When was the last time you reset the password of the AzureADSSOACC account?
$user = [adsi]"LDAP://CN=AzureADSSOACC,CN=Computers,DC=yourdomain,DC=lan" [PSCustomObject] @{ name = $user.name.Value pwdLastSet = [datetime]::FromFileTime($user.ConvertLargeIntegerToInt64($user.pwdLastSet. value)) }
- run the
following command with the path to the .edb DB file
esentutl /d "C:\Windows\System32\CertLog\IssuingCA.edb"
- at the end
the DB - file is more than
100 MB smaller than before, depending on the size
your database is.
- at this
point you have to enable and start the CA Service again
The Microsoft Enterprise
CA I’m responsible for is running on a Microsoft Windows Server 2008 Enterprise
Server
- with PowerShell 2.0
installed
- no 3rd party PS modules are used
- the certutil.exe is used by the PowerShell (PS) script
- the PS script I created is "Cleanup_MSPKI_Cert_v1.1.ps1" and
contains 3 functions
On this CA Server in the
C:\ root drive I create a folder “_scripts “ (I don’t use PS remoting) and copy
my PowerShell script “Cleanup_MSPKI_Cert_v1.1.ps1” into this folder
Per default
the functions "Remove-ExpiredCertFromDB" writes the temporary files
to a subfolder within C:\_scripts\PKICleanupLog.
You can change this
default folder path with the parameter “CleanedFolderLogPath”
The 3
functions I have implemented are:
A.)
Get-PublishedCATemplate
B.) Get-IssuedCert
C.) Remove-ExpiredCertFromDB
function
Get-PublishedCATemplate{
[CmdletBinding()]
Param (
[parameter()]
[string]$filter
)
$FilterLen = ("msPKI-Cert-Template-OID =").length+3
$AllPublishedTemplates = Invoke-Expression "certutil.exe –catemplates –v |
select-string msPKI-Cert-Template-OID"
$AllPublishedTemplates | foreach{
$tmp= ($_.line).Substring($FilterLen)
$splitarr = $tmp.split(" ",2)
$obj = New-Object
PSObject
Add-Member -Input $obj -Name "name" -MemberType Noteproperty -Value
$Splitarr[1].trim()
Add-Member -Input $obj -Name "oid" -MemberType Noteproperty -Value
$Splitarr[0].trim()
if ($PSBoundParameters["filter"]){
if ($Splitarr[1].trim() -match $filter){
write-output
$obj
}
}
else{
write-output
$obj
}
}
}
I assign the
oid of ONE template (=> change filter that you get only one result) to
the variable WSTemplate
$WSTemplate =
(Get-PublishedCATemplate -filter workstation).oid
With this function
you can list the certificates issued from all templates or a certain
template (specified with it’s oid = $CertTemplate variable) which are
issued beginning at a certain date.
function
Get-IssuedCert{
[CmdletBinding()]
Param (
[ValidatePattern('^([0-9\.\s])+$')]
[string]$CertTemplate,
[ValidatePattern('^\d\d[\./]{1}\d\d[\./]{1}\d\d\d\d$')]
[string]$Date
)
if
($PSBoundParameters["CertTemplate"]){
Invoke-Expression "certutil.exe -view -restrict 'certificate
template=$CertTemplate,disposition=20,notbefore>=$Date' -out
'Request.RequestID,Request.RequesterName,NotBefore,NotAfter,Request.Disposition'"
}
else {
#
displays Certificates issued with any custom template
Invoke-Expression "certutil.exe -view -restrict
'disposition=20,notbefore>=$Date' -out
'Request.RequestID,Request.RequesterName,NotBefore,NotAfter,Request.Disposition'"
}
}
The following example
lists all 29 certificates (from ALL templates) issued from 18 December 2014 and later …. (with this version it’s not
possible to select a time range / only a “start-date”)
Get-IssuedCert
-Date 18.12.2014
The following example lists ONLY the 3 certificates which are
issued with the Template $WSTemplate (OID of “…- Workstation – Authentication
Certificate”) beginning December 18. 2014
$WSTemplate =
(Get-PublishedCATemplate -filter workstation).oid
Get-IssuedCert -CertTemplate $WSTemplate -Date 18.12.2014
This is an advanced
function and all available parameters are displayed with the get-help command
- the expired
certificates to view (1st step) and then delete are in one of 4 folders
- I select
this “folder” with the -state parameter
- the script
creates a log file (also needed for further parsing) in a separate folder
These folders are created automatically if
they don’t exist yet.
