- Changes to xAdDomainController

- Added new parameter to disable or enable the Global Catalog (GC) (issue dsccommunity#75).
johlju · Apr 30, 2019 · d8a7a2c · d8a7a2c
1 parent da6865d
commit d8a7a2c
Show file tree

Hide file tree

Showing 5 changed files with 279 additions and 70 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -18,6 +18,12 @@
     and [@kungfu71186](https://github.com/kungfu71186)
 - Changes to xADReplicationSiteLink
   - Make use of the new localization helper functions.
+- Changes to xAdDomainController
+  - Added new parameter to disable or enable the Global Catalog (GC)
+    ([issue #75](https://github.com/PowerShell/xActiveDirectory/issues/75)). [Eric Foskett @Merto410](https://github.com/Merto410)
+  - Fixed a bug with the parameter `InstallationMediaPath` that it would
+    not be added if it was specified in a configuration. Now the parameter
+    `InstallationMediaPath` is correctly passed to `Install-ADDSDomainController`.
 
 ## 2.25.0.0
 

diff --git a/DSCResources/MSFT_xADDomainController/MSFT_xADDomainController.psm1 b/DSCResources/MSFT_xADDomainController/MSFT_xADDomainController.psm1
@@ -70,8 +70,9 @@ function Get-TargetResource
     )
 
     $returnValue = @{
-        DomainName = $DomainName
-        Ensure = $false
+        DomainName           = $DomainName
+        Ensure               = $false
+        IsGlobalCatalog      = $false
     }
 
     try
@@ -89,26 +90,33 @@ function Get-TargetResource
                 {
                     Write-Verbose -Message "Current node '$($dc.Name)' is already a domain controller for domain '$($dc.Domain)'."
 
-                    $serviceNTDS     = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters'
+                    $serviceNTDS = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters'
                     $serviceNETLOGON = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters'
 
-                    $returnValue.Ensure       = $true
+                    $returnValue.Ensure = $true
                     $returnValue.DatabasePath = $serviceNTDS.'DSA Working Directory'
-                    $returnValue.LogPath      = $serviceNTDS.'Database log files path'
-                    $returnValue.SysvolPath   = $serviceNETLOGON.SysVol -replace '\\sysvol$', ''
-                    $returnValue.SiteName     = $dc.Site
+                    $returnValue.LogPath = $serviceNTDS.'Database log files path'
+                    $returnValue.SysvolPath = $serviceNETLOGON.SysVol -replace '\\sysvol$', ''
+                    $returnValue.SiteName = $dc.Site
+                    $returnValue.IsGlobalCatalog = $dc.IsGlobalCatalog
                 }
             }
             catch
             {
-                if ($error[0]) {Write-Verbose $error[0].Exception}
+                if ($error[0])
+                {
+                    Write-Verbose $error[0].Exception
+                }
                 Write-Verbose -Message "Current node does not host a domain controller."
             }
         }
     }
     catch [System.Management.Automation.CommandNotFoundException]
     {
-        if ($error[0]) {Write-Verbose $error[0].Exception}
+        if ($error[0])
+        {
+            Write-Verbose $error[0].Exception
+        }
         Write-Verbose -Message "Current node is not running AD WS, and hence is not a domain controller."
     }
     $returnValue
@@ -142,6 +150,9 @@ function Get-TargetResource
     .PARAMETER InstallationMediaPath
         Provide the path for the IFM folder that was created with ntdsutil.
         This should not be on a share but locally to the Domain Controller being promoted.
+
+    .PARAMETER IsGlobalCatalog
+        Specifies if the domain controller will be a Global Catalog (GC).
 #>
 function Set-TargetResource
 {
@@ -178,53 +189,75 @@ function Set-TargetResource
 
         [Parameter()]
         [System.String]
-        $InstallationMediaPath
+        $InstallationMediaPath,
+
+        [Parameter()]
+        [System.Boolean]
+        $IsGlobalCatalog
     )
 
