Invoke-PKIAudit.ps1

$Version = "0.3.8"

# regex of low-privileged principal names used for testing vulnerable enrollment/access control
#   Everyone                S-1-1-0
#   Authenticated Users     S-1-5-11
#   Domain Users            S-1-5-21domain-513
#   Domain Computers        S-1-5-21domain-515
#   Users                   S-1-5-32-545
$CommonLowprivPrincipals = "S-1-1-0|S-1-5-11|S-1-5-21.*-513$|S-1-5-21.*-515$|S-1-5-32-545"`

# cache for username->SID translations
$SIDTranslationCache = @{}


function Invoke-PKIAudit {
    <#
    .SYNOPSIS

    Audits Certificate Authority settings and Certificate Template settings.

    License: Ms-PL
    Required Dependencies: PSPKI

    .PARAMETER CAComputerName

    The name of the Certificate Authority computer to audit.

    .PARAMETER CAName

    The name of the Certificate Authority to audit.

    .PARAMETER ShowAllVulnerableTemplates

    Show all vulnerable templates, not just templates published to a CA.
    #>

    [CmdletBinding()]
    Param(
        [Parameter()]
        [String]
        $CAComputerName,

        [Parameter()]
        [String]
        $CAName,

        [Switch]
        $ShowAllVulnerableTemplates
    )
    

    Write-Host -ForegroundColor Green @"

  _____   _____ _____  _  _______                   _ _ _   
 |  __ \ / ____|  __ \| |/ /_   _|   /\            | (_) |  
 | |__) | (___ | |__) | ' /  | |    /  \  _   _  __| |_| |_ 
 |  ___/ \___ \|  ___/|  <   | |   / /\ \| | | |/ ``  | | __|
 | |     ____) | |    | . \ _| |_ / ____ \ |_| | (_| | | |_ 
 |_|    |_____/|_|    |_|\_\_____/_/    \_\__,_|\__,_|_|\__|
  v$($Version)                                                       
                                                            
"@


    $Args = @{}
    if ($PSBoundParameters['CAComputerName']) { $Args['CAComputerName'] = $CAComputerName }
    if ($PSBoundParameters['CAName']) { $Args['CAName'] = $CAName }

    Write-Host -ForegroundColor Green "`n[*] Enumerating certificate authorities with Get-AuditCertificateAuthority...`n"

    $CAs = Get-AuditCertificateAuthority @Args

    ForEach($CA in $CAs) {
        $Args['CAComputerName'] = $CA.ComputerName
        $Args['CAName'] = $CA.Name
        if ($PSBoundParameters['ShowAllVulnerableTemplates']) { $Args['ShowAllVulnerableTemplates'] = $True }

        $CAMisconfigurations = @()
        $TemplateMisconfigurations = @()
        
        Write-Host -ForegroundColor Green "`n`n=== Certificate Authority ==="

        if($CA.VulnerableACL) {
            $CAMisconfigurations += "ESC7"
        }
        if($CA.AllowsUserSuppliedSans) {
            $CAMisconfigurations += "ESC6"
        }
        if($CA.NTLMEnrollmentEndpoints) {
            $CAMisconfigurations += "ESC8"
        }
        
        $CA | Add-Member -MemberType NoteProperty -Name 'Misconfigurations' -Value $($CAMisconfigurations -join ",")
        $CA

        if($CA.Misconfigurations) {
            Write-Host -ForegroundColor Red "[!] The above CA is misconfigured!"
        }

        if (Test-IsMemberOfProtectedUsers) {
            Write-Warning -WarningAction Continue -Message "The current user is a member of the Protected Users group, which will cause anything with dependencies on NTLM to fail. Please keep this in mind for ESC8 checks."
        }

