Since the PowerShell profile is a script the Execution policy of your computer must allow scripts to run.  Open an elevated PowerShell window and run the following command to check your execution policy:

Get-ExecutionPolicy

If it says restricted then scripts are prevented from running.  To enable scripts run the following:

Set-ExecutionPolicy Remotesigned or Set-ExecutionPolicy Remotesigned Unrestricted

Now you are ready to configure a PowerShell profile.  At the PowerShell prompt type:

$Profile and press ENTER.

You should see something similar to the following:

C:\Users\muaddib\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Open the Documents folder and confirm there is a “WindowsPowerShel” folder.  If not create it.

Next open Notepad and create the “Microsoft.PowerShell_profile.ps1” profile file.

Now let’s add some content to the profile.  I have a variable that contains my DEV directory where I perform all my PowerShell work.  I also have a couple of aliases such as GH for “GET-HELP and C for CLS.   I also have a few functions I use frequently.  Here is an excerpt from my PowerShell profile.  When I was first learning PowerShell I used the banner shown below to remind me of some of the common commands every time I opened a PowerShell window.  Go ahead and add the content shown below to your profile (“Microsoft.PowerShell_profile.ps1”) for now to demonstrate the use of the profile and save the file,

# ALIAS Definitions
  set-alias -name gh -value get-help
  set-alias -name c -value cls

# FUNCTIONS
  #get detailed help
  Function GHD
   {
     CLS            
     Get-help $args[0] -detailed | more
   } #END GHD Function

#Variables
$DEV = “C:\dev"

#change working folder to DEV folder
CD $DEV

#################################################################################
  # BANNER
  #################################################################################

Write-host -foregroundcolor green "USEFUL COMMANDS"
  Write-host -foregroundcolor yellow "  GET-HELP (Get-HELP ABOUT_*)"
  Write-host -foregroundcolor yellow "  GET-HELP GET-SERVICE –Detailed"
  Write-host -foregroundcolor yellow "  GET-COMMAND"
  Write-host -foregroundcolor yellow "  GET-MODULE –ListAvailable"
  write-host ""

Now open a new PowerShell windows and you should see something similar to the figure below.

Now type GH GET-SERVICE and you should see the help for the GET-SERVICE cmdlets. 

Now type GHD GET-SERVICE to run the GHD function that will display detailed help for the GET-SERVICE cmdlet.  I find this easier than typing GET-HELP <cmdlets name > –detailed when I want detailed help.

So there you have it.  Once you have your profile customized its just a matter of moving the file to another computer so you have access to your common work environment.

Windows 8 will do this for me automatically but I since I’m a control freak I like to control these actions myself.  One important note.  These are LAB MACHINES.  You should never perform a SAVE action on a production VM especially Active Directory domain controllers.

In the past I would open the Hyper-V console, select all the SAVED systems and click “start” and then reverse the process to shut down the lab.  It occurred to last week I could control these actions faster and easier with PowerShell.  I created two functions named START-LAB and STOP-LAB and added them to my PowerShell profile so they are available in every PowerShell session.  Now I just open an elevated PowerShell window and type the name of the appropriate function.  The code for the functions is shown below:

#START-LAB
Function Start-Lab {
if ((get-vm).count -eq 0)
    {Write-host
     Write-host -foregroundcolor RED "        Cannot Start VMs"    
     Write-host -foregroundcolor RED "        PowerShell is not Running with Elevated Credentials"
     Write-Host
     Exit}
  Else
    {Write-Host
         Write-host "        Starting all SAVED VMs...."
         Write-Host
    get-vm |where {$_.state -eq "saved"} | Start-VM
    }
} #END Start-Lab

#STOP-LAB
Function Stop-Lab {
if ((get-vm).count -eq 0)
    {Write-host
      Write-host -foregroundcolor RED "        Cannot Stop VMs"    
     Write-host -foregroundcolor RED "        PowerShell is not Running with Elevated Credentials"
     Write-Host
     Exit}
  Else
    {Write-Host
         Write-host "        Saving all running VMs...."
         Write-Host
    get-vm |where {$_.state -eq "running"} | Save-VM
    }
} #END Stop-Lab

The user userAccountControl flags set various account settings for user/computer accounts in Active Directory.  One flag sets the account to “Password Never Expires” while another flag indicates the “Account is Disabled”.  Multiple flags can be set for an account.  The full list and additional information can be found here.

While many of these settings can searched using the PowerShell Get-ADUser cmdlets others are not readily exposed.  Most of our security tools reference the individual UserAccountControl flag represented as a decimal number (e.g. 65536 indicates password never expires).  When I’m onsite I will usually help them find these accounts by performing a quick PowerShell query. 

This weekend I decided I would build quick easy to use script to help customers find these accounts and dump them to a file.

When you run the script you are presented with a menu asking which flag you want to query for as shown below.  You can query for standard values using the menu or select option 23 and enter a customer decimal value to query for.

Once you make a selection the query is performed and the results are displayed to the screen.

You are then prompted to save your results to a file by selecting Y or N.

So there it is pretty simple script for people who don’t do a lot of scripting.  More experienced scripters can dissect this script and build one more advanced.  As always let me know if you have any comments or found this post useful.

The script code is shown below and there is a download link at the bottom of the page.

