HPlum78

First thought would be get-netadapter from memory this cmdlet returns state I would guess that there is a set-netadapter. Need to take a closer look but it's a starting point.

I love companies that pass IaaS of as a cloud solution as a solution based on IaaS is not really a cloud solution! PaaS or SaaS is a cloud solution and thats the companies that we should sit up and listen to as that's where a true saving can be realised, and demonstrates a company with some expertise. Also based on not offering an SSO solution due whatever reasons that they state is a clear demonstration of a company that does not know what they are doing. As part of all your cloud service assessments surly support for SSO is a base requirement these days!? Else all you have done is copied your user accounts to a third party!

param ( [Parameter(Mandatory=$true)] [boolean] $IsComputerConfiguration, [Parameter(Mandatory=$true)] [string] $Extension, [Parameter(Mandatory=$true)] [string] $Where, [Parameter(Mandatory=$true)] [string] $Is, [Parameter(Mandatory=$false)] [string] $Return, [Parameter(Mandatory=$false)] [string] $DomainName =[system.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() ) function print { param ( $displayName, $value ) $host.UI.WriteLine(); $stringToPrint = "The Gpo '" + $displayName + "' has a " +$Extension + " setting where '" + $Where + "' is equal to '" +$Is + "'"; if ($Return -ne $null) { $stringToPrint += " and the value of its '" + $Return + "' property is: '" + $value + "'"; } $host.UI.Write([ConsoleColor]::Magenta,[ConsoleColor]::Black, $stringToPrint); $host.UI.WriteLine(); } function processNodes { param ( $nodes, $foundWhere ) $thePropertyWeWant = $Where; # If we already found the $Where then we are looking for our $Return value now. if ($foundWhere) { $thePropertyWeWant = $Return; } foreach($node in $nodes) { $valueWeFound = $null; #Here we are checking siblings $lookingFor = Get-Member -InputObject $node -Name$thePropertyWeWant; if ($lookingFor -ne $null) { $valueWeFound = $node.($lookingFor.Name); } else #Here we are checking attributes. { if ($node.Attributes -ne $null) { $lookingFor =$node.Attributes.GetNamedItem($thePropertyWeWant); if( $lookingFor -ne $null) { $valueWeFound = $lookingFor; } } } if( $lookingFor -ne $null) { #If we haven't found the $Where yet, then we may have found it now. if (! $foundWhere) { # We have found the $Where if it has the value we want. if ( [string]::Compare($valueWeFound, $Is, $true) -eq 0 ) { # Ok it has the value we want too. Now, are we looking for a specific # sibling or child of this node or are we done here? if ($Return -eq $null) { #we are done, there is no $Return to look for print -displayName $Gpo.DisplayName -value $null; return; } else { # Now lets look for $Return in the siblings and then if no go, the children. processNodes -nodes $node -foundWhere $true; } } } else { #we are done. We already found the $Where, and now we have found the $Return. print -displayName $Gpo.DisplayName -value$valueWeFound; return; } } if (! [string]::IsNullOrEmpty($node.InnerXml)) { processNodes -nodes $node.ChildNodes -foundWhere$foundWhere; } } } #Import our module for the call to the Get-GPO cmdlet Import-Module GroupPolicy; $allGposInDomain = Get-GPO -All -Domain $DomainName; $xmlnsGpSettings ="[url]http://www.microsoft.com/GroupPolicy/Settings[/url]"; $xmlnsSchemaInstance ="[url]http://www.w3.org/2001/XMLSchema-instance[/url]"; $xmlnsSchema = "[url=http://www.w3.org/2001/XMLSchema]XML Schema[/url]"; $QueryString = "gp:"; if($IsComputerConfiguration){ $QueryString +="Computer/gp:ExtensionData/gp:Extension"; } else{ $QueryString +="User/gp:ExtensionData/gp:Extension"; } foreach ($Gpo in $allGposInDomain) { $xmlDoc = [xml] (Get-GPOReport -Guid $Gpo.Id -ReportType xml -Domain $Gpo.DomainName); $xmlNameSpaceMgr = New-ObjectSystem.Xml.XmlNamespaceManager($xmlDoc.NameTable); $xmlNameSpaceMgr.AddNamespace("",$xmlnsGpSettings); $xmlNameSpaceMgr.AddNamespace("gp",$xmlnsGpSettings); $xmlNameSpaceMgr.AddNamespace("xsi",$xmlnsSchemaInstance); $xmlNameSpaceMgr.AddNamespace("xsd",$xmlnsSchema); $extensionNodes =$xmlDoc.DocumentElement.SelectNodes($QueryString,$XmlNameSpaceMgr); foreach ($extensionNode in $extensionNodes) { if([string]::Compare(($extensionNode.Attributes.Item(0)).Value, "[url]http://www.microsoft.com/GroupPolicy/Settings/[/url]" +$Extension, $true) -eq 0) { # We have found the Extension we are looking for now recursively search # for $Where (the property we are looking for a specific value of). processNodes -nodes $extensionNode.ChildNodes -foundWhere $false; } } }

