774 lines
36 KiB
PowerShell
774 lines
36 KiB
PowerShell
#Requires -Version 5.1
|
|
[CmdletBinding(SupportsShouldProcess)]
|
|
param(
|
|
[ipaddress]$DomainControllerIPv4Address,
|
|
[string]$NetworkInterfaceAlias,
|
|
[ipaddress]$ClientIPv4Address,
|
|
[ValidateRange(1, 32)]
|
|
[int]$ClientPrefixLength = 24,
|
|
[PSCredential]$DomainCredential,
|
|
[string]$DomainName,
|
|
[string]$DomainNetbios,
|
|
[string]$ComputerOuDn,
|
|
[string]$NewComputerName,
|
|
[ValidateSet('Auto', 'Windows10Legacy', 'Windows11Modern')]
|
|
[string]$CompatibilityProfile = 'Auto',
|
|
[ValidateSet('Direct', 'AzureP2S')]
|
|
[string]$ConnectivityMode = 'Direct',
|
|
[string]$VpnConnectionName = 'SGU Azure P2S',
|
|
[string]$VpnProfilePackagePath,
|
|
[string]$VpnClientCertificatePfxPath,
|
|
[securestring]$VpnClientCertificatePfxPassword,
|
|
[string]$VpnClientRootCertificatePath,
|
|
[string[]]$AzureNetworkPrefixes = @('10.77.0.0/16'),
|
|
[switch]$PauseOnError,
|
|
[switch]$SkipRestart
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
$brokerRecordName = 'sgu-auth'
|
|
$temporaryRoot = Join-Path $env:ProgramData ("SGU\Bootstrap\Client-" + [Guid]::NewGuid().ToString('N'))
|
|
$bootstrapLogRoot = Join-Path $env:ProgramData 'SGU\Bootstrap\Client'
|
|
$bootstrapErrorLog = Join-Path $bootstrapLogRoot 'latest-error.log'
|
|
|
|
trap {
|
|
$failure = $_
|
|
$failureText = @(
|
|
"SGU client enrollment failed at $((Get-Date).ToString('s')).",
|
|
'',
|
|
$failure.Exception.Message,
|
|
'',
|
|
$failure.ScriptStackTrace
|
|
) -join [Environment]::NewLine
|
|
try {
|
|
New-Item -ItemType Directory -Path $bootstrapLogRoot -Force | Out-Null
|
|
[IO.File]::WriteAllText($bootstrapErrorLog, $failureText, [Text.UTF8Encoding]::new($false))
|
|
}
|
|
catch {
|
|
# Keep the original enrollment error when diagnostics cannot be written.
|
|
}
|
|
|
|
Write-Host ''
|
|
Write-Host 'SGU client enrollment did not complete.' -ForegroundColor Red
|
|
Write-Host $failure.Exception.Message -ForegroundColor Red
|
|
Write-Host "Diagnostic log: $bootstrapErrorLog" -ForegroundColor Yellow
|
|
if ($PauseOnError -and [Environment]::UserInteractive) {
|
|
Read-Host 'Press ENTER to close this window' | Out-Null
|
|
}
|
|
exit 1
|
|
}
|
|
|
|
function Assert-Administrator {
|
|
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
|
$principal = [Security.Principal.WindowsPrincipal]::new($identity)
|
|
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
|
throw 'Run this bootstrap from an elevated Windows PowerShell session.'
|
|
}
|
|
}
|
|
|
|
function Assert-PackageManifest {
|
|
param([Parameter(Mandatory)][string]$PackageRoot)
|
|
|
|
$manifestPath = Join-Path $PackageRoot 'package-manifest.json'
|
|
if (-not (Test-Path -LiteralPath $manifestPath -PathType Leaf)) {
|
|
throw 'package-manifest.json is missing. Use the complete SGU client bootstrap release.'
|
|
}
|
|
|
|
$manifest = Get-Content -LiteralPath $manifestPath -Raw | ConvertFrom-Json
|
|
foreach ($entry in $manifest.Files) {
|
|
$path = Join-Path $PackageRoot ([string]$entry.Path)
|
|
if (-not (Test-Path -LiteralPath $path -PathType Leaf)) {
|
|
throw "Bootstrap package file is missing: $($entry.Path)"
|
|
}
|
|
$actual = (Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash
|
|
if ($actual -ne [string]$entry.Sha256) {
|
|
throw "Bootstrap package integrity check failed: $($entry.Path)"
|
|
}
|
|
}
|
|
return $manifest
|
|
}
|
|
|
|
function Resolve-ClientInterfaceAlias {
|
|
param(
|
|
[string]$RequestedAlias,
|
|
[Parameter(Mandatory)][ipaddress]$DomainControllerAddress
|
|
)
|
|
|
|
# IP interfaces include tunnel/PPP adapters that Get-NetAdapter can omit.
|
|
$interfaces = @(Get-NetIPInterface -AddressFamily IPv4 | Where-Object {
|
|
$_.ConnectionState -eq 'Connected' -and
|
|
(-not $RequestedAlias -or $_.InterfaceAlias -eq $RequestedAlias)
|
|
})
|
|
$preferred = @(Find-NetRoute -RemoteIPAddress $DomainControllerAddress.IPAddressToString `
|
|
-ErrorAction SilentlyContinue | Where-Object { $_.PSObject.Properties['IPAddress'] })
|
|
$attempts = @()
|
|
$candidates = @(foreach ($interface in $interfaces) {
|
|
$addresses = @(Get-NetIPAddress -InterfaceIndex $interface.InterfaceIndex -AddressFamily IPv4 `
|
|
-ErrorAction SilentlyContinue | Where-Object {
|
|
$_.AddressState -eq 'Preferred' -and -not $_.SkipAsSource -and
|
|
$_.IPAddress -notmatch '^(0\.|127\.|169\.254\.)'
