#Links
https://nocksoft.de/tutorials/domaenencontroller-mit-der-powershell-installieren-inklusive-replikation/
https://github.com/citrixguyblog/PowerShellRDSDeployment/blob/master/Install_RDSFarm.ps1
#DC
#sc.exe query wuauserv;sc.exe config wuauserv start=disabled
Enable-PSRemoting;winrm quickconfig
#Install-WindowsFeature RSAT-AD-Tools, RSAT-DNS-Server
$ndc = "adm"
Rename-Computer -NewName $ndc -Restart -Force
$pwd = ConvertTo-SecureString "Tarantu95" -AsPlainText -Force
$rdd = "e17.unirez.privatcloud.biz"
$rnb = "UE17"
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools -IncludeAllSubFeature
Import-Module ADDSDeployment
Install-ADDSForest -DomainName $rdd -DomainNetBiosName $rnb -DomainMode WinThreshold -ForestMode WinThreshold -SkipPreChecks -InstallDns:$true -SafeModeAdministratorPassword $pwd -Force
#use domain user to logon from now on...
(Get-ADDomain | Format-List Name, DomainMode) + (Get-ADForest | Format-List Name, ForestMode)
Get-DnsServerZone
$netw   = "172.22.17.0/24"
$dnsip  = "172.22.17.21"
$dnsfw1 = "172.22.17.1"
$dnsfw2 = "9.9.9.9"
Add-DnsServerPrimaryZone -NetworkID $netw -ReplicationScope Domain -DynamicUpdate Secure -PassThru
ipconfig /registerdns
Set-DnsClientServerAddress -InterfaceAlias "Ethernet0" -ServerAddresses $dnsip
Set-DnsServerForwarder -IPAddress $dnsfw1,$dnswf2
$rdd = "e17.unirez.privatcloud.biz"
# add unirez to domain admins
$Username="unirez";$Password="Change!t123";$Firstname="Unirez";$Lastname="Admin";New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user1"; $Password="Change!t123";$Firstname="User";  $Lastname="1";    New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user2"; $Password="Change!t123";$Firstname="User";  $Lastname="2";    New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user3"; $Password="Change!t123";$Firstname="User";  $Lastname="3";    New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user4"; $Password="Change!t123";$Firstname="User";  $Lastname="4";    New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user5"; $Password="Change!t123";$Firstname="User";  $Lastname="5";    New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user6"; $Password="Change!t123";$Firstname="User";  $Lastname="6";    New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user7"; $Password="Change!t123";$Firstname="User";  $Lastname="7";    New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user8"; $Password="Change!t123";$Firstname="User";  $Lastname="8";    New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user9"; $Password="Change!t123";$Firstname="User";  $Lastname="9";    New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user10";$Password="Change!t123";$Firstname="User";  $Lastname="10";   New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user11";$Password="Change!t123";$Firstname="User";  $Lastname="11";   New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user12";$Password="Change!t123";$Firstname="User";  $Lastname="12";   New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user13";$Password="Change!t123";$Firstname="User";  $Lastname="13";   New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user14";$Password="Change!t123";$Firstname="User";  $Lastname="14";   New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user15";$Password="Change!t123";$Firstname="User";  $Lastname="15";   New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user16";$Password="Change!t123";$Firstname="User";  $Lastname="16";   New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user17";$Password="Change!t123";$Firstname="User";  $Lastname="17";   New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user18";$Password="Change!t123";$Firstname="User";  $Lastname="18";   New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user19";$Password="Change!t123";$Firstname="User";  $Lastname="19";   New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user20";$Password="Change!t123";$Firstname="User";  $Lastname="20";   New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
$Username="user21";$Password="Change!t123";$Firstname="User";  $Lastname="21";   New-ADUser -SamAccountName $Username -UserPrincipalName "$Username@$rdd" -Name "$Firstname $Lastname" -GivenName $Firstname -Surname $Lastname -Enabled $True -ChangePasswordAtLogon $False -DisplayName "$Firstname $Lastname" -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -PasswordNeverExpires $true
