Tests/Invoke-TSS.ps1

<#
    .SYNOPSIS
    Converts a secure Active Directory Certificate Services (AD CS) environment to
    an insecure AD CS environment to the purposes of testing.
 
    .DESCRIPTION
    TSS reconfigures Certificate Authorities and creates
    users, templates, and objects necessary to test AD CS tools.
 
    .INPUTS
    None. You can't pipe objects to Invoke-TSS.ps1.
 
    .OUTPUTS
    None. Invoke-TSS.ps1 doesn't generate any output.
#>


#requires -Modules ActiveDirectory

Write-Output @"
 _______ _ _ _
|__ __| | | (_) | |
   | | __ _ ___| |_ _ ___ __ _| |
   | |/ _`` |/ __| __| |/ __/ _`` | |
   | | (_| | (__| |_| | (_| (_| | |
  _|_|\__,_|\___|\__|_|\___\__,_|_|
 / ____| | |
| (___ _ __ ___ ___ __| |
 \___ \| `'_ \ / _ \/ _ \/ _`` |
 ____) | |_) | __/ __/ (_| |
|_____/| .__/ \___|\___|\__,_|
 / ____| |
| (___ |_|_ _ _ _ __ _ _ __ ___
 \___ \ / _`` | | | |/ _`` | `'__/ _ \
 ____) | (_| | |_| | (_| | | | __/
|_____/ \__, |\__,_|\__,_|_| \___|
           | |
           |_|
                The UnLocksmith
"@


$NewTemplates = @(
    'ESC1and2AutoEnroll'
    'ESC1and2Enroll'
    'ESC1and2FilteredAutoEnroll'
    'ESC1and2FilteredEnroll'
    'ESC1AutoEnroll'
    'ESC1Enroll'
    'ESC1FilteredAutoEnroll'
    'ESC1FilteredEnroll'
    'ESC2AutoEnroll'
    'ESC2Enroll'
    'ESC2FilteredAutoEnroll'
    'ESC2FilteredEnroll'
    'ESC3Condition1'
    'ESC3Condition2Schema1'
    'ESC3Condition2Schema2'
    'ESC4FilteredAutoEnroll'
    'ESC4FilteredEnroll'
    'ESC4FilteredOwner'
    'ESC4FilteredSafeUsers'
    'ESC4GenericAll'
    'ESC4UnsafeOwner'
    'ESC4WriteProperty'
    'ESC4WriteOwner'
)

$NewObjects = @(
    'ESC5FilteredAutoEnroll'
    'ESC5FilteredEnroll'
    'ESC5FilteredOwner'
    'ESC5FilteredSafeUsers'
    'ESC5GenericAll'
    'ESC5UnsafeOwner'
    'ESC5WriteProperty'
    'ESC5WriteOwner'
)

$Administrators = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-544')
$AuthenticatedUsers = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-11')

$ExtendedRight = [System.DirectoryServices.ActiveDirectoryRights]::ExtendedRight
$GenericAll = [System.DirectoryServices.ActiveDirectoryRights]::GenericAll
$GenericRead = [System.DirectoryServices.ActiveDirectoryRights]::GenericRead
$ReadProperty = [System.DirectoryServices.ActiveDirectoryRights]::ReadProperty
$WriteOwner = [System.DirectoryServices.ActiveDirectoryRights]::WriteOwner
$WriteProperty = [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty

$DefaultRights = $ExtendedRight + $GenericRead + $ReadProperty + $WriteProperty

$EnrollGUID = [GUID]'0e10c968-78fb-11d2-90d4-00c04f79dc55'
$AutoEnrollGUID = [GUID]'a05b8cc2-17bc-4802-a710-e7c15ab866a2'

$Allow = [System.Security.AccessControl.AccessControlType]::Allow

$PKSContainer = "CN=Public Key Services,CN=Services,CN=Configuration,$((Get-ADRootDSE).defaultNamingContext)"

$NewTemplates | ForEach-Object {
    New-ADObject -Name $_ -Type 'pKICertificateTemplate' -Path "CN=Certificate Templates,$PKSContainer"
}

$NewObjects | ForEach-Object {
    New-ADObject -Name $_ -Type 'container' -Path $PKSContainer
}

$ESC1and2AutoEnroll = Get-ADObject "CN=ESC1and2AutoEnroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ESC1and2AutoEnrollProperties = @{
    'DisplayName'                 = 'ESC1and2AutoEnroll'
    'msPKI-Certificate-Name-Flag' = 1
    'msPKI-Enrollment-Flag'       = 0
    'pKIExtendedKeyUsage'         = '2.5.29.37.0'
}
Set-ADObject $ESC1and2AutoEnroll.DistinguishedName -Add $ESC1and2AutoEnrollProperties
$ACL = Get-Acl "AD:$ESC1and2AutoEnroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $DefaultRights, $Allow, $AutoEnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC1and2AutoEnroll" -AclObject $ACL

