User anlegen dc - Versionsgeschichte

Thomas.will am 12. August 2025 um 17:14 Uhr

2025-08-12T17:14:22Z

Thomas.will am 12. August 2025 um 17:07 Uhr

2025-08-12T17:07:41Z

Thomas.will am 12. August 2025 um 16:51 Uhr

2025-08-12T16:51:03Z

Thomas.will: Die Seite wurde neu angelegt: „

 # === AD-Lab Setup + Kerberos-Audit-GPO (Windows Server 2022 / Domäne lab.int) === # Als Domain Admin auf dem DC ausführen.  Import-Module ActiveDirec…“

2025-08-12T16:47:08Z

Die Seite wurde neu angelegt: „ <pre> # === AD-Lab Setup + Kerberos-Audit-GPO (Windows Server 2022 / Domäne lab.int) === # Als Domain Admin auf dem DC ausführen. Import-Module ActiveDirec…“

Neue Seite

<pre>
# === AD-Lab Setup + Kerberos-Audit-GPO (Windows Server 2022 / Domäne lab.int) ===
# Als Domain Admin auf dem DC ausführen.

Import-Module ActiveDirectory
Import-Module GroupPolicy

$Domain = Get-ADDomain
$DomainDN = $Domain.DistinguishedName
$Pwd = ConvertTo-SecureString '123Start$' -AsPlainText -Force

Write-Host "==> 1) OUs anlegen" -ForegroundColor Cyan
$ous = "Admins","Users","Servers","Workstations","Service Accounts"
foreach ($ou in $ous) {
if (-not (Get-ADOrganizationalUnit -LDAPFilter "(ou=$ou)" -SearchBase $DomainDN -ErrorAction SilentlyContinue)) {
New-ADOrganizationalUnit -Name $ou -Path $DomainDN -ProtectedFromAccidentalDeletion:$false | Out-Null
}
}

Write-Host "==> 2) Gruppen anlegen" -ForegroundColor Cyan
$groups = @(
@{ Name="Share-Readers"; Scope="Global"; Path="OU=Users,$DomainDN" },
@{ Name="Share-Contributors"; Scope="Global"; Path="OU=Users,$DomainDN" }
)
foreach ($g in $groups) {
if (-not (Get-ADGroup -LDAPFilter "(cn=$($g.Name))" -SearchBase $DomainDN -ErrorAction SilentlyContinue)) {
New-ADGroup -Name $g.Name -GroupScope $g.Scope -GroupCategory Security -Path $g.Path | Out-Null
}
}

Write-Host "==> 3) Standard-User anlegen (OU=Users)" -ForegroundColor Cyan
$users = @("alice","bob","charlie")
foreach ($u in $users) {
if (-not (Get-ADUser -Filter "sAMAccountName -eq '$u'" -ErrorAction SilentlyContinue)) {
New-ADUser -Name $u -SamAccountName $u -Path "OU=Users,$DomainDN" `
-AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
}
}

Write-Host "==> 4) Admin-User anlegen (OU=Admins) + Gruppenzuordnung" -ForegroundColor Cyan
if (-not (Get-ADUser -Filter "sAMAccountName -eq 'helpdesk1'" -ErrorAction SilentlyContinue)) {
New-ADUser -Name "helpdesk1" -SamAccountName "helpdesk1" -Path "OU=Admins,$DomainDN" `
-AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
}
if (-not (Get-ADUser -Filter "sAMAccountName -eq 'itadmin'" -ErrorAction SilentlyContinue)) {
New-ADUser -Name "itadmin" -SamAccountName "itadmin" -Path "OU=Admins,$DomainDN" `
-AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
}
# Gruppenmitgliedschaften
Try { Add-ADGroupMember -Identity "Domain Admins" -Members "helpdesk1" -ErrorAction Stop } Catch {}
Try { Add-ADGroupMember -Identity "Server Operators" -Members "itadmin" -ErrorAction Stop } Catch {}
Try { Add-ADGroupMember -Identity "Administrators" -Members "itadmin" -ErrorAction Stop } Catch {} # Builtin\Administrators