        # get the set of templates published to this CA (or all templates if -ShowAllVulnerableTemplates is passed)
        $CATemplates = Get-AuditCertificateTemplate @Args
        
        foreach($Template in $CATemplates) {
            $TemplateMisconfigurations = @()

            if( (-not $Template.CAManagerApproval) -and 
                ($Template.IssuanceRequirements -match "Authorized signature count: 0") -and 
                ($Template.LowPrivCanEnroll) -and 
                ($Template.HasAuthenticationEku) -and 
                ($Template.EnrolleeSuppliesSubject)
                ) {
                    $TemplateMisconfigurations += "ESC1"
            }

            if( (-not $Template.CAManagerApproval) -and 
                ($Template.IssuanceRequirements -match "Authorized signature count: 0") -and 
                ($Template.LowPrivCanEnroll) -and
                ($Template.HasDangerousEku)
                ) {
                    $TemplateMisconfigurations += "ESC2"
            }

            if( (-not $Template.CAManagerApproval) -and 
                ($Template.IssuanceRequirements -match "Authorized signature count: 0") -and 
                ($Template.LowPrivCanEnroll) -and 
                ($Template.EnrollmentAgentTemplate)
                ) {
                    $TemplateMisconfigurations += "ESC3"
            }

            if ( $Template.VulnerableTemplateACL) {
                    $TemplateMisconfigurations += "ESC4"
            }

            $Template | Add-Member -MemberType NoteProperty -Name 'Misconfigurations' -Value $($TemplateMisconfigurations -join ",")
        }

        if($($CATemplates | Where-Object {$_.Misconfigurations}).Count -eq 0) {
            Write-Host -ForegroundColor Green "`n[*] No vulnerable certificate templates found for this CA."
            Write-Host -ForegroundColor Green "`n[*] NOTE: this is not a guarantee that this CA environment is secure!`n"
        }
        else {
            Write-Host -ForegroundColor Red "`n[!] Potentially vulnerable Certificate Templates:`n"
            $CATemplates | Where-Object {$_.Misconfigurations}
        }

        if($CA.AllowsUserSuppliedSans) {
            $AuthTemplates = $CATemplates | Where-Object {
                $_.HasAuthenticationEku -and
                (-not $_.CAManagerApproval) -and
                ($_.IssuanceRequirements -match 'Authorized signature count: 0') -and
                $_.LowPrivCanEnroll
            }

            if($AuthTemplates.Count -gt 0) {
                Write-Host -ForegroundColor Red "[!] EDITF_ATTRIBUTESUBJECTALTNAME2 set on this CA, the following templates may be vulnerable:`n"
                $AuthTemplates
            }
        }
    }
}


function Get-AuditCertificateAuthority {
    <#
    .SYNOPSIS
    
    Returns security-related information for all (or the specified) certificate authority.

    License: Ms-PL
    Required Dependencies: PSPKI

    .PARAMETER CAComputerName

    The name of the Certificate Authority computer to return information for.

    .PARAMETER CAName

    The name of the Certificate Authority to return information for.
    #>
    [CmdletBinding()]
    Param(
        [Parameter()]
        [String]
        $CAComputerName,

        [Parameter()]
        [String]
        $CAName
    )

    $CAs = @()

    if($CAComputerName) {
        $CAs = Get-CertificationAuthority -ComputerName $CAComputerName
    }
    elseif($CAName) {
        $CAs = Get-CertificationAuthority -Name $CAName
    }
    else {
        $CAs = Get-CertificationAuthority
    }

    ForEach($CA in $CAs) {
        $CAServer = $CA.ComputerName
        $CAName = $CA.Name
        Write-Verbose "[Get-AuditCertificateAuthorit] CA: '$CAServer\$CAName'"

        try {
            $CAACL = $CA | Get-CertificationAuthorityAcl
            $DACLString = (($CAACL.Access | ForEach-Object { "$($_.IdentityReference) ($($_.AccessControlType)) - $($_.Rights)"}) -join "`n")

            $EnrollmentPrincipals = ForEach($Ace in $CAACL.Access) {
                if(
                    ($Ace.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow) -and 
                    ($Ace.Rights.HasFlag([SysadminsLV.PKI.Security.AccessControl.CertSrvRights]::Enroll))
                ) {
                    $Ace.IdentityReference
                }
            }

            $AllowsUserSANs = Test-UserSpecifiesSAN -ComputerName $CAServer -CAName $CAName
        }
        catch {
            Write-Warning "Error enumerating ACL information for CA '$CAServer\$CAName' : $_"
        }

        $CAACLVulnerable = $False
        
        if($CAACL) {
            $CAACLVulnerable = Test-IsCertificateAuthorityACLVulnerable $CAACL
        }

        $EnrollmentEndpoints = Get-ADCSEnrollmentEndpoint -ComputerName $CAServer -CAName $CAName -AuthType "Negotiate"
        $NTLMEnrollmentEndpoints = Get-ADCSEnrollmentEndpoint -ComputerName $CAServer -CAName $CAName -AuthType "NTLM"

