Microsoft Office LTSC入りAMIを試してみた #reinvent

<#
 .SYNOPSIS
 Domain joins an instance to the customers MAD

 .DESCRIPTION
 This script will domain join an instance in the MAD under the given OU, this script will run on customers instance using SSM

 It will perform the follow actions:
 1. Validation : Check if instance is part of domain already and under the correct OU, if not proceed
 2. Install AD tools on the instance
 3. Set the DNS Address to a MAD Domain Controllers IP
 4. Domain join the instance to the computer object already created using One time machine pascode
 5. Exit with status 3010 which tells ssm to restart the computer and rerun the script for validation on 1

As this script is running on the cutomers instance we will not be placing it on the instance rather will be running it by directly passing the script in a SSM RunPowershell document.

#>

#==================================================
# Utility Functions 
#==================================================
Function Write-TerminatingError {
    <#
    .SYNOPSIS
    write the error to the console and exit the program.
    #>
    Param (
        [String]$Message
    )
    Write-Error $Message
    exit 1
}

Function Install-ADTools {
    $attempts=3
    $sleepInSeconds=1
    do
    {
        try
        {
            Write-Output 'Installing AD tools on the instance...'
            Install-WindowsFeature -Name 'RSAT-AD-Tools' -ErrorAction Stop
            break;
        }
        catch [System.Exception]
        {
            Write-Output "Unable to install AD tools on the machine, exception : $_"
            if($attempts -eq 1)
            {
                 Write-TerminatingError -Message "Unable to install AD tools on the machine, failing error :  $_"
            }
        }
        $attempts--
        if ($attempts -gt 0) { sleep $sleepInSeconds }
    } while ($attempts -gt 0)
}

#==================================================
# Main
#==================================================
Function Domain-Join-Instance{
    <# The script accepts the below paramters
        DCIpAddress1,DCIpAddress2 : Domain Controller IPs for DCs of the directory, Domain: customers domain, OneTimeMachinePasscode : Password for the Computer Object for this instance
    #>
    Param(
        [string]$DCIpAddress1,
        [string]$DCIpAddress2,
        [string]$Domain,
        [string]$OneTimeMachinePasscode,
        [string]$ROUserPass,
        [string]$ROUsername,
        [string]$Region,
        [string]$InstanceId,
        [string]$IsOfficeProductCode

    )

    $LMReservedOUName = 'LicenseManager'
    $sleepInSeconds=1

    try{
        $CurrentDomain = Get-CimInstance -ClassName 'Win32_ComputerSystem' -ErrorAction Stop | Select-Object -ExpandProperty 'Domain'
    }
    catch [System.Exception] {
        Write-TerminatingError -Message "Unable to Computer details to check current domain: $_"
    }

    # We validate if gpo update is working, if not we need to perform the domain join.
    # when we are recovering a broken instance, it's possible that the local domain name is right but the computer object has been replaced.
    $GPUpdateResult = gpupdate /force
    $GPUpdateResult = Out-String -InputObject $GPUpdateResult
    $GPErrorMsg = "Computer policy could not be updated successfully."

    if(($CurrentDomain -eq $Domain) -and (-not ($GPUpdateResult -match $GPErrorMsg))){
        Write-Output "Instance is part of domain :  $CurrentDomain"

        $username = "$Domain\$ROUsername"
        $password = $ROUserPass | ConvertTo-SecureString -asPlainText -Force
        $credential = New-Object System.Management.Automation.PSCredential($username,$password)

        #Getting OU Path of computer object
        $attempts=3
        do
        {
            try
            {
                Write-Output 'Getting AD Computer details...'
                $ADComputer = Get-ADComputer -Identity $ENV:ComputerName -Credential $credential -ErrorAction Stop
                break;
            }
            catch [System.Exception]
            {
                Write-Output "Unable to get AD Computer details..., exception : $_"
                if($attempts -eq 1)
                {
                     Write-TerminatingError -Message "Unable to fetch details for the computer object: $_"
                }
            }
            $attempts--
            if ($attempts -gt 0) { sleep $sleepInSeconds }
        } while ($attempts -gt 0)

