Skip to content

Commit d99f804

Browse files
nikq29Niko Praandree
authored
Added AddsDomainController RODC Password Replication Variables (#209)
* Added AddsDC RODC Password Repl Option * fixed Doc * Fixed HQRM Test Failure --------- Co-authored-by: Niko P <[email protected]> Co-authored-by: Raimund Andrée [MSFT] <[email protected]>
1 parent 91db98b commit d99f804

File tree

4 files changed

+83
-16
lines changed

4 files changed

+83
-16
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,12 @@ The format is based on and uses the types of changes according to [Keep a Change
44
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
55

66
## [Unreleased]
7+
78
### Added
89

910
- AddsDomainController:
1011
- add UnprotectFromAccidentalDeletion to allow dc promote if an existing AD computer account is protected
12+
- AllowPasswordReplication and DenyPasswordReplication Variables for RODCs
1113
- AzureConnectedMachine:
1214
- Composite to install and configure the Azure Connected Machine Agent
1315
- DhcpServerAuthorization:

‎doc/AddsDomainController.adoc‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,18 @@ Set value to 'Default-First-Site-Name' if the Domain Controller shall be added t
8080
| - *False* (default)
8181
- true
8282

83+
| AllowPWReplication
84+
| Mandatory if RODC, DSC will remove all not listet groups if you add them manually in AD.
85+
| String[]
86+
| Specifies an array of names of user accounts, group accounts, and computer accounts whose passwords can be replicated to this Read-Only Domain Controller (RODC).
87+
|
88+
89+
| DenyPWReplication
90+
| Mandatory if RODC, DSC will remove all not listet groups if you add them manually in AD.
91+
| String[]
92+
| Specifies the names of user accounts, group accounts, and computer accounts whose passwords are not to be replicated to this Read-Only Domain Controller (RODC).
93+
|
94+
8395
| IsGlobalCatalog
8496
|
8597
| Boolean
@@ -111,13 +123,30 @@ If the computer acts as domain controller the 'Protect from accidental deletion'
111123
[source, yaml]
112124
----
113125
AddsDomainController:
126+
DomainName: contoso.com
127+
Credential: '[ENC=PE9ian...=]'
128+
SafeModeAdministratorPassword: '[ENC=PE9ian...=]'
129+
LogPath: C:\Windows\Logs
130+
SysvolPath: C:\Windows\SYSVOL
131+
SiteName: London
132+
IsGlobalCatalog: false
133+
IsReadOnlyReplica: true
134+
UnprotectFromAccidentalDeletion: true
135+
InstallationMediaPath: \\Server\Share
136+
137+
AddsDomainController:
114138
DomainName: contoso.com
115139
Credential: '[ENC=PE9ian...=]'
116140
SafeModeAdministratorPassword: '[ENC=PE9ian...=]'
117141
LogPath: C:\Windows\Logs
118142
SysvolPath: C:\Windows\SYSVOL
119143
SiteName: London
120144
IsGlobalCatalog: true
145+
AllowPasswordReplication:
146+
- 'SiteGroup-AllowPasswordReplication'
147+
- 'TestGroup'
148+
DenyPasswordReplication:
149+
- 'SiteGroup-DenyPasswordReplication'
121150
IsReadOnlyReplica: true
122151
UnprotectFromAccidentalDeletion: true
123152
InstallationMediaPath: \\Server\Share

‎source/DSCResources/AddsDomainController/AddsDomainController.schema.psm1‎

Lines changed: 46 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,14 @@ configuration AddsDomainController
3838
[bool]
3939
$IsReadOnlyReplica = $false,
4040

41+
[Parameter()]
42+
[string[]]
43+
$AllowPWReplication,
44+
45+
[Parameter()]
46+
[string[]]
47+
$DenyPWReplication,
48+
4149
[Parameter()]
4250
[bool]
4351
$UnprotectFromAccidentalDeletion = $false,
@@ -50,12 +58,14 @@ configuration AddsDomainController
5058
Import-DscResource -ModuleName PSDesiredStateConfiguration
5159
Import-DscResource -ModuleName ActiveDirectoryDsc
5260

