108 lines
4.4 KiB
PowerShell
108 lines
4.4 KiB
PowerShell
#Requires -Version 5.1
|
|
[CmdletBinding(SupportsShouldProcess)]
|
|
param()
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
$userName = 'alumno'
|
|
$plainTextPassword = 'ingenieria'
|
|
$description = 'Cuenta local estandar SGU para recuperacion'
|
|
$passwordNeverExpiresFlag = 0x10000
|
|
|
|
function Get-LocalUserFlags {
|
|
param([Parameter(Mandatory)][string]$Name)
|
|
|
|
$directoryEntry = [ADSI]("WinNT://$env:COMPUTERNAME/$Name,user")
|
|
return [int]$directoryEntry.InvokeGet('UserFlags')
|
|
}
|
|
|
|
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
|
$principal = [Security.Principal.WindowsPrincipal]::new($identity)
|
|
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
|
throw 'Run this script from an elevated Windows PowerShell session.'
|
|
}
|
|
|
|
if (-not $PSCmdlet.ShouldProcess($env:COMPUTERNAME, "Create or update standard local user $userName")) {
|
|
return
|
|
}
|
|
|
|
$securePassword = ConvertTo-SecureString $plainTextPassword -AsPlainText -Force
|
|
try {
|
|
$user = Get-LocalUser -Name $userName -ErrorAction SilentlyContinue
|
|
if ($user -and $user.SID.Value.EndsWith('-500', [StringComparison]::Ordinal)) {
|
|
throw "The local account '$userName' is the built-in Administrator account and cannot be converted to a standard user."
|
|
}
|
|
|
|
if ($user) {
|
|
Set-LocalUser -Name $userName `
|
|
-Password $securePassword `
|
|
-PasswordNeverExpires $true `
|
|
-Description $description
|
|
if (-not $user.Enabled) {
|
|
Enable-LocalUser -Name $userName
|
|
}
|
|
}
|
|
else {
|
|
New-LocalUser -Name $userName `
|
|
-Password $securePassword `
|
|
-PasswordNeverExpires `
|
|
-Description $description | Out-Null
|
|
}
|
|
|
|
# Windows 10's Get-LocalUser object has PasswordExpires but does not expose
|
|
# PasswordNeverExpires. Enforce and verify the underlying UF_DONT_EXPIRE_PASSWD
|
|
# flag so the result is consistent across Windows 10 and Windows 11.
|
|
$directoryEntry = [ADSI]("WinNT://$env:COMPUTERNAME/$userName,user")
|
|
$userFlags = [int]$directoryEntry.InvokeGet('UserFlags')
|
|
if (($userFlags -band $passwordNeverExpiresFlag) -eq 0) {
|
|
$directoryEntry.InvokeSet('UserFlags', ($userFlags -bor $passwordNeverExpiresFlag))
|
|
$directoryEntry.CommitChanges()
|
|
}
|
|
|
|
$user = Get-LocalUser -Name $userName -ErrorAction Stop
|
|
$administratorsSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-544')
|
|
$usersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-545')
|
|
$administratorsGroup = Get-LocalGroup -SID $administratorsSid -ErrorAction Stop
|
|
$usersGroup = Get-LocalGroup -SID $usersSid -ErrorAction Stop
|
|
$administratorMembers = @(Get-LocalGroupMember -Group $administratorsGroup -ErrorAction Stop)
|
|
if ($administratorMembers.SID.Value -contains $user.SID.Value) {
|
|
Remove-LocalGroupMember -Group $administratorsGroup -Member $user -Confirm:$false
|
|
}
|
|
|
|
$standardMembers = @(Get-LocalGroupMember -Group $usersGroup -ErrorAction Stop)
|
|
if ($standardMembers.SID.Value -notcontains $user.SID.Value) {
|
|
Add-LocalGroupMember -Group $usersGroup -Member $user
|
|
}
|
|
}
|
|
finally {
|
|
$securePassword = $null
|
|
}
|
|
|
|
$verifiedUser = Get-LocalUser -Name $userName -ErrorAction Stop
|
|
$verifiedAdministratorsGroup = Get-LocalGroup `
|
|
-SID ([Security.Principal.SecurityIdentifier]::new('S-1-5-32-544')) `
|
|
-ErrorAction Stop
|
|
$verifiedUsersGroup = Get-LocalGroup `
|
|
-SID ([Security.Principal.SecurityIdentifier]::new('S-1-5-32-545')) `
|
|
-ErrorAction Stop
|
|
$verifiedAdministrators = @(Get-LocalGroupMember -Group $verifiedAdministratorsGroup -ErrorAction Stop)
|
|
$verifiedUsers = @(Get-LocalGroupMember -Group $verifiedUsersGroup -ErrorAction Stop)
|
|
if (@($verifiedAdministrators).SID.Value -contains $verifiedUser.SID.Value) {
|
|
throw "The local account '$userName' still belongs to the local Administrators group."
|
|
}
|
|
if ($verifiedUsers.SID.Value -notcontains $verifiedUser.SID.Value) {
|
|
throw "The local account '$userName' does not belong to the local Users group."
|
|
}
|
|
$verifiedPasswordNeverExpires =
|
|
((Get-LocalUserFlags -Name $userName) -band $passwordNeverExpiresFlag) -ne 0
|
|
if (-not $verifiedPasswordNeverExpires) {
|
|
throw "The local account '$userName' password is not configured to never expire."
|
|
}
|
|
|
|
[pscustomobject]@{
|
|
UserName = $verifiedUser.Name
|
|
Enabled = $verifiedUser.Enabled
|
|
IsAdministrator = $false
|
|
IsStandardUser = $true
|
|
PasswordNeverExpires = $verifiedPasswordNeverExpires
|
|
}
|