Write-Host "==> 5) Service-Account + SPN" -ForegroundColor Cyan
if (-not (Get-ADUser -Filter "sAMAccountName -eq 'svc_web'" -ErrorAction SilentlyContinue)) {
New-ADUser -Name "svc_web" -SamAccountName "svc_web" -Path "OU=Service Accounts,$DomainDN" `
-AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
}
# SPN für den Member-Server (DNS-Name bei Bedarf anpassen)
cmd /c 'setspn -S HTTP/member.lab.int svc_web' | Out-Null

Write-Host "==> 6) Beispiel: Benutzer in Share-Gruppen" -ForegroundColor Cyan
Try { Add-ADGroupMember -Identity "Share-Readers" -Members "alice","charlie" -ErrorAction Stop } Catch {}
Try { Add-ADGroupMember -Identity "Share-Contributors" -Members "bob" -ErrorAction Stop } Catch {}

Write-Host "==> 7) GPO für Kerberos-Auditing erstellen & verlinken" -ForegroundColor Cyan
$gpoName = "LAB Kerberos Auditing"
$gpo = Get-GPO -Name $gpoName -ErrorAction SilentlyContinue
if (-not $gpo) { $gpo = New-GPO -Name $gpoName }

# Domain-Root holen & GPO verlinken (erzwingen)
$domainRoot = ([ADSI]"LDAP://$DomainDN").distinguishedName
if (-not (Get-GPLink -Target "dc=$($Domain.Name),dc=$($Domain.Forest)" -ErrorAction SilentlyContinue | Where-Object {$_.DisplayName -eq $gpoName})) {
New-GPLink -Name $gpo.DisplayName -Target ("LDAP://" + $domainRoot) -Enforced Yes | Out-Null
}

# Advanced Audit Policy via Registry (Success/Failure = 3, nur Success = 1)
# Pfad: HKLM\Software\Policies\Microsoft\Windows\Audit
$AuditKey = "HKLM\Software\Policies\Microsoft\Windows\Audit"
$policies = @(
@{Name="AuditKerberosAuthenticationService"; Value=3}, # 4768
@{Name="AuditKerberosServiceTicketOperations"; Value=3}, # 4769
@{Name="AuditLogon"; Value=1}, # 4624 (nur Success)
@{Name="AuditSpecialLogon"; Value=1} # 4672 (nur Success)
)
foreach ($p in $policies) {
Set-GPRegistryValue -Name $gpoName -Key $AuditKey -ValueName $p.Name -Type DWord -Value $p.Value
}

# Security-Log größer & Überschreiben erlauben (für Lab)
# Pfad: HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
$EventLogKey = "HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security"
Set-GPRegistryValue -Name $gpoName -Key $EventLogKey -ValueName "MaxSize" -Type DWord -Value 131072 # 128 MB (in KB)
Set-GPRegistryValue -Name $gpoName -Key $EventLogKey -ValueName "Retention" -Type DWord -Value 0 # Overwrite as needed

Write-Host "==> 8) GPUpdate anstoßen (DC sofort)" -ForegroundColor Cyan
gpupdate /force | Out-Null

Write-Host "`nFertig: OUs, User, Gruppen, SPN und Kerberos-Audit-GPO sind eingerichtet." -ForegroundColor Green
Write-Host "Hinweis: Auf Member & Client nach dem Domain-Join 'gpupdate /force' ausführen oder 10–20 Min. replizieren lassen." -ForegroundColor Yellow
</pre>

