Jorge de Almeida Pinto | IAMTEC zjorz
zjorz
/ Fix_SYSVOL_Repl_With_New_Source_RWDC.ps1
Last active
January 29, 2026 15:25
Fixing Broken DFS-R Replication Group (SYSVOL) Replication Between All Replication Group Members While Assigning A Primary Member As Source
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SOURCE: https://gist.github.com/zjorz/5a74f785bc0ff1f8a96533ba347541b2 | |
| #------- | |
| # Fixing Broken DFS-R Replication Group Replication Between All Replication Group Members While Assigning A Primary Member As Source | |
| #------- | |
| # ASSUMPTIONS: | |
| # * Name Resolution Works | |
| # * All DCs In The AD Domain Are Available/Up And Running | |
| # * All DCs In The AD Domain Are Reachable For LDAP, ADWS, Remote Management, WMI | |
| # * The Account Used To Execute This Has AT LEAST "Domain Admin" Equivalent Permissions In The AD Domain Being Processed |
zjorz
/ Configuring_GenCounter_System_Service_Disabled.ps1
Last active
May 18, 2023 20:33
Configuring New Or Existing GPO With The GenCounter System Service To NOT Start (i.e., Disable Generation ID)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #------- | |
| # Configuring New Or Existing GPO With The GenCounter System Service To NOT Start (i.e., Disable Generation ID) | |
| #------- | |
| $gpoName = "<Name Of Existing Or New GPO>" # <=== CONFIGURE !!!! | |
| Invoke-Command -ArgumentList $gpoName -Scriptblock { | |
| Param ( | |
| $gpoName | |
| ) | |
| Clear-Host | |
zjorz
/ Securing-Default-Admin-Account.ps1
Last active
June 4, 2026 13:19
Code to secure the default domain admin account as described in the blog post https://jorgequestforknowledge.wordpress.com/2024/05/04/breaking-the-glass-of-your-get-out-of-jail-for-free-ad-account-securing-it-part-2/
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SOURCE: https://gist.github.com/zjorz/fea7f1a5b61dd2f74e1de48ad49c60e7 | |
| Invoke-Command -ScriptBlock { | |
| Clear-Host | |
| Function secretDisplayWindow { | |
| Param ( | |
| $text, | |
| $secretValue |
zjorz
/ Create-Application-In-Entra-ID-And-Exchange-Online-To-Send-Email-From-OnPremises-PoSH-Scripts.ps1
Last active
September 28, 2025 22:01
Creating An Application In Entra ID And Exchange Online To Be Used As A "Proxy" To Send Emails From On-Premises PowerShell Scripts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $tenantFQDN = "<TENANT NAME>.ONMICROSOFT.COM" # <= CONFIGURE THIS!!!!! | |
| $appRegDisplayName = "<APPLICATION DISPLAY NAME>" # <= CONFIGURE THIS!!!!! | |
| $credentialType = "<CREDENTIAL TYPE>" # "Secret" OR "Certificate" <= CONFIGURE THIS!!!!! | |
| $lifetimeSecretInDays = 365 # <= CONFIGURE THIS!!!!! | |
| $certCERFilePath = "<CERTIFICATE CER FILE PATH>" # <= CONFIGURE THIS!!!!! | |
| $mailboxMailAddress = "<MAIL ADDRESS OF MAILBOX TO ALLOW TO SEND MAIL FROM>" # <= CONFIGURE THIS!!!!! | |
| Invoke-Command -ArgumentList $tenantFQDN,$appRegDisplayName,$credentialType,$lifetimeSecretInDays,$certCERFilePath,$mailboxMailAddress -ScriptBlock { | |
| Param ( | |
| $tenantFQDN, |
zjorz
/ Generate-Self-Signed-Certificate-For-Multiple-Purposes.ps1
Last active
April 30, 2025 08:00
Code To Generate Self-Signed Certificate That Can be Used For Multiple Purposes, Like Authenticating Against Application Registration In Entra ID, Token Signing Certificate or Token Encryption Certificate In Entra ID/ADFS/Whatever And Probably More Scenarios
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # To generate and export the certificate, local administrator rights in an elevated PowerShell window are required! | |
| $certPurpose = "<CERTIFICATE PURPOSE>" # "Authentication", "Token Signing", "Token Encryption" # <= CONFIGURE THIS!!!!! | |
| $svcDisplayName = "<SERVICE DISPLAY NAME AND/OR FQDN>" # <= CONFIGURE THIS!!!!! | |
| $keyLength = 4096 # 4096 | 2048 # <= CONFIGURE THIS!!!!! | |
| $daysBeforeToday = 0 # <= CONFIGURE THIS!!!!! (Positive Number For AFTER Today, Negative Number For Before Today!) | |
| $daysAfterToday = 397 # 13 Months (Best Practice According To DigiCert) # <= CONFIGURE THIS!!!!! | |
| $selfSignedCert = Invoke-Command -ArgumentList $certPurpose,$svcDisplayName,$keyLength,$daysBeforeToday,$daysAfterToday -ScriptBlock { | |
| Param ( |
zjorz
/ Delete-Application-From-Entra-ID-And-Exchange-Online.ps1
Last active
July 10, 2026 20:32
Deleting A Specific Application From Entra ID And From Exchange Online
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $tenantFQDN = "<TENANT NAME>.ONMICROSOFT.COM" # <= CONFIGURE THIS!!!!! | |
| $applicationName = "<APPLICATION DISPLAY NAME>" # <= CONFIGURE THIS!!!!! | |
