Thomas.will am 12. August 2025 um 17:14 Uhr

2025-08-12T17:14:22Z

Thomas.will am 12. August 2025 um 17:07 Uhr

2025-08-12T17:07:41Z

← Nächstältere Version		Version vom 12. August 2025, 17:07 Uhr
Zeile 102:		Zeile 102:

	Write-Host "`n✅ Fertig. OUs, User, Gruppen, SPN und Kerberos-Audit-GPO sind eingerichtet." -ForegroundColor Green		Write-Host "`n✅ Fertig. OUs, User, Gruppen, SPN und Kerberos-Audit-GPO sind eingerichtet." -ForegroundColor Green
	Write-Host " Auf Member/Client nach Domain-Join: gpupdate /force (oder ~~10–20~~ Min. warten)." -ForegroundColor Yellow		Write-Host " Auf Member/Client nach Domain-Join: gpupdate /force (oder 10-20 Min. warten)." -ForegroundColor Yellow


	</pre>		</pre>

Thomas.will am 12. August 2025 um 16:51 Uhr

2025-08-12T16:51:03Z

Änderungen zeigen

Thomas.will: Die Seite wurde neu angelegt: „

 # === AD-Lab Setup + Kerberos-Audit-GPO (Windows Server 2022 / Domäne lab.int) === # Als Domain Admin auf dem DC ausführen.  Import-Module ActiveDirec…“

2025-08-12T16:47:08Z

Die Seite wurde neu angelegt: „ <pre> # === AD-Lab Setup + Kerberos-Audit-GPO (Windows Server 2022 / Domäne lab.int) === # Als Domain Admin auf dem DC ausführen. Import-Module ActiveDirec…“

Neue Seite

<pre>
# === AD-Lab Setup + Kerberos-Audit-GPO (Windows Server 2022 / Domäne lab.int) ===
# Als Domain Admin auf dem DC ausführen.

Import-Module ActiveDirectory
Import-Module GroupPolicy

$Domain = Get-ADDomain
$DomainDN = $Domain.DistinguishedName
$Pwd = ConvertTo-SecureString '123Start$' -AsPlainText -Force

Write-Host "==> 1) OUs anlegen" -ForegroundColor Cyan
$ous = "Admins","Users","Servers","Workstations","Service Accounts"
foreach ($ou in $ous) {
if (-not (Get-ADOrganizationalUnit -LDAPFilter "(ou=$ou)" -SearchBase $DomainDN -ErrorAction SilentlyContinue)) {
New-ADOrganizationalUnit -Name $ou -Path $DomainDN -ProtectedFromAccidentalDeletion:$false | Out-Null
}
}

Write-Host "==> 2) Gruppen anlegen" -ForegroundColor Cyan
$groups = @(
@{ Name="Share-Readers"; Scope="Global"; Path="OU=Users,$DomainDN" },
@{ Name="Share-Contributors"; Scope="Global"; Path="OU=Users,$DomainDN" }
)
foreach ($g in $groups) {
if (-not (Get-ADGroup -LDAPFilter "(cn=$($g.Name))" -SearchBase $DomainDN -ErrorAction SilentlyContinue)) {
New-ADGroup -Name $g.Name -GroupScope $g.Scope -GroupCategory Security -Path $g.Path | Out-Null
}
}

Write-Host "==> 3) Standard-User anlegen (OU=Users)" -ForegroundColor Cyan
$users = @("alice","bob","charlie")
foreach ($u in $users) {
if (-not (Get-ADUser -Filter "sAMAccountName -eq '$u'" -ErrorAction SilentlyContinue)) {
New-ADUser -Name $u -SamAccountName $u -Path "OU=Users,$DomainDN" `
-AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
}
}

Write-Host "==> 4) Admin-User anlegen (OU=Admins) + Gruppenzuordnung" -ForegroundColor Cyan
if (-not (Get-ADUser -Filter "sAMAccountName -eq 'helpdesk1'" -ErrorAction SilentlyContinue)) {
New-ADUser -Name "helpdesk1" -SamAccountName "helpdesk1" -Path "OU=Admins,$DomainDN" `
-AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
}
if (-not (Get-ADUser -Filter "sAMAccountName -eq 'itadmin'" -ErrorAction SilentlyContinue)) {
New-ADUser -Name "itadmin" -SamAccountName "itadmin" -Path "OU=Admins,$DomainDN" `
-AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
}
# Gruppenmitgliedschaften
Try { Add-ADGroupMember -Identity "Domain Admins" -Members "helpdesk1" -ErrorAction Stop } Catch {}
Try { Add-ADGroupMember -Identity "Server Operators" -Members "itadmin" -ErrorAction Stop } Catch {}
Try { Add-ADGroupMember -Identity "Administrators" -Members "itadmin" -ErrorAction Stop } Catch {} # Builtin\Administrators

