SharePoint Automation Gary Lapointe – Founding Partner, Aptillon, Inc.

param(
  [switch]$Connect
)

Write-Host "Script Start Time: $(Get-Date)" -ForegroundColor Green

#Main Farm
. .\FarmCreation\Build-SPFarm.ps1
$farmConfigFile = Resolve-Path .\FarmCreation\FarmConfigurations.xml
try {
    if ($Connect) {
        Join-SPFarm $farmConfigFile
    } else {
        New-SPFarm $farmConfigFile
    }
} catch {
    Write-Warning "Unable to build or join Farm!"
    $_
    return
}

#Web Applications
if (!$Connect) {
    #Only need to do this once so do it when we create the farm initially and not for each connection.
    try {
        . .\WebApplications\Provision-WebApplications.ps1
        Provision-WebApplications (Resolve-Path .\WebApplications\WebApplications.xml)
    } catch {
        Write-Warning "Unable to create web applications!"
        $_
        return
    }
}

#Services
try {
    #State Service
    . .\ServiceApplications\StateServices\Start-StateServices.ps1
    Start-StateServices (Resolve-Path .\ServiceApplications\StateServices\StateServices.xml)

    #Usage Service
    . .\ServiceApplications\UsageService\Start-UsageService.ps1
    Start-UsageService (Resolve-Path .\ServiceApplications\UsageService\UsageService.xml)

    #Secure Store Services
    . .\ServiceApplications\SecureStoreServices\Start-SecureStoreServices.ps1
    Start-SecureStoreServices (Resolve-Path .\ServiceApplications\SecureStoreServices\SecureStoreServices.xml)

    #Web Analytics Services
    . .\ServiceApplications\WebAnalyticsServices\Start-WebAnalyticsServices.ps1
    Start-WebAnalyticsServices (Resolve-Path .\ServiceApplications\WebAnalyticsServices\WebAnalyticsServices.xml)

    #User Code Services
    . .\ServiceApplications\UserCodeServices\Start-UserCodeServices.ps1
    Start-UserCodeServices (Resolve-Path .\ServiceApplications\UserCodeServices\UserCodeServices.xml)

    #BCS Services
    . .\ServiceApplications\BCSServices\Start-BCSServices.ps1
    Start-BCSServices (Resolve-Path .\ServiceApplications\BCSServices\BCSServices.xml)

    #Excel Services
    . .\ServiceApplications\ExcelServices\Start-ExcelServices.ps1
    Start-ExcelServices (Resolve-Path .\ServiceApplications\ExcelServices\ExcelServices.xml)

    #Word Automation Services
    . .\ServiceApplications\WordAutomationServices\Start-WordAutomationServices.ps1
    Start-WordAutomationServices (Resolve-Path .\ServiceApplications\WordAutomationServices\WordAutomationServices.xml)

    #Metadata Services
    . .\ServiceApplications\MetadataServices\Start-MetadataServices.ps1
    Start-MetadataServices (Resolve-Path .\ServiceApplications\MetadataServices\MetadataServices.xml)

    #C2WTS
    . .\ServiceApplications\ClaimsToWindowsTokenServices\Start-ClaimsToWindowsTokenServices.ps1
    Start-ClaimsToWindowsTokenServices (Resolve-Path .\ServiceApplications\ClaimsToWindowsTokenServices\ClaimsToWindowsTokenServices.xml)

    #PowerPoint Services
    . .\ServiceApplications\PowerPointServices\Start-PowerPointServices.ps1
    Start-PowerPointServices (Resolve-Path .\ServiceApplications\PowerPointServices\PowerPointServices.xml)

    #Word Viewing Services
    . .\ServiceApplications\WordViewingServices\Start-WordViewingServices.ps1
    Start-WordViewingServices (Resolve-Path .\ServiceApplications\WordViewingServices\WordViewingServices.xml)
    
    #User Profile Services
    . .\ServiceApplications\UserProfileServices\Start-UserProfileServices.ps1
    Start-UserProfileServices (Resolve-Path .\ServiceApplications\UserProfileServices\UserProfileServices.xml)

    #Enterprise Search Services
    . .\ServiceApplications\EnterpriseSearchServices\Start-EnterpriseSearchServices.ps1
    Start-EnterpriseSearchServices (Resolve-Path .\ServiceApplications\EnterpriseSearchServices\EnterpriseSearchServices.xml)

} catch {
    Write-Warning "Service Application creation failed!"
    $_
    return
}
finally {
    Write-Host "Script End Time: $(Get-Date)" -ForegroundColor Green
}

$servers = @("SP01","SP02","SP04","SP05","SP06")
$cred = Get-Credential "isclondon\spinstall"

foreach ($server in $servers) {
    Write-Host "---------------------------------------------------------------" -ForegroundColor Green
    Write-Host "$(Get-Date): Connecting to server $server." -ForegroundColor Green
    Write-Host "---------------------------------------------------------------" -ForegroundColor Green
    $session = New-PSSession -ComputerName $server -Authentication CredSSP -Credential $cred -ConfigurationName "SharePoint"
    Invoke-Command -Session $session -ScriptBlock {Set-ExecutionPolicy Bypass -Scope Process}
    Invoke-Command -Session $session -ScriptBlock {cd \\sp03\c$\Scripts}
    Invoke-Command -Session $session -ScriptBlock {. .\ConfigureServer.ps1 -Connect}
    Remove-PSSession $session
    Write-Host "$(Get-Date): Finished for server $server" -ForegroundColor Green
}

function Join-SPFarm ([string]$settings = $(throw "-settings is required")) {
    Build-SPFarm $true $settings
}

function New-SPFarm ([string]$settings = $(throw "-settings is required")) {
    Build-SPFarm $false $settings
}

function Build-SPFarm ([bool]$connectToExisting = $false, [string]$settings = $(throw "-settings is required")) {   
    [xml]$config = Get-Content $settings

    if ([string]::IsNullOrEmpty($config.Farm.FarmAccount.AccountPassword)) {
        $farmAcct = Get-Credential $config.Farm.FarmAccount.AccountName
    } else {
        $farmAcct = New-Object System.Management.Automation.PSCredential $config.Farm.FarmAccount.AccountName, (ConvertTo-SecureString $config.Farm.FarmAccount.AccountPassword -AsPlainText -force)
    }