        [pscustomobject] @{
            ComputerName = $CAServer
            CAName = $CAName
            ConfigString = "$CAServer\$CAName"
            IsRoot = $CA.IsRoot
            AllowsUserSuppliedSans = $AllowsUserSANs
            VulnerableACL = $CAACLVulnerable
            EnrollmentPrincipals = ($EnrollmentPrincipals -join "`n")
            EnrollmentEndpoints = ($EnrollmentEndpoints -join "|")
            NTLMEnrollmentEndpoints = ($NTLMEnrollmentEndpoints -join "|")
            DACL = $DACLString
        }
    }
}


function Get-ADCSEnrollmentEndpoint {
    <#
    .SYNOPSIS
    
    Given an AD CS server name, return the enrollment endpoints alive/reachable for the given authentication method.

    License: Ms-PL
    Required Dependencies: PSPKI

    .PARAMETER ComputerName

    The dns hostname of the CA server to check.

    .PARAMETER CANAme

    The CA name.

    .PARAMETER AuthType

    The type of authentication to use for the request, default of Negotiate.
    #>
    [CmdletBinding()]
    Param(
        [Parameter(Position=0, Mandatory=$True)]
        [String]
        $ComputerName,

        [Parameter(Position=1, Mandatory=$True)]
        [String]
        $CAName,

        [Parameter(Position=2)]
        [String]
        [ValidateSet("NTLM", "Negotiate")]
        $AuthType = "Negotiate"
    )

    foreach($P in @("http://", "https://")) {
        foreach($Suffix in @("/certsrv/", "/$($CAName)_CES_Kerberos/service.svc", "/$($CAName)_CES_Kerberos/service.svc/CES", "/ADPolicyProvider_CEP_Kerberos/service.svc", "/certsrv/mscep/")) {
            $URL = "$($P)$($ComputerName)$($Suffix)"
            Write-Verbose "Testing enrollment URL: $URL"
            if(Test-URLEndpoint -URL $URL) {
                $URL
            }
        }
    }
}


function Test-URLEndpoint {
    <#
    .SYNOPSIS
    
    Checks if an HTTP endpoint exists and is reachable given the specified authentication type.

    License: Ms-PL
    Required Dependencies: PSPKI

    .PARAMETER URL

    The URL of the endpoint to check.

    .PARAMETER AuthType

    The type of authentication to use for the request, default of NTLM.
    #>
    [CmdletBinding()]
    Param(
        [Parameter(Position=0, Mandatory=$True)]
        [String]
        $URL,

        [Parameter(Position=1)]
        [String]
        [ValidateSet("NTLM", "Negotiate")]
        $AuthType = "NTLM"
    )

    $Request = [System.Net.WebRequest]::Create($URL)
    $Cache = New-Object System.Net.CredentialCache
    $Cache.Add([System.Uri]::new($URL), $AuthType, [System.Net.CredentialCache]::DefaultNetworkCredentials)
    
    $Request.Credentials = $Cache
    $Request.Timeout = 3000

    try {
        $Response = $Request.GetResponse()
        return $Response.StatusCode -eq [System.Net.HttpStatusCode]::OK
    }
    catch {
        return $False
    }
}


function Get-AuditCertificateTemplate {
    <#
    .SYNOPSIS
    
    Returns security-related information for certificate templates for all (or the specified) certificate authority.

    License: Ms-PL
    Required Dependencies: PSPKI

    .PARAMETER CAComputerName

    The name of the Certificate Authority computer to return information for.

    .PARAMETER CAName

    The name of the Certificate Authority to return information for.

