1. SCL Enabled (here we are only talking about implicit UPN mapping)
   1. Subject Alternative Name - Principal name on the smart card certificate is implicitly mapped to an AD user objects UPN attribute
2. SCL Enforced
   1. Subject Alternative Name - Principal name on the smart card certificate is implicitly mapped to an AD user objects UPN attribute
   2. SCRIL flag ON
3. SCL Enforced and has/knows password
   1. Subject Alternative Name - Principal name on the smart card certificate is implicitly mapped to an AD user objects UPN attribute
   2. SCRIL flag ON
   3. Admin resets password, user knows and can maintain password (pw can be used for type 3 logons)

1. Query the directory for users who are NOT SCRIL enforced
2. Enforce them

1. Query the directory for users
2. Check if they are SCRIL or Not
   1. If they are NOT SCRIL
      1. Check if they are an exception and if so Skip
      2. If they are not an exception toggle the SCRIL flag on
   2. If they are already SCRIL
      1. Toggle SCRIL flag off, then toggle back ON to scramble hash

1. User forgets smart card at home.
2. User calls help desk, account gets un-enforced and password gets reset.
3. User works all day, then goes home.
4. That night the scheduled enforcement task runs and because the user is not a member of an exception group they are again enforced.

Import-Module ActiveDirectory

#query AD for user accounts using the following LDAP filter (All user accounts in the Department users OU)
$OUQuery1 = Get-ADObject -LDAPFilter "(&(ObjectCategory=Person)(ObjectClass=User))" -Properties distinguishedName,useraccountcontrol -server localhost:389 -searchBase "ou=department users,dc=proseware,dc=com" -searchScope subtree

function Enforce-Users($Users)
{
    #here we test the $users variable to ensure it isn't NULL"
    if($users)
    {
        #do work here, iterate through the $users variable (Get-ADObject query return set)
        foreach($user in $users)
        {
            $exception = "False" 
            #test for a clo exception group, only searches one level - not recursively, if you want a recursive dig add your code here
            $userGroupMemberships = Get-ADPrincipalGroupMembership -server localhost:389 -identity $user.distinguishedName
            foreach($groupmembership in $userGroupMemberships)
            {
                if($groupmembership -like "*PROAZURE_CLO_Exceptions*")
                {
                    Write-Host "Not Enforced: " $user.name
                    $exception = "True"
                }
            }
            if($exception -eq "False")
            {
                #not an exception, enforce smart card required for interactive logon
                $UACValue = $user.userAccountControl
                #check account to see if it is currently enforced
                if($UACValue -band 262144)
                {
                    #Account is currently enforced, unenforce and re-enforce to scramble password
                    $user.userAccountControl = $user.userAccountControl -bxor 262144
                    Set-ADObject -Instance $user
                    $user.userAccountControl = $user.userAccountControl -bor 262144
                    Set-ADObject -Instance $user 
                    Write-Host "Enforced: " $user.name
                }
                else
                {
                    #Account is NOT currently enforced, enforce account
                    $user.userAccountControl = $user.userAccountControl -bor 262144
                    Set-ADObject -Instance $user 
                    write-host "Enforced: " $user.name
                }
            }  
        }
    }
}

Enforce-Users($OUQuery1)

I've also commented out the expired CAs, and added line 25 where you can set the crl fetch intervals to your specifications; as an example I set it to 24 hours here:

The function is available at the TechNet script center!

https://gallery.technet.microsoft.com/scriptcenter/Server-2008-R2-and-Server-30a916cb

Cheers!

Jesse Esquivel

Schema Extension
MIM CM requires some additional attributes and extended rights to be added to the Schema.  Hopefully you know the drill on the Schema and all of the pre-requisites for modifying it, its a one-way ticket so make sure you have at least one good system state backup from at least one DC in every domain.  Drop your admin account in Schema Admins and logoff/login to a DC to reflect the new membership.  Review the Schema folder on the MIM 2016 media, if you're doing a single forest, single domain installation like I am you'll want to use the "ResourceForest.ldif" file and use ldifde to extend it:

This is fairly straightforward and hopefully you get a success message.  Don't forget to take yourself out of Schema Admins when you're done ; )

MIM-CM Pre-requisites
Lets just say there are a number of these.  You'll want to use the following TechNet article for FIM CM which largely still applies.  We've already gone through the schema extension, but there are also SQL and certificate template pre-reqs that need to be completed that are documented there. 

