76 lines
3.3 KiB
PowerShell
76 lines
3.3 KiB
PowerShell
#Requires -Version 5.1
|
|
[CmdletBinding(SupportsShouldProcess)]
|
|
param(
|
|
[string]$TargetOuDn = 'OU=Laboratorio,DC=lci,DC=lasalle,DC=mx',
|
|
[string]$GpoName = 'SGU - Laboratorio wallpaper protection',
|
|
[string]$DomainController = $env:COMPUTERNAME,
|
|
[string]$WallpaperPath = '%LOCALAPPDATA%\SGU\Wallpapers\welcome-%COMPUTERNAME%.jpg'
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
Import-Module ActiveDirectory -ErrorAction Stop
|
|
Import-Module GroupPolicy -ErrorAction Stop
|
|
$domainName = (Get-ADDomain -Server $DomainController).DNSRoot
|
|
Get-ADOrganizationalUnit -Identity $TargetOuDn -Server $DomainController -ErrorAction Stop | Out-Null
|
|
if (-not $PSCmdlet.ShouldProcess($TargetOuDn, "Apply '$GpoName' with enforced loopback Merge")) {
|
|
return
|
|
}
|
|
|
|
$backupPath = $null
|
|
$gpo = Get-GPO -Name $GpoName -Domain $domainName -Server $DomainController -ErrorAction SilentlyContinue
|
|
if ($gpo) {
|
|
$backupPath = Join-Path $env:ProgramData ('SGU\PolicyBackups\Wallpaper-' + [guid]::NewGuid().ToString('N'))
|
|
New-Item -ItemType Directory -Path $backupPath -Force | Out-Null
|
|
Backup-GPO -Guid $gpo.Id -Path $backupPath -Domain $domainName -Server $DomainController | Out-Null
|
|
}
|
|
else {
|
|
$gpo = New-GPO -Name $GpoName -Domain $domainName -Server $DomainController `
|
|
-Comment 'Protects the SGU desktop wallpaper on Laboratorio computers and child OUs; loopback Merge preserves existing user policies.'
|
|
}
|
|
|
|
# These are user policies scoped by the computer OU, not by the user OU.
|
|
# Match the per-user/per-computer output of Set-SguWelcomeWallpaper.ps1.
|
|
$settings = @(
|
|
@{ Key = 'HKLM\Software\Policies\Microsoft\Windows\System'; Name = 'UserPolicyMode'; Type = 'DWord'; Value = 1 },
|
|
@{ Key = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop'; Name = 'NoChangingWallPaper'; Type = 'DWord'; Value = 1 },
|
|
@{ Key = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System'; Name = 'Wallpaper'; Type = 'ExpandString'; Value = $WallpaperPath },
|
|
@{ Key = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System'; Name = 'WallpaperStyle'; Type = 'String'; Value = '10' }
|
|
)
|
|
foreach ($setting in $settings) {
|
|
Set-GPRegistryValue -Guid $gpo.Id -Domain $domainName -Server $DomainController `
|
|
-Key $setting.Key -ValueName $setting.Name -Type $setting.Type -Value $setting.Value | Out-Null
|
|
}
|
|
$linkParameters = @{
|
|
Guid = $gpo.Id
|
|
Target = $TargetOuDn
|
|
Domain = $domainName
|
|
Server = $DomainController
|
|
LinkEnabled = 'Yes'
|
|
Enforced = 'Yes'
|
|
Order = 1
|
|
}
|
|
$existingLink = (Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
|
|
Where-Object GpoId -eq $gpo.Id
|
|
if ($existingLink) {
|
|
Set-GPLink @linkParameters | Out-Null
|
|
}
|
|
else {
|
|
New-GPLink @linkParameters | Out-Null
|
|
}
|
|
foreach ($setting in $settings) {
|
|
$actual = Get-GPRegistryValue -Guid $gpo.Id -Domain $domainName -Server $DomainController `
|
|
-Key $setting.Key -ValueName $setting.Name
|
|
if ([string]$actual.Value -ne [string]$setting.Value -or [string]$actual.Type -ne $setting.Type) {
|
|
throw "Wallpaper policy verification failed for $($setting.Name)."
|
|
}
|
|
}
|
|
[pscustomobject]@{
|
|
Name = $gpo.DisplayName
|
|
Id = $gpo.Id
|
|
TargetOuDn = $TargetOuDn
|
|
WallpaperPath = $WallpaperPath
|
|
Loopback = 'Merge'
|
|
Enforced = $true
|
|
BackupPath = $backupPath
|
|
}
|