     # Debug can pause Install-ADDSDomainController, so we remove it.
-    $parameters = $PSBoundParameters.Remove("Debug")
-    $parameters = $PSBoundParameters.Remove('InstallationMediaPath')
-    $targetResource = Get-TargetResource @PSBoundParameters
+    $getTargetResourceParameters = @{} + $PSBoundParameters
+    $getTargetResourceParameters.Remove('Debug')
+    $getTargetResourceParameters.Remove('InstallationMediaPath')
+    $getTargetResourceParameters.Remove('IsGlobalCatalog')
+    $targetResource = Get-TargetResource @getTargetResourceParameters
 
     if ($targetResource.Ensure -eq $false)
     {
-        ## Node is not a domain controllr so we promote it
+        ## Node is not a domain controller so we promote it
         Write-Verbose -Message "Checking if domain '$($DomainName)' is present ..."
+
         $domain = $null;
+
         try
         {
             $domain = Get-ADDomain -Identity $DomainName -Credential $DomainAdministratorCredential
         }
         catch
         {
-            if ($error[0]) {Write-Verbose $error[0].Exception}
+            if ($error[0])
+            {
+                Write-Verbose $error[0].Exception
+            }
+
             throw (New-Object -TypeName System.InvalidOperationException -ArgumentList "Domain '$($DomainName)' could not be found.")
         }
 
         Write-Verbose -Message "Verified that domain '$($DomainName)' is present, continuing ..."
         $params = @{
-            DomainName = $DomainName
+            DomainName                    = $DomainName
             SafeModeAdministratorPassword = $SafemodeAdministratorPassword.Password
-            Credential = $DomainAdministratorCredential
-            NoRebootOnCompletion = $true
-            Force = $true
+            Credential                    = $DomainAdministratorCredential
+            NoRebootOnCompletion          = $true
+            Force                         = $true
         }
+
         if ($DatabasePath -ne $null)
         {
             $params.Add("DatabasePath", $DatabasePath)
         }
+
         if ($LogPath -ne $null)
         {
             $params.Add("LogPath", $LogPath)
         }
+
         if ($SysvolPath -ne $null)
         {
             $params.Add("SysvolPath", $SysvolPath)
         }
+
         if ($SiteName -ne $null -and $SiteName -ne "")
         {
             $params.Add("SiteName", $SiteName)
         }
+
+        if ($PSBoundParameters.ContainsKey('IsGlobalCatalog') -and $IsGlobalCatalog -eq $false)
+        {
+            $params.Add("NoGlobalCatalog", $true)
+        }
+
         if (-not [string]::IsNullOrWhiteSpace($InstallationMediaPath))
         {
             $params.Add("InstallationMediaPath", $InstallationMediaPath)
@@ -239,6 +272,33 @@ function Set-TargetResource
     }
     elseif ($targetResource.Ensure)
     {
+        ## Check if Node Global Catalog state is correct
+        if ($PSBoundParameters.ContainsKey('IsGlobalCatalog') -and $targetResource.IsGlobalCatalog -ne $IsGlobalCatalog)
+        {
+            ## DC is not in the expected Global Catalog state
+            Write-Verbose "Setting the Global Catalog state to '$IsGlobalCatalog'"
+            if ($IsGlobalCatalog)
+            {
+                $value = 1
+            }
+            else
+            {
+                $value = 0
+            }
+
+            $dc = Get-ADDomainController -Identity $env:COMPUTERNAME -Credential $DomainAdministratorCredential -ErrorAction 'Stop'
+            if ($dc)
+            {
+                Set-ADObject -Identity $dc.NTDSSettingsObjectDN -replace @{
+                    options = $value
+                }
+            }
+            else
+            {
+                throw 'Could not get the distinguished name of the NTDSSettingsObject directory object that represents this domain controller.'
+            }
+        }
+
         ## Node is a domain controller. We check if other properties are in desired state
         if ($PSBoundParameters["SiteName"] -and $targetResource.SiteName -ne $SiteName)
         {
@@ -277,6 +337,9 @@ function Set-TargetResource
     .PARAMETER InstallationMediaPath
         Provide the path for the IFM folder that was created with ntdsutil.
         This should not be on a share but locally to the Domain Controller being promoted.
+
+    .PARAMETER IsGlobalCatalog
+        Specifies if the domain controller will be a Global Catalog (GC).
 #>
 function Test-TargetResource
 {
@@ -314,7 +377,11 @@ function Test-TargetResource
 
