Check state of CRL checking.

Okey I had the need to check what values were set for the Software Publishing “State”. This is the registry value where Windows stores if it should do CRL revocation check or say all okey even if the CRL is unavailable. And some other stuff. I found all the values on the MSDN page WintrustGetRegPolicyFlags. So I wrote a small Powershell function to help decode it.

Example of running Get-WintrustGetRegPolicyFlags

And here is the function: [Read more…]

An extra 100ns for free?

So I was reading up on the AD Module filters. I found a thing, Microsoft usually says keep it simple. I found an over complex way of initializing a date variable. So what did the documentation suggest:

Whoa.. Yes you can use .NET but if possible use Powershell cmdlets. Do we have any cmdlet we can use? Get-Date. Get-Date can be initialized with year, month and day.

That looks easier to read so it is better. But are they the same. And they arent. So what is the difference? Let’s convert it to the FileTime structure.

Here we see that we get a 100-nanosecond difference. Im not really sure why. But now we know that if you want the real 12am you cant use Get-Date. As it will add a 100ns extra. Bonus link to MSDN article for DateTime Structure.

Updating AD group membership if the user has a mobilenumber


So I was at a customers location and well we got talking about scripts. They had the need for a script that populates a group if the user has a cellphone number configured and remove him the number is removed after.
They had already a script that did it. The script did what was needed but I felt there was room for improvement, so I got rid of a try catch where the catch was empty. That is just as bad as ON ERROR RESUME NEXT from the old VBScript days. Anyway I thought later there has got to be a better way of doing this.

The old way:

This is a compressed version written from memory.

The improved way:

So why not just be happy. Well there is still performance improvements and let the DC do the heavy lifting. Lets start using LDAPFilter.

But I only want user from one part of my AD

Okay so now we got new requirements of course but that is really simple. Lets just instruct the Get-ADUser to search only in one part using SearchBase.

So just add the searchbase parameter and path.

Some useful Juniper SRX commands

Since I am running a Juniper SRX at home and its not really my native firewall language I have learned a few good commands that I need to remember. [Read more…]

The wierd lowercase NETBIOS name

I got a call from an associate on how to change a domains NetBIOS name from lower to upper case. At first I was stumped, Was I the one that was out of date. In my head an NetBIOS name is always in uppercase, the same as a FQDN is always in lowercase. Don’t get me started on the special case with Single Label Domains (SLD). First I turned to my colleague Jimmy Andersson to ask if I had missed that day in AD training on why one would do that, he could not really give me any good reason or how. So I turned back to associate that reported it from the beginning. It was a regular Windows 2012R2 installation that had done this. So I tried with a Windows 2012R2 Update installation. And low and behold.. I managed to get the NetBIOS name in lowercase.

A small powershell script to verify NetBIOS name:

Windows 2012R2 lowercase NetBIOS proof

How to do it: [Read more…]

Recover deleted files/folders on a Workstation

So you have managed to delete some files/folders. Or perhaps even the wrong profile by scripting.

  • First rule of recovery: Don’t write the hard drive from where you want to recover data. If possible shut of the computer until you have a plan.
  • Second rule of recovery: Don’t forget to take backups.
  • Third rule or recovery: Backups are only as good as the last restore test.

There are a couple of ways to recover data that has been deleted but not yet overwritten, but this blog post is about one method. This method requires the System Restore to be enabled. A little list of options:

  • Restore using your backup. There is no replacement for a good backup.
  • Restore using this method (Shadow Copy).
  • Restore using data recovery software.
  • Restore using restore company, for example IBAS.

So how do we restore delete files from a workstation using the Windows Shadow Copy Service? [Read more…]

GUID Endian Converter

What is a GUID

First lets check what Microsoft says about the GUID:

“GUIDs are the Microsoft implementation of the distributed computing environment (DCE) universally unique identifier (UUID)”

Well what is a UUID then? Lets check RFC4122:

This specification defines a Uniform Resource Name namespace for
UUIDs (Universally Unique IDentifier), also known as GUIDs (Globally
Unique IDentifier). A UUID is 128 bits long, and can guarantee
uniqueness across space and time. UUIDs were originally used in the
Apollo Network Computing System and later in the Open Software
Foundation’s (OSF) Distributed Computing Environment (DCE), and then
in Microsoft Windows platforms.

So now we know that the GUID is a value which should be unique (there is not such thing as a guaranteed unique since there is no central authority). So lets check how the GUID is built and why this entry is needed.

Structure of a GUID

Lets look at a sample GUID ED7BA470-8E54-465E-825C-99712043E01C. Here there is a small difference between the UUID and the GUID specification, but it does not change anything. Both start using one 32bit Unsigned Integer followed by two 16bit Unsigned Integers. Then the UUID is specified as two 8bit Unsigned Integers followed by 6 bytes. Where as the GUID is specified as 8 bytes. But it does nothing to change the problem or the solution so lets leave it as 8 bytes.

The problem

RFC4122 specifies that the GUID must be precented as big endian but Intel processors are little endian. This is where the problem comes from. There are some applications that read the GUID in little endian format and store it as a string which does not do the little to big endian conversion by magic. In these cases you need to use a cmdlet as mine to convert between the endian formats. [Read more…]

Get the SID of all domains in a forest

I got a request from a system owner what was the SID of the domain since their license was bound to the domain SID. The Domain SID is not really that is going to change and its really unlikely that anyone will collide with yours, so not really a bad choice.

Anyways if you have the Active Directory Powershell module its really easy to do this. Without the AD Powershell module its not really that hard either, but Im lazy when the three latest published versions of Windows has the modules available I feel that I can skip doing it the long way.

Lets continue with the show:

And there we go, easy as 1-2-3

Managing tombstone lifetime with AD cmdlets

So the first question might be why should I even care about this. I have heard things like “I am running Windows version xxx, so I have a tombstone life of 180 days.”. This might not be the case, the tombstone lifetime is set at the time of the promotion of the first domain controller in the forest. So okey if you have have an old forest running on a new Windows version you cant be sure that the tombstone life what you want. To make things a bit more silly, Microsoft decided during Windows 2003 to increase the value from the default of 60 days to 180 days. Jane Lewis wrote a Technet blog about this in 2006, but this is still an area where you can find forests which still run with a 60 day tombstone lifetime. Microsoft has a nice article about this, but I like powershell instead of dsquery.

How to read the current Tombstone lifetime

If no value..Note the value in the Value column. If the value is <not set>, the value is 60 days. [Read more…]

Powershell and newlines

So I was doing some scripting and and after a while the code got a bit bigger than just one line. So I decided it is time to bring out the big guns enter PowerShell Integrated Scripting Environment (ISE). So I copied the oneliner that was working perfectly into the ISE and noticed that it wasn’t working anymore. So what black magic was changing what I just had copied and pasting into the ISE.

So after a bit of research I found out the following logic.


When running by just inserting the text into a Powershell window everything is great. When I tried both just executing a ps1 file or from the ISE I got the following results:



[Read more…]