Information provided by Microsoft explaining why this is important
–
The original script written by Jared Poeppelman, who works for Microsoft.
–
This script can be downloaded through the following link:
–
WARNING:
- DO NOT CHANGE THE SCRIPT IN ANY WAY, EXCEPT TO SUPPORT ANOTHER LANGUAGE AS EXPLAINED!
- MAKE SURE TO TEST THIS FIRST IN YOUR TEST/LAB ENVIRONMENT!!!
- DO NOT RESET THE PASSWORD OF THE PROD/REAL KRBTGT ACCOUNT(S) AFTER BEING WARNED ABOUT ANY IMPACT!
- BY THE WAY: YOU ARE ON YOUR OWN IF YOU SCREW UP AND DO NOT FOLLOW GUIDELINES!
–
As soon as the script starts you see a question if you want to see extensive information about the script, its behavior and impact. READ IT, therefore type YES. Typing NO, skips all that information, which is NOT recommended!
Figure 1: All Kinds Of Information About The Script And Anything Related To It
–
Assuming you typed YES, press any key to continue twice – more info is presented!
Figure 2: All Kinds Of Information About The Script And Anything Related To It
–
Assuming you typed YES, press any key to continue twice – more info is presented!
Figure 3: All Kinds Of Information About The Script And Anything Related To It
–
Assuming you typed YES, press any key to continue twice – more info is presented!
Figure 4: All Kinds Of Information About The Script And Anything Related To It
–
–
MODE 1 – Informational Mode (No Changes At All)
Here you get to choose the mode you want to executed…
Figure 5: Choosing The Mode Of Operation: “Mode 1 – Informational Mode (No Changes At All)”
–
The script presents information about the AD forest you are in such as the forest functional level (FFL), and all the AD domains detected, if it is the AD forest root domain, its domain functional level (DFL) and if it is the current AD domain. The current AD forest and AD domain are determined based upon the computer you are executing the PowerShell on.
To select an AD domain, you enter the FQDN of the chosen AD domain, or press [ENTER] for the current AD domain. Any AD domain specified is checked to see if it indeed exists in the AD forest.
Then a check is done to see if the account that is executing the PowerShell script either has Domain Admins membership (only if for the current AD domain) or it has Enterprise Admins membership (only if any other AD domain in the AD forest than the current AD domain)
Figure 6: Specifying An AD Domain To Target
–
For the chosen AD domain again all kinds of information is displayed, such as domain functional level (DFL), the RWDC with the PDC FSMO role and a full list of RWDCs and if applicable also a full list of RODCs. For every DC various information is displayed and if any DC is reachable or unreachable. Reachability is determined by checking both port TCP:135 (RPC Endpoint Mapper) and port TCP:389 (LDAP). In case of RODCs it also tried to check if an RODC is a real RODC. For example, there may be software/solutions in your AD that have been configured to mimic an RODC. An example of this are Riverbeds in RODC mode (or whatever it is called nowadays!)
If applicable, the script will list the full path of the LOG file with the exact same information as was displayed on screen, except without the colors
Figure 7: Presenting Information About The Targeted AD Domain
–
–
MODE 2 – Simulation Mode (Temporary Canary Object Created, No Password Reset!)
Here you get to choose the mode you want to executed…
Figure 8: Choosing The Mode Of Operation: “Mode 2 – Simulation Mode (Temporary Canary Object Created, No Password Reset!)”
–
The script presents information about the AD forest you are in such as the forest functional level (FFL), and all the AD domains detected, if it is the AD forest root domain, its domain functional level (DFL) and if it is the current AD domain. The current AD forest and AD domain are determined based upon the computer you are executing the PowerShell on.
To select an AD domain, you enter the FQDN of the chosen AD domain, or press [ENTER] for the current AD domain. Any AD domain specified is checked to see if it indeed exists in the AD forest.
Then a check is done to see if the account that is executing the PowerShell script either has Domain Admins membership (only if for the current AD domain) or it has Enterprise Admins membership (only if any other AD domain in the AD forest than the current AD domain)
Figure 9: Specifying An AD Domain To Target
–
For the chosen AD domain again all kinds of information is displayed, such as domain functional level (DFL), the RWDC with the PDC FSMO role and a full list of RWDCs and if applicable also a full list of RODCs. For every DC various information is displayed and if any DC is reachable or unreachable. Reachability is determined by checking both port TCP:135 (RPC Endpoint Mapper) and port TCP:389 (LDAP). In case of RODCs it also tried to check if an RODC is a real RODC. For example, there may be software/solutions in your AD that have been configured to mimic an RODC. An example of this are Riverbeds in RODC mode (or whatever it is called nowadays!)
