Shadow Credentials Functions

Set-ShadowCredential

Description

Manage msDS-KeyCredentialLink (Shadow Credentials) for a domain object. Supports add, remove, clear, list actions.

Aliases

PV > Set-ShadowCred

Syntax

PV > Set-ShadowCredential
-Add           -CertOutFile   -Clear         -DeviceId      -DRS           -Export        -Identity      -KeySize       -List          -NoPassword    -OutFile       -PfxPassword   -Remove        -SearchBase    -Server

Examples

PV > Set-ShadowCredential -Identity victim -Add
PV > Set-ShadowCredential -Identity victim -List
PV > Set-ShadowCredential -Identity victim -Remove -DeviceId xxxx
PV > Set-ShadowCredential -Identity victim -Clear

Parameters

# With Argument
-Identity = (required)
-DeviceId =
-Export = (PFX|PEM|NONE, default PFX)
-CertOutFile =
-PfxPassword =
-KeySize = (default 2048)
-SearchBase =
-Server =
-OutFile =

# No Argument (mutually exclusive actions)
-Add
-Remove
-Clear
-List
-DRS
-NoPassword

Get-ShadowCredential

Description

List shadow credentials (msDS-KeyCredentialLink) for a domain object or all objects.

Aliases

PV > Get-ShadowCred

Syntax

PV > Get-ShadowCredential
-DRS           -Identity      -OutFile       -SearchBase    -Server

Examples

PV > Get-ShadowCredential -Identity DC01$
PV > Get-ShadowCredential

Parameters

# With Argument
-Identity =
-SearchBase =
-Server =
-OutFile =

# No Argument
-DRS

Remove-ShadowCredential

Description

Remove shadow credentials by DeviceId or clear all from a domain object.

Aliases

PV > Remove-ShadowCred

Syntax

PV > Remove-ShadowCredential
-All           -DeviceId      -DRS           -Identity      -OutFile       -SearchBase    -Server

Examples

PV > Remove-ShadowCredential -Identity DC01$ -DeviceId xxxx-xxxx
PV > Remove-ShadowCredential -Identity DC01$ -All

Parameters

# With Argument
-Identity = (required)
-DeviceId = (required if not -All, mutually exclusive with -All)
-SearchBase =
-Server =
-OutFile =

# No Argument
-All (required if not -DeviceId, mutually exclusive with -DeviceId)
-DRS