Thank You

What will happen to "GoateePFE"?

Career Advice

Continuous Improvement

• GPOs linked to OUs
• OUs where block-inheritance may be turned on
• Situations where no-override is used
• Forensic data about the last time a GPO was linked or updated on an OU

• Unlinked GPOs are included
• Columns are added for easy filtering where User or Computer version do not match
• Output no longer defaults to CSV, so that you can pipe the output wherever you like

Show me some code

.\gPLinkReport.ps1 | Out-GridView
.\gPLinkReport.ps1 | Export-Csv -Path .\GPLinkReport.csv -NoTypeInformation

Problem

Solution

• Take parameters
• Generate a unique OID for the template
• Create the template
• Optionally permission the template with Enroll for specified group(s)
• Optionally add AutoEnroll permission as well
• Optionally publish the template to CA(s)
• Optionally target all operations to a designated DC

• Enterprise AD CS PKI
• Tested on Windows Server 2012 R2 & 2016
• Enterprise Administrator rights
• ActiveDirectory PowerShell Module

• 2 year lifetime
• 2003 lowest compatibility level
• Private key not exportable
• Not stored in AD
• Document Encryption
• No digital signature

Sample Usage

# Create only the template
# Least valuable approach
New-ADCSTemplateForPSEncryption -DisplayName PowerShellCMS

# Full template creation, permissioning, and deployment
New-ADCSTemplateForPSEncryption -DisplayName PSEncryption `
-Server dc1.contoso.com -GroupName G_DSCNodes -AutoEnroll -Publish

# From a client configured via GPO for AD CS autoenrollment:
$Req = @{
    Template          = 'PSEncryption'
    Url               = 'ldap:'
    CertStoreLocation = 'Cert:\LocalMachine\My'
}
Get-Certificate @Req
# Note: If you have the Carbon module installed, it conflicts with Get-Certificate native cmdlet.

$DocEncrCert = (dir Cert:\LocalMachine\My -DocumentEncryptionCert |
 Sort-Object NotBefore)[-1]

Protect-CmsMessage -To $DocEncrCert -Content "Encrypted with my new cert from the new template!"

Get the code

The Problem - “I feel the need. The need for speed.”

The Research

The Approach

The Code

<#
.SYNOPSIS
Faster version of Compare-Object for large data sets with a single value.
.DESCRIPTION
Uses hash tables to improve comparison performance for large data sets.
.PARAMETER ReferenceObject
Specifies an array of objects used as a reference for comparison.
.PARAMETER DifferenceObject
Specifies the objects that are compared to the reference objects.
.PARAMETER IncludeEqual
Indicates that this cmdlet displays characteristics of compared objects that
are equal. By default, only characteristics that differ between the reference
and difference objects are displayed.
.PARAMETER ExcludeDifferent
Indicates that this cmdlet displays only the characteristics of compared
objects that are equal.
.EXAMPLE
Compare-Object2 -ReferenceObject 'a','b','c' -DifferenceObject 'c','d','e' `
    -IncludeEqual -ExcludeDifferent
.EXAMPLE
Compare-Object2 -ReferenceObject (Get-Content .\file1.txt) `
    -DifferenceObject (Get-Content .\file2.txt)
.EXAMPLE
$p1 = Get-Process
notepad
$p2 = Get-Process
Compare-Object2 -ReferenceObject $p1.Id -DifferenceObject $p2.Id
.NOTES
Does not support objects with properties. Expand the single property you want
to compare before passing it in.
Includes optimization to run even faster when -IncludeEqual is omitted.
#>            
function Compare-Object2 {            
param(            
    [psobject[]]            
    $ReferenceObject,            
    [psobject[]]            
    $DifferenceObject,            
    [switch]            
    $IncludeEqual,            
    [switch]            
    $ExcludeDifferent            
)            
            
    # Put the difference array into a hash table,            
    # then destroy the original array variable for memory efficiency.            
    $DifHash = @{}            
    $DifferenceObject | ForEach-Object {$DifHash.Add($_,$null)}            
    Remove-Variable -Name DifferenceObject            
            
    # Put the reference array into a hash table.            
    # Keep the original array for enumeration use.            
    $RefHash = @{}            
    for ($i=0;$i -lt $ReferenceObject.Count;$i++) {            
        $RefHash.Add($ReferenceObject[$i],$null)            
    }            
            
