trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

added pre and post checks for installations

Browse Source
This commit is contained in:
hhofs
2018-05-16 14:56:12 +02:00
parent 6f185b558a
commit 387682e809
15 changed files with 336 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
Vagrant/scripts/configure-wef-gpo.ps1
View File

@@ -1,14 +1,71 @@
# Purpose: Installs the GPOs needed to specify a Windows Event Collector and makes certain event channels readable by Event Logger
Write-Host "Importing the GPO to specify the WEF collector"
Import-GPO -BackupGpoName 'Windows Event Forwarding Server' -Path "c:\vagrant\resources\GPO\wef_configuration" -TargetName 'Windows Event Forwarding Server' -CreateIfNeeded
New-GPLink -Name 'Windows Event Forwarding Server' -Target "dc=windomain,dc=local" -Enforced yes
New-GPLink -Name 'Windows Event Forwarding Server' -Target "ou=Domain Controllers,dc=windomain,dc=local" -Enforced yes
$GPOName = 'Windows Event Forwarding Server'
Import-GPO -BackupGpoName $GPOName -Path "c:\vagrant\resources\GPO\wef_configuration" -TargetName $GPOName -CreateIfNeeded
$gpLinks = $null
$OU = "OU=Servers,dc=windomain,dc=local"
$gPLinks = Get-ADOrganizationalUnit -Identity $OU -Properties name,distinguishedName, gPLink, gPOptions
$GPO = Get-GPO -Name $GPOName
If ($gPLinks.LinkedGroupPolicyObjects -notcontains $gpo.path)
{
New-GPLink -Name $GPOName -Target $OU -Enforced yes
}
else
{
Write-Host "GpLink $GPOName already linked on $OU. Moving On."
}
$OU = "ou=Domain Controllers,dc=windomain,dc=local"
$gpLinks = $null
$gPLinks = Get-ADOrganizationalUnit -Identity $OU -Properties name,distinguishedName, gPLink, gPOptions
$GPO = Get-GPO -Name $GPOName
If ($gPLinks.LinkedGroupPolicyObjects -notcontains $gpo.path)
{
New-GPLink -Name $GPOName -Target $OU -Enforced yes
}
else
{
Write-Host "GpLink $GPOName already linked on $OU. Moving On."
}
Write-Host "Importing the GPO to modify ACLs on Custom Event Channels"
Import-GPO -BackupGPOName 'Custom Event Channel Permissions' -Path "c:\vagrant\resources\GPO\wef_configuration" -TargetName 'Custom Event Channel Permissions' -CreateIfNeeded
New-GPLink -Name 'Custom Event Channel Permissions' -Target "dc=windomain,dc=local" -Enforced yes
New-GPLink -Name 'Custom Event Channel Permissions' -Target "ou=Domain Controllers,dc=windomain,dc=local" -Enforced yes
New-GPLink -Name 'Custom Event Channel Permissions' -Target "ou=Servers,dc=windomain,dc=local" -Enforced yes
New-GPLink -Name 'Custom Event Channel Permissions' -Target "ou=Workstations,dc=windomain,dc=local" -Enforced yes
$GPOName = 'Custom Event Channel Permissions'
Import-GPO -BackupGpoName $GPOName -Path "c:\vagrant\resources\GPO\wef_configuration" -TargetName $GPOName -CreateIfNeeded
$gpLinks = $null
$OU = "OU=Servers,dc=windomain,dc=local"
$gPLinks = Get-ADOrganizationalUnit -Identity $OU -Properties name,distinguishedName, gPLink, gPOptions
$GPO = Get-GPO -Name $GPOName
If ($gPLinks.LinkedGroupPolicyObjects -notcontains $gpo.path)
{
New-GPLink -Name $GPOName -Target $OU -Enforced yes
}
else
{
Write-Host "GpLink $GPOName already linked on $OU. Moving On."
}
$OU = "ou=Domain Controllers,dc=windomain,dc=local"
$gPLinks = Get-ADOrganizationalUnit -Identity $OU -Properties name,distinguishedName, gPLink, gPOptions
$GPO = Get-GPO -Name $GPOName
If ($gPLinks.LinkedGroupPolicyObjects -notcontains $gpo.path)
{
New-GPLink -Name $GPOName -Target $OU -Enforced yes
}
else
{
Write-Host "GpLink $GPOName already linked on $OU. Moving On."
}
$OU = "ou=Workstations,dc=windomain,dc=local"
$gPLinks = Get-ADOrganizationalUnit -Identity $OU -Properties name,distinguishedName, gPLink, gPOptions
$GPO = Get-GPO -Name $GPOName
If ($gPLinks.LinkedGroupPolicyObjects -notcontains $gpo.path)
{
New-GPLink -Name $GPOName -Target $OU -Enforced yes
}
else
{
Write-Host "GpLink $GPOName already linked on $OU. Moving On."
}
gpupdate /force
# Enable WinRM
Write-Host "Enabling WinRM"