• SQL Pre-reqs'
• Certificate Template Pre-reqs'
• IIS Pre-reqs'

For this scenario I didn't perform the optional steps in the article.  One of the last things are the IIS pre-requisites for the MIM-CM web server, I used server manager to add all of the role services I wanted to install, then exported to an xml file via the UI so that I could add them via PowerShell and use on an additional CM webserver later:

MIM-CM Install
Now that all of the pre-requisites are complete we're ready to install MIM-CM on the designated MIM-CM server.  Launch the MIM-CM installer and execute the installer:

Next!

Select the Portal and Update Service.

This is the IIS virtual directory - I used the default configuration.  Go Next and click Install.  That should wrap up the installation on the CM web server.  Now that the MIM CM website is in IIS, we need to disable Kernel mode authentication which is documented here.  Let's move over to the Certificate Authority server and install the MIM-CM bits there, same drill here let's execute the installer and this time we'll choose the MIM CM CA files which will install the MIM CM policy module and exit module:

Next we need to allow the CA to access the MIM CM database, which is detailed here.  Ensure you complete these steps or the CA will not be present in the MIM CM SQL database.  Now that we've laid down the bits we need to run the MIM CM configuration Wizard on the server where you installed the MIM CM portal.  So head over there and on the start menu you should see the MIM CM configuration wizard, let's execute it and step through it.  Ensure the credential you're using has SA rights on the SQL server you're going to use (or optionally specify another account), and has the appropriate rights in AD to create all of the user objects.

Next.  Select the Certification Authority that MIM CM will use for certificate issuance clicking browse.

Specify the sql server name and which credential you are going to use to create the database.

Specify the database name, I accepted the default name and used SQL integrated authentication.

For the AD piece it's recommended to keep the default setting, and so it was done.

This screen is interesting and is actually new with MIM CM 2016, we can now use the power of ADFS for authorization and authentication into the MIM CM portal.  For this scenario we will use IWA/Kerberos.

If you chose to follow the aforementioned article and create all of the accounts yourself in AD, here is where you punch them into the configuration wizard.  For this scenario I used the MIM default settings and specified the OU that the accounts will be created in.

MIM CM needs a couple of certificates to function, they are issued from the certificate templates that you created and made available on the CA based on the TechNet article previously mentioned.  Choose the respective certificate templates for each entry, if you do not see them double check the permissions on the templates based on the TechNet article.

Email configuration.  I didn't have any exchange servers setup nor was I looking to specifically test any mail related functionality so I used the defaults here.

Now that we arrived at the summary, we can review our selections/configurations.  If you're ready to let her rip, click configure.

Hopefully we arrive here!

The idea is to get MIM CM installed and configured so that we can issue virtual smart cards to end users via the MIM CM portal, and the new MIM CM modern application.  MIM CM offers additional capabilities in reporting, enrollment, retirement, and other smart card functions.  We still have quite a bit of configuring to do to get this all off of the ground.  We have some CA, AD, IIS, and MIM CM portal configurations to complete.  So we'll see you at the next post.

Jesse Esquivel

• Windows 10 Build 10240 is the RTM build!

• EMET 5.2 is not supported with Windows 10, it will cause Internet Explorer to not start.  The next version of EMET will be compatible with Windows 10

• Windows 10 is a FREE upgrade on consumer PCs, reserve and get your copy today; if you don’t see the icon in your taskbar tray install KB3035583, or use the media creation tool to upgrade to Windows 10 now.

  After you download the Media Creation Tool and launch it, there will be an option to upgrade your PC now:
  

  
  

• Windows 10 ADK is available here

• Windows 10 Activation via KMS requires Hotfix KB3058168 be installed on the KMS host server, and the KMS host key for Windows 10 be installed.

• There will be an updated Microsoft Deployment Toolkit (MDT) available in August.

• Microsoft Bit locker Administration and Monitoring (MBAM) 2.5 client is supported on Windows 10.  MBAM 2.5 SP1 will add additional features for 10, including customizing the recovery screen, a new PowerShell v2 compatible script for enabling bit locker during a task sequence in MDT or SCCM, or stand alone; and a few new WMI methods as well as some other features.

• Current version of UE-V is not supported on Windows 10, will be supported in the next version of UE-V

• Windows 10 and the KMS host keys will be available for Enterprise customers on the VLSC on 01AUG.

• Create a Windows 10 Reference Image

Well I hope you find this information useful for getting started!  We are all very excited about Windows 10!  As we run into any issues, gotchas, or helpful tips we'll post them here.  Do you plan on testing, evaluating, and deploying Windows 10 in your organization?

Jesse Esquivel