IntuneCertificateConnectorDiagnostics

Author(s)

• Leon Zhu Jerry Abouelnasr

Tags

Windows Intune CertificateConnector NDES SCEP PKI IIS TLS Certificate Network Diagnostics

Functions

Test-IntuneCertificateConnector

PSEditions

Desktop Core

Dependencies

This module has no dependencies.

Release Notes

Version 2.3.0:
- Fixes a socket leak: a failed or timed-out connection attempt now returns the
   TcpClient so the caller can always close it.
- CERT04 reads every Subject Alternative Name DNS entry from the raw extension,
   so multi-name IIS certificates are no longer reported as a name mismatch.
- Local group membership is resolved through nested groups, and an enumeration
   that cannot be completed now warns instead of failing CON04 and IIS03.
- CERT04 warns instead of failing when the IIS HTTPS binding list cannot be
   enumerated, and application-pool discovery no longer hides that list.
- Collected IIS logs are prefixed with their site folder so identically named
   daily logs are no longer overwritten in the diagnostic ZIP.
- LOC05 parses the HTTP Date header with the invariant culture, so clock-skew
   detection is correct on every locale.
- LOC02 and NDES05 read the operating-system version from Win32_OperatingSystem
   and report the source.
- NDES08 distinguishes an unprotected endpoint from a connector that has not
   enabled SCEP yet, and CERT01 separates cross-signed roots from genuinely
   misplaced intermediates.
- The diagnostic restores the process-wide ServicePointManager TLS setting and
   honors an explicit -ErrorAction from the caller.
- Renames the private Section helper to Write-DiagnosticSection.
- Keeps the public command, alias, parameters, result IDs, and report schema
   compatible with 2.2.0.

Version 2.2.0:
- Tightens NET09 so only a successful client-certificate response containing
   EnrollmentService and RAODJPlusFEGatewayService passes full validation.
- Distinguishes transport-only validation when the agent certificate is absent.
- Makes authentication rejection, missing service names, and HTTP 5xx responses
   actionable failures while unexpected redirects and other 4xx responses warn.
- Makes DYN01 validate both required service-map keys and absolute endpoint URIs
   returned by the installed connector assembly.
- Converts unexpected environmental/runtime exceptions into a RUN01 failure
   report and fallback transcript instead of terminating the diagnostic.
- Retains Jerry Abouelnasr as co-author and acknowledges his feature-detection idea.
- Keeps the public command, alias, parameters, existing result IDs, and report
   schema compatible; RUN01 is emitted only for an unexpected runtime failure.