# 导入 GroupPolicy 模块
Import-Module GroupPolicy

# 定义常用变量
$Domain = "contoso.com"
$BackupPath = "C:\GPOBackup\$(Get-Date -Format 'yyyyMMdd')"

# 创建新的 GPO
$GPO = New-GPO -Name "Security Baseline 2026" -Comment "年度安全基线策略"

# 将 GPO 链接到指定的 OU，并设置优先级
New-GPLink -Name "Security Baseline 2026" -Target "OU=Servers,DC=contoso,DC=com" -LinkEnabled Yes -Order 1

# 禁用 GPO 的用户配置部分（仅保留计算机配置）
$GPO | Set-GPO -GpoStatus UserSettingsDisabled

# 创建备份目录并备份所有 GPO
if (-not (Test-Path $BackupPath)) {
    New-Item -Path $BackupPath -ItemType Directory -Force | Out-Null
}

$BackupReport = Backup-GPO -All -Path $BackupPath
$BackupReport | Select-Object DisplayName, GpoId, BackupId, Timestamp |
    Format-Table -AutoSize

# 导出备份清单为 CSV，便于后续还原时查找
$BackupReport | Export-Csv -Path "$BackupPath\BackupInventory.csv" -NoTypeInformation -Encoding UTF8

# 从备份还原单个 GPO（模拟灾难恢复场景）
$LatestBackup = $BackupReport | Where-Object { $_.DisplayName -eq "Security Baseline 2026" }
Restore-GPO -Name "Security Baseline 2026" -Path $BackupPath -BackupId $LatestBackup.BackupId

# 查看域中所有 GPO 的概览
Get-GPO -All | Select-Object DisplayName, GpoStatus, CreationTime, ModificationTime |
    Sort-Object ModificationTime -Descending |
    Format-Table -AutoSize

# --- 注册表首选项：通过 GPO 推送注册表项 ---
$GPOName = "Security Baseline 2026"
$Domain = "contoso.com"

# 设置注册表项：禁用 SMBv1（安全加固）
Set-GPPrefRegistryValue -Name $GPOName -Context Computer -Action Create `
    -Key "SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" `
    -ValueName "SMB1" -Value 0 -Type DWord -Order 1

# 设置注册表项：启用 PowerShell 脚本块日志记录
Set-GPPrefRegistryValue -Name $GPOName -Context Computer -Action Create `
    -Key "SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
    -ValueName "EnableScriptBlockLogging" -Value 1 -Type DWord -Order 2

# 设置注册表项：配置 Windows Defender 实时保护
Set-GPPrefRegistryValue -Name $GPOName -Context Computer -Action Create `
    -Key "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" `
    -ValueName "DisableRealtimeMonitoring" -Value 0 -Type DWord -Order 3

# --- 安全设置：通过 ini 文件方式配置账户策略 ---
# 生成安全模板 INF 文件
$SecTemplatePath = "C:\Temp\SecurityTemplate.inf"
$InfContent = @"
[Unicode]
Unicode=yes
[Version]
signature=`"`$CHICAGO`$`"
Revision=1
[Account Policies]
[Password History]
MaximumPasswordAge = 90
MinimumPasswordAge = 1
MinimumPasswordLength = 14
PasswordComplexity = 1
[Lockout]
LockoutDuration = 30
LockoutBadCount = 5
ResetLockoutCount = 30
"@

Set-Content -Path $SecTemplatePath -Value $InfContent -Encoding Unicode

# --- 脚本部署：配置启动脚本 ---
$ScriptName = "Install-EndpointAgent.ps1"
$ScriptContent = @'
# 端点代理安装脚本 - 由组策略推送执行
$AgentPath = "\\contoso.com\SYSVOL\contoso.com\scripts\EndpointAgent.msi"
$LogPath = "C:\Logs\AgentInstall.log"

if (-not (Get-Service -Name "EndpointAgent" -ErrorAction SilentlyContinue)) {
    Start-Process msiexec.exe -ArgumentList "/i `"$AgentPath`" /qn /l*v `"$LogPath`"" -Wait
    Write-Output "$(Get-Date) - Endpoint Agent installed successfully" | Out-File $LogPath -Append
}
'@

# 将脚本保存到 GPO 的启动脚本目录
$GPO = Get-GPO -Name $GPOName
$StartupScriptFolder = "\\$Domain\SYSVOL\$Domain\Policies\{$($GPO.Id)}\Machine\Scripts\Startup"
if (-not (Test-Path $StartupScriptFolder)) {
    New-Item -Path $StartupScriptFolder -ItemType Directory -Force | Out-Null
}
Set-Content -Path "$StartupScriptFolder\$ScriptName" -Value $ScriptContent -Encoding UTF8