    $configDb = $config.Farm.ConfigDB
    $contentDB = $config.Farm.AdminContentDb
    $server = $config.Farm.DatabaseServer
    if ($config.Farm.Passphrase.Length -gt 0) {
        $passphrase = (ConvertTo-SecureString $config.Farm.Passphrase -AsPlainText -force)
    } else {
        Write-Warning "Using the Farm Admin's password for a passphrase"
        $passphrase = $farmAcct.Password
    }
    
    #Only build the farm if we don't currently have a farm created
    if ([Microsoft.SharePoint.Administration.SPFarm]::Local -eq $null) {
        psconfig -cmd upgrade -inplace b2b
        
        if ($connectToExisting) {
            #Connecting to farm
            Write-Host "Connecting to Farm..."
            Connect-SPConfigurationDatabase -DatabaseName $configDb -DatabaseServer $server -Passphrase $passphrase
        } else {
            #Creating new farm
            Write-Host "Creating Farm..."
            New-SPConfigurationDatabase `
                -DatabaseName $configDb `
                -DatabaseServer $server `
                -AdministrationContentDatabaseName $contentDB `
                -Passphrase $passphrase `
                -FarmCredentials $farmAcct
            
            if (![string]::IsNullOrEmpty($config.Farm.ConfigDBFailoverDatabaseServer)) {
                Set-FailoverDatabase $configDb $config.Farm.ConfigDBFailoverDatabaseServer
            }
            if (![string]::IsNullOrEmpty($config.Farm.AdminContentDBFailoverDatabaseServer)) {
                Set-FailoverDatabase $contentDB $config.Farm.AdminContentDBFailoverDatabaseServer
            }
        }
        #Verifying farm creation
        $spfarm = Get-SPFarm -ErrorAction SilentlyContinue
        if ($spfarm -eq $null) {
            throw "Unable to verify farm creation."
        }

        #ACLing SharePoint Resources
        Write-Host "Calling Initialize-SPResourceSecurity..."
        Initialize-SPResourceSecurity

        #Installing Services
        Write-Host "Calling Install-SPService..."
        Install-SPService

        #Installing Features
        Write-Host "Calling Install-SPFeature..."
        Install-SPFeature -AllExistingFeatures
        
        Remove-PsSnapin Microsoft.SharePoint.PowerShell
        Add-PsSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
    } else {
        Write-Warning "Farm exists. Skipping creation."
    }
    
    if ((Get-Service sptimerv4).Status -ne "Running") {
        Write-Host "Starting SPTimerV4 Service"
        Start-Service sptimerv4
    }

    $scaConfig = $config.Farm.CentralAdmin
    $installSCA = (($scaConfig.Servers.Server | where {$_.Name -eq $env:computername}) -ne $null)
    if ($installSCA) {
        $auth = $scaConfig.AuthProvider
        $port = $scaConfig.Port
        $url = "http://$($env:computername):$port"
        $sca = [Microsoft.SharePoint.Administration.SPWebApplication]::Lookup($url)
        if ($installSCA -and $sca -eq $null) {
            #Provisioning Central Administration
            Write-Host "Creating Central Admin Site at $url..."
            New-SPCentralAdministration -Port $port -WindowsAuthProvider $auth

            #Installing Help
            Write-Host "Calling Install-SPHelpCollection..."
            Install-SPHelpCollection -All

            #Installing Application Content
            Write-Host "Calling Install-SPApplicationContent..."
            Install-SPApplicationContent
        }
    }
    
    if (!$connectToExisting) {
        $server = $config.Farm.OutgoingEmailServer
        $from = $config.Farm.OutgoingEmailFromAddr
        $replyTo = $config.Farm.OutgoingEmailReplyToAddr
        $charSet = 65001
        $wa = [Microsoft.SharePoint.Administration.SPAdministrationWebApplication]::Local
        if ($wa -ne $null) {
            $wa.UpdateMailSettings($server, $from, $replyTo, $charSet)
        }
    }
    
    #Stop or Start key service instances
    $startWebAppSvc = (($config.Farm.Services.WebApplicationService.Servers.Server | where {$_.Name -eq $env:computername}) -ne $null)
    Set-ServiceInstanceState "Microsoft SharePoint Foundation Web Application" $startWebAppSvc

    $startWorkflowSvc = (($config.Farm.Services.WorkflowTimerService.Servers.Server | where {$_.Name -eq $env:computername}) -ne $null)
    Set-ServiceInstanceState "Microsoft SharePoint Foundation Workflow Timer Service" $startWorkflowSvc

    $startIncomingEmailSvc = (($config.Farm.Services.IncomingEmailService.Servers.Server | where {$_.Name -eq $env:computername}) -ne $null)
    Set-ServiceInstanceState "Microsoft SharePoint Foundation Incoming E-Mail" $startIncomingEmailSvc
    