    .PARAMETER ShowAllVulnerableTemplates

    Show all vulnerable templates, not just templates published to a CA.
    #>
    [CmdletBinding()]
    Param(
        [Parameter()]
        [String]
        $CAComputerName,

        [Parameter()]
        [String]
        $CAName,

        [Switch]
        $ShowAllVulnerableTemplates
    )
    
    $CAs = @()

    if($CAComputerName) {
        $CAs = Get-CertificationAuthority -ComputerName $CAComputerName
    }
    elseif($CAName) {
        $CAs = Get-CertificationAuthority -Name $CAName
    }
    else {
        $CAs = Get-CertificationAuthority
    }

    $Templates = Get-CertificateTemplate

    if($ShowAllVulnerableTemplates) {
        ForEach($CATemplate in $Templates) {
            $CATemplateACL = $CATemplate | Get-CertificateTemplateAcl
            $DACLString = (($CATemplateACL.Access | ForEach-Object { "$($_.IdentityReference) ($($_.AccessControlType)) - $($_.Rights)"}) -join "`n")
            $IsTemplateACLVulnerable = Test-IsCertificateTemplateACLVulnerable $CATemplateACL
            $CanLowPrivEnrollInTemplate = Test-CanLowPrivEnrollInTemplate $CATemplateACL
            $EnrolleeSuppliesSubject = $CATemplate.Settings.SubjectName.HasFlag([PKI.CertificateTemplates.CertificateTemplateNameFlags]::EnrolleeSuppliesSubject)

            # Client Authentication - 1.3.6.1.5.5.7.3.2
            # PKINIT Client Authentication - 1.3.6.1.5.2.3.4
            # Smart Card Logon - 1.3.6.1.4.1.311.20.2.2
            # Any Purpose - 2.5.29.37.0
            # SubCA - (no EKUs present)

            $HasAuthenticationEku = ($CATemplate.Settings.EnhancedKeyUsage.Count -eq 0) -or (($CATemplate.Settings.EnhancedKeyUsage | Where-Object {$_.Value -match '1\.3\.6\.1\.5\.5\.7\.3\.2|1\.3\.6\.1\.5\.2\.3\.4|1\.3\.6\.1\.4\.1\.311\.20\.2\.2|2\.5\.29\.37\.0'}).Count -gt 0)
            
            $HasDangerousEku = ($CATemplate.Settings.EnhancedKeyUsage.Count -eq 0) -or (($CATemplate.Settings.EnhancedKeyUsage | Where-Object {$_.Value -match '2\.5\.29\.37\.0'}).Count -gt 0)

            # Certificate Request Agent - 1.3.6.1.4.1.311.20.2.1
            $EnrollmentAgentTemplate = (($CATemplate.Settings.EnhancedKeyUsage | Where-Object {$_.Value -match '1\.3\.6\.1\.4\.1\.311\.20\.2\.1'}).Count -gt 0)

            [pscustomobject] @{
                CA = ""
                Name = $CATemplate.Name
                SchemaVersion = $CATemplate.SchemaVersion
                OID = $CATemplate.OID
                VulnerableTemplateACL = $IsTemplateACLVulnerable
                LowPrivCanEnroll = $CanLowPrivEnrollInTemplate
                EnrolleeSuppliesSubject = $EnrolleeSuppliesSubject
                EnhancedKeyUsage = ($CATemplate.Settings.EnhancedKeyUsage -join "|")
                HasAuthenticationEku = $HasAuthenticationEku
                HasDangerousEku = $HasDangerousEku
                EnrollmentAgentTemplate = $EnrollmentAgentTemplate
                CAManagerApproval = $CATemplate.Settings.CAManagerApproval
                IssuanceRequirements = $CATemplate.Settings.RegistrationAuthority.ToString()
                ValidityPeriod = $CATemplate.Settings.ValidityPeriod
                RenewalPeriod = $CATemplate.Settings.RenewalPeriod
                Owner = $CATemplateACL.Owner
                DACL = $DACLString
            }
        }
    }
    else {
        ForEach($CA in $CAs) {

            $CAServer = $CA.ComputerName
            $CAName = $CA.Name

            # get the set of templates published to this CA
            $CATemplateNames = Get-ADObject $CA.DistinguishedName -Properties certificatetemplates | Select-Object -ExpandProperty certificatetemplates
            if ($null -eq $CATemplateNames) { continue }
            $CATemplates = $Templates | Where-Object {$CATemplateNames.Contains($_.Name)}

            try {
                ForEach($CATemplate in $CATemplates) {
                    $CATemplateACL = $CATemplate | Get-CertificateTemplateAcl
                    $DACLString = (($CATemplateACL.Access | ForEach-Object { "$($_.IdentityReference) ($($_.AccessControlType)) - $($_.Rights)"}) -join "`n")
                    $IsTemplateACLVulnerable = Test-IsCertificateTemplateACLVulnerable $CATemplateACL
                    $CanLowPrivEnrollInTemplate = Test-CanLowPrivEnrollInTemplate $CATemplateACL
                    $EnrolleeSuppliesSubject = $CATemplate.Settings.SubjectName.HasFlag([PKI.CertificateTemplates.CertificateTemplateNameFlags]::EnrolleeSuppliesSubject)