In a first step always run the cmdlet without the "-delete" parameter
so nothing is really deleted.
I also recommend the ISE instead of the shell.
And I also always run this cmdlet with the “-verbose” parameter.
The following example
displays all issued (and expired) certificates till 18.12.2014 --- they
are not really deleted yet.
Remove-ExpiredCertFromDB
-State issued -Date 18.12.2014 -Verbose
Without the -delete switch
parameter the log file has "-ViewOnly" in it’s name
Below is the
output from the example above / 396 entries “would be” deleted from the
“issued folder” (or category) if you run the cmdlet with “-delete”
The following
example lists / deletes certificates from a certain (workstation
authentication) template expired up to 18
december 2014
$WSTemplate =
(Get-PublishedCATemplate -filter workstation).oid
Remove-ExpiredCertFromDB -State issued -CertTemplate $WSTemplate -Date
18.12.2014 -Verbose
With the added-delete switch parameter you really delete the entries.
This
step can take some time if there are a lot of entries.
$WSTemplate =
(Get-PublishedCATemplate -filter workstation).oid
Remove-ExpiredCertFromDB -State issued -CertTemplate $WSTemplate -Date
18.12.2014 -Verbose -delete
The output at the end (and the log file)
When you run the same cmdlet again, you see that there aren’t
any entries to delete from the DB
The latest
(full) version of this script with the 3 functions you can download from the
Microsoft Script Gallery: go
to download
Since
TechNet is retired and will be taken offline any time soon a backup can be
downloaded here:
Find your AD group name:
Get-ADGroup -Identity "groupname"
Enable the group for Email:
Enable-DistributionGroup -Identity "groupname" -PrimarySMTPAddress groupname@domain.com
$source = "https://www.7-zip.org/a/7z1900-x64.exe"; $dest = "C:\Temp\7z1900-x64.exe"; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $WebClient = New-Object System.Net.WebClient; $WebProxy = New-Object System.Net.WebProxy("http://proxy:8080",$true); $Credentials = (New-Object Net.NetworkCredential("USERNAME","PASSWORD","domain.com")).GetCredential("http://proxy","80", "KERBEROS"); #$Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials $WebProxy.Credentials = $Credentials; $WebClient.Proxy = $WebProxy; $WebClient.DownloadFile($source,$dest);Alternative Methods:
New-Item -ItemType Directory -Force -Path C:\Temp # Create Temp folder if it doesn't already exist $proxy="http://proxy:8080"; $exclusionList="localhost;*.domain.local;10.*"# Set winhttp proxy for PowerShell
netsh winhttp set proxy $proxy $exclusionList# Prepare PowerShell to Use Default Credentials
[system.net.webrequest]::defaultwebproxy = New-Object system.net.webproxy($proxy) [system.net.webrequest]::defaultwebproxy.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials [system.net.webrequest]::defaultwebproxy.BypassProxyOnLocal = $true [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12# Download using the most efficient method
$url = "https://www.7-zip.org/a/7z1900-x64.exe" $temp = "C:\Temp\7z1900-x64.exe" Import-Module BitsTransfer Start-BitsTransfer -Source $url -Destination $tempOr:
$source = "https://www.7-zip.org/a/7z1900-x64.msi"; $dest = "C:\Temp\7z1900-x64.msi"; $browser = New-Object System.Net.WebClient $browser.Proxy.Credentials =[System.Net.CredentialCache]::DefaultNetworkCredentials; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $browser.DownloadFile($source,$dest);Or:
$source = "https://www.7-zip.org/a/7z1900-x64.msi"; $dest = "C:\Temp\7z1900-x64.msi"; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 (new-object System.Net.WebClient).DownloadFile($source,$dest)Or:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 [Net.WebRequest]::DefaultWebProxy.Credentials = [Net.CredentialCache]::DefaultCredentials; ` iex ((New-Object Net.WebClient).DownloadString('https://www.7-zip.org/a/7z1900-x64.msi'))Or:
$page = (new-object net.webclient) $page.UseDefaultCredentials = $True $Page.DownloadString('https://www.7-zip.org/a/7z1900-x64.msi')
The client and server cannot communicate, because they do not possess a common algorithm
Well the error itself reveals a little bit of info about what it involves, algorithms.