    
    #Set SPTraceV4 to run as domain account
    $accountNode = $config.Farm.Services.TraceService.Account
    if ($accountNode -ne $null -and ![string]::IsNullOrEmpty($accountNode.AccountName)) {
        if ([string]::IsNullOrEmpty($accountNode.AccountPassword)) {
            $svcAccount = Get-Credential $accountNode.AccountName
        } else {
            $svcAccount = New-Object System.Management.Automation.PSCredential $accountNode.AccountName, (ConvertTo-SecureString $accountNode.AccountPassword -AsPlainText -force)
        }
        $user = Get-SPManagedAccount -Identity $svcAccount.Username -ErrorAction SilentlyContinue
        if ($user -eq $null) {
            $user = New-SPManagedAccount -Credential $svcAccount
        }
        $tracingSvc = (Get-SPFarm).Services | ? {$_.Name -eq "SPTraceV4"}
        if ($tracingSvc.ProcessIdentity.Username -ne $user.Username) {
            $tracingSvc.ProcessIdentity.ManagedAccount = $user
            $tracingSvc.ProcessIdentity.CurrentIdentityType = "SpecificUser"
            $tracingSvc.ProcessIdentity.Update()
            $tracingSvc.ProcessIdentity.Deploy()
        }
        Write-Host "Adding `"$($user.Username)`" to Performance Log Users group..."
        $p = Start-Process -PassThru -FilePath "c:\windows\system32\net.exe" -ArgumentList "localgroup `"Performance Log Users`" `"$($user.Username)`" /add" -Wait -NoNewWindow
        if ($p.ExitCode -ne 0) { 
            Write-Warning "Unable to add `"$($user.Username)`" to Performance Log Users group!" 
        } else { 
            Restart-Service SPTraceV4
            iisreset
        }
    }

} 
function Set-ServiceInstanceState($typeName, $enable) {
    $svc = Get-SPServiceInstance -Server $env:computername | where {$_.TypeName -eq $typeName}
    if ($svc -eq $null) {
        throw "Unable to retrieve $typeName Service Instance."
    }
    if ($svc.Status -ne "Online" -and $enable) {
        Write-Host "Starting $typeName service instance..."
        $svc | Start-SPServiceInstance
    }
    if ($svc.Status -eq "Online" -and !$enable) {
        Write-Host "Stopping $typeName service instance..."
        $svc | Stop-SPServiceInstance -Confirm:$false
    }
}

function Set-FailoverDatabase($databaseName, [string]$failoverDbServer) {
    if (![string]::IsNullOrEmpty($failoverDbServer)) {
        $db = Get-SPDatabase | where {$_.Name -eq $databaseName}
        if ($db -eq $null) { 
            throw "Unable to retrieve the database to set the failover server: $databaseName" 
        }
        if (($db.FailoverServiceInstance -eq $null) -or ![string]::Equals($db.FailoverServiceInstance.NormalizedDataSource, $failoverDbServer, [StringComparison]::OrdinalIgnoreCase)) {
            try {
                Write-Host "Adding failover database instance..."
                $db.AddFailoverServiceInstance($failoverDbServer)
                $db.Update()
            } catch {
                Write-Warning "Unable to set failover database server. $_"
            }
        }
    }
}

