Group Policy: سیاست رمز عبور و قفل خودکار صفحه

New-ADOrganizationalUnit -Name "Workstations" -Path "DC=corp,DC=sahor,DC=ir"
New-ADOrganizationalUnit -Name "Staff" -Path "DC=corp,DC=sahor,DC=ir"

Set-ADDefaultDomainPasswordPolicy -Identity corp.sahor.ir `
  -MinPasswordLength 12 -ComplexityEnabled $true `
  -LockoutThreshold 5 -LockoutDuration 00:15:00 -LockoutObservationWindow 00:15:00 `
  -MaxPasswordAge 180.00:00:00
Get-ADDefaultDomainPasswordPolicy

New-ADFineGrainedPasswordPolicy -Name "Admins-PSO" -Precedence 10 -MinPasswordLength 16 -ComplexityEnabled $true -LockoutThreshold 3 -LockoutDuration 00:30:00 -LockoutObservationWindow 00:30:00 -MaxPasswordAge 90.00:00:00
Add-ADFineGrainedPasswordPolicySubject "Admins-PSO" -Subjects "Domain Admins"

New-GPO -Name "Staff - Screen Lock" | New-GPLink -Target "OU=Staff,DC=corp,DC=sahor,DC=ir"
Set-GPRegistryValue -Name "Staff - Screen Lock" -Key "HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop" -ValueName ScreenSaveActive -Type String -Value 1
Set-GPRegistryValue -Name "Staff - Screen Lock" -Key "HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop" -ValueName ScreenSaverIsSecure -Type String -Value 1
Set-GPRegistryValue -Name "Staff - Screen Lock" -Key "HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop" -ValueName ScreenSaveTimeOut -Type String -Value 600

New-GPO -Name "Workstations - Block USB Storage" | New-GPLink -Target "OU=Workstations,DC=corp,DC=sahor,DC=ir"
Set-GPRegistryValue -Name "Workstations - Block USB Storage" -Key "HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices" -ValueName Deny_All -Type DWord -Value 1

gpupdate /force
gpresult /r /scope:user

Get-GPOReport -Name "Staff - Screen Lock" -ReportType Html -Path C:\Temp\gpo.html