53-
WindowsFeature ADDS {
61+
WindowsFeature ADDS
62+
{
5463
Name = 'AD-Domain-Services'
5564
Ensure = 'Present'
5665
}
5766

58-
WindowsFeature RSATADPowerShell {
67+
WindowsFeature RSATADPowerShell
68+
{
5969
Name = 'RSAT-AD-PowerShell'
6070
Ensure = 'Present'
6171
DependsOn = '[WindowsFeature]ADDS'
@@ -79,7 +89,7 @@ configuration AddsDomainController
7989
{
8090
Get-ADDomainController -Identity $env:ComputerName
8191
Write-Verbose "Computer '$env:ComputerName' is a domain controller. Nothing to do"
82-
return $true
92+
return $true
8393
}
8494
catch
8595
{
@@ -103,16 +113,38 @@ configuration AddsDomainController
103113
$depOn = '[Script]RemoveProtectFromAccidentalDeletionBeforeDcPromo'
104114
}
105115

106-
ADDomainController 'DomainControllerAllProperties' {
107-
DomainName = $DomainName
108-
Credential = $Credential
109-
SafeModeAdministratorPassword = $SafeModeAdministratorPassword
110-
DatabasePath = $DatabasePath
111-
LogPath = $LogPath
112-
SysvolPath = $SysvolPath
113-
SiteName = $SiteName
114-
ReadOnlyReplica = $IsReadOnlyReplica
115-
IsGlobalCatalog = $IsGlobalCatalog
116-
DependsOn = $depOn
116+
if ($IsReadOnlyReplica -eq $false)
117+
{
118+
ADDomainController 'DomainControllerAllProperties'
119+
{
120+
DomainName = $DomainName
121+
Credential = $Credential
122+
SafeModeAdministratorPassword = $SafeModeAdministratorPassword
123+
DatabasePath = $DatabasePath
124+
LogPath = $LogPath
125+
SysvolPath = $SysvolPath
126+
SiteName = $SiteName
127+
ReadOnlyReplica = $IsReadOnlyReplica
128+
IsGlobalCatalog = $IsGlobalCatalog
129+
DependsOn = $depOn
130+
}
131+
}
132+
elseif ($IsReadOnlyReplica -eq $true)
133+
{
134+
ADDomainController 'DomainControllerAllProperties'
135+
{
136+
DomainName = $DomainName
137+
Credential = $Credential
138+
SafeModeAdministratorPassword = $SafeModeAdministratorPassword
139+
DatabasePath = $DatabasePath
140+
LogPath = $LogPath
141+
SysvolPath = $SysvolPath
142+
SiteName = $SiteName
143+
ReadOnlyReplica = $IsReadOnlyReplica
144+
IsGlobalCatalog = $IsGlobalCatalog
145+
AllowPasswordReplicationAccountName = $AllowPWReplication
146+
DenyPasswordReplicationAccountName = $DenyPWReplication
147+
DependsOn = $depOn
148+
}
117149
}
118150
}

