Exporting TPM Owner Key and BitLocker Recovery Password from Active Directory via PowerShell

11 Replies

Synopsis: When looking up a BitLocker Recovery Password or TPM Owner Key, the process can be quite laborious. This post contains a PowerShell script to help automate the process of manually looking at attributes in Active Directory to pull such information.

Download a copy of the script here (make sure to remove the .txt at the end): Get-TPMandBitlockerInfo.ps1.txt

Run the script with PowerShell

Here are the results it should return

Here is a copy of the script in Plain Text

<#
.SYNOPSIS
    Automates the process on gathering BitLocker recovery password and TPM owner password.

.DESCRIPTION
    This script will lookup multiple attribute in Active Directory and display the correlating
    values that hold sensitive BitLocker information.  Additionally, the TPM Owner Password
    can be exported to a .tpm file, which can be used to make changes to the correlating machine.

.NOTES
    File Name      : Get-TPMandBitlockerInfo.ps1
    Author         : Jack Stromberg (jackstromberg.com)
    Prerequisite   : PowerShell V2 over Vista and upper
    Version History: 2/5/2015 (original release)

.LINK
    Script posted over at:
    http://jackstromberg.com/2015/02/exporting-tpm-owner-key-and-bitlocker-recovery-password-from-active-directory-via-powershell/
#>

clear
Write-Host "~Enter in the correct credentials to access the BitLocker and TPM Owner attributes~"
$UserName = Read-Host "Enter User Name" 
$Password = Read-Host -AsSecureString "Enter Your Password" 
$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $UserName , $Password 

# Get input on which machine to lookup
$computer = Read-Host 'Enter in machine name'

# Import our Active Directory PowerShell commands
Import-Module ActiveDirectory

# Check if the Computer Object exists in AD
$computerObject = Get-ADComputer -Filter {cn -eq $computer} -Property msTPM-OwnerInformation, msTPM-TpmInformationForComputer -Credential $credential
if($computerObject -eq $null){
    Write-Host "Computer object not found.  Exiting the script..."
    Cmd /c pause
	Exit
}

# Windows Vista and 7 stores the TPM owner password in the msTPM-OwnerInformation attribute, check that first.
# If the key hasn't been stored there, check the msTPM-TpmInformationForComputer object to see if it was backed up on a Win 8 or greater machine
if($computerObject.'msTPM-OwnerInformation' -eq $null){
    #Check if the computer object has had the TPM info backed up to AD
    if($computerObject.'msTPM-TpmInformationForComputer' -ne $null){
        # Grab the TPM Owner Password from the msTPM-InformationObject
        $TPMObject = Get-ADObject -Identity $computerObject.'msTPM-TpmInformationForComputer' -Properties msTPM-OwnerInformation  -Credential $credential
        $TPMRecoveryKey = $TPMObject.'msTPM-OwnerInformation'
    }else{
        $TPMRecoveryKey = '<not set>'
    }
}else{
    # Windows 7 and older OS TPM Owner Password
    $TPMRecoveryKey = $computerObject.'msTPM-OwnerInformation'
}

# Check if the computer object has had a BitLocker Recovery Password backed up to AD
$BitLockerObject = Get-ADObject -Filter {objectclass -eq 'msFVE-RecoveryInformation'} -SearchBase $computerObject.DistinguishedName -Properties 'msFVE-RecoveryPassword' -Credential $credential | Select-Object -Last 1
if($BitLockerObject.'msFVE-RecoveryPassword'){
    $BitLockerRecoveryKey = $BitLockerObject.'msFVE-RecoveryPassword'
}else{
    $BitLockerRecoveryKey = '<not set>'
}

#Print out our findings
Write-Host 'TPM Owner Recovery Key:' $TPMRecoveryKey
Write-Host 'BitLocker Recovery Password:' $BitLockerRecoveryKey

# Export TPM Owner Password File
if($computerObject.'msTPM-TpmInformationForComputer' -ne $null){
    $exportToFile = Read-Host 'Would you like to export the recovery key [y or n]'
    if($exportToFile -ne 'y'){
        Exit
    }

    $TPMOwnerFile = '<?xml version="1.0" encoding="UTF-8"?><ownerAuth>' + $TPMRecoveryKey + '</ownerAuth>'
    $TPMOwnerFile | Out-File "TPMOwnerPasswordFile.tpm"
}else{
    Cmd /c pause
}

[Tutorial] Configuring BitLocker to store recovery keys in Active Directory

16 Replies

This guide is more of a reflection on the steps I took to publish the BitLocker recovery keys of machines deployed on an Active Directory domain. Microsoft has gobs and gobs of information on this subject which can be a tad overwhelming, so I have tried to consolidate this article down as much as possible, citing Microsoft sources where found. If you have any questions, comments, feedback, please feel free to leave a message below.

