# 创建DNS区域
C:\> Add-DnsServerPrimaryZone -Name “fgedu.local” -ZoneFile “fgedu.local.dns”

# 添加DNS记录
C:\> Add-DnsServerResourceRecordA -ZoneName “fgedu.local” -Name “server01” -IPv4Address “192.168.1.100”
C:\> Add-DnsServerResourceRecordCNAME -ZoneName “fgedu.local” -Name “www” -HostNameAlias “server01.fgedu.local”

# 配置DNS转发器
C:\> Add-DnsServerForwarder -IPAddress “8.8.8.8”, “8.8.4.4”

# 安装DHCP服务器
C:\> Install-WindowsFeature -Name DHCP -IncludeManagementTools

# 授权DHCP服务器
C:\> Add-DhcpServerInDC -DnsName “server01.fgedu.local” -IPAddress “192.168.1.100”

# 创建DHCP作用域
C:\> Add-DhcpServerV4Scope -Name “Internal Network” -StartRange “192.168.1.101” -EndRange “192.168.1.200” -SubnetMask “255.255.255.0”

# 配置DHCP选项
C:\> Set-DhcpServerV4OptionValue -ScopeId “192.168.1.0” -DnsServer “192.168.1.100” -Router “192.168.1.1”

# 查看DHCP租约
C:\> Get-DhcpServerv4Lease -ScopeId “192.168.1.0”

# 创建共享文件夹
C:\> New-Item -Path “D:\Shares” -ItemType Directory
C:\> New-Item -Path “D:\Shares\Public” -ItemType Directory
C:\> New-Item -Path “D:\Shares\Department” -ItemType Directory

# 配置共享权限
C:\> New-SmbShare -Name “Public” -Path “D:\Shares\Public” -FullAccess “Everyone”
C:\> New-SmbShare -Name “Department” -Path “D:\Shares\Department” -ChangeAccess “Domain Users”

# 配置NTFS权限
C:\> Get-Acl “D:\Shares\Public” | Set-Acl “D:\Shares\Department”
C:\> icacls “D:\Shares\Department” /grant “Domain Users:(OI)(CI)M”

# 启用文件服务器资源管理器
C:\> Install-WindowsFeature -Name FS-Resource-Manager

# 配置配额
C:\> New-FsrmQuota -Path “D:\Shares\Department” -Size 10GB -Description “Department Share Quota”

# 配置文件屏蔽
C:\> New-FsrmFileScreenTemplate -Name “Block Executables” -IncludeGroup “Executable Files”
C:\> New-FsrmFileScreen -Path “D:\Shares\Public” -Template “Block Executables”

# 配置卷影副本
C:\> vssadmin add shadowstorage /for=D: /on=E: /maxsize=20%
C:\> vssadmin create shadow /for=D:

# 配置远程桌面会话主机
C:\> Set-RDSessionCollectionConfiguration -CollectionName “QuickSessionCollection” -ConnectionBroker “server01.fgedu.local”

# 配置远程桌面授权
C:\> Install-RDLicense -LicenseServer “server01.fgedu.local” -LicenseMode PerUser

# 激活远程桌面授权
C:\> slmgr.vbs /ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
C:\> slmgr.vbs /ato

# 配置远程桌面用户
C:\> Add-LocalGroupMember -Group “Remote Desktop Users” -Member “jdoe”

# 配置远程桌面连接设置
C:\> Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server” -Name “fDenyTSConnections” -Value 0
C:\> Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp” -Name “UserAuthentication” -Value 1

# 查看远程桌面会话
C:\> quser

# 断开远程桌面会话
C:\> rwinsta /server:server01 sessionid

# 检查服务器状态
$servers = @(“server01”, “server02”, “server03”)
foreach ($server in $servers) {
$ping = Test-Connection -ComputerName $server -Count 1 -Quiet
if ($ping) {
Write-Host “$server is online” -ForegroundColor Green
} else {
Write-Host “$server is offline” -ForegroundColor Red
}
}

# 批量创建用户
$users = @(
@{Name=”Alice Smith”; SamAccountName=”asmith”},
@{Name=”Bob Johnson”; SamAccountName=”bjohnson”},
@{Name=”Charlie Brown”; SamAccountName=”cbrown”}
)

foreach ($user in $users) {
New-ADUser -Name $user.Name -SamAccountName $user.SamAccountName -UserPrincipalName “$($user.SamAccountName)@fgedu.local” -Enabled $true -PasswordNeverExpires $true -AccountPassword (ConvertTo-SecureString “P@ssw0rd” -AsPlainText -Force)
Write-Host “Created user: $($user.Name)”
}

# 监控磁盘空间
$servers = @(“server01”, “server02”)
foreach ($server in $servers) {
$disks = Get-WmiObject -Class Win32_LogicalDisk -ComputerName $server -Filter “DriveType=3”
foreach ($disk in $disks) {
$freeSpace = [math]::Round($disk.FreeSpace / 1GB, 2)
$totalSpace = [math]::Round($disk.Size / 1GB, 2)
$percentFree = [math]::Round(($disk.FreeSpace / $disk.Size) * 100, 2)
Write-Host “$server – $($disk.DeviceID): $freeSpace GB free of $totalSpace GB ($percentFree%)”
if ($percentFree -lt 20) {
Write-Host “WARNING: Low disk space on $server – $($disk.DeviceID)” -ForegroundColor Red
}
}
}

# 自动化服务管理
$services = @(“WinRM”, “wuauserv”, “bits”)
foreach ($service in $services) {
$status = Get-Service -Name $service
if ($status.Status -ne “Running”) {
Start-Service -Name $service
Write-Host “Started service: $service”
} else {
Write-Host “Service $service is already running”
}
}

# 配置Windows Defender防病毒
C:\> Set-MpPreference -DisableRealtimeMonitoring $false -ScanParameters 2

# 启用BitLocker加密
C:\> Install-WindowsFeature -Name BitLocker -IncludeManagementTools
C:\> Enable-BitLocker -MountPoint “C:” -EncryptionMethod Aes256 -UsedSpaceOnly -PasswordProtector

# 配置本地安全策略
C:\> secedit /export /cfg “C:\SecurityPolicy.inf”
C:\> # 编辑安全策略文件
C:\> secedit /configure /db “C:\Windows\Security\Local.sdb” /cfg “C:\SecurityPolicy.inf” /areas SECURITYPOLICY

# 启用审核策略
C:\> auditpol /set /category:”Account Management” /success:enable /failure:enable
C:\> auditpol /set /category:”Logon/Logoff” /success:enable /failure:enable

# 禁用不必要的服务
C:\> Stop-Service -Name “RemoteRegistry” -Force
C:\> Set-Service -Name “RemoteRegistry” -StartupType Disabled

# 配置用户账户控制
C:\> Set-ItemProperty -Path “HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System” -Name “EnableLUA” -Value 1
C:\> Set-ItemProperty -Path “HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System” -Name “ConsentPromptBehaviorAdmin” -Value 2

# 应用安全更新
C:\> Install-Module -Name PSWindowsUpdate
C:\> Get-WindowsUpdate -Install -AcceptAll