<Farm>
  <WebApplications>
    <WebApplication Name="SharePoint MySites" HostHeader="my.isclondon.local" Port="80" DefaultTimeZone="2" Path="c:\sharepoint\webs\mysites" Ssl="false" LoadBalancedUrl="http://my.isclondon.local" AllowAnonymous="false" SelfServiceSiteCreation="true" RequireContactForSsc="false" AuthenticationMode="Classic" EnableWindowsAuthentication="false" AuthenticationMethod="NTLM" EnableBasicAuthentication="false" EnableFormsBasedAuthentication="false">
      <ApplicationPool Name="SharePoint Collab" AccountName="isclondon\SPCollab" AccountPassword="password" />
      <PortalSuperUserAccount AccountName="isclondon\spcacheuser" AccountPassword="password" />
      <PortalSuperReaderAccount AccountName="isclondon\spcachereader" AccountPassword="password" />
      <ManagedPaths>
        <ManagedPath Explicit="false" RelativeURL="/personal" />
      </ManagedPaths>
      <UserPolicies>
        <UserPolicy UserLogin="isclondon\SPInstall" UserDisplayName="SharePoint Administrator" Zone="All">
          <Permission Name="Full Control" />
        </UserPolicy>
      </UserPolicies>
      <ProxyGroup Name="Default" />
      <SPDesigner AllowDesigner="true" AllowRevertFromTemplate="true" AllowMasterPageEditing="true" ShowURLStructure="true" />
      <ContentDatabases>
        <ContentDatabase Default="true" Server="ISCSharePoint1" FailoverDatabaseServer="" Name="ISC_Content_MySites" MaxSiteCount="15000" WarningSiteCount="9000">
          <SiteCollections>
            <SiteCollection Name="My Sites" Description="My Sites Host Site Collection" Url="http://my.isclondon.local" Template="SPSMSITEHOST#0" LCID="1033" OwnerLogin="isclondon\administrator" OwnerEmail="administrator@isclondon.com">
            </SiteCollection>
          </SiteCollections>
        </ContentDatabase>
      </ContentDatabases>
    </WebApplication>
    <WebApplication Name="SharePoint Team Sites" HostHeader="team.isclondon.local" Port="80" DefaultTimeZone="2" Path="c:\sharepoint\webs\teams" Ssl="false" LoadBalancedUrl="http://team.isclondon.local" AllowAnonymous="false" SelfServiceSiteCreation="false" RequireContactForSsc="false" AuthenticationMode="Classic" EnableWindowsAuthentication="false" AuthenticationMethod="NTLM" EnableBasicAuthentication="false" EnableFormsBasedAuthentication="false">
      <ApplicationPool Name="SharePoint Collab" AccountName="isclondon\SPCollab" AccountPassword="password" />
      <PortalSuperUserAccount AccountName="isclondon\spcacheuser" AccountPassword="password" />
      <PortalSuperReaderAccount AccountName="isclondon\spcachereader" AccountPassword="password" />
      <ManagedPaths>
      </ManagedPaths>
      <UserPolicies>
        <UserPolicy UserLogin="isclondon\SPInstall" UserDisplayName="SharePoint Administrator" Zone="All">
          <Permission Name="Full Control" />
        </UserPolicy>
      </UserPolicies>
      <ProxyGroup Name="Default" />
      <SPDesigner AllowDesigner="true" AllowRevertFromTemplate="false" AllowMasterPageEditing="true" ShowURLStructure="true" />
      <ContentDatabases>
        <ContentDatabase Default="true" Server="ISCSharePoint1" FailoverDatabaseServer="" Name="ISC_Content_TeamSites" MaxSiteCount="15000" WarningSiteCount="9000">
          <SiteCollections>
            <SiteCollection Name="Team Sites" Url="http://team.isclondon.local" Template="CMSPUBLISHING#0" LCID="1033" OwnerLogin="isclondon\administrator" OwnerEmail="administrator@isclondon.com">
            </SiteCollection>
          </SiteCollections>
        </ContentDatabase>
      </ContentDatabases>
      <Features />
    </WebApplication>
    <WebApplication Name="SharePoint Intranet" HostHeader="intranet.isclondon.local" Port="80" DefaultTimeZone="2" Path="c:\sharepoint\webs\intranet" Ssl="false" LoadBalancedUrl="http://intranet.isclondon.local" AllowAnonymous="false" SelfServiceSiteCreation="false" RequireContactForSsc="false" AuthenticationMode="Claims" EnableWindowsAuthentication="true" AuthenticationMethod="NTLM" EnableBasicAuthentication="false" EnableFormsBasedAuthentication="false">
      <ApplicationPool Name="SharePoint Content" AccountName="isclondon\SPContent" AccountPassword="password" />
      <PortalSuperUserAccount AccountName="isclondon\spcacheuser" AccountPassword="password" />
      <PortalSuperReaderAccount AccountName="isclondon\spcachereader" AccountPassword="password" />
      <ManagedPaths>
        <ManagedPath Explicit="true" RelativeURL="/CTHub" />
      </ManagedPaths>
      <UserPolicies>
        <UserPolicy UserLogin="isclondon\SPInstall" UserDisplayName="SharePoint Administrator" Zone="All">
          <Permission Name="Full Control" />
        </UserPolicy>
      </UserPolicies>
      <ProxyGroup Name="Default" />
      <SPDesigner AllowDesigner="true" AllowRevertFromTemplate="false" AllowMasterPageEditing="true" ShowURLStructure="true" />
      <ContentDatabases>
        <ContentDatabase Default="true" Server="ISCSharePoint1" FailoverDatabaseServer="" Name="ISC_Content_Intranet" MaxSiteCount="15000" WarningSiteCount="9000">
          <SiteCollections>
            <SiteCollection Name="Intranet" Url="http://intranet.isclondon.local" Template="STS#0" LCID="1033" OwnerLogin="isclondon\administrator" OwnerEmail="administrator@isclondon.com">
            </SiteCollection>
            <SiteCollection Name="Content Type Hub" Url="http://intranet.isclondon.local/CTHub" Template="STS#1" LCID="1033" OwnerLogin="isclondon\administrator" OwnerEmail="administrator@isclondon.com">
            </SiteCollection>
          </SiteCollections>
        </ContentDatabase>
      </ContentDatabases>
      <Features />
    </WebApplication>    
  </WebApplications>
</Farm>

function Provision-WebApplications() {
    <#
    .Synopsis
        Creates the web applications.
    .Description
        Creates the web applications.
    .Example
        PS C:\> . .\Provision-WebApplications.ps1
        PS C:\> Provision-WebApplication -SettingsFile c:\WebApplications.xml
    .Example
        PS C:\> . .\Provision-WebApplications.ps1
        PS C:\> Provision-WebApplications -ConfigXml ([xml](Get-Content c:\farmconfiguration.xml))
    .Parameter SettingsFile
        The path to an XML file.
    #>
    [CmdletBinding(DefaultParameterSetName="FilePath")]
    param (
        [Parameter(Mandatory=$true, Position=0, ParameterSetName="XmlElement")]
        [ValidateNotNull()]
        [System.Xml.XmlElement]$ConfigElement,

        [Parameter(Mandatory=$true, Position=0, ParameterSetName="XmlDocument")]
        [ValidateNotNull()]
        [xml]$ConfigXml,

        [Parameter(Mandatory=$true, Position=0, ParameterSetName="FilePath")]
        [ValidateNotNullOrEmpty()]
        [string]$SettingsFile
    )
    switch ($PsCmdlet.ParameterSetName) { 
        "XmlDocument" { 
            if ($ConfigXml.Farm.WebApplications.WebApplication -ne $null) {
                foreach ($appConfig in $ConfigXml.Farm.WebApplications.WebApplication) {
                    Provision-WebApplications -ConfigElement $appConfig
                }
                return
            }
        }
        "FilePath" {
            Provision-WebApplications -ConfigXml ([xml](Get-Content $SettingsFile))
            return
        }
    }
    $config = $ConfigElement

    if ($config -eq $null) {
        Write-Warning "No web application defined. Skipping."
        return
    }