Write-Host "策略设置编辑完成：注册表首选项 3 项、安全模板 1 份、启动脚本 1 个"

# --- RSOP 分析：获取目标计算机的实际策略应用结果 ---
$ComputerName = "SRV-DC01.contoso.com"

# 生成 GPO 报告（HTML 格式）
$ReportPath = "C:\Reports\GPOReport_$(Get-Date -Format 'yyyyMMdd_HHmmss').html"
Get-GPOReport -All -ReportType Html -Path $ReportPath
Write-Host "GPO 报告已生成: $ReportPath"

# 获取指定计算机的 RSOP 报告
$RsopReport = "C:\Reports\RSOP_$ComputerName`_$(Get-Date -Format 'yyyyMMdd').html"
gpresult /s $ComputerName /h $RsopReport /f 2>$null
Write-Host "RSOP 报告已生成: $RsopReport"

# --- 基线对比：检测 GPO 是否偏离已知良好配置 ---
$BaselinePath = "C:\GPOBaseline"
$CurrentBackupPath = "C:\GPOBackup\$(Get-Date -Format 'yyyyMMdd')"

# 比较基线和当前备份中的 GPO 数量
$BaselineGPOs = Get-ChildItem -Path $BaselinePath -Directory
$CurrentGPOs = Get-ChildItem -Path $CurrentBackupPath -Directory

$Missing = $BaselineGPOs.Name | Where-Object { $_ -notin $CurrentGPOs.Name }
$New = $CurrentGPOs.Name | Where-Object { $_ -notin $BaselineGPOs.Name }

if ($Missing) {
    Write-Warning "以下基线 GPO 在当前备份中缺失: $($Missing -join ', ')"
}
if ($New) {
    Write-Host "发现新增 GPO: $($New -join ', ')" -ForegroundColor Yellow
}

# --- 变更追踪：监控 GPO 的修改时间和设置变更 ---
$AuditLog = "C:\Reports\GPO_AuditLog_$(Get-Date -Format 'yyyyMMdd').csv"

# 获取所有 GPO 的当前状态快照
$Snapshot = Get-GPO -All | ForEach-Object {
    $Links = (Get-GPOReport -Name $_.DisplayName -ReportType Xml)
    $LinkCount = ([xml]$Links).GPO.LinksTo | Measure-Object | Select-Object -ExpandProperty Count

    [PSCustomObject]@{
        GPOName         = $_.DisplayName
        GpoId           = $_.Id
        Status          = $_.GpoStatus
        LinkCount       = $LinkCount
        ComputerEnabled = ($_.GpoStatus -ne 'ComputerSettingsDisabled' -and $_.GpoStatus -ne 'AllSettingsDisabled')
        UserEnabled     = ($_.GpoStatus -ne 'UserSettingsDisabled' -and $_.GpoStatus -ne 'AllSettingsDisabled')
        ModifiedTime    = $_.ModificationTime
        AuditTime       = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
    }
}

$Snapshot | Export-Csv -Path $AuditLog -NoTypeInformation -Encoding UTF8

# 标记最近 7 天内修改过的 GPO
$RecentChanges = $Snapshot | Where-Object { $_.ModifiedTime -gt (Get-Date).AddDays(-7) }
if ($RecentChanges) {
    Write-Host "`n最近 7 天内修改的 GPO:" -ForegroundColor Cyan
    $RecentChanges | Format-Table GPOName, ModifiedTime, LinkCount, Status -AutoSize
} else {
    Write-Host "`n最近 7 天内无 GPO 变更" -ForegroundColor Green
}

Write-Host "`n审计快照已保存: $AuditLog"

# 导入模块
Import-Module ActiveDirectory

# 查询用户基本信息
Get-ADUser -Identity "zhangsan" -Properties DisplayName, Department, Title, LastLogonDate |
    Select-Object SamAccountName, DisplayName, Department, Title, Enabled, LastLogonDate |
    Format-List

# 搜索特定部门的用户
$users = Get-ADUser -Filter { Department -eq "工程部" -and Enabled -eq $true } `
    -Properties DisplayName, EmailAddress, Title, WhenCreated

$users | Select-Object DisplayName, EmailAddress, Title, WhenCreated |
    Format-Table -AutoSize