Figure 10: Presenting Information About The Targeted AD Domain
–
If applicable for the chose mode, you now need to choose the scope of that mode. Although it asks which “KrbTgt Account” to target, it really means which scope the PowerShell should use for the chosen mode of operation. The combination of the choices regarding the mode of operation and if applicable its scope, really determine what will happen!
Figure 11: Choosing The Scope For The Previously Chosen Mode Of Operation
–
Because, the choice for the scope was “1 – Scope of KrbTgt in use by all RWDCs in the AD domain”, the temporary canary object is created on the RWDC with the PDC FSMO role and then every other reachable RWDC is checked for its existence to determine how long it took to replicate.
If the scope was “2 – Scope of KrbTgt in use by specific RODC – Single RODC in the AD Domain”, it would create temporary canary object on the RWDC the RODC is using as its AD replication source. Assuming both are reachable only that RWDC and the RODC are checked for its existence to determine how long it took to replicate. If the scope was “3 – Scope of KrbTgt in use by specific RODC – Multiple RODCs in the AD Domain” or “4 – Scope of KrbTgt in use by specific RODC – All RODCs in the AD Domain” it would do exactly the same for every individual targeted RODC. If the RODC is not reachable, and/or its replication source RWDC is not reachable, it will the RWDC with the PDC FSMO role as the originating RWDC.
If applicable, the script will list the full path of the LOG file with the exact same information as was displayed on screen, except without the colors.
Figure 12: Creating A Temporary Canary Object For The Chosen Scope
–
–
MODE 8 – Create TEST KrbTgt Accounts
Here you get to choose the mode you want to executed…
Figure 13: Choosing The Mode Of Operation: “Mode 8 – Create TEST KrbTgt Accounts”
–
The script presents information about the AD forest you are in such as the forest functional level (FFL), and all the AD domains detected, if it is the AD forest root domain, its domain functional level (DFL) and if it is the current AD domain. The current AD forest and AD domain are determined based upon the computer you are executing the PowerShell on.
To select an AD domain, you enter the FQDN of the chosen AD domain, or press [ENTER] for the current AD domain. Any AD domain specified is checked to see if it indeed exists in the AD forest.
Then a check is done to see if the account that is executing the PowerShell script either has Domain Admins membership (only if for the current AD domain) or it has Enterprise Admins membership (only if any other AD domain in the AD forest than the current AD domain)
Figure 14: Specifying An AD Domain To Target
–
For the chosen AD domain again all kinds of information is displayed, such as domain functional level (DFL), the RWDC with the PDC FSMO role and a full list of RWDCs and if applicable also a full list of RODCs. For every DC various information is displayed and if any DC is reachable or unreachable. Reachability is determined by checking both port TCP:135 (RPC Endpoint Mapper) and port TCP:389 (LDAP). In case of RODCs it also tried to check if an RODC is a real RODC. For example, there may be software/solutions in your AD that have been configured to mimic an RODC. An example of this are Riverbeds in RODC mode (or whatever it is called nowadays!)
Figure 15: Presenting Information About The Targeted AD Domain
–
If the mode of operation was to create TEST/BOGUS KrbTgt accounts to simulate the password reset, it will the determine the name of the KrbTgt account for RWDCs (being KRBTGT, duh!) and if applicable and real RODCs exist in the AD domain it will determine the name of the KrbTgt account for every individual RODC (being KRBTGT_<number>) by reading the forward link value from the RODC computer account. Either way, after determining the value for the KrbTgt account name, it adds “_TEST” to the name and creates it. However, it does check if the TEST/BOGUS KrbTgt accounts already exist. If it already exists, it will skip that account and if it does not exist it will create it!
If applicable, the script will list the full path of the LOG file with the exact same information as was displayed on screen, except without the colors.
Figure 16: Presenting The Resulting Information Of The Chosen Mode Of Operation And Scope
–
–
MODE 3 – Simulation Mode – Use KrbTgt TEST/BOGUS Accounts (Password Will Be Reset Once!)
Here you get to choose the mode you want to executed…
Figure 17: Choosing The Mode Of Operation: “Mode 3 – Simulation Mode – Use KrbTgt TEST/BOGUS Accounts (Password Will Be Reset Once!)”
–
The script presents information about the AD forest you are in such as the forest functional level (FFL), and all the AD domains detected, if it is the AD forest root domain, its domain functional level (DFL) and if it is the current AD domain. The current AD forest and AD domain are determined based upon the computer you are executing the PowerShell on.
To select an AD domain, you enter the FQDN of the chosen AD domain, or press [ENTER] for the current AD domain. Any AD domain specified is checked to see if it indeed exists in the AD forest.