    
    $webApp = Get-SPWebApplication -Identity $config.Name -ErrorAction SilentlyContinue
    
    if ($webApp -eq $null) {
        $allowAnon = [bool]::Parse($config.AllowAnonymous.ToString())
        $ssl = [bool]::Parse($config.Ssl.ToString())

        $db = $null
        if ($config.ContentDatabases -eq $null) {
            throw "A content database configuration setting could not be found for `"$($config.Name)`"."
        }
        if ($config.ContentDatabases.ChildNodes.Count -gt 1) {
            $db = $config.ContentDatabases.ContentDatabase | where {$_.Default -eq "true"}
            if ($db -is [array]) {
                Write-Warning "Multiple content databases set as default for `"$($config.Name)`" (using first)"
                $db = $db[0]
            }
        } else {
            $db = $config.ContentDatabases.ContentDatabase
        }
        if ($db -eq $null) {
            throw "A content database configuration setting could not be found for `"$($config.Name)`"."
        }
        
        $poolName = $config.ApplicationPool.Name
        $poolAcctName = $config.ApplicationPool.AccountName
        $poolAcctPwd = $config.ApplicationPool.AccountPassword
        $poolAcct = $null
        
        #Check for existing Application Pool
        $pools = [Microsoft.SharePoint.Administration.SPWebService]::ContentService.ApplicationPools
        if (($pools | ? {$_.Name -eq $poolName}) -eq $null) {
            $poolAcct = Get-SPManagedAccount $poolAcctName -ErrorAction SilentlyContinue
            if ($poolAcct -eq $null) {
                $securePwd = ConvertTo-SecureString $poolAcctPwd -AsPlainText -force
                $cred = New-Object System.Management.Automation.PSCredential $poolAcctName, $securePwd
                $poolAcct = New-SPManagedAccount -Credential $cred
            }
        }
        
        $loadBalancedUrl = $config.LoadBalancedUrl
        $port = $config.Port
        if (![string]::IsNullOrEmpty($loadBalancedUrl)) {
            $loadBalancedUri = New-Object System.Uri $config.LoadBalancedUrl
            $port = $loadBalancedUri.Port
            $loadBalancedUrl = "$($loadBalancedUri.Scheme)://$($loadBalancedUri.Host)/"
        } else {
            if (![string]::IsNullOrEmpty($config.HostHeader)) {
                $loadBalancedUrl = "http://$($config.HostHeader)"
            }
        }
        if ([string]::IsNullOrEmpty($port)) { $port = "80" }

        if ($config.AuthenticationMode -eq "Claims") {
            $authProviders = @()
            $enableWindowsAuthentication = $false
            if (![string]::IsNullOrEmpty($config.EnableWindowsAuthentication)) { $enableWindowsAuthentication = [bool]::Parse($config.EnableWindowsAuthentication) }
            $enableFormsBasedAuthentication = $false
            if (![string]::IsNullOrEmpty($config.EnableFormsBasedAuthentication)) { $enableFormsBasedAuthentication = [bool]::Parse($config.EnableFormsBasedAuthentication) }

            if ($enableWindowsAuthentication) {
                $enableBasicAuthentication = $false
                if (![string]::IsNullOrEmpty($config.EnableBasicAuthentication)) { $enableBasicAuthentication = [bool]::Parse($config.EnableBasicAuthentication) }
                $disableKerberos = $config.AuthenticationMethod -eq "NTLM"
                $authProviders += New-SPAuthenticationProvider `
                    -UseWindowsIntegratedAuthentication:$enableWindowsAuthentication `
                    -DisableKerberos:$disableKerberos `
                    -UseBasicAuthentication:$enableBasicAuthentication `
                    -AllowAnonymous:$allowAnon
            }
            if ($enableFormsBasedAuthentication) {
                $authProviders += New-SPAuthenticationProvider `
                    -ASPNETMembershipProvider $config.ASPNETMembershipProviderName `
                    -ASPNETRoleProviderName $config.ASPNETRoleManagerName 
            }
            Write-Host "Creating Web Application: `"$($config.Name)`""
            $webApp = New-SPWebApplication -SecureSocketsLayer:$ssl `
                -AllowAnonymousAccess:$allowAnon `
                -ApplicationPool $poolName `
                -ApplicationPoolAccount $poolAcct `
                -Name $config.Name `
                -AuthenticationProvider $authProviders `
                -DatabaseServer $db.Server `
                -DatabaseName $db.Name `
                -HostHeader $config.HostHeader `
                -Path $config.Path `
                -Port $port `
                -Url $loadBalancedUrl
        } else {
            $authMethod = "NTLM"
            if (![string]::IsNullOrEmpty($config.AuthenticationMethod)) { $authMethod = $config.AuthenticationMethod }

            Write-Host "Creating Web Application: `"$($config.Name)`""
            $webApp = New-SPWebApplication -SecureSocketsLayer:$ssl `
                -AllowAnonymousAccess:$allowAnon `
                -ApplicationPool $poolName `
                -ApplicationPoolAccount $poolAcct `
                -Name $config.Name `
                -AuthenticationMethod $authMethod `
                -DatabaseServer $db.Server `
                -DatabaseName $db.Name `
                -HostHeader $config.HostHeader `
                -Path $config.Path `
                -Port $port `
                -Url $loadBalancedUrl
        }