##############   BEGIN SCRIPT #########################################

######################################################################
# SCRIPT: GET-UAC.ps1
#PURPOSE: Dump accounts that match UserAccountControl value selected
#          or you can enter customer value
#    DATE: March 29, 2014
#
#        
# REVISON: 1.1
######################################################################

cls

#Import ActiveDirectory Module if not loaded
$Module = Get-Module ActiveDIrectory
If ($Module -eq $Null) {Import-Module ActiveDirectory}

# NOTE - RUN FROM SHELL NOT EDITOR
# Requires -modules ActiveDirectory

#display Options Menu
Write-Host ""
Write-Host -foregroundcolor green "Select the UserAccountControl setting you want to query for:"
Write-Host "1    SCRIPT     (1, 0x0001)"
Write-Host "2    ACCOUNTDISABLE     (2, 0x0002)"
Write-Host "3    HOMEDIR_REQUIRED     (8, 0x0008)"
Write-Host "4    LOCKOUT     (16, 0x0010)"
Write-Host "5    PASSWD_NOTREQD     (32, 0x0020)"
Write-Host "6    PASSWD_CANT_CHANGE     (64, 0x0040)"
Write-Host "7    ENCRYPTED_TEXT_PWD_ALLOWED     (128, 0x0080)"
Write-Host "8    TEMP_DUPLICATE_ACCOUNT     (256, 0x0100)"
Write-Host "9    NORMAL_ACCOUNT     (512, 0x0200)"
Write-Host "10   INTERDOMAIN_TRUST_ACCOUNT     (2048, 0x0800)"
Write-Host "11   WORKSTATION_TRUST_ACCOUNT     (4096, 0x1000)"
Write-Host "12   SERVER_TRUST_ACCOUNT     (8192, 0x2000)"
Write-Host "13   DONT_EXPIRE_PASSWORD     (65536, 0x10000)"
Write-Host "14   MNS_LOGON_ACCOUNT     (131072, 0x20000)"
Write-Host "15   SMARTCARD_REQUIRED     (262144, 0x40000)"
Write-Host "16   TRUSTED_FOR_DELEGATION     (524288, 0x80000)"
Write-Host "17   NOT_DELEGATED     (1048576, 0x100000)"
Write-Host "18   USE_DES_KEY_ONLY     (2097152, 0x200000)"
Write-Host "19   DONT_REQ_PREAUTH     (4194304, 0x400000)"
Write-Host "20   PASSWORD_EXPIRED     (8388608, 0x800000)"
Write-Host "21   TRUSTED_TO_AUTH_FOR_DELEGATION     (16777216, 0x1000000)"
Write-Host "22   PARTIAL_SECRETS_ACCOUNT     (67108864, 0x04000000 )"
Write-Host "23   Custom USerAccountControl value"
Write-host ""
Write-host ""

#PROMPT user for input
[int]$a = Read-Host -prompt "Please Select an Option 1-23"

 
# Make sure number entered is not greater than 23 -Show error message
If ($a -gt 23)  {Write-host -foregroundcolor red "Number must be between 1-23"}

Write-host ""
Write-host ""

[int]$uacValue = 0

switch ($a)
{
1  {[int]$uacvalue = 1}
2  {[int]$uacvalue = 2}
3  {[int]$uacvalue = 8}
4  {[int]$uacvalue = 16}
5  {[int]$uacvalue = 32}
6  {[int]$uacvalue = 64}
7  {[int]$uacvalue = 128}
8  {[int]$uacvalue = 256}
9  {[int]$uacvalue = 512}
10  {[int]$uacvalue = 2048}
11  {[int]$uacvalue = 4096}
12  {[int]$uacvalue = 8192}
13  {[int]$uacvalue = 65536}
14  {[int]$uacvalue = 131072}
15  {[int]$uacvalue = 262144}
16  {[int]$uacvalue = 524288}
17  {[int]$uacvalue = 1048576}
18  {[int]$uacvalue = 2097152}
19  {[int]$uacvalue = 4194304}
20  {[int]$uacvalue = 8388608}
21  {[int]$uacvalue = 16777216}
22  {[int]$uacvalue = 67108864}
23  {$b = Read-Host -prompt "Enter custom UserAccountControl value (e.g. 514) "; [int]$uacvalue = $b}
} 

#WRITE OUTPUT TO SCREEN
# you can customize the properties displayed for each user by adding properties
# to Format-Table command (e.g. name,distinguishedname
$results = Get-ADUser -Filter 'useraccountcontrol -band $uacvalue' -Properties useraccountcontrol | Format-Table name
IF ($results -eq $Null) {Write-Host "No accounts match this criteria";EXIT}
  Else
{$results}

$fileSave = Read-Host -prompt "Do you want to save results to a file? Press Y or N"
IF ($filesave -eq "y") {out-file -filepath .\UAC_VALUE_$uacvalue.TXT -inputobject $results -encoding ASCII;Write-host"";Write-host"";Write-Host -foregroundcolor green "Output Saved to UAC_VALUE_$uacvalue.TXT" }

##############   END SCRIPT #########################################

Reference

How to use the UserAccountControl flags to manipulate user account properties

http://support.microsoft.com/kb/305144

How to Query Individual Properties of the "userAccountControl" Active Directory User property using LDAP

http://blogs.msdn.com/b/muaddib/archive/2008/10/08/query-individual-properties-of-the-useraccountcontrol-active-directory-user-property.aspx

GET-UAC.zip

Service pack
Definition: A tested, cumulative set of all hotfixes, security updates, critical updates, and updates. Additionally, service packs may contain additional fixes for problems that are found internally since the release of the product. Service packs my also contain a limited number of customer-requested design changes or features.