@@ Zeile 2: / Zeile 2: @@
 # ============================================
 # AD-Lab Setup + Kerberos-Audit-GPO (Server 2022)
-# Domäne: lab.int   Passwort: 123Start$
+# Domain: lab.int   Passwort: 123Start$
 # ============================================
@@ Zeile 15: / Zeile 16: @@
 Write-Host "1) OUs anlegen ..." -ForegroundColor Cyan
-$ous = "Admins","Users","Servers","Workstations","Service Accounts"
+# WICHTIG: Keine OU=Users anlegen (CN=Users existiert standardmäßig)
 foreach ($ou in $ous) {
-   if (-not (Get-ADOrganizationalUnit -LDAPFilter "(ou=$ou)" -SearchBase $DomainDN -ErrorAction SilentlyContinue)) {
+   $exists = Get-ADObject -LDAPFilter "(name=$ou)" -SearchBase $DomainDN -ErrorAction SilentlyContinue
      New-ADOrganizationalUnit -Name $ou -Path $DomainDN -ProtectedFromAccidentalDeletion:$false | Out-Null
+   }
@@ Zeile 23: / Zeile 26: @@
 Write-Host "2) Gruppen anlegen ..." -ForegroundColor Cyan
-# Gruppen unter OU=Users (rein fürs Lab)
+$usersOuPath = "OU=Lab Users,$DomainDN"
 $groups = @(
-   @{ Name="Share-Readers";      Scope="Global"; Path="OU=Users,$DomainDN" },
+   @{ Name="Share-Readers";      Scope="Global"; Path=$usersOuPath },
-   @{ Name="Share-Contributors"; Scope="Global"; Path="OU=Users,$DomainDN" }
+   @{ Name="Share-Contributors"; Scope="Global"; Path=$usersOuPath }
+)
 foreach ($g in $groups) {
-   if (-not (Get-ADGroup -LDAPFilter "(cn=$($g.Name))" -SearchBase $DomainDN -ErrorAction SilentlyContinue)) {
+   $exists = Get-ADGroup -LDAPFilter "(cn=$($g.Name))" -SearchBase $g.Path -ErrorAction SilentlyContinue
      New-ADGroup -Name $g.Name -GroupScope $g.Scope -GroupCategory Security -Path $g.Path | Out-Null
+   }
+}
-Write-Host "3) Standard-User (OU=Users) ..." -ForegroundColor Cyan
+Write-Host "3) Standard-User (OU=Lab Users) ..." -ForegroundColor Cyan
 $users = @("alice","bob","charlie")
 foreach ($u in $users) {
-   if (-not (Get-ADUser -Filter "sAMAccountName -eq '$u'" -ErrorAction SilentlyContinue)) {
+   $exists = Get-ADUser -Filter "sAMAccountName -eq '$u'" -ErrorAction SilentlyContinue
-     New-ADUser -Name $u -SamAccountName $u -Path "OU=Users,$DomainDN" `
+  if (-not $exists) {
        -AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
+   }
@@ Zeile 44: / Zeile 49: @@
 Write-Host "4) Admin-User (OU=Admins) + Rechte ..." -ForegroundColor Cyan
 $admins = @("helpdesk1","itadmin")
 foreach ($a in $admins) {
-   if (-not (Get-ADUser -Filter "sAMAccountName -eq '$a'" -ErrorAction SilentlyContinue)) {
+   $exists = Get-ADUser -Filter "sAMAccountName -eq '$a'" -ErrorAction SilentlyContinue
-     New-ADUser -Name $a -SamAccountName $a -Path "OU=Admins,$DomainDN" `
+  if (-not $exists) {
        -AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
+   }
+}
 $dnDomainAdmins = "CN=Domain Admins,CN=Users,$DomainDN"
 $dnServerOps    = "CN=Server Operators,CN=Builtin,$DomainDN"
@@ Zeile 60: / Zeile 66: @@
 Write-Host "5) Service-Account + SPN ..." -ForegroundColor Cyan
-if (-not (Get-ADUser -Filter "sAMAccountName -eq 'svc_web'" -ErrorAction SilentlyContinue)) {
+$svc = Get-ADUser -Filter "sAMAccountName -eq 'svc_web'" -ErrorAction SilentlyContinue
    New-ADUser -Name "svc_web" -SamAccountName "svc_web" -Path "OU=Service Accounts,$DomainDN" `
