📐 实验环境统一规划

# 连接到 ESXi 主机
Connect-VIServer -Server "192.168.10.2" -User "root" -Password "your-password"

# 创建 DC01 虚拟机
New-VM -Name "DC01" `
       -ResourcePool "Resources" `
       -Datastore "datastore1" `
       -MemoryGB 8 `
       -NumCpu 4 `
       -DiskGB 240 `
       -NetworkName "VM Network" `
       -GuestId "windowsServer2022Guest"

# 挂载 Windows Server 2022 ISO
Get-VM "DC01" | Get-CDDrive | Set-CDDrive -IsoPath "[datastore1] ISOs\WinServer2022.iso" -Connected $true

# 启动虚拟机
Start-VM "DC01"

iehang.cn (域根)
├── IT信息部 (OU)
│   ├── Users (子OU)
│   ├── Computers (子OU)
│   └── Servers (子OU)
├── 财务部 (OU)
│   ├── Users (子OU)
│   └── Computers (子OU)
├── 人事部 (OU)
│   ├── Users (子OU)
│   └── Computers (子OU)
├── 销售部 (OU)
│   ├── Users (子OU)
│   └── Computers (子OU)
├── 生产部 (OU)
│   ├── Users (子OU)
│   └── Computers (子OU)
└── Servers (OU - 所有服务器计算机账户)
    ├── Domain Controllers (OU)
    └── Member Servers (OU)

###########################################
# 实验环境 OU 与用户创建脚本
# 运行前提：已在 DC01 上安装 AD DS
# 运行身份：IEHANG\Administrator
###########################################

# 导入 ActiveDirectory 模块
Import-Module ActiveDirectory

# 1. 创建顶级 OU（5 个部门）
New-ADOrganizationalUnit -Name "IT信息部" -Path "DC=iehang,DC=cn" -ProtectedFromAccidentalDeletion $false
New-ADOrganizationalUnit -Name "财务部" -Path "DC=iehang,DC=cn" -ProtectedFromAccidentalDeletion $false
New-ADOrganizationalUnit -Name "人事部" -Path "DC=iehang,DC=cn" -ProtectedFromAccidentalDeletion $false
New-ADOrganizationalUnit -Name "销售部" -Path "DC=iehang,DC=cn" -ProtectedFromAccidentalDeletion $false
New-ADOrganizationalUnit -Name "生产部" -Path "DC=iehang,DC=cn" -ProtectedFromAccidentalDeletion $false

# 2. 创建子 OU（每个部门下创建 Users 和 Computers）
foreach ($ou in @("IT信息部","财务部","人事部","销售部","生产部")) {
    New-ADOrganizationalUnit -Name "Users" -Path "OU=$ou,DC=iehang,DC=cn" -ProtectedFromAccidentalDeletion $false
    New-ADOrganizationalUnit -Name "Computers" -Path "OU=$ou,DC=iehang,DC=cn" -ProtectedFromAccidentalDeletion $false
}

# 3. 创建 Servers OU（存放所有服务器计算机账户）
New-ADOrganizationalUnit -Name "Servers" -Path "DC=iehang,DC=cn" -ProtectedFromAccidentalDeletion $false
New-ADOrganizationalUnit -Name "Domain Controllers" -Path "OU=Servers,DC=iehang,DC=cn" -ProtectedFromAccidentalDeletion $false
New-ADOrganizationalUnit -Name "Member Servers" -Path "OU=Servers,DC=iehang,DC=cn" -ProtectedFromAccidentalDeletion $false