|
|
})
|
|
if ($addresses.Count -eq 0) {
|
|
$attempts += "$($interface.InterfaceAlias): no usable IPv4 address (check DHCP/static configuration)"
|
|
continue
|
|
}
|
|
$route = Get-NetRoute -InterfaceIndex $interface.InterfaceIndex -AddressFamily IPv4 `
|
|
-PolicyStore ActiveStore -ErrorAction SilentlyContinue | Where-Object {
|
|
$parts = $_.DestinationPrefix -split '/'
|
|
Test-IPv4AddressesSharePrefix -FirstAddress $DomainControllerAddress `
|
|
-SecondAddress ([ipaddress]$parts[0]) -PrefixLength ([int]$parts[1])
|
|
} | Sort-Object @{ Expression = { [int]($_.DestinationPrefix -split '/')[1] }; Descending = $true },
|
|
RouteMetric | Select-Object -First 1
|
|
if ($route) {
|
|
foreach ($address in $addresses) {
|
|
[pscustomobject]@{
|
|
InterfaceAlias = $interface.InterfaceAlias
|
|
InterfaceIndex = [int]$interface.InterfaceIndex
|
|
IPAddress = $address.IPAddress
|
|
NextHop = $route.NextHop
|
|
Preferred = @($preferred | Where-Object IPAddress -eq $address.IPAddress).Count -gt 0
|
|
PrefixLength = [int]($route.DestinationPrefix -split '/')[1]
|
|
Metric = [int]$route.RouteMetric + [int]$interface.InterfaceMetric
|
|
}
|
|
}
|
|
}
|
|
else { $attempts += "$($interface.InterfaceAlias): no route to $DomainControllerAddress" }
|
|
})
|
|
if ($interfaces.Count -eq 0) { $attempts += 'No matching connected IPv4 interface' }
|
|
foreach ($candidate in ($candidates | Sort-Object @{ Expression = { $_.Preferred }; Descending = $true },
|
|
@{ Expression = { $_.PrefixLength }; Descending = $true }, Metric, InterfaceIndex, IPAddress)) {
|
|
Write-Host "Checking $($candidate.InterfaceAlias) ($($candidate.IPAddress)) -> $DomainControllerAddress..."
|
|
if (Test-TcpPort -Address $DomainControllerAddress -Port 5985 -TimeoutMilliseconds 2000 `
|
|
-SourceAddress ([ipaddress]$candidate.IPAddress) -InterfaceIndex $candidate.InterfaceIndex) {
|
|
return $candidate
|
|
}
|
|
$attempts += "$($candidate.InterfaceAlias) [$($candidate.IPAddress), next hop $($candidate.NextHop)]: TCP 5985 unavailable"
|
|
}
|
|
throw "Cannot reach SGU server $DomainControllerAddress. $($attempts -join '; '). Check the LAN/VPN connection, DHCP or an administrator-assigned IP, routes and the server WinRM firewall. No client IP was changed."
|
|
}
|
|
|
|
function Test-IPv4AddressesSharePrefix {
|
|
param(
|
|
[Parameter(Mandatory)][ipaddress]$FirstAddress,
|
|
[Parameter(Mandatory)][ipaddress]$SecondAddress,
|
|
[Parameter(Mandatory)][ValidateRange(0, 32)][int]$PrefixLength
|
|
)
|
|
|
|
if ($FirstAddress.AddressFamily -ne [Net.Sockets.AddressFamily]::InterNetwork -or
|
|
$SecondAddress.AddressFamily -ne [Net.Sockets.AddressFamily]::InterNetwork) {
|
|
return $false
|
|
}
|
|
|
|
$firstBytes = $FirstAddress.GetAddressBytes()
|
|
$secondBytes = $SecondAddress.GetAddressBytes()
|
|
$remainingBits = $PrefixLength
|
|
for ($index = 0; $index -lt 4; $index++) {
|
|
$bits = [Math]::Min(8, $remainingBits)
|
|
$mask = if ($bits -eq 0) {
|
|
0
|
|
}
|
|
elseif ($bits -eq 8) {
|
|
255
|
|
}
|
|
else {
|
|
256 - [int][Math]::Pow(2, 8 - $bits)
|
|
}
|
|
if (($firstBytes[$index] -band $mask) -ne ($secondBytes[$index] -band $mask)) {
|
|
return $false
|
|
}
|
|
$remainingBits -= $bits
|
|
}
|
|
return $true
|
|
}
|
|
|
|
function Wait-ClientInterface {
|
|
param(
|
|
[string]$RequestedAlias,
|
|
[Parameter(Mandatory)][ipaddress]$DomainControllerAddress,
|
|
[int]$TimeoutSeconds = 20
|
|
)
|
|
$deadline = (Get-Date).AddSeconds($TimeoutSeconds)
|
|
do {
|
|
try {
|
|
return Resolve-ClientInterfaceAlias -RequestedAlias $RequestedAlias `
|
|
-DomainControllerAddress $DomainControllerAddress
|
|
}
|
|
catch {
|
|
$lastFailure = $_
|
|
if ((Get-Date) -ge $deadline) { throw $lastFailure }
|
|
Write-Host 'Waiting for DHCP, VPN routes or server connectivity to become ready...'
|
|
Start-Sleep -Seconds 2
|
|
}
|
|
} while ($true)
|
|
}
|
|
|
|
function Assert-UsableClientIPv4Address {
|
|
param(
|
|
[Parameter(Mandatory)][ipaddress]$Address,
|
|
[Parameter(Mandatory)][ipaddress]$DomainControllerAddress,
|
|
[Parameter(Mandatory)][ValidateRange(1, 32)][int]$PrefixLength
|
|
)
|
|
|
|
if ($Address.AddressFamily -ne [Net.Sockets.AddressFamily]::InterNetwork) {
|
|
throw "The SGU client address '$Address' must be IPv4."
|
|
}
|
|
if ($Address.IPAddressToString -eq $DomainControllerAddress.IPAddressToString) {
|
|
throw 'The SGU client and domain controller cannot use the same IPv4 address.'
