
<# ===============================================================
 14.1c — Część B + C: Delegowanie i Zabezpieczenia (ACL) w PowerShell
 Środowisko: Windows Server 2019 | Active Directory

 Zakres:
  B) Deleguj uprawnienia dla puz1 i puz2 (domyślnie na domenie).
  C) Ustaw ACL dla puz2 na OU=pAbc: Odczyt, Zapis, Tworzenie/Usuwanie obiektów podrzędnych.

 Autor: (Ireneusz.Sobczak)
=============================================================== #>

# =============== Parametry ===============
$DelegateOnDomain   = $true         # true => delegacja na DOMENIE; false => delegacja na OU=pAbc
$UsersForDelegation = @('puz1','puz2')
$AclUserForpAbc     = 'puz2'
$ApplyAclForpAbc    = $true         # ustaw ACL dla puz2 na OU=pAbc
# (opcjonalnie) wymuś DN domeny:
# $DomainDN = 'DC=rol00,DC=edu,DC=pl'
# ========================================

# --- Funkcje logujące (PL) ---
function Write-Info($m){ Write-Host $m -ForegroundColor Cyan }
function Write-Ok($m){ Write-Host $m -ForegroundColor Green }
function Write-Warn($m){ Write-Host $m -ForegroundColor Yellow }
function Write-Err($m){ Write-Host $m -ForegroundColor Red }

# --- Moduł ActiveDirectory + wykrycie DN domeny ---
try {
    Import-Module ActiveDirectory -ErrorAction Stop
    if (-not $DomainDN) { $DomainDN = (Get-ADRootDSE).DefaultNamingContext }
    $Domain  = Get-ADDomain
    $DnsRoot = $Domain.DNSRoot
    Write-Info ("Załadowano AD. Domena: {0} ({1})" -f $DnsRoot, $DomainDN)
} catch {
    Write-Err "Problem z modułem AD albo łącznością: $($_.Exception.Message)"
    throw
}

# --- Ścieżki celów ---
$pAbcOUPath       = "OU=pAbc,$DomainDN"
$DelegationTarget = if ($DelegateOnDomain) { $DomainDN } else { $pAbcOUPath }

# --- Walidacja istnienia obiektów docelowych ---
try {
    # OU pAbc (potrzebna zawsze – do ACL i ewentualnej delegacji na OU)
    $ouAbc = Get-ADOrganizationalUnit -LDAPFilter "(ou=pAbc)" -SearchBase $DomainDN -ErrorAction Stop
    Write-Info ("Sprawdzono: istnieje {0}" -f $ouAbc.DistinguishedName)

    # Użytkownicy
    foreach ($sam in ($UsersForDelegation + $AclUserForpAbc | Select-Object -Unique)) {
        $null = Get-ADUser -Identity $sam -ErrorAction Stop
        Write-Info ("Sprawdzono: istnieje użytkownik {0}" -f $sam)
    }
} catch {
    Write-Err "Brakuje wymaganego obiektu (OU=pAbc / puz1 / puz2). $_"
    throw
}

# --- Pomocnicze: DirectoryEntry i SID ---
function Get-DirEntryByDN {
    param([Parameter(Mandatory)][string]$DN)
    try {
        $de = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$DN")
        $null = $de.RefreshCache()
        return $de
    } catch {
        Write-Err ("Nie można otworzyć LDAP://{0}. {1}" -f $DN, $_.Exception.Message)
        throw
    }
}

function Get-UserSid {
    param([Parameter(Mandatory)][string]$Sam)
    try {
        $u = Get-ADUser -Identity $Sam -Properties SID -ErrorAction Stop
        return (New-Object System.Security.Principal.SecurityIdentifier($u.SID))
    } catch {
        Write-Err ("Użytkownik {0} nie istnieje lub brak SID. {1}" -f $Sam, $_.Exception.Message)
        throw
    }
}

function New-AccessRule {
    param(
        [Parameter(Mandatory)][System.Security.Principal.SecurityIdentifier]$Sid,
        [Parameter(Mandatory)][System.DirectoryServices.ActiveDirectoryRights]$Rights,
        [Parameter(Mandatory)][System.Security.AccessControl.AccessControlType]$AllowOrDeny,
        [System.DirectoryServices.ActiveDirectorySecurityInheritance]$Inheritance = [System.DirectoryServices.ActiveDirectorySecurityInheritance]::All
    )
    New-Object System.DirectoryServices.ActiveDirectoryAccessRule($Sid, $Rights, $AllowOrDeny, $Inheritance)
}

# ==================================================
#  B) Delegowanie uprawnień (na domenie lub na OU=pAbc)
#     (odpowiednik kreatora: Delegate Control)
# ==================================================
try {
    $deDeleg = Get-DirEntryByDN -DN $DelegationTarget
    $sec     = $deDeleg.ObjectSecurity