    # This code is ugly but faster.            
    # Do the IF only once per run instead of every iteration of the ForEach.            
    If ($IncludeEqual) {            
        $EqualHash = @{}            
        # You cannot enumerate with ForEach over a hash table while you remove            
        # items from it.            
        # Must use the static array of reference to enumerate the items.            
        ForEach ($Item in $ReferenceObject) {            
            If ($DifHash.ContainsKey($Item)) {            
                $DifHash.Remove($Item)            
                $RefHash.Remove($Item)            
                $EqualHash.Add($Item,$null)            
            }            
        }            
    } Else {            
        ForEach ($Item in $ReferenceObject) {            
            If ($DifHash.ContainsKey($Item)) {            
                $DifHash.Remove($Item)            
                $RefHash.Remove($Item)            
            }            
        }            
    }            
            
    If ($IncludeEqual) {            
        $EqualHash.Keys | Select-Object @{Name='InputObject';Expression={$_}},`
            @{Name='SideIndicator';Expression={'=='}}            
    }            
            
    If (-not $ExcludeDifferent) {            
        $RefHash.Keys | Select-Object @{Name='InputObject';Expression={$_}},`
            @{Name='SideIndicator';Expression={'<='}}            
        $DifHash.Keys | Select-Object @{Name='InputObject';Expression={$_}},`
            @{Name='SideIndicator';Expression={'=>'}}            
    }            
}            

The Results

# Native Compare-Object            
Measure-Command -Expression {            
    Compare-Object -ReferenceObject (Get-Content .\file1.txt) `
        -DifferenceObject (Get-Content .\file2.txt) -IncludeEqual            
} | Select-Object TotalMilliseconds            
            
# Hash table comparison            
Measure-Command -Expression {            
    Compare-Object2 -ReferenceObject (Get-Content .\file1.txt) `
        -DifferenceObject (Get-Content .\file2.txt) -IncludeEqual            
} | Select-Object TotalMilliseconds

• For test lists of 1,000 items, Compare-Object finishes in five seconds while the hash table version finishes in <1 second.
• For test lists of 100,000 items, the hash table finishes in five seconds while Compare-Object had not finished after multiple minutes (so I just killed the task).
• For the customer’s 800,000 items, the hash table finished in 30 minutes, as opposed to 13 hours for Compare-Object. To be fair, the script does other tasks besides this Compare-Object. Regardless that is a 25x performance improvement!

The Moral of the Story

Updated Code

Case #1

Case #2

Case #3

Scripting Secrets

Problem #0: Not using cmdlet parameter filters

# Approach #1
Get-WinEvent -LogName System -ComputerName Server1 |
  Where-Object {$_.InstanceID -eq 1500}

# Approach #2
Get-WinEvent -FilterHashtable @{LogName='System';ID=1500} `
  -MaxEvents 50 -ComputerName Server1

Problem #1: Expensive operations repeated

For Each User
    Query the account from Office 365
    Output the license data of the user

Construct a single query to Office 365 that retrieves all users in scope
Execute the query and store it into a variable
Pipe the variable into the appropriate loop, selection or output cmdlet

For ($i=0; $i -lt $array.count; $i++) {
    If ($array[$i] -eq $entry) {
        "We found $entry after $($i+1) iterations."
        $found = $true
        Break
    }
}

$hashtable.ContainsKey($entry)

Problem #2 & #3: Appending stuff

1. Appending to files
2. Appending to arrays

Appending to files

• Open the file
• Scroll to the end
• Add the content
• Close the file

$sw = New-Object System.IO.StreamWriter "c:\temp\output.txt"
for ($a=1; $a -le 10000; $a++)
{
    $sw.WriteLine($BigString)
}
$sw.Close()

Appending to arrays

# Empty array
$MyReport = @()
ForEach ($Item in $Items) {
    # Fancy script processing here
    # Append to the array
    $MyReport += $Item | Select-Object Property1, Property2, Property3
}
# Output the entire array at once
$MyReport | Export-CSV -Path C:\Temp\myreport.csv

$MyReport = ForEach ($Item in $Items) {
    # Fancy script processing here
    $Item | Select-Object Property1, Property2, Property3
}
# Output the entire array at once
$MyReport | Export-CSV -Path C:\Temp\myreport.csv