Write-Host "工程部活跃用户：$($users.Count) 人" -ForegroundColor Green

# 查找长期未登录的用户（90 天未活动）
$inactiveDate = (Get-Date).AddDays(-90)
$inactive = Get-ADUser -Filter { LastLogonDate -lt $inactiveDate -and Enabled -eq $true } `
    -Properties DisplayName, LastLogonDate, Department |
    Sort-Object LastLogonDate |
    Select-Object DisplayName, Department, LastLogonDate

Write-Host "90 天未登录的活跃账号：$($inactive.Count) 个" -ForegroundColor Yellow
$inactive | Format-Table -AutoSize

# 即将过期的密码统计
$expiringSoon = Get-ADUser -Filter { Enabled -eq $true -and PasswordNeverExpires -eq $false } `
    -Properties DisplayName, PasswordLastSet, "msDS-UserPasswordExpiryTimeComputed" |
    Where-Object {
        $expiry = [datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")
        $expiry -lt (Get-Date).AddDays(7) -and $expiry -gt (Get-Date)
    } |
    Select-Object DisplayName,
        @{N='PasswordExpires'; E={ [datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed") }}

Write-Host "7 天内密码过期的用户：$($expiringSoon.Count) 人" -ForegroundColor Red
$expiringSoon | Format-Table -AutoSize

# 从 CSV 批量创建用户
$csvData = @"
Name,DisplayName,Department,Title,Manager
li.si,李四,工程部,工程师,zhangsan
wang.wu,王五,市场部,市场专员,zhangsan
zhao.liu,赵六,财务部,会计,lisi
chen.qi,陈七,工程部,初级工程师,zhangsan
"@ | ConvertFrom-Csv

function New-BatchADUsers {
    param(
        [Parameter(Mandatory)]
        [object[]]$UserData,

        [string]$BaseOU = "OU=员工,DC=contoso,DC=com",

        [string]$DefaultPassword = "P@ssw0rd!2025",

        [string]$UPNSuffix = "contoso.com"
    )

    $results = @()
    $successCount = 0
    $failCount = 0

    $securePassword = ConvertTo-SecureString $DefaultPassword -AsPlainText -Force

    foreach ($user in $UserData) {
        try {
            # 检查是否已存在
            $existing = Get-ADUser -Filter { SamAccountName -eq $user.Name } -ErrorAction SilentlyContinue
            if ($existing) {
                Write-Host "用户已存在：$($user.Name)" -ForegroundColor Yellow
                $results += @{ Name = $user.Name; Status = "已存在" }
                continue
            }

            # 创建用户
            $newUserParams = @{
                Name                  = $user.DisplayName
                DisplayName           = $user.DisplayName
                SamAccountName        = $user.Name
                UserPrincipalName     = "$($user.Name)@$UPNSuffix"
                GivenName             = ($user.DisplayName -split '')[1]
                Surname               = ($user.DisplayName -split '')[0]
                Department            = $user.Department
                Title                 = $user.Title
                Path                  = $BaseOU
                AccountPassword       = $securePassword
                Enabled               = $true
                ChangePasswordAtLogon = $true
            }

            if ($user.Manager) {
                $newUserParams['Manager'] = $user.Manager
            }

            New-ADUser @newUserParams
            $successCount++
            Write-Host "已创建：$($user.Name)（$($user.Department)）" -ForegroundColor Green
            $results += @{ Name = $user.Name; Status = "成功" }
        } catch {
            $failCount++
            Write-Host "创建失败：$($user.Name) - $($_.Exception.Message)" -ForegroundColor Red
            $results += @{ Name = $user.Name; Status = "失败：$($_.Exception.Message)" }
        }
    }

    Write-Host "`n汇总：成功 $successCount，失败 $failCount" -ForegroundColor Cyan
    return $results
}

# 执行批量创建
New-BatchADUsers -UserData $csvData

# 从 CSV 文件导入（生产环境常用）
# $importData = Import-Csv "C:\HR\NewEmployees_202509.csv"
# New-BatchADUsers -UserData $importData

# 批量修改用户属性
$users = @("li.si", "wang.wu")
foreach ($name in $users) {
    Set-ADUser -Identity $name -Department "研发部" -Company "Contoso Corp"
    Write-Host "已更新 $name 的部门和公司信息" -ForegroundColor Green
}

# 禁用离职用户
function Disable-DepartedUsers {
    param([string[]]$UserNames)

    foreach ($name in $UserNames) {
        try {
            $user = Get-ADUser -Identity $name -Properties DisplayName
            Disable-ADAccount -Identity $name

            # 移动到离职 OU
            Move-ADObject -Identity $user.DistinguishedName `
                -TargetPath "OU=离职员工,DC=contoso,DC=com"