|
|
}
|
|
if ($Address.IPAddressToString -match '^(0\.|127\.|169\.254\.|22[4-9]\.|23\d\.)') {
|
|
throw "The SGU client address '$Address' is not usable on the private domain network."
|
|
}
|
|
if (-not (Test-IPv4AddressesSharePrefix -FirstAddress $Address `
|
|
-SecondAddress $DomainControllerAddress -PrefixLength $PrefixLength)) {
|
|
throw "The SGU client address '$Address/$PrefixLength' is not on the same network as domain controller $DomainControllerAddress."
|
|
}
|
|
}
|
|
|
|
function Set-ClientDomainAddress {
|
|
param(
|
|
[Parameter(Mandatory)][string]$InterfaceAlias,
|
|
[Parameter(Mandatory)][ipaddress]$DomainControllerAddress,
|
|
[ipaddress]$RequestedAddress,
|
|
[Parameter(Mandatory)][ValidateRange(1, 32)][int]$PrefixLength
|
|
)
|
|
|
|
$adapter = Get-NetAdapter -Name $InterfaceAlias -ErrorAction Stop
|
|
$matchingAddress = Get-NetIPAddress -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 `
|
|
-ErrorAction SilentlyContinue |
|
|
Where-Object {
|
|
$_.AddressState -eq 'Preferred' -and
|
|
$_.IPAddress -notmatch '^(127\.|169\.254\.)' -and
|
|
(Test-IPv4AddressesSharePrefix -FirstAddress ([ipaddress]$_.IPAddress) `
|
|
-SecondAddress $DomainControllerAddress -PrefixLength $PrefixLength)
|
|
} |
|
|
Select-Object -First 1
|
|
|
|
if (-not $RequestedAddress -and $matchingAddress) {
|
|
return [ipaddress]$matchingAddress.IPAddress
|
|
}
|
|
if (-not $RequestedAddress) {
|
|
throw 'Static addressing requires an explicit -ClientIPv4Address. Automatic enrollment preserves DHCP and existing addresses.'
|
|
}
|
|
Assert-UsableClientIPv4Address -Address $RequestedAddress `
|
|
-DomainControllerAddress $DomainControllerAddress -PrefixLength $PrefixLength
|
|
|
|
Set-NetIPInterface -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 -Dhcp Disabled
|
|
$existingAddresses = @(Get-NetIPAddress -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 `
|
|
-ErrorAction SilentlyContinue | Where-Object PrefixOrigin -ne 'WellKnown')
|
|
foreach ($existingAddress in $existingAddresses) {
|
|
if ($existingAddress.IPAddress -ne $RequestedAddress.IPAddressToString -or
|
|
[int]$existingAddress.PrefixLength -ne $PrefixLength) {
|
|
Remove-NetIPAddress -InputObject $existingAddress -Confirm:$false
|
|
}
|
|
}
|
|
if (-not (Get-NetIPAddress -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 `
|
|
-IPAddress $RequestedAddress.IPAddressToString -ErrorAction SilentlyContinue)) {
|
|
New-NetIPAddress -InterfaceIndex $adapter.ifIndex -AddressFamily IPv4 `
|
|
-IPAddress $RequestedAddress.IPAddressToString -PrefixLength $PrefixLength | Out-Null
|
|
}
|
|
|
|
$addressReadyDeadline = (Get-Date).AddSeconds(20)
|
|
do {
|
|
$configuredAddress = Get-NetIPAddress -InterfaceIndex $adapter.ifIndex `
|
|
-AddressFamily IPv4 -IPAddress $RequestedAddress.IPAddressToString `
|
|
-ErrorAction SilentlyContinue
|
|
if ($configuredAddress -and $configuredAddress.AddressState -eq 'Preferred') {
|
|
return $RequestedAddress
|
|
}
|
|
Start-Sleep -Milliseconds 500
|
|
} while ((Get-Date) -lt $addressReadyDeadline)
|
|
|
|
$observedState = if ($configuredAddress) { $configuredAddress.AddressState } else { 'Missing' }
|
|
throw "The SGU client address '$RequestedAddress' did not become ready on '$InterfaceAlias' within 20 seconds. Observed state: $observedState."
|
|
}
|
|
|
|
function Test-TcpPort {
|
|
param(
|
|
[Parameter(Mandatory)][ipaddress]$Address,
|
|
[Parameter(Mandatory)][int]$Port,
|
|
[int]$TimeoutMilliseconds = 5000,
|
|
[ipaddress]$SourceAddress,
|
|
[int]$InterfaceIndex
|
|
)
|
|
|
|
$client = [Net.Sockets.TcpClient]::new([Net.Sockets.AddressFamily]::InterNetwork)
|
|
$connect = $null
|
|
try {
|
|
if ($InterfaceIndex) {
|
|
# IP_UNICAST_IF (31) expects the interface index in network byte order.
|
|
$client.Client.SetSocketOption([Net.Sockets.SocketOptionLevel]::IP,
|
|
[Net.Sockets.SocketOptionName]31, [Net.IPAddress]::HostToNetworkOrder($InterfaceIndex))
|
|
}
|
|
if ($SourceAddress) {
|
|
$client.Client.Bind([Net.IPEndPoint]::new($SourceAddress, 0))
|
|
}
|
|
$connect = $client.BeginConnect($Address, $Port, $null, $null)
|
|
if (-not $connect.AsyncWaitHandle.WaitOne($TimeoutMilliseconds)) {
|
|
return $false
|
|
}
|
|
$client.EndConnect($connect)
|
|
return $true
|
|
}
|
|
catch {
|
|
return $false
|
|
}
|
|
finally {
|
|
$client.Dispose()
|
|
if ($connect) { $connect.AsyncWaitHandle.Close() }
|
|
}
|
|
}
|
|
|
|
function Set-ClientServerRoute {
|
|
param(
|
|
[Parameter(Mandatory)]$SelectedInterface,
|
|
[Parameter(Mandatory)][ipaddress]$DomainControllerAddress
|
|
)
|
|
$current = @(Find-NetRoute -RemoteIPAddress $DomainControllerAddress.IPAddressToString |
|
|
Where-Object { $_.PSObject.Properties['IPAddress'] })
|
|
if (@($current | Where-Object InterfaceIndex -eq $SelectedInterface.InterfaceIndex).Count -gt 0) { return }
