repository·main·Indexed 18 days ago
https://github.com/dsccommunity/activedirectorydscA PowerShell Desired State Configuration (DSC) module for automating the deployment and management of Active Directory environments. It provides resources to configure domains, child domains, domain controllers (including RODCs), cross-domain trusts, and directory objects such as users, groups, and Organizational Units (OUs). It also includes resources for managing password policies, functional levels, and forest-wide properties.
ActiveDirectoryDsc.Common module is a PowerShell module providing a collection of utility functions and cmdlets used across the various modules in the ActiveDirectoryDsc ecosystem. It contains shared logic for Active Directory operations, type conversions, and resource state comparisons.The ADDomain resource is used to create a new domain within a new forest or to create a child domain within an existing forest.
Note that while you can specify the forest functional level and the domain functional level during deployment using this resource, standard Active Directory functional level restrictions apply. For detailed information on functional levels, refer to Microsoft's documentation on Active Directory functional levels.
The ADDomainTrust DSC resource is used to manage Domain Trust relationships within Active Directory. These relationships can be established between individual domains or entire forests.
For conceptual guidance on how to design these relationships, refer to the Microsoft documentation on Forest Design Models.
The ADDomainController DSC resource is used to install and configure domain controllers in Active Directory. It supports the installation of both standard domain controllers and Read-Only Domain Controllers (RODC).
InstallDns parameter. This specifies whether the DNS Server service should be installed and configured.InstallDns is only used during the initial provisioning of a domain controller. It cannot be used to install or uninstall the DNS server on a domain controller that has already been provisioned.FlexibleSingleMasterOperationRole parameter is ignored until the node has been successfully provisioned as a domain controller.Credential parameter, ensure the account provided can connect to an existing domain controller. If using a credential without a domain name, the underlying Install-ADDSDomainController cmdlet may hang without reporting an error while attempting replication.MSFT_ADServicePrincipalName DSC resource is used to manage Service Principal Names (SPNs). An SPN is a unique identifier for a service instance used by Kerberos authentication to associate a service instance with a specific service logon account. This enables client applications to authenticate services even without knowing the specific account name.ADReplicationSiteLink DSC resource is used to manage Replication Site Links within Active Directory. Site links are used to connect two or more sites, reflecting administrative policies for interconnecting sites and defining the methods used to transfer replication traffic. Connecting sites with site links is required to ensure domain controllers at different sites can replicate Active Directory changes.The ADUser DSC resource is used to manage User objects within Active Directory. It allows you to define the desired state of users, including properties related to their account configuration and lifecycle.
RestoreFromRecycleBin parameter, the Active Directory Recycle Bin feature must be enabled before objects are deleted. If the Recycle Bin is disabled, the msDS-LastKnownRDN property will not be added to deleted objects, which may affect restoration capabilities.ADDomainDefaultPasswordPolicy DSC resource is used to manage and enforce the default password policy for an Active Directory domain. This resource ensures that the domain-wide password settings (such as complexity requirements, minimum length, etc.) are configured according to your desired state.ADFineGrainedPasswordPolicy DSC resource is used to manage fine-grained password policies within an Active Directory domain. Use this resource to define and enforce specific password requirements for different groups of users or objects in your domain.The ADManagedServiceAccount DSC resource is used to manage Single Managed Service Accounts (MSAs) and Group Managed Service Accounts (gMSAs) within Active Directory.
Managed Service Accounts provide:
Key Differences:
MSFT_ADKDSKey DSC resource is used to manage KDS (Key Distribution Service) Root Keys within Active Directory. These root keys are a prerequisite for generating passwords for Group Managed Service Accounts (gMSA).