Oh and you can use the get-ADFineGrainedPasswordPolicy -Filter * and the if you want to change any settings you can use Set-ADFineGrainedPasswordPolicy

I wrote a powershell script to do just this, I will dig it out and post it shortly.

https://www.microsoft.com/en-gb/download/details.aspx?id=30005 AD Rep tool download this it's a good starting point.

Yeah that will do yeah! Good work glad your sorted. As for duplicate recs have one set been added manually potentially. Don't know if it's possible to add additional name servers to a stub... Right click and try I guess!

@kidpressingbuttons what was the root cause? Anyhow in DNS management right click on that _msdcs folder and look at the degation, is the server you demoted in the list?

I have also just seen on 2016 a ps module called ADDSDeployment in that module there is a Test-ADDSDomainControllerUnistallation Don't know anything about it just seen that it exists....

I will take a punt at some left over metadata or some left over dns record in the _msdcs stub. (if you have promoted/ demoted the new/ DC's correctly that is!)

Oh and I have mentioned the gui tool for checking these types of issues in the past but will point you at it https://www.microsoft.com/en-gb/download/details.aspx?id=30005

On the new 2016 sever run get-ADReplicationUpToDatenessVectorTable Also run get-adforest and get-addomain Get-ADReplicationFailure -Target -Scope Domain Post/ mail me directly the results and I will take a look.

https://securityboulevard.com/2018/08/showmecon-2018-michael-goughs-powershell-exploitation-powersploit-bloodhound-powershellmafia-obfuscation-powershell-empire-the-empire-has-fallen-you-can-detect-powershell-exploitation/ Take a look 2x speed will cut down your learning time.... Hope it helps.

I am just going to call this out as well. The tool that you are referring to is not a security risk nor is it proof in anyway of how insecure/ secure AD is (I am willing to be shown otherwise mind). From memory this tool requires that it be installed on a DC in the domain you want to collect the passwords from (source domain), this means that you have got to have a fair amount of permissions on the DC and in the domain itself. It also requires a key to be generated in the target domain to be used in the install of the tool in the source domain again needing a certain amount of access (now if you do all this while logged on with your own creds than you are the security risk not AD!). This tool has a specific use case and in itself has protection from leaking passwords and makes it a hard task for some would be attacker to decrypt the passwords, they would need access to the key as well as getting the hashes (again needing a degree of access to your domains). I am not saying that AD is totally secure in everyway but I am not seeing anything that says that AD is insecure in this thread, I see bad practice and a miss understanding of what is a pure AD security hole and what is administrative bad practice creating security holes. One final word on this, the hash comparison that has been talked about is very different from actually decrypting hashes.

AD is not secure....? So how did you scan AD and get access to the hashes? If you say that you where logged into said domain with some kind of privileged account then, well you see where I am going here! I know you alluded to this Tom but its a little disingenuous to make a sweeping statement like that. Also copying passwords in clear text (or any other form) between applications is not SSO! In any way, shape or form. Passing and storing clear text passwords is p!55 poor practice and the very reason you get owned by allowing the start for sideways movement through your environment. That's not AD being insecure thats the implementation of AD/ how its being used and not just limited to AD but any other directory solution for that matter. Now I am not saying that all is entirely rosy and securing identities and secrets should be top priority as MS has said recently that 70% of network intrusions are due to poor identity management. (oh and MS do offer a checking solution and will ripple over your password hashes if you use password sync and call out any accounts/ hashes that are publicly available)

https://www.microsoft.com/en-gb/download/details.aspx?id=30005 Get that tool.

