Skip to content

Script Catalog

This catalog documents the PowerShell deployment scripts that the sysadmin executes directly inside Windows guests.

Use this page as the operator-facing reference for:

  • where to run each script
  • what the script changes
  • which variables the sysadmin can override
  • which values are used by default
  • how to validate the result

General usage model:

  • Proxmox is used only for clone, sizing, snapshot, and power lifecycle.
  • Windows configuration is executed from an elevated PowerShell session inside the target server or workstation.
  • Passwords must be entered securely by the sysadmin at runtime unless a script is being tested in a controlled lab wrapper.
  • -ValidateOnly means preview or prerequisite validation only; it must not be treated as an execution success state.
  • the primary place to copy a script is the exact runbook step where that script is executed

HQ-CHR01 deployment helpers

scripts/qga-run.sh

Run on H1 when a template-building runbook must transport and execute a PowerShell file through QEMU Guest Agent. Parameters are positional: VMID, local PowerShell file, and optional timeout in seconds. A timeout returns code 124 and prints the exact qm guest exec-status command; it does not assert that the guest process failed.

scripts/qga-run.sh 4000 validate-golden-image.ps1 900

scripts/Validate-WS2025-GoldenImage.ps1

Run through qga-run.sh against a temporary clone of the Windows Server 2025 Desktop Experience template. It is a read-only publication gate and accepts ExpectedCaptionPattern and ExpectedPowerShellVersion; network cleanliness, domain membership, roles, devices, QGA state, OpenSSH state, and pending reboot checks remain mandatory.

The exact execution and cleanup sequence is in P02-T04.

scripts/Deploy-HQ-CHR01.sh

Run on:

  • H1
  • before the first boot of the runtime CHR clone

Purpose:

  • clone the low-VMID CHR template
  • apply Proxmox-side NIC and startup settings
  • inject the validated rw/autorun.scr bootstrap into the runtime disk
  • start the VM and optionally validate first boot through QGA

Configurable variables:

Variable Default
VMID 4010
SOURCE_TEMPLATE_VMID 4004
VM_NAME HQ-CHR01
WAN_BRIDGE GEILWAN
LAN_BRIDGE GEILLAN
WAN_IP_CIDR 172.31.255.2/30
WAN_GATEWAY 172.31.255.1
TIMEZONE_NAME America/Santo_Domingo
AUTORUN_IDENTITY_NAME HQ-CHR01
KEEP_AUTORUN_TEST_FILE 0
SKIP_BOOT_VALIDATION 0

Example:

VMID=4010 \
SOURCE_TEMPLATE_VMID=4004 \
VM_NAME='HQ-CHR01' \
WAN_BRIDGE='GEILWAN' \
LAN_BRIDGE='GEILLAN' \
WAN_IP_CIDR='172.31.255.2/30' \
WAN_GATEWAY='172.31.255.1' \
TIMEZONE_NAME='America/Santo_Domingo' \
scripts/Deploy-HQ-CHR01.sh

Validate after run:

  • qm config 4010 matches the expected WAN/LAN bridge layout
  • qm guest cmd 4010 get-osinfo reports CHR
  • qm guest cmd 4010 network-get-interfaces shows the clean ether1/ether2 model

scripts/Invoke-Qga-WindowsBootstrap.sh

Run on:

  • H1
  • after cloning a Windows guest and before the first RDP session

Purpose:

  • wait for QGA
  • apply the first exact IPv4/gateway/DNS state
  • optionally enable RDP
  • provide a predictable path for the sysadmin to continue inside the guest OS

Configurable variables:

Variable Default
VMID required
GUEST_NAME Windows guest
IPV4_ADDRESS required
PREFIX_LENGTH 24
GATEWAY required
DNS_SERVERS required
ENABLE_RDP 1
TIMEOUT_SECONDS 900

Example:

VMID=4011 \
GUEST_NAME='HQ-DC01' \
IPV4_ADDRESS='172.20.20.11' \
PREFIX_LENGTH='24' \
GATEWAY='172.20.20.1' \
DNS_SERVERS='172.20.20.1,1.1.1.1' \
ENABLE_RDP='1' \
TIMEOUT_SECONDS='900' \
scripts/Invoke-Qga-WindowsBootstrap.sh

Validate after run:

  • the guest answers on the configured IP
  • RDP is reachable if ENABLE_RDP=1
  • the sysadmin can continue with the in-guest PowerShell deployment script

