Combine ADfind and PowerShell

I really love adfind.exe (http://www.joeware.net/freetools/tools/adfind/index.htm) to search in AD and AD LDS, also if not all these machines part of AD or a different AD. Especially the CSV export is really powerful and so I was wondering how I can feed the adfind CSV output directly in a PowerShell array for further processing.


PS C:\System> $content= (tools\adfind -h dir.server.com:389 -b "o=mycompany" -u "username" -up "userpass" -maxe 25 -csv -csvdelim "|" -f "(objectclass=*)" cn | ConvertFrom-Csv -delimiter "|" )

So the command line above will run adfind to search for all entries on dir.server.com regardless what the object class is, but it will only return the first 25 entries. You can adjust the maxe option. I am working on mostly larger projects so I found the 25 entries limitation convenient and time saving.
Then all results will be available in the content array for further processing with PowerShell, e.g. counting, sorting, check for duplicates on specific attributes, ... ,you name it.

Welcome MIM

Welcome Microsoft Identity Manager!

after MMS, MIIS, CLM, ILM and FIM we got a new acronym: MIM - Microsoft Identity Manager.

http://blogs.technet.com/b/server-cloud/archive/2014/04/23/forefront-identity-manager-vnext-roadmap-now-microsoft-identity-manager.aspx

Perhaps because I never understood why it was called Forefront .. Microsoft thought simpler is better.
So then the only question is why FIM did become MIM and not CIM - Cloud Identity Manager. Perhaps one day we all have just one ID in the cloud and there is no need for  identity management anymore. Nice dream.

.

Network Discovery for Dummies

As a consultant I work several client projects over the year and sometimes I do not get a good/meaningful documentation before I start. Some environments are even so restricted that I cannot install tools or that I have to survive with a regular user account until I get clearance for a domain admin account.
So I checked out what built-in tools I could use on a Windows machine to do a basic discovery of the IT eco system.

1. Either I can connect my laptop or I get a machine fro the client and so I can run a command prompt and see the IP configuration with ipconfig.

2. Run ipconfig again with the /all parameter and find out the primary DNS suffix (what is most likely the DNS name of AD), here in this example it is frontoso.co

nslookup -querytype=SRV _ldap._tcp.dc._msdcs.frontoso.com

Nslookup should give you a list of all domaincontrollers of frontoso.com

3. Now I want see what other machines areound me in the same subnet.

The FOR /L command will fire up a ping command for each IP address in the range (10.0.1.1 - 10.0.1.250). Depending on the subnet this can be adjusted. We use it only to get the mac addresses in from the arp cache and if you scan more then the subnet range you will not get more hits from the arp cache.

 so run FOR /L %v IN (1,1,250) DO start ping -n 1 10.0.1.%v from the command line

and then arp -a to see all entries from the arp cache

Example
Interface: 172.16.32.15 --- 0xa
  Internet Address      Physical Address      Type
  172.16.32.1           54-75-d0-e2-c5-42     dynamic
  172.16.32.8           00-15-5d-20-08-35     dynamic
  172.16.32.9           00-14-5e-45-6e-25     dynamic
  172.16.32.10          68-ef-bd-93-82-04     dynamic
  172.16.32.11          00-15-5d-20-0e-32     dynamic
.....


So event ping was not working because ICMP is disabled on the target machine the arp cache entry exist.
The mac address tells you also the vendor of the network card, so sometime this helps, e.g. in the example above all 00-15-... machines are virtual machines on Microsoft Hyper-V.

4. If you want the server names use ping -a to ask DNS for a reverse DNS resolution. Server names can tell a lot, e.g about location and purpose depending on the naming convention.

FOR /L %v IN (1,1,250) DO ping -a -n 1 10.0.1.%v > pinga.txt

5.  If you just want check that you can access a SMB share through a firewall you can use

net use \\IPorServername\ipc$

even you do not have permissions to access the share, then you get an access denied message. But this tells you also that the firewall is mot likely not preventing SMB traffice to that machine.

Hope that helps,
Lutz

Creating a IPSEC tunnel with the Windows Firewall with Advanced Security

Windows provides a very simple way to establish a secure communication (IPSEC) between two machines on the machine level: Connection Security Rules.

