ADMF.psm1
|
$script:ModuleRoot = $PSScriptRoot $script:ModuleVersion = (Import-PowerShellDataFile -Path "$($script:ModuleRoot)\ADMF.psd1").ModuleVersion # Detect whether at some level dotsourcing was enforced $script:doDotSource = Get-PSFConfigValue -FullName ADMF.Import.DoDotSource -Fallback $false if ($ADMF_dotsourcemodule) { $script:doDotSource = $true } <# Note on Resolve-Path: All paths are sent through Resolve-Path/Resolve-PSFPath in order to convert them to the correct path separator. This allows ignoring path separators throughout the import sequence, which could otherwise cause trouble depending on OS. Resolve-Path can only be used for paths that already exist, Resolve-PSFPath can accept that the last leaf my not exist. This is important when testing for paths. #> # Detect whether at some level loading individual module files, rather than the compiled module was enforced $importIndividualFiles = Get-PSFConfigValue -FullName ADMF.Import.IndividualFiles -Fallback $false if ($ADMF_importIndividualFiles) { $importIndividualFiles = $true } if (Test-Path (Resolve-PSFPath -Path "$($script:ModuleRoot)\..\.git" -SingleItem -NewChild)) { $importIndividualFiles = $true } if ("<was compiled>" -eq '<was not compiled>') { $importIndividualFiles = $true } function Import-ModuleFile { <# .SYNOPSIS Loads files into the module on module import. .DESCRIPTION This helper function is used during module initialization. It should always be dotsourced itself, in order to proper function. This provides a central location to react to files being imported, if later desired .PARAMETER Path The path to the file to load .EXAMPLE PS C:\> . Import-ModuleFile -File $function.FullName Imports the file stored in $function according to import policy #> [CmdletBinding()] Param ( [string] $Path ) $resolvedPath = $ExecutionContext.SessionState.Path.GetResolvedPSPathFromPSPath($Path).ProviderPath if ($doDotSource) { . $resolvedPath } else { $ExecutionContext.InvokeCommand.InvokeScript($false, ([scriptblock]::Create([io.file]::ReadAllText($resolvedPath))), $null, $null) } } #region Load individual files if ($importIndividualFiles) { # Execute Preimport actions . Import-ModuleFile -Path "$ModuleRoot\internal\scripts\preimport.ps1" # Import all internal functions foreach ($function in (Get-ChildItem "$ModuleRoot\internal\functions" -Filter "*.ps1" -Recurse -ErrorAction Ignore)) { . Import-ModuleFile -Path $function.FullName } # Import all public functions foreach ($function in (Get-ChildItem "$ModuleRoot\functions" -Filter "*.ps1" -Recurse -ErrorAction Ignore)) { . Import-ModuleFile -Path $function.FullName } # Execute Postimport actions . Import-ModuleFile -Path "$ModuleRoot\internal\scripts\postimport.ps1" # End it here, do not load compiled code below return } #endregion Load individual files #region Load compiled code <# This file loads the strings documents from the respective language folders. This allows localizing messages and errors. Load psd1 language files for each language you wish to support. Partial translations are acceptable - when missing a current language message, it will fallback to English or another available language. #> Import-PSFLocalizedString -Path "$($script:ModuleRoot)\en-us\*.psd1" -Module 'ADMF' -Language 'en-US' function Invoke-CallbackMenu { <# .SYNOPSIS Calls a GUI window to pick the contexts for a specific server. .DESCRIPTION Calls a GUI window to pick the contexts for a specific server. This is used when invoking Set-AdmfContext with the (hidden) -Callback parameter. It is designed to be triggered automatically when trying to manage a forest / domain that has not yet had its context defined. Note: This makes it critical to define a context first when doing unattended automation. .PARAMETER Server The server / domain being connected to. Used for documentation purposes, as well as to potentially determine initial checkbox state. .PARAMETER Credential The credentials to use for this operation. .EXAMPLE PS C:\> Invoke-CallbackMenu -Server contoso.com Shows the context selection menu for the domain contoso.com #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseShouldProcessForStateChangingFunctions", "")] [CmdletBinding()] param ( [Parameter(Mandatory = $true)] [string] $Server, [pscredential] $Credential ) begin { #region Utility Functions function New-CheckBox { [CmdletBinding()] param ( $ContextObject, $Parent ) $column = $Parent.Controls.Count % 2 $row = [math]::Truncate(($Parent.Controls.Count / 2)) $checkbox = [System.Windows.Forms.CheckBox]::new() $checkbox.Width = 200 $checkbox.Height = 20 $checkbox.AutoSize = $false $checkbox.Location = [System.Drawing.Point]::new((210 * $column + 15), (25 * $row + 15)) $checkbox.Text = $ContextObject.Name $checkbox.Font = 'Microsoft Sans Serif,10' $null = $Parent.Controls.Add($checkbox) $tooltip = [System.Windows.Forms.ToolTip]::new() $tooltip.ToolTipTitle = $ContextObject.Name $tooltipText = $ContextObject.Description if ($ContextObject.Prerequisites.Count -gt 0) { $tooltipText += "`nPrerequisites: $($ContextObject.Prerequisites -join ', ')" } if ($ContextObject.MutuallyExclusive.Count -gt 0) { $tooltipText += "`nMutually exclusive with: $($ContextObject.MutuallyExclusive -join ', ')" } $tooltip.SetToolTip($checkbox, $tooltipText) $checkbox.Add_CheckedChanged({ Update-Checkbox }) $checkbox } function Update-Checkbox { [CmdletBinding()] param () # Exemption: Accessing superscope variables directly. Forms and their events are screwey enough. foreach ($checkbox in $contextCheckboxes.Values) { $checkbox.Enabled = $true } foreach ($contextObject in $allContexts) { foreach ($prerequisite in $contextObject.Prerequisites) { if (-not $contextCheckboxes[$prerequisite].Checked) { $contextCheckboxes[$contextObject.Name].Enabled = $false $contextCheckboxes[$contextObject.Name].Checked = $false break } } foreach ($exclusion in $contextObject.MutuallyExclusive) { if (-not $contextCheckboxes[$contextObject.Name].Checked) { break } if (-not $contextCheckboxes[$exclusion]) { continue } $contextCheckboxes[$exclusion].Enabled = $false $contextCheckboxes[$exclusion].Checked = $false } } } function New-Form { [OutputType([System.Windows.Forms.Form])] [CmdletBinding()] param () New-Object System.Windows.Forms.Form -Property @{ ClientSize = '500,500' Text = "Context Selection" TopMost = $false AutoSize = $false } } function New-GroupBox { [OutputType([System.Windows.Forms.Groupbox])] [CmdletBinding()] param ( [string] $Text, [int] $Height, $Form ) $newHeight = 10 if ($Form.Controls.Count -gt 0) { $last = $Form.Controls | Sort-Object { $_.Location.Y } -Descending | Select-Object -First 1 $newHeight = 10 + $last.Height + $last.Location.Y } $groupBox = New-Object System.Windows.Forms.Groupbox -Property @{ Height = $Height Width = 480 Text = $Text AutoSize = $false Location = (New-Object System.Drawing.Point(10, $newHeight)) } $Form.Controls.Add($groupBox) $groupBox } function New-Label { [CmdletBinding()] param ( [string] $Text, $Parent ) $label = New-Object system.Windows.Forms.Label -Property @{ Text = $Text AutoSize = $false Font = 'Microsoft Sans Serif,10' Location = (New-Object System.Drawing.Point(10, 15)) Width = 460 TextAlign = 'MiddleCenter' } $Parent.Controls.Add($label) } #endregion Utility Functions $parameters = $PSBoundParameters | ConvertTo-PSFHashtable -Include Server, Credential #region Form [System.Windows.Forms.Application]::EnableVisualStyles() $form = New-Form $group_Server = New-GroupBox -Text "Selected Domain / Server" -Height 50 -Form $form try { $domain = Get-ADDomain @parameters -ErrorAction Stop New-Label -Text $domain.DNSRoot -Parent $group_Server } catch { New-Label -Text $Server -Parent $group_Server } #region Contexts $allContexts = Get-AdmfContext $groupedContexts = $allContexts | Group-Object Group $contextCheckboxes = @{ } foreach ($groupedContext in $groupedContexts) { $rows = [math]::Round(($groupedContext.Group.Count / 2), [System.MidpointRounding]::AwayFromZero) $group_Context = New-GroupBox -Text $groupedContext.Name -Height ($rows * 25 + 15) -Form $form foreach ($contextObject in ($groupedContext.Group | Sort-Object Name)) { $contextCheckboxes[$contextObject.Name] = New-CheckBox -ContextObject $contextObject -Parent $group_Context } } if ($parameters.Server -eq '<Default Domain>') { $parameters.Server = $env:USERDNSDOMAIN } foreach ($context in $allContexts | Sort-Object Weight) { $path = Join-Path $context.Path 'contextPromptChecked.ps1' if (Test-Path $path) { try { $result = & $path @parameters if ($result) { $contextCheckboxes[$context.Name].Checked = $true } } catch { Write-PSFMessage -Level Warning -String 'Invoke-CallbackMenu.Context.Checked.Error' -StringValues $context.Name -ErrorRecord $_ } } } Update-Checkbox #endregion Contexts #region Buttons $button_Cancel = New-Object system.Windows.Forms.Button -Property @{ Text = 'Cancel' Width = 60 Height = 30 Anchor = 'right,bottom' Location = (New-Object System.Drawing.Point(426, 460)) Font = 'Microsoft Sans Serif,10' } $form.Controls.Add($button_Cancel) $button_OK = New-Object system.Windows.Forms.Button -Property @{ Text = 'OK' Width = 38 Height = 30 Anchor = 'right,bottom' Location = (New-Object System.Drawing.Point(378, 460)) Font = 'Microsoft Sans Serif,10' } $form.Controls.Add($button_OK) #endregion Buttons #region Other Stuff $okbox = [System.Windows.Forms.CheckBox]::new() $okbox.Visible = $false $form.Controls.Add($okbox) $button_OK.Add_Click({ $okbox.Checked = $true $this.Parent.Close() }) $form.ShowIcon = $false $form.CancelButton = $button_Cancel $form.AcceptButton = $button_OK $last = $form.Controls | Where-Object { $_ -is [System.Windows.Forms.Groupbox] } | Sort-Object { $_.Location.Y } -Descending | Select-Object -First 1 $newHeight = 90 + $last.Height + $last.Location.Y $form.Height = $newHeight #endregion Other Stuff #endregion Form } process { $null = $form.ShowDialog() if (-not $okbox.Checked) { throw "Interrupting: User cancelled operation" } $selectedNames = @(($contextCheckboxes.Values | Where-Object Checked).Text) $allContexts | Where-Object Name -In $selectedNames } } function Invoke-PostCredentialProvider { <# .SYNOPSIS Executes the PostScript action of a credential provider. .DESCRIPTION Executes the PostScript action of a credential provider. .PARAMETER ProviderName Name of the credential provider to use. .PARAMETER Server The original server targeted. .PARAMETER Credential The original credentials specified by the user. .PARAMETER Cmdlet The $PSCmdlet object of the calling command. Used to kill it with maximum prejudice in case of error. .EXAMPLE PS C:\> Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential Performs any post-execution action registered for the $CredentialProvider (if any) #> [CmdletBinding()] param ( [string] $ProviderName, [PSFComputer] $Server, [AllowNull()] [PSCredential] $Credential, [System.Management.Automation.PSCmdlet] $Cmdlet = $PSCmdlet ) if (-not $script:credentialProviders[$ProviderName]) { Stop-PSFFunction -String 'Invoke-PostCredentialProvider.Provider.NotFound' -StringValues $ProviderName -EnableException $true -Cmdlet $Cmdlet } if (-not $script:credentialProviders[$ProviderName].PostScript) { return } $argument = [PSCustomObject]@{ Server = $Server Credential = $Credential } try { $null = $script:credentialProviders[$ProviderName].PostScript.Invoke($argument) } catch { Stop-PSFFunction -String 'Invoke-PostCredentialProvider.Provider.ExecutionError' -StringValues $ProviderName -EnableException $true -ErrorRecord $_ -Cmdlet $Cmdlet } } function Invoke-PreCredentialProvider { <# .SYNOPSIS Resolves credentials to use using the registered credential provider. .DESCRIPTION Resolves credentials to use using the registered credential provider. .PARAMETER ProviderName Name of the credential provider to use. .PARAMETER Server The server to connect to. .PARAMETER Credential The credentials specified by the user. .PARAMETER Parameter The parameter object resolved from the original user input. .PARAMETER Cmdlet The $PSCmdlet object of the calling command. Used to kill it with maximum prejudice in case of error. .EXAMPLE PS C:\> $originalArgument = Invoke-PreCredentialProvider @parameters -ProviderName $CredentialProvider -Parameter $parameters Resolves the credentials to use and automatically injects them into the $parameters hashtable. Also returns the original input for use when invoking the PostScript scriptblock of the provider. #> [CmdletBinding()] param ( [string] $ProviderName, [PSFComputer] $Server, [AllowNull()] [PSCredential] $Credential, [Hashtable] $Parameter, [System.Management.Automation.PSCmdlet] $Cmdlet = $PSCmdlet ) if (-not $script:credentialProviders[$ProviderName]) { Stop-PSFFunction -String 'Invoke-PreCredentialProvider.Provider.NotFound' -StringValues $ProviderName -EnableException $true -Cmdlet $Cmdlet } $argument = [PSCustomObject]@{ Server = $Server Credential = $Credential } try { $results = $script:credentialProviders[$ProviderName].PreScript.Invoke($argument) | Where-Object { $_ -is [PSCredential] } | Select-Object -First 1 } catch { Stop-PSFFunction -String 'Invoke-PreCredentialProvider.Provider.ExecutionError' -StringValues $ProviderName -EnableException $true -ErrorRecord $_ -Cmdlet $Cmdlet } if ($results) { $Parameter['Credential'] = $results } elseif ($Parameter.ContainsKey('Credential')) { $Parameter.Remove('Credential') } return $argument } function Reset-DomainControllerCache { <# .SYNOPSIS Resets the cached domain controller resolution. .DESCRIPTION Resets the cached domain controller resolution. The targeted domain controller is being cached throughout the execution of a single test or invoke to avoid targeting issues between credential providers and the actual execution. .EXAMPLE PS C:\> Reset-DomainControllerCache Resets the cached domain controller resolution. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [CmdletBinding()] param ( ) $script:resolvedDomainController = $null } function Resolve-DataFile { <# .SYNOPSIS Resolves the specified file to a datafile path, no matter whether it is json or psd1 .DESCRIPTION Resolves the specified file to a datafile path, no matter whether it is json or psd1 Will prioritize json over psd1 if both are present. Will return an empty value if neither exists. .PARAMETER Path Path to the file to resolve. Do not specify an extension, if you want to aim for both of them. .EXAMPLE PS C:\> Resolve-DataFile -Path ".\config" Will resolve to either ".\config.json" or ".\config.psd1", depending on which is available. #> [OutputType([string])] [CmdletBinding()] param ( [Parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)] [string] $Path ) process { if (Test-Path -Path $Path) { return $Path } if (Test-Path -Path "$Path.json") { return "$Path.json" } if (Test-Path -Path "$Path.psd1") { return "$Path.psd1" } } } function Resolve-DomainController { <# .SYNOPSIS Resolves a domain to a specific domaincontroller. .DESCRIPTION Resolves a domain to a specific domaincontroller. .PARAMETER Server The server / domain to work with. .PARAMETER Credential The credentials to use for this operation. .PARAMETER Type The type of DC to resolve to. Governed by the 'ADMF.DCSelectionMode' configuration setting. .PARAMETER Confirm If this switch is enabled, you will be prompted for confirmation before executing any operations that change state. .PARAMETER WhatIf If this switch is enabled, no actions are performed but informational messages will be displayed that explain what would happen if the command were to run. .EXAMPLE PS C:\> Resolve-DomainController @parameters Picks the server to work against. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseDeclaredVarsMoreThanAssignments", "")] [OutputType([string])] [CmdletBinding(SupportsShouldProcess = $true)] param ( [PSFComputer] $Server, [PSCredential] $Credential, [ValidateSet('PDCEmulator', 'Site', 'Random')] [string] $Type = (Get-PSFConfigValue -FullName 'ADMF.DCSelectionMode' -Fallback 'PDCEmulator') ) begin { $parameters = $PSBoundParameters | ConvertTo-PSFHashtable -Include Server, Credential $parameters['Debug'] = $false } process { #region Prepare and handle caching & explicit server selection # Return cached DC to avoid multi-resolution in a single call. Is reset between calls if ($script:resolvedDomainController) { return $script:resolvedDomainController } $targetString = $Server if (-not $targetString) { $targetString = $env:USERDNSNAME } $null = Invoke-PSFProtectedCommand -ActionString 'Resolve-DomainController.Connecting' -ActionStringValues $targetString -Target $targetString -ScriptBlock { $domainController = Get-ADDomainController @parameters -ErrorAction Stop } -PSCmdlet $PSCmdlet -EnableException $true -RetryCount 5 -RetryWait 2 -Confirm:$false -Tag ResolveDC # Server was explicitly specified in call if ($domainController.HostName -eq $Server) { Write-PSFMessage -Level Host -String 'Resolve-DomainController.Resolved' -StringValues $domainController.HostName $script:resolvedDomainController = $domainController.HostName return $domainController.HostName } if ($domainController.Name -eq $Server) { Write-PSFMessage -Level Host -String 'Resolve-DomainController.Resolved' -StringValues $domainController.Name $script:resolvedDomainController = $domainController.Name return $domainController.Name } #endregion Prepare and handle caching & explicit server selection #region Resolution Types switch ($Type) { #region Random 'Random' { Write-PSFMessage -Level Host -String 'Resolve-DomainController.Resolved' -StringValues $domainController.HostName $script:resolvedDomainController = $domainController.HostName | Get-Random return $script:resolvedDomainController } #endregion Random #region Site Assignment 'Site' { $sites = Get-PSFConfigValue -FullName 'ADMF.DCSelection.Site' $prioritize = Get-PSFConfigValue -FullName 'ADMF.DCSelection.Site.Prioritize' $allDC = Get-ADDomainController @parameters -Filter * $targetDCs = $allDC | Where-Object Site -In $sites if ($prioritize) { foreach ($site in $sites) { if ($targetDCs | Where-Object Site -In $site) { $targetDCs = $targetDCs | Where-Object Site -In $site break } } } $domain = Get-ADDomain @parameters if ($targetDCs.HostName -contains $domain.PDCEmulator) { Write-PSFMessage -Level Host -String 'Resolve-DomainController.Resolved' -StringValues $domain.PDCEmulator $script:resolvedDomainController = $domain.PDCEmulator return $domain.PDCEmulator } elseif ($targetDCs) { $dcObject = $targetDCs | Get-Random Write-PSFMessage -Level Host -String 'Resolve-DomainController.Resolved' -StringValues $dcObject.HostName $script:resolvedDomainController = $dcObject.HostName return $dcObject.HostName } else { Write-PSFMessage -Level Host -String 'Resolve-DomainController.Resolved' -StringValues $domain.PDCEmulator $script:resolvedDomainController = $domain.PDCEmulator $domain.PDCEmulator } } #endregion Site Assignment #region PDC Emulator default { $domain = Get-ADDomain @parameters Write-PSFMessage -Level Host -String 'Resolve-DomainController.Resolved' -StringValues $domain.PDCEmulator $script:resolvedDomainController = $domain.PDCEmulator $domain.PDCEmulator } #endregion PDC Emulator } #endregion Resolution Types } } function Export-AdmfGpo { <# .SYNOPSIS Creates an export of GPO objects for use in the Domain Management module. .DESCRIPTION Creates an export of GPO objects for use in the Domain Management module. Use this command to record new GPO data for the module. .PARAMETER Path The path to which to export the GPOs. .PARAMETER GpoObject The GPO objects to export. Only accepts output of Get-GPO .PARAMETER Domain The domain to export from. .PARAMETER ExcludeWmiFilter Do not export WmiFilter assignments of GPOs By default, when exporting GPOs, the associated WMi Filter-Name is also exported .PARAMETER OldExportMode How should this command deal with the folders of previous GPO backups? By default, when detecting the folders of previous GPO backups, this command will prompt the user, whether to continue, stop or delete & continue. Options: + Interactive (default): Ask the user for a choice, defaulting to keep the folders. + Delete: Previous backup folders will be deleted without prompting + Ignore: Previous backup folders will be kept .EXAMPLE PS C:\> Get-GPO -All | Where-Object DisplayName -like 'AD-D-SEC-T0*' | Export-AdmfGpo -Path . Exports all GPOs named like 'AD-D-SEC-T0*' to the current path #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSReviewUnusedParameter", "")] [CmdletBinding()] Param ( [PsfValidateScript('ADMF.Validate.Path', ErrorString = 'ADMF.Validate.Path')] [Parameter(Mandatory = $true)] [string] $Path, [PsfValidateScript('ADMF.Validate.Type.Gpo', ErrorString = 'ADMF.Validate.Type.Gpo')] [Parameter(Mandatory = $true, ValueFromPipeline = $true)] $GpoObject, [string] $Domain = $env:USERDNSDOMAIN, [switch] $ExcludeWmiFilter, [ValidateSet('Interactive', 'Delete', 'Ignore')] [string] $OldExportMode = 'Interactive' ) begin { $resolvedPath = Resolve-PSFPath -Path $Path -Provider FileSystem -SingleItem #region Catch Existing GPO Folders $stop = $false $gpoFolders = Get-ChildItem -LiteralPath $resolvedPath -Directory | Where-Object Name -Match ([psfrgx]::Guid) if ($gpoFolders) { $doDelete = $OldExportMode -eq 'Delete' if ($OldExportMode -eq 'Interactive') { $choice = Get-PSFUserChoice -Caption 'Old GPO Backups Found' -Message "#$(@($gpoFolders).Count) probable GPO Backups have been found in the export path - these could create confusion when trying to add the exported data to the Context, potentially including unneeded folders and their content. What should be done with those folders?" -Options @( 'Ignore' 'Delete' 'Stop' ) if (2 -eq $choice) { $stop = $true return } if (1 -eq $choice) { $doDelete = $true } } if ($doDelete) { $gpoFolders | Remove-Item -Recurse -Force } } #endregion Catch Existing GPO Folders $backupCmd = { Backup-GPO -Path $resolvedPath -Domain $Domain } $backupGPO = $backupCmd.GetSteppablePipeline() $backupGPO.Begin($true) [System.Collections.ArrayList]$gpoData = @() $exportID = [guid]::NewGuid().ToString() } process { if ($stop) { return } foreach ($gpoItem in $GpoObject) { $exportData = $backupGPO.Process(($gpoItem | Select-PSFObject 'ID as GUID')) $data = @{ DisplayName = $gpoItem.DisplayName Description = $gpoItem.Description ID = "{$($exportData.ID.ToString().ToUpper())}" ExportID = $exportID } if (-not $ExcludeWmiFilter -and $gpoItem.WmiFilter.Name) { $data.WmiFilter = $gpoItem.WmiFilter.Name } $null = $gpoData.Add([PSCustomObject]$data) } } end { if ($stop) { return } $backupGPO.End() $gpoData | ConvertTo-Json | Set-Content "$resolvedPath\exportData.json" # Remove hidden attribute, to prevent issues with copy over WinRM foreach ($fsItem in (Get-ChildItem -Path $resolvedPath -Recurse -Force)) { $fsItem.Attributes = $fsItem.Attributes -band [System.IO.FileAttributes]::Directory } } } function Get-AdmfContext { <# .SYNOPSIS Return available contexts. .DESCRIPTION Return available contexts. By default, only the latest version of any given context will be returned. .PARAMETER Name The name of the context to filter by. .PARAMETER Store The context stores to look in. .PARAMETER All Return all versions of any given context, rather than just the latest version. .PARAMETER Current Displays the currently active contexts. .PARAMETER Importing Return the contexts that are currently being imported. Use this to react from within your context's scriptblocks to any other context that is selected. This parameter only has meaning when used within a context's scriptblocks. .PARAMETER DomainTable Return a list of which target domain has which contexts assigned in cache. .EXAMPLE PS C:\> Get-AdmfContext Returns the latest version of all available contexts. #> [CmdletBinding(DefaultParameterSetName = 'Search')] param ( [Parameter(ParameterSetName = 'Search')] [string] $Name = '*', [Parameter(ParameterSetName = 'Search')] [string] $Store = '*', [Parameter(ParameterSetName = 'Search')] [switch] $All, [Parameter(ParameterSetName = 'Current')] [switch] $Current, [Parameter(ParameterSetName = 'Importing')] [switch] $Importing, [Parameter(ParameterSetName = 'Server')] [switch] $DomainTable ) process { if ($Current) { return $script:loadedContexts } if ($DomainTable) { return $script:assignedContexts.Clone() } if ($Importing) { return (Get-PSFTaskEngineCache -Module ADMF -Name currentlyImportingContexts) } $contextStores = Get-AdmfContextStore -Name $Store $allContextData = foreach ($contextStore in $contextStores) { if (-not (Test-Path $contextStore.Path)) { continue } foreach ($folder in (Get-ChildItem -Path $contextStore.Path -Filter $Name -Directory)) { $versionFolders = Get-ChildItem -Path $folder.FullName -Directory | Where-Object { $_.Name -as [version] } | Sort-Object { [version]$_.Name } -Descending if (-not $All) { $versionFolders = $versionFolders | Select-Object -First 1 } foreach ($versionFolder in $versionFolders) { $resultObject = [pscustomobject]@{ PSTypeName = 'ADMF.Context' Name = $folder.Name Version = ($versionFolder.Name -as [version]) Store = $contextStore.Name Path = $versionFolder.FullName Description = '' Weight = 50 Author = '' Prerequisites = @() MutuallyExclusive = @() Group = 'Default' } if (Test-Path -Path "$($versionFolder.FullName)\context.json") { $contextData = Get-Content -Path "$($versionFolder.FullName)\context.json" | ConvertFrom-Json if ($contextData.Weight -as [int]) { $resultObject.Weight = $contextData.Weight -as [int] } if ($contextData.Description) { $resultObject.Description = $contextData.Description } if ($contextData.Author) { $resultObject.Author = $contextData.Author } if ($contextData.Prerequisites) { $resultObject.Prerequisites = $contextData.Prerequisites } if ($contextData.MutuallyExclusive) { $resultObject.MutuallyExclusive = $contextData.MutuallyExclusive } if ($contextData.Group) { $resultObject.Group = $contextData.Group } } $resultObject } } } if ($All) { return $allContextData } # Only return highest version if -All has not been set # The same context name might be stored in multiple stores $allContextData | Group-Object Name | ForEach-Object { $_.Group | Sort-Object Version -Descending | Select-Object -First 1 | Select-PSFObject -TypeName 'ADMF.Context' } } } function Get-AdmfContextStore { <# .SYNOPSIS Returns the list of available context stores. .DESCRIPTION Returns the list of available context stores. .PARAMETER Name The name to filter by. .EXAMPLE PS C:\> Get-AdmfContextStore Returns all available context stores. #> [CmdletBinding()] param ( [string] $Name = '*' ) process { foreach ($config in (Get-PSFConfig -FullName "ADMF.Context.Store.$Name")) { [PSCustomObject]@{ PSTypeName = 'ADMF.Context.Store' Name = $config.Name -replace '^Context\.Store\.' Path = $config.Value PathExists = (Test-Path $config.Value) } } } } function Invoke-AdmfDC { <# .SYNOPSIS Brings all DCs of the target domain into the desired/defined state. .DESCRIPTION Brings all DCs of the target domain into the desired/defined state. .PARAMETER Server The server / domain to work with. .PARAMETER Credential The credentials to use for this operation. .PARAMETER TargetServer The specific server(s) to process. If specified, only listed domain controllers will be affected. Specify the full FQDN of the server. .PARAMETER Options Which aspects to actually update. By default, all Components are applied. .PARAMETER CredentialProvider The credential provider to use to resolve the input credentials. See help on Register-AdmfCredentialProvider for details. .PARAMETER ContextPrompt Force displaying the Context selection User Interface. .PARAMETER Confirm If this switch is enabled, you will be prompted for confirmation before executing any operations that change state. .PARAMETER WhatIf If this switch is enabled, no actions are performed but informational messages will be displayed that explain what would happen if the command were to run. .EXAMPLE PS C:\> Invoke-AdmfDC -Server corp.contoso.com Brings all DCs of the domain corp.contoso.com into the desired/defined state. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPlainTextForPassword', '')] [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'High')] param ( [PSFComputer] $Server, [PSCredential] $Credential, [string[]] $TargetServer = @(), [ADMF.UpdateDCOptions[]] $Options = 'Default', [string] $CredentialProvider = 'default', [Alias('Ctx')] [switch] $ContextPrompt ) begin { Reset-DomainControllerCache $parameters = $PSBoundParameters | ConvertTo-PSFHashtable -Include Server, Credential if (-not $Server -and $TargetServer) { $parameters.Server = $TargetServer | Select-Object -First 1 } $originalArgument = Invoke-PreCredentialProvider @parameters -ProviderName $CredentialProvider -Parameter $parameters -Cmdlet $PSCmdlet try { $dcServer = Resolve-DomainController @parameters -Confirm:$false } catch { Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential -Cmdlet $PSCmdlet throw } $parameters.Server = $dcServer Invoke-PSFCallback -Data $parameters -EnableException $true -PSCmdlet $PSCmdlet Set-AdmfContext @parameters -Interactive -ReUse:$(-not $ContextPrompt) -EnableException $parameters += $PSBoundParameters | ConvertTo-PSFHashtable -Include WhatIf, Confirm, Verbose, Debug $parameters.Server = $dcServer [ADMF.UpdateDCOptions]$newOptions = $Options } process { try { if ($newOptions -band [ADMF.UpdateDCOptions]::Share) { if (Get-DCShare) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDC.Executing.Invoke' -StringValues 'Shares', $parameters.Server Invoke-DCShare @parameters -TargetServer $TargetServer } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDC.Skipping.Test.NoConfiguration' -StringValues 'Shares' } } if ($newOptions -band [ADMF.UpdateDCOptions]::FSAccessRule) { if (Get-DCAccessRule) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDC.Executing.Invoke' -StringValues 'FSAccessRules', $parameters.Server Invoke-DCAccessRule @parameters -TargetServer $TargetServer } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDC.Skipping.Test.NoConfiguration' -StringValues 'FSAccessRules' } } } catch { throw } finally { Disable-PSFConsoleInterrupt try { Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential -Cmdlet $PSCmdlet } finally { Enable-PSFConsoleInterrupt } } } } function Invoke-AdmfDomain { <# .SYNOPSIS Brings a domain into compliance with the desired