LabBuilder

1.1.0-preview0003

dsclibrary/MEMBER_FILESERVER_FSRMTEST.DSC.ps1

<###################################################################################################
DSC Template Configuration File For use by LabBuilder
.Title
    MEMBER_FILESERVER_FSRMTEST
.Desription
    Builds a Server that is joined to a domain and then made into a File Server.
    Includes tests for FSRM Resources.
.Parameters:
    DomainName = 'LABBUILDER.COM'
    DomainAdminPassword = 'P@ssword!1'
    DCName = 'SA-DC1'
    PSDscAllowDomainUser = $true
###################################################################################################>

Configuration MEMBER_FILESERVER_FSRMTEST
{
    Import-DscResource -ModuleName PSDesiredStateConfiguration
    Import-DscResource -ModuleName ComputerManagementDsc -ModuleVersion 7.1.0.0
    Import-DscResource -ModuleName StorageDsc
    Import-DscResource -ModuleName NetworkingDsc
    Import-DscResource -ModuleName FSRMDsc

    Node $AllNodes.NodeName {
        # Assemble the Local Admin Credentials
        if ($Node.LocalAdminPassword) {
            $LocalAdminCredential = New-Object `
                -TypeName System.Management.Automation.PSCredential `
                -ArgumentList ('Administrator', (ConvertTo-SecureString $Node.LocalAdminPassword -AsPlainText -Force))
        }

        if ($Node.DomainAdminPassword) {
            $DomainAdminCredential = New-Object `
                -TypeName System.Management.Automation.PSCredential `
                -ArgumentList ("$($Node.DomainName)\Administrator", (ConvertTo-SecureString $Node.DomainAdminPassword -AsPlainText -Force))
        }

        WindowsFeature FileServerInstall
        {
            Ensure = 'Present'
            Name = 'FS-FileServer'
        }

        WindowsFeature DataDedupInstall
        {
            Ensure = 'Present'
            Name = 'FS-Data-Deduplication'
            DependsOn = '[WindowsFeature]FileServerInstall'
        }

        WindowsFeature BranchCacheInstall
        {
            Ensure = 'Present'
            Name = 'FS-BranchCache'
            DependsOn = '[WindowsFeature]DataDedupInstall'
        }

        WindowsFeature DFSNameSpaceInstall
        {
            Ensure = 'Present'
            Name = 'FS-DFS-Namespace'
            DependsOn = '[WindowsFeature]BranchCacheInstall'
        }

        WindowsFeature DFSReplicationInstall
        {
            Ensure = 'Present'
            Name = 'FS-DFS-Replication'
            DependsOn = '[WindowsFeature]DFSNameSpaceInstall'
        }

        WindowsFeature FSResourceManagerInstall
        {
            Ensure = 'Present'
            Name = 'FS-Resource-Manager'
            DependsOn = '[WindowsFeature]DFSReplicationInstall'
        }

        WindowsFeature FSSyncShareInstall
        {
            Ensure = 'Present'
            Name = 'FS-SyncShareService'
            DependsOn = '[WindowsFeature]FSResourceManagerInstall'
        }

        WindowsFeature StorageServicesInstall
        {
            Ensure = 'Present'
            Name = 'Storage-Services'
            DependsOn = '[WindowsFeature]FSSyncShareInstall'
        }

        WindowsFeature ISCSITargetServerInstall
        {
            Ensure = 'Present'
            Name = 'FS-iSCSITarget-Server'
            DependsOn = '[WindowsFeature]StorageServicesInstall'
        }


        # Wait for the Domain to be available so we can join it.
        WaitForAll DC
        {
        ResourceName      = '[ADDomain]PrimaryDC'
        NodeName          = $Node.DCname
        RetryIntervalSec  = 15
        RetryCount        = 60
        }

        # Join this Server to the Domain
        Computer JoinDomain
        {
            Name          = $Node.NodeName
            DomainName    = $Node.DomainName
            Credential    = $DomainAdminCredential
            DependsOn = '[WaitForAll]DC'
        }

        # Enable FSRM FireWall rules so we can remote manage FSRM
        Firewall FSRMFirewall1
        {
            Name = 'FSRM-WMI-ASYNC-In-TCP'
            Ensure = 'Present'
            Enabled = 'True'
        }