Update rollup
Definition: A tested, cumulative set of hotfixes, security updates, critical updates, and updates that are packaged together for easy deployment. A rollup generally targets a specific area, such as security, or a component of a product, such as Internet Information Services (IIS).

Please keep in mind the lists below may not be exhaustive but were complete as of the time of this writing.  I’ll try to keep this list updated going forward.  You should search TechNet for “<operating system> update rollup” to find the latest update rollup packages.  Another option is to use Microsoft Baseline Security Analyzer (MBSA) or Windows Update to scan for missing updates.

General Availability - Windows 8 September 2012 / Windows Server 2012 October 2012

Windows 8 Client and Windows Server 2012 General Availability Update Rollup   
http://support.microsoft.com/kb/2756872

Windows 8 and Windows Server 2012 update rollup: January 2013   
http://support.microsoft.com/kb/2785094

Windows 8 and Windows Server 2012 update rollup: April 2013   
http://support.microsoft.com/kb/2822241

Windows 8 and Windows Server 2012 update rollup: May 2013   
http://support.microsoft.com/kb/2836988

Windows RT, Windows 8, and Windows Server 2012 update rollup: June 2013   
http://support.microsoft.com/kb/2845533

Windows RT, Windows 8, and Windows Server 2012 update rollup: July 2013   
http://support.microsoft.com/kb/2855336

Windows RT, Windows 8, and Windows Server 2012 update rollup: September 2013   
http://support.microsoft.com/kb/2876415/en-gb

Windows RT, Windows 8, and Windows Server 2012 update rollup: October 2013   
http://support.microsoft.com/kb/2883201

Windows RT, Windows 8, and Windows Server 2012 update rollup: January 2014   
http://support.microsoft.com/kb/2911101

General Availability - Windows 8.1 October 2013 / Windows Server 2012 R2 October 2013

Windows 8.1 and Windows Server 2012 R2 General Availability Update Rollup   
http://support.microsoft.com/kb/2883200

Windows 8.1 and Windows Server 2012 R2 update rollup: October 2013   
http://support.microsoft.com/kb/2884846

Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 update rollup: November 2013   
http://support.microsoft.com/kb/2887595

Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 update rollup: December 2013   
http://support.microsoft.com/kb/2903939

Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 update rollup: January 2014   
http://support.microsoft.com/kb/2911106

The “magic key” is the asterisk (“ * ”) character on the numeric keypad.  If you are working in Active Directory Sites and Services and want to expand ALL the sites just click on the Sites node at the top of MMC and press “ * “ on the numeric keypad and all the sites will expand to the NTDS Settings object.  To collapse the tree just hit the minus key ( “ – “) on numeric keypad.  This also works in Active Directory Users & Computers DNS etc.

The link below contains additional MMC shortcuts.

MMC Navigation Keyboard Shortcuts
http://technet.microsoft.com/en-us/library/cc181576.aspx

For me this is a life-changing improvement in productivity.  How about you?

When the account is removed from a privileged group these two changes are not automatically reversed and must be changed manually.  The inability to inherit permissions will prevent your delegation model from working as expected so we decided to create script to set the AdminCount back to it’s default state and enable inheritance on the user objects.

Finding accounts that were or are members of privileged groups is easy enough.  You can use the Get-ADUser cmdlet to find them as shown below:

Get-ADUser -Filter {AdminCount -eq 1} -properties AdminCount

Changing the AdminCount property on an object back to the default state is easy enough as well:

Set-ADUser <user identity> -Clear AdminCount

Modifying the inheritance flag was a bit more challenging.  First lets describe the behavior of the inheritance flag and where it is located in the GUI.  The Inheritance Flag can be set using Active Directory Users & Computers (ADUCs).  You can see checkbox by viewing the properties for a user, selecting the “Security” tab and then clicking the “Advanced” button and you will see the screen shown below.

Figure 1 – Inheritance flag check box

If you uncheck the box you will receive the following prompt asking you if you want to copy the existing permissions to the object.

Figure 2 – Copy permissions dialog,

Clicking “Add” will add the inherited permissions form the parent object.  Clicking “Remove” will leave the object with the permissions applied explicitly to the object.

We spent a good deal of time trying to find a way to “check” the inheritance box programmatically in PowerShell.  After a few hours we realized we had other work to do and settled on a tried and true method that uses DSACLS command to enable inheritance.  The command is shown below.

DSACLS <User DN>  /P:N

We were now able to script these changes on the desired accounts but I still wanted to find out how to do this using native PowerShell commands…

The Quest…

Before you read any further you need to understand I am NOT a programmer.  I’m a support engineer who likes to automate tasks with scripting languages.  The great thing about PowerShell is it exposes the underlying .NET code and makes it easy for mortals like me to write scripts quickly and easily.  For more advanced scripts I am forced to “look under the hood” understand what is happening at the programming level.  This is where the challenge, and the learning happens for me.  The remainder of the article will explain how I found the solution to my problem.

Most of my research for enabling inheritance on an object with PowerShell showed examples of modifying files and folders instead of users.  The interesting thing is the same PowerShell cmdlets works for files, folders and Active Directory objects.

