Visual Studio入りAMIが使える様になった件をライセンス面から調査してみた

$username = "RO-LM-NRT"
$pwd = ConvertTo-SecureString "xxxxxxxxxx (専用ユーザーパスワード) xxxxxxxxxx" -AsPlainText -Force
$region = "NRT"
# SSM Neti Audit Powershell Script

#==================================================
# Utility Functions
#==================================================
Function Write-TerminatingError {
    <#
    .SYNOPSIS
    write the error to the console anSd exit the program.
    #>
    Param (
        [String]$Message
    )
    Write-Error $Message
    exit 1
}

$isSecurityPolicyProcessingValid = $false
$isGroupPoliciesBackgroundRefreshEnabled = $false
$isGroupPoliciesRefreshIntervalValid = $false
$isRestrictedGroupRuleValid = $false
$isAllowLogonRuleValid = $false
$isDenyLogonRuleValid = $false

# Check if restricted group contains computer user group
if (!(Get-Module -Name RSAT -ErrorAction SilentlyContinue) | out-null) {Install-WindowsFeature RSAT}
if (!(Get-Module -Name GPMC -ErrorAction SilentlyContinue) | out-null) {Install-WindowsFeature GPMC}

$cred = New-Object System.Management.Automation.PSCredential ($username, $pwd)
$instanceId = (New-Object System.Net.WebClient).DownloadString("http://169.254.169.254/latest/meta-data/instance-id")
$hostName = hostname

try {
    $rsopReportPath = Join-Path ([IO.Path]::GetTempPath())([IO.Path]::GetRandomFileName())
    gpresult /scope computer /X $rsopReportPath
            $report = Get-Content $rsopReportPath
            $restrictedGroupMembers = $report.Rsop.ComputerResults.ExtensionData.Extension.RestrictedGroups.Member.Name.'#text'
    $groupName = $instanceId + "-user-group"
    $isRestrictedGroupRuleValid = $restrictedGroupMembers.Contains($groupName)

    foreach ($gpo in $report.Rsop.ComputerResults.ExtensionData.Extension.UserRightsAssignment) {
        if (($gpo.Name -eq "SeRemoteInteractiveLogonRight")) {
            $isAllowLogonRuleValid = $gpo.Member.Name.'#text'.Contains($instanceId)
        } elseif ($gpo.Name -eq "SeDenyRemoteInteractiveLogonRight") {
            $isDenyLogonRuleValid = $gpo.Member.Name.'#text'.Contains("Local account")
        }
    }
    Remove-Item -Path $rsopReportPath
} catch [System.Exception] {
    Write-TerminatingError -Message 'Failed to get isAllowedLogonRuleValid and isDenyLogonRuleValid. Error: $_'
}

# Check registry
$securityProcessing = 0
$bkgndGroupPolicy = 0
$groupPolicyRefreshTimeOffset = 0
$groupPolicyRefreshTime = 0

$expectedRefreshTime = 15
$expectedRereshTimeOffset = 5
$securityProcessingConfigPath = 'HKLM:\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}'
$bkgndGroupPolicyPath = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System'
$groupPolicyRefreshTimePath = 'HKLM:\Software\Policies\Microsoft\Windows\System'
$bkgndGroupPolicyRegistryKey = 'DisableBkGndGroupPolicy'

Function Test-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][String]$Path,
        [Parameter(Mandatory = $true)][String]$Name
    )

    process {
        if (Test-Path $Path) {
            $Key = Get-Item -LiteralPath $Path
            if ($Key.GetValue($Name, $null) -ne $null) {
                if ($PassThru) {
                    Get-ItemProperty $Path $Name
                } else {
                    $true
                }
            } else {
                $false
            }
        } else {
            $false
        }
    }
}

try {
    $securityProcessing = Get-ItemPropertyValue -Path $securityProcessingConfigPath -Name 'NoBackgroundPolicy'
    if ($securityProcessing -eq 0) {
        $isSecurityPolicyProcessingValid = $true
    }
} catch [System.Exception] {
    Write-TerminatingError -Message 'Failed to get isSecurityPolicyProcessingValid. Error: $_'
}

if (Test-RegistryValue $bkgndGroupPolicyPath $bkgndGroupPolicyRegistryKey) {
    $bkgndGroupPolicy = Get-ItemPropertyValue -Path $bkgndGroupPolicyPath -Name $bkgndGroupPolicyRegistryKey
    if ($bkgndGroupPolicy -eq 0) {
        $isGroupPoliciesBackgroundRefreshEnabled = $true
    }
} else { # DisableBkGndGroupPolicy is sometimes not set, and if that is the case let the check pass
    $isGroupPoliciesBackgroundRefreshEnabled = $true
}

try {
    $groupPolicyRefreshTime = Get-ItemPropertyValue -Path $groupPolicyRefreshTimePath -Name 'GroupPolicyRefreshTime'
    $groupPolicyRefreshTimeOffset = Get-ItemPropertyValue -Path $groupPolicyRefreshTimePath -Name 'GroupPolicyRefreshTimeOffset'
    if (($groupPolicyRefreshTime -eq $expectedRefreshTime) -and ($groupPolicyRefreshTimeOffset -eq $expectedRereshTimeOffset)) {
        $isGroupPoliciesRefreshIntervalValid = $true
    }
} catch [System.Exception] {
    Write-TerminatingError -Message 'Failed to get isGroupPoliciesRefreshIntervalValid. Error: $_'
}

