|
$existingState = [ordered]@{
|
|
Phase = 'Promote'
|
|
ServerIPv4Address = $ServerIPv4Address.IPAddressToString
|
|
PrefixLength = $PrefixLength
|
|
NetworkInterfaceAlias = $NetworkInterfaceAlias
|
|
DefaultGateway = if ($DefaultGateway) { $DefaultGateway.IPAddressToString } else { $null }
|
|
NetworkConfigurationMode = $NetworkConfigurationMode
|
|
TrustedClientNetworks = $TrustedClientNetworks
|
|
DnsForwarders = @($DnsForwarders | ForEach-Object IPAddressToString)
|
|
DomainName = $DomainName
|
|
DomainNetbios = $DomainNetbios
|
|
BrokerRecordName = $BrokerRecordName
|
|
RustDeskRecordName = $RustDeskRecordName
|
|
PackageSharePath = $PackageSharePath
|
|
}
|
|
[IO.File]::WriteAllText(
|
|
$statePath,
|
|
($existingState | ConvertTo-Json -Depth 4),
|
|
[Text.UTF8Encoding]::new($false))
|
|
}
|
|
|
|
if ($NetworkConfigurationMode -eq 'PlatformManaged') {
|
|
Write-BootstrapLog "Validating platform-managed address $ServerIPv4Address/$PrefixLength on $NetworkInterfaceAlias without changing DHCP, routes, or the Azure NIC."
|
|
Assert-PlatformManagedDomainAddress -InterfaceAlias $NetworkInterfaceAlias `
|
|
-Address $ServerIPv4Address -NetworkPrefixLength $PrefixLength
|
|
}
|
|
else {
|
|
Write-BootstrapLog "Configuring $NetworkInterfaceAlias as $ServerIPv4Address/$PrefixLength."
|
|
Set-StaticDomainAddress -InterfaceAlias $NetworkInterfaceAlias `
|
|
-Address $ServerIPv4Address -NetworkPrefixLength $PrefixLength -Gateway $DefaultGateway
|
|
}
|
|
|
|
$computer = Get-CimInstance Win32_ComputerSystem
|
|
if (-not $computer.PartOfDomain) {
|
|
if ([string]$existingState.Phase -eq 'Finalize') {
|
|
throw 'Active Directory promotion completed but Windows has not restarted. Restart the server to continue automatically.'
|
|
}
|
|
|
|
if (-not $SafeModeAdministratorPassword) {
|
|
$SafeModeAdministratorPassword = Read-Host `
|
|
'Directory Services Restore Mode password (not stored)' -AsSecureString
|
|
}
|
|
|
|
Write-BootstrapLog 'Installing Active Directory Domain Services, DNS, and management tools.'
|
|
Install-WindowsFeature AD-Domain-Services,DNS,GPMC,RSAT-AD-Tools `
|
|
-IncludeManagementTools | Out-Null
|
|
Register-ResumeTask -ScriptPath $stagedScriptPath
|
|
|
|
Write-BootstrapLog "Creating the $DomainName forest. Windows must restart once."
|
|
Install-ADDSForest `
|
|
-DomainName $DomainName `
|
|
-DomainNetbiosName $DomainNetbios `
|
|
-InstallDns `
|
|
-SafeModeAdministratorPassword $SafeModeAdministratorPassword `
|
|
-NoRebootOnCompletion `
|
|
-Force | Out-Null
|
|
|
|
$existingState.Phase = 'Finalize'
|
|
[IO.File]::WriteAllText(
|
|
$statePath,
|
|
($existingState | ConvertTo-Json -Depth 4),
|
|
[Text.UTF8Encoding]::new($false))
|
|
|
|
if ($SkipRestart) {
|
|
Write-BootstrapLog 'Promotion succeeded. Restart manually; finalization will resume at startup.'
