Server 2019, frische Domäne - Privates Netzwerk nach dem Neustart

@rem This script restarts the service nlasvc (Network Location Awareness Service)
@rem to correct the firewall profile to Domain in case of the station is a domain controller

@rem readout DomainRole
FOR /F "tokens=2 delims==" %%i in ('wmic.exe ComputerSystem get DomainRole /value ^| find /i "DomainRole"') do set DomainRole=%%i  
@rem	Value	DomainRole
@rem	0	Standalone Workstation
@rem	1	Member Workstation
@rem	2	Standalone Server
@rem	3	Member Server
@rem	4	Backup Domain Controller
@rem	5	Primary Domain Controller

rem readout current firewall profile status
FOR /F %%i in ('netsh advfirewall monitor show currentprofile ^| find /i "Profile"') do set FirewallProfile=%%i  

@rem save current script path
set ScriptPath=%~dp0
set Logfile=%ScriptPath%FirewallProfile.log

@rem build date-time string
set mydatetime=%date%_%time%

@rem do the following in case of Backup or Primary Domain Controller
@rem GEQ - greater than or equal
IF /I %DomainRole% GEQ 4 (
	@rem stop an start the nlasvc-Service in case of not Domain
	IF /I  NOT %FirewallProfile%==Domain (
		@rem store date and time in logfile
		echo. >> %Logfile%
		echo %mydatetime% >> %Logfile%
		@rem store current status in logfile
		echo      System is in the firewall profile: %FirewallProfile% >> %Logfile%
		echo      Restart NLA-Service >> %Logfile%
		@rem option /y force stop of dependent services
		net stop /y nlasvc
		net start nlasvc
		@rem wait for 5 seconds
		@rem because there is not wait-command, we use the ping-command to spend some time
		echo      wait 5 seconds >> %Logfile%
		ping 127.0.0.1 -n 6 > nul
		@rem check status again
		FOR /F %%i in ('netsh advfirewall monitor show currentprofile ^| find /i "Profile"') do set FirewallProfile=%%i  
		echo      new firewall profile: %FirewallProfile% >> %Logfile%
	)
)

Allgemein
---------------
Name: correct-firewall-profile-dc
Benutzerkonto: System
Ja, mit höchsten Privilegien ausführen
Konfigurieren für: Windows Server 2019

Trigger
--------
Aufgabe starten: Beim Start
Verzögern für 1 Minute
Wiederholen jede: 5 Minuten für die Dauer von: Unbegrenzt
Aufgabe beenden nach: 1 Minute

Aktionen
------------
Aktion: Programm starten
Skript: correct-firewall-profile-dc.bat

Bedingungen
-----------------
Ja, nur starten, wenn folgende Netzwerkverbindung verfügbar ist: Alle Verbindungen

Einstellungen
---------------
Ja, Aufgabe beenden, falls Ausführung länger als 1 Minute (man kann dort selbst Minute hinschreiben, es steht nicht in der Auswahl)
Ja, Beenden der aktiven Aufgabe erzwingen, falls sie auf Aufforderung nicht beendet wird
Folgende Regel anwenden, falls die Aufgabe bereits ausgeführt wird: Vorhandene Instanz anhalten

@rem This script restarts the service nlasvc (Network Location Awareness Service)
@rem to correct the firewall profile to Domain in case of the station is a domain controller

@rem readout DomainRole
FOR /F "tokens=2 delims==" %%i in ('wmic.exe ComputerSystem get DomainRole /value ^| find /i "DomainRole"') do set DomainRole=%%i  
@rem	Value	DomainRole
@rem	0	Standalone Workstation
@rem	1	Member Workstation
@rem	2	Standalone Server
@rem	3	Member Server
@rem	4	Backup Domain Controller
@rem	5	Primary Domain Controller

rem readout current firewall profile status
FOR /F %%i in ('netsh advfirewall monitor show currentprofile ^| find /i "Profile"') do set FirewallProfile=%%i  

@rem save current script path
set ScriptPath=%~dp0
set Logfile=%ScriptPath%FirewallProfile.log

@rem build date-time string
set mydatetime=%date%_%time%

@rem do the following in case of Backup or Primary Domain Controller
@rem GEQ - greater than or equal
IF /I %DomainRole% GEQ 4 (
   @rem stop an start the nlasvc-Service in case of not Domain
   IF /I  NOT %FirewallProfile%==Domain (
      @rem store date and time in logfile
      echo. >> %Logfile%
      echo %mydatetime% >> %Logfile%
      @rem store current status in logfile
      echo      System is in the firewall profile: %FirewallProfile% >> %Logfile%
      echo      Restart NLA-Service >> %Logfile%
      @rem option /y force stop of dependent services
      net stop NlaSvc /y
      IF errorlevel 1 (
         echo      No Success: net stop NlaSvc  >> %Logfile%
         @rem hard way
         taskkill /f /fi "SERVICES eq NlaSvc"  
         IF errorlevel 1 (
            echo      No Success: taskkill NlaSvc >> %Logfile%
         ) ELSE (
            echo      Success: taskkill NlaSvc >> %Logfile%
         )

      ) ELSE (
         echo      Success: net stop NlaSvc >> %Logfile%
      )
      net start NlaSvc
   )
)