Git - moving between commits

 

Git - command to move files between stages

 

Installing AzurePolicyforWindows extension

 Short info for myself: how to install specific extension:

Set-AzVMExtension -ResourceGroupName yourGroup -ResourceName YourServerName `

-Publisher Microsoft.GuestConfiguration -Name AzurePolicyforWindows `

-ExtensionType ConfigurationforWindows -Location westeurope -TypeHandlerVersion 1.1

Set-AzVMExtension -ResourceGroupName yourGroup-ResourceName yourHost `

-Publisher Microsoft.Azure.NetworkWatcher -Type NetworkWatcherAgentWindows `

-TypeHandlerVersion 1.4 -Name "Microsoft.Azure.NetworkWatcher" `

-Location "Central US"

How to update user properties with trusted domains

 Goal for this exercise is to setup a two domain contoso.local and foo.local and manage users in domain contoso using some user in domain foo.local.

First goal is to setup both domains with trust between them, there are plenty of solutions for this on internet.

Overall outcome is:

PS C:\Windows\system32> whoami

foo\vagrant

PS C:\Windows\system32> get-adtrust -Filter *

Direction               : BiDirectional

DisallowTransivity      : False

DistinguishedName       : CN=Contoso.local,CN=System,DC=foo,DC=local

ForestTransitive        : True

IntraForest             : False

IsTreeParent            : False

IsTreeRoot              : False

Name                    : Contoso.local

ObjectClass             : trustedDomain

ObjectGUID              : 4a044679-13b3-456b-8b8b-09a30d9b7252

SelectiveAuthentication : False

SIDFilteringForestAware : False

SIDFilteringQuarantined : False

Source                  : DC=foo,DC=local

Target                  : Contoso.local

TGTDelegation           : False

TrustAttributes         : 8

TrustedPolicy           :

TrustingPolicy          :

TrustType               : Uplevel

UplevelOnly             : False

UsesAESKeys             : False

UsesRC4Encryption       : False

I will use user foo\vagrant to update manager property of user contoso\user.

PS C:\Windows\system32> $u = Get-ADUser -Server dc1 -Filter * -Properties manager | ? name -eq "user"

PS C:\Windows\system32> $u

DistinguishedName : CN=user,OU=People,DC=Contoso,DC=local

Enabled           : True

GivenName         : user

Manager           :

Name              : user

ObjectClass       : user

ObjectGUID        : f6380a23-5d28-454f-9978-5455faf94a85

SamAccountName    : user

SID               : S-1-5-21-123626555-3626747555-2727358533-1109

Surname           :

UserPrincipalName : user@Contoso.local

Now another user manager:

PS C:\Windows\system32> $m = Get-ADUser -Server dc1 -Filter * -Properties manager | ? name -eq "manager"

PS C:\Windows\system32> $m

DistinguishedName : CN=Manager,OU=People,DC=Contoso,DC=local

Enabled           : True

GivenName         : Manager

Manager           :

Name              : Manager

ObjectClass       : user

ObjectGUID        : 0abf258d-22b0-4705-b66a-908e5ba2cf4a

SamAccountName    : manager

SID               : S-1-5-21-123626555-3626747555-2727358533-1107

Surname           :

UserPrincipalName : manager@Contoso.local

update manager property:

PS C:\Windows\system32> $u| Set-ADUser -Manager $m

PS C:\Windows\system32> $u = Get-ADUser -Server dc1 -Filter * -Properties manager | ? name -eq "user"

PS C:\Windows\system32> $u

DistinguishedName : CN=user,OU=People,DC=Contoso,DC=local

Enabled           : True

GivenName         : user

Manager           : CN=Manager,OU=People,DC=Contoso,DC=local

Name              : user

ObjectClass       : user

ObjectGUID        : f6380a23-5d28-454f-9978-5455faf94a85

SamAccountName    : user

SID               : S-1-5-21-123626555-3626747555-2727358533-1109

Surname           :

UserPrincipalName : user@Contoso.local

PS C:\Windows\system32> whoami

foo\vagrant

Property Manager is updated.

How to load and execute DLL from Powershell.

Compile using Visual Studio Community following code:

Imports System

Public Module HelloWorld

Sub main()

Console.WriteLine("Hello World Using Visual Basic Code!")

'Msgbox("Hello World from My DotNET Assembly !")