Write-Host "==> 5) Service-Account + SPN" -ForegroundColor Cyan
if (-not (Get-ADUser -Filter "sAMAccountName -eq 'svc_web'" -ErrorAction SilentlyContinue)) {
New-ADUser -Name "svc_web" -SamAccountName "svc_web" -Path "OU=Service Accounts,$DomainDN" `
-AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
}
# SPN für den Member-Server (DNS-Name bei Bedarf anpassen)
cmd /c 'setspn -S HTTP/member.lab.int svc_web' | Out-Null

Write-Host "==> 6) Beispiel: Benutzer in Share-Gruppen" -ForegroundColor Cyan
Try { Add-ADGroupMember -Identity "Share-Readers" -Members "alice","charlie" -ErrorAction Stop } Catch {}
Try { Add-ADGroupMember -Identity "Share-Contributors" -Members "bob" -ErrorAction Stop } Catch {}

Write-Host "==> 7) GPO für Kerberos-Auditing erstellen & verlinken" -ForegroundColor Cyan
$gpoName = "LAB Kerberos Auditing"
$gpo = Get-GPO -Name $gpoName -ErrorAction SilentlyContinue
if (-not $gpo) { $gpo = New-GPO -Name $gpoName }

# Domain-Root holen & GPO verlinken (erzwingen)
$domainRoot = ([ADSI]"LDAP://$DomainDN").distinguishedName
if (-not (Get-GPLink -Target "dc=$($Domain.Name),dc=$($Domain.Forest)" -ErrorAction SilentlyContinue | Where-Object {$_.DisplayName -eq $gpoName})) {
New-GPLink -Name $gpo.DisplayName -Target ("LDAP://" + $domainRoot) -Enforced Yes | Out-Null
}

# Advanced Audit Policy via Registry (Success/Failure = 3, nur Success = 1)
# Pfad: HKLM\Software\Policies\Microsoft\Windows\Audit
$AuditKey = "HKLM\Software\Policies\Microsoft\Windows\Audit"
$policies = @(
@{Name="AuditKerberosAuthenticationService"; Value=3}, # 4768
@{Name="AuditKerberosServiceTicketOperations"; Value=3}, # 4769
@{Name="AuditLogon"; Value=1}, # 4624 (nur Success)
@{Name="AuditSpecialLogon"; Value=1} # 4672 (nur Success)
)
foreach ($p in $policies) {
Set-GPRegistryValue -Name $gpoName -Key $AuditKey -ValueName $p.Name -Type DWord -Value $p.Value
}

# Security-Log größer & Überschreiben erlauben (für Lab)
# Pfad: HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
$EventLogKey = "HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security"
Set-GPRegistryValue -Name $gpoName -Key $EventLogKey -ValueName "MaxSize" -Type DWord -Value 131072 # 128 MB (in KB)
Set-GPRegistryValue -Name $gpoName -Key $EventLogKey -ValueName "Retention" -Type DWord -Value 0 # Overwrite as needed

Write-Host "==> 8) GPUpdate anstoßen (DC sofort)" -ForegroundColor Cyan
gpupdate /force | Out-Null

Write-Host "`nFertig: OUs, User, Gruppen, SPN und Kerberos-Audit-GPO sind eingerichtet." -ForegroundColor Green
Write-Host "Hinweis: Auf Member & Client nach dem Domain-Join 'gpupdate /force' ausführen oder 10–20 Min. replizieren lassen." -ForegroundColor Yellow
</pre>

User anlegen dc - Versionsgeschichte

Thomas.will am 12. August 2025 um 17:14 Uhr

Thomas.will am 12. August 2025 um 17:07 Uhr

Thomas.will am 12. August 2025 um 16:51 Uhr

Thomas.will: Die Seite wurde neu angelegt: „
# === AD-Lab Setup + Kerberos-Audit-GPO (Windows Server 2022 / Domäne lab.int) === # Als Domain Admin auf dem DC ausführen. Import-Module ActiveDirec…“