init

scripts/Build.ps1

@@ -0,0 +1,12 @@
+[CmdletBinding()]
+param([string] $Version = 'dev', [string] $Output = '.\bin')
+$ErrorActionPreference = 'Stop'
+New-Item -ItemType Directory -Force -Path $Output | Out-Null
+$ldflags = "-s -w -X main.version=$Version"
+$env:CGO_ENABLED = '0'
+$env:GOOS = 'windows'; $env:GOARCH = 'amd64'
+go build -trimpath -ldflags $ldflags -o (Join-Path $Output 'gpo-agent-windows-amd64.exe') .\cmd\agent
+go build -trimpath -ldflags $ldflags -o (Join-Path $Output 'gpoctl-windows-amd64.exe') .\cmd\gpoctl
+$env:GOOS = 'linux'; $env:GOARCH = 'amd64'
+go build -trimpath -ldflags $ldflags -o (Join-Path $Output 'gpo-server-linux-amd64') .\cmd\server
+Remove-Item Env:GOOS, Env:GOARCH, Env:CGO_ENABLED

scripts/Export-And-Publish.ps1

@@ -0,0 +1,48 @@
+#requires -Modules GroupPolicy
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [string] $GpoName,
+    [Parameter(Mandatory)] [string] $PolicyName,
+    [Parameter(Mandatory)] [string] $ServerUrl,
+    [Parameter(Mandatory)] [string] $AdminToken,
+    [Parameter(Mandatory)] [string] $GpoCtl,
+    [string] $Note = '',
+    [string] $Domain,
+    [string] $DomainController,
+    [switch] $InsecureSkipVerify,
+    [switch] $ForceVersion
+)
+
+$ErrorActionPreference = 'Stop'
+if (-not (Test-Path -LiteralPath $GpoCtl -PathType Leaf)) { throw "gpoctl not found: $GpoCtl" }
+$work = Join-Path ([IO.Path]::GetTempPath()) ("gpo-publish-" + [guid]::NewGuid().ToString('N'))
+$backup = Join-Path $work 'backup'
+$zip = Join-Path $work 'gpo-backup.zip'
+New-Item -ItemType Directory -Force -Path $backup | Out-Null
+try {
+    $params = @{ Name = $GpoName; Path = $backup }
+    if ($Note) { $params.Comment = $Note }
+    if ($Domain) { $params.Domain = $Domain }
+    if ($DomainController) { $params.Server = $DomainController }
+    Backup-GPO @params | Out-Null
+
+    # CreateFromDirectory includes hidden files such as bkupInfo.xml. The ZIP root
+    # contains manifest.xml plus the GUID-named GPO backup directory expected by LGPO.exe.
+    Add-Type -AssemblyName System.IO.Compression.FileSystem
+    [IO.Compression.ZipFile]::CreateFromDirectory(
+        $backup,
+        $zip,
+        [IO.Compression.CompressionLevel]::Optimal,
+        $false
+    )
+
+    $args = @('upload', '-server', $ServerUrl, '-token', $AdminToken, '-policy', $PolicyName, '-file', $zip)
+    if ($Note) { $args += @('-note', $Note) }
+    if ($InsecureSkipVerify) { $args += '-insecure-skip-verify' }
+    if ($ForceVersion) { $args += '-force' }
+    & $GpoCtl @args
+    if ($LASTEXITCODE -ne 0) { throw "gpoctl exited with code $LASTEXITCODE" }
+}
+finally {
+    Remove-Item -LiteralPath $work -Recurse -Force -ErrorAction SilentlyContinue
+}

scripts/Install-Agent.ps1

@@ -0,0 +1,52 @@
+#requires -RunAsAdministrator
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [string] $AgentExe,
+    [Parameter(Mandatory)] [string] $LGPOExe,
+    [Parameter(Mandatory)] [string] $ServerUrl,
+    [Parameter(Mandatory)] [string] $Profile,
+    [Parameter(Mandatory)] [string] $ClientToken,
+    [Parameter(Mandatory)] [string] $SigningKey,
+    [ValidateRange(1, 1440)] [int] $IntervalMinutes = 15,
+    [string] $InstallDir = "$env:ProgramFiles\GPO-Distributor",
+    [string] $StateDir = "$env:ProgramData\GPO-Distributor",
+    [switch] $InsecureSkipVerify
+)
+
+$ErrorActionPreference = 'Stop'
+if (-not (Test-Path -LiteralPath $AgentExe -PathType Leaf)) { throw "Agent executable not found: $AgentExe" }
+if (-not (Test-Path -LiteralPath $LGPOExe -PathType Leaf)) { throw "LGPO.exe not found: $LGPOExe" }
+
+New-Item -ItemType Directory -Force -Path $InstallDir, $StateDir | Out-Null
+$agentTarget = Join-Path $InstallDir 'gpo-agent.exe'
+$lgpoTarget = Join-Path $InstallDir 'LGPO.exe'
+Copy-Item -LiteralPath $AgentExe -Destination $agentTarget -Force
+Copy-Item -LiteralPath $LGPOExe -Destination $lgpoTarget -Force
+
+$config = [ordered]@{
+    server_url          = $ServerUrl.TrimEnd('/')
+    profile             = $Profile
+    client_token        = $ClientToken
+    signing_key         = $SigningKey
+    lgpo_path           = $lgpoTarget
+    state_dir           = $StateDir
+    poll_interval       = "${IntervalMinutes}m"
+    request_timeout     = '15m'
+    insecure_skip_verify = [bool]$InsecureSkipVerify
+}
+$configPath = Join-Path $StateDir 'agent.json'
+$config | ConvertTo-Json | Set-Content -LiteralPath $configPath -Encoding UTF8
+
+# Restrict secrets and cached policy bundles to SYSTEM and local Administrators.
+& icacls.exe $InstallDir /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' | Out-Null
+& icacls.exe $StateDir /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' | Out-Null
+
+$action = New-ScheduledTaskAction -Execute $agentTarget -Argument "-config `"$configPath`" -once"
+$startupTrigger = New-ScheduledTaskTrigger -AtStartup
+$periodicTrigger = New-ScheduledTaskTrigger -Once -At ((Get-Date).AddMinutes(2)) -RepetitionInterval (New-TimeSpan -Minutes $IntervalMinutes)
+$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -MultipleInstances IgnoreNew -ExecutionTimeLimit (New-TimeSpan -Minutes 30)
+$principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
+Register-ScheduledTask -TaskName 'GPO Distributor Agent' -Action $action -Trigger @($startupTrigger, $periodicTrigger) -Settings $settings -Principal $principal -Force | Out-Null
+
+Start-ScheduledTask -TaskName 'GPO Distributor Agent'
+Write-Host "Installed. Configuration: $configPath"