Create Get-PublishedTemplates #161
Conversation
Get-PublishedTemplates pulls a list of published templates with their name, OID, flags, enrollment flag, last modified date, revision, and minor revision. This should help us check if vulnerable templates are published and also ultimately check if the vulnerable version is in use by issued certificate requests.
| Get-PublishedTemplates | ||
|
|
||
| .NOTES | ||
| If either of these flags are set, the template is considered published: |
There was a problem hiding this comment.
Your logic doesn't seem consistent with what's actually published, but it's very possible I'm missing something.
Your code returns this from my lab CA:
But the Certificate Templates list on my lab CA looks like this:
Which matches CA's object's cetificateTemplates attribute expanded:
Note: The Certificate Templates pane shows the templates displayName attribute while the expanded certificateTemplates list shows the name attribute.
This function should be rewritten to see if the template name exists within the certificateTemplates attribute on any pKIEnrollmentService object. We already collect the required attribute in Get-ADCSObject, so I think you could:
- Collect all the published template
names from all the CA objects - De-duplicate the list and store it as
$PublishedTemplates - Loop through the templates to see if
$PublishedTemplates -contains $TemplateName - Return
$trueor$falseto enrich the template object as a custom attribute.
Or whatever you want to do. You probably have a more elegant way of doing it.
Get-PublishedTemplates pulls a list of published templates with their name, OID, flags, enrollment flag, whenModified, revision, and minor revision. This should help us check if vulnerable templates are published and also ultimately check if the vulnerable version is in use by issued certificate requests.
Please review the bitwise checks for the template's
flagsandmspki-enrollment-flagproperties to see if the logic is correct and returns all published templates in your test environments.Contributes to #87.