Write "Install SAP Aplications";$server="172.22.17.10";$files="\\$server\b1_shf"
if ( 1 -eq 1 ) { 
  & "$files\Hana_Components\SAP_HANA_CLIENT_WINDOWSx64\hdbinst.exe" --path="C:\Program Files\sap\hdbclient" --batch
  Wait-Process -Name hdbinst
  & "$files\Client.x64\setup.exe" /S /z"C:\Program Files\SAP\SAP Business One Client\*$server:40000"
 Wait-Process -Name setup
 & Get-ChildItem "C:\Program Files\sap\SAP Business One DI API\Conf" -Recurse -Include "b1-local-machine.xml" |
  ForEach-Object { (Get-Content $_.FullName) | 
  ForEach-Object {$_ -replace 'localhost', "$server"} | 
  Set-Content $_.FullName }
 & Get-ChildItem "C:\Program Files\sap\SAP Business One DI API\Conf" -Recurse -Include "b1-local-machine-template.xml" |
  ForEach-Object { (Get-Content $_.FullName) | 
  ForEach-Object {$_ -replace 'localhost', "$server"} | 
  Set-Content $_.FullName }
 & Get-ChildItem "C:\Program Files\sap\SAP Business One Client\Conf" -Recurse -Include "b1-local-machine-template.xml" |
  ForEach-Object { (Get-Content $_.FullName) | 
  ForEach-Object {$_ -replace 'localhost', "$server"} | 
  Set-Content $_.FullName }
 & Start-Process cmd -ArgumentList { /k mkdir "C:\Program Files\sap\SAP Business One Client\AddOns" }
 & Start-Process cmd -ArgumentList { /k icacls "C:\Program Files\sap\SAP Business One Client\AddOns" /grant *S-1-5-32-545:(OI)(CI)(F) /t /c /q }
}
if ( 2 -eq 2 ) { 
 & "$files\Hana_Components\SAP_HANA_STUDIO_WINDOWSx64\hdbinst.exe" --path="C:\Program Files\sap\hdbstudio" --batch
 Wait-Process -Name hdbinst
}
# RD
#sc.exe query wuauserv;sc.exe config wuauserv start=disabled
Enable-PSRemoting;winrm quickconfig
#Install-WindowsFeature RSAT-AD-Tools, RSAT-DNS-Server
$nrd = "rds"
Rename-Computer -NewName $nrd -Restart -Force
Get-WmiObject -Class Win32_NetworkAdapterConfiguration -Filter IPEnabled=TRUE -ComputerName . | Select-Object -Property [a-z]* -ExcludeProperty IPX*,WINS*
Get-WmiObject -Class Win32_NetworkAdapterConfiguration -Filter "DHCPEnabled=true" –ComputerName . | Get-Member
Get-WmiObject Win32_NetworkAdapterConfiguration -computername . | select name, DNSServerSearchOrder
$rdd = "e17.unirez.privatcloud.biz"
add-computer –domainname $rdd -restart
#use domain user to logon from now on...
# SAP
if ( 1 -eq 1 ) { 
 Write "Install SAP Aplications";$server="172.22.17.10";$files="\\$server\b1_shf"
  & "$files\Hana_Components\SAP_HANA_CLIENT_WINDOWSx64\hdbinst.exe" --path="C:\Program Files\sap\hdbclient" --batch
  Wait-Process -Name hdbinst
  & "$files\Client.x64\setup.exe" /S /z"C:\Program Files\SAP\SAP Business One Client\*$server:40000"
 Wait-Process -Name setup
 & Get-ChildItem "C:\Program Files\sap\SAP Business One DI API\Conf" -Recurse -Include "b1-local-machine.xml" |
  ForEach-Object { (Get-Content $_.FullName) | 
  ForEach-Object {$_ -replace 'localhost', "$server"} | 
  Set-Content $_.FullName }
 & Get-ChildItem "C:\Program Files\sap\SAP Business One DI API\Conf" -Recurse -Include "b1-local-machine-template.xml" |
  ForEach-Object { (Get-Content $_.FullName) | 
  ForEach-Object {$_ -replace 'localhost', "$server"} | 
  Set-Content $_.FullName }
 & Get-ChildItem "C:\Program Files\sap\SAP Business One Client\Conf" -Recurse -Include "b1-local-machine-template.xml" |
  ForEach-Object { (Get-Content $_.FullName) | 
  ForEach-Object {$_ -replace 'localhost', "$server"} | 
  Set-Content $_.FullName }
 & Start-Process cmd -ArgumentList { /k mkdir "C:\Program Files\sap\SAP Business One Client\AddOns" }
 & Start-Process cmd -ArgumentList { /k icacls "C:\Program Files\sap\SAP Business One Client\AddOns" /grant *S-1-5-32-545:(OI)(CI)(F) /t /c /q }
}
# RDS
Import-Module RemoteDesktop
$tdc    = "adm.e17.unirez.privatcloud.biz"
$rdb    = "rds.e17.unirez.privatcloud.biz"
$rdg    = "rds.e17.unirez.privatcloud.biz"
$rds    = "rds.e17.unirez.privatcloud.biz"
$rdw    = "rds.e17.unirez.privatcloud.biz"
$rdl    = "rds.e17.unirez.privatcloud.biz"
$rdc    = "SAP"
$rdu    = "Domänen-Benutzer"
$rdz    = "e17.unirez.privatcloud.biz"
$susip  = "172.22.17.10"
$dnsip  = "172.22.17.21"
$rdsip  = "172.22.17.20"
$rdspw  = ConvertTo-SecureString -String "Unirez123" -AsPlainText -Force
$rdspfx = "c:\$rdg.pfx"
$rdscer = "c:\$rdg.cer" # copy to b1 share, import on rds and adm