|
|
return [pscustomobject]@{
|
|
Phase = 'AwaitingRestart'
|
|
DomainName = $DomainName
|
|
ServerIPv4Address = $ServerIPv4Address.IPAddressToString
|
|
ResumeTask = $taskName
|
|
}
|
|
}
|
|
|
|
Restart-Computer -Force
|
|
return
|
|
}
|
|
|
|
if (-not $computer.Domain.Equals($DomainName, [StringComparison]::OrdinalIgnoreCase)) {
|
|
throw "This server belongs to $($computer.Domain), not $DomainName."
|
|
}
|
|
|
|
Write-BootstrapLog 'Finalizing Active Directory, DNS, policies, broker, shares, and remote management.'
|
|
|
|
# Once the machine is a DC, every active adapter must query the local DNS
|
|
# service. Only the private domain adapter may publish its address in the AD
|
|
# zone; otherwise clients can receive the DHCP/NAT address of the Internet NIC.
|
|
Get-NetAdapter | Where-Object Status -eq 'Up' | ForEach-Object {
|
|
Set-DnsClientServerAddress -InterfaceIndex $_.ifIndex `
|
|
-ServerAddresses $ServerIPv4Address.IPAddressToString
|
|
Set-DnsClient -InterfaceIndex $_.ifIndex `
|
|
-RegisterThisConnectionsAddress:($_.Name -eq $NetworkInterfaceAlias)
|
|
}
|
|
|
|
Clear-DnsClientCache
|
|
Register-DnsClient
|
|
Import-Module ActiveDirectory -ErrorAction Stop
|
|
Wait-ActiveDirectoryReady -ExpectedBaseDn $baseDn
|
|
|
|
# A newly promoted Windows Server 2025 DC can retain the Public firewall
|
|
# profile because network identification ran before local DNS and LDAP were
|
|
# ready. A private-adapter bounce triggers the supported domain-detection path.
|
|
$domainProfile = Get-NetConnectionProfile -InterfaceAlias $NetworkInterfaceAlias `
|
|
-ErrorAction SilentlyContinue
|
|
if (-not $domainProfile -or $domainProfile.NetworkCategory -ne 'DomainAuthenticated') {
|
|
if ($NetworkConfigurationMode -eq 'GuestStatic') {
|
|
Write-BootstrapLog "Refreshing $NetworkInterfaceAlias so Windows detects the domain network profile."
|
|
Restart-NetAdapter -Name $NetworkInterfaceAlias -Confirm:$false
|
|
}
|
|
else {
|
|
# Restarting an Azure NIC from inside the guest can sever the only
|
|
# management path. Refresh NLA instead; this does not change the
|
|
# platform-managed address, DHCP lease, route, or link state.
|
|
Write-BootstrapLog 'Refreshing Network Location Awareness without restarting the Azure adapter.'
|
|
Restart-Service NlaSvc -Force -ErrorAction SilentlyContinue
|
|
}
|
|
for ($attempt = 1; $attempt -le 15; $attempt++) {
|
|
Start-Sleep -Seconds 2
|
|
$domainProfile = Get-NetConnectionProfile -InterfaceAlias $NetworkInterfaceAlias `
|
|
-ErrorAction SilentlyContinue
|
|
if ($domainProfile -and $domainProfile.NetworkCategory -eq 'DomainAuthenticated') {