Where are algorithms used? Well secure connections, such as TLS.
If you have TLS 1.2 enabled chances are your application defaults to TLS 1.0 which you probably have disabled just a did for TLS1.1.
Adding an email address to be trusted for whatever reason to your environment depends on what email anti spam/phish/malware/virus solution you have.
But here's one that's always in the way. Outlook.
Here's how to add an email address to the safe senders list in Outlook for all your mailboxes in Exchange Online:
#Add trusted sender and domain per user: Set-MailboxJunkEmailConfiguration firstname.lastname@domain.com -TrustedSendersAndDomains @{Add="@something.com","info@something.com"} #Add Blocked sender and domain per user: Set-MailboxJunkEmailConfiguration firstname.lastname@domain.com -BlockedSendersAndDomains @{Add="@something.com","info@something.com"} #Add emailaddress to the trusted list in all mailboxes: Get-Mailbox -resultsize unlimited | Set-MailboxJunkEmailConfiguration -TrustedSendersAndDomains @{Add="quarantine@messaging.microsoft.com"} #Add a domain and an email address to the trusted list in all mailboxes: Get-Mailbox -resultsize unlimited | Set-MailboxJunkEmailConfiguration -BlockedSendersAndDomains @{Add="domain1.com", "user@domain2.com"}
<# .SYNOPSIS Install Office365 PowerShell Prerequisites .DESCRIPTION Downloads and installs the AzureAD, Sharepoint Online, Skype Online for Windows PowerShell etc. .Made by Edwin van Brenk .Date 01-11-2020 .Source https://vanbrenk.blogspot.com/2018/03/install-office365-requirements-with.html #> <# Function InstallSharepointOnlinePowerShellModule() { $SharepointOnlinePowerShellModuleSourceURL = "https://download.microsoft.com/download/0/2/E/02E7E5BA-2190-44A8-B407-BC73CA0D6B87/SharePointOnlineManagementShell_8525-1200_x64_en-us.msi" $DestinationFolder = "C:\Temp" If (!(Test-Path $DestinationFolder)) { New-Item $DestinationFolder -ItemType Directory -Force } Write-Host "Downloading Sharepoint Online PowerShell Module from $SharepointOnlinePowerShellModuleSourceURL" try { Invoke-WebRequest -Uri $SharepointOnlinePowerShellModuleSourceURL -OutFile "$DestinationFolder\SharePointOnlineManagementShell_7414-1200_x64_en-us.msi" -ErrorAction STOP $msifile = "$DestinationFolder\SharePointOnlineManagementShell_7414-1200_x64_en-us.msi" $arguments = @( "/i" "`"$msiFile`"" "/passive" ) Write-Host "Attempting to install $msifile" $process = Start-Process -FilePath msiexec.exe -Wait -PassThru -ArgumentList $arguments if ($process.ExitCode -eq 0) { Write-Host "$msiFile has been successfully installed" } else { Write-Host "installer exit code $($process.ExitCode) for file $($msifile)" } } catch { Write-Host $_.Exception.Message } } InstallSharepointOnlinePowerShellModule #> # Download and Install Visual Studio C++ 2017 $VisualStudio2017x64URL = "https://download.visualstudio.microsoft.com/download/pr/11687625/2cd2dba5748dc95950a5c42c2d2d78e4/VC_redist.x64.exe" Write-Host "Downloading VisualStudio 2017 C++ from $VisualStudio2017x64" $DestinationFolder = "C:\Temp" Invoke-WebRequest -Uri $VisualStudio2017x64URL -OutFile "$DestinationFolder\VC_redist.x64.exe" -ErrorAction STOP Write-Host "Attempting to install VisualStudio 2017 C++, a reboot is required!" Start-Process "$DestinationFolder\VC_redist.x64.exe" -ArgumentList "/passive /norestart" -Wait Write-Host "Attempting to install VisualStudio 2017 C++" # Download and Install Skype Online PowerShell module $SkypeOnlinePowerShellModuleSourceURL = "https://download.microsoft.com/download/2/0/5/2050B39B-4DA5-48E0-B768-583533B42C3B/SkypeOnlinePowerShell.Exe" $DestinationFolder = "C:\Temp" If (!