         [Parameter()]
         [System.String]
-        $InstallationMediaPath
+        $InstallationMediaPath,
+
+        [Parameter()]
+        [System.Boolean]
+        $IsGlobalCatalog
     )
 
     if ($PSBoundParameters.SiteName)
@@ -329,30 +396,41 @@ function Test-TargetResource
 
     try
     {
-        $parameters = $PSBoundParameters.Remove("Debug")
-        $parameters = $PSBoundParameters.Remove('InstallationMediaPath')
-        $existingResource = Get-TargetResource @PSBoundParameters
+        $getTargetResourceParameters = @{} + $PSBoundParameters
+        $getTargetResourceParameters.Remove('Debug')
+        $getTargetResourceParameters.Remove('InstallationMediaPath')
+        $getTargetResourceParameters.Remove('IsGlobalCatalog')
+        $existingResource = Get-TargetResource @getTargetResourceParameters
         $isCompliant = $existingResource.Ensure
 
         if ([System.String]::IsNullOrEmpty($SiteName))
         {
-            #If SiteName is not specified confgiuration is compliant
+            #If SiteName is not specified configuration is compliant
         }
         elseif ($existingResource.SiteName -ne $SiteName)
         {
             Write-Verbose "Domain Controller Site is not in a desired state. Expected '$SiteName', actual '$($existingResource.SiteName)'"
             $isCompliant = $false
         }
+
+        ## Check Global Catalog Config
+        if ($PSBoundParameters.ContainsKey('IsGlobalCatalog') -and $existingResource.IsGlobalCatalog -ne $IsGlobalCatalog)
+        {
+            $isCompliant = $false
+        }
     }
     catch
     {
-        if ($error[0]) {Write-Verbose $error[0].Exception}
+        if ($error[0])
+        {
+            Write-Verbose $error[0].Exception
+        }
+
         Write-Verbose -Message "Domain '$($DomainName)' is NOT present on the current node."
         $isCompliant = $false
     }
 
     $isCompliant
-
 }
 
 Export-ModuleMember -Function *-TargetResource
diff --git a/DSCResources/MSFT_xADDomainController/MSFT_xADDomainController.schema.mof b/DSCResources/MSFT_xADDomainController/MSFT_xADDomainController.schema.mof
@@ -9,5 +9,6 @@ class MSFT_xADDomainController : OMI_BaseResource
     [Write, Description("The path where the Sysvol will be stored.")] String SysvolPath;
     [Write, Description("The name of the site this Domain Controller will be added to.")] String SiteName;
     [Write, Description("The path of the media you want to use install the Domain Controller.")] String InstallationMediaPath;
+    [Write, Description("Specifies if the domain controller will be a Global Catalog (GC).")] Boolean IsGlobalCatalog;
     [Read, Description("The state of the Domain Controller.")] String Ensure;
 };
diff --git a/README.md b/README.md
@@ -128,6 +128,7 @@ The xADDomainController DSC resource will install and configure domain controlle
 * **`[String]` SysvolPath** _(Write)_: Specifies the fully qualified, non-UNC path to a directory on a fixed disk of the local computer where the Sysvol file will be written.
 * **`[String]` SiteName** _(Write)_: Specify the name of an existing site where new domain controller will be placed.
 * **`[String]` InstallationMediaPath** _(Write)_: Specify the path of the folder containg the Installation Media created in NTDSutil.
+* **`[String]` IsGlobalCatalog** _(Write)_: Specifies if the domain controller will be a Global Catalog (GC).
 * **`[String]` Ensure** _(Read)_: The state of the Domain Controller, returned with Get.
 
 ### **xADDomainDefaultPasswordPolicy**