AsHciADArtifactsPreCreationTool.psm1
|
<#############################################################
# # # Copyright (C) Microsoft Corporation. All rights reserved. # # # #############################################################> # Script to create AD objects from domain admin context prior to azurestack hci deployment driver execution. # # Requirements: # - Ensure that the following parameters must be unquie in AD per cluster instance # - Azurestack hci lifecycle management user. # - Azurestack hci organization unit name. # - Azurestack hci deployment prefix (must be at the max 8 characters). # - Azurestack hci deployment cluster name. # - Physical nodes objects (if already created) must be available under hci ou computers organization unit. # # Objects to be created: # - Hci Organizational Unit that will be the parent to an organizational unit for each instance and 2 sub organizational units (Computers and Users) with group policy inheritance blocked. # - A user account (under users OU) that will have full control to that organizational unit. # - Computer objects (if provided under Computers OU else all computer objects must be present under Computer OU) # - Security groups (under users OU) # - Azurestack Hci cluster object (under computers OU) # # This script should be run by a user that has domain admin privileges to the domain. # # Parameter Ex: # -AsHciOUName "OU=Hci001,OU=HciDeployments,DC=v,DC=masd,DC=stbtest,DC=microsoft,DC=com" [Hci001 OU will be created under OU=HciDeployments,DC=v,DC=masd,DC=stbtest,DC=microsoft,DC=com] # -DomainFQDN "v.masd.stbtest.microsoft.com" # -AsHciClusterName "s-cluster" # # Usage Ex: # # Hci cluster Deployment # # New-HciAdObjectsPreCreation -Deploy -AzureStackLCMUserCredential (get-credential) -AsHciOUName "OU=Hci001,DC=v,DC=masd,DC=stbtest,DC=microsoft,DC=com" -AsHciPhysicalNodeList @("Physical Machine1", "Physical Machine2") -AsHciDeploymentPrefix "Hci001" -DomainFQDN "v.masd.stbtest.microsoft.com" -AsHciClusterName "s-cluster" # # # Hci cluster Upgrade # New-HciAdObjectsPreCreation -Upgrade -AzureStackLCMUserCredential (get-credential) -AsHciOUName "OU=Hci001,DC=v,DC=masd,DC=stbtest,DC=microsoft,DC=com" -AsHciPhysicalNodeList @("Physical Machine1", "Physical Machine2") -AsHciDeploymentPrefix "Hci001" -DomainFQDN "v.masd.stbtest.microsoft.com" -AsHciClusterName "s-cluster" # $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop <# .Synopsis Tests hci organization unit. .Parameter AsHciOUPath The hci ou path. #> function Test-AsHciOU { [CmdletBinding()] Param ( [Parameter(Mandatory = $true)] [ValidateNotNullOrEmpty()] [string] $AsHciOUPath ) $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop try { if (-not [adsi]::Exists("LDAP://$AsHciOUPath")) { Write-Error "'$AsHciOUPath' does not exist. Exception :: $_" } Write-Verbose "Successfully verified $AsHciOUPath" } catch { Write-Error "Unable to verify organization unit '$AsHciOUPath'. Exception :: $_" } } <# .Synopsis Verifies deployment prefix uniqueness. .Parameter AsHciOUPath The hci ou path. .Parameter AsHciDeploymentPrefix The hci deployment prefix. #> function Test-AsHciDeploymentPrefix { [CmdletBinding()] Param ( [Parameter(Mandatory = $true)] [string] $AsHciOUPath, [Parameter(Mandatory = $true)] [string] $AsHciDeploymentPrefix ) $ErrorActionPreference = [System.Management.Automation.ActionPreference]::continue $opsAdminGroup = "$AsHciDeploymentPrefix-OpsAdmin" $hciGroup = Get-AdGroup -Filter { Name -eq $opsAdminGroup} # Test for unique AsHciDeploymentPrefix if ($hciGroup) { if (-not ($hciGroup.DistinguishedName -match $AsHciOUPath) ) { Write-Error "Deployment prefix '$AsHciDeploymentPrefix' is in use, please provide an unique prefix" } } } <# .Synopsis Creates HCI organization unit in a given AD domain. .Parameter DomainOUPath The AD domain organization unit path .Parameter HciOUName The HCI organizational unit name. #> function New-AsHciOrganizationalUnit { [CmdletBinding(SupportsShouldProcess=$true)] Param ( [Parameter(Mandatory = $true)] [string] $DomainOUPath, [Parameter(Mandatory = $true)] [String] $OUName, [Parameter(Mandatory = $false)] [bool] $Rerun =$false ) $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop $ouPath = Get-ADOrganizationalUnit -SearchBase $DomainOUPath -Filter { Name -eq $OUName } | Select-Object DistinguishedName if ($ouPath) { Write-Error "Hci organizational unit '$OUName' exists under '$DomainOUPath', to continue with '$OUName' OU please remove it and execute the tool." } try { New-ADOrganizationalUnit -Name $OUName -Path $DomainOUPath Write-Verbose "Successfully created $OUName organization unit under '$DomainOUPath' " } catch { Write-Error "Failed to create organization unit. Exception :: $_" } } <# .Synopsis Remove hci organization unit. .Parameter AsHciOUPath The hci ou path. #> function Remove-AsHciOU { [CmdletBinding()] Param ( [Parameter(Mandatory = $true)] [ValidateNotNullOrEmpty()] [string] $AsHciOUPath ) $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop try { if ([adsi]::Exists("LDAP://$AsHciOUPath")) { Get-ADOrganizationalUnit -Identity $AsHciOUPath | Set-ADObject -ProtectedFromAccidentalDeletion:$false -PassThru | Remove-ADOrganizationalUnit -Recursive -Confirm:$false Write-Verbose "Successfully deleted $AsHciOUPath" } else { Write-Verbose "OU $AsHciOUPath not found, skipping the remove operation." } } catch { Write-Error "Unable to delete '$AsHciOUPath'. Exception :: $_" } } <# .Synopsis Creates new secruity groups and gMSA accounts if required during update process. .Parameter AsHciLCMUserName The azure stack hci lifecycle management user names .Parameter DeploymentPrefix The hci deployment prefix. .Parameter AsHciOUName The hci ou name. .Parameter DomainFQDN The active directory domain fqdn #> function Update-SecurityGroupsandGMSAAccounts { [CmdletBinding()] Param ( [Parameter(Mandatory = $true)] [string] $AsHciLCMUserName, [Parameter(Mandatory = $true)] [ValidateNotNullOrEmpty()] [String] $AsHciDeploymentPrefix, [Parameter(Mandatory = $true)] [ValidateNotNullOrEmpty()] [string] $AsHciOUName, [Parameter(Mandatory = $true)] [ValidateNotNullOrEmpty()] [string] $DomainFQDN ) $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop # OU names $hciParentOUPath = $AsHciOUName.Split(",",2)[1] $hciOUName = ($AsHciOUName.Split(",",2)[0]).split("=")[1] $computersOU = "Computers" $usersOU = "Users" # Create Hci organization units $asHciOUPath = Get-ADOrganizationalUnit -SearchBase $hciParentOUPath -Filter { Name -eq $hciOUName } $asHciComputersOUPath = Get-ADOrganizationalUnit -SearchBase $asHciOUPath.DistinguishedName -Filter { Name -eq $computersOU } $asHciUsersOUPath = Get-ADOrganizationalUnit -SearchBase $asHciOUPath.DistinguishedName -Filter { Name -eq $usersOU } # Create security groups New-AsHciSecurityGroup -AsHciUsersOuPath $asHciUsersOUPath -AsHciComputersOuPath $asHciComputersOUPath -DeploymentPrefix $AsHciDeploymentPrefix -AsHciLCMUserName $AsHciLCMUserName -Verbose # Create gMSA accounts New-AsHciGmsaAccount -DomainFQDN $DomainFQDN -DeploymentPrefix $AsHciDeploymentPrefix -AsHciUsersOuPath $AsHciUsersOuPath -Verbose } <# .Synopsis Creates hci lifecycle management users under hci users organization unit path. .Parameter AsHciLCMUserName The azure stack hci lifecycle management user names .Parameter DomainFQDN The active directory domain fqdn .Parameter AsHciLCMUserPassword The azure stack hci user password. .Parameter HciUsersOUPath The hci users organization unit path object. #> function New-AsHciUser { [CmdletBinding(SupportsShouldProcess=$true)] Param ( [Parameter(Mandatory = $true)] [String] $AsHciLCMUserName, [Parameter(Mandatory = $true)] [String] $DomainFQDN, [Parameter(Mandatory = $true)] [SecureString] $AsHciUserPassword, [Parameter(Mandatory = $true)] [Microsoft.ActiveDirectory.Management.ADOrganizationalUnit] $AsHciUsersOUPath, [Parameter(Mandatory = $false)] [bool] $Rerun = $false ) $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop try { $user = Get-ADUser -SearchBase $AsHciUsersOUPath -Filter { Name -eq $AsHciLCMUserName } if ($user -and (-not $Rerun)) { Write-Error "$AsHciLCMUserName exists, please provide an unique username." } if ($user) { Write-verbose "$AsHciLCMUserName exists under $AsHciUsersOUPath, skipping." } else { New-ADUser -Name $AsHciLCMUserName -AccountPassword $AsHciUserPassword -UserPrincipalName "$AsHciLCMUserName@$DomainFQDN" -Enabled $true -PasswordNeverExpires $true -path $AsHciUsersOUPath.DistinguishedName Write-Verbose "Successfully created '$AsHciLCMUserName' under '$AsHciUsersOUPath'" } } catch { if ($_ -match 'The operation failed because UPN value provided for addition/modification is not unique forest-wide') { Write-Error "UserPrincipalName '$AsHciLCMUserName@$DomainFQDN' already exists, please provide a different user name" } elseif ($_ -match 'The specified account already exists') { Write-Error "$AsHciLCMUserName already exists, please provide a different user name" } else { Write-Error "Unable to create $AsHciLCMUserName. Exception :: $_ " } } } <# .Synopsis Grants full access permissions of hci organization unit to hci lifecycle management user. .Parameter AsHciLCMUserName The hci lifecycle management user name. .Parameter AsHciOUPath The hci organization unit path. #> function Grant-HciOuPermissionsToHciLCMUser { [CmdletBinding(SupportsShouldProcess=$true)] Param ( [Parameter(Mandatory = $true)] [string] $AsHciLCMUserName, [Parameter(Mandatory = $true)] [Microsoft.ActiveDirectory.Management.ADOrganizationalUnit] $AsHciOUPath ) $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop try { $ouPath = "AD:\$($AsHciOUPath.DistinguishedName)" $userSecurityIdentifier = Get-ADuser -Identity $AsHciLCMUserName $userSID = [System.Security.Principal.SecurityIdentifier] $userSecurityIdentifier.SID $acl = Get-Acl -Path $ouPath $userIdentityReference = [System.Security.Principal.IdentityReference] $userSID $adRight = [System.DirectoryServices.ActiveDirectoryRights] "GenericAll" $type = [System.Security.AccessControl.AccessControlType] "Allow" $inheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] "All" $rule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($userIdentityReference, $adRight, $type, $inheritanceType) $acl.AddAccessRule($Rule) Set-Acl -Path $ouPath -AclObject $acl (Get-Acl $ouPath).Access | Where-Object IdentityReference -eq $userSID Write-Verbose "Successfully granted access permissions '$($AsHciOUPath.DistinguishedName)' to '$AsHciLCMUserName'" } catch { Write-Error "Failed to grant access permissions '$($AsHciOUPath.DistinguishedName)' to '$AsHciLCMUserName'. Error :: $_" } } <# .Synopsis Pre creates computer object in AD under hci computers ou path. .Parameter Machines The list of machines required for hci deployment. .Parameter DomainFQDN The domain fqdn. .Parameter HciComputerOuPath The hci computers ou path. #> function New-MachineObject { [CmdletBinding(SupportsShouldProcess=$true)] Param ( [Parameter(Mandatory = $true)] [String[]] $Machines, [Parameter(Mandatory = $true)] [String] $DomainFQDN, [Parameter(Mandatory = $true)] [Microsoft.ActiveDirectory.Management.ADOrganizationalUnit] $AsHciComputerOuPath ) $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop foreach ($node in $Machines) { try { $computerObject = Get-ADComputer -SearchBase $($AsHciComputerOuPath.DistinguishedName) -Filter {Name -eq $node } if ($computerObject) { Write-Verbose "$node exists in AD, skipping computer object creation." } else { New-ADComputer -Name $node -SAMAccountName $node -DNSHostName "$node.$DomainFQDN" -Path $AsHciComputerOuPath Write-Verbose "Successfully created $node computer object under $($AsHciComputerOuPath.DistinguishedName)" } } catch { if ($_ -match 'The specified account already exists') { Write-Error "$node object already exists, move $node object under '$($AsHciComputerOuPath.DistinguishedName)'" } else { Write-Error "Error :: $_" } } } } <# .Synopsis Enables dynamic updates in the DNS zone corresponding to the domain and gives NC VMs permissions to update it. .Parameter DomainFQDN The domain fqdn. .Parameter DeploymentPrefix The deployment domain prefix. .Parameter OrganizationalUnit The OrganizationalUnit object under which the NC computer objects will be created .Parameter DNSServerIP IP of the DNS Server. #> function Set-DynamicDNSAndConfigureDomainZoneForNC { [CmdletBinding(SupportsShouldProcess=$true)] Param ( [Parameter(Mandatory = $true)] [String] $DomainFQDN, [Parameter(Mandatory = $true)] [string] $DeploymentPrefix, [Parameter(Mandatory = $true)] [Microsoft.ActiveDirectory.Management.ADOrganizationalUnit] $OrganizationalUnit, [Parameter(Mandatory=$false)] [string] $DNSServerIP ) $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop try { $dnsZone = Get-DnsServerZone -Name $DomainFQDN -ComputerName $DNSServerIP if ($dnsZone.DynamicUpdate -eq "NonsecureAndSecure") { Write-Verbose "DNS server is configured to accept dynamic updates from secure and non-secure sources. No further DNS configuration changes are needed." return } Write-Verbose "Configuring DNS server to accept secure dynamic updates. Identities with the right access will be allowed to update DNS entries." Set-DnsServerPrimaryZone -Name $DomainFQDN -ComputerName $DNSServerIP -DynamicUpdate Secure $ncVmNames = @("$DeploymentPrefix-NC01", "$DeploymentPrefix-NC02", "$DeploymentPrefix-NC03") Write-Verbose "Pre-creating the following computer objects for the Network Controller nodes: $ncVmNames." New-MachineObject -Machines $ncVmNames -DomainFQDN $DomainFQDN -AsHciComputerOuPath $OrganizationalUnit -Verbose $domainZoneAcl = Get-Acl "AD:\$($dnsZone.DistinguishedName)" foreach ($ncVm in $ncVmNames) { Write-Verbose "Giving access to $ncVm to allow it to do DNS dynamic updates." $adComputer = Get-ADComputer $ncVm $ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $adComputer.SID,'GenericAll','Allow' $domainZoneAcl.AddAccessRule($ace) } Set-Acl -AclObject $domainZoneAcl "AD:\$($dnsZone.DistinguishedName)" Write-Output "List of AD identities with write permissions that are allowed to do DNS dynamic updates to DNS zone: $DomainFQDN." $domainZoneAcl.Access | where -FilterScript {($_.ActiveDirectoryRights -band ` [System.DirectoryServices.ActiveDirectoryRights]::GenericWrite) -eq ` [System.DirectoryServices.ActiveDirectoryRights]::GenericWrite -and ` $_.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow} ` | select @{n="Identities";e={$_.IdentityReference}} } catch { Write-Error "Failed to configure the DNS server to support dynamic updates. Please enable dynamic updates manually in your DNS server." } } <# .Synopsis Prestage cluster computer object in AD Refer to https://docs.microsoft.com/en-us/windows-server/failover-clustering/prestage-cluster-adds .Parameter OrganizationalUnit The OrganizationalUnit object under which to create the cluster computer object .Parameter ClusterName The cluster name .Example $ou = Get-ADOrganizationalUnit -Filter 'Name -eq "testou"' New-ADPrestagedCluster -OrganizationalUnit $ou -ClusterName 's-cluster' #> function New-PrestagedAsHciCluster { [CmdletBinding(SupportsShouldProcess=$true)] param( [Parameter(Mandatory=$true)] [ValidateNotNull()] [Microsoft.ActiveDirectory.Management.ADOrganizationalUnit] $OrganizationalUnit, [Parameter(Mandatory=$true)] [ValidateNotNullOrEmpty()] [string] $ClusterName ) $ErrorActionPreference = "Stop" Write-Verbose "Checking computer '$ClusterName' under OU '$($OrganizationalUnit.DistinguishedName)' ..." -Verbose $cno = Get-ADComputer -Filter "Name -eq '$ClusterName'" -SearchBase $OrganizationalUnit if ($cno) { Write-Verbose "Found existing computer with name '$ClusterName', skip creation." } else { Write-Verbose "Creating computer '$ClusterName' under OU '$($OrganizationalUnit.DistinguishedName)' ..." -Verbose $cno = New-ADComputer -Name $ClusterName -Description 'Cluster Name Object of HCI deployment' -Path $OrganizationalUnit.DistinguishedName -Enabled $false -PassThru -Verbose } $cno | Set-ADObject -ProtectedFromAccidentalDeletion:$true -Verbose Write-Verbose "Configuring permission for computer '$ClusterName' ..." -Verbose $ouPath = "AD:\$($OrganizationalUnit.DistinguishedName)" $ouAcl = Get-Acl $ouPath $ouAclUpdate = New-Object System.DirectoryServices.ActiveDirectorySecurity foreach ($ace in $ouAcl.Access) { if ($ace.IdentityReference -notlike "*\$ClusterName$") { $ouAclUpdate.AddAccessRule($ace) } } # Refer to https://docs.microsoft.com/en-us/windows/win32/adschema/c-computer $computersObjectType = [System.Guid]::New('bf967a86-0de6-11d0-a285-00aa003049e2') $allObjectType = [System.Guid]::Empty $ace1 = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $cno.SID, "CreateChild", "Allow", $computersObjectType, "All" $ace2 = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $cno.SID, "ReadProperty", "Allow", $allObjectType, "All" $ouAclUpdate.AddAccessRule($ace1) $ouAclUpdate.AddAccessRule($ace2) $ouAclUpdate | Set-Acl $ouPath -Verbose (Get-Acl $ouPath).Access | Where-Object IdentityReference -like "*\$ClusterName$" Write-Verbose "Finish prestage for cluster '$ClusterName'." -Verbose } <# .Synopsis Creates required security groups for hci deployment. .Parameter AsHciUsersOuPath The hci users organization unit object. .Parameter AsHciComputersOuPath The hci computers organization unit object. .Parameter DeploymentPrefix The hci deployment prefix. .Parameter PhysicalMachines The hci cluster physical machines. .Parameter AsHciLCMUserName The hci lifecycle management username. #> function New-AsHciSecurityGroup { [CmdletBinding(SupportsShouldProcess=$true)] Param ( [Parameter(Mandatory = $true)] [Microsoft.ActiveDirectory.Management.ADOrganizationalUnit] $AsHciUsersOuPath, [Parameter(Mandatory = $true)] [Microsoft.ActiveDirectory.Management.ADOrganizationalUnit] $AsHciComputersOuPath, [Parameter(Mandatory = $true)] [string] $DeploymentPrefix, [Parameter(Mandatory = $false)] [string[]] $PhysicalMachines, [Parameter(Mandatory = $true)] [string] $AsHciLCMUserName ) $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop Write-Verbose "Creating security groups under '$($AsHciUsersOuPath.DistinguishedName)'" # List of security groups required for hci deployment. $securityGroups = @("$($DeploymentPrefix)-Sto-SG", "$($DeploymentPrefix)-OpsAdmin" ) foreach ($securityGroup in $securityGroups) { try { $adGroup = Get-AdGroup -SearchBase $($AsHciUsersOuPath.DistinguishedName) -Filter { Name -eq $SecurityGroup} if ($adGroup) { Write-Verbose "$securityGroup is present on AD hence skipping." } else { New-ADGroup -Name $SecurityGroup -DisplayName $securityGroup -Description $securityGroup -GroupCategory Security -GroupScope DomainLocal -Path $($AsHciUsersOuPath.DistinguishedName) Write-Verbose "$securityGroup successfully created." } } catch { Write-Error "$SecurityGroup creation failed. Error :: $_ " } } Write-Verbose "Successfully created security groups under '$($AsHciUsersOuPath.DistinguishedName)'" $physicalMachineSecurityGroups = @("$($DeploymentPrefix)-Sto-SG") #Add