Prerequisites

Domain Controllers are running Windows Server 2003 SP1 or greater
Schema Admin or an Enterprise Admin user account privileges

Step 1: Verify your schema is ready (and extend it if applicable)

Based on what I have read, if your DCs were introduced with Server 2008 Beta 3 or later, your schema will be ready, if you started with anything older, your AD environment will more than likely will not have the schema objects/attributes.

Verify you have the schema changes if running Server 2003 R2 or older:

If you are on Server 2003 you will need to open up ADSI edit and verify you have the schema changes (here you can see we are missing the five schema changes for BitLocker)

Verify you have the schema changes if running Server 2008 or newer:

If you are on Server 2008 or greater and have powershell, you can execute the following command (here you can see we have the necessary schema changes to proceed, if you receive 0 results, you will need to extend your schema):

Get-ADObject -SearchBase ((GET-ADRootDSE).SchemaNamingContext) -Filter {Name -like "ms-FVE-*"}

Extending your schema if you don't have the schema changes above

If you need the schema update (you are missing the five schema objects listed in the above powershell command), you can execute the following command via Command Prompt on your Domain Controller:

Note: If you are on Server 2008 r2, it is recommended you extend your schema to Server 2012 or if you just want the BitLocker attributes, use these two ldf files: https://technet.microsoft.com/en-us/library/jj635854.aspx

ldifde -i -v -f BitLockerTPMSchemaExtension.ldf -c "DC=X" "DC=mydomain,DC=local" -k -j .

Yes, you do want the trailing period (.) at the end of the command. It is literally apart of the command, so ensure you execute the command exactly like above (changing your domain of course). You can see the official technet article here for more information on the command: https://technet.microsoft.com/en-us/library/cc766015(v=ws.10).aspx

If you would like to verify everything went well, Microsoft has posted some output on what the command should write: https://technet.microsoft.com/en-us/library/cc722060(v=ws.10).aspx

Step 2: Set the required permissions for backing up TPM password information

Next, we need to add an access control entry (ACE) so that backing up TPM recovery information is possible.

Head over to the following Microsoft document and download each of the VBS scripts they have displayed: Save the following VBS scripts from the following website: https://technet.microsoft.com/en-us/library/dn466534.aspx#Sample scripts

Ensure you are on one of your domain controllers
Open up a command prompt as an administrator
Navigate to your BitLocker folder
Execute the following command on your domain controller
1. cscript Add-TPMSelfWriteACE.vbs
Delegate msTPM-OwnerInformation
1. Open up Active Directory Users and Computers
2. Navigate to the OU that stores your computers, right click, and select Delegate Control...
3. Click Next > button on the welcome screen
4. Click the Add... button
5. Type in SELF, hit the Check Names button, and click OK
6. Click Next >
7. Select Create a custom task to delegate and click Next >
8. Check Only the following objects in the folder, check Computer objects, click Next >
9. Check Property-specific, scroll down and find Write msTPM-OwnerInformation and click Next >
10. Click Finish

Step 3: Configure group policy to back up BitLocker and TPM recovery information to Active Directory

In this step, we will push out the actual policy that tells the machine to push BitLocker and TPM recovery info to Active Directory. We will try to follow some of Microsoft's best practices on deploying the group policy here: https://technet.microsoft.com/en-us/library/dd875532(WS.10).aspx

Login to your domain controller
In Server Manager, open up Group Policy Management
Select the policy you want to edit/deploy for this and hit Edit...
Expand Computer Configuration, expand Policies, expand Administrative Templates, open Windows Components, and then select BitLocker Drive Encryption

Follow the below configuration for each policy (most of these are Microsoft's best practices with a few notes I have made in the Settings)

[Tutorial] Configuring Lync Server 2013 to block calls based on Caller ID

3 Replies

Synopsis: Out of the box, Lync Server 2013 does not have any way to block specific calls destined to any user or specific user inside of an organization. However, Microsoft added in the ability for users/partners/etc. to write custom scripts to help allow flexibility in Lync. That being said, this tutorial will go over deploying a custom script to allow Lync Server to block calls based on caller ID.