                    # Client Authentication - 1.3.6.1.5.5.7.3.2
                    # PKINIT Client Authentication - 1.3.6.1.5.2.3.4
                    # Smart Card Logon - 1.3.6.1.4.1.311.20.2.2
                    # Any Purpose - 2.5.29.37.0
                    # SubCA - (no EKUs present)

                    $HasAuthenticationEku = ($CATemplate.Settings.EnhancedKeyUsage.Count -eq 0) -or (($CATemplate.Settings.EnhancedKeyUsage | Where-Object {$_.Value -match '1\.3\.6\.1\.5\.5\.7\.3\.2|1\.3\.6\.1\.5\.2\.3\.4|1\.3\.6\.1\.4\.1\.311\.20\.2\.2|2\.5\.29\.37\.0'}).Count -gt 0)
                    
                    $HasDangerousEku = ($CATemplate.Settings.EnhancedKeyUsage.Count -eq 0) -or (($CATemplate.Settings.EnhancedKeyUsage | Where-Object {$_.Value -match '2\.5\.29\.37\.0'}).Count -gt 0)
                    
                    # Certificate Request Agent - 1.3.6.1.4.1.311.20.2.1
                    $EnrollmentAgentTemplate = (($CATemplate.Settings.EnhancedKeyUsage | Where-Object {$_.Value -match '1\.3\.6\.1\.4\.1\.311\.20\.2\.1'}).Count -gt 0)

                    [pscustomobject] @{
                        CA = "$CAServer\$CAName"
                        Name = $CATemplate.Name
                        SchemaVersion = $CATemplate.SchemaVersion
                        OID = $CATemplate.OID
                        VulnerableTemplateACL = $IsTemplateACLVulnerable
                        LowPrivCanEnroll = $CanLowPrivEnrollInTemplate
                        EnrolleeSuppliesSubject = $EnrolleeSuppliesSubject
                        EnhancedKeyUsage = ($CATemplate.Settings.EnhancedKeyUsage -join "|")
                        HasAuthenticationEku = $HasAuthenticationEku
                        HasDangerousEku = $HasDangerousEku
                        EnrollmentAgentTemplate = $EnrollmentAgentTemplate
                        CAManagerApproval = $CATemplate.Settings.CAManagerApproval
                        IssuanceRequirements = $CATemplate.Settings.RegistrationAuthority.ToString()
                        ValidityPeriod = $CATemplate.Settings.ValidityPeriod
                        RenewalPeriod = $CATemplate.Settings.RenewalPeriod
                        Owner = $CATemplateACL.Owner
                        DACL = $DACLString
                    }
                }
            }
            catch {
                Write-Error $_
            }
        }
    }
}


function Test-IsCertificateTemplateACLVulnerable {
    <#
    .SYNOPSIS
    
    Returns true if a certicate template ACL is vulnerable.

    License: Ms-PL
    Required Dependencies: PSPKI

    .PARAMETER Template

    The certificate template ACL to audit.
    #>
    [CmdletBinding()]
    Param(
        [Parameter(Position=0, Mandatory=$True)]
        [SysadminsLV.PKI.Security.AccessControl.CertTemplateSecurityDescriptor]
        $TemplateACL
    )
    
    if((ConvertName-ToSid $TemplateACL.Owner) -match $CommonLowprivPrincipals) {
        return $True
    }

    ForEach($Ace in $TemplateACL.Access) {
        if(
            ($Ace.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow) -and 
            ( (ConvertName-ToSid $Ace.IdentityReference) -match $CommonLowprivPrincipals) -and 
            ($Ace.Rights.HasFlag([SysadminsLV.PKI.Security.AccessControl.CertTemplateRights]::FullControl) -or $Ace.Rights.HasFlag([SysadminsLV.PKI.Security.AccessControl.CertTemplateRights]::Write))
        ) {
            return $True
        }
    }

    return $False
}


function ConvertName-ToSid {
    <#
    .SYNOPSIS
    
    Converts a DOMAIN\username to a domain SID.