$ouPath = "OU=$($instanceId)-OU,OU=$region,OU=LicenseManager,OU=AWS Reserved"
$computer = Get-ADComputer -Identity $hostname -Credential $cred -Properties DistinguishedName
$isValidOUPath = $computer.DistinguishedName.Contains($ouPath)
$auditT = [DateTimeOffset]::Now.ToUnixTimeSeconds()
$json = @"
{
    "allowLogonRuleValid": $isAllowLogonRuleValid,
    "denyLogonRuleValid": $isDenyLogonRuleValid,
    "restrictedGroupRuleValid": $isRestrictedGroupRuleValid,
    "securityPolicyProcessingValid": $isSecurityPolicyProcessingValid,
    "groupPoliciesBackgroundRefreshEnabled": $isGroupPoliciesBackgroundRefreshEnabled,
    "groupPoliciesRefreshIntervalValid": $isGroupPoliciesRefreshIntervalValid,
    "validOUPath": $isValidOUPath,
    "auditTs": $auditT
}
"@
echo $json

<#
 .SYNOPSIS
 Domain joins an instance to the customers MAD

 .DESCRIPTION
 This script will domain join an instance in the MAD under the given OU, this script will run on customers instance using SSM

 It will perform the follow actions:
 1. Validation : Check if instance is part of domain already and under the correct OU, if not proceed
 2. Install AD tools on the instance
 3. Set the DNS Address to a MAD Domain Controllers IP
 4. Domain join the instance to the computer object already created using One time machine pascode
 5. Exit with status 3010 which tells ssm to restart the computer and rerun the script for validation on 1

As this script is running on the cutomers instance we will not be placing it on the instance rather will be running it by directly passing the script in a SSM RunPowershell document.

#>

#==================================================
# Utility Functions 
#==================================================
Function Write-TerminatingError {
    <#
    .SYNOPSIS
    write the error to the console and exit the program.
    #>
    Param (
        [String]$Message
    )
    Write-Error $Message
    exit 1
}

Function Install-ADTools {
    $attempts=3
    $sleepInSeconds=1
    do
    {
        try
        {
            Write-Output 'Installing AD tools on the instance...'
            Install-WindowsFeature -Name 'RSAT-AD-Tools' -ErrorAction Stop
            break;
        }
        catch [System.Exception]
        {
            Write-Output "Unable to install AD tools on the machine, exception : $_"
            if($attempts -eq 1)
            {
                 Write-TerminatingError -Message "Unable to install AD tools on the machine, failing error :  $_"
            }
        }
        $attempts--
        if ($attempts -gt 0) { sleep $sleepInSeconds }
    } while ($attempts -gt 0)
}

#==================================================
# Main
#==================================================
Function Domain-Join-Instance{
    <# The script accepts the below paramters
        DCIpAddress1,DCIpAddress2 : Domain Controller IPs for DCs of the directory, Domain: customers domain, OneTimeMachinePasscode : Password for the Computer Object for this instance
    #>
    Param(
        [string]$DCIpAddress1,
        [string]$DCIpAddress2,
        [string]$Domain,
        [string]$OneTimeMachinePasscode,
        [string]$ROUserPass,
        [string]$ROUsername,
        [string]$Region,
        [string]$InstanceId

    )

    $LMReservedOUName = 'LicenseManager'
    $sleepInSeconds=1

    try{
        $CurrentDomain = Get-CimInstance -ClassName 'Win32_ComputerSystem' -ErrorAction Stop | Select-Object -ExpandProperty 'Domain'
    }
    catch [System.Exception] {
        Write-TerminatingError -Message "Unable to Computer details to check current domain: $_"
    }

    # We validate if gpo update is working, if not we need to perform the domain join.
    # when we are recovering a broken instance, it's possible that the local domain name is right but the computer object has been replaced.
    $GPUpdateResult = gpupdate /force
    $GPUpdateResult = Out-String -InputObject $GPUpdateResult
    $GPErrorMsg = "Computer policy could not be updated successfully."

    if(($CurrentDomain -eq $Domain) -and (-not ($GPUpdateResult -match $GPErrorMsg))){
        Write-Output "Instance is part of domain :  $CurrentDomain"

        $username = "$Domain\$ROUsername"
        $password = $ROUserPass | ConvertTo-SecureString -asPlainText -Force
        $credential = New-Object System.Management.Automation.PSCredential($username,$password)