        Set-SPWebApplication -Identity $webApp -DefaultTimeZone $config.DefaultTimeZone

        #Re-get the web app to avoid update conflicts
        $webApp = Get-SPWebApplication -Identity  $webApp
        $webApp.SelfServiceSiteCreationEnabled = [bool]::Parse($config.SelfServiceSiteCreation)
        $webApp.RequireContactForSelfServiceSiteCreation = [bool]::Parse($config.RequireContactForSsc)
        if ($config.ProxyGroup -ne $null -and ![string]::IsNullOrEmpty($config.ProxyGroup.Name)) {
            $proxyGroupName = $config.ProxyGroup.Name
            if ($proxyGroupName -ne $null) {
                $webApp.ServiceApplicationProxyGroup = Get-ProxyGroup $proxyGroupName $true
            }
        }
        $webApp.Update()
        Write-Host """$($config.Name)"" successfully created."
    } else {
        #We got the web app so return it and don't attempt to recreate
        Write-Host """$($config.Name)"" already exists, skipping creation."
    }
    $setObjectCacheAccounts = $true
    if (![string]::IsNullOrEmpty($config.PortalSuperUserAccount) -and ![string]::IsNullOrEmpty($config.PortalSuperReaderAccount)) {
        if ($config.PortalSuperUserAccount.AccountName -eq $config.PortalSuperReaderAccount.AccountName) {
            Write-Warning "The Portal Super User Account and Portal Super Reader Account must not be the same account as this will result in a security hole. The accounts will not be set."
            $setObjectCacheAccounts = $false
        }
    }
    $claimsPrefix = ""
    if ($config.AuthenticationMode -eq "Claims") {
        $claimsPrefix = "i:0#.w|"
    }
    if (![string]::IsNullOrEmpty($config.PortalSuperUserAccount.AccountName) -and $setObjectCacheAccounts) {
        $webApp.Properties["portalsuperuseraccount"] = "$claimsPrefix$($config.PortalSuperUserAccount.AccountName)"
        Set-WebAppUserPolicy $webApp "$claimsPrefix$($config.PortalSuperUserAccount.AccountName)" $config.PortalSuperUserAccount.AccountName "Full Control"
    }
    if (![string]::IsNullOrEmpty($config.PortalSuperReaderAccount.AccountName) -and $setObjectCacheAccounts) {
        $webApp.Properties["portalsuperreaderaccount"] = "$claimsPrefix$($config.PortalSuperReaderAccount.AccountName)"
        Set-WebAppUserPolicy $webApp "$claimsPrefix$($config.PortalSuperReaderAccount.AccountName)" $config.PortalSuperReaderAccount.AccountName "Full Read"
    }


    if ($config.UserPolicies) {
        Write-Host "Creating user policies..."
        [bool]$updateRequired = $false
        foreach ($userPolicyConfig in $config.UserPolicies.UserPolicy) {
            if ($userPolicyConfig -eq $null) { continue }

            [string]$zoneName = $userPolicyConfig.Zone
            [Microsoft.SharePoint.Administration.SPPolicyCollection]$policies = $webApp.Policies
            if ($zoneName.ToLower() -ne "all") {
                $policies = $webApp.ZonePolicies($zoneName)
            }
            Write-Host "Adding user policy for: $claimsPrefix$($userPolicyConfig.UserLogin)..."
            [Microsoft.SharePoint.Administration.SPPolicy]$policy = $policies.Add("$claimsPrefix$($userPolicyConfig.UserLogin)", $userPolicyConfig.UserDisplayName)
            foreach ($permConfig in $userPolicyConfig.Permission) {
                [Microsoft.SharePoint.Administration.SPPolicyRole]$policyRole = $webApp.PolicyRoles | where {$_.Name -eq $permConfig.Name}
                if ($policyRole -ne $null) {
                    Write-Host "Adding policy role: $($permConfig.Name)..."
                    $policy.PolicyRoleBindings.Add($policyRole)
                }
            }
            $updateRequired = $true
        }
        if ($updateRequired) {
            $webApp.Update()
        }
    }
    
    
    if ($config.ManagedPaths) {
        Write-Host "Creating managed paths..."
        foreach ($mpConfig in $config.ManagedPaths.ManagedPath) {
            if ($mpConfig -eq $null) { continue }

            $path = Get-SPManagedPath -Identity $mpConfig.RelativeURL `
                -WebApplication $webApp -ErrorAction SilentlyContinue
            if ($path -eq $null) {
                Write-Host "Creating ""$($mpConfig.RelativeURL)""..."
                New-SPManagedPath -RelativeURL $mpConfig.RelativeURL `
                    -Explicit  [bool]::Parse($mpConfig.Explicit)) -WebApplication $webApp
            } else {
                Write-Host "Managed path already exists: ""$($mpConfig.RelativeURL)""."
            }
        }
    }
    
    if ($config.SPDesigner) {
        Write-Host "Configuring SharePoint Designer Settings..."
        sleep 5
        #Get the web app again to avoid an update conflict
        $webApp = Get-SPWebApplication $webApp
        $webApp | Set-SPDesignerSettings `
            -AllowDesigner ([bool]::Parse($config.SPDesigner.AllowDesigner)) `
            -AllowRevertFromTemplate ([bool]::Parse($config.SPDesigner.AllowRevertFromTemplate)) `
            -AllowMasterPageEditing ([bool]::Parse($config.SPDesigner.AllowMasterPageEditing)) `
            -ShowURLStructure ([bool]::Parse($config.SPDesigner.ShowURLStructure))
        $webApp.Update()
    }