        Firewall FSRMFirewall2
        {
            Name = 'FSRM-WMI-WINMGMT-In-TCP'
            Ensure = 'Present'
            Enabled = 'True'
        }

        Firewall FSRMFirewall3
        {
            Name = 'FSRM-RemoteRegistry-In (RPC)'
            Ensure = 'Present'
            Enabled = 'True'
        }

        Firewall FSRMFirewall4
        {
            Name = 'FSRM-Task-Scheduler-In (RPC)'
            Ensure = 'Present'
            Enabled = 'True'
        }

        Firewall FSRMFirewall5
        {
            Name = 'FSRM-SrmReports-In (RPC)'
            Ensure = 'Present'
            Enabled = 'True'
        }

        Firewall FSRMFirewall6
        {
            Name = 'FSRM-RpcSs-In (RPC-EPMAP)'
            Ensure = 'Present'
            Enabled = 'True'
        }

        Firewall FSRMFirewall7
        {
            Name = 'FSRM-System-In (TCP-445)'
            Ensure = 'Present'
            Enabled = 'True'
        }

        Firewall FSRMFirewall8
        {
            Name = 'FSRM-SrmSvc-In (RPC)'
            Ensure = 'Present'
            Enabled = 'True'
        }

        WaitforDisk Disk2
        {
            DiskId = 1
            RetryIntervalSec = 60
            RetryCount = 60
            DependsOn = '[Computer]JoinDomain'
        }

        Disk DVolume
        {
            DiskId = 1
            DriveLetter = 'D'
            DependsOn = '[WaitforDisk]Disk2'
        }

        File UsersFolder
        {
            DestinationPath = 'd:\Users'
            Ensure = 'Present'
            Type = 'Directory'
            DependsOn = '[Disk]DVolume'
        }

        FSRMQuotaTemplate HardLimit5GB
        {
            Name = '5 GB Limit'
            Description = '5 GB Hard Limit'
            Ensure = 'Present'
            Size = 5GB
            SoftLimit = $false
            ThresholdPercentages = @( 85, 100 )
            DependsOn = '[File]UsersFolder'
        }

        FSRMQuotaTemplateAction HardLimit5GBEmail85
        {
            Name = '5 GB Limit'
            Percentage = 85
            Ensure = 'Present'
            Type = 'Email'
            Subject = '[Quota Threshold]% quota threshold exceeded'
            Body = 'User [Source Io Owner] has exceed the [Quota Threshold]% quota threshold for quota on [Quota Path] on server [Server]. The quota limit is [Quota Limit MB] MB and the current usage is [Quota Used MB] MB ([Quota Used Percent]% of limit).'
            MailBCC = ''
            MailCC = 'fileserveradmins@contoso.com'
            MailTo = '[Source Io Owner Email]'
            DependsOn = '[FSRMQuotaTemplate]HardLimit5GB'
        } # End of FSRMQuotaTemplateAction Resource

        FSRMQuotaTemplateAction HardLimit5GBEvent85
        {
            Name = '5 GB Limit'
            Percentage = 85
            Ensure = 'Present'
            Type = 'Event'
            Body = 'User [Source Io Owner] has exceed the [Quota Threshold]% quota threshold for quota on [Quota Path] on server [Server]. The quota limit is [Quota Limit MB] MB and the current usage is [Quota Used MB] MB ([Quota Used Percent]% of limit).'
            EventType = 'Warning'
            DependsOn = '[FSRMQuotaTemplate]HardLimit5GB'
        } # End of FSRMQuotaTemplateAction Resource

        FSRMQuotaTemplateAction HardLimit5GBEmail100
        {
            Name = '5 GB Limit'
            Percentage = 100
            Ensure = 'Present'
            Type = 'Email'
            Subject = '[Quota Threshold]% quota threshold exceeded'
            Body = 'User [Source Io Owner] has exceed the [Quota Threshold]% quota threshold for quota on [Quota Path] on server [Server]. The quota limit is [Quota Limit MB] MB and the current usage is [Quota Used MB] MB ([Quota Used Percent]% of limit).'
            MailBCC = ''
            MailCC = 'fileserveradmins@contoso.com'
            MailTo = '[Source Io Owner Email]'
            DependsOn = '[FSRMQuotaTemplate]HardLimit5GB'
        } # End of FSRMQuotaTemplateAction Resource

