Damien Coles
f172d00514
Infrastructure-as-code framework for Active Directory objects and Group Policy. Sanitized from production deployment for public sharing.
93 lines
4.0 KiB
PowerShell
93 lines
4.0 KiB
PowerShell
# Apply-DscBaseline.ps1
|
|
# DC-local compliance validation using DSC.
|
|
#
|
|
# Compiles DSC configurations from settings.ps1 (same source of truth as
|
|
# Apply-GPOBaseline.ps1), then tests local state against the compiled MOF.
|
|
# This script is test-only by design — it never modifies the system.
|
|
# To fix drift, edit settings.ps1 and run Apply-GPOBaseline.ps1.
|
|
#
|
|
# Usage:
|
|
# .\Apply-DscBaseline.ps1 # Check DC compliance (read-only)
|
|
|
|
[CmdletBinding()]
|
|
param()
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
$ScriptRoot = $PSScriptRoot
|
|
$OutputPath = Join-Path $ScriptRoot 'Output'
|
|
|
|
# -------------------------------------------------------------------
|
|
# Load shared helper functions (needed by DSC config files)
|
|
# -------------------------------------------------------------------
|
|
. (Join-Path $ScriptRoot 'lib\GPOHelper.ps1')
|
|
|
|
# -------------------------------------------------------------------
|
|
# Step 1: Ensure SecurityPolicyDsc module is installed
|
|
# -------------------------------------------------------------------
|
|
Write-Host 'Checking for SecurityPolicyDsc module...' -ForegroundColor Cyan
|
|
if (-not (Get-Module -ListAvailable -Name SecurityPolicyDsc)) {
|
|
Write-Host 'Installing SecurityPolicyDsc from PSGallery...' -ForegroundColor Yellow
|
|
Install-Module -Name SecurityPolicyDsc -Repository PSGallery -Force -Scope AllUsers
|
|
Write-Host 'Installed.' -ForegroundColor Green
|
|
} else {
|
|
Write-Host 'SecurityPolicyDsc is already installed.' -ForegroundColor Green
|
|
}
|
|
|
|
# -------------------------------------------------------------------
|
|
# Step 2: Create output directory for compiled MOF files
|
|
# -------------------------------------------------------------------
|
|
if (-not (Test-Path $OutputPath)) {
|
|
New-Item -ItemType Directory -Path $OutputPath | Out-Null
|
|
}
|
|
|
|
# -------------------------------------------------------------------
|
|
# Step 3: Load and compile configurations
|
|
# -------------------------------------------------------------------
|
|
$configurations = @(
|
|
@{
|
|
Name = 'DefaultDomainPolicy'
|
|
Script = Join-Path $ScriptRoot 'default-domain\DefaultDomainPolicy.ps1'
|
|
},
|
|
@{
|
|
Name = 'DefaultDCPolicy'
|
|
Script = Join-Path $ScriptRoot 'default-domain-controller\DefaultDCPolicy.ps1'
|
|
}
|
|
)
|
|
|
|
foreach ($config in $configurations) {
|
|
Write-Host "`nLoading $($config.Name)..." -ForegroundColor Cyan
|
|
. $config.Script
|
|
|
|
$mofOutput = Join-Path $OutputPath $config.Name
|
|
Write-Host "Compiling $($config.Name) -> $mofOutput" -ForegroundColor Cyan
|
|
& $config.Name -OutputPath $mofOutput | Out-Null
|
|
Write-Host "Compiled." -ForegroundColor Green
|
|
}
|
|
|
|
# -------------------------------------------------------------------
|
|
# Step 4: Test compliance
|
|
# -------------------------------------------------------------------
|
|
foreach ($config in $configurations) {
|
|
$mofPath = Join-Path $OutputPath $config.Name
|
|
|
|
Write-Host "`n--- Testing compliance: $($config.Name) ---" -ForegroundColor Yellow
|
|
$result = Test-DscConfiguration -ReferenceConfiguration (Join-Path $mofPath 'localhost.mof')
|
|
if ($result.InDesiredState) {
|
|
Write-Host " [OK] All $($result.ResourcesInDesiredState.Count) resource(s) in desired state" -ForegroundColor Green
|
|
} else {
|
|
Write-Host " [DRIFT] $($result.ResourcesNotInDesiredState.Count) resource(s) out of desired state:" -ForegroundColor Red
|
|
foreach ($resource in $result.ResourcesNotInDesiredState) {
|
|
Write-Host " $($resource.ResourceId)" -ForegroundColor Red
|
|
}
|
|
if ($result.ResourcesInDesiredState.Count -gt 0) {
|
|
Write-Host " [OK] $($result.ResourcesInDesiredState.Count) resource(s) in desired state" -ForegroundColor Green
|
|
}
|
|
}
|
|
}
|
|
|
|
# -------------------------------------------------------------------
|
|
# Step 5: Summary
|
|
# -------------------------------------------------------------------
|
|
Write-Host "`nCompliance test complete. No changes were made." -ForegroundColor Yellow
|
|
Write-Host 'To fix drift, edit settings.ps1 and run Apply-GPOBaseline.ps1.' -ForegroundColor DarkGray
|