NP glad your all sorted, H.

oh and a good place for working out what is going on with SAML and the likes is available here https://www.samltool.com/decode.php

Send me the documents for the Progresso app and do a Get-AdfsRelyingPartyTrust -name '' and send me that I will take a look, also get SAML trace/ View for firefox/ chrome and take a look at what is going out in the claim (if you can get that far) you may need to set the RPT to not encrypt the claim so you can see what is going on the following command will do this Get-AdfsRelyingPartyTrust -name '' | Set-AdfsRelyingPartyTrust -EncryptClaims $false. I will try to help where I can. H.

As @Oaktech says a more friendly tool can be found here https://www.microsoft.com/en-gb/download/details.aspx?id=30005 if a GUI helps.....

so running this from ISE on your win 10 client it runs without error, do you logon to your client with a privileged account? My guess and this is just a guess.... is that you need to pass some creds (that has interactive login rights). Try:- Invoke-Command -ComputerName "WSH-SCCM-01" -FilePath "A:\Tools\PowershellScripts\Create-SCCMEntry.ps1" -ArgumentList $ComputerName,$MACAddress -Credential (get-Credential) when prompted give it some creds that have the above rights.

hmmm, how is it being called? need elevation.....

first pass and I cannot see anywhere that is setting up a psdrive called WSH I can see it being used by set location mind...

