User anlegen dc

# === AD-Lab Setup + Kerberos-Audit-GPO (Windows Server 2022 / Domäne lab.int) ===
# Als Domain Admin auf dem DC ausführen.

Import-Module ActiveDirectory
Import-Module GroupPolicy

$Domain      = Get-ADDomain
$DomainDN    = $Domain.DistinguishedName
$Pwd         = ConvertTo-SecureString '123Start$' -AsPlainText -Force

Write-Host "==> 1) OUs anlegen" -ForegroundColor Cyan
$ous = "Admins","Users","Servers","Workstations","Service Accounts"
foreach ($ou in $ous) {
  if (-not (Get-ADOrganizationalUnit -LDAPFilter "(ou=$ou)" -SearchBase $DomainDN -ErrorAction SilentlyContinue)) {
    New-ADOrganizationalUnit -Name $ou -Path $DomainDN -ProtectedFromAccidentalDeletion:$false | Out-Null
  }
}

Write-Host "==> 2) Gruppen anlegen" -ForegroundColor Cyan
$groups = @(
  @{ Name="Share-Readers";       Scope="Global"; Path="OU=Users,$DomainDN" },
  @{ Name="Share-Contributors";  Scope="Global"; Path="OU=Users,$DomainDN" }
)
foreach ($g in $groups) {
  if (-not (Get-ADGroup -LDAPFilter "(cn=$($g.Name))" -SearchBase $DomainDN -ErrorAction SilentlyContinue)) {
    New-ADGroup -Name $g.Name -GroupScope $g.Scope -GroupCategory Security -Path $g.Path | Out-Null
  }
}

Write-Host "==> 3) Standard-User anlegen (OU=Users)" -ForegroundColor Cyan
$users = @("alice","bob","charlie")
foreach ($u in $users) {
  if (-not (Get-ADUser -Filter "sAMAccountName -eq '$u'" -ErrorAction SilentlyContinue)) {
    New-ADUser -Name $u -SamAccountName $u -Path "OU=Users,$DomainDN" `
      -AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
  }
}

Write-Host "==> 4) Admin-User anlegen (OU=Admins) + Gruppenzuordnung" -ForegroundColor Cyan
if (-not (Get-ADUser -Filter "sAMAccountName -eq 'helpdesk1'" -ErrorAction SilentlyContinue)) {
  New-ADUser -Name "helpdesk1" -SamAccountName "helpdesk1" -Path "OU=Admins,$DomainDN" `
    -AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
}
if (-not (Get-ADUser -Filter "sAMAccountName -eq 'itadmin'" -ErrorAction SilentlyContinue)) {
  New-ADUser -Name "itadmin" -SamAccountName "itadmin" -Path "OU=Admins,$DomainDN" `
    -AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
}
# Gruppenmitgliedschaften
Try { Add-ADGroupMember -Identity "Domain Admins" -Members "helpdesk1" -ErrorAction Stop } Catch {}
Try { Add-ADGroupMember -Identity "Server Operators" -Members "itadmin" -ErrorAction Stop } Catch {}
Try { Add-ADGroupMember -Identity "Administrators"   -Members "itadmin" -ErrorAction Stop } Catch {}  # Builtin\Administrators

Write-Host "==> 5) Service-Account + SPN" -ForegroundColor Cyan
if (-not (Get-ADUser -Filter "sAMAccountName -eq 'svc_web'" -ErrorAction SilentlyContinue)) {
  New-ADUser -Name "svc_web" -SamAccountName "svc_web" -Path "OU=Service Accounts,$DomainDN" `
    -AccountPassword $Pwd -Enabled $true -PasswordNeverExpires $true | Out-Null
}
# SPN für den Member-Server (DNS-Name bei Bedarf anpassen)
cmd /c 'setspn -S HTTP/member.lab.int svc_web' | Out-Null

Write-Host "==> 6) Beispiel: Benutzer in Share-Gruppen" -ForegroundColor Cyan
Try { Add-ADGroupMember -Identity "Share-Readers"      -Members "alice","charlie" -ErrorAction Stop } Catch {}
Try { Add-ADGroupMember -Identity "Share-Contributors" -Members "bob"             -ErrorAction Stop } Catch {}

Write-Host "==> 7) GPO für Kerberos-Auditing erstellen & verlinken" -ForegroundColor Cyan
$gpoName = "LAB Kerberos Auditing"
$gpo = Get-GPO -Name $gpoName -ErrorAction SilentlyContinue
if (-not $gpo) { $gpo = New-GPO -Name $gpoName }

# Domain-Root holen & GPO verlinken (erzwingen)
$domainRoot = ([ADSI]"LDAP://$DomainDN").distinguishedName
if (-not (Get-GPLink -Target "dc=$($Domain.Name),dc=$($Domain.Forest)" -ErrorAction SilentlyContinue | Where-Object {$_.DisplayName -eq $gpoName})) {
  New-GPLink -Name $gpo.DisplayName -Target ("LDAP://" + $domainRoot) -Enforced Yes | Out-Null
}

# Advanced Audit Policy via Registry (Success/Failure = 3, nur Success = 1)
# Pfad: HKLM\Software\Policies\Microsoft\Windows\Audit
$AuditKey = "HKLM\Software\Policies\Microsoft\Windows\Audit"
$policies = @(
  @{Name="AuditKerberosAuthenticationService"; Value=3},   # 4768
  @{Name="AuditKerberosServiceTicketOperations"; Value=3}, # 4769
  @{Name="AuditLogon"; Value=1},                           # 4624 (nur Success)
  @{Name="AuditSpecialLogon"; Value=1}                     # 4672 (nur Success)
)
foreach ($p in $policies) {
  Set-GPRegistryValue -Name $gpoName -Key $AuditKey -ValueName $p.Name -Type DWord -Value $p.Value
}

# Security-Log größer & Überschreiben erlauben (für Lab)
# Pfad: HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security
$EventLogKey = "HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security"
Set-GPRegistryValue -Name $gpoName -Key $EventLogKey -ValueName "MaxSize"  -Type DWord -Value 131072   # 128 MB (in KB)
Set-GPRegistryValue -Name $gpoName -Key $EventLogKey -ValueName "Retention" -Type DWord -Value 0       # Overwrite as needed

Write-Host "==> 8) GPUpdate anstoßen (DC sofort)" -ForegroundColor Cyan
gpupdate /force | Out-Null

Write-Host "`nFertig: OUs, User, Gruppen, SPN und Kerberos-Audit-GPO sind eingerichtet." -ForegroundColor Green
Write-Host "Hinweis: Auf Member & Client nach dem Domain-Join 'gpupdate /force' ausführen oder 10–20 Min. replizieren lassen." -ForegroundColor Yellow