BlueTuxedo

A tiny tool built to find and fix common misconfigurations in Active Directory-Integrated DNS (and a little DHCP as a treat).

How can BlueTuxedo help you?

Read the slides from WWHF.

Watch the presentation from BSidesCharm.

Quick Start:

# Install from PSGallery
Install-Module -Name BlueTuxedo -Scope CurrentUser
Invoke-BlueTuxedo

# Clone from GitHub and Import
git clone https://github.com/TrimarcJake/BlueTuxedo.git
cd BlueTuxedo
Import-Module .\BlueTuxedo.psd1 -Force
Invoke-BlueTuxedo

# Use the testing branch - probably broken, but 🤷‍♀️
git clone https://github.com/TrimarcJake/BlueTuxedo.git
cd BlueTuxedo
git checkout testing
Import-Module .\BlueTuxedo.psd1 -Force
Invoke-BlueTuxedo

Running Invoke-BlueTuxedo with no paramters will Get stuff, Test it, then offer code for how to Repair identified issues (where possible).

Get Stuff

• ADI Zones
• Conditional Forwarder
• Dangling SPNs ¹
• DHCP Dynamic Update service account configuration
• DnsAdmins Membership
• DnsUpdateProxy Membership
• Forwarder Configuration
• Global Query Block List (GQBL)
• Non-ADI Zone Auditing
• Query Resolution Policies
• Security Descriptors
• Socket Pool Configuration
• Tombstoned DNS Records
• Wildcard Record
• WPAD Record
• Zone Scopes
• Zone Scope Containers

Test Stuff

Item	Test Condition
ADI Zones	Is Legacy Zone?
ADI Zones	Are Secure Updates enabled?
DHCP Dynamic Update service account	Exists on each DHCP server?
Dangling SPNs	Exist?
DnsAdmins Membership	Is non-zero?
DnsUpdateProxy Membership	Is non-zero?
Forwarder Configuration	Exist?
Global Query Block List (GQBL)	Contains wpad/isatap
Non-ADI Zones	Exist?
Query Resolution Policies	Exist?
Security Descriptor (ACEs)	Standard/Expected?
Security Descriptor (Ownership)	Standard/Expected?
Socket Pool Configuration	Is maximum?
Tombstoned DNS Records	Exist?
Wildcard Record	Exists & correct type?
WPAD Record	Exists & correct type?
Zone Scopes	Exist?
Zone Scope Containers	Exists & empty?

Repair Stuff

Item	Fix
ADI Zones	Convert Legacy (Windows 2000 Compatible) Zones to Modern
Dangling SPNs	Delete SPN from Account
Socket Pool Configuration	Set Socket Pool Configuration to Maximum
Tombstoned DNS Records	Delete Tombstoned DNS Record
Wildcard Record	Create Proper Wildcard Record
WPAD Record	Create Proper WPAD Record

Footnotes

1. A "Dangling SPN" is a Service Principal Name (SPN) in which the host portion of the SPN does not resolve to an IP address. ↩