|
|
break
|
|
}
|
|
}
|
|
}
|
|
|
|
# Apply the single-address DNS listener only after any adapter refresh. That
|
|
# avoids transient DNS socket errors while the private address is momentarily
|
|
# unavailable, while still preventing the Internet/NAT address from being
|
|
# published once finalization completes.
|
|
New-ItemProperty `
|
|
-Path 'HKLM:\SYSTEM\CurrentControlSet\Services\DNS\Parameters' `
|
|
-Name PublishAddresses `
|
|
-PropertyType String `
|
|
-Value $ServerIPv4Address.IPAddressToString `
|
|
-Force | Out-Null
|
|
$dnsServerSetting = Get-DnsServerSetting -All -WarningAction SilentlyContinue
|
|
$dnsServerSetting.ListeningIPAddress = @($ServerIPv4Address)
|
|
Set-DnsServerSetting -InputObject $dnsServerSetting -WarningAction SilentlyContinue | Out-Null
|
|
Restart-Service DNS -Force
|
|
Wait-DnsZoneReady -ZoneName $DomainName -DnsServer $ServerIPv4Address
|
|
|
|
$adServer = 'localhost'
|
|
$domain = Get-ADDomain -Identity $DomainName -Server $adServer
|
|
$laboratoryOuDn = Ensure-OrganizationalUnit -Name 'Laboratorio' -Path $baseDn -Server $adServer
|
|
$usersOuDn = Ensure-OrganizationalUnit -Name 'Usuarios-SGU' -Path $baseDn -Server $adServer
|
|
foreach ($ouName in @('Docentes', 'Alumnos', 'Administrativos')) {
|
|
Ensure-OrganizationalUnit -Name $ouName -Path $usersOuDn -Server $adServer | Out-Null
|
|
}
|
|
|
|
$remoteDesktopGroupName = 'SG-Laboratorio-Usuarios-RDP'
|
|
$remoteDesktopGroup = Get-ADGroup -LDAPFilter "(sAMAccountName=$remoteDesktopGroupName)" `
|
|
-SearchBase $baseDn -SearchScope Subtree -Server $adServer `
|
|
-ErrorAction SilentlyContinue
|
|
if (-not $remoteDesktopGroup) {
|
|
New-ADGroup -Name $remoteDesktopGroupName -SamAccountName $remoteDesktopGroupName `
|
|
-GroupCategory Security -GroupScope Global -Path $laboratoryOuDn `
|
|
-Description 'SGU users permitted to use Remote Desktop on laboratory clients.' `
|
|
-Server $adServer | Out-Null
|
|
$remoteDesktopGroup = Get-ADGroup -LDAPFilter "(sAMAccountName=$remoteDesktopGroupName)" `
|
|
-SearchBase $laboratoryOuDn -SearchScope OneLevel -Server $adServer
|
|
}
|
|
|
|
& (Join-Path $scriptsRoot 'Set-LabBrokerDns.ps1') `
|
|
-ZoneName $DomainName `
|
|
-RecordName $BrokerRecordName `
|
|
-IPv4Address $ServerIPv4Address `
|
|
-ExternalForwarders $DnsForwarders | Out-Null
|
|
& (Join-Path $scriptsRoot 'Set-LabBrokerDns.ps1') `
|
|
-ZoneName $DomainName `
|
|
-RecordName $RustDeskRecordName `
|
|
-IPv4Address $ServerIPv4Address | Out-Null
|
|
|
|
$certificateDirectory = Join-Path $bootstrapRoot 'certificates'
|
|
$serverCertificate = Get-ChildItem Cert:\LocalMachine\My |
|
|
Where-Object {
|
|
$_.Subject -eq "CN=$brokerDnsName" -and
|
|
$_.HasPrivateKey -and
|
|
$_.NotAfter -gt (Get-Date).AddDays(30)
|
|
} |
|
|
Sort-Object NotAfter -Descending |
|
|
Select-Object -First 1
|
|
if (-not $serverCertificate) {
|
|
$certificateResult = & (Join-Path $scriptsRoot 'New-LabCertificate.ps1') `
|
|
-Role BrokerServer `
|
|
-BrokerDnsName $brokerDnsName `