The good news is Get-Acl and Set-Acl cmdlets can be used to read and set security on Active Directory objects.  The bad news is the process to enable/disable inheritance is not very intuitive at all. 

To get started I created a test account named “ACL Test” and unchecked the inheritance flag.  I then started looking at all properties on the object by running the following command:

Get-ADUSer acltest –properties * |fl *

I noticed there was something called nTSecurityDescriptor that displayed  “System.DirectoryServices.ActiveDirectorySecurity” instead of a normal property value which indicated I was dealing with an object.  I used the following commands to expose more information:

$user = Get-ADUSer acltest –properties * |fl *

$user.nTSecurityDescriptor  |Get-Member

This command showed promise.

Figure 3 – Get-Member output for nTSecurityDescriptor 

At some point during several hours of “Bing-ing” I became aware that the inheritance flag was also referred to an Access Rule.  The first thing I noticed was this:

AreAccessRulesProtected     Property    bool AreAccessRulesProtected {get;}

This property shows the state of the inheritance check flag on the object.  So the command below made it easy to check the status of the flag:

$user.nTSecurityDescriptor.AreAccessRulesProtected 

If the box was checked the command would return FALSE.  If the box was unchecked it would return TRUE.  I was able to verify this by checking and unchecking the box manually and running the code above.

As I started researching the process and testing code it became apparent to me I needed an easier way to determine if my code was making the change successfully.  Frankly refreshing the object in ADUCs, viewing the properties selecting the “Security” tab and then “Advanced” button to view the checkbox for each test cycle was getting old.  To solve this problem I used a PowerShell loop running in a separate window to monitor the change on the test account.  The PowerShell code shown below checks the status of the flag every five seconds and repeats the check !000 times which meant I could work for over 80 minutes before restarting my monitor loop. 

FOR($i=1;$i -le 1000; $i++){(get-aduser acltest -properties nTSecurityDescriptor).nTSecurityDescriptor.AreAccessRulesProtected ;Write-host "Count = $i";start-sleep 5}

The output is shown below.  I displayed the “count” so I could tell the display was updating.  You can see where the state change occurred during my testing.

Figure 4 – Monitoring my progress

Keep in mind when you make a change in Active Directory it does not appear immediately but can take several seconds before the change can be detected.  During my testing a change was usually detected within one or two 5 second cycles.

During my research I kept seeing examples of using Get-Acl and Set-Acl to set inheritance on OUs, files and folders but no examples of performing this task on users.  I’ll spare you the details but I was unable to change the state of the inheritance flags using the methods associated with $user.nTSecurityDescriptor object initially because I did not understand how to "write" the updated security information back to Active Directory.  At this point in my testing and research I switched my focus to using Get-Acl and Set-Acl to solve my problem.

The first thing I did was run Get-Acl on the “ACL Test” user object and store that in a variable.

$ACL = Get-ACL -path 'AD:\CN=ACL Test,OU=Managed Users,DC=Contoso,DC=com'

The $ACL variable is an object that represents the security of the “CN=ACL Test,OU=Managed Users,DC=Contoso,DC=com” user object.  I then ran Get-Member on $ACL to expose the same properties and methods I had seen on the nTSecurityDescriptor object in earlier testing.

$ACL | Get-Member

NOTE- See the ACL_GET_MEMBER.TXT file attached below to see all the properties and methods exposed.

Several properties and methods were exposed but I was focused on two.  The first was the “AreAccessRulesProtected” property which tells me the status of the inheritance checkbox.  The second one is the “SetAccessRuleProtection” method shown below:

SetAccessRuleProtection Method void SetAccessRuleProtection(bool  IsProtected, bool preserveInheritance)

Lets look at this a little closer.  We see that “SetAccessRuleProtection” is a method which means we can take some type of action on the object.  Then we see the word “bool” which is short for Boolean which means the two parameters we are passing; IsProtected and PreserveInheritance will be TRUE or FALSE when passed to the method.  If we call the “SetAccessRuleProtection” method and set the value of the IsProtected parameter to TRUE, the inheritance checkbox will be cleared.  If we set it to FALSE, the checkbox will become checked.  The “preserveInheritance” parameter only has an effect when we uncheck the inheritance checkbox  (IsProtected = TRUE).  If we set preserveInheritance to TRUE then the permissions from the parent object are copied to the object.  It has the same effect as clicking “Add” in figure 2 above.  If “preserverInheritance” is set to FALSE, it has the same effect as clicking “Remove” in Figure 2 above.  Let’s take a look at the code in action.

First we create an object that represents the current security configuration of our user (ACL Test) using Get-Acl and store it in the variable $ACL.  Notice the “AD:\” in front of the distinguished name for the user object.  This let’s Get-Acl command know the object is located on the Active Directory PSDrive (PowerShell Drive).

$ACL = Get-ACL -path 'AD:\CN=ACL Test,OU=Managed Users,DC=Contoso,DC=com'

Next we call the SetAccessRuleProtection method of the $ACL security object and pass $False for the “IsProtected” parameter which will “check” the inheritance checkbox for the user account. We also pass $True for the “preserveInheritance” parameter but it has no effect since we are enabling inheritance.  At this point in time we have modified the security on the $ACL object but we have not modified the object in Active Directory.

$ACL.SetAccessRuleProtection($False,$True)

Finally we use Set-Acl to overwrite the security of the “ACL Test” user account in Active Directory with the value stored in $ACL variable.