|
|
|
|
# Only pin this server when Windows currently chooses a different interface.
|
|
# Do not replace default routes or change interface metrics used by Internet traffic.
|
|
$route = New-NetRoute -DestinationPrefix "$DomainControllerAddress/32" `
|
|
-InterfaceIndex $SelectedInterface.InterfaceIndex -NextHop $SelectedInterface.NextHop `
|
|
-RouteMetric 1
|
|
$current = @(Find-NetRoute -RemoteIPAddress $DomainControllerAddress.IPAddressToString |
|
|
Where-Object { $_.PSObject.Properties['IPAddress'] })
|
|
if (@($current | Where-Object InterfaceIndex -eq $SelectedInterface.InterfaceIndex).Count -eq 0) {
|
|
$route | Remove-NetRoute -Confirm:$false
|
|
throw "Windows still routes $DomainControllerAddress through another interface. Resolve conflicting host routes or VPN policies and retry."
|
|
}
|
|
}
|
|
|
|
function Set-ClientDomainDns {
|
|
param(
|
|
[Parameter(Mandatory)][string]$DnsDomain,
|
|
[Parameter(Mandatory)][ipaddress]$ServerAddress
|
|
)
|
|
$displayName = "SGU domain DNS - $DnsDomain"
|
|
$existing = @(Get-DnsClientNrptRule -ErrorAction Stop | Where-Object DisplayName -eq $displayName)
|
|
if ($existing.Count -eq 1 -and @($existing[0].NameServers) -contains $ServerAddress.IPAddressToString -and
|
|
@($existing[0].Namespace) -contains ".$DnsDomain" -and @($existing[0].Namespace) -contains $DnsDomain) { return }
|
|
$existing | Remove-DnsClientNrptRule -Force
|
|
Add-DnsClientNrptRule -Namespace @($DnsDomain, ".$DnsDomain") `
|
|
-NameServers $ServerAddress.IPAddressToString -DisplayName $displayName | Out-Null
|
|
Clear-DnsClientCache
|
|
}
|
|
|
|
function Assert-ClientOperatingSystem {
|
|
param(
|
|
[Parameter(Mandatory)]$OperatingSystem,
|
|
[Parameter(Mandatory)][string]$Edition,
|
|
[Parameter(Mandatory)][string]$Architecture
|
|
)
|
|
if ([int]$OperatingSystem.ProductType -ne 1) {
|
|
throw 'The client bootstrap supports Windows 10/11 workstations. Use the server bootstrap on Windows Server.'
|
|
}
|
|
if ([int]$OperatingSystem.BuildNumber -lt 14393 -or $Architecture -ne 'AMD64') {
|
|
throw 'This package requires Windows 10 1607 or later, or Windows 11, running x64 Windows PowerShell.'
|
|
}
|
|
if ($Edition -match '^Core' -or $Edition -match 'Home') {
|
|
throw "Windows edition '$Edition' cannot join an Active Directory domain. Upgrade to Pro, Enterprise, or Education, then run this same bootstrap again."
|
|
}
|
|
}
|
|
|
|
function Wait-TcpPort {
|
|
param(
|
|
[Parameter(Mandatory)][ipaddress]$Address,
|
|
[Parameter(Mandatory)][int]$Port,
|
|
[int]$TimeoutSeconds = 20
|
|
)
|
|
|
|
$deadline = (Get-Date).AddSeconds($TimeoutSeconds)
|
|
do {
|
|
if (Test-TcpPort -Address $Address -Port $Port -TimeoutMilliseconds 2000) {
|
|
return $true
|
|
}
|
|
Start-Sleep -Milliseconds 750
|
|
} while ((Get-Date) -lt $deadline)
|
|
return $false
|
|
}
|
|
|
|
function Connect-SguAzureP2s {
|
|
param([Parameter(Mandatory)][string]$ConnectionName)
|
|
|
|
$connection = Get-VpnConnection -Name $ConnectionName -AllUserConnection `
|
|
-ErrorAction SilentlyContinue
|
|
if (-not $connection) {
|
|
throw "The all-user VPN connection '$ConnectionName' is not installed. Run Install-SguAzureP2sClient.ps1 in this VM first."
|
|
}
|
|
if ($connection.TunnelType -notcontains 'Ikev2' -and $connection.TunnelType -ne 'Ikev2') {
|
|
throw "The VPN connection '$ConnectionName' is not configured for IKEv2."
|
|
}
|
|
if ($connection.ConnectionStatus -ne 'Connected') {
|
|
& "$env:SystemRoot\System32\rasdial.exe" $ConnectionName
|
|
if ($LASTEXITCODE -ne 0) {
|
|
throw "Could not connect the Azure P2S profile '$ConnectionName'. Verify the machine certificate and that UDP 500/4500 is permitted by the local network."
|
|
}
|
|
}
|
|
$connection = Get-VpnConnection -Name $ConnectionName -AllUserConnection
|
|
if ($connection.ConnectionStatus -ne 'Connected') {
|
|
throw "The Azure P2S profile '$ConnectionName' did not reach Connected state."