$suscer = "\\$susip\b1_shf" # copy to
$shfcer = "$suscer\$rdg.cer" # destination file
$rdstcp = "10067"
New-RDSessionDeployment -ConnectionBroker $rdb -WebAccessServer $rdw -SessionHost $rds
New-RDSessionCollection -CollectionName $rdc -SessionHost $rds -ConnectionBroker $rdb
Add-WindowsFeature -Name RDS-Gateway -IncludeManagementTools -ComputerName $rdg
Add-RDServer -Server $rdg -Role "RDS-GATEWAY" -ConnectionBroker $rdb -GatewayExternalFqdn $rdg
Invoke-Command -ComputerName $rdg -ArgumentList "$rdu", "$rdg", "$rdz", "$rds" {
 $GatewayAccessGroup = $args[0]
 $RDBrokerDNSInternalName = $args[1]
 $RDBrokerDNSInternalZone = $args[2]
 $RDSHost01 = $args[3]
 Import-Module RemoteDesktopServices
 Remove-Item -Path "RDS:\GatewayServer\CAP\RDG_CAP_AllUsers" -Force -recurse
 Remove-Item -Path "RDS:\GatewayServer\RAP\RDG_RDConnectionBrokers" -Force -recurse
 Remove-Item -Path "RDS:\GatewayServer\RAP\RDG_AllDomainComputers" -Force -recurse
 Remove-Item -Path "RDS:\GatewayServer\GatewayManagedComputerGroups\RDG_RDCBComputers" -Force -recurse
}
#eigenschaften anpassen (tcp port, udp aus, serverfarm fqdn, ssl-bridging wenn proxy)
#rd-cap erstellen (CAP,kennwort+domänen-benutzer,nur zwischenablage, kein limit)
#Wenn der Benutzer Mitglied einer der folgenden Benutzergruppen ist:
#UE17\Domänen-Benutzer
#Wenn der Clientcomputer Mitglied einer der folgenden Computergruppen ist:
#Nicht zutreffend (es wurde keine Computergruppe angegeben)
#Wenn der Benutzer folgende unterstützte Windows-Authentifizierungsmethoden verwendet:
#Kennwort
#Zulassen, dass der Benutzer eine Verbindung mit diesem Remotedesktop-Gatewayserver herstellt, und die Geräteumleitung für die folgenden Clientgeräte deaktivieren:
#Zwischenablage
#Wenn Leerlaufzeitlimit erreicht ist:
# - Nicht zutreffend (keine Leerlaufzeitüberschreitung)
#Wenn Sitzungszeitlimit erreicht ist:
# - Nicht zutreffend (keine Sitzungszeitüberschreitung)
#rd-rap erstellen (RAP,domänen-benutzer,beliebige resource,nur port 3389)
#Wenn der Benutzer Mitglied einer der folgenden Benutzergruppen ist:
#UE17\Domänen-Benutzer
#Der Benutzer kann dann über das Remotedesktopgateway eine Remoteverbindung mit einem beliebigen Computer herstellen
#und der Benutzer kann die Verbindung mit diesen Netzwerkressourcen (Computern) über folgende Ports herstellen:
#Standardport: 3389
Add-DnsServerResourceRecordA -ComputerName $tdc -Name $rdg -ZoneName $rdz -AllowUpdateAny -IPv4Address $rdsip
Add-RDServer -Server $rdl -Role "RDS-LICENSING" -ConnectionBroker $rdb
Set-RDLicenseConfiguration -LicenseServer $rdl -Mode PerUser -ConnectionBroker $rdb -Force
#add server to "terminalserver-licenseserver" in ad, activate license server, install rds cals, check license diagnoser
#in collection, set per user cal and license server
New-RDCertificate -Role RDWebAccess  -DnsName $rdg -Password $rdspw -ExportPath $rdspfx -ConnectionBroker $rdb
copy $rdscer $suscer
Set-RDCertificate -Role RDPublishing -ImportPath $rdspfx -Password $rdspw -ConnectionBroker $rdb -Force
Set-RDCertificate -Role RDRedirector -ImportPath $rdspfx -Password $rdspw -ConnectionBroker $rdb -Force
Set-RDCertificate -Role RDWebAccess  -ImportPath $rdspfx -Password $rdspw -ConnectionBroker $rdb -Force
Set-RDCertificate -Role RDGateway    -ImportPath $rdspfx -Password $rdspw -ConnectionBroker $rdb -Force
#Set-RDPublishedName.ps1
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;Install-PackageProvider Nuget –Force;Install-Module -Name PowerShellGet -Force -SkipPublisherCheck;exit
Install-Module -Name RDWebClientManagement;Install-RDWebClientPackage;Get-RDWebClientPackage
Import-RDWebClientBrokerCert $shfcer;Publish-RDWebClientPackage -Type Production -Latest
netsh advfirewall firewall add rule name=RDG protocol=TCP dir=in localport=$rdstcp action=allow
#make sure all settings are done in collection and elsewhere in server manager / note missing steps
#publish apps
#update registry ()
#test all services with a normal user account
#Import-Certificate -FilePath "\\172.22.17.10\b1_shf\rds.e17.unirez.privatcloud.biz.cer" -CertStoreLocation Cert:\LocalMachine\Root
#212.162.6.43
#https://rds.e17.unirez.privatcloud.biz:10067/rdweb
#https://rds.e17.unirez.privatcloud.biz:10067/rdweb/feed/webfeed.aspx
#https://rds.e17.unirez.privatcloud.biz:10067/rdweb/webclient/index.html