|
|
-OutputDirectory $certificateDirectory
|
|
$serverCertificate = Get-ChildItem Cert:\LocalMachine\My |
|
|
Where-Object Thumbprint -eq $certificateResult.Thumbprint |
|
|
Select-Object -First 1
|
|
}
|
|
else {
|
|
New-Item -ItemType Directory -Path $certificateDirectory -Force | Out-Null
|
|
$publicCertificatePath = Join-Path $certificateDirectory 'sgu-auth-broker.cer'
|
|
Export-Certificate -Cert $serverCertificate -FilePath $publicCertificatePath -Force | Out-Null
|
|
if (-not (Get-ChildItem Cert:\LocalMachine\Root | Where-Object Thumbprint -eq $serverCertificate.Thumbprint)) {
|
|
Import-Certificate -FilePath $publicCertificatePath `
|
|
-CertStoreLocation Cert:\LocalMachine\Root | Out-Null
|
|
}
|
|
}
|
|
|
|
$allowedClientThumbprints = @()
|
|
$brokerConfigurationPath = 'C:\Program Files\SGU\AuthBroker\appsettings.Production.json'
|
|
if (Test-Path -LiteralPath $brokerConfigurationPath -PathType Leaf) {
|
|
$priorConfiguration = Get-Content -LiteralPath $brokerConfigurationPath -Raw | ConvertFrom-Json
|
|
$allowedClientThumbprints = @($priorConfiguration.Broker.Tls.AllowedClientThumbprints)
|
|
}
|
|
|
|
& (Join-Path $scriptsRoot 'Deploy-AuthBroker.ps1') `
|
|
-PublishPath $brokerPublishPath `
|
|
-ServerCertificateSubject $brokerDnsName `
|
|
-AllowedClientThumbprints $allowedClientThumbprints `
|
|
-LdapHost $adServer `
|
|
-BaseDn $baseDn `
|
|
-DomainNetbios $DomainNetbios `
|
|
-UpnSuffix $DomainName `
|
|
-RemoteDesktopGroupDn $remoteDesktopGroup.DistinguishedName `
|
|
-DefaultCompany 'La Salle' `
|
|
-FirewallLocalAddress $ServerIPv4Address `
|
|
-FirewallRemoteAddress $allowedRemoteAddresses `
|
|
-CreateMissingOus `
|
|
-DisableCertificateRevocationCheckForLab | Out-Null
|
|
|
|
# Remove stale A records registered by any non-domain/NAT adapter before its
|
|
# dynamic DNS registration was disabled.
|
|
$hostRecords = @(Get-DnsServerResourceRecord -ZoneName $DomainName `
|
|
-Name $env:COMPUTERNAME -RRType A -ErrorAction SilentlyContinue)
|
|
foreach ($hostRecord in $hostRecords) {
|
|
if ($hostRecord.RecordData.IPv4Address.IPAddressToString -ne $ServerIPv4Address.IPAddressToString) {
|
|
Remove-DnsServerResourceRecord -ZoneName $DomainName -InputObject $hostRecord -Force
|
|
}
|
|
}
|
|
|
|
& (Join-Path $scriptsRoot 'Enable-SguServerRemoteManagement.ps1') `
|
|
-AllowedRemoteAddress $allowedRemoteAddresses | Out-Null
|
|
|
|
$contentPath = Join-Path $bootstrapRoot 'payload\server-content\Packages'
|
|
if (Test-Path -LiteralPath $contentPath -PathType Container) {
|
|
New-Item -ItemType Directory -Path $PackageSharePath -Force | Out-Null
|
|
Copy-Item -Path (Join-Path $contentPath '*') -Destination $PackageSharePath -Recurse -Force
|
|
}
|
|
Set-PackageShare -Path $PackageSharePath -NetbiosName $DomainNetbios `
|
|
-DomainSid $domain.DomainSID.Value
|
|
|
|
$packageFirewallRule = Get-NetFirewallRule -DisplayName 'SGU Bootstrap Packages (SMB)' `
|
|
-ErrorAction SilentlyContinue
|
|
if (-not $packageFirewallRule) {