    foreach ($dbConfig in $config.ContentDatabases.ContentDatabase) {
        $db = Get-SPContentDatabase $dbConfig.Name -ErrorAction SilentlyContinue
        if ($db -eq $null) { 
            $db = New-SPContentDatabase -Name $dbConfig.Name `
                -WebApplication $webApp `
                -DatabaseServer $dbConfig.Server `
                -MaxSiteCount $dbConfig.MaxSiteCount `
                -WarningSiteCount $dbConfig.WarningSiteCount
        }
        $failoverDbServer = $dbConfig.FailoverDatabaseServer
        if (![string]::IsNullOrEmpty($failoverDbServer)) {
            if (($db.FailoverServiceInstance -eq $null) -or ![string]::Equals($db.FailoverServiceInstance.NormalizedDataSource, $failoverDbServer, [StringComparison]::OrdinalIgnoreCase)) {
                try {
                    Write-Host "Adding failover database instance..."
                    $db.AddFailoverServiceInstance($failoverDbServer)
                    $db.Update()
                } catch {
                    Write-Warning "Unable to set failover database server. $_"
                }
            }
        }
        foreach ($siteConfig in $dbConfig.SiteCollections.SiteCollection) {
            $site = Get-SPSite $siteConfig.Url -ErrorAction SilentlyContinue
            if ($site -ne $null) {
                Write-Host "Site Collection $($siteConfig.Url) already exists. Skipping."
                $site.Dispose()
                continue
            }
            
            $lcid = $siteConfig.LCID
            if ([string]::IsNullOrEmpty($lcid)) { $lcid = [Microsoft.SharePoint.SPRegionalSettings]::GlobalServerLanguage.LCID }

            $optionalParams = @{}
            if (![string]::IsNullOrEmpty($siteConfig.SecondaryLogin)) { 
                $optionalParams += @{"SecondaryOwnerAlias"=$siteConfig.SecondaryLogin} }
            if (![string]::IsNullOrEmpty($siteConfig.SecondaryEmail)) { 
                $optionalParams += @{"SecondaryEmail"=$siteConfig.SecondaryEmail} }
            if (![string]::IsNullOrEmpty($siteConfig.OwnerEmail)) { 
                $optionalParams += @{"OwnerEmail"=$siteConfig.OwnerEmail} }

            Write-Host "Creating Site Collection $($siteConfig.Url)..."
            $site = New-SPSite `
                -Url $siteConfig.Url `
                -Description $siteConfig.Description `
                -Language $lcid `
                -Name $siteConfig.Name `
                -OwnerAlias $siteConfig.OwnerLogin `
                -Template $siteConfig.Template `
                -ContentDatabase $db `
                -ErrorAction Continue @optionalParams

            if ($site -eq $null) { 
                Write-Warning "Site collection was not created!"
            } else {
                Write-Host "Site collection successfully created: $($siteConfig.Url)"
                Write-Host "Setting default associated security groups..."
                sleep 5
                $refreshedSite = $site | Get-SPSite
                $secondaryLogin = $siteConfig.SecondaryLogin
                if (![string]::IsNullOrEmpty($secondaryLogin)) { $secondaryLogin = "$claimsPrefix$secondaryLogin" }
                $refreshedSite.RootWeb.CreateDefaultAssociatedGroups("$claimsPrefix$($siteConfig.OwnerLogin)", $secondaryLogin, $siteConfig.Name)
                $refreshedSite.Dispose()
                $site.Dispose()
            }
        }
    }
}

function Get-ProxyGroup([string]$name, [bool]$createIfMissing = $true) {
    if ($name -eq "Default" -or [string]::IsNullOrEmpty($name)) { return [Microsoft.SharePoint.Administration.SPServiceApplicationProxyGroup]::Default }
    
    $proxyGroup = Get-SPServiceApplicationProxyGroup $name -ErrorAction SilentlyContinue -ErrorVariable err
    if ($err -and !$createIfMissing) { throw $err }
    if ($proxyGroup -eq $null) {
        $proxyGroup = New-SPServiceApplicationProxyGroup -Name $name
    }
    return $proxyGroup
}

function Set-WebAppUserPolicy($webApp, $userName, $userDisplayName, $perm) {
    [Microsoft.SharePoint.Administration.SPPolicyCollection]$policies = $webApp.Policies
    [Microsoft.SharePoint.Administration.SPPolicy]$policy = $policies.Add($userName, $userDisplayName)
    [Microsoft.SharePoint.Administration.SPPolicyRole]$policyRole = $webApp.PolicyRoles | where {$_.Name -eq $perm}
    if ($policyRole -ne $null) {
        $policy.PolicyRoleBindings.Add($policyRole)
    }
    $webApp.Update()
}

$claim = [Microsoft.SharePoint.Administration.Claims.SPClaimProviderManager]::CreateUserClaim("isclondon\spcacheuser", "Windows")
[Microsoft.SharePoint.Administration.Claims.SPClaimProviderManager]::Local.EncodeClaim($claim)

function Start-SecureStoreServices {
    [CmdletBinding()]
    param 
    (  
        [Parameter(Mandatory=$true, Position=0)]
        [ValidateNotNullOrEmpty()]
        [string]$SettingsFile
    )
    
    [xml]$config = Get-Content $settingsFile

    $install = (($config.Farm.Services.SecureStoreServices.Servers.Server | where {$_.Name -eq $env:computername}) -ne $null)
    if (!$install) { 
        Write-Host "Machine not specified in Servers element, service will not be installed on this server."
        return
    }
    
    $svc = Get-SPServiceInstance -Server $env:computername | where {$_.TypeName -eq "Secure Store Service"}
    if ($svc -eq $null) {
        throw "Unable to retrieve Service Instance."
    }
    if ($svc.Status -ne "Online") {
        Write-Host "Starting service instance..."
        $svc | Start-SPServiceInstance
    
