堡垒机.note

noteId: WEBd8b75c20efee4d0e91b8b8e0033926f0 · 原始路径：/ALL/世赛题目（练习） - 笔记/第48届/08-集训队解题/B/堡垒机.note · 图片：5 · 附件待处理：0

不需要配置winrm，域内直接走kerberos认证的
旧：服务器要开启 Winrm Server，客户端要配置Winrm 客户端“*”

1、配置服务端（iqaluiT）：

执行后重启不会失效

·优化后的最简脚本：

先直接去图形化复制这个路径：

rolecapabilies 可以在右边框里面搜，只不过结尾要改y为ies

remove-item 那一行可以不写

路径不区分大小写

new-psrolecapabilityFile 那一行里的 ValidateSet 必须要大小，否则无法进行限制

mkdir "C:\Program Files\WindowsPowerShell\Modules\wsus\RoleCapabilities","C:\tran" -Force
New-ModuleManifest "C:\Program Files\WindowsPowerShell\Modules\wsus\wsus.psd1" -ModuleVersion 1.0.0
Remove-Item "C:\Program Files\WindowsPowerShell\Modules\wsus\RoleCapabilities\wsus.psrc" -Force -ErrorAction ignore
New-PSRoleCapabilityFile "C:\Program Files\WindowsPowerShell\Modules\wsus\RoleCapabilities\wsus.psrc" `
  -VisibleCmdlets @(@{Name="restart-service";Parameters=@{Name="Name";ValidateSet="wsusservice"}}) `
  -VisibleExternalCommands "C:\Windows\System32\whoami.exe"
New-PSSessionConfigurationFile "C:\wsus.pssc" `
  -SessionType RestrictedRemoteServer `
  -RunAsVirtualAccount `
  -TranscriptDirectory "C:\tran" `
  -RoleDefinitions @{Everyone=@{RoleCapabilities="wsus"}}
Register-PSSessionConfiguration -Name "WS-Management" -Path "C:\wsus.pssc" -Force
Restart-Service winrm

2、客户端测试：

Enter-PSSession -ComputerName iqaluiT_R -ConfigurationName WS-Management
whoami    //显示 winrm virtual users
restart-service wsusservice    //重启成功（不报错）
restart-service winrm    //命令执行失败
ipconfig    //命令执行失败

旧 WSUS：

$mod="WsusOpsModule"
$role="WsusOps"
$ep="WS-Management"
$modPath=Join-Path $env:ProgramFiles "WindowsPowerShell\Modules\$mod"
$rolePath=Join-Path $modPath "RoleCapabilities"
$psrc=Join-Path $rolePath "$role.psrc"
$pssc="C:\WsusOpsEndpoint.pssc"
$trans="C:\Transcripts"
 
New-Item -Type Directory $rolePath,$trans -Force | Out-Null
New-ModuleManifest -Path (Join-Path $modPath "$mod.psd1") -ModuleVersion 1.0.0 | Out-Null
 
if(Test-Path $psrc){Remove-Item $psrc -Force}
New-PSRoleCapabilityFile -Path $psrc -Author "Senior Engineer" `
  -VisibleCmdlets @(@{Name="Restart-Service";Parameters=@{Name="Name";ValidateSet="WsusService"}}) `
  -VisibleExternalCommands @("C:\Windows\System32\whoami.exe")
 
New-PSSessionConfigurationFile -Path $pssc -SessionType RestrictedRemoteServer -RunAsVirtualAccount `
  -TranscriptDirectory $trans -RoleDefinitions @{Everyone=@{RoleCapabilities=$role}}
 
Register-PSSessionConfiguration -Name $ep -Path $pssc -Force
Restart-Service WinRM

$ep 这里改成 WS-Management