state. .DESCRIPTION Brings a domain into compliance with the desired state. It implements a wide variety of settings against the targeed domain, whether it be OUs, groups, users, gpos, acls or many more items. Note on order: - OU Creation and Updating should be done first, but DELETING ous (OUHard) should be one of the last operations performed. - Acl & Access operations should be performed last - Managing group policy yields best results in this order: 1. Create new GPO 2. Create Links, only disabling undesired links 3. Delete unneeded GPO 4. Delete undesired links This is due to the fact that "unneeded GPO" are detected by being linked into managed GPOs. .PARAMETER Server The server / domain to work with. .PARAMETER Credential The credentials to use for this operation. .PARAMETER Options The various operations that are supported. By default "default" operations are executed against the targeted domain. - Acl : The basic permission behavior of an object (e.g.: Owner, Inheritance) - GPLink : Manages the linking of group policies. - GPPermission : Managing permissions on group policy objects. - GroupPolicy : Deploying and updating GPOs. - GroupMembership : Assigning group membership - Group : Creating groups - OUSoft : Creating & modifying OUs, but not deleting them - OUHard : Creating, Modifying & Deleting OUs. This exists in order to be able to create new OUs, then move all objects over and only when done deleting undesired OUs. Will NOT delete OUs that contain objects.! - PSO : Implementing Finegrained Password Policies - Object : Custom AD object - User : Managing User objects - GPLinkDisable : Creating GP Links, but only disabling undesired links. This is needed in order to detect undesired GPOs to delete: Those linked when they shouldn't be! - GroupPolicyDelete : Deploy, update and delete Group Policy objects. .PARAMETER CredentialProvider The credential provider to use to resolve the input credentials. See help on Register-AdmfCredentialProvider for details. .PARAMETER ContextPrompt Force displaying the Context selection User Interface. .PARAMETER Confirm If this switch is enabled, you will be prompted for confirmation before executing any operations that change state. .PARAMETER WhatIf If this switch is enabled, no actions are performed but informational messages will be displayed that explain what would happen if the command were to run. .EXAMPLE PS C:\> Invoke-AdmfDomain Brings the current domain into compliance with the desired state. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPlainTextForPassword', '')] [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'High')] Param ( [PSFComputer[]] $Server, [PSCredential] $Credential, [ADMF.UpdateDomainOptions[]] $Options = 'Default', [string] $CredentialProvider = 'default', [Alias('Ctx')] [switch] $ContextPrompt ) begin { [ADMF.UpdateDomainOptions]$newOptions = $Options } process { foreach ($computer in $Server) { Reset-DomainControllerCache $parameters = $PSBoundParameters | ConvertTo-PSFHashtable -Include Credential $parameters.Server = $computer $originalArgument = Invoke-PreCredentialProvider @parameters -ProviderName $CredentialProvider -Parameter $parameters -Cmdlet $PSCmdlet try { $dcServer = Resolve-DomainController @parameters -Confirm:$false } catch { Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential -Cmdlet $PSCmdlet Write-Error $_ continue } $parameters.Server = $dcServer Invoke-PSFCallback -Data $parameters -EnableException $true -PSCmdlet $PSCmdlet Set-AdmfContext @parameters -Interactive -ReUse:$(-not $ContextPrompt) -EnableException $parameters += $PSBoundParameters | ConvertTo-PSFHashtable -Include WhatIf, Confirm, Verbose, Debug $parameters.Server = $dcServer try { if ($newOptions -band [UpdateDomainOptions]::OUSoft) { if (Get-DMOrganizationalUnit) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'OrganizationalUnits - Create & Modify', $parameters.Server Invoke-DMOrganizationalUnit @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'OrganizationalUnits - Create & Modify' } } if ($newOptions -band [UpdateDomainOptions]::Group) { if (Get-DMGroup) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'Groups', $parameters.Server Invoke-DMGroup @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'Groups' } } if ($newOptions -band [UpdateDomainOptions]::User) { if (Get-DMUser) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'Users', $parameters.Server Invoke-DMUser @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'Users' } } if ($newOptions -band [UpdateDomainOptions]::ServiceAccount) { if (Get-DMServiceAccount) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'ServiceAccounts', $parameters.Server Invoke-DMServiceAccount @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'ServiceAccounts' } } if ($newOptions -band [UpdateDomainOptions]::GroupMembership) { if (Get-DMGroupMembership) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'GroupMembership', $parameters.Server Invoke-DMGroupMembership @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'GroupMembership' } } if ($newOptions -band [UpdateDomainOptions]::PSO) { if (Get-DMPasswordPolicy) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'PasswordPolicies', $parameters.Server Invoke-DMPasswordPolicy @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'PasswordPolicies' } } if ($newOptions -band [UpdateDomainOptions]::WmiFilter) { if (Get-DMWmiFilter) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'WmiFilter', $parameters.Server Invoke-DMWmiFilter @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'WmiFilter' } } if ($newOptions -band [UpdateDomainOptions]::GroupPolicy) { if (Get-DMGroupPolicy) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'GroupPolicies - Create & Modify', $parameters.Server Invoke-DMGroupPolicy @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'GroupPolicies - Create & Modify' } } if ($newOptions -band [UpdateDomainOptions]::GPPermission) { if (Get-DMGPPermission) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'GroupPolicyPermissions', $parameters.Server Invoke-DMGPPermission @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'GroupPolicyPermissions' } } if ($newOptions -band [UpdateDomainOptions]::GPOwner) { if (Get-DMGPOwner) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'GroupPolicyOwners', $parameters.Server Invoke-DMGPOwner @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'GroupPolicyOwners' } } if ($newOptions -band [UpdateDomainOptions]::GPLinkDisable) { if (Get-DMGPLink) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'GroupPolicyLinks - Create, Update & Disable unwanted Links', $parameters.Server Invoke-DMGPLink @parameters -Disable } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'GroupPolicyLinks - Create, Update & Disable unwanted Links' } } if ($newOptions -band [UpdateDomainOptions]::GroupPolicyDelete) { if (Get-DMGroupPolicy) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'GroupPolicies - Delete', $parameters.Server Invoke-DMGroupPolicy @parameters -Delete } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'GroupPolicies - Delete' } } if ($newOptions -band [UpdateDomainOptions]::GPLink) { if (Get-DMGPLink) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'GroupPolicyLinks - Delete unwanted Links', $parameters.Server Invoke-DMGPLink @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'GroupPolicyLinks - Delete unwanted Links' } } if ($newOptions -band [UpdateDomainOptions]::OUHard) { if (Get-DMOrganizationalUnit) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'OrganizationalUnits - Delete', $parameters.Server Invoke-DMOrganizationalUnit @parameters -Delete } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'OrganizationalUnits - Delete' } } if ($newOptions -band [UpdateDomainOptions]::Object) { if (Get-DMObject) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'Objects', $parameters.Server Invoke-DMObject @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'Objects' } } if ($newOptions -band [UpdateDomainOptions]::Acl) { if (Get-DMAcl | Remove-PSFNull) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'Acls', $parameters.Server Invoke-DMAcl @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'Acls' } } if ($newOptions -band [UpdateDomainOptions]::AccessRule) { if (Get-DMAccessRule) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'AccessRules', $parameters.Server Invoke-DMAccessRule @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'AccessRules' } } if ($newOptions -band [UpdateDomainOptions]::DomainLevel) { if (Get-DMDomainLevel) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'DomainLevel', $parameters.Server Invoke-DMDomainLevel @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'DomainLevel' } } if ($newOptions -band [UpdateDomainOptions]::Exchange) { if (Get-DMExchange) { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Executing.Invoke' -StringValues 'Exchange System Objects', $parameters.Server Invoke-DMExchange @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'Exchange System Objects' } } } catch { Write-Error $_ continue } finally { Disable-PSFConsoleInterrupt try { Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential -Cmdlet $PSCmdlet } finally { Enable-PSFConsoleInterrupt } } } } } function Invoke-AdmfForest { <# .SYNOPSIS Applies the currently desired configuration to the targeted forest. .DESCRIPTION Applies the currently desired configuration to the targeted forest. By default, this will only include sites, sitelinks and subnets. To switch to a full application, use the "-Options All" parameter. .PARAMETER Server The server / domain to work with. .PARAMETER Credential The credentials to use for this operation. .PARAMETER Options Which aspects to actually update. Defaults to "default" (Sites, SiteLinks & Subnets) Also available: - ServerRelocate (reassigns domain controllers to correct sites, if necessary) - Schema (applies core schema updates) - SchemaLdif (applies product Ldif files, such as SkypeForBusiness) To update everything, use "All". .PARAMETER CredentialProvider The credential provider to use to resolve the input credentials. See help on Register-AdmfCredentialProvider for details. .PARAMETER ContextPrompt Force displaying the Context selection User Interface. .PARAMETER Confirm If this switch is enabled, you will be prompted for confirmation before executing any operations that change state. .PARAMETER WhatIf If this switch is enabled, no actions are performed but informational messages will be displayed that explain what would happen if the command were to run. .EXAMPLE PS C:\> Invoke-AdmfForest -Server contoso.com -Options All Applies the full forest configuration to the contoso.com domain. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPlainTextForPassword', '')] [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'High')] Param ( [PSFComputer[]] $Server, [PSCredential] $Credential, [ADMF.UpdateForestOptions[]] $Options = 'Default', [string] $CredentialProvider = 'default', [Alias('Ctx')] [switch] $ContextPrompt ) begin { [ADMF.UpdateForestOptions]$newOptions = $Options } process { foreach ($computer in $Server) { Reset-DomainControllerCache $parameters = $PSBoundParameters | ConvertTo-PSFHashtable -Include Credential $parameters.Server = $computer $originalArgument = Invoke-PreCredentialProvider @parameters -ProviderName $CredentialProvider -Parameter $parameters -Cmdlet $PSCmdlet try { $dcServer = Resolve-DomainController @parameters -Confirm:$false } catch { Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential -Cmdlet $PSCmdlet Write-Error $_ continue } $parameters.Server = $dcServer Invoke-PSFCallback -Data $parameters -EnableException $true -PSCmdlet $PSCmdlet Set-AdmfContext @parameters -Interactive -ReUse:$(-not $ContextPrompt) -EnableException $parameters += $PSBoundParameters | ConvertTo-PSFHashtable -Include WhatIf, Confirm, Verbose, Debug $parameters.Server = $dcServer try { if ($newOptions -band [UpdateForestOptions]::Sites) { if (Get-FMSite) { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Executing.Invoke' -StringValues 'Sites', $parameters.Server Invoke-FMSite @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Sites' } } if ($newOptions -band [UpdateForestOptions]::SiteLinks) { if (Get-FMSiteLink) { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Executing.Invoke' -StringValues 'Sitelinks', $parameters.Server Invoke-FMSiteLink @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Sitelinks' } } if ($newOptions -band [UpdateForestOptions]::Subnets) { if (Get-FMSubnet) { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Executing.Invoke' -StringValues 'Subnets', $parameters.Server Invoke-FMSubnet @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Subnets' } } if ($newOptions -band [UpdateForestOptions]::ServerRelocate) { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Executing.Invoke' -StringValues 'Server Site Assignment', $parameters.Server Invoke-FMServer @parameters } if ($newOptions -band [UpdateForestOptions]::Schema) { if (Get-FMSchema) { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Executing.Invoke' -StringValues 'Schema (Custom)', $parameters.Server Invoke-FMSchema @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Schema (Custom)' } } if ($newOptions -band [UpdateForestOptions]::SchemaDefaultPermissions) { if (Get-FMSchemaDefaultPermission) { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Executing.Invoke' -StringValues 'Schema Default Permissions', $parameters.Server Invoke-FMSchemaDefaultPermission @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Schema Default Permissions' } } if ($newOptions -band [UpdateForestOptions]::SchemaLdif) { if (Get-FMSchemaLdif) { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Executing.Invoke' -StringValues 'Schema (Ldif)', $parameters.Server Invoke-FMSchemaLdif @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Schema (Ldif)' } } if ($newOptions -band [UpdateForestOptions]::NTAuthStore) { if (Get-FMNTAuthStore) { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Executing.Invoke' -StringValues 'NTAuthStore', $parameters.Server Invoke-FMNTAuthStore @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'NTAuthStore' } } if ($newOptions -band [UpdateForestOptions]::Certificates) { if (Get-FMCertificate) { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Executing.Invoke' -StringValues 'Certificate', $parameters.Server Invoke-FMCertificate @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Certificate' } } if ($newOptions -band [UpdateForestOptions]::ForestLevel) { if (Get-FMForestLevel) { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Executing.Invoke' -StringValues 'ForestLevel', $parameters.Server Invoke-FMForestLevel @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'ForestLevel' } } if ($newOptions -band [UpdateForestOptions]::ExchangeSchema) { if (Get-FMExchangeSchema) { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Executing.Invoke' -StringValues 'ExchangeSchema', $parameters.Server Invoke-FMExchangeSchema @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'ExchangeSchema' } } } catch { Write-Error $_ continue } finally { Disable-PSFConsoleInterrupt try { Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential -Cmdlet $PSCmdlet } finally { Enable-PSFConsoleInterrupt } } } } } function Invoke-AdmfItem { <# .SYNOPSIS Apply individual changes found by Test-AdmfDc, Test-AdmfDomain or Test-AdmfForest. .DESCRIPTION Apply individual changes found by Test-AdmfDc, Test-AdmfDomain or Test-AdmfForest. This allows applying individual changes, irrespective of domain or type. While this command accepts from the pipeline, it groups results by server and executes during the end phase. This is done to rationalize the application of credential providers, context switching and connection management. .PARAMETER TestResult The test results to apply. Output objects of Test-AdmfDc, Test-AdmfDomain or Test-AdmfForest. .PARAMETER Credential The credentials to use for this operation. .PARAMETER CredentialProvider The credential provider to use to resolve the input credentials. See help on Register-AdmfCredentialProvider for details. .PARAMETER Confirm If this switch is enabled, you will be prompted for confirmation before executing any operations that change state. .PARAMETER WhatIf If this switch is enabled, no actions are performed but informational messages will be displayed that explain what would happen if the command were to run. .EXAMPLE PS C:\> Test-AdmfDomain -Server contoso.com | Where-Object ObjectType -in User, Group | Where-Object ObjectType -eq Create | Invoke-AdmfItem Apply all create actions for all users and groups in contoso.com. #> [Alias('iai')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPlainTextForPassword', '')] [CmdletBinding(SupportsShouldProcess = $true)] Param ( [Parameter(ValueFromPipeline = $true)] $TestResult, [PSCredential] $Credential, [string] $CredentialProvider = 'default' ) begin { #region Functions function Invoke-TestResult { [CmdletBinding()] param( $TestResult, $Parameters ) switch ($TestResult.ObjectType) { # DCManagement 'Share' { $TestResult | Invoke-DCShare @Parameters } 'FSAccessRule' { $TestResult | Invoke-DCAccessRule @Parameters } # DomainManagement 'AccessRule' { $TestResult | Invoke-DMAccessRule @Parameters } 'Acl' { $TestResult | Invoke-DMAcl @Parameters } 'DomainLevel' { $TestResult | Invoke-DMDomainLevel @Parameters } 'ExchangeVersion' { $TestResult | Invoke-DMExchange @Parameters } 'GPLink' { $TestResult | Invoke-DMGPLink @Parameters } 'GPOwner' { $TestResult | Invoke-DMGPOwner @Parameters } 'GPPermission' { $TestResult | Invoke-DMGPPermission @Parameters } 'GroupMembership' { $TestResult | Invoke-DMGroupMembership @Parameters } 'GroupPolicy' { $TestResult | Invoke-DMGroupPolicy @Parameters } 'Group' { $TestResult | Invoke-DMGroup @Parameters } 'Object' { $TestResult | Invoke-DMObject @Parameters } 'OrganizationalUnit' { $TestResult | Invoke-DMOrganizationalUnit @Parameters -Delete } 'PSO' { $TestResult | Invoke-DMPasswordPolicy @Parameters } 'ServiceAccount' { $TestResult | Invoke-DMServiceAccount @Parameters } 'User' { $TestResult | Invoke-DMUser @Parameters } 'WmiFilter' { $TestResult | Invoke-DMWmiFilter @parameters } # ForestManagement 'Certificate' { $TestResult | Invoke-FMCertificate @Parameters } 'ExchangeSchema' { $TestResult | Invoke-FMExchangeSchema @Parameters } 'ForestLevel' { $TestResult | Invoke-FMForestLevel @Parameters } 'NTAuthStore' { $TestResult | Invoke-FMNTAuthStore @Parameters } 'Schema' { $TestResult | Invoke-FMSchema @Parameters } 'SchemaDefaultPermission' { $TestResult | Invoke-FMSchemaDefaultPermission @Parameters } 'SchemaLdif' { $TestResult | Invoke-FMSchemaLdif @Parameters } 'Server' { $TestResult | Invoke-FMServer @Parameters } 'SiteLink' { $TestResult | Invoke-FMSiteLink @Parameters } 'Site' { $TestResult | Invoke-FMSite @Parameters } 'Subnet' { $TestResult | Invoke-FMSubnet @Parameters } } } #endregion Functions $testResults = [System.Collections.Generic.List[object]]::new() } process { foreach ($result in $TestResult) { $hasName = $result.PSObject.TypeNames -match '^DomainManagement|^ForestManagement|^DCManagement' if (-not $hasName) { Write-PSFMessage -Level Warning -String 'Invoke-AdmfItem.Error.BadInput' -StringValues $result -Target $result continue } $testResults.Add($result) } } end { $resultGroups = $testResults | Group-Object Server foreach ($resultGroup in $resultGroups) { #region Prepare Credential Stuff Reset-DomainControllerCache $parameters = $PSBoundParameters | ConvertTo-PSFHashtable -Include Credential $parameters.Server = $resultGroup.Name try { $originalArgument = Invoke-PreCredentialProvider @parameters -ProviderName $CredentialProvider -Parameter $parameters Invoke-PSFCallback -Data $parameters -EnableException $true Set-AdmfContext @parameters -Interactive -ReUse -EnableException } catch { Write-PSFMessage -Level Warning -String 'Invoke-AdmfItem.Error.PrepareContext' -StringValues $resultGroup.Name, $resultGroup.Count -Target $resultGroup -ErrorRecord $_ -EnableException $true -PSCmdlet $PSCmdlet if ($originalArgument) { try { Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential } catch { Write-PSFMessage -Level Warning -String 'Invoke-AdmfItem.Error.PostCredentialProvider' -StringValues $CredentialProvider, $resultGroup.Name, $resultGroup.Count -ErrorRecord $_ -Target $resultGroup -PSCmdlet $PSCmdlet } } continue } $parameters += $PSBoundParameters | ConvertTo-PSFHashtable -Include WhatIf, Confirm, Verbose, Debug $parameters.Server = $resultGroup.Name #endregion Prepare Credential Stuff #region Execute Test Results try { foreach ($resultItem in $resultGroup.Group) { if (-not (Test-PSFShouldProcess -Target $resultItem -ActionString 'Invoke-AdmfItem.Processing.ShouldProcess' -ActionStringValues $resultItem.Server, $resultItem.ObjectType, $resultItem.Type, $resultItem.Identity -PSCmdlet $PSCmdlet)) { continue } Write-PSFMessage -Level Host -String 'Invoke-AdmfItem.Processing' -Target $resultItem -StringValues $resultItem.Server, $resultItem.ObjectType, $resultItem.Type, $resultItem.Identity -PSCmdlet $PSCmdlet Invoke-TestResult -TestResult $resultItem -Parameters $parameters } } #endregion Execute Test Results #region Post Processing catch { Write-PSFMessage -Level Warning -String 'Invoke-AdmfItem.Error.Execute' -StringValues $resultGroup.Name, $resultGroup.Count -Target $resultGroup -ErrorRecord $_ -EnableException $true -PSCmdlet $PSCmdlet } finally { try { Disable-PSFConsoleInterrupt Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential } catch { Enable-PSFConsoleInterrupt Write-PSFMessage -Level Warning -String 'Invoke-AdmfItem.Error.PostCredentialProvider' -StringValues $CredentialProvider, $resultGroup.Name, $resultGroup.Count -ErrorRecord $_ -Target $resultGroup } } #endregion Post Processing } } } function New-AdmfContext { <# .SYNOPSIS Creates a new configuration context for ADMF. .DESCRIPTION Creates a new configuration context for ADMF. Contexts are a set of configuration settings. You can combine multiple contexts at the same time, merging the settings they contain. For more details on how contexts work, see: Get-Help about_ADMF_Context .PARAMETER Name The name of the context to create. .PARAMETER Store The context store to create the context in. Context Stores are registered filesystem locations where ADMF will look for contexts. Defaults to the default store found in %AppData%. .PARAMETER OutPath Create the context in a target path, rather than a registered store. Keep in mind, that this will require the context to be manually moved to a registered location in order for it to become available to use. .PARAMETER Weight The priority of the context. This is used to determine the import order when importing multiple contexts. The higher the value, the later in the import order. Default: 50 .PARAMETER Description Add a description to your context (for documentation purposes only). .PARAMETER Author The author of the context (for documentation purposes only) .PARAMETER Group The group to assign the context to. By default, will be part of the "Default" group. Groups are only relevant fpr the itneractive context selection menu, where they govern the visual display style / grouping. .PARAMETER Prerequisite Contexts the current context depends on / requires. .PARAMETER MutuallyExclusive Contexts that are mutually exclusive with each other. E.g.: Where the user has to select between one of several environments. .PARAMETER DefaultAccessRules A new Active Directory environment comes with more deployed security delegations than defined in the schema. Several containers - especially the BuiltIn container - have a lot of extra access rules. When deploying a restrictive domain content mode, where these objects fall under management, it becomes necessary to also configure these delegations, lest they be removed. Setting this switch will include all the default delegations in your new context. .PARAMETER ExchangeAccessRules Whether to include the default permissions installing Exchange into an Active Directory domain brings. .PARAMETER Force This command refuses to replace an existing context by default. Using force, it is a bit more brutish and will kill any previously existing context with the same name in the target store. .PARAMETER EnableException This parameters disables user-friendly warnings and enables the throwing of exceptions. This is less user friendly, but allows catching exceptions in calling scripts. .EXAMPLE PS C:\> New-AdmfContext -Name 'newContext' Creates a new context named "newContext" .EXAMPLE PS C:\> New-AdmfContext -Name 'Contoso_Baseline' -Store Company -Weight 10 -Author "Sad Joey" -DefaultccessRules -Description "Default baseline for contoso company forests" Creates a new context ... - Named "Contoso_Baseline" - In the context store "Company" - With the weight 10 (very low, causing it to be one of the first to be applied) - By Sad Joey (a great and non-sad person) - that contains the default access rules - has a useful description of what it is for #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseShouldProcessForStateChangingFunctions", "")] [CmdletBinding(DefaultParameterSetName = 'Store')] param ( [Parameter(Mandatory = $true)] [PsfValidatePattern('^[\w\d_\-\.]+$', ErrorString = 'ADMF.Validate.Pattern.ContextName')] [string] $Name, [Parameter(ParameterSetName = 'Store')] [PsfValidateSet(TabCompletion = 'ADMF.Context.Store')] [string] $Store = 'Default', [Parameter(ParameterSetName = 'Path')] [PsfValidateScript('ADMF.Validate.Path.Folder', ErrorString = 'ADMF.Validate.Path.Folder')] [string] $OutPath, [int] $Weight = 50, [string] $Description = "<Insert description-text here>", [string] $Author = "<Insert your name here>", [string] $Group = 'Default', [string[]] $Prerequisite = @(), [string[]] $MutuallyExclusive = @(), [switch] $DefaultAccessRules, [ValidateSet('None', 'Default', 'SplitPermission')] [string] $ExchangeAccessRules = 'None', [switch] $Force, [switch] $EnableException ) begin { if ($OutPath) { $resolvedPath = Resolve-PSFPath -Provider FileSystem -Path $OutPath -SingleItem if (-not $Force -and (Test-Path -Path "$resolvedPath\$Name")) { Stop-PSFFunction -String 'New-AdmfContext.Context.AlreadyExists' -StringValues $resolvedPath, $Name -EnableException $EnableException -Category InvalidArgument -Cmdlet $PSCmdlet return } } else { $storeObject = Get-AdmfContextStore -Name $Store if (-not $Force -and (Test-Path -Path "$($storeObject.Path)\$Name")) { Stop-PSFFunction -String 'New-AdmfContext.Context.AlreadyExists2' -StringValues $Store, $Name -EnableException $EnableException -Category InvalidArgument -Cmdlet $PSCmdlet return } if (-not (Test-Path -Path $storeObject.Path)) { $null = New-Item -Path $storeObject.Path -ItemType Directory -Force } $resolvedPath = Resolve-PSFPath -Provider FileSystem -Path $storeObject.Path -SingleItem } } process { if (Test-PSFFunctionInterrupt) { return } # This can only be $true when -Force was used, as otherwise it would fail in begin if (Test-Path -Path "$resolvedPath\$Name") { Remove-Item -Path "$resolvedPath\$Name" -Recurse -Force } $contextFolder = New-Item -Path $resolvedPath -Name $Name -ItemType Directory $contextVersionFolder = New-Item -Path $contextFolder.FullName -Name '1.0.0' -ItemType Directory Copy-Item -Path "$script:ModuleRoot\internal\data\context\*" -Destination "$($contextVersionFolder.FullName)\" -Recurse #region Default Access Rules if ($DefaultAccessRules){ Copy-Item -Path "$script:ModuleRoot\internal\data\domainDefaults\accessRules\*.json" -Destination "$($contextVersionFolder.FullName)\domain\accessrules\" Copy-Item -Path "$script:ModuleRoot\internal\data\domainDefaults\objectCategories\*.psd1" -Destination "$($contextVersionFolder.FullName)\domain\objectcategories\" Copy-Item -Path "$script:ModuleRoot\internal\data\domainDefaults\gppermissions\*.json" -Destination "$($contextVersionFolder.FullName)\domain\gppermissions\" Copy-Item -Path "$script:ModuleRoot\internal\data\domainDefaults\gppermissionfilters\*.json" -Destination "$($contextVersionFolder.FullName)\domain\gppermissionfilters\" Copy-Item -Path "$script:ModuleRoot\internal\data\forestDefaults\schemaDefaultPermissions\*.json" -Destination "$($contextVersionFolder.FullName)\forest\schemaDefaultPermissions\" } #endregion Default Access Rules #region Exchange Access Rules switch ($ExchangeAccessRules) { 'Default' { Copy-Item -Path "$script:ModuleRoot\internal\data\exchangeDefaults\accessRules\*.json" -Destination "$($contextVersionFolder.FullName)\domain\accessrules\" } 'SplitPermission' { Copy-Item -Path "$script:ModuleRoot\internal\data\exchangeSPDefaults\accessRules\*.json" -Destination "$($contextVersionFolder.FullName)\domain\accessrules\" } } #endregion Exchange Access Rules $contextJson = [pscustomobject]@{ Version = '1.0.0' Weight = $Weight Description = $Description Author = $Author Prerequisites = $Prerequisite MutuallyExclusive = $MutuallyExclusive Group = $Group } $contextJson | ConvertTo-Json | Set-Content -Path "$($contextVersionFolder.FullName)\context.json" Get-AdmfContext -Name $Name -Store $Store } } function New-AdmfContextModule { <# .SYNOPSIS Create an ADMF Client PowerShell module. .DESCRIPTION Create an ADMF Client PowerShell module. Specify which contexts to use from a repository to which they have previously been published. It will then dynamically create a PowerShell module containing all contexts and their dependencies and publish them under its own Context store once imported. .PARAMETER Name Name of the contexts to include. Supports plain "Name" or the PowerShell module notation. Examples: "Default" @{ ModuleName = 'SecBaseline' } @{ ModuleName = 'SecBaseline'; ModuleVersion = '2.0.0' } @{ ModuleName = 'SecBaseline'; RequiredVersion = '2.3.1' } .PARAMETER Repository Name of the repository to download from. .PARAMETER Path Path where to write the finished module to. .PARAMETER ModuleName Name of the module to generate. .PARAMETER ModuleOption Additional options to include in the module code when generating the module. Confirm: Injects all ADMF component modules with the requirement to confirm all changes. .PARAMETER AliasPrefix Create aliases for the common ADMF commands. This simplifies guiding users into loading the module containing their configuration settings. Rather than having them run Test-ADMFDomain, you could have them run Test-ConDomain, which would then implicitly load the generated module and make the contexts available, without having to first manually import the module generated. .PARAMETER ModuleVersion The version of the module to generate. Defaults to 1.0.0 .PARAMETER Credential Credentials to use for accessing the powershell repository. .PARAMETER ModuleCode Additional code to iunclude in the module generated .PARAMETER GetV3 Use PowerShellGet V3 or later. Defaults to the configuration setting of ADMF.PowerShellGet.UseV3. .EXAMPLE PS C:\> New-AdmfContextModule -Name Default -Repository Contoso -Path . -ModuleName Whatever -ModuleOption Confirm -AliasPrefix WE Retrieves the "Default" context from the "Contoso" repository. It will then wrap it into a module named "Whatever", injecting a requirement to confirm all changes and include aliases for the common ADMF commands with the WE prefix (e.g. Test-WEDomain) #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseShouldProcessForStateChangingFunctions", "")] [CmdletBinding()] param ( [Parameter(Mandatory = $true)] $Name, [Parameter(Mandatory = $true)] [string] $Repository, [Parameter(Mandatory = $true)] [string] $Path, [Parameter(Mandatory = $true)] [string] $ModuleName, [ValidateSet('Confirm')] [string[]] $ModuleOption = 'Confirm', [string] $AliasPrefix, [version] $ModuleVersion = '1.0.0', [PSCredential] $Credential, [ScriptBlock] $ModuleCode, [switch] $GetV3 ) trap { Remove-PSFTempItem -ModuleName ADMF -Name * throw $_ } # Resolve Target Module Names / Versions $modules = foreach ($entry in $Name) { if ($entry -is [string]) { @{ Name = $entry } } else { $entry | ConvertTo-PSFHashtable Name, ModuleVersion, RequiredVersion } } foreach ($module in $modules) { if ($module.Name -notlike 'ADMF.Context.