        #Getting OU Path of computer object
        $attempts=3
        do
        {
            try
            {
                Write-Output 'Getting AD Computer details...'
                $ADComputer = Get-ADComputer -Identity $ENV:ComputerName -Credential $credential -ErrorAction Stop
                break;
            }
            catch [System.Exception]
            {
                Write-Output "Unable to get AD Computer details..., exception : $_"
                if($attempts -eq 1)
                {
                     Write-TerminatingError -Message "Unable to fetch details for the computer object: $_"
                }
            }
            $attempts--
            if ($attempts -gt 0) { sleep $sleepInSeconds }
        } while ($attempts -gt 0)

        $DistinguishedName = $ADComputer | Select-Object -ExpandProperty DistinguishedName
        # Example for DistinguishedName : CN=EC2AMAZ-PCQS7MN,OU=i-05f83f681c65dfd6c-OU,OU=IAD,OU=LicenseManager,OU=AWS Reserved,DC=example,DC=com

        $OUPathArr = $DistinguishedName -split ',',2
        $CurrentOUPath = $OUPathArr[1]

        #Building the OU Path from customers domain and reserved ou path
        $attempts=3
        do
        {
            try
            {
                Write-Output 'Getting AD Domain details...'
                $ADDomain = Get-ADDomain -credential $credential -ErrorAction Stop
                break;
            }
            catch [System.Exception]
            {
                Write-Output "Unable to get AD Domain details......, exception : $_"
                if($attempts -eq 1)
                {
                     Write-TerminatingError -Message "Unable to fetch AD domain details: $_"
                }
            }
            $attempts--
            if ($attempts -gt 0) { sleep $sleepInSeconds }
        } while ($attempts -gt 0)

        $DomainFQDN = $ADDomain.DNSRoot
        $BasePath = $ADDomain.DistinguishedName
        $ReservedOUPath = "OU=$LMReservedOUName,OU=AWS Reserved"
        $ExpectedOUPath = "OU=$InstanceId-OU,OU=$Region,$ReservedOUPath,$BasePath"

        #SUCCESS : If computer is part of OU - exit 0
        if($CurrentOUPath -eq $ExpectedOUPath){
            Write-Output "Success... Instance was domain joined under the correct OU, at path : $ExpectedOUPath"
            exit 0
        } else{
            Write-TerminatingError -Message "Failure... Instance is joined under OU path : $CurrentOUPath `nInstead of expected OU path : $ExpectedOUPath"
        }
    } else{
        Write-Output "Instance is not part of domain so proceeding to join it to the domain: $Domain"
    }

    # in case of recovery, we also need to remove it from any domain explicitly even if it's already in the target domain.
    Write-Output "Removing the computer from the current domain if it's in any, failure to do so will not terminate the script."
    $hostname = hostname
    netdom remove $hostname /domain: /force

    #Install AD Tools
    Install-ADTools

    Write-Output 'Setting the DNS address to MAD Domain Controller IP...'
    try{
        $dns = Get-DnsClientServerAddress
        Write-Output "Current Value for index " $dns.InterfaceIndex[0] "-" $dns.ServerAddresses
        Set-DnsClientServerAddress -InterfaceIndex $dns.InterfaceIndex[0] -ServerAddresses ($DCIpAddress1, $DCIpAddress2) -ErrorAction Stop
        $dns = Get-DnsClientServerAddress
        Write-Output "Updated Value for index " $dns.InterfaceIndex[0] "-" $dns.ServerAddresses
        Write-Output 'Successfully! updated the DNS address to MAD Domain Controller IP...'
    }
    catch [System.Exception] {
        Write-TerminatingError -Message "Unable to set DNS address: $_"
    }

    #Domain join this instance to the AD and connect to the Computer Object created already using OneTimeMachinePasscode
    $OneTimeMachinePasscodeSecure = $OneTimeMachinePasscode | ConvertTo-SecureString -AsPlainText -Force
    Write-Output 'Domain joining the instance...'
    try{
        $JoinCred = New-Object -TypeName 'System.Management.Automation.PSCredential' -ArgumentList ([PSCustomObject]@{
                UserName = $Null
                Password = ($OneTimeMachinePasscodeSecure)[0]
            })
        Add-Computer -Domain $Domain -Options UnsecuredJoin, PasswordPass -Credential $JoinCred -ErrorAction Stop
        Write-Output 'Successfully! domain joined the instance'
    }
    catch [System.Exception] {
        Write-TerminatingError -Message "Unable to domain join the instance: $_"
    }

    Write-Output 'Restarting the instance to reflect changes...'
    #exit 3010 sends a request to ssm to restart instance and rerun the script again : https://docs.aws.amazon.com/systems-manager/latest/userguide/send-commands-reboot.html
    exit 3010
}

#Function call that runs the script, it will be replaced in code with param and values while calling the script
Domain-Join-Instance -DCIpAddress1 '10.0.21.214' -DCIpAddress2 '10.0.22.207' -Domain 'corp.contoso.com' -OneTimeMachinePasscode 'xxxxxxxxxxx (ワンタイムパスワード) xxxxxxxxxxx' -ROUsername 'RO-LM-NRT' -ROUserPass 'xxxxxxxxxxx (専用ユーザーパスワード) xxxxxxxxxxx' -Region 'NRT' -InstanceId 'i-0c9d06734cd031f10'