|
|
}
|
|
return $connection
|
|
}
|
|
|
|
Assert-Administrator
|
|
$operatingSystem = Get-CimInstance Win32_OperatingSystem
|
|
$edition = (Get-WindowsEdition -Online).Edition
|
|
Assert-ClientOperatingSystem -OperatingSystem $operatingSystem -Edition $edition `
|
|
-Architecture $env:PROCESSOR_ARCHITECTURE
|
|
$windowsBuild = [int]$operatingSystem.BuildNumber
|
|
$windowsName = if ($windowsBuild -ge 22000) { 'Windows 11' } else { 'Windows 10' }
|
|
Write-Host "$windowsName (build $windowsBuild): unified SGU enrollment."
|
|
|
|
if (-not $DomainControllerIPv4Address) {
|
|
$DomainControllerIPv4Address = [ipaddress](Read-Host 'Fixed IPv4 address of the SGU domain controller')
|
|
}
|
|
if ($DomainControllerIPv4Address.AddressFamily -ne [Net.Sockets.AddressFamily]::InterNetwork -or
|
|
$DomainControllerIPv4Address.IPAddressToString -match '^(0\.|127\.|169\.254\.|22[4-9]\.|23\d\.|24\d\.|25[0-5]\.)') {
|
|
throw 'Enter a reachable unicast IPv4 address for the domain controller.'
|
|
}
|
|
|
|
$packageRoot = $PSScriptRoot
|
|
$packageManifest = Assert-PackageManifest -PackageRoot $packageRoot
|
|
# Retain the old parameter for existing automation; neither name restricts networking.
|
|
if ($CompatibilityProfile -ne 'Auto') {
|
|
Write-Warning 'CompatibilityProfile is deprecated. This package uses the same implementation on Windows 10 and 11.'
|
|
}
|
|
$CompatibilityProfile = 'Auto'
|
|
$scriptsRoot = Join-Path $packageRoot 'payload\scripts'
|
|
$providerPublishPath = Join-Path $packageRoot 'payload\credential-provider'
|
|
$runtimeInstaller = Get-ChildItem (Join-Path $packageRoot 'payload\prerequisites') `
|
|
-Filter '*x64*.exe' -File -ErrorAction SilentlyContinue |
|
|
Sort-Object Name -Descending |
|
|
Select-Object -First 1
|
|
foreach ($requiredPath in @(
|
|
(Join-Path $scriptsRoot 'Enroll-SguDomainClient.ps1'),
|
|
(Join-Path $scriptsRoot 'Install-SguRustDeskClient.ps1'),
|
|
(Join-Path $scriptsRoot 'Register-SguClientCertificate.ps1'),
|
|
(Join-Path $providerPublishPath 'SGU.CredentialProvider.comhost.dll'))) {
|
|
if (-not (Test-Path -LiteralPath $requiredPath -PathType Leaf)) {
|
|
throw "The client bootstrap package is incomplete: $requiredPath"
|
|
}
|
|
}
|
|
if (-not $runtimeInstaller) {
|
|
throw 'The offline Microsoft .NET 10 x64 runtime installer is missing from the client package.'
|
|
}
|
|
if (-not $PSCmdlet.ShouldProcess($env:COMPUTERNAME, "Enroll with SGU server $DomainControllerIPv4Address")) { return }
|
|
if ($ClientIPv4Address) {
|
|
if (-not $NetworkInterfaceAlias -or $ConnectivityMode -eq 'AzureP2S') {
|
|
throw 'Explicit static IP setup requires -NetworkInterfaceAlias with Direct connectivity. Omit -ClientIPv4Address to preserve the current LAN/VPN configuration.'
|
|
}
|
|
$ClientIPv4Address = Set-ClientDomainAddress -InterfaceAlias $NetworkInterfaceAlias `
|
|
-DomainControllerAddress $DomainControllerIPv4Address `
|
|
-RequestedAddress $ClientIPv4Address -PrefixLength $ClientPrefixLength
|
|
}
|
|
|
|
if ($ConnectivityMode -eq 'AzureP2S') {
|
|
$existingVpnConnection = Get-VpnConnection -Name $VpnConnectionName -AllUserConnection `
|
|
-ErrorAction SilentlyContinue
|
|
if (-not $existingVpnConnection) {
|
|
$installerPath = Join-Path $packageRoot 'Install-SguAzureP2sClient.ps1'
|
|
if (-not (Test-Path -LiteralPath $installerPath -PathType Leaf)) {
|
|
throw 'Install-SguAzureP2sClient.ps1 is missing from the client bootstrap package.'
|
|
}
|
|
foreach ($vpnInput in @(
|
|
@{ Name = 'VpnProfilePackagePath'; Value = $VpnProfilePackagePath },
|
|
@{ Name = 'VpnClientCertificatePfxPath'; Value = $VpnClientCertificatePfxPath },
|
|
@{ Name = 'VpnClientRootCertificatePath'; Value = $VpnClientRootCertificatePath })) {
|
|
if ([string]::IsNullOrWhiteSpace([string]$vpnInput.Value)) {
|
|
throw "$($vpnInput.Name) is required the first time an Azure P2S client is enrolled."
|
|
}
|
|
}
|
|
$vpnInstallParameters = @{
|
|
VpnProfilePackagePath = $VpnProfilePackagePath
|
|
ClientCertificatePfxPath = $VpnClientCertificatePfxPath
|
|
ClientRootCertificatePath = $VpnClientRootCertificatePath
|
|
ConnectionName = $VpnConnectionName
|
|
AzureNetworkPrefixes = $AzureNetworkPrefixes
|
|
DomainControllerIPv4Address = $DomainControllerIPv4Address
|
|
DomainName = $DomainName
|
|
}
|
|
if ($VpnClientCertificatePfxPassword) {
|
|
$vpnInstallParameters.ClientCertificatePfxPassword = $VpnClientCertificatePfxPassword
|
|
}
|
|
& $installerPath @vpnInstallParameters | Out-Null
|
|
}
|
|
$vpnConnection = Connect-SguAzureP2s -ConnectionName $VpnConnectionName
|
|
}
|
|
$selectedInterface = Wait-ClientInterface -RequestedAlias $NetworkInterfaceAlias `
|
|
-DomainControllerAddress $DomainControllerIPv4Address
|
|
$NetworkInterfaceAlias = $selectedInterface.InterfaceAlias
|
|
$ClientIPv4Address = [ipaddress]$selectedInterface.IPAddress
|
|
Set-ClientServerRoute -SelectedInterface $selectedInterface -DomainControllerAddress $DomainControllerIPv4Address
|
|
Write-Host "Using $NetworkInterfaceAlias ($ClientIPv4Address)."
