added folders and scripts
This commit is contained in:
Gramzon
@@ -0,0 +1,72 @@
|
||||
#install active directory.
|
||||
# THIS SCRIPT MUST BE RUN AS ADMINISTRATOR ON DC1
|
||||
|
||||
#language, time and timezone settings:
|
||||
# Se hvilke språkpakker (capabilities) som er tilgjengelige og evt. installert:
|
||||
Get-WindowsCapability -Online -Name Language* |
|
||||
Where-Object { $_.Name -like '*nb-NO*' } |
|
||||
Format-Table -Autosize
|
||||
|
||||
# Installer Bokmål grunnpakke:
|
||||
Add-WindowsCapability -Online -Name Language.Basic~~~nb-NO~0.0.1.0
|
||||
|
||||
# (Valgfritt) Installer OCR / TextToSpeech / Handwriting / Speech om ønskelig:
|
||||
# Add-WindowsCapability -Online -Name Language.OCR~~~nb-NO~0.0.1.0
|
||||
# Add-WindowsCapability -Online -Name Language.TextToSpeech~~~nb-NO~0.0.1.0
|
||||
# Add-WindowsCapability -Online -Name Language.Handwriting~~~nb-NO~0.0.1.0
|
||||
# Add-WindowsCapability -Online -Name Language.Speech~~~nb-NO~0.0.1.0
|
||||
|
||||
|
||||
|
||||
<# Checklist:
|
||||
- Windows Update is up to date
|
||||
- Time zone is correct
|
||||
- Computer name is correct
|
||||
- IP address is correct (non relevant for this lab)
|
||||
- Keyboard layout is correct (Norwegian)
|
||||
#>
|
||||
|
||||
# variable containing the computer name
|
||||
$env:DC1
|
||||
# If you want to change the computer name, you can use the Rename-Computer cmdlet
|
||||
# $newcompname = Read-host "Skriv inn ønsket hostname på maskinen"
|
||||
# Rename-Computer -Newname $newcompname -Restart -Force
|
||||
|
||||
# Check what features are installed
|
||||
Get-WindowsFeature | Where-Object {$_. installstate -eq "installed"}
|
||||
|
||||
|
||||
# Install Active Directory Domain Services (AD DS)
|
||||
# Needs to be run as Administrator
|
||||
Install-WindowsFeature AD-Domain-Services, DNS -IncludeManagementTools
|
||||
$Password = Read-Host -Prompt 'Enter Password' -AsSecureString
|
||||
Set-LocalUser -Password $Password Administrator
|
||||
|
||||
$Params = @{
|
||||
DomainMode = 'WinThreshold'
|
||||
DomainName = 'RohanIT.sec'
|
||||
DomainNetbiosName = 'RohanIT'
|
||||
ForestMode = 'WinThreshold'
|
||||
InstallDns = $true
|
||||
NoRebootOnCompletion = $true
|
||||
SafeModeAdministratorPassword = $Password
|
||||
Force = $true
|
||||
}
|
||||
|
||||
# Install AD DS with the parameters defined above
|
||||
Install-ADDSForest @Params
|
||||
Restart-Computer
|
||||
# Log in as Administrator@YourDomanName.whatever with password from above
|
||||
# Test our domain
|
||||
Get-ADRootDSE
|
||||
# The Get-ADRootDSE cmdlet gets the object that represents the root of the directory information tree of a directory server.