(Test-Path $DestinationFolder)) { New-Item $DestinationFolder -ItemType Directory -Force } Write-Host "Downloading Skype Online PowerShell Module from $SkypeOnlinePowerShellModuleSourceURL" Invoke-WebRequest -Uri $SkypeOnlinePowerShellModuleSourceURL -OutFile "$DestinationFolder\SkypeOnlinePowerShell.Exe" -ErrorAction STOP Start-Process "$DestinationFolder\SkypeOnlinePowerShell.Exe" -ArgumentList "/quiet" -Wait # Register PSGallery PSprovider and set as Trusted source Register-PSRepository -Name PSGallery -SourceLocation https://www.powershellgallery.com/api/v2/ -PublishLocation https://www.powershellgallery.com/api/v2/package/ -ScriptSourceLocation https://www.powershellgallery.com/api/v2/items/psscript/ -ScriptPublishLocation https://www.powershellgallery.com/api/v2/package/ -InstallationPolicy Trusted -PackageManagementProvider NuGet -ErrorAction SilentlyContinue Register-PSRepository -Default -ErrorAction SilentlyContinue Set-PSRepository -Name psgallery -InstallationPolicy trusted # Install modules from PSGallery Install-Module -Name AADRM -Force Install-Module -Name AzureADPreview -Force Install-Module -Name AzureAD -Force Install-Module -Name MSOnline -Force Install-Module -Name AZ -Force Install-Module -Name MicrosoftTeams -Force Install-Module -Name Microsoft.Graph.Intune -Force Install-Module -Name Microsoft.Online.SharePoint.PowerShell -Force # Manually install Exchange Online with MFA authentication support from the Exchange Online ECP Write-Host "Login, go to Hybrid and download the Exchange Online Powershell module" Start-Process https://outlook.office365.com/ecp/
Get-PackageProvider -Name PSGallery -Force Set-PackageSource -Name PSGallery -Trusted Get-PackageProvider -Name Chocolatey -Force Set-PackageSource -Name Chocolatey -TrustedThis Add on needs some additional modules so we'll install all in one go.
Install-Module IsePackV2 -AllowClobber -Force Install-Module ShowUI -AllowClobber -Force Install-Module RoughDraft -AllowClobber -Force Install-Module Pipeworks -AllowClobber -Force Install-Module EZOut -AllowClobber -Force Install-Module ScriptCop -AllowClobber -Force Import-Module IsePackV2When running the PowerShell ISE as Administrator and running Import-Module IsePackV2 there will be some error. I don't know where it comes from, i'll have to look in to that later.
You don't have sufficient permissions. This operation can only be performed by a manager of the group.
Say what? I'm the Exchange admin.
I don't know why this happens, but there's a way to get around it.
C:\>Set-DistributionGroup -Identity "yourdistributiongroupname" -ManagedBy "username"
You don't have sufficient permissions. This operation can only be performed by a manager of the group.
+ CategoryInfo : NotSpecified: (:) [Set-DistributionGroup], OperationRequiresGroupManagerException
+ FullyQualifiedErrorId : [Server=SR-xxxxx,RequestId=3aed658e-071f-4ddc-abd9-04cf5450b8b8,TimeStamp=18-9-2020 12:2
3:03] [FailureCategory=Cmdlet-OperationRequiresGroupManagerException] 22D1312B,Microsoft.Exchange.Management.Recip
ientTasks.SetDistributionGroup
+ PSComputerName : sr-xxxxx.domain.lan
C:\>Set-DistributionGroup -Identity "yourdistributiongroupname" -ManagedBy 'username' -BypassSecurityGroupManagerCheckNow you can manage the group like the admin that you are.
How old is your Active Directory?