|
|
|
|
if (-not (Wait-TcpPort -Address $DomainControllerIPv4Address -Port 5985 -TimeoutSeconds 20)) {
|
|
throw "The domain controller at $DomainControllerIPv4Address did not accept WinRM on TCP 5985 after 20 seconds. Run the server bootstrap first and verify the selected IP."
|
|
}
|
|
|
|
if (-not $DomainCredential) {
|
|
$suggestedUser = if ($DomainNetbios) { "$DomainNetbios\Administrator" }
|
|
elseif ($DomainName) { "Administrator@$DomainName" } else { 'Administrator' }
|
|
$DomainCredential = Get-Credential `
|
|
-UserName $suggestedUser `
|
|
-Message "Domain account permitted to enroll this computer (DOMAIN\user or user@domain)"
|
|
}
|
|
if (-not $DomainCredential) { throw 'Enrollment cancelled: no domain credential was provided.' }
|
|
|
|
New-Item -ItemType Directory -Path $temporaryRoot -Force | Out-Null
|
|
$clientCertificatePath = Join-Path $temporaryRoot 'client.cer'
|
|
$serverCertificatePath = Join-Path $temporaryRoot 'server.cer'
|
|
$remoteRegistrationScript = $null
|
|
$remoteClientCertificate = $null
|
|
$session = $null
|
|
$winRmWasRunning = (Get-Service WinRM).Status -eq 'Running'
|
|
$priorTrustedHosts = $null
|
|
|
|
try {
|
|
if (-not $winRmWasRunning) {
|
|
Set-Service WinRM -StartupType Manual
|
|
Start-Service WinRM
|
|
}
|
|
$priorTrustedHosts = [string](Get-Item WSMan:\localhost\Client\TrustedHosts).Value
|
|
$trustedHostValues = @($priorTrustedHosts -split ',' | ForEach-Object Trim | Where-Object { $_ })
|
|
if ($trustedHostValues -notcontains $DomainControllerIPv4Address.IPAddressToString) {
|
|
$trustedHostValues += $DomainControllerIPv4Address.IPAddressToString
|
|
Set-Item WSMan:\localhost\Client\TrustedHosts -Value ($trustedHostValues -join ',') -Force
|
|
}
|
|
|
|
$session = New-PSSession `
|
|
-ComputerName $DomainControllerIPv4Address.IPAddressToString `
|
|
-Credential $DomainCredential `
|
|
-Authentication Negotiate
|
|
|
|
$serverIdentity = Invoke-Command -Session $session -ScriptBlock {
|
|
$computer = Get-CimInstance Win32_ComputerSystem
|
|
if ([int]$computer.DomainRole -lt 4) { throw 'The supplied server is not an Active Directory domain controller.' }
|
|
Import-Module ActiveDirectory -ErrorAction Stop
|
|
$domain = Get-ADDomain -ErrorAction Stop
|
|
$labOu = Get-ADOrganizationalUnit -LDAPFilter '(ou=Laboratorio)' `
|
|
-SearchBase $domain.DistinguishedName -SearchScope OneLevel -ErrorAction Stop |
|
|
Select-Object -First 1
|
|
$brokerService = Get-Service SGUAuthBroker -ErrorAction SilentlyContinue
|
|
$rustDeskStatusPath = Join-Path $env:ProgramData 'SGU\RustDesk\server.json'
|
|
$rustDeskStatus = if (Test-Path -LiteralPath $rustDeskStatusPath -PathType Leaf) {
|
|
Get-Content -LiteralPath $rustDeskStatusPath -Raw | ConvertFrom-Json
|
|
}
|
|
else {
|
|
$null
|
|
}
|
|
$hbbsTask = Get-ScheduledTask -TaskName 'SGU-RustDesk-hbbs' -ErrorAction SilentlyContinue
|
|
$hbbrTask = Get-ScheduledTask -TaskName 'SGU-RustDesk-hbbr' -ErrorAction SilentlyContinue
|
|
[pscustomobject]@{
|
|
ComputerName = $env:COMPUTERNAME
|
|
Domain = $computer.Domain
|
|
DomainNetbios = $domain.NetBIOSName
|
|
ComputerContainer = if ($labOu) { $labOu.DistinguishedName } else { $domain.ComputersContainer }
|
|
BrokerService = if ($brokerService) { $brokerService.Status.ToString() } else { 'Missing' }
|
|
RustDeskServerAddress = if ($rustDeskStatus) { [string]$rustDeskStatus.ServerAddress } else { $null }
|
|
RustDeskPublicKey = if ($rustDeskStatus) { [string]$rustDeskStatus.PublicKey } else { $null }
|
|
RustDeskHbbsTask = if ($hbbsTask) { $hbbsTask.State.ToString() } else { 'Missing' }
|
|
RustDeskHbbrTask = if ($hbbrTask) { $hbbrTask.State.ToString() } else { 'Missing' }
|
|
}
|
|
}
|
|
if (-not $serverIdentity.Domain -or ($DomainName -and
|
|
-not $serverIdentity.Domain.Equals($DomainName, [StringComparison]::OrdinalIgnoreCase))) {
|
|
throw "The server at $DomainControllerIPv4Address belongs to $($serverIdentity.Domain), not $DomainName."
|
|
}
|
|
if ($DomainNetbios -and $DomainNetbios -ne $serverIdentity.DomainNetbios) {
|
|
throw "The supplied NetBIOS domain '$DomainNetbios' does not match '$($serverIdentity.DomainNetbios)'."