|
||||
# This tree provides information about the configuration and capabilities of the directory server,
|
||||
# such as the distinguished name for the configuration container, the current time on the directory server,
|
||||
# and the functional levels of the directory server and the domain.
|
||||
#
|
||||
Get-ADForest
|
||||
# The Get-ADForest cmdlet gets the Active Directory forest specified by the parameters.
|
||||
Get-ADDomain
|
||||
# The Get-ADDomain cmdlet gets the Active Directory domain specified by the parameters.
|
||||
# Any computers joined the domain?
|
||||
Get-ADComputer -Filter * | Select-Object DNSHostName
|
||||
@@ -0,0 +1,27 @@
|
||||
# THIS SCRIPT MUST BE RUN AS ADMINISTRATOR ON SRV1, CLI1 and MGR
|
||||
<# CHECKLIST:
|
||||
- Windows Update is up to date
|
||||
- Time zone is correct
|
||||
- Set-TimeZone -id 'W. Europe Standard Time'
|
||||
- Computer name is correct
|
||||
- IP address is correct (non relevant for this lab)
|
||||
- Keyboard layout is correct (Norwegian)
|
||||
#>
|
||||
|
||||
# VM's for the lab needs DC1 IP-address as DNS server (must be done on VM's: SRV1, CLI1 and MGR)
|
||||
# Why? Because the DNS server is the only one that knows about the domain
|
||||
$ipaddressdc1 = "192.168.x.x" # IP-address of DC1
|
||||
Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses $ipaddressdc1
|
||||
|
||||
# Check if configuration is correct
|
||||
# Find DNS Servers . . . . . . . . . . . : IP.ADR.TIL.DC (192.168.x.x)
|
||||
ipconfig /all
|
||||
|
||||
# Add the computer to the domain
|
||||
$domainName = "RohanIT.sec" # replace with your domain name (e.g. InfraIT.sec)
|
||||
|
||||
$cred = Get-Credential -UserName "Wormtongue@$domainName" -Message 'Provide credentials for a domain admin'
|
||||
Add-Computer -Credential $cred -DomainName $domainName -PassThru -Verbose
|
||||
Restart-Computer
|
||||
|
||||
# When restarted, the computer will be joinedto the domain, and you can log in with a domain admin or user account
|
||||
@@ -0,0 +1,26 @@
|
||||
################################################################################
|
||||
# MAKE SURE YOUR ARE LOGED IN AS A YOUR DOMAIN ADMIN USER - NOT ADMINISTRATOR :D
|
||||
################################################################################
|
||||
|
||||
|
||||
# Installere Choco
|
||||
# Hva er Choco: https://chocolatey.org/
|
||||
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
|
||||
choco upgrade chocolatey
|
||||
# Installere programvare med Choco
|
||||
choco install -y powershell-core
|
||||
choco install -y git.install
|
||||
choco install -y vscode
|
||||
#choco install -y sysinternals
|
||||
|
||||
# Konfigurer Git
|
||||
git config --global user.name "NAVN"
|
||||
git config --global user.email "EPOST@EPOST.EPOST"
|
||||
#
|
||||
|
||||
# Check if computer is domain joined (CIM (Common Information Model))
|
||||
Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object -Property Name, Domain, PartOfDomain
|
||||
|
||||
# Remote Server Administrative Tools (RSAT)
|
||||
# Installere RSAT - RSAT is a tool that allows you to manage roles and features in Windows Server remotely from a Windows 10/11 machine.
|
||||
Add-WindowsCapability -Name Rsat.ActiveDirectory.DS-LDS.Tools -Online
|
||||
@@ -0,0 +1,29 @@
|
||||
#configureVM
|
||||
|
||||
# THIS SCRIPT MUST BE RUN AS ADMINISTRATOR ON SRV1, CLI1 and MGR
|
||||
<# CHECKLIST:
|
||||
- Windows Update is up to date
|
||||
- Time zone is correct
|
||||
- Set-TimeZone -id 'W. Europe Standard Time'
|
||||
- Computer name is correct
|
||||
- IP address is correct (non relevant for this lab)
|
||||
- Keyboard layout is correct (Norwegian)
|
||||
#>
|
||||
|
||||
# VM's for the lab needs DC1 IP-address as DNS server (must be done on VM's: SRV1, CLI1 and MGR)
|
||||
# Why? Because the DNS server is the only one that knows about the domain
|
||||
$ipaddressdc1 = "192.168.111.193" # IP-address of DC1
|
||||
Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses $ipaddressdc1
|
||||
|
||||
# Check if configuration is correct
|
||||
# Find DNS Servers . . . . . . . . . . . : IP.ADR.TIL.DC (192.168.111.193)
|
||||
ipconfig /all
|
||||
|
||||
# Add the computer to the domain
|
||||
$domainName = "RohanIT.sec" # replace with your domain name (e.g. InfraIT.sec)
|
||||
|
||||
$cred = Get-Credential -UserName "Wormtongue@$domainName" -Message 'Provide credentials for a domain admin'
|
||||
Add-Computer -Credential $cred -DomainName $domainName -PassThru -Verbose
|
||||
Restart-Computer
|
||||
|
||||
# When restarted, the computer will be joinedto the domain, and you can log in with a domain admin or user account
|
||||
@@ -0,0 +1 @@
|
||||
New-NetFirewallRule -DisplayName "Allow HTTP port 443" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow -Profile Any
|
||||
@@ -0,0 +1,211 @@
|
||||
heat_template_version: 2013-05-23
|
||||
|
||||
description: >
|
||||
HOT template to create a new neutron network plus a router to the public
|
||||
network, and for deploying two Windows 11 (hostname cl1 and mgr) and two Windows
|
||||
Servers (hostnames dc1 and srv1) without any configuration (only cl1 has
|
||||
a boot script to set correct hostname).