Wrote a PowerShell function to manage forwarding and inbox rules on mailboxes. (Needs some more work/ refinements - (many cats.....) but it works) <# .Synopsis Function that can check and remove a mailbox forwarding and inbox rule(s) in O365. .ALIASES clrmbx .DESCRIPTION This function can be used to check/ and remove mailbox forwarding settings. The function can also export any inbox rules a user mailbox has setup (the default location is (C:\localapp\$($identity)-ExpIbxRules.csv) along with also being able to remove these rules. A connection to O365 with the correct permissions is required. .EXAMPLE Clean-MbxRules -Identity UserName -CheckSMTPFwdSettings .EXAMPLE Clean-MbxRules -Identity UserName -RemoveSMTPFwdSettings .EXAMPLE Clean-MbxRules -Identity UserName -CheckInBoxRules -ExportInBoxRules -OutFileLocation "C:\temp\UserName-IbxRules.csv" .EXAMPLE Clean-MbxRules -Identity UserName -CheckInBoxRules -ExportInBoxRules -OutFileLocation "C:\temp\UserName-IbxRules.csv" -RemoveInBoxRules .OUTPUTS Outputs Inbox rules when the -ExportInBoxRules switch is used, the default location C:\localapp\$($identity)-ExpIbxRules.csv this location can be modified by using the -OutFileLocation switch. .NOTES Author: H.A Plumtree Date: 04/07/2010 Version: 1.0.0 Pulls the functionality of the get-mailbox/ set-mailbox cmdlets in to one funtion. This function can then be triggered to run when AD accounts are Disabled/ Deleted from AD to clean up the mailbox in O365 Backlog/ Changes: #> function Clean-MbxRules { param( [Parameter(Mandatory = $true)]$Identity, [Parameter(Mandatory = $false)]$OutFileLocation = "C:\localapp\$($identity)-ExpIbxRules.csv", [switch]$CheckSMTPFwdSettings, [switch]$RemoveSMTPFwdSettings, [switch]$CheckForwardingAddress, [switch]$RemoveForwardingAddress, [switch]$CheckDeliverToMailboxAndForward, [switch]$DisableDeliverToMailboxAndForward, [switch]$CheckInBoxRules, [switch]$ExportInBoxRules, [switch]$RemoveInBoxRules ) $Identity = Get-Mailbox -Identity $identity | % { if($checkSMTPFwdSettings.IsPresent){ if($_.ForwardingSmtpAddress -eq $null){ write-host -fore green "No SMTP forwarding address set on account $($_.UserPrincipalName)" } else{ Write-Host -fore Yellow "SMTP Forwarding address found,$($_.ForwardingSmtpAddress) is set on $($_.UserPrincipalName) mailbox" } } if($removeSMTPFwdSettings.IsPresent){ if($_.ForwardingSmtpAddress -eq $null){ write-host -fore magenta "No SMTP forwarding address set on account $($_.UserPrincipalName). Please check and try again" } else{ Write-Host -fore yellow "SMTP Forwarding address found, $($_.ForwardingSmtpAddress) is set on $($_.UserPrincipalName) mailbox" Try{ Write-Host -fore green "Removing SMTP forwarding address $($_.ForwardingSmtpAddress) from $($_.UserPrincipalName) mailbox" Set-Mailbox -Identity $_.UserPrincipalName -ForwardingSmtpAddress $null } Catch{ write-host -fore Red "Failed to remove SMTP forwarding address on account $($_.UserPrincipalName)" } } } if($CheckForwardingAddress.IsPresent){ if($_.ForwardingAddress -eq $null){ write-host -fore green "No forwarding address set on account $($_.UserPrincipalName)" } else{ Write-Host -fore Yellow "Forwarding address found, $($_.ForwardingAddress) is set on $($_.UserPrincipalName) mailbox" } } if($RemoveForwardingAddress.IsPresent){ if($_.ForwardingAddress -eq $null){ write-host -fore magenta "No forwarding address set on account $($_.UserPrincipalName). Please check and try again" } else{ Write-Host -fore yellow "Forwarding address found, $($_.ForwardingSmtpAddress) is set on $($_.UserPrincipalName) mailbox" Try{ Write-Host -fore green "Removing forwarding address $($_.ForwardingAddress) from $($_.UserPrincipalName) mailbox" Set-Mailbox -Identity $_.UserPrincipalName -ForwardingAddress $null } Catch{ write-host -fore Red "Failed to remove forwarding address on account $($_.UserPrincipalName)" } } } if($CheckDeliverToMailboxAndForward.IsPresent){ if($_.DeliverToMailboxAndForward -eq $false){ write-host -fore green "Deliver To Mailbox And Forward setting is not configured on account $($_.UserPrincipalName)" } else{ Write-Host -fore Yellow "Deliver To Mailbox And Forward setting is configured on account $($_.UserPrincipalName)" } } if($DisableDeliverToMailboxAndForward.IsPresent){ if($_.DeliverToMailboxAndForward -eq $fasle){ write-host -fore green "Deliver To Mailbox And Forward setting is not configured on account $($_.UserPrincipalName)" } else{ Write-Host -fore yellow "Deliver To Mailbox and Forward is set on account $($_.UserPrincipalName)" Try{ Write-Host -for green "Setting Deliver To Mailbox and Forward on account $($_.UserPrincipalName) to false" Set-Mailbox -Identity $_.UserPrincipalName -DeliverToMailboxAndForward $false } Catch{ Write-Host -fore Red "Fialed to set Deliver To Mailbox and Forward on account $($_.UserPrincipalName) to false" } } } if($CheckInBoxRules.IsPresent){ $forwardingRules = $null $ibxRules = $null Write-host -fore green "Checking $($_.UserPrincipalName) mailbox for inbox rules" $ibxRules = Get-InboxRule -Mailbox $_.UserPrincipalName if($ibxRules -ne $null){ Write-Host -fore green "Found inboxrule(s) on Mailbox $($_.UserPrincipalName)" } else{ Write-Host -fore yellow "No inboxrule(s) found on Mailbox $($_.UserPrincipalName)" } If($ExportInBoxRules.IsPresent){ if($ibxRules -ne $null){ foreach($ibxrule in $ibxRules){ $ibxRulesList = $null $ibxRulesList = [ordered]@{ PrimarySmtpAddress = "$($_.UserPrincipalName)" DisplayName = "$($_.DisplayName)" RuleName = "$($ibxrule.Name)" RuleDescription = "$($ibxrule.Description)" RuleEnabled = "$($ibxrule.Enabled)" RuleForwardTo = "$($ibxrule.forwardTo)" RuleForwardAsAttchmentto = "$($ibxrule.forwardAsAttachmentTo)" } $ibxRulesList = New-Object PSObject -Property $ibxRulesList $ibxRulesList | Export-Csv -Path $OutFileLocation -Append -NoTypeInformation } } } if($RemoveInBoxRules.IsPresent){ try{ foreach($ibxrule in $ibxRules){ Write-Host -ForegroundColor Cyan "Trying to remove $($ibxrule.name) from mailbox $($_.UserPrincipalName)" Remove-InboxRule -Mailbox $_.UserPrincipalName -Identity $($ibxrule.name) -Force -Confirm:$false } } catch{ Write-Host -fore Magenta "Failed to remove inbox rules from $($_.UserPrincipalName)" } } } } } Set-Alias -Name ClrMbx -Value Clean-MbxRules

https://www.cisco.com/c/en/us/about/security-center/guide-ddos-defense.html