*') { $module.Name = "ADMF.Context.$($module.Name)" } if ($GetV3) { $module.Remove('ModuleVersion') if ($module.RequiredVersion) { $module.Version = $module.RequiredVersion $module.Remove('RequiredVersion') } } else { if ($module.ModuleVersion) { $module.MinimumVersion = $module.ModuleVersion $module.Remove('ModuleVersion') } } } # Create TEMP folder and deploy them from repository $folder = New-PSFTempDirectory -Name contextpath -ModuleName ADMF $moduleParam = $PSBoundParameters | ConvertTo-PSFHashtable -Include Repository, Credential foreach ($module in $modules) { if ($GetV3) { Save-PSResource @moduleParam @module -Path $folder } else { Save-Module @moduleParam @module -Path $folder } } # Create Module & Copy Contexts $moduleRoot = New-PSFTempDirectory -Name moduleroot -ModuleName ADMF -DirectoryName $ModuleName $manifest = @{ Path = "$moduleRoot\$ModuleName.psd1" ModuleVersion = $ModuleVersion RootModule = "$ModuleName.psm1" FunctionsToExport = @() CmdletsToExport = @() AliasesToExport = @() VariablesToExport = @() } if ($AliasPrefix) { $manifest.AliasesToExport = "Invoke-$($aliasPrefix)Forest", "Invoke-$($aliasPrefix)Domain", "Invoke-$($aliasPrefix)DC", "Invoke-$($aliasPrefix)Item", "Test-$($aliasPrefix)Domain", "Test-$($aliasPrefix)DC", "Test-$($aliasPrefix)Forest" } New-ModuleManifest @manifest $null = New-Item -Path $moduleRoot -Name "$ModuleName.psm1" -ItemType File $contextRoot = New-Item -Path $moduleRoot -Name Contexts -ItemType Directory $contextConfig = Get-Item -Path "$folder/*/*/*/*/context.json" $contextPaths = $contextConfig.FullName | Split-Path | Split-Path | Sort-Object -Unique foreach ($contextPath in $contextPaths) { Copy-Item -Path $contextPath -Destination $contextRoot.FullName -Recurse -Force } # Add module content $content = @() ## Register Context Store $content += "Set-PSFConfig -FullName 'ADMF.Context.Store.$ModuleName' -Value `"`$PSScriptRoot\Contexts`"" ## Confirm Preference if ($ModuleOption -contains 'Confirm') { $content += @' # Confirm by default & (Get-Module DCManagement) { $script:ConfirmPreference = 'Low' } & (Get-Module DomainManagement) { $script:ConfirmPreference = 'Low' } & (Get-Module ForestManagement) { $script:ConfirmPreference = 'Low' } '@ } ## Add Alias for the ADMF Commands if ($AliasPrefix) { $content += "`$aliasPrefix = '$aliasPrefix'" $content += @' # Set Aliases for module $aliases = @{ 'Invoke-AdmfDC' = "Invoke-$($aliasPrefix)DC" 'Invoke-AdmfDomain' = "Invoke-$($aliasPrefix)Domain" 'Invoke-AdmfForest' = "Invoke-$($aliasPrefix)Forest" 'Invoke-AdmfItem' = "Invoke-$($aliasPrefix)Item" 'Test-AdmfDC' = "Test-$($aliasPrefix)DC" 'Test-AdmfDomain' = "Test-$($aliasPrefix)Domain" 'Test-AdmfForest' = "Test-$($aliasPrefix)Forest" } foreach ($pair in $aliases.GetEnumerator()) { Set-Alias -Name $pair.Value -Value $pair.Key } '@ } ## Add Custom Code if ($ModuleCode) { $content += $ModuleCode.ToString() } $content | Set-Content -Path "$moduleRoot\$ModuleName.psm1" # Copy to destination Copy-Item -Path $moduleRoot -Destination $Path -Recurse Remove-PSFTempItem -ModuleName ADMF -Name * } function New-AdmfContextStore { <# .SYNOPSIS Creates a new Context Store. .DESCRIPTION Creates a new Context Store. Context Stores are locations where configuration contexts are stored and retrieved from. These contexts are stored using the PSFramework configuration system: https://psframework.org/documentation/documents/psframework/configuration.html Making it possible to deploy them using GPO, SCCM or other computer or profile management solutions. .PARAMETER Name The name of the store to create. Must not exist yet. .PARAMETER Path The path where the context is pointing at. Must be an existing folder. .PARAMETER Scope Where to persist the store. by default, this is stored in HKCU, making the store persistently available to the user. For more information on scopes, and what location they corespond with, see: https://psframework.org/documentation/documents/psframework/configuration/persistence-location.html .PARAMETER EnableException This parameters disables user-friendly warnings and enables the throwing of exceptions. This is less user friendly, but allows catching exceptions in calling scripts. .EXAMPLE PS C:\> New-AdmfContextStore -Name 'company' -Path '\\contoso\system\ad\contexts' Creates a new context named 'company', pointing at '\\contoso\system\ad\contexts' #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseShouldProcessForStateChangingFunctions", "")] [CmdletBinding()] param ( [Parameter(Mandatory = $true)] [PsfValidateScript('ADMF.Validate.ContextStore.ExistsNot', ErrorString = 'ADMF.Validate.ContextStore.ExistsNot')] [PsfValidatePattern('^[\w\d_\-\.]+$', ErrorString = 'ADMF.Validate.Pattern.ContextStoreName')] [string] $Name, [Parameter(Mandatory = $true)] [PsfValidateScript('ADMF.Validate.Path.Folder', ErrorString = 'ADMF.Validate.Path.Folder')] [string] $Path, [PSFramework.Configuration.ConfigScope] $Scope = "UserDefault", [switch] $EnableException ) process { $resolvedPath = Resolve-PSFPath -Path $Path -Provider FileSystem -SingleItem Set-PSFConfig -FullName "ADMF.Context.Store.$Name" -Value $resolvedPath Register-PSFConfig -FullName "ADMF.Context.Store.$Name" -Scope $Scope -EnableException:$EnableException } } function Publish-AdmfContext { <# .SYNOPSIS Publishes a Context as a PowerShell Package. .DESCRIPTION Publishes a Context as a PowerShell Package. This wraps a Context as its own PowerShell module named "ADMF.Context.<ContextName>". It uses the version number in the context.json for the module version. All dependent contexts are declared as a module dependency following the same naming scheme. .PARAMETER Path Path to the Context to publish. .PARAMETER Name Name of the Context to publish. Will search known Context stores for available Contexts. .PARAMETER Store Store to search for the Context to publish. Will search all stores if not otherwise specified. .PARAMETER Version Version of the Context to publish. Will publish the latest version if not specified. .PARAMETER Repository Repository to publish the Context to. .PARAMETER ApiKey API Key of the repository to publish to. Defaults to "Whatever" .PARAMETER GetV3 Use PowerShellGet V3 or later. Defaults to the configuration setting of ADMF.PowerShellGet.UseV3. .EXAMPLE PS C:\> Publish-AdmfContext -Path 'C:\ADMF\Default\1.0.0' -Repository Contoso Publishes the "Default" Context to the Contoso repository #> [CmdletBinding()] param ( [Parameter(Mandatory = $true, ParameterSetName = 'Path')] [string] $Path, [Parameter(Mandatory = $true, ParameterSetName = 'Store')] [string] $Name, [Parameter(ParameterSetName = 'Store')] [string] $Store, [Parameter(ParameterSetName = 'Store')] [version] $Version, [Parameter(Mandatory = $true)] [string] $Repository, [string] $ApiKey = 'whatever', [switch] $GetV3 = (Get-PSFConfigValue -FullName ADMF.PowerShellGet.UseV3 -Fallback $false) ) begin { function ConvertTo-Prerequisite { [OutputType([hashtable])] [CmdletBinding()] param ( [Parameter(ValueFromPipeline = $true)] $InputObject ) process { if ($InputObject -is [string]) { return @{ ModuleName = $InputObject } } $InputObject | ConvertTo-PSFHashtable -Include ModuleName, ModuleVersion, RequiredVersion } } } process { trap { Remove-PSFTempItem -ModuleName ADMF -Name * if ($originalPath) { $env:PSModulePath = $originalPath } throw $_ } # Determine Path switch ($PSCmdlet.ParameterSetName) { Path { $contextRoot = $Path } Store { $param = @{ Name = $Name All = $true } if ($Store) { $param.Store = $Store } $context = Get-AdmfContext @param | Where-Object Name -EQ $Name if ($Version) { $context = $context | Where-Object Version -EQ $Version } $context = $context | Sort-Object Version -Descending | Select-Object -First 1 $contextRoot = $context.Path } } # Determine Name, Author, Description, Version & Dependencies $ctxName = Split-Path (Split-Path $contextRoot) -Leaf $configFile = Join-Path $contextRoot 'context.json' $config = Import-PSFPowerShellDataFile -Path $configFile if ($config.Name) { $ctxName = $config.Name } $ctxDescription = $config.Description $ctxAuthor = $config.Author $ctxVersion = $config.Version $requirements = $config.Prerequisites | ForEach-Object { @{ ModuleName = "ADMF.Context.$_" ModuleVersion = '1.0.0' # RequiredVersion = $null } } if ($config.Requirements) { $requirements = $config.Requirements } # Build Dynamic Module $moduleName = "ADMF.Context.$ctxName" $folder = New-PSFTempDirectory -Name context -ModuleName ADMF -DirectoryName $moduleName $null = New-Item -Path $folder -Name "$moduleName.psm1" -ItemType File $param = @{ Path = "$folder\$moduleName.psd1" RootModule = "$moduleName.psm1" Author = $ctxAuthor Description = $ctxDescription ModuleVersion = $ctxVersion FunctionsToExport = @() CmdletsToExport = @() AliasesToExport = @() VariablesToExport = @() } if ($requirements) { $param.RequiredModules = $requirements | ConvertTo-Prerequisite } New-ModuleManifest @param $null = New-Item -Path "$folder\$ctxName\$ctxVersion" -ItemType Directory Copy-Item -Path "$($contextRoot -replace '\\$')\*" -Destination "$folder\$ctxName\$ctxVersion\" -Recurse # Create Temporary Modulepath and prepare dependencies $modulePath = New-PSFTempDirectory -Name modulepath -ModuleName ADMF $originalPath = $env:PSModulePath $env:PSModulePath = '{0};{1}' -f $modulePath, $env:PSModulePath foreach ($requirement in $requirements) { Save-Module -Repository $Repository -Path $modulePath @requirement } # Publish if ($GetV3) { $publish = @{ Repository = $Repository Path = $folder } if ($PSBoundParameters.Keys -contains 'ApiKey') { $publish.APiKey = $ApiKey } Publish-PSResource @publish } else { Publish-Module -Path $folder -Repository $Repository -NuGetApiKey $ApiKey } Remove-PSFTempItem -ModuleName ADMF -Name * $env:PSModulePath = $originalPath } } function Register-AdmfCredentialProvider { <# .SYNOPSIS Registers a credential provider used by the ADMF. .DESCRIPTION Registers a credential provider used by the ADMF. Credential providers are used for translating the credentials to use for all actions performed against active directory. For example, the ADMF could be extended to support a password safe solution: When connecting to a target domain, this provider scriptblock would retrieve the required credentials from a password safe solution. A credential provider consists of two scriptblocks: - A PreScript that is executed before running any commands. It must return either a PSCredential object (if applicable) or $null (if default windows credentials should be used instead). - A PostScript that is executed after all component commands have been executed. It need not return anything. Both scriptblocks receive a single input object, with two properties: - Server: The computer / domain targeted - Credential: The credentials originally provided (if any - this may be $null instead!) .PARAMETER Name The name of the credential provider. Each name must be unique, registering a provider using an existing name overwrites the previous provider. The provider "default" exists as part of ADMF and will be used if no other is specified. Overriding it allows you to change the default provider intentionally, but may remove your ability to NOT use any credential transformations, so use with care. .PARAMETER PreScript The script to execute before performing actions, in order to resolve the correct credentials to use. - If it returns a credential object, this object will be used for authenticating all AD operations (including WinRM against domain controllers!). - If it returns nothing / only non-credential objects, instead the default windows identity of the user is used. .PARAMETER PostScript This script is executed after performing all actions. You can use this optional script to perform any cleanup actions if necessary. .EXAMPLE PS C:\> Register-AdmfCredentialProvider -Name AZKeyVault -PreScript $keyVaultScript Registers the scriptblock defined in $keyVaultScript as "AZKeyVault" provider. #> [CmdletBinding()] param ( [Parameter(Mandatory = $true)] [string] $Name, [Parameter(Mandatory = $true)] [Scriptblock] $PreScript, [Scriptblock] $PostScript ) $script:credentialProviders[$Name] = [PSCustomObject]@{ PSTypeName = 'Admf.CredentialProvider' Name = $Name PreScript = $PreScript PostScript = $PostScript } } function Set-AdmfContext { <# .SYNOPSIS Applies a set of configuration contexts. .DESCRIPTION Applies a set of configuration contexts. This merges the settings from all selected contexts into one configuration set. .PARAMETER Context Name of context or full context object to apply. .PARAMETER Interactive Show an interactive context selection prompt. This is designed for greater convenience when managing many forests. The system automatically uses Set-AdmfContext with this parameter when directly testing or invoking against a new domain without first selecting a context to apply. .PARAMETER ReUse ADMF remembers the last contexts assigned to a specific server/domain. By setting this parameter, it will re-use those contexts, rather than show the prompt again. This parameter is used by the system to prevent prompting automatically on each call. .PARAMETER DefineOnly Do not actually switch configuration sets. Just register the selected Contexts to the target domain, after validating the selection. .PARAMETER Server The server / domain to work with. .PARAMETER Credential The credentials to use for this operation. .PARAMETER DnsDomain The DNS Name of the domain to target. Removes the need for AD Resolution of the domain, potentially speeding up the -DefineOnly workflow. .PARAMETER NoDomain If used against a target without a domain, it will skip AD connect and instead use the server name for Context caching purposes. .PARAMETER EnableException This parameters disables user-friendly warnings and enables the throwing of exceptions. This is less user friendly, but allows catching exceptions in calling scripts. .EXAMPLE PS C:\> Set-AdmfContext -Interactive Interactively pick to select the contexts to apply to the user's own domain. .EXAMPLE PS C:\> Set-AdmfContext -Interactive -Server contoso.com Interactively pick to select the contexts to apply to the contoso.com domain. .EXAMPLE PS C:\> Set-AdmfContext -Context Default, Production, Europe -Server eu.contoso.com Configures the contexts Default, Production and Europe to be applied to eu.contoso.com. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseShouldProcessForStateChangingFunctions", "")] [CmdletBinding(DefaultParameterSetName = 'name')] param ( [Parameter(Mandatory = $true, ValueFromPipeline = $true, ParameterSetName = 'name')] [Alias('Name')] [object[]] $Context, [Parameter(ParameterSetName = 'interactive')] [switch] $Interactive, [switch] $ReUse, [switch] $DefineOnly, [PSFComputer] $Server = $env:USERDNSDOMAIN, [System.Management.Automation.PSCredential] $Credential, [string] $DnsDomain, [Parameter(DontShow = $true)] [switch] $NoDomain, [switch] $EnableException ) begin { #region Utility Functions function Set-Context { [CmdletBinding()] param ( $ContextObject, [string] $Server, [System.Management.Automation.PSCredential] $Credential, [System.Management.Automation.PSCmdlet] $Cmdlet, [bool] $EnableException ) Write-PSFMessage -String 'Set-AdmfContext.Context.Applying' -StringValues $ContextObject.Name -Target $ContextObject $parameters = $PSBoundParameters | ConvertTo-PSFHashtable -Include Server, Credential $stopParam = @{ EnableException = $EnableException Cmdlet = $Cmdlet Target = $ContextObject StepsUpward = 1 } #region PreImport if (Test-Path "$($ContextObject.Path)\preImport.ps1") { try { $null = & "$($ContextObject.Path)\preImport.ps1" @parameters } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.PreImport' -StringValues $ContextObject.Name -ErrorRecord $_ return } } #endregion PreImport #region Forest $forestFields = @{ 'exchangeschema' = Get-Command Register-FMExchangeSchema 'schema' = Get-Command Register-FMSchema 'schemaDefaultPermissions' = Get-Command Register-FMSchemaDefaultPermission 'servers' = Get-Command Register-FMServer 'sitelinks' = Get-Command Register-FMSiteLink 'sites' = Get-Command Register-FMSite 'subnets' = Get-Command Register-FMSubnet } foreach ($key in $forestFields.Keys) { if (-not (Test-Path "$($ContextObject.Path)\forest\$key")) { continue } foreach ($file in (Get-ChildItem "$($ContextObject.Path)\forest\$key\" -Recurse | Where-Object Extension -In ".json", '.psd1')) { Write-PSFMessage -Level Debug -String 'Set-AdmfContext.Context.Loading' -StringValues $ContextObject.Name, $key, $file.FullName try { foreach ($dataSet in (Import-PSFPowerShellDataFile -LiteralPath $file.FullName -Unsafe -ErrorAction Stop | Write-Output | ConvertTo-PSFHashtable -Include $($forestFields[$key].Parameters.Keys))) { if ($forestFields[$key].Parameters.Keys -contains 'ContextName') { $dataSet['ContextName'] = $ContextObject.Name } & $forestFields[$key] @dataSet -ErrorAction Stop } } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.ForestConfig' -StringValues $ContextObject.Name, $key, $file.FullName -ErrorRecord $_ return } } } if (Test-Path "$($ContextObject.Path)\forest\schemaldif") { $filesProcessed = @() #region Process Ldif Configuration foreach ($file in (Get-ChildItem "$($ContextObject.Path)\forest\schemaldif\" -Recurse | Where-Object Extension -In ".json", '.psd1')) { $jsonData = Import-PSFPowerShellDataFile -LiteralPath $file.FullName -Unsafe foreach ($jsonEntry in $jsonData) { $targetPath = Join-Path "$($ContextObject.Path)\forest\schemaldif" $jsonEntry.Path if ($filesProcessed -contains $targetPath) { continue } try { $ldifItem = Get-Item -Path $targetPath -ErrorAction Stop -Force } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.ForestConfig' -StringValues $ContextObject.Name, 'Schema (ldif)', $file.FullName -ErrorRecord $_ return } $ldifParam = @{ Path = $ldifItem.FullName Name = $ldifItem.BaseName ContextName = $ContextObject.Name } if ($jsonEntry.Name) { $ldifParam.Name = $jsonEntry.Name } if ($jsonEntry.Weight) { $ldifParam['Weight'] = $jsonEntry.Weight } if ($jsonEntry.MissingObjectExemption) { $ldifParam['MissingObjectExemption'] = $jsonEntry.MissingObjectExemption } try { Register-FMSchemaLdif @ldifParam -ErrorAction Stop $filesProcessed += $ldifItem.FullName } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.ForestConfig' -StringValues $ContextObject.Name, 'schemaldif', $file.FullName -ErrorRecord $_ return } } } #endregion Process Ldif Configuration #region Process Ldif Files without configuration foreach ($file in (Get-ChildItem "$($ContextObject.Path)\forest\schemaldif\" -Recurse -Filter "*.ldf")) { # Skip files already defined in json if ($filesProcessed -contains $file.FullName) { continue } try { Register-FMSchemaLdif -Name $file.BaseName -Path $file.FullName -ContextName $ContextObject.Name -ErrorAction Stop } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.ForestConfig' -StringValues $ContextObject.Name, 'schemaldif', $file.FullName -ErrorRecord $_ return } } #endregion Process Ldif Files without configuration } # Forest Level $forestLevelPath = Resolve-DataFile -Path "$($ContextObject.Path)\forest\forest_level" if ($forestLevelPath) { $file = Get-Item -Path $forestLevelPath Write-PSFMessage -Level Debug -String 'Set-AdmfContext.Context.Loading' -StringValues $ContextObject.Name, 'ForestLevel', $file.FullName try { $dataSet = Import-PSFPowerShellDataFile -LiteralPath $file.FullName -Unsafe -ErrorAction Stop Register-FMForestLevel -Level $dataSet.Level -ContextName $ContextObject.Name } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.ForestConfig' -StringValues $ContextObject.Name, 'ForestLevel', $file.FullName -ErrorRecord $_ return } } #region NTAuthStore if (Test-Path "$($ContextObject.Path)\forest\ntAuthStore") { foreach ($file in (Get-ChildItem "$($ContextObject.Path)\forest\ntAuthStore" -Recurse -File)) { switch ($file.Extension) { { $_ -in '.json', '.psd1' } { Write-PSFMessage -Level Debug -String 'Set-AdmfContext.Context.Loading' -StringValues $ContextObject.Name, 'NTAuthStore', $file.FullName try { $jsonData = Import-PSFPowerShellDataFile -LiteralPath $file.FullName -Unsafe -ErrorAction Stop if ($jsonData.PSObject.Properties.Name -eq 'Authorative') { Register-FMNTAuthStore -Authorative:$jsonData.Authorative } } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.ForestConfig' -StringValues $ContextObject.Name, 'NTAuthStore', $file.FullName -ErrorRecord $_ return } } '.cer' { Write-PSFMessage -Level Debug -String 'Set-AdmfContext.Context.Loading' -StringValues $ContextObject.Name, 'NTAuthStore', $file.FullName try { $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::CreateFromCertFile($file.FullName) Register-FMNTAuthStore -Certificate $cert } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.ForestConfig' -StringValues $ContextObject.Name, 'NTAuthStore', $file.FullName -ErrorRecord $_ return } } } } } #endregion NTAuthStore #region Certificates if (Test-Path "$($ContextObject.Path)\forest\certificates") { foreach ($file in (Get-ChildItem "$($ContextObject.Path)\forest\certificates" -Recurse -File)) { switch ($file.Extension) { { $_ -in '.json', '.psd1' } { Write-PSFMessage -Level Debug -String 'Set-AdmfContext.Context.Loading' -StringValues $ContextObject.Name, 'Certificates', $file.FullName try { $jsonData = Import-PSFPowerShellDataFile -LiteralPath $file.FullName -Unsafe -ErrorAction Stop foreach ($deletion in $jsonData.Delete) { Register-FMCertificate -Remove $deletion.Thumbprint -Type $deletion.Type } foreach ($addition in $jsonData.Add) { Register-FMCertificate -Certificate ($addition.Certificate | ConvertFrom-PSFClixml) -Type $addition.Type } foreach ($authority in $jsonData.Authority) { Register-FMCertificate -Type $authority.Type -Authorative $authority.Authorative } } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.ForestConfig' -StringValues $ContextObject.Name, 'Certificates', $file.FullName -ErrorRecord $_ return } } '.cer' { Write-PSFMessage -Level Debug -String 'Set-AdmfContext.Context.Loading' -StringValues $ContextObject.Name, 'Certificates', $file.FullName try { switch -regex ($file.Name) { '^NTAuthCA' { $type = 'NTAuthCA' } '^RootCA' { $type = 'RootCA' } '^SubCA' { $type = 'SubCA' } '^CrossCA' { $type = 'CrossCA' } '^KRA' { $type = 'KRA' } default { throw "Bad filename, cannot divine certificate type: $($file.Name)" } } $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::CreateFromCertFile($file.FullName) Register-FMCertificate -Certificate $cert -Type $type } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.ForestConfig' -StringValues $ContextObject.Name, 'Certificates', $file.FullName -ErrorRecord $_ return } } } } } #endregion Certificates #endregion Forest #region Domain $domainFields = @{ 'organizationalunits' = Get-Command Register-DMOrganizationalUnit 'accessrules' = Get-Command Register-DMAccessRule 'accessrulemodes' = Get-Command Register-DMAccessRuleMode 'acls' = Get-Command Register-DMAcl 'builtinsids' = Get-Command Register-DMBuiltInSID 'exchange' = Get-Command Register-DMExchange 'gplinks' = Get-Command Register-DMGPLink 'gpowners' = Get-Command Register-DMGPOwner 'gppermissions' = Get-Command Register-DMGPPermission 'gppermissionfilters' = Get-Command Register-DMGPPermissionFilter 'gpregistrysettings' = Get-Command Register-DMGPRegistrySetting 'groups' = Get-Command Register-DMGroup 'groupmemberships' = Get-Command Register-DMGroupMembership 'names' = Get-Command Register-DMNameMapping 'objects' = Get-Command Register-DMObject 'psos' = Get-Command Register-DMPasswordPolicy 'serviceaccounts' = Get-Command Register-DMServiceAccount 'users' = Get-Command Register-DMUser 'wmifilter' = Get-Command Register-DMWmiFilter } foreach ($key in $domainFields.Keys) { if (-not (Test-Path "$($ContextObject.Path)\domain\$key")) { continue } foreach ($file in (Get-ChildItem "$($ContextObject.Path)\domain\$key\" -Recurse | Where-Object Extension -In '.json', '.psd1')) { Write-PSFMessage -Level Debug -String 'Set-AdmfContext.Context.Loading' -StringValues $ContextObject.Name, $key, $file.FullName try { foreach ($dataSet in (Import-PSFPowerShellDataFile -LiteralPath $file.FullName -Unsafe -ErrorAction Stop | Write-Output | ConvertTo-PSFHashtable -Include $($domainFields[$key].Parameters.Keys))) { if ($domainFields[$key].Parameters.Keys -contains 'ContextName') { $dataSet['ContextName'] = $ContextObject.Name } & $domainFields[$key] @dataSet -ErrorAction Stop } } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.DomainConfig' -StringValues $ContextObject.Name, $key, $file.FullName -ErrorRecord $_ return } } } # Group Policy $exportDataPath = Resolve-DataFile -Path "$($ContextObject.Path)\domain\grouppolicies\exportData" if ($exportDataPath) { $file = Get-Item $exportDataPath Write-PSFMessage -Level Debug -String 'Set-AdmfContext.Context.Loading' -StringValues $ContextObject.Name, 'Group Policy', $file.FullName try { $dataSet = Import-PSFPowerShellDataFile -LiteralPath $file.FullName -Unsafe -ErrorAction Stop | ConvertTo-PSFHashtable -Include DisplayName, Description, ID, ExportID, WMiFilter foreach ($policyEntry in $dataSet) { Register-DMGroupPolicy @policyEntry -Path "$($ContextObject.Path)\domain\grouppolicies\$($policyEntry.ID)" -ContextName $ContextObject.Name } } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.DomainConfig' -StringValues $ContextObject.Name, 'Group Policy', $file.FullName -ErrorRecord $_ return } } # Object Categories foreach ($file in (Get-ChildItem "$($ContextObject.Path)\domain\objectcategories" -Filter '*.psd1' -ErrorAction Ignore)) { try { $dataSet = Import-PSFPowerShellDataFile -Path $file.FullName $dataSet.TestScript = $dataSet.TestScript.Invoke() | Write-Output # Remove automatic scriptblock nesting Register-DMObjectCategory @dataSet -ContextName $ContextObject.Name } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.DomainConfig' -StringValues $ContextObject.Name, 'Object Categories', $file.FullName -ErrorRecord $_ return } } # Domain Data foreach ($file in (Get-ChildItem "$($ContextObject.Path)\domain\domaindata" -Filter '*.psd1' -ErrorAction Ignore)) { try { $dataSet = Import-PSFPowerShellDataFile -Path $file.FullName $dataSet.Scriptblock = $dataSet.Scriptblock.Invoke() | Write-Output # Remove automatic scriptblock nesting Register-DMDomainData @dataSet -ContextName $ContextObject.Name } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.DomainConfig' -StringValues $ContextObject.Name, 'Domain Data', $file.FullName -ErrorRecord $_ return } } # Domain Level $domainLevelPath = Resolve-DataFile -Path "$($ContextObject.Path)\domain\domain_level" if ($domainLevelPath) { $file = Get-Item -Path $domainLevelPath Write-PSFMessage -Level Debug -String 'Set-AdmfContext.Context.Loading' -StringValues $ContextObject.Name, 'DomainLevel', $file.FullName try { $dataSet = Import-PSFPowerShellDataFile -LiteralPath $file.FullName -Unsafe -ErrorAction Stop Register-DMDomainLevel -Level $dataSet.Level -ContextName $ContextObject.Name } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.DomainConfig' -StringValues $ContextObject.Name, 'DomainLevel', $file.FullName -ErrorRecord $_ return } } # Content Mode $contentModePath = Resolve-DataFile -Path "$($ContextObject.Path)\domain\content_mode" if ($contentModePath) { $file = Get-Item -Path $contentModePath Write-PSFMessage -Level Debug -String 'Set-AdmfContext.Context.Loading' -StringValues $ContextObject.Name, 'ContentMode', $file.FullName try { $dataSet = Import-PSFPowerShellDataFile -LiteralPath $file.FullName -Unsafe -ErrorAction Stop if ($dataSet.Mode) { Set-DMContentMode -Mode $dataSet.Mode } if ($dataSet.Include) { $includes = @((Get-DMContentMode).Include) foreach ($entry in $dataSet.Include) { $includes += $entry } Set-DMContentMode -Include $includes } if ($dataSet.Exclude) { $excludes = @((Get-DMContentMode).Exclude) foreach ($entry in $dataSet.Exclude) { $excludes += $entry } Set-DMContentMode -Exclude $excludes } if ($dataSet.UserExcludePattern) { $userExcludePatterns = @((Get-DMContentMode).UserExcludePattern) foreach ($entry in $dataSet.UserExcludePattern) { $userExcludePatterns += $entry -replace '%GUID%', '(\{{0,1}([0-9a-fA-F]){8}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){4}-([0-9a-fA-F]){12}\}{0,1})' } Set-DMContentMode -UserExcludePattern $userExcludePatterns } if ($dataSet.Keys -contains 'RemoveUnknownWmiFilter') { Set-DMContentMode -RemoveUnknownWmiFilter $dataSet.RemoveUnknownWmiFilter } } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.DomainConfig' -StringValues $ContextObject.Name, 'ContentMode', $file.FullName -ErrorRecord $_ return } } #endregion Domain #region DC $dcConfigPath = Resolve-DataFile -Path "$($ContextObject.Path)\dc\dc_config" if ($dcConfigPath) { try { $dcData = Import-PSFPowerShellDataFile -LiteralPath $dcConfigPath -Unsafe -ErrorAction Stop } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.DCConfig' -StringValues $ContextObject.Name -ErrorRecord $_ return } if ($null -ne $dcData.NoDNS) { Set-PSFConfig -FullName 'DCManagement.Defaults.NoDNS' -Value $dcData.NoDNS } if ($null -ne $dcData.NoReboot) { Set-PSFConfig -FullName 'DCManagement.Defaults.NoReboot' -Value $dcData.NoReboot } if ($dcData.DatabasePath) { Set-PSFConfig -FullName 'DCManagement.Defaults.DatabasePath' -Value $dcData.DatabasePath } if ($dcData.LogPath) { Set-PSFConfig -FullName 'DCManagement.Defaults.LogPath' -Value $dcData.LogPath } if ($dcData.SysvolPath) { Set-PSFConfig -FullName 'DCManagement.Defaults.SysvolPath' -Value $dcData.SysvolPath } } $dcFields = @{ 'shares' = Get-Command Register-DCShare 'fsaccessrules' = Get-Command Register-DCAccessRule } foreach ($key in $dcFields.Keys) { if (-not (Test-Path "$($ContextObject.Path)\dc\$key")) { continue } foreach ($file in Get-ChildItem "$($ContextObject.Path)\dc\$key\" -Recurse | Where-Object Extension -In ".json", '.psd1') { Write-PSFMessage -Level Debug -String 'Set-AdmfContext.Context.Loading' -StringValues $ContextObject.Name, $key, $file.FullName try { foreach ($dataSet in (Import-PSFPowerShellDataFile -LiteralPath $file.FullName -Unsafe -ErrorAction Stop | Write-Output | ConvertTo-PSFHashtable -Include $($dcFields[$key].Parameters.Keys))) { if ($dcFields[$key].Parameters.Keys -contains 'ContextName') { $dataSet['ContextName'] = $ContextObject.Name } & $dcFields[$key] @dataSet -ErrorAction Stop } } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.ForestConfig' -StringValues $ContextObject.Name, $key, $file.FullName -ErrorRecord $_ return } } } #endregion DC #region PostImport if (Test-Path "$($ContextObject.Path)\postImport.ps1") { try { $null = & "$($ContextObject.Path)\postImport.ps1" @parameters } catch { Clear-AdcConfiguration Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.PostImport' -StringValues $ContextObject.Name -ErrorRecord $_ return } } #endregion PostImport } #endregion Utility Functions $parameters = $PSBoundParameters | ConvertTo-PSFHashtable -Include Server, Credential $selectedContexts = @{ } # Common parameters for Stop-PSFFunction $commonParam = @{ EnableException = $EnableException Continue = $true Cmdlet = $PSCmdlet } if ($NoDomain) { $domain = [pscustomobject]@{ DNSRoot = $Server } return # Ends the current block and moves on to process } if ($DnsDomain) { $domain = [pscustomobject]@{ DNSRoot = $DnsDomain } return # Ends the current block and moves on to process } $adParameters = $parameters.Clone() if (-not $adParameters.Credential) { $adParameters.Remove('Credential') } try { $domain = Get-ADDomain @adParameters -ErrorAction Stop } catch { Stop-PSFFunction -String 'Set-AdmfContext.Domain.AccessError' -StringValues $Server -EnableException $EnableException -ErrorRecord $_ -Cmdlet $PSCmdlet return } } process { if (Test-PSFFunctionInterrupt) { return } #region Explicitly specified contexts foreach ($contextObject in $Context) { if ($contextObject -is [string]) { $foundContext = Get-AdmfContext -Name $contextObject if (-not $foundContext) { Stop-PSFFunction @commonParam -String 'Set-AdmfContext.Context.NotFound' -StringValues $contextObject } if ($foundContext.Count -gt 1) { Stop-PSFFunction @commonParam -String 'Set-AdmfContext.Context.Ambiguous' -StringValues $contextObject, ($foundContext.Name -join ", ") } $selectedContexts[$foundContext.Name] = $foundContext continue } if ($contextObject.PSObject.Typenames -eq 'ADMF.Context') { $selectedContexts[$contextObject.Name] = $contextObject continue } Stop-PSFFunction @commonParam -String 'Set-AdmfContext.Context.InvalidInput' -StringValues $contextObject, $contextObject.GetType().FullName } #endregion Explicitly specified contexts #region Interactively chosen contexts if ($Interactive) { if ($ReUse -and $script:assignedContexts["$($domain.DNSRoot)"]) { foreach ($contextObject in $script:assignedContexts["$($domain.DNSRoot)"]) { $selectedContexts[$contextObject.Name] = $contextObject } return } try { foreach ($contextObject in (Invoke-CallbackMenu @parameters)) { $selectedContexts[$contextObject.Name] = $contextObject } } catch { Stop-PSFFunction -String 'Set-AdmfContext.Interactive.Cancel' -EnableException $EnableException -ErrorRecord $_ return } } #endregion Interactively chosen contexts } end { if (Test-PSFFunctionInterrupt) { return } #region Handle errors in selection $missingPrerequisites = $selectedContexts.Values.Prerequisites | Where-Object { $_ -notin $selectedContexts.Values.Name } if ($missingPrerequisites) { Stop-PSFFunction -String 'Set-AdmfContext.Resolution.MissingPrerequisites' -StringValues ($missingPrerequisites -join ", ") -EnableException $EnableException -Category InvalidData return } $conflictingContexts = $selectedContexts.Values.MutuallyExclusive | Where-Object { $_ -in $selectedContexts.Values.Name } if ($conflictingContexts) { Stop-PSFFunction -String 'Set-AdmfContext.Resolution.ExclusionConflict' -StringValues ($conflictingContexts.Name -join ", ") -EnableException $EnableException -Category InvalidData return } #endregion Handle errors in selection # Do nothing if the currently loaded contexts are equal to the selected ones if ( $script:loadedContexts.Name -and $selectedContexts.Values.Name -and -not (Compare-Object -ReferenceObject $selectedContexts.Values.Name -DifferenceObject $script:loadedContexts.Name) ) { # When switching from one domain to a new one, make sure that the selection is cached, even if it is the same selection. # Otherwise, the second domain will keep reprompting for contexts if (-not $script:assignedContexts["$($domain.DNSRoot)"]) { $script:assignedContexts["$($domain.DNSRoot)"] = $selectedContexts.Values } return } # In Define Only Mode: Register Context to domain and terminate peacefully if ($DefineOnly) { $script:assignedContexts["$($domain.DNSRoot)"] = $selectedContexts.Values | Sort-Object Weight return } # Kill previous configuration $script:loadedContexts = @() Clear-AdcConfiguration Set-PSFTaskEngineCache -Module ADMF -Name currentlyImportingContexts -Value $selectedContexts.Values foreach ($contextObject in ($selectedContexts.Values | Sort-Object Weight)) { if (Test-PSFFunctionInterrupt) { return } Set-Context @parameters -ContextObject $contextObject -Cmdlet $PSCmdlet -EnableException $EnableException if (Test-PSFFunctionInterrupt) { return } } $script:assignedContexts["$($domain.DNSRoot)"] = $selectedContexts.Values | Sort-Object Weight $script:loadedContexts = @($selectedContexts.Values | Sort-Object Weight) Set-PSFTaskEngineCache -Module ADMF -Name currentlyImportingContexts -Value @() } } function Test-AdmfDC { <# .SYNOPSIS Tests whether all DCs in the target domain are in the desired state. .DESCRIPTION Tests whether all DCs in the target domain are in the desired state. .PARAMETER Server The server / domain to work with. .PARAMETER Credential The credentials to use for this operation. .PARAMETER TargetServer The specific server(s) to process. If specified, only listed domain controllers will be affected. Specify the full FQDN of the server. .PARAMETER Options What tests to execute. Defaults to all tests. .PARAMETER CredentialProvider The credential provider to use to resolve the input credentials. See help on Register-AdmfCredentialProvider for details. .PARAMETER ContextPrompt Force displaying the Context selection User Interface. .EXAMPLE PS C:\> Test-AdmfDC Tests the current domain's DCs whether they are compliant with the desired/defined state #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPlainTextForPassword', '')] [CmdletBinding()] param ( [PSFComputer] $Server, [PSCredential] $Credential, [string[]] $TargetServer = @(), [UpdateDCOptions[]] $Options = 'All', [string] $CredentialProvider = 'default', [Alias('Ctx')] [switch] $ContextPrompt ) begin { Reset-DomainControllerCache $parameters = $PSBoundParameters | ConvertTo-PSFHashtable -Include Server, Credential if (-not $Server -and $TargetServer) { $parameters.Server = $TargetServer | Select-Object -First 1 } $originalArgument = Invoke-PreCredentialProvider @parameters -ProviderName $CredentialProvider -Parameter $parameters -Cmdlet $PSCmdlet try { $parameters.Server = Resolve-DomainController @parameters -ErrorAction Stop -Confirm:$false } catch { Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential -Cmdlet $PSCmdlet throw } Invoke-PSFCallback -Data $parameters -EnableException $true -PSCmdlet $PSCmdlet Set-AdmfContext @parameters -Interactive -ReUse:$(-not $ContextPrompt) -EnableException [UpdateDCOptions]$newOptions = $Options } process { try { if ($newOptions -band [UpdateDCOptions]::Share) { if (Get-DCShare) { Write-PSFMessage -Level Host -String 'Test-AdmfDC.Executing.Test' -StringValues 'Shares', $parameters.Server Test-DCShare @parameters -TargetServer $TargetServer } else { Write-PSFMessage -Level Host -String 'Test-AdmfDC.Skipping.Test.NoConfiguration' -StringValues 'Shares' } } if ($newOptions -band [UpdateDCOptions]::FSAccessRule) { if (Get-DCAccessRule) { Write-PSFMessage -Level Host -String 'Test-AdmfDC.Executing.Test' -StringValues 'FSAccessRules', $parameters.Server Test-DCAccessRule @parameters -TargetServer $TargetServer } else { Write-PSFMessage -Level Host -String 'Test-AdmfDC.Skipping.Test.NoConfiguration' -StringValues 'FSAccessRules' } } } catch { throw } finally { Disable-PSFConsoleInterrupt try { Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential -Cmdlet $PSCmdlet } finally { Enable-PSFConsoleInterrupt } } } } function Test-AdmfDomain { <# .SYNOPSIS Tests a domain for its domain level content and whether it matches the desired state. .DESCRIPTION Tests a domain for its domain level content and whether it matches the desired state. Executes a large battery of tests from the DomainManagement module. The desired state is defined using configuration files, which the module handles for the user. .PARAMETER Server The server / domain to work with. .PARAMETER Credential The credentials to use for this operation. .PARAMETER Options Which scan to execute. By default, all tests are run, but it is possibly to selectively choose which to run. .PARAMETER CredentialProvider The credential provider to use to resolve the input credentials. See help on Register-AdmfCredentialProvider for details. .PARAMETER ContextPrompt Force displaying the Context selection User Interface. .EXAMPLE PS C:\> Test-AdmfDomain -Server corp.fabrikam.com Scans the domain corp.fabrikam.com for compliance with the desired state. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPlainTextForPassword', '')] [CmdletBinding()] Param ( [PSFComputer[]] $Server, [PSCredential] $Credential, [UpdateDomainOptions[]] $Options = 'All', [string] $CredentialProvider = 'default', [Alias('Ctx')] [switch] $ContextPrompt ) begin { [UpdateDomainOptions]$newOptions = $Options } process { foreach ($computer in $Server) { Reset-DomainControllerCache $parameters = $PSBoundParameters | ConvertTo-PSFHashtable -Include Credential $parameters.Server = $computer $originalArgument = Invoke-PreCredentialProvider @parameters -ProviderName $CredentialProvider -Parameter $parameters -Cmdlet $PSCmdlet try { $parameters.Server = Resolve-DomainController @parameters -ErrorAction Stop -Confirm:$false } catch { Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential -Cmdlet $PSCmdlet Write-Error $_ continue } Invoke-PSFCallback -Data $parameters -EnableException $true -PSCmdlet $PSCmdlet Set-AdmfContext @parameters -Interactive -ReUse:$(-not $ContextPrompt) -EnableException try { if (($newOptions -band [UpdateDomainOptions]::OUSoft) -or ($newOptions -band [UpdateDomainOptions]::OUHard)) { if (Get-DMOrganizationalUnit) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'OrganizationalUnits', $parameters.Server Test-DMOrganizationalUnit @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'OrganizationalUnits' } } if ($newOptions -band [UpdateDomainOptions]::Group) { if (Get-DMGroup) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'Groups', $parameters.Server Test-DMGroup @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'Groups' } } if ($newOptions -band [UpdateDomainOptions]::User) { if (Get-DMUser) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'Users', $parameters.Server Test-DMUser @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'Users' } } if ($newOptions -band [UpdateDomainOptions]::ServiceAccount) { if (Get-DMServiceAccount) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'ServiceAccounts', $parameters.Server Test-DMServiceAccount @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'ServiceAccounts' } } if ($newOptions -band [UpdateDomainOptions]::GroupMembership) { if (Get-DMGroupMembership) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'GroupMembership', $parameters.Server Test-DMGroupMembership @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'GroupMembership' } } if ($newOptions -band [UpdateDomainOptions]::Acl) { if (Get-DMAcl | Remove-PSFNull) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'Acls', $parameters.Server Test-DMAcl @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'Acls' } } if ($newOptions -band [UpdateDomainOptions]::AccessRule) { if (Get-DMAccessRule) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'AccessRules', $parameters.Server Test-DMAccessRule @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'AccessRules' } } if ($newOptions -band [UpdateDomainOptions]::PSO) { if (Get-DMPasswordPolicy) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'PasswordPolicies', $parameters.Server Test-DMPasswordPolicy @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'PasswordPolicies' } } if ($newOptions -band [UpdateDomainOptions]::Object) { if (Get-DMObject) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'Object', $parameters.Server Test-DMObject @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'Object' } } if ($newOptions -band [UpdateDomainOptions]::WmiFilter) { if (Get-DMWmiFilter) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'WmiFilter', $parameters.Server Test-DMWmiFilter @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'WmiFilter' } } if (($newOptions -band [UpdateDomainOptions]::GroupPolicy) -or ($newOptions -band [UpdateDomainOptions]::GroupPolicyDelete)) { if (Get-DMGroupPolicy) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'GroupPolicies', $parameters.Server Test-DMGroupPolicy @parameters | Where-Object { ($newOptions -band [UpdateDomainOptions]::GroupPolicyDelete) -or ($_.Type -ne 'Delete') } } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'GroupPolicies' } } if ($newOptions -band [UpdateDomainOptions]::GPPermission) { if (Get-DMGPPermission) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'GroupPolicyPermissions', $parameters.Server Test-DMGPPermission @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'GroupPolicyPermissions' } } if ($newOptions -band [UpdateDomainOptions]::GPOwner) { if (Get-DMGPOwner) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'GroupPolicyOwners', $parameters.Server Test-DMGPOwner @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'GroupPolicyOwners' } } if (($newOptions -band [UpdateDomainOptions]::GPLink) -or ($newOptions -band [UpdateDomainOptions]::GPLinkDisable)) { if (Get-DMGPLink) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'GroupPolicyLinks', $parameters.Server Test-DMGPLink @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'GroupPolicyLinks' } } if ($newOptions -band [UpdateDomainOptions]::DomainLevel) { if (Get-DMDomainLevel) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'DomainLevel', $parameters.Server Test-DMDomainLevel @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'DomainLevel' } } if ($newOptions -band [UpdateDomainOptions]::Exchange) { if (Get-DMExchange) { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Executing.Test' -StringValues 'Exchange System Objects', $parameters.Server Test-DMExchange @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfDomain.Skipping.Test.NoConfiguration' -StringValues 'Exchange System Objects' } } } catch { Write-Error $_ continue } finally { Disable-PSFConsoleInterrupt try { Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential -Cmdlet $PSCmdlet } finally { Enable-PSFConsoleInterrupt } } } } } function Test-AdmfForest { <# .SYNOPSIS Tests whether a forest is configured according to baseline configuration .DESCRIPTION Tests whether a forest is configured according to baseline configuration .PARAMETER Server The server / domain to work with. .PARAMETER Credential The credentials to use for this operation. .PARAMETER Options What tests to execute. Defaults to all tests. .PARAMETER CredentialProvider The credential provider to use to resolve the input credentials. See help on Register-AdmfCredentialProvider for details. .PARAMETER ContextPrompt Force displaying the Context selection User Interface. .EXAMPLE PS C:\> Test-AdmfForest Test the current forest for baseline compliance. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPlainTextForPassword', '')] [CmdletBinding()] Param ( [PSFComputer[]] $Server, [PSCredential] $Credential, [UpdateForestOptions[]] $Options = 'All', [string] $CredentialProvider = 'default', [Alias('Ctx')] [switch] $ContextPrompt ) begin { [UpdateForestOptions]$newOptions = $Options } process { foreach ($computer in $Server) { Reset-DomainControllerCache $parameters = $PSBoundParameters | ConvertTo-PSFHashtable -Include Credential $parameters.Server = $computer $originalArgument = Invoke-PreCredentialProvider @parameters -ProviderName $CredentialProvider -Parameter $parameters -Cmdlet $PSCmdlet try { $parameters.Server = Resolve-DomainController @parameters -ErrorAction Stop -Confirm:$false } catch { Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential -Cmdlet $PSCmdlet Write-Error $_ continue } Invoke-PSFCallback -Data $parameters -EnableException $true -PSCmdlet $PSCmdlet Set-AdmfContext @parameters -Interactive -ReUse:$(-not $ContextPrompt) -EnableException try { if ($newOptions -band [UpdateForestOptions]::Sites) { if (Get-FMSite) { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Executing.Test' -StringValues 'Sites', $parameters.Server Test-FMSite @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Sites' } } if ($newOptions -band [UpdateForestOptions]::SiteLinks) { if (Get-FMSiteLink) { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Executing.Test' -StringValues 'Sitelinks', $parameters.Server Test-FMSiteLink @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Sitelinks' } } if ($newOptions -band [UpdateForestOptions]::Subnets) { if (Get-FMSubnet) { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Executing.Test' -StringValues 'Subnets', $parameters.Server Test-FMSubnet @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Subnets' } } if ($newOptions -band [UpdateForestOptions]::ServerRelocate) { # Requires no configuration, so no check for configuration existence required Write-PSFMessage -Level Host -String 'Test-AdmfForest.Executing.Test' -StringValues 'Server Site Assignment', $parameters.Server Test-FMServer @parameters } if ($newOptions -band [UpdateForestOptions]::Schema) { if (Get-FMSchema) { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Executing.Test' -StringValues 'Schema (Custom)', $parameters.Server Test-FMSchema @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Schema (Custom)' } } if ($newOptions -band [UpdateForestOptions]::SchemaDefaultPermissions) { if (Get-FMSchemaDefaultPermission) { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Executing.Test' -StringValues 'Schema Default Permissions', $parameters.Server Test-FMSchemaDefaultPermission @parameters } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Schema Default Permissions' } } if ($newOptions -band [UpdateForestOptions]::SchemaLdif) { if (Get-FMSchemaLdif) { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Executing.Test' -StringValues 'Schema (Ldif)', $parameters.Server Test-FMSchemaLdif @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Schema (Ldif)' } } if ($newOptions -band [UpdateForestOptions]::NTAuthStore) { if (Get-FMNTAuthStore) { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Executing.Test' -StringValues 'NTAuthStore', $parameters.Server Test-FMNTAuthStore @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'NTAuthStore' } } if ($newOptions -band [UpdateForestOptions]::Certificates) { if (Get-FMCertificate) { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Executing.Test' -StringValues 'Certificate', $parameters.Server Test-FMCertificate @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Certificate' } } if ($newOptions -band [UpdateForestOptions]::ForestLevel) { if (Get-FMForestLevel) { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Executing.Test' -StringValues 'ForestLevel', $parameters.Server Test-FMForestLevel @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'ForestLevel' } } if ($newOptions -band [UpdateForestOptions]::ExchangeSchema) { if (Get-FMExchangeSchema) { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Executing.Test' -StringValues 'ExchangeSchema', $parameters.Server Test-FMExchangeSchema @parameters } else { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'ExchangeSchema' } } } catch { Write-Error $_ continue } finally { Disable-PSFConsoleInterrupt try { Invoke-PostCredentialProvider -ProviderName $CredentialProvider -Server $originalArgument.Server -Credential $originalArgument.Credential -Cmdlet $PSCmdlet } finally { Enable-PSFConsoleInterrupt } } } } } Register-PSFConfigValidation -Name "DCSelectionMode" -ScriptBlock { Param ( $Value ) $Result = New-Object PSObject -Property @{ Success = $True Value = $null Message = "" } $legalModes = @( 'Random' 'PDCEmulator' 'Site' ) if ($Value -notin $legalModes) { $Result.Message = "Bad value: $Value is not any of '$($legalModes -join ",")'" $Result.Success = $False return $Result } $Result.Value = $Value -as [string] return $Result } <# This is an example configuration file By default, it is enough to have a single one of them, however if you have enough configuration settings to justify having multiple copies of it, feel totally free to split them into multiple files. #> <# # Example Configuration Set-PSFConfig -Module 'ADMF' -Name 'Example.Setting' -Value 10 -Initialize -Validation 'integer' -Handler { } -Description "Example configuration setting. Your module can then use the setting using 'Get-PSFConfigValue'" #> Set-PSFConfig -Module 'ADMF' -Name 'Import.DoDotSource' -Value $false -Initialize -Validation 'bool' -Description "Whether the module files should be dotsourced on import. By default, the files of this module are read as string value and invoked, which is faster but worse on debugging." Set-PSFConfig -Module 'ADMF' -Name 'Import.IndividualFiles' -Value $false -Initialize -Validation 'bool' -Description "Whether the module files should be imported individually. During the module build, all module code is compiled into few files, which are imported instead by default. Loading the compiled versions is faster, using the individual files is easier for debugging and testing out adjustments." Set-PSFConfig -Module 'ADMF' -Name 'DCSelectionMode' -Value 'PDCEmulator' -Initialize -Validation 'DCSelectionMode' -Description 'When executing commands, specifying the domain name will cause the module to resolve to a single DC to work against. This setting governs the algorythm that determines the DC to work against. Either "PDCEmulator", "Site" or "Random" are valid choices. When using site, specify the "ADMF.DCSelection.Site" setting as well to select the site to prefer.' Set-PSFConfig -Module 'ADMF' -Name 'DCSelection.Site' -Value '' -Initialize -Validation 'stringarray' -Description 'When using the "ADMF.DCSelectionMode" in "Site" mode, specifying this setting will pick the site to chose. If there are multiple DCs in the target site, the PDCEmulator will be preferred if present.' Set-PSFConfig -Module 'ADMF' -Name 'DCSelection.Site.Prioritize' -Value $true -Initialize -Validation bool -Description 'When using the "ADMF.DCSelectionMode" in "Site" mode, this setting governs whether all sites are pooled ($false) or whether processed one after the other until a valid DC has been found ($true).' Set-PSFConfig -Module 'ADMF' -Name 'VerboseExecution' -Value $true -Initialize -Validation bool -Handler { if ($args[0]) { $null = New-PSFMessageLevelModifier -Name ADMF_Verbose -Modifier 0 -IncludeModuleName ADMF } else { $null = New-PSFMessageLevelModifier -Name ADMF_Verbose -Modifier 3 -IncludeModuleName ADMF } } -Description 'Enabling this will cause the ADMF module to be more verbose by default' Set-PSFConfig -Module 'ADMF' -Name 'Context.Store.Default' -Value "$(Get-PSFPath -Name AppData)\ADMF\Contexts" -Initialize -Validation string -Description 'The default path in which ADMF will look for configuration contexts. Add additional such paths by declaring additional settings labeled "ADMF.Context.Store.*"' Set-PSFConfig -Module 'ADMF' -Name 'DCInstall.Context.Prompt.Enable' -Value $true -Initialize -Validation 'bool' -Description "Whether the DC installation commands should generate Context selection prompts." Set-PSFConfig -Module 'ADMF' -Name 'PowerShellGet.UseV3' -Value $false -Initialize -Validation bool -Description 'Whether to use PowerShellGet V3 by default or not.' <# Stored scriptblocks are available in [PsfValidateScript()] attributes. This makes it easier to centrally provide the same scriptblock multiple times, without having to maintain it in separate locations. It also prevents lengthy validation scriptblocks from making your parameter block hard to read. Set-PSFScriptblock -Name 'ADMF.ScriptBlockName' -Scriptblock { } #> Set-PSFScriptblock -Name 'ADMF.Validate.Type.Gpo' -Scriptblock { foreach ($item in $_) { if ( -not ($item -is [Microsoft.GroupPolicy.Gpo]) -or ($item.PSObject.TypeNames -contains 'Microsoft.GroupPolicy.Gpo') ) { return $false } } $true } Set-PSFScriptblock -Name 'ADMF.Validate.Path' -Scriptblock { Test-Path -Path $_ } Set-PSFScriptblock -Name 'ADMF.Validate.Path.Folder' -Scriptblock { $resolvedPath = Resolve-PSFPath -Provider FileSystem -Path $_ -SingleItem Test-Path -Path $resolvedPath -PathType Container } Set-PSFScriptblock -Name 'ADMF.Validate.ContextStore.ExistsNot' -Scriptblock { $_ -notin (Get-AdmfContextStore).Name } <# # Example: Register-PSFTeppScriptblock -Name "ADMF.alcohol" -ScriptBlock { 'Beer','Mead','Whiskey','Wine','Vodka','Rum (3y)', 'Rum (5y)', 'Rum (7y)' } #> Register-PSFTeppScriptblock -Name 'ADMF.Context.Store' -ScriptBlock { (Get-AdmfContextStore).Name } Register-PSFTeppScriptblock -Name 'ADMF.CredentialProvider' -ScriptBlock { $module = Get-Module ADMF if (-not $module) { return } & $module { $script:credentialProviders.Keys } } Register-PSFTeppArgumentCompleter -Command Test-AdmfDomain -Parameter CredentialProvider -Name 'ADMF.CredentialProvider' Register-PSFTeppArgumentCompleter -Command Invoke-AdmfDomain -Parameter CredentialProvider -Name 'ADMF.CredentialProvider' Register-PSFTeppArgumentCompleter -Command Test-AdmfForest -Parameter CredentialProvider -Name 'ADMF.CredentialProvider' Register-PSFTeppArgumentCompleter -Command Invoke-AdmfForest -Parameter CredentialProvider -Name 'ADMF.CredentialProvider' Register-PSFTeppArgumentCompleter -Command Invoke-AdmfItem -Parameter CredentialProvider -Name 'ADMF.CredentialProvider' <# # Example: Register-PSFTeppArgumentCompleter -Command Get-Alcohol -Parameter Type -Name ADMF.alcohol #> Register-PSFTeppArgumentCompleter -Command New-AdmfContext -Parameter Store -Name 'ADMF.Context.Store' New-PSFLicense -Product 'ADMF' -Manufacturer 'Friedrich Weinmann' -ProductVersion $script:ModuleVersion -ProductType Module -Name MIT -Version "1.0.0.0" -Date (Get-Date "2019-12-20") -Text @" Copyright (c) 2019 Friedrich Weinmann Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. "@ # The list of currently applied context sets $script:loadedContexts = @() # The list of contexts per domain/server $script:assignedContexts = @{ } # The list of registered credentials providers $script:credentialProviders = @{ } # Currently resolved domain controller $script:resolvedDomainController = $null $callbackScript = { [CmdletBinding()] param ( [AllowNull()] $Server, [AllowNull()] $Credential, [AllowNull()] $ForestObject, [AllowNull()] $DomainObject ) $parameters = $PSBoundParameters | ConvertTo-PSFHashtable -Include Server, Credential if ($parameters.Server -eq '<Default Domain>') { $parameters.Server = $env:USERDNSDOMAIN } Set-AdmfContext @parameters -Interactive -ReUse -EnableException } Register-DMCallback -Name ADMF -ScriptBlock $callbackScript Register-FMCallback -Name ADMF -ScriptBlock $callbackScript $callbackScript2 = { [CmdletBinding()] param ( [Hashtable] $Data ) # If this is a DC Installation command from DC Management and we disabled the prompt in configuration, stop if ($Data.Data.IsDCInstall -and -not (Get-PSFConfigValue -FullName 'ADMF.DCInstall.Context.Prompt.Enable')) { return } $parameters = $Data.Data | ConvertTo-PSFHashtable -Include Server, Credential if ($parameters.Server -eq '<Default Domain>') { $parameters.Server = $env:USERDNSDOMAIN } if (-not $parameters.Server) { $parameters.Server = $env:USERDNSDOMAIN } Set-AdmfContext @parameters -Interactive -ReUse -EnableException -NoDomain:($Data.Data.IsDCInstall -as [bool]) } Register-PSFCallback -Name 'ADMF.ContextPrompt' -ModuleName DCManagement -CommandName '*' -ScriptBlock $callbackScript2 Set-PSFTypeAlias -Mapping @{ 'UpdateDCOptions' = 'ADMF.UpdateDCOptions' 'UpdateDomainOptions' = 'ADMF.UpdateDomainOptions' 'UpdateForestOptions' = 'ADMF.UpdateForestOptions' } Register-AdmfCredentialProvider -Name default -PreScript { param ( $Data ) $Data.Credential } Set-PSFFeature -Name PSFramework.Stop-PSFFunction.ShowWarning -Value $true -ModuleName ADMF $null = Get-Acl -Path $HOME -ErrorAction Ignore #endregion Load compiled code |