f5a5de943a
02-software: add Atera RMM agent install (Invoke-WebRequest + msiexec /qn), stop UCPD driver before PDF association write, restart after; remove reference to PDF-DefaultApp scheduled task in header 03-system-registry: correct OneDrive uninstall description - intentional (pre-installed consumer version only, no policy key, M365 can reinstall) 04-default-profile: OneDrive RunOnce blocking removed, ShowRecent=0, ShowFrequent=0, FullPath=1 in CabinetState already added in prior session 06-scheduled-tasks: PDF-DefaultApp task removed - PDF set once in step 02 08-activation: add OA3/BIOS embedded key check via SoftwareLicensingService WMI; key priority: config.json > OA3 firmware > GVLK web/spec: update all status badges, remove mustfix flags, deduplicate OneDrive entries across steps 01/03/04, add OA3 row to step-08 web/data/descriptions.json: regenerated (65 items) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
113 lines
5 KiB
PowerShell
113 lines
5 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Creates the adminx9 local administrator account for MSP use.
|
|
|
|
.DESCRIPTION
|
|
Creates a hidden local administrator account 'adminx9' used by X9.cz technicians
|
|
for remote management and on-site administration. The account has no password by
|
|
design - it is invisible to regular users and only accessible to technicians who
|
|
know it exists. FullName is set to "X9.cz s.r.o." so it is identifiable in
|
|
system tools. Password policy is set so it never expires.
|
|
|
|
.ITEMS
|
|
vytvorit-lokalni-ucet-adminx9: Creates the account via [ADSI] WinNT provider. No password by design - the account is hidden from users and used only by MSP technicians for remote administration.
|
|
pridat-do-skupiny-administrators: Adds adminx9 to the local Administrators group via net localgroup. Required for full system management rights.
|
|
skryt-z-login-obrazovky-specialaccounts-: Sets HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\adminx9 = 0. Removes the user tile from Windows login and lock screen completely.
|
|
heslo-nevypirsi-uzivatel-nesmeni-heslo: Sets ADS_UF_DONT_EXPIRE_PASSWD and ADS_UF_PASSWD_CANT_CHANGE flags via ADSI userFlags. The account never locks out or requires password maintenance.
|
|
zadne-heslo-aktualne-nastavovano-z-confi: Account created with empty password. Previous version used config.json password - removed because plaintext passwords in config files are a security risk.
|
|
fullname-x9-cz-s-r-o-via-adsi: Sets FullName property via [ADSI] so the account shows as "X9.cz s.r.o." in User Accounts panel, Event Viewer, and audit logs.
|
|
#>
|
|
param(
|
|
[object]$Config,
|
|
[string]$LogFile
|
|
)
|
|
|
|
$ErrorActionPreference = "Continue"
|
|
|
|
function Write-Log {
|
|
param([string]$Message, [string]$Level = "INFO")
|
|
$line = "[$(Get-Date -Format 'HH:mm:ss')] [$Level] $Message"
|
|
Add-Content -Path $LogFile -Value $line -Encoding UTF8
|
|
}
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Read account config
|
|
# -----------------------------------------------------------------------
|
|
$accountName = "adminx9"
|
|
$accountPass = "AdminX9.AdminX9"
|
|
$accountDesc = "X9 MSP admin account"
|
|
|
|
if ($Config -and $Config.adminAccount) {
|
|
if ($Config.adminAccount.username) { $accountName = $Config.adminAccount.username }
|
|
if ($Config.adminAccount.password) { $accountPass = $Config.adminAccount.password }
|
|
if ($Config.adminAccount.description) { $accountDesc = $Config.adminAccount.description }
|
|
}
|
|
|
|
Write-Log "Creating admin account: $accountName" -Level INFO
|
|
|
|
$securePass = ConvertTo-SecureString $accountPass -AsPlainText -Force
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Create or update account
|
|
# -----------------------------------------------------------------------
|
|
$existing = Get-LocalUser -Name $accountName -ErrorAction SilentlyContinue
|
|
|
|
if ($existing) {
|
|
Write-Log " Account already exists - updating password" -Level INFO
|
|
try {
|
|
Set-LocalUser -Name $accountName -Password $securePass -PasswordNeverExpires $true
|
|
Enable-LocalUser -Name $accountName
|
|
Write-Log " Account updated: $accountName" -Level OK
|
|
}
|
|
catch {
|
|
Write-Log " Failed to update account: $_" -Level ERROR
|
|
}
|
|
} else {
|
|
try {
|
|
New-LocalUser -Name $accountName `
|
|
-Password $securePass `
|
|
-Description $accountDesc `
|
|
-PasswordNeverExpires `
|
|
-UserMayNotChangePassword `
|
|
-ErrorAction Stop | Out-Null
|
|
Write-Log " Account created: $accountName" -Level OK
|
|
}
|
|
catch {
|
|
Write-Log " Failed to create account: $_" -Level ERROR
|
|
}
|
|
}
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Add to Administrators group
|
|
# -----------------------------------------------------------------------
|
|
try {
|
|
$adminsGroup = (Get-LocalGroup | Where-Object { $_.SID -eq "S-1-5-32-544" }).Name
|
|
$members = Get-LocalGroupMember -Group $adminsGroup -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.Name -like "*$accountName" }
|
|
if (-not $members) {
|
|
Add-LocalGroupMember -Group $adminsGroup -Member $accountName -ErrorAction Stop
|
|
Write-Log " Added to $adminsGroup" -Level OK
|
|
} else {
|
|
Write-Log " Already in $adminsGroup" -Level INFO
|
|
}
|
|
}
|
|
catch {
|
|
Write-Log " Failed to add to Administrators: $_" -Level ERROR
|
|
}
|
|
|
|
# -----------------------------------------------------------------------
|
|
# Hide account from login screen
|
|
# -----------------------------------------------------------------------
|
|
try {
|
|
$specialPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"
|
|
if (-not (Test-Path $specialPath)) {
|
|
New-Item -Path $specialPath -Force | Out-Null
|
|
}
|
|
Set-ItemProperty -Path $specialPath -Name $accountName -Value 0 -Type DWord -Force
|
|
Write-Log " Account hidden from login screen" -Level OK
|
|
}
|
|
catch {
|
|
Write-Log " Failed to hide account from login screen: $_" -Level ERROR
|
|
}
|
|
|
|
Write-Log "Step 0a - Admin account complete" -Level OK
|