    License: Ms-PL
    Required Dependencies: PSPKI

    .PARAMETER Username

    The username to convert
    #>
    [CmdletBinding()]
    Param(
        [Parameter(Position=0, Mandatory=$True)]
        [String]
        $Username
    )

    # first check the translation cache
    if($SIDTranslationCache.ContainsKey($Username)) {
        return $SIDTranslationCache[$Username]
    }
    else {
        try {
            $NTAccount = New-Object System.Security.Principal.NTAccount($Username)
            $SID = $NTAccount.Translate([System.Security.Principal.SecurityIdentifier])
            $SIDTranslationCache[$Username] = $SID.Value
        }
        catch {
            $SIDTranslationCache[$Username] = $Null
            Write-Warning "Error converting '$Username' to domain SID."
        }

        return $SIDTranslationCache[$Username]
    }
}


function Test-IsCertificateAuthorityACLVulnerable {
    <#
    .SYNOPSIS
    
    Returns true if a certicate authority ACL is vulnerable.

    License: Ms-PL
    Required Dependencies: PSPKI

    .PARAMETER CAACL

    The certificate authority ACL to audit.
    #>
    [CmdletBinding()]
    Param(
        [Parameter(Position=0, Mandatory=$True)]
        [SysadminsLV.PKI.Security.AccessControl.CertSrvSecurityDescriptor]
        $CAACL
    )
    
    if( (ConvertName-ToSid $CAACL.Owner) -match $CommonLowprivPrincipals) {
        return $True
    }

    ForEach($Ace in $CAACL.Access) {
        if(
            ($Ace.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow) -and 
            ( (ConvertName-ToSid $Ace.IdentityReference) -match $CommonLowprivPrincipals) -and 
            ($Ace.Rights.HasFlag([SysadminsLV.PKI.Security.AccessControl.CertSrvRights]::ManageCA) -or $Ace.Rights.HasFlag([SysadminsLV.PKI.Security.AccessControl.CertSrvRights]::ManageCertificates))
        ) {
            return $True
        }
    }

    return $False
}


function Test-CanLowPrivEnrollInTemplate {
    <#
    .SYNOPSIS
    
    Returns true if default low privileged principals can enroll in a template.

    License: Ms-PL
    Required Dependencies: PSPKI

    .PARAMETER TemplateACL

    The certificate template ACL to audit.
    #>
    [CmdletBinding()]
    Param(
        [Parameter(Position=0, Mandatory=$True)]
        [SysadminsLV.PKI.Security.AccessControl.CertTemplateSecurityDescriptor]
        $TemplateACL
    )
    
    ForEach($Ace in $TemplateACL.Access) {
        if(
            ($Ace.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow) -and 
            ( (ConvertName-ToSid $Ace.IdentityReference) -match $CommonLowprivPrincipals) -and 
            ($Ace.Rights.HasFlag([SysadminsLV.PKI.Security.AccessControl.CertTemplateRights]::Enroll))
        ) {
            return $True
        }
    }

    return $False
}


function Test-UserSpecifiesSAN {
    <#
    .SYNOPSIS

    Returns true if the specified server\CA has the EDITF_ATTRIBUTESUBJECTALTNAME2 flag set.

    License: Ms-PL
    Required Dependencies: PSPKI
    #>
    [CmdletBinding()]
    Param
    ( 
        [Parameter(Position=0, Mandatory=$True, ValueFromPipeline=$True, ValueFromPipelineByPropertyName=$True)]
        [String]
        $ComputerName,

        [Parameter(Position=1, Mandatory=$True, ValueFromPipeline=$True, ValueFromPipelineByPropertyName=$True)]
        [String]
        $CAName
    )

    if (Test-Connection $ComputerName -Count 2 -Quiet) {
        try {
            $Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $ComputerName)
            $Key = $Reg.OpenSubKey("SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\$($CAName)\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy")
            $Data = $Key.GetValue("EditFlags")
            ($Data -band 0x00040000) -eq 0x00040000
        }
        catch {
            Write-Warning "[Test-UserSpecifiesSAN] Error: $_"
            return $false
        }
    }
    else {
        Write-Warning "[Test-UserSpecifiesSAN] $ComputerName not reachable!"
        return $false
    }
}


function Get-AuditPKIADObjectControllers {
    <#
    .SYNOPSIS

    Returns users who have control or edit rights to PKI AD objects.

