init

2026-08-05 10:46:09 +02:00
parent 99fa56505a
commit d191b871de
44 changed files with 5155 additions and 1 deletions
@@ -0,0 +1,52 @@
+#requires -RunAsAdministrator
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [string] $AgentExe,
+    [Parameter(Mandatory)] [string] $LGPOExe,
+    [Parameter(Mandatory)] [string] $ServerUrl,
+    [Parameter(Mandatory)] [string] $Profile,
+    [Parameter(Mandatory)] [string] $ClientToken,
+    [Parameter(Mandatory)] [string] $SigningKey,
+    [ValidateRange(1, 1440)] [int] $IntervalMinutes = 15,
+    [string] $InstallDir = "$env:ProgramFiles\GPO-Distributor",
+    [string] $StateDir = "$env:ProgramData\GPO-Distributor",
+    [switch] $InsecureSkipVerify
+)
+
+$ErrorActionPreference = 'Stop'
+if (-not (Test-Path -LiteralPath $AgentExe -PathType Leaf)) { throw "Agent executable not found: $AgentExe" }
+if (-not (Test-Path -LiteralPath $LGPOExe -PathType Leaf)) { throw "LGPO.exe not found: $LGPOExe" }
+
+New-Item -ItemType Directory -Force -Path $InstallDir, $StateDir | Out-Null
+$agentTarget = Join-Path $InstallDir 'gpo-agent.exe'
+$lgpoTarget = Join-Path $InstallDir 'LGPO.exe'
+Copy-Item -LiteralPath $AgentExe -Destination $agentTarget -Force
+Copy-Item -LiteralPath $LGPOExe -Destination $lgpoTarget -Force
+
+$config = [ordered]@{
+    server_url          = $ServerUrl.TrimEnd('/')
+    profile             = $Profile
+    client_token        = $ClientToken
+    signing_key         = $SigningKey
+    lgpo_path           = $lgpoTarget
+    state_dir           = $StateDir
+    poll_interval       = "${IntervalMinutes}m"
+    request_timeout     = '15m'
+    insecure_skip_verify = [bool]$InsecureSkipVerify
+}
+$configPath = Join-Path $StateDir 'agent.json'
+$config | ConvertTo-Json | Set-Content -LiteralPath $configPath -Encoding UTF8
+
+# Restrict secrets and cached policy bundles to SYSTEM and local Administrators.
+& icacls.exe $InstallDir /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' | Out-Null
+& icacls.exe $StateDir /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' | Out-Null
+
+$action = New-ScheduledTaskAction -Execute $agentTarget -Argument "-config `"$configPath`" -once"
+$startupTrigger = New-ScheduledTaskTrigger -AtStartup
+$periodicTrigger = New-ScheduledTaskTrigger -Once -At ((Get-Date).AddMinutes(2)) -RepetitionInterval (New-TimeSpan -Minutes $IntervalMinutes)
+$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -MultipleInstances IgnoreNew -ExecutionTimeLimit (New-TimeSpan -Minutes 30)
+$principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
+Register-ScheduledTask -TaskName 'GPO Distributor Agent' -Action $action -Trigger @($startupTrigger, $periodicTrigger) -Settings $settings -Principal $principal -Force | Out-Null
+
+Start-ScheduledTask -TaskName 'GPO Distributor Agent'
+Write-Host "Installed. Configuration: $configPath"