physical machines to the security groups. foreach ($physicalMachine in $PhysicalMachines) { $machineObject = Get-ADComputer -SearchBase $($AsHciComputersOuPath.DistinguishedName) -Filter {Name -eq $physicalMachine} Add-Membership -IdentityObject $machineObject -SecurityGroupNames $physicalMachineSecurityGroups -AsHciUsersOUPath $($AsHciUsersOuPath.DistinguishedName) } #Add user membership. $AsHciUserSecurityGroups = @("$($AsHciDeploymentPrefix)-OpsAdmin") $userIdentity = Get-ADUser -SearchBase $AsHciUsersOuPath.DistinguishedName -Filter { Name -eq $AsHciLCMUserName } Add-Membership -IdentityObject $userIdentity -SecurityGroupNames $AsHciUserSecurityGroups -AsHciUsersOuPath $AsHciUsersOuPath.DistinguishedName } <# .Synopsis Creates required group managed service accounts for hci deployment. .Parameter DomainFQDN The domain fqdn. .Parameter AsHciUsersOuPath The hci users organization unit object. #> function New-AsHciGmsaAccount { [CmdletBinding(SupportsShouldProcess=$true)] Param ( [Parameter(Mandatory = $true)] [String] $DomainFQDN, [Parameter(Mandatory = $true)] [String] $DeploymentPrefix, [Parameter(Mandatory = $true)] [Microsoft.ActiveDirectory.Management.ADOrganizationalUnit] $AsHciUsersOuPath ) $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop return # List of gMSA accounts, it's membership, principals allowed to retrieve the password and service principal names if any. $gmsaAccounts = @([pscustomobject]@{ GmsaName="$($DeploymentPrefix)-BM-ECE"; PrincipalsAllowedToRetrieveManagedPassword= @("$($DeploymentPrefix)-Sto-SG"); ServicePrincipalName=@("$($DeploymentPrefix)/ae3299a9-3e87-4186-bd99-c43c9ae6a571"); MemberOf=@("$($DeploymentPrefix)-EceSG", "$($DeploymentPrefix)-BM-ECESG", "$($DeploymentPrefix)-FsAcl-InfraSG")}, [pscustomobject]@{ GmsaName="$($DeploymentPrefix)-EceSA"; PrincipalsAllowedToRetrieveManagedPassword= @("$($DeploymentPrefix)-Sto-SG"); ServicePrincipalName=@("$($DeploymentPrefix)/4dde37cc-6ee0-4d75-9444-7061e156507f"); MemberOf=@("$($DeploymentPrefix)-FsAcl-InfraSG", "$($DeploymentPrefix)-EceSG", "$($DeploymentPrefix)-BM-EceSG")}) # Creating gmsa accounts. foreach ($gmsaAccount in $GmsaAccounts) { try { $gmsaName = $($gmsaAccount.GmsaName) $adGmsaAccount = Get-ADServiceAccount -SearchBase $($AsHciUsersOuPath.DistinguishedName) -Filter {Name -eq $gmsaName} if ($adGmsaAccount) { Write-Verbose "$gmsaName exists hence skipping." } else { if ($($gmsaAccount.ServicePrincipalName).count -ge 1) { New-ADServiceAccount -Name $gmsaName -DNSHostName "$($gmsaAccount.GmsaName).$DomainFQDN" -ServicePrincipalNames $($gmsaAccount.ServicePrincipalName) -PrincipalsAllowedToRetrieveManagedPassword $($gmsaAccount.PrincipalsAllowedToRetrieveManagedPassword) -ManagedPasswordIntervalInDays 1 -KerberosEncryptionType AES256 -Path $($AsHciUsersOuPath.DistinguishedName) } else { New-ADServiceAccount -Name $gmsaName -DNSHostName "$($gmsaAccount.GmsaName).$DomainFQDN" -PrincipalsAllowedToRetrieveManagedPassword $($gmsaAccount.PrincipalsAllowedToRetrieveManagedPassword) -ManagedPasswordIntervalInDays 1 -KerberosEncryptionType AES256 -Path $($AsHciUsersOuPath.DistinguishedName) } Write-Verbose "Successfully created $gmsaName on AD" } $serviceAccountIdentityObject = Get-ADServiceAccount -SearchBase $($AsHciUsersOuPath.DistinguishedName) -Filter {Name -eq $gmsaName} Add-Membership -IdentityObject $serviceAccountIdentityObject -SecurityGroupNames $($gmsaAccount.MemberOf) -AsHciUsersOuPath $($AsHciUsersOuPath.DistinguishedName) } catch { if ($_ -match 'The operation failed because SPN value provided for addition/modification is not unique forest-wide') { Write-Error "SPN '$($gmsaAccount.ServicePrincipalName)' already exists, please remove the SPN and Rerun the tool." } Write-Error "Failed to create $gmsaName or adding it's membership. Error :: $_" } } } <# .Synopsis Helper function to add the membership of an identity object to the security group name. .Parameter IdentityObject The ad identity object. .Parameter SecurityGroupNames The list of security group names. .Parameter HciUsersOuPath The hci users ou path. #> function Add-Membership { [CmdletBinding()] Param ( [Parameter(Mandatory = $true)] $IdentityObject, [Parameter(Mandatory = $true)] $SecurityGroupNames, [Parameter(Mandatory = $true)] $AsHciUsersOuPath ) $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop foreach ($securityGroupName in $SecurityGroupNames) { try { $groupObject = Get-ADGroup -SearchBase $AsHciUsersOuPath -Filter {Name -eq $securityGroupName} if (-not $groupObject) { Write-Error "$securityGroupName is not available." } $isMember = Get-ADGroupMember -Identity $groupObject |Where-Object {$_.Name -eq $($IdentityObject.Name)} if ($isMember) { Write-Verbose "$($IdentityObject.Name) is already a member of $securityGroupName hence skipping" } else { Add-ADGroupMember -Identity $groupObject -Members $IdentityObject Write-Verbose "Finished adding '$($IdentityObject.Name)' as a member of the group '$securityGroupName'." } } catch { Write-Error "Failed to add the $($IdentityObject.Name) to $securityGroupName. Error :: $_" } } } <# .Synopsis Blocks gpo inheritance to Hci ou .Parameter HciOUs List of hci ou #> function Block-GPInheritance { [CmdletBinding()] Param ( [Parameter(Mandatory = $true)] [Microsoft.ActiveDirectory.Management.ADOrganizationalUnit[]] $AsHciOUs ) $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop foreach ($asHciOu in $AsHciOUs) { try { $gpInheritance = Get-GPInheritance -Target $($asHciOu.DistinguishedName) if (-not $gpInheritance.GpoInheritanceBlocked) { $gpInheritance = Set-GPInheritance -Target $($asHciOu.DistinguishedName) -IsBlocked Yes } Write-Verbose "Gpo inheritance blocked for '$($asHciOu.DistinguishedName)', inheritance blocked state is : $($gpInheritance.GpoInheritanceBlocked)" } catch { Write-Error "Failed to block gpo inheritance for '$($asHciOu.DistinguishedName)'. Error :: $_" } } } <# .Synopsis Verfies the below obejcts are unique or not. Lifecycle management user Organizational unit Phyiscal machines Deployment prefix Cluster name .Parameter AzureStackLCMUserCredential Lifecycle management credentails. .Parameter AsHciOUName Organizational unit. .Parameter AsHciPhysicalNodeList Physical machines list. .Parameter AsHciDeploymentPrefix Deployment prefix. .Parameter AsHciClusterName Cluster