    License: Ms-PL
    Required Dependencies: PSPKI

    .PARAMETER Server

    The domain controller to connect to.

    .PARAMETER Credential

    The credential used to authenticate.

    .EXAMPLE

    $Controllers = Get-AuditPKIADObjectControllers
    Format-PKIAdObjectControllers $Controllers
    #>

    [CmdletBinding()]
    Param(
        [Parameter(Mandatory=$False)]
        [string]
        $Server,

        [Parameter(Mandatory=$False)]
        [pscredential]
        $Credential
    )

    $ObjectControllers = New-Object 'System.Collections.Generic.SortedDictionary[[string],[System.Collections.ArrayList]]'

    try {
        $RootDse = Get-ADRootDSE @PSBoundParameters -ErrorAction Stop
    } catch {
        throw "Could not query the forest root: $($_)"
    }

    $PkiServicesContainer = "CN=Public Key Services,CN=Services,$($RootDse.configurationNamingContext)"

    foreach($Obj in (Get-ADObject @PSBoundParameters -SearchBase $PkiServicesContainer -Filter * -Properties DistinguishedName,ntsecuritydescriptor)) {
        $Dn = $Obj.DistinguishedName
        
        $Sd = $Obj.ntsecuritydescriptor


        if($null -eq $Sd) {
            Write-Warning "Could not obtain AD security information for the object $($Obj.DistinguishedName)"
            continue
        }

        $OwnerSid = $sd.GetOwner([System.Security.Principal.SecurityIdentifier])

        try {
            $Owner = $sd.GetOwner([System.Security.Principal.NTAccount])
        } catch {
            $Owner = $null
        }

        $Key = "$($Owner)`t$($OwnerSid)"

        if(!$ObjectControllers.ContainsKey($Key)) {
            $ObjectControllers[$Key] = New-Object System.Collections.ArrayList
        }

        $null = $ObjectControllers[$Key].Add([PSCustomObject]@{
            Right = 'Owner'
            ADObject = $Dn
        })
        
        $Dacl = $sd.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])

        foreach($Ace in $Dacl) {
            
            $AceOwnerSid = $Ace.IdentityReference
            try {
                $AceOwner = $AceOwnerSid.Translate([System.Security.Principal.NTAccount])
            } catch {
                $AceOwner = $null
            }
            $Key = "$($AceOwner)`t$($AceOwnerSid)"

            if(!$ObjectControllers.ContainsKey($Key)) {
                $ObjectControllers[$Key] = New-Object System.Collections.ArrayList
            }

            if($Dn -match 'ADObject') {
                $null = $null
            }
            $Right = $Ace.ActiveDirectoryRights

            if($Right.HasFlag([System.DirectoryServices.ActiveDirectoryRights]::GenericAll)) {
                $null = $ObjectControllers[$Key].Add([PSCustomObject]@{
                    Right = 'GenericAll'
                    ADObject = $Dn
                })
            } elseif($Right.HasFlag([System.DirectoryServices.ActiveDirectoryRights]::WriteOwner)) {
                $null = $ObjectControllers[$Key].Add([PSCustomObject]@{
                    Right = 'WriteOwner'
                    ADObject = $Dn
                })
            } elseif($Right.HasFlag([System.DirectoryServices.ActiveDirectoryRights]::WriteDacl)) {
                $null = $ObjectControllers[$Key].Add([PSCustomObject]@{
                    Right = 'WriteDacl'
                    ADObject = $Dn
                })
            } elseif($Right.HasFlag([System.DirectoryServices.ActiveDirectoryRights]::WriteProperty) -and $Ace.ObjectType -eq "00000000-0000-0000-0000-000000000000") {
                $null = $ObjectControllers[$Key].Add([PSCustomObject]@{
                    Right = 'WriteAllProperties'
                    ADObject = $Dn
                })
            }
        }
    }

    
    foreach($Entry in $ObjectControllers.GetEnumerator()) {
        $Obj = $Entry.Value
        if($Obj.Count -eq 0) {
            continue
        }
        
        $User,$UserSid = $Entry.Key.Split("`t")

        
        [PSCustomObject]@{
            User = $User
            UserSid = $UserSid
            Access = $Obj
        }
    }
}


function Format-PKIAdObjectControllers {
    <#
    .SYNOPSIS

    Formats the output of Get-AuditPKIADObjectControllers.