|
||||
|
||||
parameters:
|
||||
key_name:
|
||||
type: string
|
||||
description: Name of keypair to assign to servers
|
||||
|
||||
resources:
|
||||
private_net:
|
||||
type: OS::Neutron::Net
|
||||
|
||||
private_subnet:
|
||||
type: OS::Neutron::Subnet
|
||||
properties:
|
||||
network_id: { get_resource: private_net }
|
||||
cidr: 192.168.111.0/24
|
||||
gateway_ip: 192.168.111.1
|
||||
allocation_pools:
|
||||
- start: 192.168.111.101
|
||||
end: 192.168.111.200
|
||||
|
||||
router:
|
||||
type: OS::Neutron::Router
|
||||
properties:
|
||||
external_gateway_info:
|
||||
network: ntnu-internal
|
||||
|
||||
router_interface:
|
||||
type: OS::Neutron::RouterInterface
|
||||
properties:
|
||||
router_id: { get_resource: router }
|
||||
subnet_id: { get_resource: private_subnet }
|
||||
|
||||
sec_core:
|
||||
type: OS::Neutron::SecurityGroup
|
||||
properties:
|
||||
description: Security group rules for all
|
||||
name: sec_core
|
||||
rules:
|
||||
- remote_ip_prefix: 0.0.0.0/0
|
||||
protocol: icmp
|
||||
- remote_ip_prefix: 0.0.0.0/0
|
||||
protocol: tcp
|
||||
port_range_min: 22
|
||||
port_range_max: 22
|
||||
- remote_ip_prefix: 0.0.0.0/0
|
||||
protocol: tcp
|
||||
port_range_min: 80
|
||||
port_range_max: 80
|
||||
- remote_ip_prefix: 0.0.0.0/0
|
||||
protocol: tcp
|
||||
port_range_min: 443
|
||||
port_range_max: 443
|
||||
- remote_ip_prefix: 0.0.0.0/0
|
||||
protocol: tcp
|
||||
port_range_min: 3389
|
||||
port_range_max: 3389
|
||||
|
||||
mgr:
|
||||
type: OS::Nova::Server
|
||||
properties:
|
||||
name: mgr
|
||||
image: 'Windows 11 22H2 Enterprise [Evaluation]'
|
||||
flavor: gx3.4c8r
|
||||
key_name: { get_param: key_name }
|
||||
networks:
|
||||
- port: { get_resource: mgr_port }
|
||||
user_data_format: RAW
|
||||
user_data: |
|
||||
#ps1_sysnative
|
||||
#
|
||||
# Windows 10 doesn't set hostname correctly
|
||||
#
|
||||
$name = (New-Object System.Net.WebClient).DownloadString("http://169.254.169.254/latest/meta-data/hostname")
|
||||
$shortname = $name.split('.',2)[0]
|
||||
if ( $env:computername -ne $shortname ) {
|
||||
Rename-Computer $shortname
|
||||
exit 1003 # 1003 - reboot and run the plugin again on next boot
|
||||
# https://cloudbase-init.readthedocs.io/en/latest/tutorial.html#file-execution
|
||||
}
|
||||
mgr_port:
|
||||
type: OS::Neutron::Port
|
||||
properties:
|
||||
network_id: { get_resource: private_net }
|
||||
security_groups:
|
||||
- default
|
||||
- { get_resource: sec_core }
|
||||
fixed_ips:
|
||||
- subnet_id: { get_resource: private_subnet }
|
||||
mgr_floating_ip:
|
||||
type: OS::Neutron::FloatingIP
|
||||
properties:
|
||||
floating_network: ntnu-internal
|
||||
port_id: { get_resource: mgr_port }
|
||||
|
||||
cl1:
|
||||
type: OS::Nova::Server
|
||||
properties:
|
||||
name: cl1
|
||||
image: 'Windows 11 22H2 Enterprise [Evaluation]'
|
||||
flavor: gx1.2c6r
|
||||
key_name: { get_param: key_name }
