Install AzureADPasswordProtection - EIDP / EIDPP

 

Import-Module AzureADPasswordProtection

Get-Service AzureADPasswordProtectionProxy | fl

Register-AzureADPasswordProtectionProxy -AccountUpn 'yourglobaladmin@yourtenant.onmicrosoft.com'

Register-AzureADPasswordProtectionProxy -AccountUpn 'yourglobaladmin@yourtenant.onmicrosoft.com' -AuthenticateUsingDeviceCode

$scp = "serviceConnectionPoint"

$keywords = "{ebefb703-6113-413d-9167-9f8dd4d24468}*"

Get-ADObject -SearchScope Subtree -Filter { objectClass -eq $scp -and keywords -like $keywords }

$scp = "serviceConnectionPoint"

$keywords = "{2bac71e6-a293-4d5b-ba3b-50b995237946}*"

Get-ADObject -SearchScope Subtree -Filter { objectClass -eq $scp -and keywords -like $keywords }

EIDC/AADC - Entra Connect installation

 

0xCAA80000 during Entra Connect installation - after authentication - on a fresh Windows 2022 Server, tests:

Test-NetConnection login.microsoftonline.com -Port 443

Invoke-WebRequest https://login.microsoftonline.com

The second test - result - IE Enhanced Security - after disable and restart of installation I'm further

CertPropSvc is not starting - 3534 error

 Windows 11 - 3 laptops,  (L1) 1st old - not updating with new Windows 11, (L2) second dell 7310 and the third (L3) - 7320. The same smart card reader - OmniKey  3121 SC (but not important), the same smart card - on L1 and L2 card appears in device manager but not on L3 - smartcard reader is visible on all three. 

Finally - Certficate Propagtion Service is not started on L3. No errors in System eventlog, after startup try - no errors only 3534. Compared registries between three of them, files are present. 

Solution? 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CertProp] "CertPropEnabled"=dword:00000001

get-aduser with filter - missing attributes

A forest, 40 domains, one attribute, let's assume 'attribute-N'. Attribute was deprecated (isDefunct=True), now is visible again. near 40k user objects have this value set - boolean type, not system, in global catalog (SearchFlags=1). When I was looking for I got 40k objects. After clear no instances. 

After that I undeleted user object with this attribute and again looking for objects with attribute-N in a domain and in the forest (global catalog) - I received no answers. Get-ADUser for this single objects returns attribute value. Looking for with Get-ADObject - also no return. 

Finally, when I added value to my user object - I can find by searching in the domain and in the forest. Is there a limit of 1 instance per domain or the forest when I can find objects? 

Yes, I must have minimum 2 instances to look for objects. 

password rotation in ADFS

 ADFS farm, configuration in dedicated SQL database, standard service accounts in Active Directory, how to rotate passwords? Nothing unexpected:

• change password on account in Active Directory
• change on every node of the farm - in service configuration (through services.msc)
• restart
• low risk of account lockout - my personal preference - do it on Wednesday or Thursday evening - when most of customers do not use it actively

LSASS Schema Cache

 Interesting - every time, when I'm modifying schema there is a gap when I can't see changes from perspective of tools. For example - I'm adding new attribute and this attribute will be available after a small gap - 5-15 minutes before it will be available. Is it Schema Cache? 

Or maybe Schema Management Thread (ntdsai.dll)?

After hide of one of attributes in Powershell I can still query for this attribute and magically - after 5-15 minutes it just disappears...

schema isDefunct - hide attribute

 First test deactivation of attribute:

• created custom attribute - emptyAttribute1 (ldap emptyAttr1), some oid, OMx 64
• custom attribute added to class User (I know, it should be auxiliary class)
• few user objects created - few of them with this attribute populated
• all test accounts deleted - moved to trash - recycle bin
• all restored - without issue
• all test accounts deleted again - in recycle bin 
• isDefunct = True set on attribute 
• I can't restore them

Second test undelete:

• try to add mayContain in user class - error 0x57 - error in attribute conversion
• 00000057: LdapErr: DSID‑0C090EBF, comment: Error in attribute conversion operation
• isDefunct cleared (means False)
• few errors - but finally success - maybe I must close dialog boxes - they have their own cache - cache of threads connected with dialog boxes
• now attribute is in class... lets try to recover objects - still error with user objects with attribute unhidden
• attribute is not reachable from ADUC, but from Powershell is visible, can be set
• ok - finally I can restore object 
• can I defunct attribute now? no, I have 2 objects with this value...
• 0x20C2 (WILL_NOT_PERFORM) + data 8386 → „attribute is used in may‑contain”
• - let's try to clear the value... cleared - still can't defunct, let's populate it again and try to remove from may contain
• removed from maycontain - it is possible with objects with this value
• now isDefunct=TRUE is possible - objects still have this value
• I can change value of attribute that is already set
• ok, now I have error in Powershell - parameter is incorrec - so I should wait - even in lab with the single server
• objects have been deleted, isDefunct=TRUE, in theory they don't have attributes set - before removal - no attributes visible, even from Powershell
• isDefunct cleared  - can I restore object? no, I must add to mayContain
• I can't add to mayContain - error in attribute conversion... why? dialog boxes or Search Flags? 
• Bingo! searchFlags must be cleared - now I can add to mayContain, can I recover accounts?
• yes - 5 minutes waiting - accounts undeleted

Summary:

• to recover objects with isDefunct attributes
• clear isDefunct in attribute
• clear SearchFlags in attribute
• add attribte to mayContain in class
• wait 5 minutes (in lab)
• recover

Observation - important:

• objects can have values in attributes not active anymore - attributes in state inDecfunct=TRUE, class mayContain - cleared with these attributes