    End Sub

End Module

Execution in Powershell:

$filename = "C:\Users\jarekole\source\repos\ConsoleApp1\ConsoleApp1\bin\Debug\netcoreapp3.1\ConsoleApp1.dll"

$assembly = [Reflection.Assembly]::Loadfile($filename)

$assembly.gettype()

$assembly.fullName

$assembly.gettypes()

$assembly.GetName() |select * | fl

$assembly.GetTypes() | select UnderlyingSystemType 

[ConsoleApp1.HelloWorld]::main()

 Configuring certificate autoenrollment:

New-Item -path HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\ -name AutoEnrollment

New-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\AutoEnrollment\ -Name AEPolicy -Value 7

New-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\AutoEnrollment\ -Name OfflineExpirationPercent -Value 10

New-ItemProperty -Path HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\AutoEnrollment\ -Name OfflineExpirationStoreNames -Value MY

Binding certificate to web size that already has a binding:

Adjust your cert thumbprint

Import-Module WebAdministration

#check validity

Get-Item Cert:\LocalMachine\My\7FCF3A69C4E62637677953CB61F27D669154C6B5 | fl

#set bindings

dir cert:\localmachine\my\7FCF3A69C4E62637677953CB61F27D669154C6B5 | Set-Item IIS:\SslBindings\0.0.0.0!443

domain controller from DSC

Configuration DomainController {
    param
    (
        [Parameter(Mandatory = $true)][PSCredential]$SafeModeCredentials,
        [Parameter(Mandatory = $true)][PSCredential]$VMCredentials,
        [Parameter(Mandatory = $true)][PSCredential]$DomainAdministratorCredentials,
        [Parameter(Mandatory = $true)][string]$AdministratorAccount,
       
        [Parameter(Mandatory = $true)][string]$FirstDomainControllerName,
        #[Parameter(Mandatory = $true)][string]$SecondDomainControllerIPAddress,
        #[Parameter(Mandatory = $true)][string]$GatewayAddress,
        #[Parameter(Mandatory = $true)][string]$SubnetMask,
        [Parameter(Mandatory = $true)][string]$DomainName,
        [Parameter(Mandatory = $true)][string]$DomainDnsName
    )
    Import-Module PSDesiredStateConfiguration
    Import-Module xActiveDirectory
    Import-Module xNetworking

    Import-DscResource -ModuleName PSDesiredStateConfiguration
    Import-DscResource -ModuleName xActiveDirectory
    Import-DscResource -ModuleName xNetworking

   
    Node $FirstDomainControllerName {

       

        File ADFiles {
            DestinationPath = 'C:\NTDS'
            Type = 'Directory'
            Ensure = 'Present'
        }

        WindowsFeature DNS {
            Ensure = "Present"
            Name = "DNS"
        }



        xDnsServerAddress DnsServerAddress {
            Address= '127.0.0.1'
            InterfaceAlias = 'Ethernet'
            AddressFamily  = 'IPv4'
            DependsOn = "[WindowsFeature]DNS"
        }
        WindowsFeature AD-Domain-Services {
            Ensure = "Present"
            Name = "AD-Domain-Services"
            DependsOn = "[File]ADFiles"
        }

        # These RSAT features are optional, but you may want
        #  the admin tools installed locally.
        #WindowsFeature RSAT-DNS-Server {
         #   Ensure = "Present"
         #   Name = "RSAT-DNS-Server"
         #   DependsOn = "[WindowsFeature]DNS"
        #}

        #WindowsFeature RSAT-AD-Tools {
        #    Name = 'RSAT-AD-Tools'
        #    Ensure = 'Present'
        #    DependsOn = "[WindowsFeature]AD-Domain-Services"
        #}

        WindowsFeature RSAT-ADDS {
            Ensure = "Present"
            Name = "RSAT-ADDS"
            DependsOn = "[WindowsFeature]AD-Domain-Services"
        }

        #WindowsFeature RSAT-ADDS-Tools {
        #    Name = 'RSAT-ADDS-Tools'
         #   Ensure = 'Present'
         #   DependsOn = "[WindowsFeature]RSAT-ADDS"
        #}

        #WindowsFeature RSAT-AD-AdminCenter {
        #    Name = 'RSAT-AD-AdminCenter'
        #    Ensure = 'Present'
        #    DependsOn = "[WindowsFeature]AD-Domain-Services"
        #}