|
||||
networks:
|
||||
- port: { get_resource: cl1_port }
|
||||
user_data_format: RAW
|
||||
user_data: |
|
||||
#ps1_sysnative
|
||||
#
|
||||
# Windows 10 doesn't set hostname correctly
|
||||
#
|
||||
$name = (New-Object System.Net.WebClient).DownloadString("http://169.254.169.254/latest/meta-data/hostname")
|
||||
$shortname = $name.split('.',2)[0]
|
||||
if ( $env:computername -ne $shortname ) {
|
||||
Rename-Computer $shortname
|
||||
exit 1003 # 1003 - reboot and run the plugin again on next boot
|
||||
# https://cloudbase-init.readthedocs.io/en/latest/tutorial.html#file-execution
|
||||
}
|
||||
cl1_port:
|
||||
type: OS::Neutron::Port
|
||||
properties:
|
||||
network_id: { get_resource: private_net }
|
||||
security_groups:
|
||||
- default
|
||||
- { get_resource: sec_core }
|
||||
fixed_ips:
|
||||
- subnet_id: { get_resource: private_subnet }
|
||||
cl1_floating_ip:
|
||||
type: OS::Neutron::FloatingIP
|
||||
properties:
|
||||
floating_network: ntnu-internal
|
||||
port_id: { get_resource: cl1_port }
|
||||
|
||||
dc1:
|
||||
type: OS::Nova::Server
|
||||
properties:
|
||||
name: dc1
|
||||
image: 'Windows Server 2025 Standard [Evaluation]'
|
||||
flavor: gx1.2c6r
|
||||
key_name: { get_param: key_name }
|
||||
networks:
|
||||
- port: { get_resource: dc1_port }
|
||||
dc1_port:
|
||||
type: OS::Neutron::Port
|
||||
properties:
|
||||
network_id: { get_resource: private_net }
|
||||
security_groups:
|
||||
- default
|
||||
- { get_resource: sec_core }
|
||||
fixed_ips:
|
||||
- subnet_id: { get_resource: private_subnet }
|
||||
dc1_floating_ip:
|
||||
type: OS::Neutron::FloatingIP
|
||||
properties:
|
||||
floating_network: ntnu-internal
|
||||
port_id: { get_resource: dc1_port }
|
||||
|
||||
srv1:
|
||||
type: OS::Nova::Server
|
||||
properties:
|
||||
name: srv1
|
||||
image: 'Windows Server 2025 Standard [Evaluation]'
|
||||
flavor: gx1.2c4r
|
||||
key_name: { get_param: key_name }
|
||||
networks:
|
||||
- port: { get_resource: srv1_port }
|
||||
srv1_port:
|
||||
type: OS::Neutron::Port
|
||||
properties:
|
||||
network_id: { get_resource: private_net }
|
||||
security_groups:
|
||||
- default
|
||||
- { get_resource: sec_core }
|
||||
fixed_ips:
|
||||
- subnet_id: { get_resource: private_subnet }
|
||||
srv1_floating_ip:
|
||||
type: OS::Neutron::FloatingIP
|
||||
properties:
|
||||
floating_network: ntnu-internal
|
||||
port_id: { get_resource: srv1_port }
|
||||
|
||||
outputs:
|
||||
srv1_private_ip:
|
||||
description: IP address of srv1 in private network
|
||||
value: { get_attr: [ srv1, first_address ] }
|
||||
srv1_public_ip:
|
||||
description: Floating IP address of srv1 in public network
|
||||
value: { get_attr: [ srv1_floating_ip, floating_ip_address ] }
|
||||
dc1_private_ip:
|
||||
description: IP address of dc1 in private network
|
||||
value: { get_attr: [ dc1, first_address ] }
|
||||
dc1_public_ip:
|
||||