Set-ACL -AclObject $ACL -path 'AD:\CN=ACL Test,OU=Managed Users,DC=Contoso,DC=com'

Now that I understood how to write the security changes back to Active Directory using Set-Acl I realized I would be able to perform the same task using the $user.nTSecurityDescriptor path I had started down originally.  Here is the solution using that method:

 $user = get-aduser acltest -properties ntsecuritydescriptor
 $user.ntsecuritydescriptor.SetAccessRuleProtection($false, $true)
 Set-Acl -AclObject $user.ntsecurityDescriptor  -Path "AD:\CN=ACL Test,OU=PS_USERS,DC=AD,DC=CONTOSO,DC=COM"
 

Putting it All Together

Now that we know how to use Get-Acl and Set-Acl to modify the inheritance flag let’s put it in a PowerShell function to make it easier to use in a script:

Function Set-Inheritance {
    param($ObjectPath)
    $ACL = Get-ACL -path "AD:\$ObjectPath"
    If ($acl.AreAccessRulesProtected){
         $ACL.SetAccessRuleProtection($False, $True)
        Set-ACL -AclObject $ACL -path "AD:\$ObjectPath"
        Write-Host "MODIFIED "$ObjectPath
    } #End IF
} #End Function Set-Inheritance

To use the function we call the function and pass the distinguished name of the object we want to enable inheritance on.  Here is a sample script that uses the function:

Import-Module ActiveDirectory

Function Set-Inheritance {
    param($ObjectPath)
    $ACL = Get-ACL -path "AD:\$ObjectPath"
    If ($acl.AreAccessRulesProtected){
         $ACL.SetAccessRuleProtection($False, $True)
        Set-ACL -AclObject $ACL -path "AD:\$ObjectPath"
        Write-Host "MODIFIED "$ObjectPath
    } #End IF
} #End Function Set-Inheritance

#Find user with AdminCount set to 1
$users = get-aduser -SearchBase "OU=Managed Users,DC=Contoso,DC=com" -Filter {AdminCount -eq 1}
#Enable inheritance flag for each user
$users | foreach {Set-Inheritance $_.distinguishedname}

We place the PowerShell function Set-Inheritance at the top of the script so it is loaded into memory before we call the function later in the script.  We search for users with their AdminCount property set to “1” and store them in the $users variable.  Then we loop through each user in the variable $users and pass the distinguished name of each user to the Set-Inheritance function to set the inheritance flag so the object will inherit permissions.

So there you have it.  A long discussion on how I arrived at what amounts to three lines of PowerShell code to perform the same task as “DSACLS <User DN> /P:N”.  As always if you have feedback or questions use the comments section below.

Reference

Regarding AdminSDHolder
http://blogs.technet.com/b/asiasupp/archive/2006/11/16/adminsdholder1.aspx

AdminSDHolder, Protected Groups and SDPROP
http://technet.microsoft.com/en-us/magazine/2009.09.sdadminholder.aspx

Delegated permissions are not available and inheritance is automatically disabled
http://support.microsoft.com/kb/817433

AdminSDHolder Object Affects Delegation of Control for Past Administrator Accounts
http://support.microsoft.com/kb/306398

ACL_GET_MEMBER.txt

After removing the last Windows Server 2003 domain controller we opened up the DNS console to cleanup all the references to the decommissioned server including SRV records and DNS zone name server entries.  Removing the name server entries from the forward lookup zones was easy to do manually since there were only a couple.  When we got to the reverse lookup zones we realized we needed some automation since there were over 20 reverse lookup zones to remove the obsolete name server entries from.

The following commands can be used to Add or Delete Name Server (NS) records from a zone:

Add Record

DNSCMD <DNS server> /RECORDADD <zone name> @ NS <name server FQDN>

Delete Record

DNSCMD <DNS server> /RECORDDELETE <zone name> @ NS <name server FQDN> /F

Notice the “/F” at the end of the delete command.  This suppresses the “Y/N?” prompt

To automate the task we created a script that uses a DOS FOR loop to iterate through the zones in a text file and remove the obsolete name server records.  I added the DNSCMD commands above to my standard FOR loop script template that includes logging.

The first thing we did was create a ZONES.TXT file containing all the reverse lookup zones we needed to modify.  We placed the ZONES.TXT file in the same directory as the script. 

The contents are shown below:

11.10.10.in-addr.arpa
12.10.10.in-addr.arpa
13.10.10.in-addr.arpa
14.10.10.in-addr.arpa
15.10.10.in-addr.arpa
16.10.10.in-addr.arpa

The contents of the UPDATE_NAME_SERVERS.CMD script is shown below:

:::::::::::::::::::::::::: BEGIN SCRIPT ::::::::::::::::::::::::::::::::

@ECHO OFF
  :: NAME:UPDATE_NAME_SERVERS
  :: DATE: 4:56 PM 12/16/2013
  :: PURPOSE: 
  ::
  :: The ZONES.TXT contains a list of zones (one server per line)
  :: to be modified
  
  SET LOGFILENAME=.\UPDATE_NAME_SERVER_OUTPUT.LOG

ECHO     DATE: %DATE% > %LOGFILENAME%
ECHO     TIME: %TIME% >> %LOGFILENAME%
ECHO     USER: %USERNAME% >> %LOGFILENAME%
ECHO COMPUTER: %COMPUTERNAME% >> %LOGFILENAME%
ECHO. >> %LOGFILENAME%
ECHO. >> %LOGFILENAME%
ECHO. >> %LOGFILENAME%

