OmerMicrosoft

Add-DnsServerConditionalForwarderZone -Name "contoso.com" -ReplicationScope "Forest"

OmerMicrosoft

#Changing The Forest Level
$CurrentForest = Get-ADForest
Set-ADForestMode -Identity $CurrentForest -Server $CurrentForest.SchemaMaster -ForestMode Windows2008R2Forest
#Changing The Domain Level
$CurrentDomain = Get-ADDomain
Set-ADDomainMode -Identity $CurrentDomain.Name -Server $CurrentDomain.PDCEmulator -DomainMode Windows2008R2Domain

OmerMicrosoft

Function Create-DNSScavengingRecordsReport
{
    <#Creates a report with DNS records stale data.
    For any record, checks if:
    1)Stale record, responding to ping.
    2)Stale record, NOT responding to ping.
    3)Valid record, timestamp is updated (not stale).#>
    $DC = (Get-ADDomainController).Name
    $DNSRoot = (Get-ADDomain).DNSRoot
    $DNSRecords = Get-DnsServerResourceRecord -ComputerName $DC -ZoneName $DNSRoot

OmerMicrosoft

$WVDApplication = Get-AzureADServicePrincipal -Filter "displayName eq 'Windows Virtual Desktop'"
$ApplicationRole = $WVDApplication.AppRoles | Where-Object { $_.DisplayName -eq 'TenantCreator'}
$UserAccount = Get-AzureADUser -ObjectId $AzureAccount.Id
New-AzureADUserAppRoleAssignment -ObjectId $UserAccount.ObjectId -PrincipalId $UserAccount.ObjectId -ResourceId $WVDApplication.ObjectId -Id $ApplicationRole.Id

OmerMicrosoft

$WVDApplication = Get-AzureADServicePrincipal -Filter "displayName eq 'Windows Virtual Desktop'"
$ApplicationRole = $WVDApplication.AppRoles | Where-Object { $_.DisplayName -eq 'TenantCreator'}
$UserAccount = Get-AzureADUser -ObjectId $AzureAccount.Id
New-AzureADUserAppRoleAssignment -ObjectId $UserAccount.ObjectId -PrincipalId $UserAccount.ObjectId -ResourceId $WVDApplication.ObjectId -Id $ApplicationRole.Id

OmerMicrosoft

$BrokerURL = "https://rdbroker.wvd.microsoft.com"
Add-RdsAccount -DeploymentUrl $BrokerURL -Credential $Credentials
$RDSTenantName = Read-Host "Enter RDS tenant name" 
$NewRDSTenant = New-RdsTenant -Name $RDSTenantName -AadTenantId $SelectedAzureSubscription.TenantId -AzureSubscriptionId $SelectedAzureSubscription.SubscriptionId
if ($NewRDSTenant) {
    Write-Host "A new RDS tenant was created with the name $($NewRDSTenant.TenantName)" -ForegroundColor Green
}
else {
    Write-Host "The creation of a new RDS tenant was failed." -ForegroundColor Red
}

OmerMicrosoft

#Get Azure admin credentials
Write-Host "Getting Azure credentials... "
$Credentials = Get-Credential -Message "Enter your Azure admin credentials"
#Add RDS Account in order to be able to change WVD configuration
$BrokerURL = "https://rdbroker.wvd.microsoft.com"
Write-Host "Adding the RDS account... " -NoNewline
Try {
    Add-RdsAccount -DeploymentUrl $BrokerURL -Credential $Credentials -ErrorAction Stop | Out-Null
}
Catch {

OmerMicrosoft

<#Script Summary:
This PowerShell script initialize the setup of Windows Virtual Desktop in Azure.
The script include:
1.Assign the “TenantCreator” role to a user account.
2.Create a Windows Virtual Desktop tenant.
Before running this script, you should allow the Windows Virtual Desktop service to access Azure AD on the following link: https://rdweb.wvd.microsoft.com/
#>

###Install and import Required Modules###
#Install-Module Az,AzureAD,Microsoft.RDInfra.RDPowerShell -AllowClobber -Force #Remove remark if the required modules have not been installed yet.

OmerMicrosoft

Function Create-DNSScavengingRecordsReport
{
    <#The script checks any Dynamic DNS Record and decided whether it’s:
        1)A stale record which responded to ping.
        2)stale record which doesn’t responded to ping.
        3)An updated record (not stale).#>
    $DC = (Get-ADDomainController).Name
    $DNSRoot = (Get-ADDomain).DNSRoot
    $DNSRecords = Get-DnsServerResourceRecord -ComputerName $DC -ZoneName $DNSRoot
    $DateThershold = (Get-Date).AddDays(-14)

OmerMicrosoft

#Find Group Policies with Missing Permissions
Function Get-GPMissingPermissionsGPOs
{
   $MissingPermissionsGPOArray = New-Object System.Collections.ArrayList
   $GPOs = Get-GPO -all
   foreach ($GPO in $GPOs) {
        If ($GPO.User.Enabled) {
            $GPOPermissionForAuthUsers = Get-GPPermission -Guid $GPO.Id -All | select -ExpandProperty Trustee | ? {$_.Name -eq "Authenticated Users"}
            $GPOPermissionForDomainComputers = Get-GPPermission -Guid $GPO.Id -All | select -ExpandProperty Trustee | ? {$_.Name -eq "Domain Computers"}
            If (!$GPOPermissionForAuthUsers -and !$GPOPermissionForDomainComputers) {