        $DistinguishedName = $ADComputer | Select-Object -ExpandProperty DistinguishedName
        # Example for DistinguishedName : CN=EC2AMAZ-PCQS7MN,OU=i-05f83f681c65dfd6c-OU,OU=IAD,OU=LicenseManager,OU=AWS Reserved,DC=example,DC=com

        $OUPathArr = $DistinguishedName -split ',',2
        $CurrentOUPath = $OUPathArr[1]

        #Building the OU Path from customers domain and reserved ou path
        $attempts=3
        do
        {
            try
            {
                Write-Output 'Getting AD Domain details...'
                $ADDomain = Get-ADDomain -credential $credential -ErrorAction Stop
                break;
            }
            catch [System.Exception]
            {
                Write-Output "Unable to get AD Domain details......, exception : $_"
                if($attempts -eq 1)
                {
                     Write-TerminatingError -Message "Unable to fetch AD domain details: $_"
                }
            }
            $attempts--
            if ($attempts -gt 0) { sleep $sleepInSeconds }
        } while ($attempts -gt 0)

        $DomainFQDN = $ADDomain.DNSRoot
        $BasePath = $ADDomain.DistinguishedName
        $ReservedOUPath = "OU=$LMReservedOUName,OU=AWS Reserved"
        $ExpectedOUPath = "OU=$InstanceId-OU,OU=$Region,$ReservedOUPath,$BasePath"

        #SUCCESS : If computer is part of OU - exit 0
        if($CurrentOUPath -eq $ExpectedOUPath){
            Write-Output "Success... Instance was domain joined under the correct OU, at path : $ExpectedOUPath"
            exit 0
        } else{
            Write-TerminatingError -Message "Failure... Instance is joined under OU path : $CurrentOUPath `nInstead of expected OU path : $ExpectedOUPath"
        }
    } else{
        Write-Output "Instance is not part of domain so proceeding to join it to the domain: $Domain"
    }

    # in case of recovery, we also need to remove it from any domain explicitly even if it's already in the target domain.
    Write-Output "Removing the computer from the current domain if it's in any, failure to do so will not terminate the script."
    $hostname = hostname
    netdom remove $hostname /domain: /force

    #Install AD Tools
    Install-ADTools

    Write-Output 'Office instance launched: $IsOfficeProductCode'

    # Set DNS address only for VS. For Office we are taking Route53 resolver approach
    if($IsOfficeProductCode -eq 'false'){
        Write-Output 'Setting the DNS address to MAD Domain Controller IP for VS Product...'
        try{
            $dns = Get-DnsClientServerAddress
            Write-Output "Current Value for index " $dns.InterfaceIndex[0] "-" $dns.ServerAddresses
            Set-DnsClientServerAddress -InterfaceIndex $dns.InterfaceIndex[0] -ServerAddresses ($DCIpAddress1, $DCIpAddress2) -ErrorAction Stop
            $dns = Get-DnsClientServerAddress
            Write-Output "Updated Value for index " $dns.InterfaceIndex[0] "-" $dns.ServerAddresses
            Write-Output 'Successfully! updated the DNS address to MAD Domain Controller IP...'
        }
        catch [System.Exception] {
            Write-TerminatingError -Message "Unable to set DNS address: $_"
        }
    }

    #Domain join this instance to the AD and connect to the Computer Object created already using OneTimeMachinePasscode
    $OneTimeMachinePasscodeSecure = $OneTimeMachinePasscode | ConvertTo-SecureString -AsPlainText -Force
    Write-Output 'Domain joining the instance...'
    try{
        $JoinCred = New-Object -TypeName 'System.Management.Automation.PSCredential' -ArgumentList ([PSCustomObject]@{
                UserName = $Null
                Password = ($OneTimeMachinePasscodeSecure)[0]
            })
        Add-Computer -Domain $Domain -Options UnsecuredJoin, PasswordPass -Credential $JoinCred -ErrorAction Stop
        Write-Output 'Successfully! domain joined the instance'
    }
    catch [System.Exception] {
        Write-TerminatingError -Message "Unable to domain join the instance: $_"
    }