Before we begin, I would like to give credit to a few individuals. This guide will make use of David Paulino's guide/script for Lync Server 2013 (http://uclobby.com/2014/07/31/calleridblock/), which was a converted script from VoIP Norm's original Lync Server 2010 script (http://voipnorm.blogspot.co.uk/2011/06/blocking-calls-in-lync-based-on-caller.html). The only changes in this article is a more step-by-step deployment guide as well as the ability to control blocking of numbers at a user level and the ability to optionally leave comments on why a rule was added.

Tutorial

Download a copy of the CallerIDBlock.am.txt script (or copy and paste this script into a file called CallerIDBlock.am) (if you downloaded this file, make sure you remove the .txt at the end)
1. <?xml version="1.0" ?> <lc:applicationManifest lc:appUri="http://jackstromberg.com/2015/02/CallerIDBlock" xmlns:lc="http://schemas.microsoft.com/lcs/2006/05"> <lc:requestFilter methodNames="ALL" strictRoute="true"/> <lc:responseFilter reasonCodes="NONE"/> <lc:scriptOnly/> <lc:file name="BlockedTelephoneNumbers" path="\\<Lync Share Path>\CallerIDBlock\BlockedTelephoneNumbers.txt" delimitedBy="comma" keyColumnName="FromSIP" static="false"> <lc:column name="FromSIP" /> <lc:column name="ToSIP" /> <lc:column name="Action" /> <lc:column name="Comments" /> </lc:file> <lc:splScript><![CDATA[/*
  Module Name: CallerIDBlock.am
  */if(sipRequest.Method == "INVITE"){
  fromSIPUser = GetUserName(GetUri(sipRequest.From));
  toSIPUser = GetUserName(GetUri(sipRequest.To));
  sep = IndexOfString(fromSIPUser, ";");Log ("Debugr", false, "CallerIDBlock processing request:");
  Log ("Debugr", false, "From - ", fromSIPUser);
  Log ("Debugr", false, "To - ", toSIPUser);
  if(sep != -1) {
  fromSIPUser = SubString(fromSIPUser, 0, sep);
  }
  
  action = BlockedTelephoneNumbers[fromSIPUser].Action;
  if(action == "block") {
  if(BlockedTelephoneNumbers[fromSIPUser].ToSIP == "*" || BlockedTelephoneNumbers[fromSIPUser].ToSIP == toSIPUser){
  Log ("Debugr", false, "Rejected by CallerIDBlock");
  Respond(403, "Forbidden");
  }
  } else {
  Log ("Debugr", false, "Allowed by CallerIDBlock");
  }
  }
  return;
  ]]></lc:splScript>
  </lc:applicationManifest>
Download a copy of the BlockedTelephoneNumbers.txt file (or copy and paste the code below into a file called BlockedTelephoneNumbers.txt)
1. FromSIP,ToSIP,Action,Comments
Edit the CallerIDBlock.am file and change the BlockedTelephoneNumbers path to be your fileshare
Edit the list of blocked numbers inside the BlockedTelephoneNumbers.txt file
1. Notes: The FromSIP address is the Caller ID of the incoming call; the ToSIP is the individual that is trying to be reached (side-note, in this particular script, if you set this field so an asterisk (*), this will be a wildcard for any/every user; the Action should be set to "block" to block the call; the Comments field is an optional field to document when/why the number was added to be blocked
Create a new folder where your Lync share is
Copy the CallerIDBlock.am and BlcokedTelephoneNumbers.txt files to your Lync Share where your new CallerIDBlock folder is
Add the CallerIDBlock script as a Lync Server Application
1. Open up the Lync Server Manage Shell as an Administrator
2. New-CsServerApplication -Identity "Service:Registrar:<Lync Front End Pool>/CallerIDBlock" -Uri http://jackstromberg.com/2015/02/CallerIDBlock -Critical $false -ScriptName "\\<Lync Share Path>\CallerIDBlock\CallerIDBlock.am"
Enable the CallerIDBlockLync Server Application
1. Set-CsServerApplication -Identity "Service:Registrar:<Lync Front End Pool>/CallerIDBlock" -Enabled $true
Verify the script is actively listening for calls
1. Open up Event Viewer, navigate to Applications and Services Logs, Lync Server, and verify you see Event ID 30208

Upgrading DirSync to AADSync for Office 365 and Azure environments

7 Replies

As of 11/11/2014, Microsoft has released their next generation tool for providing synchronization between an on-premise Active Directory environment and Microsoft based cloud service (Azure, Office 365 Suite (Lync Online, CRM, SharePoint, Exchange, etc.)). The utility is now referenced as Microsoft Azure Active Directory Sync Services (AADSync).