FOR /F "tokens=1" %%i in (zones.txt) DO (
   ECHO Running command on... %%i
   ECHO. >> %LOGFILENAME%
   REM Delete Name Server (NS) records from a zone
   dnscmd vdc02.contoso.com /recorddelete %%i @ NS admin1.contoso.com /f  >> %LOGFILENAME%

  REM USe this section to ADD Name Server (NS) Records
   REM Uncomment the DNSCMD line below to add NS records
   REM ============================================
   REM  dnscmd vdc02.contoso.com /recordadd %%i @ NS admin1.contoso.com >> %LOGFILENAME%
  )

GOTO EOF

:EOF
  ECHO.
  ECHO.
  ECHO  %0 COMPLETED!
  ECHO.
  ECHO.
  ECHO.
  :::::::::::::::::::::::::: END SCRIPT :::::::::::::::::::::::::::::::::::

Remember when using sample scripts always test them in a lab environment first before using them in production.  If you found this useful or have feedback feel free to leave me a comment below.

During almost every ADRAP I perform we get a message from our assessment tool indicating that one or more user accounts have Kerberos preauthentication disabled.  Unfortunately the tool does not tells us which accounts.  Before we discuss finding the accounts lets talk about the impact of disabling Kerberos pre-authentication.

During Kerberos authentication the Authentication Service (AS) request identifies the client to the KDC in plain text. If preauthentication is enabled, a time stamp will be encrypted using the user's password hash as an encryption key. If the KDC reads a valid time when using the user's password hash (stored in the Active Directory) to decrypt the time stamp, the KDC knows that request isn't a replay of a previous request.

The preauthentication feature may be disabled for specific users in order to support some applications that don't support the security feature. Access the user account from the Active Directory users and the computers will snap-in and select the account tab. From the account options: slide window, check mark the "Do not require Kerberos" preauthentication option (see below).

More information on Kerberos can be found in the Reference section below.

So the Kerberos preauthentication setting is part of the UserAccountControl settings for accounts in Active Directory.  We can read the value of this setting from Active Directory to find these accounts.  When you view the UserAccountControl setting in ADSIEDIT (decimal) or LDP (hex) you will see a number representing the different flags (e.g disabled, password never expires etc.) configured on the account.  More information on UserAccountControl can be found in the Reference section below.

Searching Active Directory

There are two simple ways you can find these accounts in Active Directory.  The first method involves creating a custom LDAP query in Active Directory Users & Computers (see Reference below) and using the LDAP query string below:

(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=4194304))

The second method is to use PowerShell to query Active Directory.  Two examples are shown below:

get-aduser  -LDAP "(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" -properties DoesNotRequirePreAuth

get-aduser -filter * -properties DoesNotRequirePreAuth |where {$_.DoesNotRequirePreAuth -eq "TRUE"}

Reference

Kerberos Explained
http://technet.microsoft.com/en-us/library/bb742516.aspx

How to Create Custom Active Directory LDAP Searches
http://blogs.msdn.com/b/muaddib/archive/2011/10/24/active-directory-ldap-searches.aspx

How to Query Individual Properties of the "userAccountControl" Active Directory User property using LDAP
http://blogs.msdn.com/b/muaddib/archive/2008/10/08/query-individual-properties-of-the-useraccountcontrol-active-directory-user-property.aspx

How to use the UserAccountControl flags to manipulate user account properties
http://support.microsoft.com/kb/305144

Caution – before making changes to the Certificates or Certificate Stores in your environment make sure you understand the impact of the change you are making.  Modifying the Certificate stores via Active Directory containers or Group Policy will affect a large number of computers and can break smart card logon or applications. 

In order to enable smart card logon there are a number of certificates that need to be published (installed) on each computer into the correct store.  The certificates required can be published via Group Policy, published into Active Directory or even into the local registry of each computer manually (not recommended).  The following information will explain the stores used to enable smart card logon at a high level and explain how to view the contents of the store as using several methods.

Certificate Stores

A Certificate Store can be thought of as a logical container in the operating system that holds one or more certificates.  The most common way to view the certificate stores is using the Certificates MMC snap-in as shown below (click graphic for larger view).

By default the Certificates snap-in displays the logical view of each store.  In reality this logical view is comprised of the certificates from each of the physical certificate stores on the computer.  These physical locations are located in the registry in different keys.  When you look at the registry location you will see keys labeled with hexadecimal numbers.  These numbers are the thumbprint for each certificate in the store.  The certificate information is stored in the registry as a BLOB (Binary Large object) and cannot be viewed within the registry.

To configure the snap-in to show the physical stores do the following:

1. Right-click the Certificates Node > View > Options
2. Check the Physical certificate stores box
   
   

You will notice in the graphic below there are now three additional nodes that represent the physical stores on the local computer; Registry, Group Policy and Enterprise

Another fun fact about working with certificate stores is different names are used to represent the stores depending on the tool you are using.  This is perhaps the most confusing aspect of working with certificates and stores.  The table below shows the conventional name of the store as viewed in the Certificates snap-in and the name used in other tools.