HQ-DC01 deployment and validation

Direct QGA bootstrap command for the first RDP connection

Run on:

  • H1
  • before RDP access to the new Windows clone

Purpose:

  • configure the first static IPv4 state through QGA
  • set gateway and DNS
  • enable RDP
  • enable the Windows firewall Remote Desktop rule group

Copy-paste example:

VMID=4011
IPV4_ADDRESS='172.20.20.11'
PREFIX_LENGTH='24'
GATEWAY='172.20.20.1'
DNS1='172.20.20.1'
DNS2='1.1.1.1'

qm guest exec "$VMID" -- powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "
\$adapter = Get-NetAdapter | Where-Object Status -eq 'Up' | Sort-Object ifIndex | Select-Object -First 1;
if (-not \$adapter) { throw 'No active network adapter was found.' }

Get-NetIPAddress -InterfaceIndex \$adapter.ifIndex -AddressFamily IPv4 -ErrorAction SilentlyContinue |
  Where-Object { \$_.IPAddress -notlike '169.254.*' } |
  ForEach-Object {
    Remove-NetIPAddress -InterfaceIndex \$adapter.ifIndex -AddressFamily IPv4 -IPAddress \$_.IPAddress -Confirm:\$false -ErrorAction SilentlyContinue
  };

Get-NetRoute -InterfaceIndex \$adapter.ifIndex -DestinationPrefix '0.0.0.0/0' -AddressFamily IPv4 -ErrorAction SilentlyContinue |
  ForEach-Object {
    Remove-NetRoute -InterfaceIndex \$adapter.ifIndex -DestinationPrefix '0.0.0.0/0' -NextHop \$_.NextHop -Confirm:\$false -ErrorAction SilentlyContinue
  };

New-NetIPAddress -InterfaceIndex \$adapter.ifIndex -IPAddress '$IPV4_ADDRESS' -PrefixLength $PREFIX_LENGTH -DefaultGateway '$GATEWAY' | Out-Null;
Set-DnsClientServerAddress -InterfaceIndex \$adapter.ifIndex -ServerAddresses '$DNS1','$DNS2';

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 0;
Enable-NetFirewallRule -DisplayGroup 'Remote Desktop' | Out-Null;
"

Validate after run:

  • the guest responds on the configured IP
  • RDP port 3389 is reachable
  • the sysadmin can sign in over RDP

HQ-MGMT01 management server

scripts/Deploy-HQ-MGMT01-Stage1.ps1

Run on:

  • HQ-MGMT01
  • elevated PowerShell
  • after Proxmox clone/bootstrap

Purpose:

  • validate first boot state
  • validate server VLAN DNS/gateway/domain reachability
  • optionally enable RDP
  • rename the server to HQ-MGMT01
  • join corp.gntech.me

Configurable variables:

Parameter Default
TargetName HQ-MGMT01
DomainName corp.gntech.me
OuPath OU=Servers,OU=GNTECH,DC=corp,DC=gntech,DC=me
JoinCredentialUser corp.gntech.me\svc.join.hq
ExpectedDnsServer 172.20.20.11
ExpectedGateway 172.20.20.1
EnableRdp not set
SkipDomainJoin not set
RestartIfNeeded not set

Example:

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force
.\Deploy-HQ-MGMT01-Stage1.ps1 `
    -TargetName 'HQ-MGMT01' `
    -DomainName 'corp.gntech.me' `
    -OuPath 'OU=Servers,OU=GNTECH,DC=corp,DC=gntech,DC=me' `
    -JoinCredentialUser 'corp.gntech.me\svc.join.hq' `
    -ExpectedDnsServer '172.20.20.11' `
    -ExpectedGateway '172.20.20.1' `
    -EnableRdp `
    -RestartIfNeeded

Validate after run:

  • HQ-MGMT01 is domain joined
  • RDP is enabled for approved administrators
  • HQ-MGMT01 can reach HQ-DC01 and HQ-FS01 on the required management ports

scripts/Deploy-HQ-DC01-Stage1.ps1

Run on:

  • HQ-DC01
  • elevated PowerShell
  • before forest promotion

Purpose:

  • set hostname
  • set time zone
  • set static IPv4, gateway, and DNS
  • install AD DS, DNS, and DHCP features

Configurable variables:

Parameter Default
TargetName HQ-DC01
TimeZone SA Western Standard Time
IPv4 172.20.20.11
PrefixLength 24
Gateway 172.20.20.1
DnsServers 127.0.0.1, 1.1.1.1
RestartIfNeeded not set

Example:

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force
.\Deploy-HQ-DC01-Stage1.ps1 -TargetName 'HQ-DC01' -IPv4 '172.20.20.11' -PrefixLength 24 -Gateway '172.20.20.1' -DnsServers '127.0.0.1','1.1.1.1' -RestartIfNeeded

Validate after run:

  • hostname is correct
  • static IP is present
  • features are installed

scripts/Promote-HQ-DC01-Forest.ps1

Run on:

  • HQ-DC01
  • elevated PowerShell
  • after stage 1

Purpose:

  • promote the first domain controller
  • create the forest
  • set the DSRM password

Configurable variables:

Parameter Default
DomainName corp.gntech.me
NetBIOSName GNTECH
InstallDns true
NoRebootOnCompletion not set
ValidateOnly not set

Secure prompts:

  • local Administrator password
  • DSRM password

Example:

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force
.\Promote-HQ-DC01-Forest.ps1 -DomainName 'corp.gntech.me' -NetBIOSName 'GNTECH'

Validate after run:

  • server reboots as a domain controller
  • corp.gntech.me exists
  • SYSVOL and NETLOGON shares exist

scripts/Configure-HQ-DC01-PostPromotion.ps1

Run on:

  • HQ-DC01
  • elevated PowerShell
  • after forest promotion

Purpose:

  • add UPN suffix
  • configure DNS forwarders and reverse zones
  • authorize and configure DHCP
  • create the validated day-zero OU layout
  • optionally read the OU hierarchy from a CSV template instead of relying only on built-in defaults

Configurable variables:

Parameter Default
DomainFqdn corp.gntech.me
DomainDn DC=corp,DC=gntech,DC=me
DcFqdn HQ-DC01.corp.gntech.me
DcIp 172.20.20.11
UpnSuffix gntech.me
DnsForwarders 1.1.1.1, 9.9.9.9
ServerReverseNetworkId 172.20.20.0/24
WorkstationReverseNetworkId 172.20.30.0/24
DhcpScopeName VLAN30 Workstations
DhcpScopeId 172.20.30.0
DhcpStartRange 172.20.30.100
DhcpEndRange 172.20.30.199
DhcpSubnetMask 255.255.255.0
DhcpRouter 172.20.30.1
EnterpriseRootOuName GNTECH
OuTemplateCsvPath ou-baseline.csv next to the script if present, otherwise built-in validated OU hierarchy
ValidateOnly not set

Example:

.\Configure-HQ-DC01-PostPromotion.ps1

Example with explicit OU template CSV:

.\Configure-HQ-DC01-PostPromotion.ps1 -OuTemplateCsvPath 'C:\Deploy\ou-baseline.csv'

Validate after run:

  • DHCP scope is active
  • forwarders are correct
  • expected OUs exist
  • OU=GNTECH and the approved top-level OUs are present immediately after this step
  • if a CSV was used, the created OUs match the enabled rows in that file

scripts/Validate-HQ-DC01.ps1

Run on:

  • HQ-DC01
  • elevated PowerShell
  • after post-promotion work

Purpose:

  • validate domain controller state against the approved lab baseline

Configurable variables:

  • all expected values can be overridden
  • most operators should use the defaults unless the deployment intentionally differs

Important parameters:

Parameter Default
ExpectedHostname HQ-DC01
ExpectedDomainFqdn corp.gntech.me
ExpectedNetBIOSName GNTECH
ExpectedUpnSuffix gntech.me
ExpectedDcIp 172.20.20.11
ExpectedDnsForwarders 1.1.1.1, 9.9.9.9
ExpectedDnsZones corp.gntech.me, 20.20.172.in-addr.arpa, 30.20.172.in-addr.arpa
ExpectedDhcpAuthorizedDnsName hq-dc01.corp.gntech.me
ExpectedDhcpAuthorizedIp 172.20.20.11
ExpectedDhcpScopeId 172.20.30.0
ExpectedEnterpriseRootOuDn OU=GNTECH,DC=corp,DC=gntech,DC=me
OuTemplateCsvPath ou-baseline.csv next to the script if present, otherwise manual OU list input/defaults

Example:

.\Validate-HQ-DC01.ps1

Validate after run:

  • script completes without failures

GPO scripts

scripts/Configure-HQ-DC01-GPOBaseline.ps1

Run on:

  • HQ-DC01
  • elevated PowerShell

Purpose:

  • create and link:
  • GPO-DC-Baseline
  • GPO-Servers-Baseline
  • GPO-Workstations-Baseline

Configurable variables:

Parameter Default
DomainFqdn corp.gntech.me
DomainDn DC=corp,DC=gntech,DC=me
EnterpriseRootOuDn OU=GNTECH,DC=corp,DC=gntech,DC=me
DomainControllersDn OU=Domain Controllers,DC=corp,DC=gntech,DC=me
ServersOuDn OU=Servers,OU=GNTECH,DC=corp,DC=gntech,DC=me
WorkstationsOuDn OU=Workstations,OU=GNTECH,DC=corp,DC=gntech,DC=me
DcBaselineGpoName GPO-DC-Baseline
ServerBaselineGpoName GPO-Servers-Baseline
WorkstationBaselineGpoName GPO-Workstations-Baseline
ValidateOnly not set

Example:

.\Configure-HQ-DC01-GPOBaseline.ps1

scripts/Configure-HQ-DC01-UserGPOBaseline.ps1

Run on:

  • HQ-DC01
  • elevated PowerShell

Purpose:

  • create and link GPO-Users-Baseline

Configurable variables:

Parameter Default
UsersOuDn OU=Users,OU=GNTECH,DC=corp,DC=gntech,DC=me
UserBaselineGpoName GPO-Users-Baseline
ValidateOnly not set

Example:

.\Configure-HQ-DC01-UserGPOBaseline.ps1

Identity scripts

scripts/Create-HQ-TestUsers.ps1

Run on:

  • HQ-DC01
  • elevated PowerShell

Execution point:

  • run this after P03-T01 - HQ-DC01 Build and Promotion has completed successfully
  • complete it before P03-T07 - HQ-FS01 File Services and P03-T08 - Workstation Resource Access Validation

Purpose:

  • create validated test users and admin users

Current built-in identities:

  • miguel.perez@gntech.me
  • ana.garcia@gntech.me
  • adm.miguel.perez@gntech.me
  • adm.gerlin.nolasco@gntech.me

Built-in validation membership behavior:

  • adds miguel.perez to DL-HQ-FS01-Public-RW by default
  • leaves ana.garcia outside that group so denied-write validation remains meaningful

Configurable variables:

Parameter Default
DomainDn DC=corp,DC=gntech,DC=me
UsersOuDn OU=Users,OU=GNTECH,DC=corp,DC=gntech,DC=me
AdminsOuDn OU=Admins,OU=GNTECH,DC=corp,DC=gntech,DC=me
UserUpnSuffix gntech.me
AdminUpnSuffix gntech.me
PublicWriteGroupSamAccountName DL-HQ-FS01-Public-RW
ValidateOnly not set

Notes:

  • the admin must enter the standard-user and admin-user passwords securely during execution
  • the script no longer accepts plaintext password parameters
  • the script creates the accounts but does not automatically grant Domain Admins
  • the script does add the validated write user miguel.perez to the approved Public write group by default
  • if an admin account must RDP to HQ-DC01, membership in the appropriate privileged group must also be configured

Example:

.\Create-HQ-TestUsers.ps1

scripts/Create-HQ-ServiceAccounts.ps1

Run on:

  • HQ-DC01
  • elevated PowerShell

Purpose:

  • create the baseline service accounts:
  • svc.join.hq
  • svc.backup.hq
  • svc.monitor.hq
  • svc.deploy.hq

Configurable variables:

Parameter Default
DomainDn DC=corp,DC=gntech,DC=me
ServiceAccountsOuDn OU=Tier1,OU=ServiceAccounts,OU=GNTECH,DC=corp,DC=gntech,DC=me
ServiceUpnSuffix none
AccountPasswords none; optional hashtable of SecureString values for an approved automation transport
PasswordNeverExpires not set
ValidateOnly not set

Secure prompts:

  • one secure password per service account that does not already exist
  • interactive sysadmin use omits AccountPasswords and receives secure prompts
  • automation may pass SecureString values in memory; plaintext values are rejected and must never be committed

Validation and re-run behavior:

  • validates the domain and target OU before creating accounts
  • -ValidateOnly reports compliant, missing, or drifted accounts without changing AD or requesting passwords
  • a re-run does not reset passwords for existing accounts
  • an account with the same SamAccountName outside the target OU is a blocking error
  • only svc.join.hq receives a permission in the current validated runbooks; the other three accounts remain identity placeholders until role-specific least-privilege workflows are validated

Example:

.\Create-HQ-ServiceAccounts.ps1 -ServiceUpnSuffix 'gntech.me'

scripts/Grant-HQ-JoinDelegation.ps1

Run on:

  • HQ-DC01
  • elevated PowerShell

Purpose:

  • delegate workstation and server join rights to the service account used for onboarding

Validated model:

  • svc.join.hq
  • target OUs:
  • OU=Workstations,OU=GNTECH,...
  • OU=Servers,OU=GNTECH,...

Configurable variables:

Parameter Default
JoinAccountSam svc.join.hq
TargetOuDns OU=Workstations,OU=GNTECH,DC=corp,DC=gntech,DC=me, OU=Servers,OU=GNTECH,DC=corp,DC=gntech,DC=me
ValidateOnly not set

Notes:

  • this script must be run after the service account exists
  • this script adds only missing ACL entries and reports already-compliant entries on re-run
  • -ValidateOnly reports each required ACL entry as Compliant or Missing without changing AD
  • this script is validated in the lab with a real join of HQ-CL02

Example:

.\Grant-HQ-JoinDelegation.ps1

scripts/Configure-HQ-DC01-RecoveryTime.ps1

Run on:

  • the PDC Emulator (HQ-DC01 in the validated single-DC lab)
  • elevated PowerShell

Purpose:

  • enable AD Recycle Bin
  • install Windows Server Backup
  • safely prepare a verified RAW, non-system backup disk
  • configure reliable external NTP peers
  • optionally create and validate the first System State recovery point
Parameter Default
DomainFqdn corp.gntech.me
BackupDriveLetter E
BackupDiskNumber 1
NtpPeers Cloudflare and Google time peers
StartSystemStateBackup not set
ValidateOnly not set

Safety boundaries:

  • refuses to configure time if the target is not the PDC Emulator
  • refuses a boot, system, or non-RAW disk when preparing a new volume
  • -ValidateOnly changes nothing
  • recovery-point creation is validated; restore workflows are not validated by this script

scripts/Configure-HQ-ADSites.ps1

Run on:

  • HQ-DC01
  • elevated PowerShell

Purpose:

  • rename the default site to HQ when appropriate
  • create or reconcile the 11 documented internal VLAN subnet objects
  • validate the DC server object and local site discovery
Parameter Default
SiteName HQ
Location Headquarters
Subnets 172.20.10.0/24 through the documented 172.20.110.0/24 VLAN plan
ValidateOnly not set

Validated boundary:

  • validated on HQ-DC01 and from HQ-CL01 on VLAN 30
  • -ValidateOnly changes nothing
  • client Netlogon cache may require a service restart before nltest /dsgetsite reflects a renamed site

File services

scripts/Create-HQ-FS01-Groups.ps1

Run on:

  • HQ-DC01
  • elevated PowerShell

Purpose:

  • create the domain-local security groups used by HQ-FS01 shares and NTFS ACLs

Groups created:

  • DL-HQ-FS01-Public-RW
  • DL-HQ-FS01-Departments-IT-RW
  • DL-HQ-FS01-Departments-Finance-RW
  • DL-HQ-FS01-Backups-RW

Configurable variables:

Parameter Default
GroupsOuDn OU=Groups,OU=GNTECH,DC=corp,DC=gntech,DC=me
ValidateOnly not set

Example:

.\Create-HQ-FS01-Groups.ps1

Validate after run:

  • the four DL-HQ-FS01-* groups exist in the target Groups OU

scripts/Deploy-HQ-FS01-Stage1.ps1

Run on:

  • HQ-FS01
  • elevated PowerShell

Purpose:

  • set static IP configuration
  • set DNS registration suffix
  • rename the server
  • join it to the domain

Configurable variables:

Parameter Default
TargetName HQ-FS01
IPv4 172.20.20.21
PrefixLength 24
Gateway 172.20.20.1
DnsServers 172.20.20.11
DomainName corp.gntech.me
OuPath OU=Servers,OU=GNTECH,DC=corp,DC=gntech,DC=me
JoinCredentialUser corp.gntech.me\svc.join.hq
RestartIfNeeded not set

Secure prompts:

  • domain join credential

Validated note:

  • live lab validation used the delegated service account svc.join.hq
  • when Add-Computer was driven non-interactively, the stable credential format was the UPN form svc.join.hq@gntech.me

Example:

.\Deploy-HQ-FS01-Stage1.ps1 -RestartIfNeeded

Validate after run:

  • hostname is HQ-FS01
  • static IP is 172.20.20.21/24
  • the server is joined to corp.gntech.me
  • DNS resolution for corp.gntech.me succeeds before the join attempt is made

scripts/Configure-HQ-FS01-Shares.ps1

Run on:

  • HQ-FS01
  • elevated PowerShell

Purpose:

  • install the FS-FileServer role if needed
  • create C:\Shares
  • create business folders and SMB shares
  • apply baseline share permissions and NTFS ACLs
  • preflight all required domain identities before changing the server

Configured paths:

  • C:\Shares\Departments
  • C:\Shares\Departments\IT
  • C:\Shares\Departments\Finance
  • C:\Shares\Public
  • C:\Shares\Backups

Configured SMB shares:

  • Departments
  • Public
  • Backups

Configurable variables:

Parameter Default
ShareRoot C:\Shares
DomainNetbios GNTECH
ValidateOnly not set

Example:

.\Configure-HQ-FS01-Shares.ps1

Re-run boundary:

  • -ValidateOnly is read-only and does not install FS-FileServer
  • an existing share with the wrong path stops execution
  • existing shares are reconciled with the required description, access-based enumeration mode, and required grants
  • managed folder ACLs are authoritative: inheritance is disabled and the documented explicit ACL is reapplied

Validate after run:

  • Get-SmbShare shows Departments, Public, and Backups
  • Get-SmbShareAccess shows the intended access model
  • the folder tree exists under C:\Shares
  • only Public is currently validated from a real client workflow in the published runbooks

Workstation onboarding

scripts/Configure-HQ-WorkstationHardeningGPO.ps1

Run on:

  • HQ-DC01
  • elevated PowerShell

Purpose:

  • create and link the separate workstation hardening GPO
  • reconcile 11 validated LLMNR, PowerShell logging, SmartScreen, and Defender registry settings
  • report effective GPO configuration without changing AD through -ValidateOnly
Parameter Default
WorkstationsOuDn OU=Workstations,OU=GNTECH,DC=corp,DC=gntech,DC=me
GpoName GPO-Workstations-Hardening
TranscriptionPath C:\ProgramData\PSLogs
ValidateOnly not set

Validated on HQ-CL01 with effective registry, Defender, LDAP, SMB, and HTTPS checks.

scripts/Join-HQ-Workstation.ps1

Run on:

  • target workstation such as HQ-CL01 or HQ-CL02
  • elevated PowerShell

Purpose:

  • validate first-boot readiness
  • validate DHCP and DNS assumptions
  • rename the workstation
  • join the workstation to the domain

Configurable variables:

Parameter Default
TargetName current computer name
DomainName corp.gntech.me
OuPath OU=Workstations,OU=GNTECH,DC=corp,DC=gntech,DC=me
DomainControllerFqdn hq-dc01.corp.gntech.me
ExpectedDnsServer 172.20.20.11
ExpectedGateway 172.20.30.1
LegacyBuildGateway 172.20.110.1
InternetTestHost github.com
DomainCredential secure prompt when omitted
RemoveLegacyBuildGateway not set
RestartIfNeeded not set
SkipInternetTest not set

Secure prompts:

  • domain join credential

Validated examples:

.\Join-HQ-Workstation.ps1 -TargetName 'HQ-CL01' -RestartIfNeeded

Operational note:

  • the delegated account model is validated with svc.join.hq
  • unexpected gateways block onboarding; legacy build-route cleanup must be explicitly requested
  • automation transports may pass a PSCredential object, while interactive use prompts securely
  • a wider admin credential can still be used intentionally, but it should not be the normal workstation join pattern

Validation boundary:

  • successful script execution is not enough by itself
  • the workstation join path is treated as validated only after the dependent runbook confirms DNS, domain join, OU placement, and gpresult

Validation guidance

After documenting or modifying a script:

  • validate syntax
  • validate -ValidateOnly mode if the script exposes it
  • validate the real execution path before treating the runbook as approved for customer deployment

Do not document a script as production-ready if only the parameter block was reviewed and no real lab execution happened.