description: Floating IP address of dc1 in public network
|
||||
value: { get_attr: [ dc1_floating_ip, floating_ip_address ] }
|
||||
cl1_private_ip:
|
||||
description: IP address of cl1 in private network
|
||||
value: { get_attr: [ cl1, first_address ] }
|
||||
cl1_public_ip:
|
||||
description: Floating IP address of cl1 in public network
|
||||
value: { get_attr: [ cl1_floating_ip, floating_ip_address ] }
|
||||
mgr_private_ip:
|
||||
description: IP address of mgr in private network
|
||||
value: { get_attr: [ mgr, first_address ] }
|
||||
mgr_public_ip:
|
||||
description: Floating IP address of mgr in public network
|
||||
value: { get_attr: [ mgr_floating_ip, floating_ip_address ] }
|
||||
@@ -0,0 +1,21 @@
|
||||
# TEST PSREMOTE: Connect-PSRemoting -ComputerName FROM MGR TO WORKSTATIONS/SERVERS IN DOMAIN
|
||||
Enter-PSSession -ComputerName dc1
|
||||
Enter-PSSession -ComputerName srv1
|
||||
Enter-PSSession -ComputerName cl1
|
||||
|
||||
# Install PowerShell 7.x on remote machine.
|
||||
# Enable-PSRemoting -Force <- This command must be run as administrator on remote machine if PSRemote dont work.
|
||||
$session = New-PSSession -ComputerName dc1 -ConfigurationName PowerShell.7
|
||||
Copy-Item -Path "C:\install\PowerShell-7.4.0-win-x64.msi" -Destination "C:\install" -ToSession $session
|
||||
Invoke-Command -Session $session -ScriptBlock {
|
||||
Start-Process "msiexec.exe" -ArgumentList "/i C:\install\PowerShell-7.4.0-win-x64.msi /quiet /norestart" -Wait
|
||||
}
|
||||
Invoke-Command -Session $session -ScriptBlock { $PSVersionTable }
|
||||
|
||||
|
||||
# IF PSREMOTE DONT WORK, THIS COMMANDS MUST BE RUN AS ADMINISTRATOR ON VM'S WITH WINDOWS 10/11
|
||||
# Enable PSRemote: Enable-PSRemoting -Force
|
||||
Enable-PSRemoting -Force
|
||||
winrm set winrm/config/service/auth '@{Kerberos="true"}'
|
||||
# List auth:
|
||||
winrm get winrm/config/service/auth
|
||||
@@ -0,0 +1,30 @@
|
||||
#language, time and timezone settings:
|
||||
#language, time and timezone settings:
|
||||
# Se hvilke språkpakker (capabilities) som er tilgjengelige og evt. installert:
|
||||
Get-WindowsCapability -Online -Name Language* |
|
||||
Where-Object { $_.Name -like '*nb-NO*' } |
|
||||
Format-Table -Autosize
|
||||
|
||||
# Installer Bokmål grunnpakke:
|
||||
Add-WindowsCapability -Online -Name Language.Basic~~~nb-NO~0.0.1.0
|
||||
|
||||
# (Valgfritt) Installer OCR / TextToSpeech / Handwriting / Speech om ønskelig:
|
||||
# Add-WindowsCapability -Online -Name Language.OCR~~~nb-NO~0.0.1.0
|
||||
# Add-WindowsCapability -Online -Name Language.TextToSpeech~~~nb-NO~0.0.1.0
|
||||
# Add-WindowsCapability -Online -Name Language.Handwriting~~~nb-NO~0.0.1.0
|
||||
# Add-WindowsCapability -Online -Name Language.Speech~~~nb-NO~0.0.1.0
|
||||
|
||||
# Sett Windows sin brukerliste for språk
|
||||
# (NB: -Force hindrer bekreftelsesdialog):
|
||||
Set-WinUserLanguageList -LanguageList nb-NO -Force