Connection Securiy Rules allow the configuration of a encrypted communication even a user is not logged on. The IPSEC rule can use a preshared key (for testing, single server or you do not have a PKI) or digital certificates for authentication in an enterprise environment Using certificates is the best way for authentication and my recommendation.

The computer and the users have still to authenticate before they can use any service on a IPSEC protected host, so see IPSEC as an pre-authentication.

Use scenarios:

- You want allow only access from corporate laptop computers to Exchange Outlook Anywhere or other internal services directly, or over TMG or UAG

- You have a server externally hosted and you want have a more secure way to RDP in

- You want allow access to a file share for remote workers in a way they do not have to VPN-in all the time

- You want make sure that computers for remote worker can use the corporate WSUS server for patching even the machines are not connected back via VPN to corporate network

- ...

Requirement:

- Windows Firewall service must be running

- Windows Firewall profiles must be active the network profile(s)

- Firewall rules must allow IPSEC traffic ESP and UDP500(ISAKMP). UDP4500(IPSEC NAT-T) is required if the server is behind a NAT firewall (as it is in this example)

Note: You can require IPSEC also only for certain TCP ports, e.g. you have an externally hosted web server. Require IPSEC only for 3389(RDP) for web server administration but port 80 is open because you clients want surf your companies public web site.And make all other ports not available from outside of that server at all.

Client Configuration Steps

The client configuration can be done using the Advanced Windows Firewall management console (wf.msc) or via group policy. In this post i use the group policy.

1.       Open Group Policy Management

2.       Navigate to Computer Configuration/Policies/Windows Settings/Security Settings/Windows Firewall with Advanced Security/ Windows Firewall with Advanced Security/Connection Security Rules

Note: as alternative and for testing you can also start the Windows Firewall management console by starting wf.msc from the Run dialog.

3.       Make a right mouse click on Connection Security Rules and click on New Rule…

4. Select Server-to-server as rule type and click Next.

5.   Add the public IP address of the edge server to the list of IP addresses under “Which computers are in Endpoint 2?” Then select Next to continue.

6.       Select and then click Next.

7. Click Browse and select the appropriate CA name. Then click Next.

8. Select all firewall profiles and click Next.

9. Enter name and description of the rule. Then click Finish to end the configuration wizard.

Server Side Configuration Steps

The server must have a second network card for external facing connections. The configuration of the IPSEC rules should be for this interface, otherwise you might lose the network connection to the server.

1. Start the Windows Firewall Advanced Configuration management console from the Run menu by running wf.msc.

2. Click on Connection Security Rules and then New Rule …

3. Select Server-to-server and click Next.

4. Add the server IP address to the list of IP address under “Which computers are in Endpoint 2?” and click Next to continue.

5. Select Require authentication for inbound and outbound connections and then click on Next.

6. Click Browse and select the appropriate CA name. Then click Next.

7. Select all firewall profiles and click Next.

UAG 2010 Migration from NLB to Hardware Load Balancer

As many other companies we got some pressure to migrate from TMG to UAG because of Microsoft's decision to discontinue TMG. We use the system solely for application publishing.
We brought up a UAG array with 2 nodes with NLB, both running on Vmware vSphere. From the beginning those servers had some issues seeing or not seeing each other so we opened a ticket with Microsoft. They insisted/highly recommended to run the NLB in uni-cast mode and to make settings in Vmware according to this article http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1556.

Vmware is saying to support uni-cast you have to run both machines on the same virtual network switch on the same host.
WOW, so what is then the purpose of having the array if on physical node fails, all will fail?