|
|
}
|
|
$DomainName = [string]$serverIdentity.Domain
|
|
$DomainNetbios = [string]$serverIdentity.DomainNetbios
|
|
if (-not $ComputerOuDn) { $ComputerOuDn = [string]$serverIdentity.ComputerContainer }
|
|
$brokerDnsName = "$brokerRecordName.$DomainName"
|
|
$brokerEndpoint = "https://${brokerDnsName}:8443/v1/authenticate"
|
|
Write-Host "Discovered domain: $DomainName ($DomainNetbios). Computer container: $ComputerOuDn"
|
|
if ($serverIdentity.BrokerService -ne 'Running') {
|
|
throw "The SGU Authentication Broker is not running on $($serverIdentity.ComputerName)."
|
|
}
|
|
if ([string]::IsNullOrWhiteSpace($serverIdentity.RustDeskServerAddress) -or
|
|
[string]::IsNullOrWhiteSpace($serverIdentity.RustDeskPublicKey) -or
|
|
$serverIdentity.RustDeskHbbsTask -ne 'Running' -or
|
|
$serverIdentity.RustDeskHbbrTask -ne 'Running') {
|
|
throw "The RustDesk server is not ready on $($serverIdentity.ComputerName). Run the current server bootstrap first."
|
|
}
|
|
Set-ClientDomainDns -DnsDomain $DomainName -ServerAddress $DomainControllerIPv4Address
|
|
foreach ($port in @(53, 88, 135, 389, 445, 8443)) {
|
|
if (-not (Test-TcpPort -Address $DomainControllerIPv4Address -Port $port -TimeoutMilliseconds 2000)) {
|
|
throw "Server $DomainControllerIPv4Address is reachable, but required TCP port $port is unavailable. Check AD/SGU services and the LAN/VPN firewall. Domain join has not started."
|
|
}
|
|
}
|
|
|
|
$certificateSubject = "CN=SGU Credential Provider Client $env:COMPUTERNAME"
|
|
$clientCertificate = Get-ChildItem Cert:\LocalMachine\My |
|
|
Where-Object {
|
|
$_.Subject -eq $certificateSubject -and
|
|
$_.HasPrivateKey -and
|
|
$_.NotAfter -gt (Get-Date).AddDays(30)
|
|
} |
|
|
Sort-Object NotAfter -Descending |
|
|
Select-Object -First 1
|
|
if (-not $clientCertificate) {
|
|
$clientCertificate = New-SelfSignedCertificate `
|
|
-Subject $certificateSubject `
|
|
-CertStoreLocation Cert:\LocalMachine\My `
|
|
-KeyAlgorithm RSA `
|
|
-KeyLength 3072 `
|
|
-HashAlgorithm SHA256 `
|
|
-KeyExportPolicy NonExportable `
|
|
-NotAfter (Get-Date).AddYears(2) `
|
|
-TextExtension @('2.5.29.37={text}1.3.6.1.5.5.7.3.2')
|
|
}
|
|
Export-Certificate -Cert $clientCertificate -FilePath $clientCertificatePath -Force | Out-Null
|
|
if (-not (Get-ChildItem Cert:\LocalMachine\Root | Where-Object Thumbprint -eq $clientCertificate.Thumbprint)) {
|
|
Import-Certificate -FilePath $clientCertificatePath `
|
|
-CertStoreLocation Cert:\LocalMachine\Root | Out-Null
|
|
}
|
|
|
|
$remoteTemporaryRoot = Invoke-Command -Session $session -ScriptBlock {
|
|
$path = Join-Path $env:ProgramData ("SGU\Enrollment\Incoming-" + [Guid]::NewGuid().ToString('N'))
|
|
New-Item -ItemType Directory -Path $path -Force | Out-Null
|
|
$path
|
|
}
|
|
$remoteRegistrationScript = Join-Path $remoteTemporaryRoot 'Register-SguClientCertificate.ps1'
|
|
$remoteClientCertificate = Join-Path $remoteTemporaryRoot 'client.cer'
|
|
Copy-Item -LiteralPath (Join-Path $scriptsRoot 'Register-SguClientCertificate.ps1') `
|
|
-Destination $remoteRegistrationScript -ToSession $session
|
|
Copy-Item -LiteralPath $clientCertificatePath `
|
|
-Destination $remoteClientCertificate -ToSession $session
|
|
|
|
Invoke-Command -Session $session -ScriptBlock {
|
|
param($RegistrationScript, $CertificatePath)
|
|
& $RegistrationScript -CertificatePath $CertificatePath | Out-Null
|
|
} -ArgumentList $remoteRegistrationScript,$remoteClientCertificate
|
|
|
|
$serverCertificateBase64 = Invoke-Command -Session $session -ScriptBlock {
|
|
param($ExpectedSubject)
|
|
$certificate = Get-ChildItem Cert:\LocalMachine\My |
|
|
Where-Object {
|
|
$_.Subject -eq "CN=$ExpectedSubject" -and
|
|
$_.HasPrivateKey -and
|
|
$_.NotAfter -gt (Get-Date)
|
|
} |
|
|
Sort-Object NotAfter -Descending |
|
|
Select-Object -First 1
|
|
if (-not $certificate) {
|
|
throw "The broker certificate for $ExpectedSubject is missing."
|
|
}
|
|
[Convert]::ToBase64String($certificate.RawData)
|
|
} -ArgumentList $brokerDnsName
|
|
[IO.File]::WriteAllBytes($serverCertificatePath, [Convert]::FromBase64String($serverCertificateBase64))
|
|
$serverCertificate = [Security.Cryptography.X509Certificates.X509Certificate2]::new($serverCertificatePath)
|
|
Import-Certificate -FilePath $serverCertificatePath `
|
|
-CertStoreLocation Cert:\LocalMachine\Root | Out-Null
|
|
|
|
Resolve-DnsName -Type SRV "_ldap._tcp.dc._msdcs.$DomainName" -ErrorAction Stop | Out-Null
|
|
$brokerAddress = Resolve-DnsName -Name $brokerDnsName -Type A -ErrorAction Stop |
|
|
Where-Object IPAddress -eq $DomainControllerIPv4Address.IPAddressToString
|
|
if (-not $brokerAddress) {
|
|
throw "$brokerDnsName does not resolve to $DomainControllerIPv4Address."