Problem #4: Searching text

$a = 'I love PowerShell!'
# View the string methods
$a | Get-Member -MemberType Methods
# Try the string methods
$a.ToLower()
$a.ToLower().Substring(7,10)
$a.Substring(0,$a.IndexOf('P'))

$domainuser = 'contoso\alice'

# String methods
$domain = $domainuser.Substring(0,$domainuser.IndexOf('\'))
$user   = $domainuser.Substring($domainuser.IndexOf('\')+1)

# RegEx
$domainuser -match '(?<domain>.*)\\(?<user>.*)'
$Matches

# Convert-String
'contoso\alice' |
    Convert-String -Example 'domain\user=domain,user' |
    ConvertFrom-Csv -Header 'Domain','User'

How can I tell how long my script runs?

Measure-Command -Expression {
    #
    # Insert body of script here
    #
}

$Start = Get-Date
#
# Insert body of script here
#
$End = Get-Date
# Show the result
New-Timespan -Start $Start -End $End

The One Common Performance Link: Loops

Disclaimer

• Keep learning
• Review (and optimize) all code you find online before implementing it
• Periodically review your most-used scripts in light of your new knowledge

More Tips

These are the events you’re looking for.

• Event 4249 only shows up in ApplyAndMonitor configuration mode to indicate configuration drift. In my testing I could not find an event indicating configuration drift when ApplyAndAutocorrect actually makes a correction to the configuration.
• In the message body of some events you will see PerformRequiredConfigurationChecks. These bit flag values are documented here.
• Event 4252 appears for all kinds of conditions. Differentiate the events by the message body and the Error Category data inside the event.

Scripting to Capture Logs

Invoke-Command -ComputerName server1,server2,server3 -ScriptBlock {            
  Get-WinEvent -LogName 'Microsoft-Windows-DSC/Operational' -MaxEvents 50} |            
  Select-Object PSComputerName,TimeCreated,LevelDisplayName,Id,Message |            
  Out-Gridview

New-Item -ItemType Directory -Path C:\logs -ErrorAction SilentlyContinue            
(Get-WinEvent -ListLog *desired*,*dsc*).LogName |             
Where-Object {$_ -notlike "*admin*"} |             
ForEach-Object {            
    wevtutil export-log /overwrite:true $_ "C:\logs\$($env:COMPUTERNAME)_$($_.Replace('/','-')).evtx"            
}            
'System','Application' | ForEach-Object {            
    wevtutil export-log /overwrite:true $_ "C:\logs\$($env:COMPUTERNAME)_$($_).evtx"            
}            
If ((Get-WindowsFeature DSC-Service).Installed) {            
    Get-ChildItem 'C:\Program Files\WindowsPowerShell\DscService' > C:\logs\DscService.txt            
    Copy-Item -Path 'C:\inetpub\wwwroot\PSDSCPullServer\web.config' -Destination C:\logs            
}            
$PSVersionTable > C:\logs\PSVersionTable.txt            
Compress-Archive -Path C:\logs\*.evtx,C:\logs\*.config,C:\logs\*.txt `
    -DestinationPath "C:\logs\$($env:COMPUTERNAME)_DSC_Logs.zip" -Update

Additional Resources

Comments

tl;dr

• This is a follow up to my previous blog post on Kerberos double hop and PowerShell remoting.
• I have published some helper functions for working with resource-based Kerberos constrained delegation (RB KCD) and PowerShell remoting: Enable-RBKCD, Disable-RBKCD, Get-RBKCD.
• Get the files and slides on my GitHub here.
• RB KCD works with a limited set of commands and functions running under SYSTEM account in the kernel context.
• RB KCD does not support WinRM / PowerShell remoting, because that runs under the NETWORK account.
• For cases where RB KCD does not work you can nest two Invoke-Command statements to make the double hop. See helper function Invoke-DoubleHop.
• You can share these RB KCD articles and scripts with this short link: https://aka.ms/pskdh

The Problem

Classic Kerberos Double Hop

Scenario A: Jump Server

Scenario B: Remote Software Install

Scenario X

Two Solutions, One Module

PS> Import-Module rbkcd.psm1

PS> Get-Command -Module RBKCD

CommandType Name             Version Source
----------- ----             ------- ------
Function    Disable-RBKCD    0.0     RBKCD
Function    Enable-RBKCD     0.0     RBKCD
Function    Get-RBKCD        0.0     RBKCD
Function    Invoke-DoubleHop 0.0     RBKCD