Then a check is done to see if the account that is executing the PowerShell script either has Domain Admins membership (only if for the current AD domain) or it has Enterprise Admins membership (only if any other AD domain in the AD forest than the current AD domain)
Figure 18: Specifying An AD Domain To Target
–
For the chosen AD domain again all kinds of information is displayed, such as domain functional level (DFL), the RWDC with the PDC FSMO role and a full list of RWDCs and if applicable also a full list of RODCs. For every DC various information is displayed and if any DC is reachable or unreachable. Reachability is determined by checking both port TCP:135 (RPC Endpoint Mapper) and port TCP:389 (LDAP). In case of RODCs it also tried to check if an RODC is a real RODC. For example, there may be software/solutions in your AD that have been configured to mimic an RODC. An example of this are Riverbeds in RODC mode (or whatever it is called nowadays!)
Figure 19: Presenting Information About The Targeted AD Domain
–
If applicable for the chose mode, you now need to choose the scope of that mode. Although it asks which “KrbTgt Account” to target, it really means which scope the PowerShell should use for the chosen mode of operation. The combination of the choices regarding the mode of operation and if applicable its scope, really determine what will happen!
Figure 20: Choosing The Scope For The Previously Chosen Mode Of Operation
–
Because, the choice for the scope was “1 – Scope of KrbTgt in use by all RWDCs in the AD domain”, the password of the TEST/BOGUS KrbTgt account is reset on the RWDC with the PDC FSMO role and then every other reachable RWDC is checked for its existence to determine how long it took to replicate.
If the scope was “2 – Scope of KrbTgt in use by specific RODC – Single RODC in the AD Domain”, it would reset the password of the TEST/BOGUS KrbTgt account on the RWDC the RODC is using as its AD replication source. Assuming both are reachable only that RWDC and the RODC are checked for its existence to determine how long it took to replicate. If the scope was “3 – Scope of KrbTgt in use by specific RODC – Multiple RODCs in the AD Domain” or “4 – Scope of KrbTgt in use by specific RODC – All RODCs in the AD Domain” it would do exactly the same for every individual targeted RODC. If the RODC is not reachable, and/or its replication source RWDC is not reachable, it will the RWDC with the PDC FSMO role as the originating RWDC.
If applicable, the script will list the full path of the LOG file with the exact same information as was displayed on screen, except without the colors.
Figure 21: Presenting The Resulting Information Of The Chosen Mode Of Operation And Scope
–
If you try to reset the password again too early, it will warn you there would be impact involved. The highly recommended action is to STOP and wait at least the time difference is at least higher than the specified “Max TGT Lifetime (Hours)”.
However, because this involves the TEST/BOGUS KrbTgt accounts there is NO IMPACT although it does mention that. It mentions it so that you can see what would happen when using the PROD/REAL KrbTgt accounts!
Figure 22: Presenting A Warning If Impact Is Detected
–
–
MODE 4 – Real Reset Mode – Use KrbTgt PROD/REAL Accounts (Password Will Be Reset Once!)
Here you get to choose the mode you want to executed…
Figure 23: Choosing The Mode Of Operation: “Mode 4 – Simulation Mode – Use KrbTgt PROD/REAL Accounts (Password Will Be Reset Once!)”
–
The script presents information about the AD forest you are in such as the forest functional level (FFL), and all the AD domains detected, if it is the AD forest root domain, its domain functional level (DFL) and if it is the current AD domain. The current AD forest and AD domain are determined based upon the computer you are executing the PowerShell on.
To select an AD domain, you enter the FQDN of the chosen AD domain, or press [ENTER] for the current AD domain. Any AD domain specified is checked to see if it indeed exists in the AD forest.
Then a check is done to see if the account that is executing the PowerShell script either has Domain Admins membership (only if for the current AD domain) or it has Enterprise Admins membership (only if any other AD domain in the AD forest than the current AD domain)
Figure 24: Specifying An AD Domain To Target
–
For the chosen AD domain again all kinds of information is displayed, such as domain functional level (DFL), the RWDC with the PDC FSMO role and a full list of RWDCs and if applicable also a full list of RODCs. For every DC various information is displayed and if any DC is reachable or unreachable. Reachability is determined by checking both port TCP:135 (RPC Endpoint Mapper) and port TCP:389 (LDAP). In case of RODCs it also tried to check if an RODC is a real RODC. For example, there may be software/solutions in your AD that have been configured to mimic an RODC. An example of this are Riverbeds in RODC mode (or whatever it is called nowadays!)
Figure 25: Presenting Information About The Targeted AD Domain
–
Targeting The KrbTgt Account Of Every Individual RODCs In The AD Domain At Once
–
If applicable for the chose mode, you now need to choose the scope of that mode. Although it asks which “KrbTgt Account” to target, it really means which scope the PowerShell should use for the chosen mode of operation. The combination of the choices regarding the mode of operation and if applicable its scope, really determine what will happen!