|
|
}
|
|
|
|
$enrollmentParameters = @{
|
|
PublishPath = $providerPublishPath
|
|
BrokerEndpoint = $brokerEndpoint
|
|
ClientCertificateThumbprint = $clientCertificate.Thumbprint
|
|
ServerCertificateThumbprint = $serverCertificate.Thumbprint
|
|
DomainCredential = $DomainCredential
|
|
DomainName = $DomainName
|
|
DomainNetbios = $DomainNetbios
|
|
ComputerOuDn = $ComputerOuDn
|
|
NetworkInterfaceAlias = $NetworkInterfaceAlias
|
|
DomainDnsServerAddresses = @($DomainControllerIPv4Address.IPAddressToString)
|
|
DomainDnsConfigured = $true
|
|
ConnectivityMode = $ConnectivityMode
|
|
RemoteDesktopPrincipal = "$DomainNetbios\SG-Laboratorio-Usuarios-RDP"
|
|
DotNetRuntimeInstallerPath = $runtimeInstaller.FullName
|
|
RustDeskServerAddress = $serverIdentity.RustDeskServerAddress
|
|
RustDeskServerPublicKey = $serverIdentity.RustDeskPublicKey
|
|
SkipRestart = $true
|
|
}
|
|
if ($NewComputerName) {
|
|
$enrollmentParameters.NewComputerName = $NewComputerName
|
|
}
|
|
|
|
$result = & (Join-Path $scriptsRoot 'Enroll-SguDomainClient.ps1') @enrollmentParameters
|
|
|
|
$rustDeskEnrollment = $result.RustDesk
|
|
if (-not $rustDeskEnrollment -or -not $rustDeskEnrollment.RustDeskId -or
|
|
-not $rustDeskEnrollment.AccessPassword) {
|
|
throw 'The client RustDesk enrollment did not provide an ID and protected access credential.'
|
|
}
|
|
$rustDeskPasswordPointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR(
|
|
$rustDeskEnrollment.AccessPassword)
|
|
try {
|
|
$rustDeskPassword = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($rustDeskPasswordPointer)
|
|
Invoke-Command -Session $session -ScriptBlock {
|
|
param($ComputerName, $RustDeskId, $AccessPassword)
|
|
$registrationScript = Join-Path $env:ProgramData 'SGU\RustDesk\Register-SguRustDeskDevice.ps1'
|
|
if (-not (Test-Path -LiteralPath $registrationScript -PathType Leaf)) {
|
|
throw 'The RustDesk device-registration script is missing on the domain controller.'
|
|
}
|
|
& $registrationScript -ComputerName $ComputerName -RustDeskId $RustDeskId `
|
|
-AccessPassword $AccessPassword | Out-Null
|
|
} -ArgumentList $env:COMPUTERNAME,$rustDeskEnrollment.RustDeskId,$rustDeskPassword
|
|
}
|
|
finally {
|
|
[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($rustDeskPasswordPointer)
|
|
$rustDeskPassword = $null
|
|
}
|
|
$rustDeskEnrollment.PSObject.Properties.Remove('AccessPassword')
|
|
}
|
|
finally {
|
|
if ($session) {
|
|
if ($remoteRegistrationScript -or $remoteClientCertificate) {
|
|
Invoke-Command -Session $session -ScriptBlock {
|
|
param($Paths)
|
|
foreach ($path in $Paths) {
|
|
if ($path) {
|
|
Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue
|
|
}
|
|
}
|
|
if ($Paths.Count -gt 0 -and $Paths[0]) {
|
|
Remove-Item -LiteralPath (Split-Path $Paths[0] -Parent) `
|
|
-Force -ErrorAction SilentlyContinue
|
|
}
|
|
} -ArgumentList (,@($remoteRegistrationScript,$remoteClientCertificate)) `
|
|
-ErrorAction SilentlyContinue
|
|
}
|
|
Remove-PSSession $session
|
|
}
|
|
if ($null -ne $priorTrustedHosts) {
|
|
Set-Item WSMan:\localhost\Client\TrustedHosts -Value $priorTrustedHosts -Force
|
|
}
|
|
if (-not $winRmWasRunning) {
|
|
Stop-Service WinRM -Force -NoWait -WarningAction SilentlyContinue `
|
|
-ErrorAction SilentlyContinue
|
|
}
|
|
Remove-Item -LiteralPath $temporaryRoot -Recurse -Force -ErrorAction SilentlyContinue
|
|
$DomainCredential = $null
|
|
$VpnClientCertificatePfxPassword = $null
|
|
}
|
|
|
|
if ($SkipRestart) {
|
|
[pscustomobject]@{
|
|
ComputerName = if ($NewComputerName) { $NewComputerName } else { $env:COMPUTERNAME }
|
|
DomainName = $DomainName
|
|
ProviderInstalled = $true
|
|
ClientCertificateRegistered = $true
|
|
BrokerEndpoint = $brokerEndpoint
|
|
ConnectivityMode = $ConnectivityMode
|
|
CompatibilityProfile = $CompatibilityProfile
|
|
VpnConnectionName = if ($ConnectivityMode -eq 'AzureP2S') { $VpnConnectionName } else { $null }
|
|
RestartRequired = $true
|
|
RustDesk = if ($result) { $result.RustDesk } else { $null }
|
|
EnrollmentResult = $result
|
|
}
|
|
return
|
|
}
|
|
|
|
Restart-Computer -Force
|