Category Archives: Active Directory

Selfsign with Windows Certification Authority

If you just create a certificate, and it signed by a Windows Certification Authority, the certs is working just fine in the old Internet Explorer, but Chrome/Firefox and the new Edge browser will failed, with Common Name invalid, the precise error in Chrome is: NET::ERR_CERT_COMMON_NAME_INVALID.

This is because a normal certificate request, does not included a subject alternative name.
So to fix this you new to request the certficate, by an inf file instead

So first create a new Certreq.inf file and paste this into it:

;----------------- request.inf -----------------
[Version]

Signature="$Windows NT$"

[NewRequest]

Subject = "CN=kennethdalbjerg.dk, OU=Hosting, O=KennethDalbjerg, L=DK, S=DK, C=DK" ; replace attribues in this line
KeySpec = 1
KeyLength = 2048
; Can be 2048, 4096, 8192, or 16384.
; Larger key sizes are more secure, but have
; a greater impact on performance.
Exportable = TRUE
FriendlyName = "Kennethdalbjerg.dk-2024"
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft Strong Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0

[EnhancedKeyUsageExtension]

OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication

[RequestAttributes]

SAN="kennethdalbjerg.dk&dns=www.kennethdalbjerg.dk"
;-----------------------------------------------

Replace kennethdalbjerg.dk and www.kennethdalbjerg.dk, with the name you want. If you don’t want more than one common name, in yours certificate. Then you just in last line remove:
&dns=www.kennethdalbjerg.dk
Also replace the name in FriendlyName.

Now run this command to prepare the CSR file:

certreq -new certreq.inf certreq.csr

Copy the certreq.csr to yours Certication Authority server, and the run this command on that server

certreq -Submit -Attrib "CertificateTemplate:webserver" -Config - c:\certreq.txt

Replace CertificateTemplate:webserver with the correct name for the template that you want to use.
Save the certificate by name, i use signcert.cer
Copy signcert.cert back to the server, that you have generate the CSR file on, and run this command on that server

certreq -accept signcert.cer

ADFS – Bad Request 400 in Internet Explorer

Today i have a customer that got an Bad Request Error 400, when he try to logon to ADFS from inside their own network, with domain connected computers.
The error is only showing up in Internet Explorer, witch lead me to it might be a kerberos thing.

The service account that run the ADFS services, is “ita_service_admin”.

So looking at that account with setspn i can see witch SPN is register to ita_service_admin account.

setspn -l XXX\ita_service_admin

The where no SPN for the account. The ADFS url is: https://fs.YYY.dk so i added the following SPN to ita_service_Admin account:

setspn -S HOST/FS.YYY.DK XXX\ITA_SERVICE_ADMIN
setspn -S HTTP/FS.YYY.DK XXX\ITA_SERVICE_ADMIN

But I got an error saying that HOST/FS.YYY.DK already exist. So i look for the SPN in the domain

This Code, will show all SPN in use in you Active Directory

cls
$search = New-Object DirectoryServices.DirectorySearcher([ADSI]“”)
$search.filter = “(servicePrincipalName=*)”
$results = $search.Findall()

#list results
foreach($result in $results)
{
$userEntry = $result.GetDirectoryEntry()
Write-host “Object Name = “ $userEntry.name -backgroundcolor “yellow” -foregroundcolor “black”
Write-host “DN      =      “  $userEntry.distinguishedName
Write-host “Object Cat. = “  $userEntry.objectCategory
Write-host “servicePrincipalNames”        $i=1

foreach($SPN in $userEntry.servicePrincipalName)
{
  Write-host “SPN(“ $i “)   =      “ $SPN       $i+=1
  }
Write-host “”

}

Find the SPN, and delete it from the account, i find the account under Administrator, so it looks like someone have change the service account for ADFS service from Administrator to ITA_SERVICE_ADMIN account in the past, without moving the SPN.

So delete the SPN from administrator account

setspn -D HOST/FS.YYY.DK XXX\administrator

Then try to add it again to ITA_Service_Admin account.

setspn -S HOST/FS.YYY.DK XXX\ITA_SERVICE_ADMIN

Restart the ADFS service, and the ADFS is working again also from Internet Explorer.

Remote Desktop seesions – See sessions on all servers in Active directory

If you have enabled that a user get lock out in Active Directory, if the user type the password wrong X times.
Then you might have experienced, that yours admin account get locked out multiple times, just after you have change the password for the admin account.

It could be that you have left a session on a server in you Active Directory logged on, and that session now trying to authenticated it self, by using you old password.

