📚 Installation Windows Server 2022 — Active Directory DHCP DNS

#Requires -RunAsAdministrator
# Configuration initiale Windows Server — A exécuter juste après installation

# ── Nom du serveur ────────────────────────────────────────────
Rename-Computer -NewName "SRV-AD-01" -Force
Write-Host "[OK] Serveur renommé en SRV-AD-01" -ForegroundColor Green

# ── Réseau statique ───────────────────────────────────────────
$NIC = Get-NetAdapter | Where-Object {$_.Status -eq "Up"} | Select-Object -First 1
New-NetIPAddress -InterfaceIndex $NIC.ifIndex `
    -IPAddress     "192.168.1.10" `
    -PrefixLength  24 `
    -DefaultGateway "192.168.1.254"
Set-DnsClientServerAddress -InterfaceIndex $NIC.ifIndex `
    -ServerAddresses "192.168.1.10","192.168.1.11"
Write-Host "[OK] IP statique configurée : 192.168.1.10/24" -ForegroundColor Green

# ── Fuseau horaire ────────────────────────────────────────────
Set-TimeZone -Id "Romance Standard Time"
w32tm /resync /force | Out-Null
Write-Host "[OK] Fuseau horaire : Europe/Paris" -ForegroundColor Green

# ── Windows Update automatique ────────────────────────────────
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" `
    -Name "AUOptions" -Value 4

# ── Désactiver IPv6 (si non utilisé) ─────────────────────────
Disable-NetAdapterBinding -Name $NIC.Name -ComponentID ms_tcpip6
Write-Host "[OK] IPv6 désactivé" -ForegroundColor Green

# ── Activer RDP ───────────────────────────────────────────────
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" fDenyTSConnections 0
Enable-NetFirewallRule -DisplayGroup "Bureau à distance"
Write-Host "[OK] RDP activé" -ForegroundColor Green

# ── Pare-feu : profil domaine strict ─────────────────────────
Set-NetFirewallProfile -Profile Domain -DefaultInboundAction Block -DefaultOutboundAction Allow

Write-Host "`n=== Configuration initiale terminée. Redémarrage recommandé. ===" -ForegroundColor Cyan

#Requires -RunAsAdministrator
# Installation et promotion en contrôleur de domaine

# ── Installer le rôle AD DS + outils ─────────────────────────
Install-WindowsFeature -Name AD-Domain-Services `
    -IncludeManagementTools `
    -IncludeAllSubFeature
Write-Host "[OK] Rôle AD DS installé" -ForegroundColor Green

# ── Installer DNS (requis pour AD) ───────────────────────────
Install-WindowsFeature -Name DNS -IncludeManagementTools
Write-Host "[OK] Rôle DNS installé" -ForegroundColor Green

# ── Créer une nouvelle forêt AD (premier DC) ─────────────────
$SafePass = ConvertTo-SecureString "SafeMode@2025!" -AsPlainText -Force

Install-ADDSForest `
    -DomainName            "entreprise.local" `
    -DomainNetbiosName     "ENTREPRISE" `
    -ForestMode            "WinThreshold" `
    -DomainMode            "WinThreshold" `
    -InstallDns            $true `
    -DatabasePath          "C:\Windows\NTDS" `
    -LogPath               "C:\Windows\NTDS" `
    -SysvolPath            "C:\Windows\SYSVOL" `
    -SafeModeAdministratorPassword $SafePass `
    -Force `
    -NoRebootOnCompletion  $false

# Le serveur redémarre automatiquement après la promotion

# Installer DHCP
Install-WindowsFeature DHCP -IncludeManagementTools

# Configurer le serveur DHCP (étendue principale)
Add-DhcpServerv4Scope `
    -Name          "LAN-Principal" `
    -StartRange    "192.168.1.100" `
    -EndRange      "192.168.1.200" `
    -SubnetMask    "255.255.255.0" `
    -State         "Active"

Set-DhcpServerv4OptionValue `
    -ScopeId "192.168.1.0" `
    -Router  "192.168.1.254" `
    -DnsServer "192.168.1.10" `
    -DnsDomain "entreprise.local"

# Autoriser le DHCP dans AD
Add-DhcpServerInDC -DnsName "SRV-AD-01.entreprise.local"

# ── Installer IIS (si serveur web interne) ────────────────────
Install-WindowsFeature Web-Server -IncludeManagementTools

# ── Installer File Server (partages) ─────────────────────────
Install-WindowsFeature FS-FileServer

# Créer un partage réseau
New-SmbShare -Name "Partage" `
    -Path "D:\Partage" `
    -FullAccess "ENTREPRISE\Administrateurs" `
    -ChangeAccess "ENTREPRISE\Utilisateurs" `
    -ReadAccess "EVERYONE"

# ── Installer Print Server ────────────────────────────────────
Install-WindowsFeature Print-Server -IncludeManagementTools

# Vérifier le domaine et AD
Get-ADDomain
Get-ADDomainController -Discover

# Tester la réplication AD
repadmin /showrepl
dcdiag /test:replications

# Vérifier le DNS AD
nslookup entreprise.local
Resolve-DnsName _ldap._tcp.entreprise.local -Type SRV

# Vérifier les services AD critiques
@("ADWS","DNS","KDC","Netlogon","NTDS","W32Time") | ForEach-Object {
    $svc = Get-Service -Name $_
    Write-Host "$_ : $($svc.Status)" -ForegroundColor $(if($svc.Status -eq "Running"){"Green"}else{"Red"})
}

# Voir les événements récents AD (erreurs/avertissements)
Get-EventLog -LogName "Directory Service" -EntryType Error,Warning -Newest 20 |
    Select-Object TimeGenerated, Source, Message | Format-List