‎tests/Unit/DSCResources/Assets/Config/AddsDomainController.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
11
DomainName: contoso.com
22
Credential: '[ENC=PE9ianMgVmVyc2lvbj0iMS4xLjAuMSIgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vcG93ZXJzaGVsbC8yMDA0LzA0Ij4NCiAgPE9iaiBSZWZJZD0iMCI+DQogICAgPFROIFJlZklkPSIwIj4NCiAgICAgIDxUPlN5c3RlbS5NYW5hZ2VtZW50LkF1dG9tYXRpb24uUFNDdXN0b21PYmplY3Q8L1Q+DQogICAgICA8VD5TeXN0ZW0uT2JqZWN0PC9UPg0KICAgIDwvVE4+DQogICAgPE1TPg0KICAgICAgPE9iaiBOPSJLZXlEYXRhIiBSZWZJZD0iMSI+DQogICAgICAgIDxUTiBSZWZJZD0iMSI+DQogICAgICAgICAgPFQ+U3lzdGVtLk9iamVjdFtdPC9UPg0KICAgICAgICAgIDxUPlN5c3RlbS5BcnJheTwvVD4NCiAgICAgICAgICA8VD5TeXN0ZW0uT2JqZWN0PC9UPg0KICAgICAgICA8L1ROPg0KICAgICAgICA8TFNUPg0KICAgICAgICAgIDxPYmogUmVmSWQ9IjIiPg0KICAgICAgICAgICAgPFROUmVmIFJlZklkPSIwIiAvPg0KICAgICAgICAgICAgPE1TPg0KICAgICAgICAgICAgICA8UyBOPSJIYXNoIj44MDg1MzBFQzZDOUMyNENEODIzMjEyMkNBNDAwQUQyQjA4RUYwQTA0QjlGQzM2NUQxOUY1NTY3MjdEQjNDOUJEPC9TPg0KICAgICAgICAgICAgICA8STMyIE49Ikl0ZXJhdGlvbkNvdW50Ij41MDAwMDwvSTMyPg0KICAgICAgICAgICAgICA8QkEgTj0iS2V5Ij5leUt6OUNtWjhFRUoyVmlqR1dhYVVodW9IcEtCeEd6SmZza3F1L3JicWxXZzVoVXkwYWd5QW1xZnI5WWExbDAxPC9CQT4NCiAgICAgICAgICAgICAgPEJBIE49Ikhhc2hTYWx0Ij5nQ3NLTldCTUdRMjF0Smc1QVA1UXcyRGdoWDZpTkx2cy8vZHFQbE5PNExnPTwvQkE+DQogICAgICAgICAgICAgIDxCQSBOPSJTYWx0Ij54OVhLaTVPRVg3SXRsbnQySkRPY0tJdlNZLzN1V2dOQjBjWFpaSitpWjZBPTwvQkE+DQogICAgICAgICAgICAgIDxCQSBOPSJJViI+NUVpcFhyeVBSeDA3dDI2dk1mNGlPR0dURldiT2tzVDdraHRxcjNiM1NsND08L0JBPg0KICAgICAgICAgICAgPC9NUz4NCiAgICAgICAgICA8L09iaj4NCiAgICAgICAgPC9MU1Q+DQogICAgICA8L09iaj4NCiAgICAgIDxCQSBOPSJDaXBoZXJUZXh0Ij54OUp0WXZDbXFKQmpaVitqNmQxK3VUazBEM0FiZ3cvMTRJbk5EMEN2ZXZCVTlkUG5tL091WFR4bWdGVVQzaUlMdGYzRnNxQ0VVc29wYkhSaHBPdjE5dz09PC9CQT4NCiAgICAgIDxCQSBOPSJITUFDIj5pR3FoYkYwR0w5NUF6bDFSTVhMa0twQ2VNRXcwa29QeGtJd1NzMVczWU9vPTwvQkE+DQogICAgICA8UyBOPSJUeXBlIj5TeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uLlBTQ3JlZGVudGlhbDwvUz4NCiAgICA8L01TPg0KICA8L09iaj4NCjwvT2Jqcz4=]'
33