|
|
New-NetFirewallRule `
|
|
-DisplayName 'SGU Bootstrap Packages (SMB)' `
|
|
-Direction Inbound `
|
|
-Action Allow `
|
|
-Protocol TCP `
|
|
-LocalPort 445 `
|
|
-LocalAddress $ServerIPv4Address.IPAddressToString `
|
|
-RemoteAddress $allowedRemoteAddresses `
|
|
-Profile Any | Out-Null
|
|
}
|
|
else {
|
|
$packageFirewallRule | Set-NetFirewallRule -Enabled True -Profile Any
|
|
$packageFirewallRule | Get-NetFirewallAddressFilter |
|
|
Set-NetFirewallAddressFilter `
|
|
-LocalAddress $ServerIPv4Address.IPAddressToString `
|
|
-RemoteAddress $allowedRemoteAddresses | Out-Null
|
|
}
|
|
|
|
$collectorFqdn = "$env:COMPUTERNAME.$DomainName"
|
|
& (Join-Path $scriptsRoot 'Set-SguDomainComputerPolicies.ps1') `
|
|
-TargetOuDn $laboratoryOuDn `
|
|
-DomainController $env:COMPUTERNAME `
|
|
-EventCollectorFqdn $collectorFqdn | Out-Null
|
|
& (Join-Path $scriptsRoot 'Install-SguDomainMonitoring.ps1') `
|
|
-CollectorFqdn $collectorFqdn `
|
|
-ComputerOuDn $laboratoryOuDn `
|
|
-RetentionDays 183 | Out-Null
|
|
$userPolicyParameters = @{
|
|
TargetOuDn = $usersOuDn
|
|
DomainController = $env:COMPUTERNAME
|
|
ClearManagedWallpaper = $true
|
|
}
|
|
& (Join-Path $scriptsRoot 'Set-SguDomainUserPolicies.ps1') @userPolicyParameters | Out-Null
|
|
|
|
$rustDeskServer = & (Join-Path $scriptsRoot 'Install-SguRustDeskServer.ps1') `
|
|
-ServerAddress $rustDeskDnsName `
|
|
-FirewallRemoteAddress $allowedRemoteAddresses
|
|
$rustDeskManagementRoot = Join-Path $env:ProgramData 'SGU\RustDesk'
|
|
New-Item -ItemType Directory -Path $rustDeskManagementRoot -Force | Out-Null
|
|
foreach ($scriptName in @(
|
|
'Register-SguRustDeskDevice.ps1',
|
|
'Get-SguRustDeskDevice.ps1',
|
|
'Install-SguRustDeskLinuxEnrollment.ps1',
|
|
'Invoke-SguRustDeskLinuxRegistrationProcessor.ps1')) {
|
|
Copy-Item -LiteralPath (Join-Path $scriptsRoot $scriptName) `
|
|
-Destination (Join-Path $rustDeskManagementRoot $scriptName) -Force
|
|
}
|
|
$rustDeskLinuxEnrollment = & (Join-Path $rustDeskManagementRoot 'Install-SguRustDeskLinuxEnrollment.ps1') `
|
|
-DomainName $DomainName `
|
|
-ServerAddress $rustDeskDnsName `
|
|
-ServerPublicKey $rustDeskServer.PublicKey `
|
|
-ProcessorScriptPath (Join-Path $rustDeskManagementRoot 'Invoke-SguRustDeskLinuxRegistrationProcessor.ps1')
|
|
$rustDeskServerClient = & (Join-Path $scriptsRoot 'Install-SguRustDeskClient.ps1') `
|
|
-ServerAddress $rustDeskDnsName `
|
|
-ServerPublicKey $rustDeskServer.PublicKey
|
|
$rustDeskPasswordPointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR(
|
|
$rustDeskServerClient.AccessPassword)
|
|
try {
|
|
$rustDeskPassword = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($rustDeskPasswordPointer)
|
|
& (Join-Path $rustDeskManagementRoot 'Register-SguRustDeskDevice.ps1') `
|
|
-ComputerName $env:COMPUTERNAME `
|
|
-RustDeskId $rustDeskServerClient.RustDeskId `
|
|
-AccessPassword $rustDeskPassword | Out-Null
|
|
}
|
|
finally {
|
|
[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($rustDeskPasswordPointer)