name. #> function Test-UniqueAdObjects { Param( [PSCredential] $AzureStackLCMUserCredential, [string] $AsHciOUName, [string[]] $AsHciPhysicalNodeList, [string] $AsHciDeploymentPrefix, [string] $AsHciClusterName ) $Errors = New-Object System.Collections.Generic.List[System.Object] $asHciLCMUserName = $AzureStackLCMUserCredential.UserName if ( Get-ADUser -Filter { Name -eq $asHciLCMUserName }) { $Errors.Add(" UserName :: '$asHciLCMUserName'") } if (-not ([string]::IsNullOrWhitespace($AsHciClusterName))) { if (Get-ADComputer -Filter "Name -eq '$AsHciClusterName'") { $Errors.Add(" Cluster Name :: '$AsHciClusterName'") } } foreach ($node in $AsHciPhysicalNodeList) { if (Get-ADComputer -Filter "Name -eq '$node'") { $Errors.Add(" Physical Node :: '$node'") } } $opsAdminGroup = "$AsHciDeploymentPrefix-OpsAdmin" if (Get-AdGroup -Filter { Name -eq $opsAdminGroup} ) { $Errors.Add(" Deployment prefix :: '$AsHciDeploymentPrefix'") } if ($Errors.Count -ge 1) { Write-Warning "Below object/objects are already available on AD please provide unique values and run the tool." foreach ($error in $Errors) { Write-Warning "$error" } Write-Error "AD precreation object failed" } } <# .Synopsis Creates required active directory objects for deployment / upgrade driver execution. .Parameter Deploy Deployment. .Parameter Upgrade Upgrade. .Parameter AzureStackLCMUserCredential Lifecycle management credentails. .Parameter AsHciOUName Organizational unit. .Parameter AsHciPhysicalNodeList Physical machines list. .Parameter AsHciDeploymentPrefix Deployment prefix. .Parameter AsHciClusterName Cluster name. .Parameter DomainFQDN Domain FQDN. .Parameter DNSServerIP DNS server ipaddress, #> function New-AdObjectsForDeployOrUpgrade { Param( [Switch] $Deploy, [Switch] $Upgrade, [Parameter(Mandatory = $true)] [ValidateNotNullOrEmpty()] [PSCredential] $AzureStackLCMUserCredential, [Parameter(Mandatory = $true)] [ValidateNotNullOrEmpty()] [string] $AsHciOUName, [Parameter(Mandatory = $true)] [ValidateLength(1,8)] [string] $AsHciDeploymentPrefix, [Parameter(Mandatory = $true)] [ValidateNotNullOrEmpty()] [string] $DomainFQDN, [string[]] $AsHciPhysicalNodeList, [Parameter(Mandatory = $true)] [ValidateLength(1,15)] [string] $AsHciClusterName, [string] $DNSServerIP ) # OU names $hciOUName = ($AsHciOUName.Split(",",2)[0]).split("=")[1] $computersOU = "Computers" $usersOU = "Users" # Create Hci organization units New-AsHciOrganizationalUnit -DomainOUPath $hciParentOUPath -OUName $hciOUName -Verbose $asHciOUPath = Get-ADOrganizationalUnit -SearchBase $hciParentOUPath -Filter { Name -eq $hciOUName } # Create computers OU under $asHciOUPath New-AsHciOrganizationalUnit -DomainOUPath $($asHciOUPath.DistinguishedName) -OUName $computersOU -Verbose $asHciComputersOUPath = Get-ADOrganizationalUnit -SearchBase $asHciOUPath.DistinguishedName -Filter { Name -eq $computersOU } # Create users OU under $asHciOUPath New-AsHciOrganizationalUnit -DomainOUPath $($asHciOUPath.DistinguishedName) -OUName $usersOU -Verbose $asHciUsersOUPath = Get-ADOrganizationalUnit -SearchBase $asHciOUPath.DistinguishedName -Filter { Name -eq $usersOU } # Create Hci lifecycle management user under Hci users OU path $asHciLCMUserName = $AzureStackLCMUserCredential.UserName $asHciLCMUserPassword = $AzureStackLCMUserCredential.Password New-AsHciUser -AsHciLCMUserName $asHciLCMUserName -AsHciUserPassword $asHciLCMUserPassword -DomainFQDN $DomainFQDN -AsHciUsersOUPath $asHciUsersOUPath -Verbose # Grant permissions to hci lifecycle management user Grant-HciOuPermissionsToHciLCMUser -AsHciLCMUserName $asHciLCMUserName -AsHciOUPath $asHciOUPath -Verbose if ($Deploy) { # Pre-create computer objects New-MachineObject -Machines $AsHciPhysicalNodeList -DomainFQDN $DomainFQDN -AsHciComputerOuPath $asHciComputersOUPath -Verbose } elseif ($Upgrade) { # Move cluster and physical machine objects to Hci OU Move-AsHciAdObjetToHciOU -AsHciPhysicalNodeList $AsHciPhysicalNodeList -AsHciClusterName $AsHciClusterName -AsHciComputerOuPath $asHciComputersOUPath -Verbose } # Pre-stage cluster objects New-PrestagedAsHciCluster -OrganizationalUnit $asHciComputersOUPath -ClusterName $AsHciClusterName -Verbose # Create security groups New-AsHciSecurityGroup -AsHciUsersOuPath $asHciUsersOUPath -AsHciComputersOuPath $asHciComputersOUPath -PhysicalMachines $AsHciPhysicalNodeList -DeploymentPrefix $AsHciDeploymentPrefix -AsHciLCMUserName $AsHciLCMUserName -Verbose # Block gpo inheritance to hci ou Block-GPInheritance -AsHciOUs @($asHciOUPath, $asHciUsersOUPath,$asHciComputersOUPath) -Verbose if ($DNSServerIP) { # Configure the DNS to support dynamic updates and give NC VMs permissions to update the domain zone Set-DynamicDNSAndConfigureDomainZoneForNC -DomainFQDN $DomainFQDN -DeploymentPrefix $AsHciDeploymentPrefix -OrganizationalUnit $asHciComputersOUPath -DNSServerIP $DNSServerIP -Verbose } else { Write-Warning "DNSServerIP parameter was not provided, so configuring dynamic DNS updates on the server was skipped. Please make sure that your DNS supports dynamic updates and that Network Controller VMs have access to do DNS updates." } } <# .Synopsis Move existing AD objects to Hci organizational units. E.g., Move the cluster name object, the host computer objects to the Hci Computers OU. .Parameter AsHciPhysicalNodeList Physical machines list. .Parameter AsHciClusterName Cluster name. .Parameter AsHciComputerOuPath The Hci Computers OrganizationalUnit where the AD computer objects should be moved to. #> function Move-AsHciAdObjetToHciOU { Param( [Parameter(Mandatory = $true)] [string[]] $AsHciPhysicalNodeList, [Parameter(Mandatory = $true)] [ValidateNotNullOrEmpty()] [string] $AsHciClusterName, [Parameter(Mandatory=$true)] [ValidateNotNull()] [Microsoft.ActiveDirectory.Management.ADOrganizationalUnit] $AsHciComputerOuPath ) $AsHciPhysicalNodeList + $AsHciClusterName | ForEach-Object { $computerObjName = $_ # Check existence $adComputer = Get-ADComputer -Filter { Name -eq $computerObjName } -Property ProtectedFromAccidentalDeletion if (-not $adComputer) { Write-Error "Computer object '$computerObjName' not found in AD." } # Check whether it is in target OU if (-not (Get-ADComputer -Filter { Name -eq $computerObjName } -SearchBase $AsHciComputerOuPath)) { # Unprotect the ad object before moving, otherwise access will be denied $isProtected = $adComputer.ProtectedFromAccidentalDeletion if ($isProtected) { Write-Verbose "Unprotect computer object '$computerObjName' before moving" $adComputer | Set-ADObject -ProtectedFromAccidentalDeletion:$false } Write-Verbose "Moving computer object '$computerObjName' to OU '$($AsHciComputerOuPath.DistinguishedName)'" $adComputer = $adComputer | Move-ADObject -TargetPath $AsHciComputerOuPath -PassThru # Reprotect after moving if ($isProtected) { Write-Verbose "Reprotect computer object '$computerObjName' after moving" $adComputer | Set-ADObject -ProtectedFromAccidentalDeletion:$true } } else { Write-Verbose "Computer object '$computerObjName' is already in OU '$($AsHciComputerOuPath.DistinguishedName)'" } } } <# .Synopsis Cmdlet to Create required active directory objects. .Parameter Deploy Deployment. .Parameter Upgrade Upgrade. .Parameter AzureStackLCMUserCredential Lifecycle management credentials. .Parameter AsHciOUName Organizational unit. .Parameter AsHciPhysicalNodeList Physical machines list. .Parameter AsHciDeploymentPrefix Deployment prefix. .Parameter AsHciClusterName Cluster name. .Parameter DomainFQDN Domain FQDN. .Parameter DNSServerIP DNS server ipaddress, #> function New-HciAdObjectsPreCreation { [CmdletBinding( DefaultParameterSetName= 'Deploy' )] Param( [Parameter(ParameterSetName = 'Deploy', Mandatory=$true)] [Switch] $Deploy, [Parameter(ParameterSetName = 'Upgrade', Mandatory=$true)] [Switch] $Upgrade, [Parameter(ParameterSetName = 'Deploy', Mandatory=$true)] [Parameter(ParameterSetName = 'Upgrade', Mandatory=$true)] [ValidateNotNullOrEmpty()] [PSCredential] $AzureStackLCMUserCredential, [Parameter(ParameterSetName = 'Deploy', Mandatory=$true)] [Parameter(ParameterSetName = 'Upgrade', Mandatory=$true)] [validatePattern('^(OU=[^,]+,)+(DC=[^,]+,)*DC=[^,]+$')] [ValidateNotNullOrEmpty()] [string] $AsHciOUName, [Parameter(ParameterSetName = 'Deploy', Mandatory=$true)] [Parameter(ParameterSetName = 'Upgrade', Mandatory=$true)] [ValidateNotNullOrEmpty()] [ValidateLength(1,15)] [validatePattern("^[0-9a-z]([0-9a-z\-]{0,61}[0-9a-z])")] [string[]] $AsHciPhysicalNodeList, [Parameter(ParameterSetName = 'Deploy', Mandatory=$true)] [Parameter(ParameterSetName = 'Upgrade', Mandatory=$true)] [ValidateLength(1,8)] [validatePattern('^([a-zA-Z])(\-?[a-zA-Z\d])*$')] [string] $AsHciDeploymentPrefix, [Parameter(ParameterSetName = 'Deploy', Mandatory=$true)] [Parameter(ParameterSetName = 'Upgrade', Mandatory=$true)] [ValidateNotNullOrEmpty()] [string] $DomainFQDN, [Parameter(ParameterSetName = 'Deploy', Mandatory=$true)] [Parameter(ParameterSetName = 'Upgrade', Mandatory=$true)] [ValidateNotNullOrEmpty()] [validatePattern('^((?!-)[A-Za-z0-9-]+(?<!-))$')] [string] $AsHciClusterName, [Parameter(ParameterSetName = 'Deploy', Mandatory=$false)] [ValidateNotNullOrEmpty()] [string] $DNSServerIP ) # import required modules $modules = @('ActiveDirectory','GroupPolicy','Kds') foreach ($module in $modules) { Import-Module -Name $module -Verbose:$false -ErrorAction Stop | Out-Null } $hciParentOUPath = $AsHciOUName.Split(",",2)[1] # Test hci parent ou path exists or not." Test-AsHciOU -AsHciOUPath $hciParentOUPath -Verbose Test-AsHciDeploymentPrefix -AsHciOUPath $AsHciOUName -AsHciDeploymentPrefix $AsHciDeploymentPrefix -Verbose # Create AD objects for a fresh HCI deployment. if ($Deploy) { Test-UniqueAdObjects -AzureStackLCMUserCredential $AzureStackLCMUserCredential ` -AsHciOUName $AsHciOUName ` -AsHciPhysicalNodeList $AsHciPhysicalNodeList ` -AsHciClusterName $AsHciClusterName ` -AsHciDeploymentPrefix $AsHciDeploymentPrefix New-AdObjectsForDeployOrUpgrade -Deploy ` -AzureStackLCMUserCredential $AzureStackLCMUserCredential ` -AsHciOUName $AsHciOUName ` -AsHciDeploymentPrefix $AsHciDeploymentPrefix ` -DomainFQDN $DomainFQDN ` -AsHciPhysicalNodeList $AsHciPhysicalNodeList ` -AsHciClusterName $AsHciClusterName ` -DNSServerIP $DNSServerIP } elseif ($Upgrade) { Test-UniqueAdObjects -AzureStackLCMUserCredential $AzureStackLCMUserCredential ` -AsHciOUName $AsHciOUName ` -AsHciDeploymentPrefix $AsHciDeploymentPrefix New-AdObjectsForDeployOrUpgrade -Upgrade ` -AzureStackLCMUserCredential $AzureStackLCMUserCredential ` -AsHciOUName $AsHciOUName ` -AsHciDeploymentPrefix $AsHciDeploymentPrefix ` -DomainFQDN $DomainFQDN ` -AsHciPhysicalNodeList $AsHciPhysicalNodeList ` -AsHciClusterName $AsHciClusterName ` -DNSServerIP $DNSServerIP } else { Write-Error "Invalid operation" } } Export-ModuleMember -Function New-HciAdObjectsPreCreation Export-ModuleMember -Function Remove-AsHciOU Export-ModuleMember -Function Update-SecurityGroupsandGMSAAccounts # SIG # Begin signature block # MIIoKgYJKoZIhvcNAQcCoIIoGzCCKBcCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBAstvRzYxcAMBu # e0H4rU1KFaundrhH3Ho9ar3Jz2P71KCCDXYwggX0MIID3KADAgECAhMzAAADTrU8 # esGEb+srAAAAAANOMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p # bmcgUENBIDIwMTEwHhcNMjMwMzE2MTg0MzI5WhcNMjQwMzE0MTg0MzI5WjB0MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB # AQDdCKiNI6IBFWuvJUmf6WdOJqZmIwYs5G7AJD5UbcL6tsC+EBPDbr36pFGo1bsU # p53nRyFYnncoMg8FK0d8jLlw0lgexDDr7gicf2zOBFWqfv/nSLwzJFNP5W03DF/1 # 1oZ12rSFqGlm+O46cRjTDFBpMRCZZGddZlRBjivby0eI1VgTD1TvAdfBYQe82fhm # WQkYR/lWmAK+vW/1+bO7jHaxXTNCxLIBW07F8PBjUcwFxxyfbe2mHB4h1L4U0Ofa # +HX/aREQ7SqYZz59sXM2ySOfvYyIjnqSO80NGBaz5DvzIG88J0+BNhOu2jl6Dfcq # jYQs1H/PMSQIK6E7lXDXSpXzAgMBAAGjggFzMIIBbzAfBgNVHSUEGDAWBgorBgEE # AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUnMc7Zn/ukKBsBiWkwdNfsN5pdwAw # RQYDVR0RBD4wPKQ6MDgxHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEW # MBQGA1UEBRMNMjMwMDEyKzUwMDUxNjAfBgNVHSMEGDAWgBRIbmTlUAXTgqoXNzci # tW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vd3d3Lm1pY3Jvc29mdC5j # b20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3JsMGEG # CCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQu # Y29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3J0 # MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAD21v9pHoLdBSNlFAjmk # mx4XxOZAPsVxxXbDyQv1+kGDe9XpgBnT1lXnx7JDpFMKBwAyIwdInmvhK9pGBa31 # TyeL3p7R2s0L8SABPPRJHAEk4NHpBXxHjm4TKjezAbSqqbgsy10Y7KApy+9UrKa2 # kGmsuASsk95PVm5vem7OmTs42vm0BJUU+JPQLg8Y/sdj3TtSfLYYZAaJwTAIgi7d # hzn5hatLo7Dhz+4T+MrFd+6LUa2U3zr97QwzDthx+RP9/RZnur4inzSQsG5DCVIM # pA1l2NWEA3KAca0tI2l6hQNYsaKL1kefdfHCrPxEry8onJjyGGv9YKoLv6AOO7Oh # JEmbQlz/xksYG2N/JSOJ+QqYpGTEuYFYVWain7He6jgb41JbpOGKDdE/b+V2q/gX # UgFe2gdwTpCDsvh8SMRoq1/BNXcr7iTAU38Vgr83iVtPYmFhZOVM0ULp/kKTVoir # IpP2KCxT4OekOctt8grYnhJ16QMjmMv5o53hjNFXOxigkQWYzUO+6w50g0FAeFa8 # 5ugCCB6lXEk21FFB1FdIHpjSQf+LP/W2OV/HfhC3uTPgKbRtXo83TZYEudooyZ/A # Vu08sibZ3MkGOJORLERNwKm2G7oqdOv4Qj8Z0JrGgMzj46NFKAxkLSpE5oHQYP1H # tPx1lPfD7iNSbJsP6LiUHXH1MIIHejCCBWKgAwIBAgIKYQ6Q0gAAAAAAAzANBgkq # hkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x # EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv # bjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 # IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEwOTA5WjB+MQswCQYDVQQG # EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG # A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQg # Q29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC # CgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+laUKq4BjgaBEm6f8MMHt03 # a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc6Whe0t+bU7IKLMOv2akr # rnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4Ddato88tt8zpcoRb0Rrrg # OGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+lD3v++MrWhAfTVYoonpy # 4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nkkDstrjNYxbc+/jLTswM9 # sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6A4aN91/w0FK/jJSHvMAh # dCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmdX4jiJV3TIUs+UsS1Vz8k # A/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL5zmhD+kjSbwYuER8ReTB # w3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zdsGbiwZeBe+3W7UvnSSmn # Eyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3T8HhhUSJxAlMxdSlQy90 # lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS4NaIjAsCAwEAAaOCAe0w # ggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRIbmTlUAXTgqoXNzcitW2o # ynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYD # VR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBDuRQFTuHqp8cx0SOJNDBa # BgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2Ny # bC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3JsMF4GCCsG # AQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3dy5taWNyb3NvZnQuY29t # L3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3J0MIGfBgNV # HSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEFBQcCARYzaHR0cDovL3d3 # dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1hcnljcHMuaHRtMEAGCCsG # AQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkAYwB5AF8AcwB0AGEAdABl # AG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn8oalmOBUeRou09h0ZyKb # C5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7v0epo/Np22O/IjWll11l # hJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0bpdS1HXeUOeLpZMlEPXh6 # I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/KmtYSWMfCWluWpiW5IP0 # wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvyCInWH8MyGOLwxS3OW560 # STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBpmLJZiWhub6e3dMNABQam # ASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJihsMdYzaXht/a8/jyFqGa # J+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYbBL7fQccOKO7eZS/sl/ah # XJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbSoqKfenoi+kiVH6v7RyOA # 9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sLgOppO6/8MO0ETI7f33Vt # Y5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtXcVZOSEXAQsmbdlsKgEhr # /Xmfwb1tbWrJUnMTDXpQzTGCGgowghoGAgEBMIGVMH4xCzAJBgNVBAYTAlVTMRMw # EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN # aWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNp # Z25pbmcgUENBIDIwMTECEzMAAANOtTx6wYRv6ysAAAAAA04wDQYJYIZIAWUDBAIB # BQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEO # MAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIJ7qZeFeIYAUp9W0DlmUOk2U # DH6xxkdzumIvi8ngT3XwMEIGCisGAQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8A # cwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEB # BQAEggEAi2hj3fg4Xp3l/4anHObIMt3OarzYc7jwF5HhyOEsor2DX2vQnqRWTlsh # z9LL+fcInKMfPWbhpggN7L8aUWF0/EBzyma2JjsF6tvieCCKHuFFdp+YnSV8FHyO # EgkZXtV58FTXMKDg4FXFp3CwgyHTuF5nqf4h8VQ3RdNkovx/ltCsKhVsolUhayFR # 6zs8BpJvQRozFXoGCku5qQcnht73axOy475eh5o6K3y3ZMoCyqyzZEAXu1jDpsgz # Xwh2Qv0vJ1gEj6KY5Yx6o3/rWlGW7RkNow9PH/bzue9jFHh0E3+6TRIj4Xq8tiQd # RvjSNRhH2eafrT+a6LBx42aNujoB5qGCF5QwgheQBgorBgEEAYI3AwMBMYIXgDCC # F3wGCSqGSIb3DQEHAqCCF20wghdpAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFSBgsq # hkiG9w0BCRABBKCCAUEEggE9MIIBOQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFl # AwQCAQUABCBErtBQYLTHLyGkxu91Qa9lSuDQvyn/TpGWEIF7jDOCFQIGZVbKF6yW # GBMyMDIzMTIwNDE5MjIzNy44OTlaMASAAgH0oIHRpIHOMIHLMQswCQYDVQQGEwJV # UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE # ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1l # cmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046ODkwMC0w # NUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2Wg # ghHqMIIHIDCCBQigAwIBAgITMwAAAdMdMpoXO0AwcwABAAAB0zANBgkqhkiG9w0B # AQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYD # VQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDAeFw0yMzA1MjUxOTEy # MjRaFw0yNDAyMDExOTEyMjRaMIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz # aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv # cnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25z # MScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046ODkwMC0wNUUwLUQ5NDcxJTAjBgNV # BAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2UwggIiMA0GCSqGSIb3DQEB # AQUAA4ICDwAwggIKAoICAQC0jquTN4g1xbhXCc8MV+dOu8Uqc3KbbaWti5vdsAWM # 1D4fVSi+4NWgGtP/BVRYrVj2oVnnMy0eazidQOJ4uUscBMbPHaMxaNpgbRG9FEQR # FncAUptWnI+VPl53PD6MPL0yz8cHC2ZD3weF4w+uMDAGnL36Bkm0srONXvnM9eNv # nG5djopEqiHodWSauRye4uftBR2sTwGHVmxKu0GS4fO87NgbJ4VGzICRyZXw9+Rv # vXMG/jhM11H8AWKzKpn0oMGm1MSMeNvLUWb31HSZekx/NBEtXvmdo75OV030NHgI # XihxYEeSgUIxfbI5OmgMq/VDCQp2r/fy/5NVa3KjCQoNqmmEM6orAJ2XKjYhEJzo # p4nWCcJ970U6rXpBPK4XGNKBFhhLa74TM/ysTFIrEXOJG1fUuXfcdWb0Ex0FAeTT # r6gmmCqreJNejNHffG/VEeF7LNvUquYFRndiCUhgy624rW6ptcnQTiRfE0QL/gLF # 41kA2vZMYzcc16EiYXQQBaF3XAtMduh1dpXqTPPQEO3Ms5/5B/KtjhSspMcPUvRv # b35IWN+q+L+zEwiphmnCGFTuyOMqc5QE0ruGN3Mx0Vv6x/hcOmaXxrHQGpNKI5Pn # 79Yk89AclqU2mXHz1ZHWp+KBc3D6VP7L32JlwxhJx3asa085xv0XPD58MRW1WaGv # aQIDAQABo4IBSTCCAUUwHQYDVR0OBBYEFNLHIIa4FAD494z35hvzCmm0415iMB8G # A1UdIwQYMBaAFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMF8GA1UdHwRYMFYwVKBSoFCG # Tmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUy # MFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNybDBsBggrBgEFBQcBAQRgMF4w # XAYIKwYBBQUHMAKGUGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2Vy # dHMvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3J0MAwG # A1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwDgYDVR0PAQH/BAQD # AgeAMA0GCSqGSIb3DQEBCwUAA4ICAQBAYlhYoUQ+4aaQ54MFNfE6Ey8v4rWv+LtD # RSjMM2X9g4uanA9cU7VitdpIPV/zE6v4AEhe/Vng2UAR5qj2SV3sz+fDqN6VLWUZ # sKR0QR2JYXKnFPRVj16ezZyP7zd5H8IsvscEconeX+aRHF0xGGM4tDLrS84vj6Rm # 0bgoWLXWnMTZ5kP4ownGmm0LsmInuu0GKrDZnkeTVmfk8gTTy8d1y3P2IYc2UI4i # JYXCuSaKCuFeO0wqyscpvhGQSno1XAFK3oaybuD1mSoQxT9q77+LAGGQbiSoGlgT # jQQayYsQaPcG1Q4QNwONGqkASCZTbzJlnmkHgkWlKSLTulOailWIY4hS1EZ+w+sX # 0BJ9LcM142h51OlXLMoPLpzHAb6x22ipaAJ5Kf3uyFaOKWw4hnu0zWs+PKPd192n # deK2ogWfaFdfnEvkWDDH2doL+ZA5QBd8Xngs/md3Brnll2BkZ/giZE/fKyolriR3 # aTAWCxFCXKIl/Clu2bbnj9qfVYLpAVQEcPaCfTAf7OZBlXmluETvq1Y/SNhxC6MJ # 1QLCnkXSI//iXYpmRKT783QKRgmo/4ztj3uL9Z7xbbGxISg+P0HTRX15y4TReBbO # 2RFNyCj88gOORk+swT1kaKXUfGB4zjg5XulxSby3uLNxQebE6TE3cAK0+fnY5UpH # aEdlw4e7ijCCB3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZI # hvcNAQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw # DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x # MjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAy # MDEwMB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMC # VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV # BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRp # bWUtU3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC # AQDk4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg4r25Phdg # M/9cT8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPF # dvWGUNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6 # GnszrYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBp # Dco2LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2krnopN6zL64NF50Zu # yjLVwIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3E # XzTdEonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0 # lBw0gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1q # GFphAXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ # +QuJYfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PA # PBXbGjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkw # EgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxG # NSnPEP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARV # MFMwUQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWlj # cm9zb2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAK # BggrBgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMC # AYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvX # zpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20v # cGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYI # KwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5j # b20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG # 9w0BAQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0x # M7U518JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmC # VgADsAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449 # xvNo32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wM # nosZiefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDS # PeZKPmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2d # Y3RILLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxn # GSgkujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+Crvs # QWY9af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokL # jzbaukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL # 6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggNN # MIICNQIBATCB+aGB0aSBzjCByzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hp # bmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw # b3JhdGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEn # MCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOjg5MDAtMDVFMC1EOTQ3MSUwIwYDVQQD # ExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloiMKAQEwBwYFKw4DAhoDFQBS # x23cMcNB1IQws/LYkRXa7I5JsKCBgzCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYD # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy # b3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1w # IFBDQSAyMDEwMA0GCSqGSIb3DQEBCwUAAgUA6RhaQjAiGA8yMDIzMTIwNDE0MDEz # OFoYDzIwMjMxMjA1MTQwMTM4WjB0MDoGCisGAQQBhFkKBAExLDAqMAoCBQDpGFpC # AgEAMAcCAQACAhDcMAcCAQACAhNuMAoCBQDpGavCAgEAMDYGCisGAQQBhFkKBAIx # KDAmMAwGCisGAQQBhFkKAwKgCjAIAgEAAgMHoSChCjAIAgEAAgMBhqAwDQYJKoZI # hvcNAQELBQADggEBACJFbf3RxhZOAf1DPCmUI5IcoDLu3ciNHJP9VJF4RdzVzAhV # 8/pTedvLZvnRtt1OZLymBYmG0kuzfvfJhDJwVJs3kJ+F1Zl3ShvPG30AczyMdEUw # UwcB0/jEFfokkpPBO30agq1F2Aem/4Oe4ES3NvvmyRzOH1Mw5rrpoQO89+T/GKWk # SCINjnc28qugoYRTPG1nI3ir6jHTpd+2C4yn6IEBqSFMDqIsdKw532PEfyqzc3S2 # VVoBRrKB8xlZVw+GssoMFFX6AymAvPDkW6M/aTWDTWewBstSvSpTWYl/nHm0Ad0V # cRKPFKmiq2Nwreh77nAUqVA+YLVaC/YArlNqYvIxggQNMIIECQIBATCBkzB8MQsw # CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u # ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNy # b3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAdMdMpoXO0AwcwABAAAB0zAN # BglghkgBZQMEAgEFAKCCAUowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMC8G # CSqGSIb3DQEJBDEiBCAIvwBJScGQYUm00vFslw4buUc3jbzn+u2Cxnjyl3BktDCB # +gYLKoZIhvcNAQkQAi8xgeowgecwgeQwgb0EIJJm9OrE4O5PWA1KaFaztr9uP96r # QgEn+tgGtY3xOqr1MIGYMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldh # c2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBD # b3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIw # MTACEzMAAAHTHTKaFztAMHMAAQAAAdMwIgQgi0a7i0P0ZZFQZFdDqaIQZEw0IjMT # 0YFU3Uu1cK3JoRMwDQYJKoZIhvcNAQELBQAEggIAqPVpToPJnjiLtf6CGm/zUoR1 # 3tSkd8aupIT7prbFxTIrf2IWrBzpQ9ADPqO2qu0Bu2yBlMn1wC4t6SOlffQlG90B # 0RK28/NB3hOHLymGXT4KYsX5MBEU2tiBgq1tASNwk1k5nzXDOsG9NIx4oRzTDlEn # L1l/znraesnlzZ/NmwdIHHojkUTQ8mqFu5NC1AhzbZ0fl3T8YlH1AMIz7wuxSFxX # N1l14nPGC2GFjP02aq3mdX/Z/+TbZr7IWx4JxhLgzaU/jdgfhRq7ix5LyLlGpgwG # QpS6yMqNcy+kgAObfyG4ucAT1Wma3SWlscRBG4eNf2aqyCtAxvhSCyhqo+HMBFA/ # EKeGLQU/E5MM8QyIvecxHnT4kz1U3/uGYtCFry2u0zDSSd+n8jlJsQZPJU5dLCw5 # muwudbDO0QeFQeCVnBNuW1gA0b/H+nZj0DFe5WlFnDrIxb8d6glQijVS+mWgiuiF # 01qPf9hkvhl1ZLW0GCj42rm0RnaAyqYBjIc4dkKx/zygg2Jo8oW3db3vCcW4Qfip # igKWtPosGR7Kgf/iFOB2foMCHnIH+ga2NDqu2ND8xJoI2mFtR8+DCD+wy4eRqoGm # jDaojgQBmqZ5IRx1/JhW1gRewrR2Jhj3HFGNGtFAlyvuu8SrkBMHrKd+tXZRHPmt # I8DBB5whwIbcFevMmMo= # SIG # End signature block |