Filip Zubik
c42943cfa8
Initial deployment suite for X9.cz MSP Windows 10/11 deployment: - PowerShell scripts 00-11: admin account, bloatware removal, software (winget+Atera), system registry tweaks, default profile, personalization, scheduled tasks, BackInfo desktop info, Windows activation, PC identity/rename, network, Dell Update - Web platform: xetup.x9.cz (nginx), spec/annotation page, /dl shortlink, GitHub mirror - Forgejo Actions CI: auto-build xetup.exe on push, publish to releases/latest - Go xetup.exe: embeds all scripts/assets, per-feature checkboxes, load/save config
125 lines
5.3 KiB
PowerShell
125 lines
5.3 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Creates the adminx9 local administrator account for MSP use.
|
|
|
|
.DESCRIPTION
|
|
Creates a hidden local administrator account 'adminx9' used by X9.cz technicians
|
|
for remote management and on-site administration. The account has no password by
|
|
design - it is invisible to regular users and only accessible to technicians who
|
|
know it exists. FullName is set to "X9.cz s.r.o." so it is identifiable in
|
|
system tools. Password policy is set so it never expires.
|
|
|
|
.ITEMS
|
|
vytvorit-lokalni-ucet-adminx9: Creates the account via [ADSI] WinNT provider. No password by design - the account is hidden from users and used only by MSP technicians for remote administration.
|
|
pridat-do-skupiny-administrators: Adds adminx9 to the local Administrators group via net localgroup. Required for full system management rights.
|
|
skryt-z-login-obrazovky-specialaccounts-: Sets HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\adminx9 = 0. Removes the user tile from Windows login and lock screen completely.
|
|
heslo-nevypirsi-uzivatel-nesmeni-heslo: Sets ADS_UF_DONT_EXPIRE_PASSWD and ADS_UF_PASSWD_CANT_CHANGE flags via ADSI userFlags. The account never locks out or requires password maintenance.
|
|
zadne-heslo-aktualne-nastavovano-z-confi: Account created with empty password. Previous version used config.json password - removed because plaintext passwords in config files are a security risk.
|
|
fullname-x9-cz-s-r-o-via-adsi: Sets FullName property via [ADSI] so the account shows as "X9.cz s.r.o." in User Accounts panel, Event Viewer, and audit logs.
|
|
#>
|
|
param(
|
|
[object]$Config,
|
|
[string]$LogFile
|
|
)
|
|
|
|
$ErrorActionPreference = "Continue"
|
|
|
|
function Write-Log {
|
|
param([string]$Message, [string]$Level = "INFO")
|
|
$line = "[$(Get-Date -Format 'HH:mm:ss')] [$Level] $Message"
|
|
Add-Content -Path $LogFile -Value $line -Encoding UTF8
|
|
}
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Account config - no password by design
|
|
# -----------------------------------------------------------------------
|
|
$accountName = "adminx9"
|
|
$accountDesc = "X9 MSP admin account"
|
|
$accountFullName = "X9.cz s.r.o."
|
|
|
|
if ($Config -and $Config.adminAccount) {
|
|
if ($Config.adminAccount.username) { $accountName = $Config.adminAccount.username }
|
|
}
|
|
|
|
Write-Log "Creating admin account: $accountName" -Level INFO
|
|
|
|
# Empty password - account is hidden from login screen, no password needed
|
|
$emptyPass = [System.Security.SecureString]::new()
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Create or update account
|
|
# -----------------------------------------------------------------------
|
|
$existing = Get-LocalUser -Name $accountName -ErrorAction SilentlyContinue
|
|
|
|
if ($existing) {
|
|
Write-Log " Account already exists - clearing password" -Level INFO
|
|
try {
|
|
Set-LocalUser -Name $accountName -Password $emptyPass -PasswordNeverExpires $true
|
|
Enable-LocalUser -Name $accountName
|
|
Write-Log " Account updated: $accountName" -Level OK
|
|
}
|
|
catch {
|
|
Write-Log " Failed to update account: $_" -Level ERROR
|
|
}
|
|
} else {
|
|
try {
|
|
New-LocalUser -Name $accountName `
|
|
-Password $emptyPass `
|
|
-Description $accountDesc `
|
|
-PasswordNeverExpires `
|
|
-UserMayNotChangePassword `
|
|
-ErrorAction Stop | Out-Null
|
|
Write-Log " Account created: $accountName" -Level OK
|
|
}
|
|
catch {
|
|
Write-Log " Failed to create account: $_" -Level ERROR
|
|
}
|
|
}
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Set FullName via ADSI
|
|
# -----------------------------------------------------------------------
|
|
try {
|
|
$adsiUser = [ADSI]"WinNT://./$accountName,user"
|
|
$adsiUser.FullName = $accountFullName
|
|
$adsiUser.SetInfo()
|
|
Write-Log " FullName set to: $accountFullName" -Level OK
|
|
}
|
|
catch {
|
|
Write-Log " Failed to set FullName: $_" -Level ERROR
|
|
}
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Add to Administrators group
|
|
# -----------------------------------------------------------------------
|
|
try {
|
|
$adminsGroup = (Get-LocalGroup | Where-Object { $_.SID -eq "S-1-5-32-544" }).Name
|
|
$members = Get-LocalGroupMember -Group $adminsGroup -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.Name -like "*$accountName" }
|
|
if (-not $members) {
|
|
Add-LocalGroupMember -Group $adminsGroup -Member $accountName -ErrorAction Stop
|
|
Write-Log " Added to $adminsGroup" -Level OK
|
|
} else {
|
|
Write-Log " Already in $adminsGroup" -Level INFO
|
|
}
|
|
}
|
|
catch {
|
|
Write-Log " Failed to add to Administrators: $_" -Level ERROR
|
|
}
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Hide account from login screen
|
|
# -----------------------------------------------------------------------
|
|
try {
|
|
$specialPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"
|
|
if (-not (Test-Path $specialPath)) {
|
|
New-Item -Path $specialPath -Force | Out-Null
|
|
}
|
|
Set-ItemProperty -Path $specialPath -Name $accountName -Value 0 -Type DWord -Force
|
|
Write-Log " Account hidden from login screen" -Level OK
|
|
}
|
|
catch {
|
|
Write-Log " Failed to hide account from login screen: $_" -Level ERROR
|
|
}
|
|
|
|
Write-Log "Step 0a - Admin account complete" -Level OK
|