        #Make sure the service is online before attempting to add a svc app.
        while ($true) {
            Start-Sleep 2
            $svc = Get-SPServiceInstance -Server $env:computername | where {$_.TypeName -eq "Secure Store Service"}
            if ($svc.Status -eq "Online") { break }
        }
    }


    foreach ($appConfig in $config.Farm.Services.SecureStoreServices.SecureStoreServiceApplications.SecureStoreServiceApplication) {
        $app = Get-SPServiceApplication | where {$_.Name -eq $appConfig.Name}
        $updateKey = $false
        if ($app -eq $null) {
            $poolName = $appConfig.ApplicationPool.Name
            $identity = $appConfig.ApplicationPool.AccountName
            $password = $appConfig.ApplicationPool.AccountPassword
            $pool = Get-ServicePool $poolName $identity $password

            Write-Host "Creating secure store service application..."
            $app = New-SPSecureStoreServiceApplication -Name $appConfig.Name `
                -ApplicationPool $pool `
                -DatabaseServer $appConfig.DatabaseServer `
                -DatabaseName $appConfig.DatabaseName `
                -AuditingEnabled  [bool]::Parse($appConfig.AuditingEnabled)) `
                -AuditLogMaxSize $appConfig.AuditLogMaxSize `
                -FailoverDatabaseServer $appConfig.FailoverDatabaseServer `
                -PartitionMode:([bool]::Parse($appConfig.Partitioned)) `
                -Sharing:([bool]::Parse($appConfig.Sharing))
            $updateKey = $true
        } else {
            Write-Host "Secure store service application already exists, skipping creation."
        }

        $proxy = Get-SPServiceApplicationProxy | where {$_.Name -eq $appConfig.Proxy.Name}
        if ($proxy -eq $null) {
            Write-Host "Creating secure store service application proxy..."
            $proxy = New-SPSecureStoreServiceApplicationProxy `
                -Name $appConfig.Proxy.Name `
                -ServiceApplication $app `
                -DefaultProxyGroup:$false
        } else {
            Write-Host "Secure store service application proxy already exists, skipping creation."
        }
        $proxy | Set-ProxyGroupsMembership $appConfig.Proxy.ProxyGroup

        
        if ($updateKey) {
            Update-SPSecureStoreMasterKey -ServiceApplicationProxy $proxy -Passphrase $appConfig.KeyPassphrase
            while ($true) {
                try {
                    Start-Sleep -Seconds 5
                    Update-SPSecureStoreApplicationServerKey -ServiceApplicationProxy $proxy -Passphrase $appConfig.KeyPassphrase
                    break
                } catch { }
            }
        }
        
    }
}



function Get-ServicePool($poolName, $identity, $password) {
    $pool = Get-SPServiceApplicationPool $poolName -ErrorAction SilentlyContinue
    if ($pool -eq $null) {
        if ($identity -ne $null) {
            $acct = Get-SPManagedAccount $identity -ErrorAction SilentlyContinue
        }
        if ($acct -eq $null) {
            if ([string]::IsNullOrEmpty($password)) {
                $cred = Get-Credential $identity
            } else {
                $cred = New-Object System.Management.Automation.PSCredential $identity, (ConvertTo-SecureString $password -AsPlainText -force)
            }
            $acct = Get-SPManagedAccount $cred.UserName -ErrorAction SilentlyContinue
            if ($acct -eq $null) {
                $acct = New-SPManagedAccount $cred
            }
        }
        Write-Host "Creating application pool..."
        $pool = New-SPServiceApplicationPool  -Name $poolName -Account $acct
    }
    return $pool
}

function Set-ProxyGroupsMembership([System.Xml.XmlElement[]]$groups, [Microsoft.SharePoint.Administration.SPServiceApplicationProxy[]]$InputObject) {
    begin {}
    process {
        if ($_ -eq $null -and $InputObject -ne $null) {
            $InputObject | Set-ProxyGroupsMembership $groups
            return
        }
        $proxy = $_
        
        #Clear any existing proxy group assignments
        Get-SPServiceApplicationProxyGroup | where {$_.Proxies -contains $proxy} | ForEach-Object {
            $proxyGroupName = $_.Name
            if ([string]::IsNullOrEmpty($proxyGroupName)) { $proxyGroupName = "Default" }
            $group = $null
            [bool]$matchFound = $false
            foreach ($g in $groups) {
                $group = $g.Name
                if ($group -eq $proxyGroupName) { 
                    $matchFound = $true
                    break 
                }
            }
            if (!$matchFound) {
                Write-Host "Removing ""$($proxy.DisplayName)"" from ""$proxyGroupName"""
                $_ | Remove-SPServiceApplicationProxyGroupMember -Member $proxy -Confirm:$false -ErrorAction SilentlyContinue
            }
        }
        
        foreach ($g in $groups) {
            $group = $g.Name

            $pg = $null
            if ($group -eq "Default" -or [string]::IsNullOrEmpty($group)) {
                $pg = [Microsoft.SharePoint.Administration.SPServiceApplicationProxyGroup]::Default
            } else {
                $pg = Get-SPServiceApplicationProxyGroup $group -ErrorAction SilentlyContinue -ErrorVariable err
                if ($pg -eq $null) {
                    $pg = New-SPServiceApplicationProxyGroup -Name $name
                }
            }
            
            $pg = $pg | where {$_.Proxies -notcontains $proxy}
            if ($pg -ne $null) { 
                Write-Host "Adding ""$($proxy.DisplayName)"" to ""$($pg.DisplayName)"""
                $pg | Add-SPServiceApplicationProxyGroupMember -Member $proxy 
            }
        }
    }
    end {}
}