        # Here’s where we create the domain.
        # No slash at end of folder paths.
        xADDomain PrimaryDC {
            DomainName = $DomainDnsName
            DomainNetbiosName = $DomainName
            DomainAdministratorCredential = $DomainAdministratorCredentials
            SafemodeAdministratorPassword = $SafeModeCredentials
            #DatabasePath = "C:\NTDS"
            LogPath = "C:\NTDS"
            DependsOn = "[WindowsFeature]AD-Domain-Services"
        }

        # Here’s where we create the alternate administrator account,
        #  and add it to the appropriate groups.
        xADUser AlternateAdminUser {
            DomainName = $DomainDnsName
            UserName = $AdministratorAccount
            Password = $DomainAdministratorCredentials # Uses just the password
            DisplayName = $AdministratorAccount
            PasswordAuthentication = 'Negotiate'
            DomainAdministratorCredential = $DomainAdministratorCredentials
            Ensure = 'Present'
            DependsOn = "[xADDomain]PrimaryDC"
        }

        xADGroup AddAdminToDomainAdminsGroup {
            GroupName = "Domain Admins"
            GroupScope = 'Global'
            Category = 'Security'
            MembersToInclude = @($AdministratorAccount, "Administrator")
            Ensure = 'Present'
            Credential = $DomainAdministratorCredentials
            DependsOn = "[xADUser]AlternateAdminUser"
        }

        xADGroup AddAdminToEnterpriseAdminsGroup {
            GroupName = "Enterprise Admins"
            GroupScope = 'Universal'
            Category = 'Security'
            MembersToInclude = @($AdministratorAccount, "Administrator")
            Ensure = 'Present'
            Credential = $DomainAdministratorCredentials
            DependsOn = "[xADUser]AlternateAdminUser"
        }
    }
}



#</code block>

#Compiling and running the configuration
#Now that the configuration exists, we need to compile it using the specific values we need. After that, we’ll push the configuration to the nodes.

#<code block>

$password = ConvertTo-SecureString 'Pa$$w0rd' -AsPlainText -Force
$password_local = ConvertTo-SecureString 'vagrant' -AsPlainText -Force

$FirstDomainControllerName = 'dc1'

$DomainName = ‘contoso.com’

$DomainDnsName = ‘contoso.com’


# We’ll disable the Administrator account; this is the name of the account that will become the new administrator.

$AdministratorAccount = 'ADifferentUsernameThanAdministrator'


#$VMCredentials = Get-Credential -Message "Enter the local administrator credentials." -UserName "vagrant"
$VMCredentials = New-Object System.Management.Automation.PSCredential ('.\vagrant', $password_local)

# This is where we’ll type in the password of the new administrator account.

#$DomainAdministratorCredentials = Get-Credential -Message "Enter the domain administrator credentials." -UserName ($DomainName + ‘\’ + $AdministratorAccount)
$DomainAdministratorCredentials = New-Object System.Management.Automation.PSCredential ($($DomainName + ‘\’ + $AdministratorAccount), $password)

# This is used just to type in the safe mode password; the username isn’t used.

#$SafeModeCredentials = Get-Credential -Message "Enter the new domain's Safe Mode administrator password." -UserName '(Password Only)'
$SafeModeCredentials = New-Object System.Management.Automation.PSCredential ('(Password Only)', $password)

$cd = @{
    AllNodes = @(   
        @{ 
            NodeName = $FirstDomainControllerName
            PsDscAllowPlainTextPassword = $true
        }
    )
}

DomainController -ConfigurationData $cd -SafeModeCredentials $SafeModeCredentials -VMCredentials $VMCredentials -DomainAdministratorCredentials $DomainAdministratorCredentials -FirstDomainControllerName $FirstDomainControllerName -DomainName $DomainName -DomainDnsName $DomainDnsName -AdministratorAccount 'ADifferentUsernameThanAdministrator'



Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force

$VMSession1 = New-CimSession -Credential $VMCredentials -ComputerName $FirstDomainControllerName -Verbose


Start-DscConfiguration -Path DomainController -CimSession $VMSession1 -Verbose -Wait -Force


you might need to install modules on dc1 first:

Invoke-Command dc1  -Credential $VMCredentials {
Install-Module  xActiveDirectory -force -Confirm:$false
Install-Module  xNetworking -force -Confirm:$false

}