Okay so we have a hardware load balancer as well, so lets move from NLB to HW LB. I did some research how to do that and basically found nothing. Nothing else then saying a migration will not work. Bummer.
So one disadvantage of not using NLB is that you need more IP addresses, because then each UAG trunk node needs two (if you have 2 servers) IP addresses.
Trying to remove the NLB cluster was not working because the IP addresses were still in use from UAG. And you cannot add new IP addresses to the interface used from NLB.
To work around those issues I added to each internal interface private IP addresses for the time of migration, then I changed the trunk configurations to use the temporary addresses (caused a service unavailability of course) and then I removed NLB using the UAG management console..
The rest was easy. Adding old plus the new external IP addressed to the UAG array members and reconfigure the UAG trunks to use these. Then change the DNS name from the NLB cluster IPs to the hardware load balancer IPs.
Now I have only to make sure that the UAG array nodes are not running on the same hardware. :-)

P.S. And yes, the hardware load balancer is high available as well.

Perfect Forward Secrecy (PFS) for IIS, TMG and UAG (and other services)

Traditionally during a client and a server establishes a SSL/TLS session they exchange a secret to protect this session. This secret is the same for all sessions established using the same certificate private key.

SSL web browser - server handshake (simplified):
1. Browser opens a connection to https://www.mywebsite.com
2. Server sends its public certificate
3. Web browser runs certificate verification and sends a message encrypted with the servers public key back
4. Web browser creates a secret session password
5. Server acknowledges the secret session password

If a attacker gets access to the web server's private key he can reveal the password and decrypt a previously recorded session.
That is where PFS is stepping in using Diffie-Hellman. Diffie-Hellman is a "magic" algorithm where 2 communication parties can create a secret without ever sending the secret over the wire. So even the attacker has the private key he cannot re-create the session password.

Quick facts:

- Perfect Forward Secrecy helps to mitigate attacks, when the attacker has access to the web server's private key and has a recording of previous sessions.
- PFS is not supported on all platforms and devices, but it seems we have reached a large enough volume and for legacy clients you should keep accepting at least one of the non-PFS ciphers.
- PFS has a performance overhead of 15 percent (in best case) depending on the exact cipher, depending on the overall traffic on your website this is a small or big number


Windows settings e.g. for IIS as reg file (update 11/15/2013):


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL]
"EventLogging"=dword:00000001
"DisableRenegoOnClient"=dword:00000001
"DisableRenegoOnServer"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 128/128]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\AES 256/256]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168/168]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\CipherSuites]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5]
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS]
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]
"DisabledByDefault"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
"Enabled"=dword:00000000
"DisabledByDefault"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
"Enabled"=dword:ffffffff
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]
"Enabled"=dword:ffffffff
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client]
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server]
"DisabledByDefault"=dword:00000000
"Enabled"=dword:ffffffff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client]
"DisabledByDefault"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server]
"DisabledByDefault"=dword:00000000
"Enabled"=dword:ffffffff


[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002]
"Functions"="TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P521,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P521,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P521,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P521,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA"

To test you web server I recommend:

Qualys SSL Labs - https://www.ssllabs.com/ssltest/

For further reading:

Vincent Bernat about PFS including performance benchmarks - http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html

Wikipedia article about PFS - http://en.wikipedia.org/wiki/Perfect_forward_secrecy

GUI for changing Windows SSL settings - https://www.nartac.com/Products/IISCrypto/Default.aspx

Diffie- Hellman - http://en.wikipedia.org/wiki/Diffie-Hellman

Bitlocker Data Recovery Agent Certificate

Microsoft BitLocker supports Data Recovery Agents in Windows 7 and above.
That is a great way for large organizations to ensure that the corporate IT or Information Security has access to data for if the individual pass-phrase recovery is not working and for forensics.

To setup a Data Recovery Agent you can follow Microsofts blog post http://blogs.technet.com/b/askcore/archive/2010/10/11/how-to-use-bitlocker-data-recovery-agent-to-unlock-bitlocker-protected-drives.aspx

If you do not see the BitLocker Drive Encryptin and BitLocker Data Recovery Agent extended key usage (EKU) listed in the GUI install the BitLocker feature on your management machine. Even feature installation does not require a reboot, you will not see the EKU showing up in the last until you do so.

If you Certification Authority is running on Windows 2003 you have to add the EKUs manually. For this you need the OIDs, here you go.

Bitlocker Drive Encryption - 1.3.6.1.4.1.311.67.1.1

Bitlocker Data Recovery Agent - 1.3.6.1.4.1.311.67.1.2