        FSRMQuota DUsersQuota
        {
            Path = 'd:\users'
            Description = '5 GB Hard Limit, YEAH!'
            Ensure = 'Present'
            Template = '5 GB Limit'
            MatchesTemplate = $true
            DependsOn = '[FSRMQuotaTemplateAction]HardLimit5GBEmail100'
        } # End of FSRMQuota Resource

        File SharedFolder
        {
            DestinationPath = 'd:\shared'
            Ensure = 'Present'
            Type = 'Directory'
            DependsOn = '[Disk]DVolume'
        }

        FSRMQuota DSharedQuota
        {
            Path = 'd:\shared'
            Description = '5 GB Hard Limit'
            Ensure = 'Present'
            Size = 5GB
            SoftLimit = $false
            ThresholdPercentages = @( 75, 100 )
            DependsOn = '[File]SharedFolder'
        } # End of FSRMQuota Resource

        FSRMQuotaAction DSharedEmail75
        {
            Path = 'd:\shared'
            Percentage = 75
            Ensure = 'Present'
            Type = 'Email'
            Subject = '[Quota Threshold]% quota threshold exceeded'
            Body = 'User [Source Io Owner] has exceed the [Quota Threshold]% quota threshold for quota on [Quota Path] on server [Server]. The quota limit is [Quota Limit MB] MB and the current usage is [Quota Used MB] MB ([Quota Used Percent]% of limit).'
            MailBCC = ''
            MailCC = 'fileserveradmins@contoso.com'
            MailTo = '[Source Io Owner Email]'
            DependsOn = '[FSRMQuota]DSharedQuota'
        } # End of FSRMQuotaAction Resource

        FSRMQuotaAction DSharedEmail100
        {
            Path = 'd:\shared'
            Percentage = 100
            Ensure = 'Present'
            Type = 'Email'
            Subject = '[Quota Threshold]% quota threshold exceeded'
            Body = 'User [Source Io Owner] has exceed the [Quota Threshold]% quota threshold for quota on [Quota Path] on server [Server]. The quota limit is [Quota Limit MB] MB and the current usage is [Quota Used MB] MB ([Quota Used Percent]% of limit).'
            MailBCC = ''
            MailCC = 'fileserveradmins@contoso.com'
            MailTo = '[Source Io Owner Email]'
            DependsOn = '[FSRMQuota]DSharedQuota'
        } # End of FSRMQuotaAction Resource

        File AutoFolder
        {
            DestinationPath = 'd:\auto'
            Ensure = 'Present'
            Type = 'Directory'
            DependsOn = '[Disk]DVolume'
        }

        FSRMAutoQuota DAutoQuota
        {
            Path = 'd:\auto'
            Ensure = 'Present'
            Template = '100 MB Limit'
            DependsOn = '[File]SharedFolder'
        } # End of FSRMQuota Resource

        FSRMFileGroup FSRMFileGroupPortableFiles
        {
            Name = 'Portable Document Files'
            Description = 'Files containing portable document formats'
            Ensure = 'Present'
            IncludePattern = '*.eps','*.pdf','*.xps'
        }

        FSRMFileScreenTemplate FileScreenSomeFiles
        {
            Name = 'Block Some Files'
            Description = 'File Screen for Blocking Some Files'
            Ensure = 'Present'
            Active = $true
            IncludeGroup = 'Audio and Video Files','Executable Files','Backup Files'
        } # End of FSRMFileScreenTemplate Resource

        FSRMFileScreenTemplateAction FileScreenSomeFilesEmail
        {
            Name = 'Block Some Files'
            Ensure = 'Present'
            Type = 'Email'
            Subject = 'Unauthorized file matching [Violated File Group] file group detected'
            Body = 'The system detected that user [Source Io Owner] attempted to save [Source File Path] on [File Screen Path] on server [Server]. This file matches the [Violated File Group] file group which is not permitted on the system.'
            MailBCC = ''
            MailCC = 'fileserveradmins@contoso.com'
            MailTo = '[Source Io Owner Email]'
            DependsOn = '[FSRMFileScreenTemplate]FileScreenSomeFiles'
        } # End of FSRMFileScreenTemplateAction Resource