    License: Ms-PL
    Required Dependencies: PSPKI

    .PARAMETER InputObject

    Output objects from Get-AuditPKIADObjectControllers to format.

    .PARAMETER IncludeDefaultAdministrators

    Displays access rights where the principal is a default AD administrator (e.g. Enterprise Admins).

    .EXAMPLE

    $Controllers = Get-AuditPKIADObjectControllers
    Format-PKIAdObjectControllers $Controllers
    #>
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true)]
        $InputObject,

        [switch]
        $IncludeDefaultAdministrators
    )

    Process {
        foreach($Obj in $InputObject) {

            if(!$IncludeDefaultAdministrators -and (
                    $Obj.UserSid.EndsWith('-519') -or
                    $Obj.UserSid.EndsWith('-512') -or
                    $Obj.UserSid -eq 'S-1-5-32-544' -or
                    $Obj.UserSid -eq 'S-1-5-18'
                )) {
                continue
            }

            if([string]::IsNullOrEmpty($Obj.User)) {
                $UserStr = "$($Obj.UserSid)"
            } else {
                $UserStr = "$($Obj.User) ($($Obj.UserSid))"
            }
            
            Write-Host $UserStr -ForegroundColor Red
            foreach($i in $Obj.Access) {
                Write-Host "    $($i.Right.PadRight(18)) $($i.ADObject)"
            }
            Write-Host
        }
    }
}


function Test-IsMemberOfProtectedUsers {
    <#
        .SYNOPSIS
            Check to see if a user is a member of the Protected Users group.

        .DESCRIPTION
            This function checks to see if a specified user or the current user is a member of the Protected Users group in AD.
            It also checked the user's primary group ID in case that is set to 525 (Protected Users).

        .PARAMETER User
            The user that will be checked for membership in the Protected Users group. This parameter accepts input from the pipeline.

        .EXAMPLE
            This example will check if JaneDoe is a member of the Protected Users group.

            Test-IsMemberOfProtectedUsers -User JaneDoe

        .EXAMPLE
            This example will check if the current user is a member of the Protected Users group.

            Test-IsMemberOfProtectedUsers

        .INPUTS
            Active Directory user object, user SID, SamAccountName, etc

        .OUTPUTS
            True, False

        .NOTES
            Author:     Sam Erde
            Base Repo:  https://github.com/SamErde/Active-Directory
            Modified:   2024-02-16
            Version:    0.1.0

            Membership in Active Directory's Protect Users group can have implications for anything that relies on NTLM authentication.
    #>

    [CmdletBinding()]
    param (
        # User parameter accepts any input that is valid for Get-ADUser
        [Parameter(
            ValueFromPipeline = $true
        )]
        $User
    )

    Import-Module ActiveDirectory

    # Use the currently logged in user if none is specified
    # Get the user from Active Directory
    if (-not($User)) {
        # These two are different types. Fixed by referencing $CheckUser.SID later, but should fix here by using one type.
        $CurrentUser = ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name).Split('\')[-1]
        $CheckUser = Get-ADUser $CurrentUser -Properties primaryGroupID
    }
    else {
        $CheckUser = Get-ADUser $User -Properties primaryGroupID
    }

    # Get the Protected Users group by SID instead of by its name to ensure compatibility with any locale or language.
    $DomainSID = (Get-ADDomain).DomainSID.Value
    $ProtectedUsersSID = "$DomainSID-525"

    # Get members of the Protected Users group for the current domain. Recuse in case groups are nested in it.
    $ProtectedUsers = Get-ADGroupMember -Identity $ProtectedUsersSID -Recursive | Select-Object -Unique

    # Check if the current user is in the 'Protected Users' group
    if ($ProtectedUsers.SID.Value -contains $CheckUser.SID) {
        Write-Verbose "$($CheckUser.Name) ($($CheckUser.DistinguishedName)) is a member of the Protected Users group."
        $true
    } else {
        # Check if the user's PGID (primary group ID) is set to the Protected Users group RID (525).
        if ( $CheckUser.primaryGroupID -eq '525' ) {
            $true
        } else {
            Write-Verbose "$($CheckUser.Name) ($($CheckUser.DistinguishedName)) is not a member of the Protected Users group."
            $false
        }
    }
}