    Write-Output 'Restarting the instance to reflect changes...'
    #exit 3010 sends a request to ssm to restart instance and rerun the script again : https://docs.aws.amazon.com/systems-manager/latest/userguide/send-commands-reboot.html
    exit 3010
}

#Function call that runs the script, it will be replaced in code with param and values while calling the script
Domain-Join-Instance -DCIpAddress1 '10.0.21.119' -DCIpAddress2 '10.0.22.189' -Domain 'corp.contoso.com' -OneTimeMachinePasscode 'xxxxxxxxxx (中略) xxxxxxxxxx' -ROUsername 'RO-LM-NRT' -ROUserPass 'xxxxxxxxxx (中略) xxxxxxxxxx' -Region 'NRT' -InstanceId 'i-0701a1b3e35bfedf2' -IsOfficeProductCode 'true'

#==================================================
# Utility Functions
#==================================================
Function Write-TerminatingError {
    <#
    .SYNOPSIS
    write the error to the console and exit the program.
    #>
    Param (
        [String]$Message
    )
    throw $Message
}

Function Find-First-Match {
    <#
    .SYNOPSIS
    Return the entry in the array
    #>
    Param (
        [String[]]$StringArray,
        [String]$RegEx
    )
    foreach ($element in $StringArray){
      if ($element -match $RegEx){
        return $element
      }
    }
    return $null
}

#==================================================
# Main
#==================================================
Function Office-Activation-Instance{
    Param(
            [string]$Region,
            [string]$Stage,
            [string]$Endpoint
        )
        Write-Output "Office Activation instance script launched for $Region, $Stage and $Endpoint"
        # Entering into the Office16 folder. Terminate if the required folder doesn't exist.
        $Path = 'c:\Program Files\Microsoft Office\Office16'
        if (-not (Test-Path -LiteralPath $Path)) {
            Write-TerminatingError -Message "Failure... Path $Path does not exist."
        }
        Set-Location -Path $Path

	    # This is required since AD does not uses default Amazon DNS
	    $ServerIPAddress = (Resolve-DnsName "$Endpoint" -Server 169.254.169.253).IPAddress | Select -First 1
        if (-not (Test-Path -LiteralPath ".\ospp.vbs")) {
                    Write-TerminatingError -Message "Failure... the script ospp.vbs does not exist."
        }
        Write-Output "Running the activation script with the license manager : $ServerIPAddress"
        cscript ospp.vbs /sethst:$ServerIPAddress

        for ($i=0; $i -lt 3; $i++){
            cscript ospp.vbs /act
            try{
                        $result = cscript ospp.vbs /dstatus
            } catch [System.Exception] {
                         Write-TerminatingError -Message "Unexpected system failure while getting the activation status."
            }
            # Check if the result array contains the key for license status.
            $checkKey = Find-First-Match -StringArray $result  -RegEx "LICENSE STATUS"
            # Check if the value of the key license status is LICENSED:
            $checkKeyValue = Find-First-Match -StringArray $result  -RegEx "LICENSE STATUS:  ---LICENSED---"
            if (($checkKey -eq $null) -or ($checkKeyValue -eq $null)) {
                Start-Sleep -Seconds 30
                continue;
            }
            Write-Output "Office is licensed........$result"
            return;
        }
        $errorDescription = Find-First-Match -StringArray $result  -RegEx "ERROR DESCRIPTION"
        $errorDescriptionTrimmed = $errorDescription -replace "ERROR DESCRIPTION: ",""
        Write-TerminatingError -Message "Office is not licensed because $errorDescriptionTrimmed"
}

#Function call that runs the script, it will be replaced in code with param and values while calling the script

Function Main {
    Param(
            [string]$Region,
            [string]$Stage,
            [string]$Endpoint
        )

    Office-Activation-Instance -Region $Region -Stage $Stage -Endpoint $Endpoint
}

Main -Region 'ap-northeast-1' -Stage 'prod' -Endpoint 'vpce-xxxxxxxxxxxxxxxxx-sw05a846.activation-license-manager.ap-northeast-1.vpce.amazonaws.com'