Review PR

.gitignore

@@ -0,0 +1 @@
+DSCResource.Tests

DSCResources/Helper.psm1

@@ -0,0 +1,70 @@
+<#
+ .SYNOPSIS
+ Tests the $Target parameter to ensure it contains the RootDSE and adds it if it doesn't.
+
+ .PARAMETER Name
+ Not used. Included to allow @PSBoundParameters in function call.
+
+ .PARAMETER Target
+ The target OU Distinguished Name with or without the RootDSE.
+
+ .PARAMETER Domain
+ Not used. Included to allow @PSBoundParameters in function call.
+
+ .PARAMETER Server
+ The name of the server. Optional.
+
+ .PARAMETER Ensure
+ Not used. Included to allow @PSBoundParameters in function call.
+
+#>
+function Test-TargetDN
+{
+ param
+ (
+ [string]
+ $Name,
+
+ [parameter(Mandatory = $true)]
+ [string]
+ $TargetDN,
+
+ [string]
+ $Domain,
+
+ [string]
+ $Server,
+
+ [ValidateSet('Present','Absent')]
+ [string]
+ $Ensure = 'Present'
+ )
+
+ $getADDomainParams = @{}
+ if ($Server)
+ {
+ $getADDomainParams += @{
+ Server = $Server
+ }
+ }
+ Write-Verbose -Message ("Checking the Domain Distinguished Name is " +
+ "present on the Target Distinguished Name.")
+ $domainDN = (Get-ADDomain @getADDomainParams).DistinguishedName
+ if ($TargetDN -like "*$domainDN")
+ {
+ Write-Verbose -Message "Target has full DN."
+ }
+ else
+ {
+ Write-Verbose -Message "Adding the Domain Distinguished Name to the Target DN."
+ if ($TargetDN.EndsWith(","))
+ {
+ $TargetDN = "$TargetDN$domainDN"
+ }
+ else
+ {
+ $TargetDN = "$TargetDN,$domainDN"
+ }
+ }
+ Write-Output -InputObject $TargetDN
+}

DSCResources/MSFT_GPInheritance/MSFT_GPInheritance.psm1

@@ -0,0 +1,156 @@
+function Get-TargetResource
+{
+ [OutputType([Hashtable])]
+ param
+ (
+ [parameter(Mandatory = $true)]
+ [string]
+ $TargetDN,
+
+ [string]
+ $Domain,
+
+ [string]
+ $Server,
+
+ [ValidateSet('Present','Absent')]
+ [string]
+ $Ensure = 'Present'
+ )
+
+ Import-Module $PSScriptRoot\..\Helper.psm1 -Verbose:$false
+ Import-Module -Name GroupPolicy -Verbose:$false
+ $testTargetDN = Test-TargetDN @PSBoundParameters
+ $targetResource = @{
+ TargetDN = $testTargetDN
+ Domain = $null
+ Server = $null
+ Ensure = $null
+ }
+ $getGPInheritanceParams = @{
+ Target = $testTargetDN
+ }
+ if ($Domain)
+ {
+ $targetResource.Domain = $Domain
+ $getGPInheritanceParams += @{
+ Domain = $Domain
+ }
+ }
+ if ($Server)
+ {
+ $targetResource.Server = $Server
+ $getGPInheritanceParams += @{
+ Server = $Server
+ }
+ }
+ Write-Verbose -Message 'Getting Group Policy Inheritance'
+ $gpoInheritanceBlocked = (Get-GPInheritance @getGPInheritanceParams).GpoInheritanceBlocked
+ if (!$gpoInheritanceBlocked)
+ {
+ $targetResource.Ensure = 'Present'
+ }
+ else
+ {
+ $targetResource.Ensure = 'Absent'
+ }
+ Write-Output -InputObject $targetResource
+}
+
+function Set-TargetResource
+{
+ param
+ (
+ [parameter(Mandatory = $true)]
+ [string]
+ $TargetDN,
+
+ [string]
+ $Domain,
+
+ [string]
+ $Server,
+
+ [ValidateSet('Present','Absent')]
+ [string]
+ $Ensure = 'Present'
+ )
+
+ if ($Ensure -eq 'Present')
+ {
+ Write-Verbose -Message 'Enabling Group Policy Inheritance'
+ $isBlocked = 'No'
+ }
+ else
+ {
+ Write-Verbose -Message 'Disabling Group Policy Inheritance'
+ $isBlocked = 'Yes'
+ }
+ $testTargetDN = Test-TargetDN @PSBoundParameters
+ $setGPInheritanceParams = @{
+ Target = $testTargetDN
+ IsBlocked = $IsBlocked
+ }
+ if ($Domain)
+ {
+ $setGPInheritanceParams += @{
+ Domain = $Domain
+ }
+ }
+ if ($Server)
+ {
+ $setGPInheritanceParams += @{
+ Server = $Server
+ }
+ }
+ Import-Module -Name GroupPolicy -Verbose:$false
+ $null = Set-GPInheritance @setGPInheritanceParams
+}
+
+function Test-TargetResource
+{
+[OutputType([Boolean])]
+ param
+ (
+ [parameter(Mandatory = $true)]
+ [string]
+ $TargetDN,
+
+ [string]
+ $Domain,
+
+ [string]
+ $Server,
+
+ [ValidateSet('Present','Absent')]
+ [string]
+ $Ensure = 'Present'
+ )
+
+ $targetResource = Get-TargetResource @PSBoundParameters
+ switch ($Ensure)
+ {
+ Present
+ {
+ if ($targetResource.Ensure -eq 'Present')
+ {
+ Write-Output -InputObject $true
+ }
+ else
+ {
+ Write-Output -InputObject $false
+ }
+ }
+ Absent
+ {
+ if ($targetResource.Ensure -eq 'Absent')
+ {
+ Write-Output -InputObject $true
+ }
+ else
+ {
+ Write-Output -InputObject $false
+ }
+ }
+ }
+}

DSCResources/MSFT_GPInheritance/MSFT_GPInheritance.schema.mof

@@ -0,0 +1,9 @@
+[ClassVersion("1.0.0"), FriendlyName("GPInheritance")]
+class MSFT_GPInheritance : OMI_BaseResource
+{
+ [Key, Description("Specifies the domain or the OU for which to block or unblock inheritance by its LDAP distinguished name.")] String TargetDN;
+ [Write, Description("Specifies the domain to run against.")] String Domain;
+ [Write, Description("Specifies the name of the domain controller that this resource contacts to complete the operation.
+You can specify either the fully qualified domain name (FQDN) or the host name.")] String Server;
+ [Write, Description("Whether inheritance should be blocked (Absent) or unblocked (Present)."), ValueMap{"Present", "Absent"}, Values{"Present", "Absent"}] String Ensure;
+};