SafeModeAdministratorPassword: '[ENC=PE9ianMgVmVyc2lvbj0iMS4xLjAuMSIgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vcG93ZXJzaGVsbC8yMDA0LzA0Ij4NCiAgPE9iaiBSZWZJZD0iMCI+DQogICAgPFROIFJlZklkPSIwIj4NCiAgICAgIDxUPlN5c3RlbS5NYW5hZ2VtZW50LkF1dG9tYXRpb24uUFNDdXN0b21PYmplY3Q8L1Q+DQogICAgICA8VD5TeXN0ZW0uT2JqZWN0PC9UPg0KICAgIDwvVE4+DQogICAgPE1TPg0KICAgICAgPE9iaiBOPSJLZXlEYXRhIiBSZWZJZD0iMSI+DQogICAgICAgIDxUTiBSZWZJZD0iMSI+DQogICAgICAgICAgPFQ+U3lzdGVtLk9iamVjdFtdPC9UPg0KICAgICAgICAgIDxUPlN5c3RlbS5BcnJheTwvVD4NCiAgICAgICAgICA8VD5TeXN0ZW0uT2JqZWN0PC9UPg0KICAgICAgICA8L1ROPg0KICAgICAgICA8TFNUPg0KICAgICAgICAgIDxPYmogUmVmSWQ9IjIiPg0KICAgICAgICAgICAgPFROUmVmIFJlZklkPSIwIiAvPg0KICAgICAgICAgICAgPE1TPg0KICAgICAgICAgICAgICA8UyBOPSJIYXNoIj44MDg1MzBFQzZDOUMyNENEODIzMjEyMkNBNDAwQUQyQjA4RUYwQTA0QjlGQzM2NUQxOUY1NTY3MjdEQjNDOUJEPC9TPg0KICAgICAgICAgICAgICA8STMyIE49Ikl0ZXJhdGlvbkNvdW50Ij41MDAwMDwvSTMyPg0KICAgICAgICAgICAgICA8QkEgTj0iS2V5Ij5leUt6OUNtWjhFRUoyVmlqR1dhYVVodW9IcEtCeEd6SmZza3F1L3JicWxXZzVoVXkwYWd5QW1xZnI5WWExbDAxPC9CQT4NCiAgICAgICAgICAgICAgPEJBIE49Ikhhc2hTYWx0Ij5nQ3NLTldCTUdRMjF0Smc1QVA1UXcyRGdoWDZpTkx2cy8vZHFQbE5PNExnPTwvQkE+DQogICAgICAgICAgICAgIDxCQSBOPSJTYWx0Ij54OVhLaTVPRVg3SXRsbnQySkRPY0tJdlNZLzN1V2dOQjBjWFpaSitpWjZBPTwvQkE+DQogICAgICAgICAgICAgIDxCQSBOPSJJViI+NUVpcFhyeVBSeDA3dDI2dk1mNGlPR0dURldiT2tzVDdraHRxcjNiM1NsND08L0JBPg0KICAgICAgICAgICAgPC9NUz4NCiAgICAgICAgICA8L09iaj4NCiAgICAgICAgPC9MU1Q+DQogICAgICA8L09iaj4NCiAgICAgIDxCQSBOPSJDaXBoZXJUZXh0Ij54OUp0WXZDbXFKQmpaVitqNmQxK3VUazBEM0FiZ3cvMTRJbk5EMEN2ZXZCVTlkUG5tL091WFR4bWdGVVQzaUlMdGYzRnNxQ0VVc29wYkhSaHBPdjE5dz09PC9CQT4NCiAgICAgIDxCQSBOPSJITUFDIj5pR3FoYkYwR0w5NUF6bDFSTVhMa0twQ2VNRXcwa29QeGtJd1NzMVczWU9vPTwvQkE+DQogICAgICA8UyBOPSJUeXBlIj5TeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uLlBTQ3JlZGVudGlhbDwvUz4NCiAgICA8L01TPg0KICA8L09iaj4NCjwvT2Jqcz4=]'
4-
DatabasePath: C:\Windows\NTDS
54
LogPath: C:\Windows\Logs
65
SysvolPath: C:\Windows\SYSVOL
76
SiteName: London
87
IsGlobalCatalog: true
9-
IsReadOnlyReplica: false
8+
AllowPWReplication:
9+
- 'SiteGroup-AllowPasswordReplication'
10+
- 'TestGroup'
11+
DenyPWReplication:
12+
- 'SiteGroup-DenyPasswordReplication'
13+
IsReadOnlyReplica: true
1014
UnprotectFromAccidentalDeletion: true
1115
InstallationMediaPath: \\Server\Share

0 commit comments

Comments
 (0)