In this tutorial, we will go over the process to ensure you are on the new generation of their synchronization tool. The process is fairly straight forward, uninstall the old DirSync utility, install the new AADSync utility. If you wish to install the utility on a new server, stop the DirSync service, install the AADSync utility on the new server, and then uinstall DirSync after you have verified synchronization is successful on the new machine.

Here is the uninstall DirSync and install AADSync process

Download a copy of the AADSync utility from Microsoft's website: http://www.microsoft.com/en-us/download/details.aspx?id=44225
Login to the server currently running DirSync
Open up Control Panel
Select Programs and Features (notice I am in the View By Small icons view)
Uninstall the Windows Azure Active Directory Sync tool
Select Yes to uninstall when prompted
Uninstall Forefront Identity Manager Synchronization Service if it wasn't uninstalled already
Run the MicrosoftAzureADConnectionTool.exe application you downloaded from Microsoft
Check I agree to the license terms and click Install
Once the install has finished, open up Computer Management and navigate to System Tools -> Local Users and Groups, Groups, and double click on ADSyncAdmins
Ensure your user account, user group, or local machine has been added to the security group
Log out of Windows
1. Note: This step is needed to ensure you have proper user privileges when running the sync tool. When running through the sync tool's installer, your user account will automatically be placed in a local security group called ADSyncAdmins. A logout is needed to update your session otherwise you may receive the following error message:
  Your account is not a member of the ADSyncAdmins security group. If you have recently installed Azure AD Sync, sign out before running this installation guide again.
Upon login, open up the DirectorySyncTool application
Enter your Azure or Office 365 admin credentials and click Next
Enter in your forest name, username (must be in domain\username format), and password (Active Directory on-premise credentials) and click Add Forest
1. Note: If you are unsure what your forest name is, login to your domain controller and execute the following powershell command to list all forests in your deployment:
  Get-AdForest | FT Name
Click Next once your forest has been validated
Click Next on User Matching
Check the boxes that are applicable to your deployment and click Next
Click Configure
Click Finish

How to administratively forward Lync calls or numbers

1 Reply

Scenario: A user leaves the organization and you would like to forward their number/calls to a manager.

Solution: Microsoft has a Lync Server 2013 (and 2010) Resource Kit that contains a command-line tool called SEFAUtil (secondary extension feature activation) which can be used to achieve this task. Before beginning, I would recommend taking a look at the official TechNet article/documentation on the utility itself: http://technet.microsoft.com/en-us/library/jj945604.aspx In this tutorial, we will download the tool and execute the proper commands to configure call forwarding for a specified user.

Download a copy of the Lync Server 2013 Resource Kit from Microsoft's website here: http://go.microsoft.com/fwlink/p/?LinkID=330429
Run the installer from your Front End Server/Pool
Create a trusted application pool
1. Execute the following command
  1. $Site=Get-CsSite -Identity "My Site"
    1. Note: If you don't know what to substitute for My Site, execute the following command to see what sites you have available and then use the Identity value.
      1. Get-CsSite
  2. Execute the following command
    1. New-CsTrustedApplicationPool -id <Pool FQDN> -Registrar <Pool Registrar FQDN> -site $Site.SiteID
      1. Note: Technically we didn't need to run the 1st command, however this can help cut-down on user error. Additionally, if you have multiple sites and you knew what site you wanted to use but not the ID, this helps skip a step.
Define SEFAUtil as a trusted application in the Lync topology
1. Execute the following command
  1. New-CsTrustedApplication -ApplicationId sefautil -TrustedApplicationPoolFqdn <Pool FQDN> -Port 7489
Enable the Lync topology to commit the changes
1. Enable-CsTopology
Forward a user's number
1. Navigate to %ProgramFiles%\Microsoft Lync Server 2013\ResKit
2. Execute the following command
  1. SEFAUtil.exe /Server:<Pool FQDN> [email protected] /enablefwdimmediate /setfwddestination:[email protected]

That should be it!

