Code Snippets

Get-ADUser -Properties msDS-SupportedEncryptionTypes -Filter * | Where-Object { $_.Enabled -and $_."msDS-SupportedEncryptionTypes" -ne $null -and $_."msDS-SupportedEncryptionTypes" -ne 0 -and ($_."msDS-SupportedEncryptionTypes" -band 0x18) -eq 0 } Get-ADComputer -Properties msDS-SupportedEncryptionTypes -Filter * | Where-Object { $_.Enabled -and $_."msDS-SupportedEncryptionTypes" -ne $null -and $_."msDS-SupportedEncryptionTypes" -ne 0 -and ($_."msDS-SupportedEncryptionTypes" -band 0x18) -eq 0 }

Set-User kevin.schweiger -AuthenticationPolicy "Allow Modern Auth"

Set-OrganizationConfig -DefaultAuthenticationPolicy "Block Modern Auth" Set-OrganizationConfig -OAuth2ClientProfileEnabled $true

New-AuthenticationPolicy "Block Modern Auth" -BlockModernAuthWebServices -BlockModernAuthActiveSync -BlockModernAuthAutodiscover -BlockModernAuthImap -BlockModernAuthMapi -BlockModernAuthOfflineAddressBook -BlockModernAuthPop -BlockModernAuthRpc New-AuthenticationPolicy "Allow Modern Auth" New-AuthenticationPolicy "Allow ONLY Modern Auth" -BlockLegacyAuthImap -BlockLegacyAuthActiveSync -BlockLegacyAuthOfflineAddressBook -BlockLegacyAuthRpc -BlockLegacyAuthWebServices -BlockLegacyAuthAutodiscover -BlockLegacyAuthMapi -BlockLegacyAuthPop

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos] "KdcProxyServer_Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\KdcProxy\ProxyServers] ".schweigerstechblog.de"="<https kdc.schweigerstechblog.de:443:kdcproxy />" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\KdcProxy\ProxyServers] ".schweigerstechblog.local"="<https kdc.schweigerstechblog.de:443:kdcproxy />"

$kdcCert = "schweigerstechblog.de" ### SET ROOT DOMAIN $kdcFQDN = "kdc.schweigerstechblog.de" ### CHANGE TO YOUR PUBLIC DOMAIN $kdcPort = 443 ### IT’S NOT RECOMMENDED BUT YOU CAN CHANGE THE PORT Install-WindowsFeature -Name Web-Scripting-Tools, Web-Mgmt-Console Import-Module -Name WebAdministration $setACL = ’netsh http add urlacl url=https://+:{0}/KdcProxy user="NT AUTHORITY\Network Service"‘ -f $kdcPort cmd /c $setACL $kdcCertObject = Get-ChildItem -Path...

$contactItems = @() $outlook = New-Object -ComObject Outlook.Application $namespace = $outlook.GetNamespace("MAPI") $contactFolders = ($namespace.Folders | where {$_.Folderpath -like "*Outlook-Datendatei*"}).Folders foreach($contactFolder in $contactFolders){ foreach($contact in $contactFolder.Items){ try{ $contactBirthdayOld = $null $contactBirthdayOld = $contact.PropertyAccessor.GetProperty("http://schemas.microsoft.com/mapi/proptag/0x3A420040") #PidTagBirthday }catch{ # Nothing to do here } if($contactBirthdayOld -ne $null -AND $contactBirthdayOld -notlike ""){ $contactCreationTime = $contact.PropertyAccessor.GetProperty("http://schemas.microsoft.com/mapi/proptag/0x30070040") #PR_CREATION_TIME $contactBirthdayNew = $contact.Birthday try{...

C:\Users\kschweiger>klist Current LogonId is 0:0x1ec5e67d Cached Tickets: (1) #0> Client: kschweiger @ TEST.SYSTEMS Server: krbtgt/TEST.SYSTEMS @ TEST.SYSTEMS KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96 Ticket Flags 0xe10000 -> renewable initial pre_authent name_canonicalize Start Time: 2/21/2025 20:16:48 (local) End Time: 2/22/2025 6:16:48 (local) Renew Time: 2/28/2025 20:16:48 (local) Session Key Type: AES-256-CTS-HMAC-SHA1-96 Cache Flags: 0x1 -> PRIMARY Kdc Called:...

### .NET Framework 4.X Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" -Name "SystemDefaultTlsVersions" -Value 1 -Type DWord Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" -Name "SchUseStrongCrypto" -Value 1 -Type DWord Set-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319" -Name "SystemDefaultTlsVersions" -Value 1 -Type DWord Set-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319" -Name "SchUseStrongCrypto" -Value 1 -Type DWord ### .NET Framework 3.X Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" -Name "SystemDefaultTlsVersions" -Value 1 -Type DWord Set-ItemProperty -Path...

{ "aud": "6ae19765-6bce-47fe-ab39-fea801fba272", "iss": "https://auth.schweigerstechblog.de/adfs", "iat": 1697447965, "nbf": 1697447965, "exp": 1697451565, "auth_time": 1697447577, "sub": "K9aaS9eMkJiUcrEoaTbXZR90U99U7HlxSKa5CQ2s7oc=", "upn": "kschweiger@schweigerstechblog.de", "unique_name": "SWT\kschweiger", "pwd_url": "https://auth.schweigerstechblog.de/adfs/portal/updatepassword/", "sid": "S-1-5-21-988405549-3412143714-2819284977-3374", "EmployeeID": "01", "Department": "Blogging", "apptype": "Confidential", "appid": "6ae19765-6bce-47fe-ab39-fea801fba272", "authmethod": "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport", "ver": "1.0", "scp": "openid" }