Figure 26: Choosing The Scope For The Previously Chosen Mode Of Operation
–
If the scope was “4 – Scope of KrbTgt in use by specific RODC – All RODCs in the AD Domain”, for every real RODC it finds it will reset the password of the PROD/REAL KrbTgt account on the RWDC the RODC is using as its AD replication source. Assuming both are reachable only that RWDC and the RODC are checked for its existence to determine how long it took to replicate. If the RODC is not reachable, and/or its replication source RWDC is not reachable, it will the RWDC with the PDC FSMO role as the originating RWDC.
If applicable, the script will list the full path of the LOG file with the exact same information as was displayed on screen, except without the colors.
Figure 27: Presenting The Resulting Information Of The Chosen Mode Of Operation And Scope
–
If you try to reset the password again too early, it will warn you there would be impact involved. The highly recommended action is to STOP and wait at least the time difference is at least higher than the specified “Max TGT Lifetime (Hours)”.
Figure 28: Presenting A Warning If Impact Is Detected
–
Targeting The KrbTgt Account Of The RWDCs In The AD Domain
–
If applicable for the chose mode, you now need to choose the scope of that mode. Although it asks which “KrbTgt Account” to target, it really means which scope the PowerShell should use for the chosen mode of operation. The combination of the choices regarding the mode of operation and if applicable its scope, really determine what will happen!
Figure 29: Choosing The Scope For The Previously Chosen Mode Of Operation
Because, the choice for the scope was “1 – Scope of KrbTgt in use by all RWDCs in the AD domain”, the password of the PROD/REAL KrbTgt account is reset on the RWDC with the PDC FSMO role and then every other reachable RWDC is checked for its existence to determine how long it took to replicate.
If applicable, the script will list the full path of the LOG file with the exact same information as was displayed on screen, except without the colors.
Figure 30: Presenting The Resulting Information Of The Chosen Mode Of Operation And Scope
–
If you try to reset the password again too early, it will warn you there would be impact involved. The highly recommended action is to STOP and wait at least the time difference is at least higher than the specified “Max TGT Lifetime (Hours)”.
Figure 31: Presenting A Warning If Impact Is Detected
–
–
MODE 9 – Cleanup TEST KrbTgt Accounts
Here you get to choose the mode you want to executed…
Figure32: Choosing The Mode Of Operation: “Mode 9 – Cleanup TEST KrbTgt Accounts”
–
The script presents information about the AD forest you are in such as the forest functional level (FFL), and all the AD domains detected, if it is the AD forest root domain, its domain functional level (DFL) and if it is the current AD domain. The current AD forest and AD domain are determined based upon the computer you are executing the PowerShell on.
To select an AD domain, you enter the FQDN of the chosen AD domain, or press [ENTER] for the current AD domain. Any AD domain specified is checked to see if it indeed exists in the AD forest.
Then a check is done to see if the account that is executing the PowerShell script either has Domain Admins membership (only if for the current AD domain) or it has Enterprise Admins membership (only if any other AD domain in the AD forest than the current AD domain)
Figure 33: Specifying An AD Domain To Target
–
For the chosen AD domain again all kinds of information is displayed, such as domain functional level (DFL), the RWDC with the PDC FSMO role and a full list of RWDCs and if applicable also a full list of RODCs. For every DC various information is displayed and if any DC is reachable or unreachable. Reachability is determined by checking both port TCP:135 (RPC Endpoint Mapper) and port TCP:389 (LDAP). In case of RODCs it also tried to check if an RODC is a real RODC. For example, there may be software/solutions in your AD that have been configured to mimic an RODC. An example of this are Riverbeds in RODC mode (or whatever it is called nowadays!)
Figure 34: Presenting Information About The Targeted AD Domain
–
If the mode of operation was to delete/cleanup TEST/BOGUS KrbTgt accounts, it will the determine the name of the KrbTgt account for RWDCs (being KRBTGT, duh!) and if applicable and real RODCs exist in the AD domain it will determine the name of the KrbTgt account for every individual RODC (being KRBTGT_<number>) by reading the forward link value from the RODC computer account. Either way, after determining the value for the KrbTgt account name, it adds “_TEST” to the name and deletes the KrbTgt accounts that end with “_TEST”. The PROD/REAL are NOT deleted!. However, it does check if the TEST/BOGUS KrbTgt accounts do exist to be able to delete. If it exists, it will delete that account and if it does not exist it will do nothing!
If applicable, the script will list the full path of the LOG file with the exact same information as was displayed on screen, except without the colors.
Figure 35: Presenting The Resulting Information Of The Chosen Mode Of Operation And Scope
–
Cheers,
Jorge
————————————————————————————————————————————————————-
This posting is provided "AS IS" with no warranties and confers no rights!
Always evaluate/test everything yourself first before using/implementing this in production!
This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years!
DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/
————————————————————————————————————————————————————-
########################### Jorge’s Quest For Knowledge ##########################
#################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
————————————————————————————————————————————————————-
Like this:
Like Loading...
Jorge's Quest For Knowledge! 