        FSRMFileScreenTemplateAction FileScreenSomeFilesEvent
        {
            Name = 'Block Some Files'
            Ensure = 'Present'
            Type = 'Event'
            Body = 'The system detected that user [Source Io Owner] attempted to save [Source File Path] on [File Screen Path] on server [Server]. This file matches the [Violated File Group] file group which is not permitted on the system.'
            EventType = 'Warning'
            DependsOn = '[FSRMFileScreenTemplate]FileScreenSomeFiles'
        } # End of FSRMFileScreenTemplateAction Resource

        FSRMFileScreen DUsersFileScreen
        {
            Path = 'd:\users'
            Description = 'File Screen for Blocking Some Files'
            Ensure = 'Present'
            Active = $true
            IncludeGroup = 'Audio and Video Files','Executable Files','Backup Files'
        } # End of FSRMFileScreen Resource

        FSRMFileScreenAction DUsersFileScreenSomeFilesEmail
        {
            Path = 'd:\users'
            Ensure = 'Present'
            Type = 'Email'
            Subject = 'Unauthorized file matching [Violated File Group] file group detected'
            Body = 'The system detected that user [Source Io Owner] attempted to save [Source File Path] on [File Screen Path] on server [Server]. This file matches the [Violated File Group] file group which is not permitted on the system.'
            MailBCC = ''
            MailCC = 'fileserveradmins@contoso.com'
            MailTo = '[Source Io Owner Email]'
            DependsOn = '[FSRMFileScreen]DUsersFileScreen'
        } # End of FSRMFileScreenAction Resource

        FSRMFileScreenAction DUsersFileScreenSomeFilesEvent
        {
            Path = 'd:\users'
            Ensure = 'Present'
            Type = 'Event'
            Body = 'The system detected that user [Source Io Owner] attempted to save [Source File Path] on [File Screen Path] on server [Server]. This file matches the [Violated File Group] file group which is not permitted on the system.'
            EventType = 'Warning'
            DependsOn = '[FSRMFileScreen]DUsersFileScreen'
        } # End of FSRMFileScreenAction Resource

        FSRMFileScreenException DUsersFileScreenException
        {
            Path = 'd:\users'
            Description = 'File Screen Exclusion'
            Ensure = 'Present'
            IncludeGroup = 'E-mail Files'
        } # End of FSRMFileScreenException Resource

        FSRMClassificationProperty PrivacyClasificationProperty
        {
            Name = 'Privacy'
            DisplayName = 'File Privacy'
            Description = 'File Privacy Property'
            Ensure = 'Present'
            Type = 'SingleChoice'
            PossibleValue = 'Top Secret','Secret','Confidential','Public'
            Parameters = 'Parameter1=Value1','Parameter2=Value2'
        } # End of FSRMClassificationProperty Resource

        FSRMClassificationPropertyValue PublicClasificationPropertyValue
        {
            Name = 'Public'
            PropertyName = 'Privacy'
            Description = 'Publically accessible files.'
            Ensure = 'Present'
            DependsOn = '[FSRMClassificationProperty]PrivacyClasificationProperty'
        } # End of FSRMClassificationPropertyValue Resource

        FSRMClassificationPropertyValue SecretClasificationPropertyValue
        {
            Name = 'Secret'
            PropertyName = 'Privacy'
            Ensure = 'Present'
            DependsOn = '[FSRMClassificationProperty]PrivacyClasificationProperty'
        } # End of FSRMClassificationPropertyValue Resource
        FSRMClassification FSRMClassificationSettings
        {
            Id = 'Default'
            Continuous = $true
            ContinuousLog = $true
            ContinuousLogSize = 2048
            ScheduleWeekly = 'Monday','Tuesday','Wednesday'
            ScheduleRunDuration = 4
            ScheduleTime = '23:30'
        } # End of FSRMClassification Resource
        FSRMClassificationRule ConfidentialPrivacyClasificationRule
        {
            Name = 'Confidential'
            Description = 'Set Confidential'
            Ensure = 'Present'
            Property = 'Privacy'
            PropertyValue = 'Confidential'
            ClassificationMechanism = 'Content Classifier'
            ContentString = 'Confidential'
            Namespace = '[FolderUsage_MS=User Files]','d:\Users'
            ReevaluateProperty = 'Overwrite'
        } # End of FSRMClassificationRule Resource
    }
}