Damien Coles
f172d00514
Infrastructure-as-code framework for Active Directory objects and Group Policy. Sanitized from production deployment for public sharing.
54 lines
2.5 KiB
PowerShell
54 lines
2.5 KiB
PowerShell
# Default Domain Policy -- Settings Declaration
|
|
# GPO GUID: {31B2F340-016D-11D2-945F-00C04FB984F9} (built-in, same on all domains)
|
|
# Linked to: example.internal (domain root)
|
|
#
|
|
# This GPO controls domain-wide password, account lockout, and Kerberos policies.
|
|
# These settings ONLY take effect at the domain level -- they are ignored in OU-level GPOs.
|
|
|
|
@{
|
|
GPOName = 'Default Domain Policy'
|
|
Description = 'Domain-wide password, account lockout, and Kerberos policies'
|
|
|
|
DisableUserConfiguration = $true
|
|
|
|
# No link management needed -- auto-linked at domain creation
|
|
LinkTo = $null
|
|
|
|
SecurityPolicy = @{
|
|
|
|
'System Access' = [ordered]@{
|
|
# --- Password Policy ---
|
|
MinimumPasswordAge = 1 # Days before password can be changed
|
|
MaximumPasswordAge = 42 # Days before password must be changed
|
|
MinimumPasswordLength = 7 # Minimum characters (consider 14+)
|
|
PasswordComplexity = 1 # 1=Enabled: requires 3 of 4 char types
|
|
PasswordHistorySize = 24 # Previous passwords remembered
|
|
ClearTextPassword = 0 # 0=Disabled: no reversible encryption
|
|
RequireLogonToChangePassword = 0 # 0=Disabled
|
|
ForceLogoffWhenHourExpire = 0 # 0=Disabled: sessions continue after hours expire
|
|
LSAAnonymousNameLookup = 0 # 0=Disabled: block anonymous SID-to-name resolution
|
|
|
|
# --- Account Lockout Policy ---
|
|
LockoutBadCount = 5 # Failed attempts before lockout
|
|
ResetLockoutCount = 30 # Minutes before counter resets
|
|
LockoutDuration = 30 # Minutes account stays locked
|
|
}
|
|
|
|
'Kerberos Policy' = [ordered]@{
|
|
MaxTicketAge = 10 # TGT lifetime in hours
|
|
MaxRenewAge = 7 # TGT max renewal in days
|
|
MaxServiceAge = 600 # Service ticket lifetime in minutes
|
|
MaxClockSkew = 5 # Max clock difference in minutes
|
|
TicketValidateClient = 1 # 1=Enabled: validate client identity
|
|
}
|
|
|
|
'Registry Values' = [ordered]@{
|
|
# Do not store LAN Manager hash -- LM hashes are trivially crackable
|
|
'MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash' = '4,1' # REG_DWORD=1
|
|
}
|
|
}
|
|
|
|
# No registry-based (Administrative Template) settings in this GPO
|
|
RegistrySettings = @()
|
|
}
|