Note the AIA Container and the NTAuthCertificates are not certificate stores but containers in Active directory in the Configuration partition.  They are included here because the name mapping helps when using the CERTUTIL command to publish certificates into Active Directory.  Certificates in the AIA Container are published to clients in the Enterprise physical store described in more detail below.

Registry (Physical Store)

These are certificates published into the local registry of the computer.  The certificates can be found in the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates  

To view these certificates using CERTUTIL type the following:

CERTUTIL -viewstore <store name> where store name is MY, Root, CA, AuthRoot

Group Policy (Physical Store)

These certificates are published to the physical store via Group Policy and are updated when Group Policy refreshes.

These are certificate published via a Group Policy and can be found in the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates

To view these certificates using CERTUTIL type the following:

CERTUTIL -viewstore -GroupPolicy <store name> where store name is MY, Root, CA, AuthRoot

Enterprise (Physical Store)

These certificates are published into Active Directory containers.  There is a background process that runs to update the local operating system when the computer Group Policy is updated. 
NOTE – If the Task Scheduler is disabled then the computer will not receive these certificates. 

If you make changes to the certificate data stored in AD you can you can refresh this data on local computer by running GPUPDATE /FORCE /TARGET:COMPUTER.

The certificates can be found in the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates

To view these certificates using CERTUTIL type the following:

CERTUTIL -viewstore -enterprise <store name> where store name is MY, Root, CA, AuthRoot

AIA Container (Active Directory)

Contains CA certificates that can be retrieved by clients using the authority information access (AIA) certificate extension to build a valid certificate chain and to retrieve any cross-certificates issued by the CA.

Certificates published to this container will be published into the Intermediate Certification Authorities store on domain joined computers.

To view the contents of the store use the Enterprise PKI snap-in (PKIVIEW.MSC).  Certificates cannot be published to this store using the snap-in.

To publish certificates to this store using CERTUTIL type the following:

CERTUTIL -f -dspublish <cert file name> SubCA

NTAuthCertificates Container (Active Directory)

Contains all of the CA certificates in the current forest. Certificates are added automatically when a new CA is installed by a member of the Enterprise Admins group. Certificates can also be added manually by using the Manage AD Containers dialog box.

To publish certificates to this store using CERTUTIL type the following:

CERTUTIL -f -dspublish <cert file name> NTAuthCA

Certificate Authorities Container (Active Directory)

Contains the certificates for trusted root CAs in the forest. Root CA certificates are added automatically when a member of Enterprise Admins sets up an enterprise root CA or stand-alone root CA that is joined to the domain. Root CA certificates can also be added manually from the command prompt but not through the Manage AD Containers dialog box.

Certificates published to this container will be published to the Trusted Root Certification Store on domain joined computers.

To publish certificates to this container using CERTUTIL type the following:

CERTUTIL -f -dspublish <cert file name> RootCA

Smart Card Logon

During smart card logon the user proves their identity to a domain controller by means of a certificate, conversely the domain controller must prove its identity to the client with it's own certificate.  Both sides of this mutual authentication must be successful before a successful logon can occur.  When a certificate is used for authentication the following three tests are performed to make sure the certificates are valid:

• The certificate is within its validation period.  The certificate falls within the issued and expired dates on the certificate.
• The certificate must chain to a trusted root certificate.  The computer validating the certificate must trust the root certificate it chains to.
• The certificate has not been revoked.  The computer validating the certificate must be able to confirm the certificate has not been revoked.  The computer must be able to retrieve a copy of the certificate revocation list (CRL) from the certificate authority that issued the certificate or use some other method for validation like OCSP.

If any one of these checks fails, on either side of the mutual authentication, then logon will fail.

In order to use smart cards for logon you need to have a few things in place:

• Identity certificates for all domain controllers that were issued by a trusted source.
• Identity certificates for each user issued by a trusted source.
• Certificates from each of the issuing certificate authorities (Issuing CA in diagram below) that the identity certificates above were generated on.
• All certificates need to be placed in the correct certificate stores.
• All certificates used must be trusted.

Most of the organizations I have worked with to implement smart card logon use certificates from a third-party certificate authority outside their organization.  To enable smart card logon you need to publish these external certificates into the appropriate certificate stores.  The first step is to get your computers and users to “trust” the certificates from the third-party.  This is done by taking the third-party root certificate, the certificate from the top of the external third-party hierarchy (offline Root CA in diagram below), and publishing to the Trusted Root Certification Authorities store. 

This can be accomplished in two ways.  You can configure a Group Policy to publish the new root certificate to the Trusted Root Certification Authorities store on all computers or you can publish it to Active Directory using CERTUTIL or the Enterprise PKI snap-in.

To use the Enterprise PKI snap-in right-click on “Enterprise PKI” and select Manage AD Containers. Select “Certificate Authorities Container” tab and click the Add button and navigate to the certificate file you want to add.

NOTE – If you have an internal PKI infrastructure the snap-in will load quickly.  If you do not it will be very slow because it is trying to contact your internal (non-existent) PKI.  Be patient.

To use CERTUTIL to publish the certificate to the Certificate Authorities container type the following command:

CERTUTIL -f -dspublish <cert file name> RootCA

To use Group Policy to publish the certificates follow the instructions in the following article:

Use Policy to Distribute Certificates
http://technet.microsoft.com/en-us/library/cc772491.aspx

The identity certificates used by the domain controllers and smart cards are issued from one or more Issuing CAs.  Next you need to place the certificate(s) from each of the Issuing CAs in the appropriate stores.  You need to publish the certificates from each of the issuing CAs into the NTAuthCertificates store.  This is can be accomplished by using CERTUTIL or the Enterprise PKI mmc snap-in.