      -AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
+}
-# <<< Falls dein Member-Server anders heißt, DIESEN Namen anpassen >>>
+# Hostname ggf. anpassen
-& setspn.exe -S HTTP/member.lab.int svc_web | Out-Null
+$spn = "HTTP/member.lab.int"
 Write-Host "6) Share-Gruppen befüllen ..." -ForegroundColor Cyan
-Try { Add-ADGroupMember -Identity "Share-Readers"      -Members "alice","charlie" } Catch {}
+foreach ($op in @(@{G="Share-Readers";M=@("alice","charlie")}, @{G="Share-Contributors";M=@("bob")})) {
-Try { Add-ADGroupMember -Identity "Share-Contributors" -Members "bob"             } Catch {}
+  foreach ($m in $op.M) { Try { Add-ADGroupMember -Identity $op.G -Members $m } Catch {} }
 Write-Host "7) Kerberos-Audit-GPO erstellen + verlinken ..." -ForegroundColor Cyan
@@ Zeile 75: / Zeile 85: @@
 $gpo = Get-GPO -Name $gpoName -ErrorAction SilentlyContinue
 if (-not $gpo) { $gpo = New-GPO -Name $gpoName }
-# Direkt auf die Domäne verlinken (erzwingen)
+# Advanced Audit Policy
 $AuditKey = "HKLM\Software\Policies\Microsoft\Windows\Audit"
 $policies = @(
-   @{Name="AuditKerberosAuthenticationService";   Value=3},  # 4768
+   @{Name="AuditKerberosAuthenticationService";   Value=3},
-   @{Name="AuditKerberosServiceTicketOperations"; Value=3},  # 4769
+   @{Name="AuditKerberosServiceTicketOperations"; Value=3},
-   @{Name="AuditLogon";                            Value=1},  # 4624 (Success)
+   @{Name="AuditLogon";                            Value=1},
-   @{Name="AuditSpecialLogon";                     Value=1}   # 4672 (Success)
+   @{Name="AuditSpecialLogon";                     Value=1}
+)
 foreach ($p in $policies) {
@@ Zeile 92: / Zeile 103: @@
+}
-# Security-Log größer + überschreiben (Lab)
+# Eventlog: Security
 $EventLogKey = "HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security"
-Set-GPRegistryValue -Name $gpoName -Key $EventLogKey -ValueName "MaxSize"   -Type DWord -Value 131072   # 128 MB (KB)
+Set-GPRegistryValue -Name $gpoName -Key $EventLogKey -ValueName "MaxSize"   -Type DWord -Value 131072
-Set-GPRegistryValue -Name $gpoName -Key $EventLogKey -ValueName "Retention" -Type DWord -Value 0        # Overwrite as needed
+Set-GPRegistryValue -Name $gpoName -Key $EventLogKey -ValueName "Retention" -Type DWord -Value 0
 Write-Host "8) GPUpdate auf dem DC ..." -ForegroundColor Cyan
 gpupdate /force | Out-Null
-Write-Host "`n✅ Fertig. OUs, User, Gruppen, SPN und Kerberos-Audit-GPO sind eingerichtet." -ForegroundColor Green
+Write-Host "`nFertig. OUs, User, Gruppen, SPN und Kerberos-Audit-GPO sind eingerichtet." -ForegroundColor Green
-Write-Host "   Auf Member/Client nach Domain-Join: gpupdate /force (oder 10-20 Min. warten)." -ForegroundColor Yellow
+Write-Host "Auf Member/Client nach Domain-Join: gpupdate /force (oder 10-20 Min. warten)." -ForegroundColor Yellow
 </pre>

@@ Zeile 102: / Zeile 102: @@
 Write-Host "`n✅ Fertig. OUs, User, Gruppen, SPN und Kerberos-Audit-GPO sind eingerichtet." -ForegroundColor Green
-Write-Host "   Auf Member/Client nach Domain-Join: gpupdate /force (oder 10–20 Min. warten)." -ForegroundColor Yellow
+Write-Host "   Auf Member/Client nach Domain-Join: gpupdate /force (oder 10-20 Min. warten)." -ForegroundColor Yellow
 </pre>