    Write-Info ("Delegowanie: cel = {0}" -f $DelegationTarget)

    foreach ($sam in $UsersForDelegation) {
        $sid = Get-UserSid -Sam $sam

        # Typowy pakiet praw delegowania (jak w kreatorze):
        # ReadProperty/WriteProperty, CreateChild/DeleteChild, ListChildren,
        # GenericRead/GenericWrite
        $rights = [System.DirectoryServices.ActiveDirectoryRights]::ReadProperty `
                -bor [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty `
                -bor [System.DirectoryServices.ActiveDirectoryRights]::CreateChild `
                -bor [System.DirectoryServices.ActiveDirectoryRights]::DeleteChild `
                -bor [System.DirectoryServices.ActiveDirectoryRights]::ListChildren `
                -bor [System.DirectoryServices.ActiveDirectoryRights]::GenericRead `
                -bor [System.DirectoryServices.ActiveDirectoryRights]::GenericWrite

        $rule = New-AccessRule -Sid $sid -Rights $rights -AllowOrDeny ([System.Security.AccessControl.AccessControlType]::Allow)
        $sec.AddAccessRule($rule)
        Write-Ok ("Dodano delegację dla: {0} (Read/Write, Create/Delete child, ListChildren)" -f $sam)
    }

    $deDeleg.ObjectSecurity = $sec
    $deDeleg.CommitChanges()
    Write-Ok ("Delegacje zapisane na: {0}" -f $DelegationTarget)
} catch {
    Write-Err ("Błąd podczas delegowania. {0}" -f $_.Exception.Message)
    throw
}

# ==================================================
#  C) ACL dla puz2 na OU=pAbc
#     (Odczyt, Zapis, Tworzenie/Usuwanie obiektów podrzędnych)
# ==================================================
if ($ApplyAclForpAbc) {
    try {
        $deAbc  = Get-DirEntryByDN -DN $pAbcOUPath
        $secAbc = $deAbc.ObjectSecurity
        $sid2   = Get-UserSid -Sam $AclUserForpAbc

        Write-Info ("ACL dla {0} na {1}: Odczyt/Zapis/Tworzenie/Usuwanie obiektów podrzędnych" -f $AclUserForpAbc, $pAbcOUPath)

        # Zgodnie z ćwiczeniem / screenem:
        $rightsAbc = [System.DirectoryServices.ActiveDirectoryRights]::ReadProperty `
                    -bor [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty `
                    -bor [System.DirectoryServices.ActiveDirectoryRights]::CreateChild `
                    -bor [System.DirectoryServices.ActiveDirectoryRights]::DeleteChild

        $ruleAbc = New-AccessRule -Sid $sid2 -Rights $rightsAbc -AllowOrDeny ([System.Security.AccessControl.AccessControlType]::Allow)
        $secAbc.AddAccessRule($ruleAbc)

        $deAbc.ObjectSecurity = $secAbc
        $deAbc.CommitChanges()
        Write-Ok ("Zapisano ACL dla {0} na {1}." -f $AclUserForpAbc, $pAbcOUPath)
    } catch {
        Write-Err ("Błąd ustawiania ACL na OU=pAbc. {0}" -f $_.Exception.Message)
        throw
    }
} else {
    Write-Info "Pominięto ustawianie ACL dla OU=pAbc (ApplyAclForpAbc = `$false)."
}

# --- Podsumowanie + szybka weryfikacja ---
Write-Warn "B + C ZAKOŃCZONE"
Write-Ok ("Delegacja: {0}" -f $DelegationTarget)
if ($ApplyAclForpAbc) { Write-Ok ("ACL: {0} -> {1}" -f $AclUserForpAbc, $pAbcOUPath) }

# Weryfikacja (podgląd w konsoli)
try {
    Write-Info ("Wpisy delegacji dla puz1/puz2 na: {0}" -f $DelegationTarget)
    (Get-DirEntryByDN -DN $DelegationTarget).ObjectSecurity.Access |
        Where-Object { $_.IdentityReference -match 'puz1|puz2' } |
        ForEach-Object {
            Write-Host ("  - {0} ({1}) Inheritance={2}" -f $_.ActiveDirectoryRights, $_.AccessControlType, $_.InheritanceType) -ForegroundColor Gray
        }

    if ($ApplyAclForpAbc) {
        Write-Info ("Wpisy ACL dla {0} na: {1}" -f $AclUserForpAbc, $pAbcOUPath)
        (Get-DirEntryByDN -DN $pAbcOUPath).ObjectSecurity.Access |
            Where-Object { $_.IdentityReference -match $AclUserForpAbc } |
            ForEach-Object {
                Write-Host ("  - {0} ({1}) Inheritance={2}" -f $_.ActiveDirectoryRights, $_.AccessControlType, $_.InheritanceType) -ForegroundColor Gray
            }
    }
} catch {
    Write-Warn ("Weryfikacja ACL nie powiodła się: {0}" -f $_.Exception.Message)
}