To use the Enterprise PKI snap-in right-click on “Enterprise PKI” and select Manage AD Containers. Select “NTAuthCertificates” tab and click the Add button and navigate to the certificate you want to add.

To use CERTUTIL type the following command:

CERTUTIL -f -dspublish <cert file name> NTAuthCA

The final step is to publish the certificates from each of the Issuing CAs into the Intermediate Certificate Authorities store on each computer.  This can be accomplished using Group Policy or publishing the certificates into Active Directory using CERTUTIL or the Enterprise PKI snap-in.

To use the Enterprise PKI snap-in right-click on “Enterprise PKI” and select Manage AD Containers. Select “AIA Container” tab and click the Add button and navigate to the certificate you want to add.

To use CERTUTIL type the following command:

CERTUTIL -f -dspublish <cert file name> SubCA

Troubleshooting Duplicate Certificates in the Certificate Stores

In some case you will see two copies of the same certificate in a store.  This can happen when you publish the certificate using two different methods.  The screenshot below demonstrates this (click graphic for larger view).

In order to find out why this is occurring we need to look at the physical stores.  To configure the snap-in to show the physical stores do the following:

1. Right-click the Certificates Node > View > Options
2. Check the Physical certificate stores box
   

As you can see in the two screen captures below we are publishing the CORP NAP CA 2 certificate in the Group Policy physical Store as well as the Enterprise physical store.  When we view the certificates in the logical view (previous screen capture) we see two copies of the certificate because we have two copies stored on the computer in two different stores.

Reference

How to import third-party certification authority (CA) certificates into the Enterprise NTAuth store
http://support.microsoft.com/kb/295663

Guidelines for enabling smart card logon with third-party certification authorities
http://support.microsoft.com/kb/281245

Designing and Implementing a PKI: Part I Design and Planning
http://blogs.technet.com/b/askds/archive/2009/09/01/designing-and-implementing-a-pki-part-i-design-and-planning.aspx

Use Policy to Distribute Certificates
http://technet.microsoft.com/en-us/library/cc772491.aspx

Relationship of the Configuration Container and Certificate Store
http://technet.microsoft.com/en-us/library/cc758636(v=WS.10).aspx

Managing Active Directory Containers with Enterprise PKI
http://technet.microsoft.com/en-us/library/cc754126.aspx

Customers tend to fall into two groups when it comes to DNS scavenging.  The first group has scavenging configured and it is working well.  The second group turned on scavenging in the past, caused an outage, and have refused to try and use scavenging since then.  When someone tells me they had a bad experience with scavenging in the past I know they probably just “threw the switch” without doing any of the prep work required to insure critical records do not get deleted.

There are plenty of DNS Scavenging articles out there (see below) so I won’t repeat it here. The high-level steps required to enable scavenging are as follows:

1. Disable scavenging on ALL DNS servers.
2. Enable scavenging on the DNS zones and monitor the time stamps on all records in the zones for a week or two to confirm DNS hosts are updating the time stamps on the A (host) records.  Pay close attention to servers to make sure their records are being updated.
3. Configured the zone scavenging interval.
4. Backup your zone data just in case.
5. Enable scavenging on a single DNS server and monitor for desired results

The remainder of this post will be about step 1 and how to find DNS server with scavenging enabled.  If you only have a few domain controllers running DNS you can view the Properties for each DNS server as shown below.

If you have dozens or hundreds of domain controllers then you need an easier way.  The PowerShell script shown below will dump the DNS server name and scavenging settings for each DNS server in your domain.  If you see a scavenging interval greater than zero you know scavenging is enabled on the server.

#---------------BEGIN SCRIPT CODE------------------
####################################################
# DATE: June 13, 2013  
# AUTHOR:  Don Baker
# SCRIPT:  GET-DNSScavengingData.ps1
# PURPOSE: Find DNS server(s) with scavenging enabled
#         
#
# REVISON:
####################################################
cls
#get a list of domain controllers in domain (replace Contoso with your domain)
$DCs=(GET-ADDOMAIN -Identity Contoso).ReplicadirectoryServers

#loop through list of DCs and dump lines with "scavenging" in them
foreach ($dc in $DCs)
{
    $output = dnscmd $DC /info
    #Write-host $output |fl
    $string =$output |Select-string "Scavenging"
    Write-host $DC
    Write-host $string
    Write-host ""
       
}
#-----------------END SCRIPT CODE------------------

Sample Output

As you can see below server DC1 has scavenging enabled and set to 7 days (168 hours) and the other server has it disabled.

DC1.AD.CONTOSO.COM
    ScavengingInterval           = 168

DC2CORE.AD.CONTOSO.COM
    ScavengingInterval           = 0

Resources

Don't be afraid of DNS Scavenging. Just be patient
http://blogs.technet.com/b/networking/archive/2008/03/19/don-t-be-afraid-of-dns-scavenging-just-be-patient.aspx 
 
Understanding Aging and Scavenging
http://technet.microsoft.com/en-us/library/cc771677(v=WS.10).aspx
 
Enable Aging and Scavenging for DNS
http://technet.microsoft.com/en-us/library/cc771362(v=WS.10).aspx