You can run this script, to check all servers in Active Directory, to see where there are user session on it.

function Get-LoggedOnUsers ($server) {
    if($server -eq $null){
        $server = "localhost"
    }
 
    $users = @()
    # Query using quser, 2>$null to hide "No users exists...", then skip to the next server
    $quser = quser /server:$server 2>$null
    if(!($quser)){
        Continue
    }
 
    #Remove column headers
    $quser = $quser[1..$($quser.Count)]
    foreach($user in $quser){
        $usersObj = [PSCustomObject]@{Server=$null;Username=$null;SessionName=$null;SessionId=$Null;SessionState=$null;LogonTime=$null;IdleTime=$null}
        $quserData = $user -split "\s+"
 
        #We have to splice the array if the session is disconnected (as the SESSIONNAME column quserData[2] is empty)
        if(($user | select-string "Disc") -ne $null){
            #User is disconnected
            $quserData = ($quserData[0..1],"null",$quserData[2..($quserData.Length -1)]) -split "\s+"
        }
 
        # Server
        $usersObj.Server = $server
        # Username
        $usersObj.Username = $quserData[1]
        # SessionName
        $usersObj.SessionName = $quserData[2]
        # SessionID
        $usersObj.SessionID = $quserData[3]
        # SessionState
        $usersObj.SessionState = $quserData[4]
        # IdleTime
        $quserData[5] = $quserData[5] -replace "\+",":" -replace "\.","0:0" -replace "Disc","0:0"
        if($quserData[5] -like "*:*"){
            $usersObj.IdleTime = [timespan]"$($quserData[5])"
        }elseif($quserData[5] -eq "." -or $quserData[5] -eq "none"){
            $usersObj.idleTime = [timespan]"0:0"
        }else{
            $usersObj.IdleTime = [timespan]"0:$($quserData[5])"
        }
        # LogonTime
        $usersObj.LogonTime = (Get-Date "$($quserData[6]) $($quserData[7]) $($quserData[8] )")
 
        $users += $usersObj
    }
    return $users
}

$strCategory = "computer" 
$strOperatingSystem = "Windows*Server*" 
 
$objDomain = New-Object System.DirectoryServices.DirectoryEntry 
 
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher 
$objSearcher.SearchRoot = $objDomain 

$objSearcher.Filter = ("OperatingSystem=$strOperatingSystem") 
 
$colProplist = "name" 

foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)} 

$colResults = $objSearcher.FindAll() 

foreach ($objResult in $colResults) 
    { 
    If ($Err -ne $null) {
        Remove-Variable Err
    }
    $objComputer = $objResult.Properties;  
    $ServerName = $objComputer.name
    $isalive = Test-Connection -BufferSize 32 -Count 1 -ComputerName $servername -Quiet
    if($isalive -eq $True) {
        $wmi = Get-WmiObject -class "Win32_Process" -namespace "root\cimv2" -computername $ServerName -EV Err -EA SilentlyContinue
        if ($Err) {
         } Else {
            Get-LoggedOnUsers $ServerName | ft -autosize
        }

    }
}

 

 

You can change this last command:

Get-LoggedOnUsers $ServerName | ft -autosize

to

Get-LoggedOnUsers $ServerName | ? { $_.Username -eq ‘kda’ } | ft -autosize

to only see where KDA is loggedon

Problems deleting a old mailbox database

I have a customer, where we have taken over the support from an old supplier, so we don’t know much about their background.

The first thing we do, was to update the Exchange Server.
But after have move all mailboxes, public folders, system mailbox.

I still got this error:

This mailbox database contains one or more mailboxes, mailbox plans, archive mailboxes, or arbitration mailboxes. To ge
t a list of all mailboxes in this database, run the command Get-Mailbox -Database <Database ID>. To get a list of all m
ailbox plans in this database, run the command Get-MailboxPlan. To get a list of archive mailboxes in this database, ru
n the command Get-Mailbox -Database <Database ID> -Archive. To get a list of all arbitration mailboxes in this database
, run the command Get-Mailbox -Database <Database ID> -Arbitration. To disable a non-arbitration mailbox so that you ca
n delete the mailbox database, run the command Disable-Mailbox <Mailbox ID>. To disable an archive mailbox so you can d
elete the mailbox database, run the command Disable-Mailbox <Mailbox ID> -Archive. Arbitration mailboxes should be move
d to another server; to do this, run the command New-MoveRequest <parameters>. If this is the last server in the organi
zation, run the command Disable-Mailbox <Mailbox ID> -Arbitration -DisableLastArbitrationMailboxAllowed to disable the
arbitration mailbox. Mailbox plans should be moved to another server; to do this, run the command Set-MailboxPlan <Mail
boxPlan ID> -Database <Database ID>.

Mailbox Plan is only used on the cloud.

I have look every places, unto i run this command:

dsquery * domainroot -attr * -limit 0 > result.txt

i then open the result.txt in notepad, and found some reference to the old database

msExchDisabledArchiveDatabaseLink: CN=Exch2013MB_Archive,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=Fibia,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=XXXX,DC=local

After delete this reference, i could delete the database.