First Commit

2026-09-24 11:29:54 -05:00 · 2026-09-24 11:29:54 -05:00 · 2e5a4751a7
commit 2e5a4751a7
30 changed files with 2517 additions and 0 deletions
--- a/scripts/win11-join.ps1
+++ b/scripts/win11-join.ps1
@ -0,0 +1,84 @@
+# =====================================================================================
+# Windows 11 client side: DNS -> optional CA trust -> domain join -> verification.
+# Run in an elevated PowerShell on the Windows 11 machine.
+#
+#   .\win11-join.ps1 -DnsServer 192.168.5.12 -Domain ad.example.com -CaCert C:\ca.crt
+#   .\win11-join.ps1 -VerifyOnly
+# =====================================================================================
+#Requires -RunAsAdministrator
+param(
+    [string]$DnsServer = "192.168.5.12",
+    [string]$Domain    = "ad.example.com",
+    [string]$DcHost    = "dc1.ad.example.com",
+    [string]$OUPath    = "",          # e.g. "OU=Wks,DC=ad,DC=example,DC=com"
+    [string]$CaCert    = "",          # ca.crt path - local, or straight off the DC:
+                                     #   \\premier.local\NETLOGON\ad-root-ca.crt
+    [switch]$VerifyOnly,
+    [switch]$NoRestart
+)
+
+$ErrorActionPreference = 'Stop'
+function Step($m) { Write-Host "`n==> $m" -ForegroundColor Cyan }
+function Warn($m) { Write-Host "    ! $m" -ForegroundColor Yellow }
+
+if ($VerifyOnly) {
+    Step "Secure channel"
+    Test-ComputerSecureChannel -Verbose
+
+    Step "DC discovery for $Domain"
+    & nltest /dsgetdc:$Domain
+
+    Step "Group policy"
+    & gpupdate /force
+    & gpresult /r
+
+    Step "Kerberos tickets (look for cifs/$DcHost and HTTP/$DcHost)"
+    & klist
+
+    Step "Last 15 logon / netlogon errors"
+    Get-WinEvent -FilterHashtable @{ LogName = 'System'; Level = 1,2,3; StartTime = (Get-Date).AddHours(-4) } `
+        -MaxEvents 15 -ErrorAction SilentlyContinue |
+        Format-Table TimeCreated, ProviderName, Id, @{n='Msg';e={$_.Message.Substring(0, [Math]::Min(120, $_.Message.Length))}} -AutoSize
+    return
+}
+
+Step "Point DNS at the domain controller ($DnsServer)"
+$adapters = Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Sort-Object LinkSpeed -Descending
+$adapter  = $adapters[0]
+Set-DnsClientServerAddress -InterfaceIndex $adapter.ifIndex -ServerAddresses ($DnsServer, '8.8.8.8')
+Write-Host "    adapter: $($adapter.Name) -> $($DnsServer), 8.8.8.8"
+ipconfig /flushdns | Out-Null
+
+Step "SRV bootstrap records"
+try {
+    Resolve-DnsName -Name "_ldap._tcp.dc._msdcs.$Domain" -Type SRV -ErrorAction Stop |
+        Select-Object Name, Strings | Format-Table -AutoSize
+} catch {
+    Warn "no SRV answer for _ldap._tcp.dc._msdcs.$Domain - DNS is not pointing at the DC yet"
+    throw
+}
+
+Step "Connectivity matrix"
+foreach ($p in 53, 88, 389, 445, 636, 3268) {
+    $r = Test-NetConnection -ComputerName $DcHost -Port $p -WarningAction SilentlyContinue
+    Write-Host ("    {0,-5} {1}" -f $p, $(if ($r.TcpTestSucceeded) { 'open' } else { 'CLOSED' }))
+}
+
+if ($CaCert -and (Test-Path $CaCert)) {
+    Step "Importing LDAPS root CA into the machine trust store"
+    Import-Certificate -FilePath $CaCert -CertStoreLocation 'Cert:\LocalMachine\Root' | Out-Null
+    Write-Host "    imported $CaCert"
+} else {
+    Warn "no -CaCert supplied: LDAPS will present an untrusted certificate"
+}
+
+Step "Joining $Domain as $(hostname)"
+$cred = Get-Credential -Message "Domain join credentials (use ${Domain.ToUpper()}\administrator)"
+$joinArgs = @{ DomainName = $Domain; Credential = $cred }
+if ($OUPath) { $joinArgs['OUPath'] = $OUPath }
+if ($NoRestart) { $joinArgs['NoRestart'] = $true }
+Add-Computer @joinArgs
+
+Write-Host ""
+Write-Host "Joined. Reboot now (or run: Restart-Computer -Force) and log in with a domain account." -ForegroundColor Green
+Write-Host "Then re-run this script with -VerifyOnly to confirm secure channel + GPO." -ForegroundColor Green