# 4. 创建用户（5 个部门各 1 人）
New-ADUser -Name "孔德毅" -GivenName "德毅" -Surname "孔" -SamAccountName "kongdeyi" -UserPrincipalName "kongdeyi@iehang.cn" -Path "OU=Users,OU=IT信息部,DC=iehang,DC=cn" -AccountPassword (ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force) -Enabled $true
New-ADUser -Name "张桂英" -GivenName "桂英" -Surname "张" -SamAccountName "zhangguiying" -UserPrincipalName "zhangguiying@iehang.cn" -Path "OU=Users,OU=财务部,DC=iehang,DC=cn" -AccountPassword (ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force) -Enabled $true
New-ADUser -Name "宋丹" -GivenName "丹" -Surname "宋" -SamAccountName "songdan" -UserPrincipalName "songdan@iehang.cn" -Path "OU=Users,OU=人事部,DC=iehang,DC=cn" -AccountPassword (ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force) -Enabled $true
New-ADUser -Name "张雪" -GivenName "雪" -Surname "张" -SamAccountName "zhangxue" -UserPrincipalName "zhangxue@iehang.cn" -Path "OU=Users,OU=销售部,DC=iehang,DC=cn" -AccountPassword (ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force) -Enabled $true
New-ADUser -Name "石晓杰" -GivenName "晓杰" -Surname "石" -SamAccountName "shixiaojie" -UserPrincipalName "shixiaojie@iehang.cn" -Path "OU=Users,OU=生产部,DC=iehang,DC=cn" -AccountPassword (ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force) -Enabled $true

# 5. 创建全局安全组
New-ADGroup -Name "GG_IT_Admins" -GroupScope "Global" -GroupCategory "Security" -Path "DC=iehang,DC=cn"
New-ADGroup -Name "GG_Finance_Users" -GroupScope "Global" -GroupCategory "Security" -Path "DC=iehang,DC=cn"
New-ADGroup -Name "GG_HR_Users" -GroupScope "Global" -GroupCategory "Security" -Path "DC=iehang,DC=cn"
New-ADGroup -Name "GG_Sales_Users" -GroupScope "Global" -GroupCategory "Security" -Path "DC=iehang,DC=cn"
New-ADGroup -Name "GG_Production_Users" -GroupScope "Global" -GroupCategory "Security" -Path "DC=iehang,DC=cn"

# 6. 将用户添加到对应组
Add-ADGroupMember -Identity "GG_IT_Admins" -Members "kongdeyi"
Add-ADGroupMember -Identity "GG_Finance_Users" -Members "zhangguiying"
Add-ADGroupMember -Identity "GG_HR_Users" -Members "songdan"
Add-ADGroupMember -Identity "GG_Sales_Users" -Members "zhangxue"
Add-ADGroupMember -Identity "GG_Production_Users" -Members "shixiaojie"

# 7. 验证创建结果
Get-ADOrganizationalUnit -Filter "*" | Select-Object Name, DistinguishedName
Get-ADUser -Filter "*" -SearchBase "DC=iehang,DC=cn" | Select-Object Name, SamAccountName
Get-ADGroup -Filter "*" -SearchBase "DC=iehang,DC=cn" | Select-Object Name, GroupScope

# 8. 将服务器计算机账户移入 Servers OU
Get-ADComputer -Identity "DC01" | Move-ADObject -TargetPath "OU=Domain Controllers,OU=Servers,DC=iehang,DC=cn"
Get-ADComputer -Identity "DC02" | Move-ADObject -TargetPath "OU=Domain Controllers,OU=Servers,DC=iehang,DC=cn"
# WDS01, WSUS01, FS01, RDS01 在加入域后会自动创建计算机账户，之后手动移入 Member Servers OU

Write-Output "✅ OU、用户、组创建完成！"

区域名称: iehang.cn (Active Directory 集成)
  ├── DC01 (A 记录) → 192.168.10.254
  ├── DC02 (A 记录) → 192.168.10.253
  ├── WDS01 (A 记录) → 192.168.10.252
  ├── WSUS01 (A 记录) → 192.168.10.251
  ├── FS01 (A 记录) → 192.168.10.250
  ├── RDS01 (A 记录) → 192.168.10.249
  └── client (DHCP 动态注册)

# 配置静态 IP
New-NetIPAddress -InterfaceAlias "Ethernet0" `
    -IPAddress "192.168.10.254" `
    -PrefixLength 24 `
    -DefaultGateway "192.168.10.1"

# 配置 DNS（指向自身）
Set-DnsClientServerAddress -InterfaceAlias "Ethernet0" `
    -ServerAddresses "127.0.0.1"

# 重命名计算机为 DC01
Rename-Computer -NewName "DC01" -Restart