|
||||
|
||||
# Sett system-lokale:
|
||||
Set-WinSystemLocale nb-NO
|
||||
|
||||
# Sett kultur (valutafomat, dato/klokkeslett osv.):
|
||||
Set-Culture nb-NO
|
||||
|
||||
# Sett standard grensesnittspråk for UI (f.eks. "Press any key to continue"):
|
||||
Set-WinUILanguageOverride nb-NO
|
||||
|
||||
|
||||
@@ -0,0 +1,27 @@
|
||||
# THIS SCRIPT MUST BE RUN AS ADMINISTRATOR ON DC1
|
||||
|
||||
# Define new user parameters
|
||||
$username = "Wormtongue" # Change this to the desired username
|
||||
$Password = Read-Host -Prompt 'Enter Password' -AsSecureString
|
||||
$userPrincipalName = $username + "Wormtongue@RohanIT.sec" # Change to your domain
|
||||
$displayName = "Wormtongue" # Change this to the desired display name
|
||||
$description = "SysAdm" # Change this to a suitable description
|
||||
$path = "CN=Users,DC=<RohanIT>,DC=<sec>" # Change the path to the appropriate path in your AD structure
|
||||
# My path in the video CN=Users,DC=InfraIT,DC=sec (CN stands for Common Name, and DC stands for Domain Component)
|
||||
# Users is a container in the root of the domain and not a OU (Organizational Unit)
|
||||
|
||||
# Create the new user
|
||||
New-ADUser -Name $displayName `
|
||||
-GivenName $username `
|
||||
-UserPrincipalName $userPrincipalName `
|
||||
-SamAccountName $username `
|
||||
-AccountPassword $password `
|
||||
-DisplayName $displayName `
|
||||
-Description $description `
|
||||
-Path $path `
|
||||
-Enabled $true
|
||||
|
||||
# Add the new user to the Domain Admins group
|
||||
Add-ADGroupMember -Identity "Domain Admins" -Members $username
|
||||
|
||||
Write-Host "User $username created and added to Domain Admins group."
|
||||
@@ -0,0 +1,30 @@
|
||||
# Ensure Winget is installed and updated
|
||||
if (-not (Get-Command winget -ErrorAction SilentlyContinue)) {
|
||||
Write-Output "Winget is not installed. Please install Winget from the Microsoft Store."
|
||||
exit
|
||||
}
|
||||
|
||||
# Update Winget to the latest version
|
||||
Write-Output "Updating Winget to the latest version..."
|
||||
winget upgrade --id Microsoft.Winget.Source --silent --accept-source-agreements
|
||||
|
||||
# List all installed drivers
|
||||
Write-Output "Listing all installed drivers..."
|
||||
$drivers = winget list | Where-Object { $_.Name -like "*Driver*" }
|
||||
|
||||
if ($drivers.Count -eq 0) {
|
||||
Write-Output "No drivers found that can be updated via Winget."
|
||||
exit
|
||||
}
|
||||
|
||||
# Update all drivers
|
||||
Write-Output "Updating all drivers..."
|
||||
foreach ($driver in $drivers) {
|
||||
Write-Output "Updating $($driver.Name)..."
|
||||
winget upgrade --id $driver.Id --silent --accept-package-agreements
|
||||
}
|
||||
|
||||
Write-Output "All drivers have been updated."
|
||||
|
||||
#install chocolatey
|
||||
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
|
||||
Reference in New Issue
Block a user