| Invoke-Command -ArgumentList $tenantFQDN,$applicationName -ScriptBlock { | |
| Param ( | |
| $tenantFQDN, | |
| $applicationName | |
| ) | |
| <# |
zjorz
/ Finding-All-Candidate-EXPLICIT-Allow-ACEs-To-Investigate-For-dMSA-Abuse-In-AD-Domain.ps1
Last active
July 21, 2026 03:06
Finding All Candidate EXPLICIT Allow ACEs To Investigate For dMSA Abuse In AD Domain
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ####### | |
| # Finding All Candidate EXPLICIT Allow ACEs To Investigate For dMSA Abuse In AD Domain | |
| ####### | |
| Clear-Host | |
| # Execution Date/Time | |
| $datetime = Get-Date | |
| # Local Computer Domain |
zjorz
/ Get-Relevant-Data-From-All-sMSAs-In-The-AD-Domain.ps1
Last active
July 21, 2026 03:05
Get The Relevant Data From All sMSAs (Stand-Alone Managed Service Accounts) In The AD Domain
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SOURCE: https://gist.github.com/zjorz/1d454aaa7c8fb7f0a696092b332af49b | |
| # Get The Relevant Data From All sMSAs (Stand-Alone Managed Service Accounts) In The AD Domain | |
| Clear-Host | |
| $allSmsaRelevantDataFromAD = Get-ADServiceAccount -LDAPFilter "(objectClass=msDS-ManagedServiceAccount)" -Properties description,displayName,KerberosEncryptionType,memberOf,'msDS-HostServiceAccountBL',PasswordLastSet,whenChanged,whenCreated -Server $((Get-ADDomain -Current LocalComputer).PDCEmulator) | |
| $allSmsaRelevantDataFromAD | Select DistinguishedName,SamAccountName,@{Label = 'RID'; Expression = {$_.SID.Value.Split("-")[-1]}},@{Label = 'Type'; Expression = {"sMSA"}},description,Enabled,@{Label = 'KerbEncryptType'; Expression = {$_.KerberosEncryptionType}},@{Label = 'WhenCreated'; Expression = {Get-Date $_.whenCreated -Format 'yyyy-MM-dd HH:mm:ss'}},@{Label = 'WhenChanged'; Expression = {Get-Date $_.whenChanged -Format 'yyyy-MM-dd HH:mm:ss'}},@{Label = 'PasswordLastSetSmsa'; Expression = {Get-Date $_.PasswordLastSet -Format 'yyyy-M |
zjorz
/ Get-Relevant-Data-From-All-gMSAs-In-The-AD-Domain.ps1
Last active
May 24, 2026 09:25
Get The Relevant Data From All gMSAs (Group Managed Service Accounts) In The AD Domain
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SOURCE: https://gist.github.com/zjorz/d1906ac04964a29d87bd377e0298eb21 | |
| # Get The Relevant Data From All gMSAs (Group Managed Service Accounts) In The AD Domain | |
| # Column "PSHC" = "Password Should Have Changed" - Based On The Last Password Last Set Date ("PasswordLastSet" Column) And The Configured Password Change Interval ("PwdInt" Column) | |
| # Column "DUEX" = "Days Until Expiration" - Based On When The Script Was Executed, Password Last Set Date ("PasswordLastSet" Column) And The Configured Password Change Interval ("PwdInt" Column) | |
| $retrievePassword = $false # $TRUE only works if the account running this code has the permissions to retrieve the password | |
| Clear-Host | |
| $allKDRootKeys = Get-KDSRootKey | |
| If ($retrievePassword -eq $true) { | |
| $allGmsaRelevantDataFromAD = Get-ADServiceAccount -LDAPFilter "(objectClass=msDS-GroupManagedServiceAccount)" -Properties description,dNSHostName,KerberosEncryptionType,memberOf,'msDS-ManagedPassword','msDS-ManagedPasswordId','msDS-ManagedPasswordInterval','msDS-ManagedPasswordPrev |
zjorz
/ Get-Relevant-Data-From-All-dMSAs-In-The-AD-Domain.ps1
Last active
January 29, 2026 15:21
Get The Relevant Data From All dMSAs (Delegated Managed Service Accounts) In The AD Domain
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SOURCE: https://gist.github.com/zjorz/62de8c4b5c8d10f7b3c1934c4332dfb8/ | |
| # Get The Relevant Data From All dMSAs (Delegated Managed Service Accounts) In The AD Domain | |
| # Column "PSHC" = "Password Should Have Changed" - Based On The Last Password Last Set Date ("PasswordLastSet" Column) And The Configured Password Change Interval ("PwdInt" Column) | |
| # Column "DUEX" = "Days Until Expiration" - Based On When The Script Was Executed, Password Last Set Date ("PasswordLastSet" Column) And The Configured Password Change Interval ("PwdInt" Column) | |
| Clear-Host | |
| $allKDRootKeys = Get-KDSRootKey | |
| $allDmsaRelevantDataFromAD = Get-ADServiceAccount -LDAPFilter "(objectClass=msDS-DelegatedManagedServiceAccount)" -Properties description,dNSHostName,KerberosEncryptionType,memberOf,'msDS-DelegatedMSAState','msDS-ManagedAccountPrecededByLink','msDS-ManagedPasswordId','msDS-ManagedPasswordInterval','msDS-ManagedPasswordPreviousId',objectClass,PasswordLastSet,PrincipalsAllowedToRetrieveManagedPassword,whenChanged,whenCreated -Server $( |
OlderNewer