            # 移除所有组（保留 Domain Users）
            $groups = Get-ADPrincipalGroupMembership -Identity $name |
                Where-Object { $_.Name -ne "Domain Users" }
            foreach ($group in $groups) {
                Remove-ADGroupMember -Identity $group.SamAccountName -Members $name -Confirm:$false
            }

            Write-Host "已禁用并归档：$($user.DisplayName)（$name）" -ForegroundColor Yellow
        } catch {
            Write-Host "处理失败：$name - $($_.Exception.Message)" -ForegroundColor Red
        }
    }
}

Disable-DepartedUsers -UserNames @("zhao.liu")

# 用户组管理
function Set-UserDepartmentGroups {
    param(
        [string]$UserName,
        [string]$Department
    )

    $deptGroups = @{
        "工程部" = @("SG_Developers", "SG_Git_Access", "SG_Build_Servers")
        "市场部" = @("SG_Marketing", "SG_CRM_Access")
        "财务部" = @("SG_Finance", "SG_ERP_Access", "SG_Reporting")
    }

    $groups = $deptGroups[$Department]
    if (-not $groups) {
        Write-Host "未定义 $Department 的默认组" -ForegroundColor Yellow
        return
    }

    foreach ($group in $groups) {
        try {
            Add-ADGroupMember -Identity $group -Members $UserName -ErrorAction Stop
            Write-Host "已加入组：$group" -ForegroundColor Green
        } catch {
            Write-Host "加入组失败：$group - $($_.Exception.Message)" -ForegroundColor Red
        }
    }
}

Set-UserDepartmentGroups -UserName "chen.qi" -Department "工程部"

# 安装 AD PowerShell 模块（Windows Server）
Install-WindowsFeature -Name RSAT-AD-PowerShell

# Windows 10/11 客户端安装 RSAT
# 设置 > 应用 > 可选功能 > 添加 RSAT: Active Directory Domain Services 工具

# 导入模块
Import-Module ActiveDirectory

# 验证模块已加载
Get-Command -Module ActiveDirectory |
    Select-Object Name, CommandType |
    Sort-Object Name |
    Select-Object -First 20 |
    Format-Table -AutoSize

# 测试域连接
Get-ADDomain | Select-Object Name, DNSRoot, Forest, DomainMode |
    Format-List

# 查询用户信息
Get-ADUser -Identity "john.doe" -Properties * |
    Select-Object Name, SamAccountName, EmailAddress, Department,
        Title, Manager, Enabled, LastLogonDate, PasswordLastSet |
    Format-List

# 搜索用户（模糊匹配）
Get-ADUser -Filter "Name -like '*Smith*'" |
    Select-Object Name, SamAccountName, Department |
    Format-Table -AutoSize

# 创建新用户
$newUserParams = @{
    Name            = "张伟"
    GivenName       = "伟"
    Surname         = "张"
    SamAccountName  = "wei.zhang"
    UserPrincipalName = "wei.zhang@contoso.com"
    EmailAddress    = "wei.zhang@contoso.com"
    Department      = "IT"
    Title           = "高级运维工程师"
    Path            = "OU=IT,OU=Users,DC=contoso,DC=com"
    AccountPassword = (Read-Host "设置密码" -AsSecureString)
    Enabled         = $true
    ChangePasswordAtLogon = $true
}
New-ADUser @newUserParams
Write-Host "用户已创建：wei.zhang" -ForegroundColor Green

# 修改用户属性
Set-ADUser -Identity "wei.zhang" -Department "DevOps" -Title "DevOps 工程师"

# 禁用/启用账户
Disable-ADAccount -Identity "wei.zhang"
Enable-ADAccount -Identity "wei.zhang"

# 解锁账户（用户多次输错密码后被锁定）
Unlock-ADAccount -Identity "john.doe"

# 批量创建用户（从 CSV）
$usersCsv = @"
Name,SamAccountName,Department,Title,Email
李明,ming.li,Engineering,开发工程师,ming.li@contoso.com
王芳,fang.wang,Marketing,市场经理,fang.wang@contoso.com
赵强,qiang.zhao,Finance,财务分析师,qiang.zhao@contoso.com
刘洋,yang.liu,IT,系统管理员,yang.liu@contoso.com
"@ | ConvertFrom-Csv

$password = ConvertTo-SecureString "P@ssw0rd123!" -AsPlainText -Force

$results = foreach ($user in $usersCsv) {
    try {
        $ouPath = "OU=$($user.Department),OU=Users,DC=contoso,DC=com"