# Both ServerB and ServerC in the same domain.
Enable-RBKCD -ServerB sb.proseware.com -ServerC sc.proseware.com -Credential (Get-Credential)

# ServerB and ServerC in different domains.
Enable-RBKCD -ServerB sb.proseware.com -ServerC ms1.alpineskihouse.com -DomainBCred (Get-Credential) -DomainCCred (Get-Credential)

# See which identities are allowed to delegate to ServerC
Get-RBKCD -ServerC sc.proseware.com -Credential (Get-Credential proseware\adminacct)

# Remove all identities allowed to delegate to ServerC
Disable-RBKCD -ServerC sc.proseware.com -Credential (Get-Credential proseware\adminacct)

# For scenarios that do not work with RB KCD
Invoke-DoubleHop -ServerB sb -ServerC sc -DomainBCred $DomainBCred -Scriptblock {
    dir \\sc\c$
}

Did this work for you?

Practical DSC

Security Features

• Script block logging
• System-wide transcription
• Protected event logging (used together with Windows Event Forwarding)
• and more…

Requirements

• Script block logging
  • HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
    • EnableScriptBlockLogging, 1
    • EnableScriptBlockInvocationLogging, 1
  • It may also be a good idea to increase the log size. The Microsoft-Windows-PowerShell/Operational log is 15MB by default.
• System-wide transcription
  • Create a directory to hold transcripts
    • Set permissions on the directory to prevent tampering. (I chose SDDL for the shortest code here.)
    • Trim the transcript directory contents on an interval to avoid filling the drive (if local).
    • We are going to use a local directory for now. Lee recommends pointing it to a share off-box.
  • HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription
    • EnableTranscripting, 1
    • IncludeInvocationHeader,1
    • OutputDirectory, [Path]
• Protected event logging (can be used together with Windows Event Forwarding)
  • Requires Windows 10 or Windows Server 2016
  • Requires a document encryption certificate
  • HKLM:\Software\Policies\Microsoft\Windows\EventLog\ProtectedEventLogging
    • EnableProtectedEventLogging, 1
    • EncryptionCertificate, [Certificate]

Desired State Configuration

• Script Block Logging
  • Two registry resources set the values.
  • Then for good measure we use a script resource to increase the size of the PowerShell event log.
• Transcription
  • Three registry resources set the values.
  • We need a file resource to create the directory to hold the transcript files.
  • Then two script resources set the permissions on the directory and remove any old files. We probably could have used an external resource to set the directory permissions, but I want to keep this using in-box resources for simplicity. Keeping the transcript directory clean requires that you set the DSC Local Configuration Manager (LCM) to ApplyAndAutocorrect.
  • NOTE: Remove the file and script resources if you send the transcripts to a remote UNC share path.
  • NOTE: If you use a local path, have fun trying to read the transcript files. Also, the trim files script resource will likely generate warnings trying to clear old files.
• Protected Event Logging
  • I’m going to skip this one due to a couple reasons:
  • Right now we do not have a way to request a certificate in a configuration, and then pass that data to another resource in the same configuration. Writing a custom resource for that wouldn’t be practical, because I’m trying to keep this to in-box DSC resources for now.
  • Most customers already have an event collection tool (SIEM). If not, then explore the xWindowsEventForwarding resource module.
• Fit and Finish
  • Notice that the configuration has the following parameters:
  • TranscriptPath – Directory where you want to put the transcript files. Can be local or UNC path.
  • TranscriptDays – How many days of transcripts do you wish to retain?
  • EventLogSizeInMB – Size to set for the PowerShell log to hold the additional content generated.
• BONUS
  • For completeness I threw in a configuration to disable the transcription and logging.
  • I also threw in a couple lines to query the event logs for your new events.

Gotchas

Audit Thy Servers

The Contenders

Group Policy vs. PowerShell DSC

Summary Recommendations

Resources

• Start here: https://microsoft.com/powershell. This page includes links for documentation, WMF download, etc. The documentation includes many code samples for getting started.
• Microsoft Virtual Academy has several good videos for training on DSC.
• Channel 9 also has many good training videos.
• Follow #psdsc on Twitter for all the latest news and blog posts. Connect real-time with people using DSC in the real world.