@{
    Parameters = @{
        DomainLabel = @{
            Type = 'string'
            DefaultValue = ''
            Required = $false
            MinLength = 2
            MaxLength = 32
            Pattern = '^[A-Za-z][A-Za-z0-9_-]*$'
            Metadata = @{
                Description = @{
                    'de-DE' = 'Kurzer logischer Bezeichner der Umgebung oder Domaene.'
                    'en-US' = 'Short logical identifier for the environment or domain.'
                }
            }
        }

        DomainFQDN = @{
            Type = 'string'
            DefaultValue = ''
            Required = $true
            Pattern = '^[A-Za-z0-9.-]+$'
            Metadata = @{
                Description = @{
                    'de-DE' = 'Vollqualifizierter DNS-Name der Active-Directory-Domaene.'
                    'en-US' = 'Fully qualified DNS name of the Active Directory domain.'
                }
            }
        }

        DomainNetBIOS = @{
            Type = 'string'
            DefaultValue = ''
            Required = $true
            MinLength = 1
            MaxLength = 15
            Pattern = '^[A-Za-z0-9_-]+$'
            Metadata = @{
                Description = @{
                    'de-DE' = 'NetBIOS-Name der Active-Directory-Domaene.'
                    'en-US' = 'NetBIOS name of the Active Directory domain.'
                }
            }
        }
    }

    Resources = @{
    NonNodeData = @{
        RequiredModules = @(
            @{
                Name = 'ActiveDirectoryDsc'
                Version = '6.7.1'
            }
        )

        Services = @{
            ActiveDirectory = @{
                Domain = @{
                    Ensure = 'Present'

                    FQDN = "[parameters('DomainFQDN')]"
                    NetBIOS = "[parameters('DomainNetBIOS')]"

                    ForestMode = "[parameters('ForestMode')]"
                    DomainMode = "[parameters('DomainMode')]"

                    DnsDelegation = $false

                    Credentials = @{
                        DomainAdministrator = @{
                            CredentialName = "[parameters('DomainAdministratorCredentialName')]"
                        }

                        SafeModeAdministrator = @{
                            SecretName = "[parameters('SafeModeAdministratorPasswordSecretName')]"
                        }
                    }
                }

                DomainControllers = @(
                    @{
                        NodeName = '*'
                        Ensure = 'Present'
                        InstallDns = $true
                        IsGlobalCatalog = $true
                        SiteName = "[parameters('DefaultSiteName')]"
                    }
                )

                Sites = @(
                    @{
                        Name = "[parameters('DefaultSiteName')]"
                        Ensure = 'Present'
                    }
                )

                Subnets = @(
                    @{
                        Name = "[parameters('DefaultSubnet')]"
                        SiteName = "[parameters('DefaultSiteName')]"
                        Ensure = 'Present'
                    }
                )

                OrganizationalUnits = @(
                    @{
                        Name = 'Servers'
                        Path = "[concat('DC=', replace(parameters('DomainFQDN'), '.', ',DC='))]"
                        Ensure = 'Present'
                        ProtectedFromAccidentalDeletion = $true
                    }

                    @{
                        Name = 'Service Accounts'
                        Path = "[concat('DC=', replace(parameters('DomainFQDN'), '.', ',DC='))]"
                        Ensure = 'Present'
                        ProtectedFromAccidentalDeletion = $true
                    }

                    @{
                        Name = 'Groups'
                        Path = "[concat('DC=', replace(parameters('DomainFQDN'), '.', ',DC='))]"
                        Ensure = 'Present'
                        ProtectedFromAccidentalDeletion = $true
                    }
                )

                Groups = @(
                    @{
                        GroupName = 'GG-SharePoint-Admins'
                        Path = "[concat('OU=Groups,DC=', replace(parameters('DomainFQDN'), '.', ',DC='))]"
                        Scope = 'Global'
                        Category = 'Security'
                        Ensure = 'Present'
                        Members = @()
                    }
                )

                Users = @(
                    @{
                        UserName = 'SVC_SHP_Setup'
                        Path = "[concat('OU=Service Accounts,DC=', replace(parameters('DomainFQDN'), '.', ',DC='))]"
                        Ensure = 'Present'
                        Enabled = $true
                        Password = @{
                            SecretName = 'SVC_SHP_Setup'
                        }
                    }
                )

                Trusts = @()

                Dns = @{
                    Forwarders = @()
                    ReverseLookupZones = @()
                }
            }
        }
    }
}
}