Note: If you are more comfortable using a GUI or don't wish to type in multiple powershell commands, I would highly recommend checking out Johan Veldhuis's SefaUtil GUI PowerShell script. Once you are done following steps 1-5 above, you you can grab a copy of the script here: http://johanveldhuis.nl/sefautil-gui/sefautil-gui/

[How-To] Import large .sql file into MSSQL (Microsoft SQL) Server

[How-To] Upgrade the firmware on a Dell PowerConnect N2000/3000 series switch

6 Replies

Download the latest firmware from Dell's website
1. Navigate to http://www.dell.com/support/ and enter in your service tag. You should see downloads for this product, grab the latest firmware that is in a zipped folder.
Extract the .zip folder of the firmware
Console into the switch via SSH or direct console
Copy the current configuration to startup
1. console#> copy running-config startup-config
Transfer the firmware to the switch
1. TFTP Method
  1. console#> tftp://N3000_2000v6.1.2.4.stk backup
2. USB Method (Directly attached to switch)
  1. console#> usb://N3000_2000v6.1.2.4.stk backup
Verify the backup version is the new build
1. console#> show version
Activate the new firmware
1. console#> boot system backup
Reboot the switch
1. console#> reload
Verify the build is now up-to-date
1. console#> show version
Update the boot code
1. console#> update bootcode
Reboot the switch
1. console#> reload

That should do it!

Office 365 - Renew your certificates (on-premise ADFS) alert

1 Reply

Symptom: After you replace your SSL certificates on your ADFS servers you continue to receive the following alert inside of the Office 365 portal.

Renew your certificates
One of your on-premises Federation Service certificates is expiring. Failure to renew the certificate and update trust properties within XX days will result in a loss of access to all Office 365 services for all users. Update now

Solution: This error can be caused if any of the three primary SSL Certificates that are required to federate to an external identity are nearing their experation date (Service Communications, Token-decrpting, and Token-signing).

Verify which SSL certificate is about to expire

Login to your primary ADFS server
Open up Server Manager
Select Tools -> AD FS Management
Under AD FS expand Service and select Certificates
Verify if any certificates are set to expire
1. Note: In this case, you can see the Token-decrypting and Token-signing certificates are set to expire soon

Replace the expir(ed)(ing) certificates

Unfortunately, I don't currently have a tutorial on the processes behind replacing each certificate. The process for replacing each certificate is a tad different. Here are a few articles that might help you:

Replacing the Service Communication certificate: http://blogs.technet.com/b/tune_in_to_windows_intune/archive/2013/11/13/replace-certificates-on-adfs-3-0.aspx

Replacing the token-signing and token-decrypting certificates can be found here: http://social.technet.microsoft.com/wiki/contents/articles/2554.ad-fs-2-0-how-to-replace-the-ssl-service-communications-token-signing-and-token-decrypting-certificates.aspx#Replacing_the_Token-Signing_certificate

Update the federated trust with Office 365

Once your certificates are not nearing their experation date, open up the Windows Azure Active Direcotry Module for Windows PowerShell as an administrator
1. Note: Installation instructions and the download for this can be found here: http://technet.microsoft.com/en-us/library/jj151815.aspx
Execute the following command
1. Connect-MsolService
  1. Note: Enter in your Office 365 administrator credentials on this step
Execute the following command
1. Update-MsolFederatedDomain -DomainName mydomain.com -SupportMultiDomain
  1. Note: Replace mydomain.com with your federated domain. If you have multiple domains you are federating with Office 365, add the optional -SupportMultiDomain paramter as well

[Tutorial] Deploying a reverse proxy for Lync Server 2013

[Tutorial] How to install IIS on Server 2012 and Server 2012 R2

1 Reply

Here is a tutorial on how to install IIS on Server 2012 and Server 2012 R2. The installation process for this is very straight forward and does not differ much from Server 2008 R2. This guide will only go over the basic install, additional configuration of IIS is outside the scope of this tutorial. Before beginning, you can choose to install IIS via PowerShell or the GUI. Either option will result with the exact same configuration.

PowerShell

Open an elevated PowerShell console
Execute the following command
1. Install-WindowsFeature -Name Web-Server, Web-Mgmt-Tools
  1. Note: Web-Mgmt-Tools is optional, but in most instances added to get the Internet Information Services (IIS) Manager GUI snap-in to manage IIS

GUI

Open Server Manager
Click on Manage - Add Roles and Features
Click Next > on the Before You Begin screen
Click Next > on the Installation Type screen
Click Next > on the Server Selection screen
Select Web Server (IIS) from the list on Server Roles and click on the Add Features button once prompted. Click Next >
Click Next > on the Features screen
Click Next > on the Web Server Role (IIS) screen
Click Next > on the Role Services screen
Click Install on the Confirmation screen