        New-ADUser -Name $user.Name `
            -SamAccountName $user.SamAccountName `
            -UserPrincipalName "$($user.SamAccountName)@contoso.com" `
            -EmailAddress $user.Email `
            -Department $user.Department `
            -Title $user.Title `
            -Path $ouPath `
            -AccountPassword $password `
            -Enabled $true `
            -ChangePasswordAtLogon $true `
            -ErrorAction Stop

        [PSCustomObject]@{
            User   = $user.SamAccountName
            Status = 'Created'
            OU     = $ouPath
        }
    } catch {
        [PSCustomObject]@{
            User   = $user.SamAccountName
            Status = "Failed: $($_.Exception.Message)"
            OU     = $ouPath
        }
    }
}

$results | Format-Table -AutoSize

# 查询组信息
Get-ADGroup -Identity "IT-Admins" -Properties * |
    Select-Object Name, GroupScope, GroupCategory, Description, Members |
    Format-List

# 查看组成员
Get-ADGroupMember -Identity "IT-Admins" |
    Select-Object Name, SamAccountName, ObjectClass |
    Format-Table -AutoSize

# 添加用户到组
Add-ADGroupMember -Identity "IT-Admins" -Members "wei.zhang"
Write-Host "已将 wei.zhang 添加到 IT-Admins 组" -ForegroundColor Green

# 批量添加组成员
$members = @("ming.li", "yang.liu")
Add-ADGroupMember -Identity "DevOps-Team" -Members $members

# 从组中移除用户
Remove-ADGroupMember -Identity "IT-Admins" -Members "john.doe" -Confirm:$false

# 创建新组
New-ADGroup -Name "Cloud-Admins" `
    -GroupScope Global `
    -GroupCategory Security `
    -Description "云平台管理员组" `
    -Path "OU=Groups,DC=contoso,DC=com"

# 查找用户所属的所有组
Get-ADUser -Identity "wei.zhang" -Properties MemberOf |
    Select-Object -ExpandProperty MemberOf |
    ForEach-Object { ($_ -split ',')[0] -replace 'CN=','' } |
    Sort-Object

# 查询域中所有计算机
Get-ADComputer -Filter * -Properties Name, OperatingSystem, LastLogonDate, Enabled |
    Select-Object Name, OperatingSystem, LastLogonDate, Enabled |
    Sort-Object Name |
    Format-Table -AutoSize

# 按操作系统筛选
Get-ADComputer -Filter "OperatingSystem -like '*Server 2022*'" |
    Select-Object Name, DNSHostName |
    Format-Table -AutoSize

# 查找不活跃的计算机（90 天未登录）
$cutoffDate = (Get-Date).AddDays(-90)
$inactiveComputers = Get-ADComputer -Filter { LastLogonDate -lt $cutoffDate } `
    -Properties Name, LastLogonDate, OperatingSystem

$inactiveComputers |
    Select-Object Name, OperatingSystem,
        @{N='LastLogon'; E={$_.LastLogonDate.ToString('yyyy-MM-dd')}} |
    Format-Table -AutoSize

Write-Host "不活跃计算机数量：$($inactiveComputers.Count)" -ForegroundColor Yellow

# 禁用不活跃的计算机账户
foreach ($comp in $inactiveComputers) {
    Set-ADComputer -Identity $comp -Enabled $false
    Write-Host "已禁用：$($comp.Name)" -ForegroundColor Yellow
}

# 查看域密码策略
Get-ADDefaultDomainPasswordPolicy |
    Select-Object ComplexityEnabled, MinPasswordLength,
        MaxPasswordAge, PasswordHistoryCount, LockoutThreshold |
    Format-List

# 查找密码即将过期的用户
$maxAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge.Days
$notifyDays = 14
$cutoffDate = (Get-Date).AddDays($notifyDays)

$expiringUsers = Get-ADUser -Filter { Enabled -eq $true -and PasswordNeverExpires -eq $false } `
    -Properties Name, EmailAddress, PasswordLastSet, PasswordNeverExpires

$results = foreach ($user in $expiringUsers) {
    $expiryDate = $user.PasswordLastSet.AddDays($maxAge)
    if ($expiryDate -le $cutoffDate) {
        $daysLeft = [math]::Floor(($expiryDate - (Get-Date)).TotalDays)
        [PSCustomObject]@{
            Name        = $user.Name
            Email       = $user.EmailAddress
            ExpiresOn   = $expiryDate.ToString('yyyy-MM-dd')
            DaysLeft    = $daysLeft
        }
    }
}

$results | Sort-Object DaysLeft | Format-Table -AutoSize