|
|
$rustDeskPassword = $null
|
|
}
|
|
|
|
$validation = [ordered]@{
|
|
CompletedAt = (Get-Date).ToString('o')
|
|
ComputerName = $env:COMPUTERNAME
|
|
DomainName = $DomainName
|
|
ServerIPv4Address = $ServerIPv4Address.IPAddressToString
|
|
NetworkConfigurationMode = $NetworkConfigurationMode
|
|
TrustedClientNetworks = $TrustedClientNetworks
|
|
AllowedRemoteAddresses = $allowedRemoteAddresses
|
|
BrokerDnsName = $brokerDnsName
|
|
BrokerCertificateThumbprint = $serverCertificate.Thumbprint
|
|
BrokerService = (Get-Service SGUAuthBroker).Status.ToString()
|
|
BrokerPortListening = [bool](Get-NetTCPConnection -LocalPort 8443 -State Listen -ErrorAction SilentlyContinue)
|
|
WinRM = (Get-Service WinRM).Status.ToString()
|
|
RemoteDesktop = (Get-Service TermService).Status.ToString()
|
|
RustDeskServerAddress = $rustDeskServer.ServerAddress
|
|
RustDeskHbbsTask = $rustDeskServer.HbbsTask
|
|
RustDeskHbbrTask = $rustDeskServer.HbbrTask
|
|
RustDeskHbbsListening = $rustDeskServer.HbbsListening
|
|
RustDeskHbbrListening = $rustDeskServer.HbbrListening
|
|
RustDeskLinuxRegistrationTask = (Get-ScheduledTask -TaskName $rustDeskLinuxEnrollment.RegistrationTask).State.ToString()
|
|
RustDeskServerClientId = $rustDeskServerClient.RustDeskId
|
|
EventCollector = (Get-Service Wecsvc).Status.ToString()
|
|
EventSubscription = @(& wecutil.exe enum-subscription) -contains 'SGU-Lab-Monitoring'
|
|
MonitoringRetentionDays = 183
|
|
PackageShare = "\\$env:COMPUTERNAME\Packages"
|
|
LaboratoryOu = $laboratoryOuDn
|
|
UsersOu = $usersOuDn
|
|
RemoteDesktopGroup = $remoteDesktopGroup.DistinguishedName
|
|
DomainNetworkProfile = [string](Get-NetConnectionProfile `
|
|
-InterfaceAlias $NetworkInterfaceAlias -ErrorAction SilentlyContinue).NetworkCategory
|
|
}
|
|
|
|
if ($validation.BrokerService -ne 'Running' -or
|
|
-not $validation.BrokerPortListening -or
|
|
$validation.WinRM -ne 'Running' -or
|
|
$validation.RemoteDesktop -ne 'Running' -or
|
|
$validation.RustDeskHbbsTask -ne 'Running' -or
|
|
$validation.RustDeskHbbrTask -ne 'Running' -or
|
|
$validation.RustDeskLinuxRegistrationTask -notin @('Ready', 'Running') -or
|
|
-not $validation.RustDeskHbbsListening -or
|
|
-not $validation.RustDeskHbbrListening -or
|
|
$validation.EventCollector -ne 'Running' -or
|
|
-not $validation.EventSubscription -or
|
|
$validation.DomainNetworkProfile -ne 'DomainAuthenticated') {
|
|
throw 'Server finalization did not pass service validation. Review bootstrap.log and re-run the bootstrap.'
|
|
}
|
|
|
|
[IO.File]::WriteAllText(
|
|
$completionPath,
|
|
($validation | ConvertTo-Json -Depth 4),
|
|
[Text.UTF8Encoding]::new($false))
|
|
if (Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue) {
|
|
Unregister-ScheduledTask -TaskName $taskName -Confirm:$false
|
|
}
|
|
Remove-Item -LiteralPath $statePath -Force -ErrorAction SilentlyContinue
|
|
Write-BootstrapLog 'SGU domain controller bootstrap completed successfully.'
|
|
[pscustomobject]$validation
|