Get-NdesNtlmDisclosure

Sends an unauthenticated NTLM type-1 (negotiate) message to the NDES SCEP administration
endpoint and inspects the server's NTLM type-2 (challenge) response. When NTLM is enabled,
the type-2 challenge leaks sensitive host and domain details in its TargetInfo block,
including the server's NetBIOS and DNS computer names, the NetBIOS and DNS domain names,
the DNS forest name, and the operating system version.

This information disclosure occurs without any authentication and can be used by an
attacker to enumerate an organization's internal Active Directory namespace. The script
surfaces exactly what an unauthenticated client can retrieve so the exposure can be
assessed and remediated (for example, by disabling NTLM on the NDES endpoint).

The request is always sent over HTTPS to the default NDES SCEP administration endpoint
(/certsrv/mscep_admin), which is the resource that presents the NTLM challenge.