$ESC1and2Enroll = Get-ADObject "CN=ESC1and2Enroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ESC1and2EnrollProperties = @{
    'msPKI-Certificate-Name-Flag' = 1
    'msPKI-Enrollment-Flag'       = 0
    'pKIExtendedKeyUsage'         = '2.5.29.37.0'
}
Set-ADObject $ESC1and2Enroll.DistinguishedName -Add $ESC1and2EnrollProperties
$ACL = Get-Acl "AD:$ESC1and2Enroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $DefaultRights, $Allow, $EnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC1and2Enroll" -AclObject $ACL

$ESC1and2FilteredAutoEnroll = Get-ADObject "CN=ESC1and2FilteredAutoEnroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ESC1and2FilteredAutoEnrollProperties = @{
    'msPKI-Certificate-Name-Flag' = 1
    'msPKI-Enrollment-Flag'       = 0
    'pKIExtendedKeyUsage'         = '2.5.29.37.0'
}
Set-ADObject $ESC1and2FilteredAutoEnroll.DistinguishedName -Add $ESC1and2FilteredAutoEnrollProperties
$ACL = Get-Acl "AD:$ESC1and2FilteredAutoEnroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Administrators, $DefaultRights, $Allow, $AutoEnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC1and2FilteredAutoEnroll" -AclObject $ACL

$ESC1and2FilteredEnroll = Get-ADObject "CN=ESC1and2FilteredEnroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ESC1and2FilteredEnrollProperties = @{
    'msPKI-Certificate-Name-Flag' = 1
    'msPKI-Enrollment-Flag'       = 0
    'pKIExtendedKeyUsage'         = '2.5.29.37.0'
}
Set-ADObject $ESC1and2FilteredEnroll.DistinguishedName -Add $ESC1and2FilteredEnrollProperties
$ACL = Get-Acl "AD:$ESC1and2FilteredEnroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Administrators, $DefaultRights, $Allow, $EnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC1and2FilteredEnroll" -AclObject $ACL

$ESC1AutoEnroll = Get-ADObject "CN=ESC1AutoEnroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ESC1AutoEnrollProperties = @{
    'msPKI-Certificate-Name-Flag' = 1
    'msPKI-Enrollment-Flag'       = 0
    'pKIExtendedKeyUsage'         = '1.3.6.1.5.5.7.3.2'
}
Set-ADObject $ESC1AutoEnroll.DistinguishedName -Add $ESC1AutoEnrollProperties
$ACL = Get-Acl "AD:$ESC1AutoEnroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $DefaultRights, $Allow, $AutoEnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC1AutoEnroll" -AclObject $ACL

$ESC1Enroll = Get-ADObject "CN=ESC1Enroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ESC1EnrollProperties = @{
    'msPKI-Certificate-Name-Flag' = 1
    'msPKI-Enrollment-Flag'       = 0
    'pKIExtendedKeyUsage'         = '1.3.6.1.5.5.7.3.2'
}
Set-ADObject $ESC1Enroll.DistinguishedName -Add $ESC1EnrollProperties
$ACL = Get-Acl "AD:$ESC1Enroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $DefaultRights, $Allow, $EnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC1Enroll" -AclObject $ACL

$ESC1FilteredAutoEnroll = Get-ADObject "CN=ESC1FilteredAutoEnroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ESC1FilteredAutoEnrollProperties = @{
    'msPKI-Certificate-Name-Flag' = 1
    'msPKI-Enrollment-Flag'       = 0
    'pKIExtendedKeyUsage'         = '1.3.6.1.5.5.7.3.2'
}
Set-ADObject $ESC1FilteredAutoEnroll.DistinguishedName -Add $ESC1FilteredAutoEnrollProperties
$ACL = Get-Acl "AD:$ESC1FilteredAutoEnroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Administrators, $DefaultRights, $Allow, $AutoEnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC1FilteredAutoEnroll" -AclObject $ACL

$ESC1FilteredEnroll = Get-ADObject "CN=ESC1FilteredEnroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ESC1FilteredEnrollProperties = @{
    'msPKI-Certificate-Name-Flag' = 1
    'msPKI-Enrollment-Flag'       = 0
    'pKIExtendedKeyUsage'         = '1.3.6.1.5.5.7.3.2'
}
Set-ADObject $ESC1FilteredEnroll.DistinguishedName -Add $ESC1FilteredEnrollProperties
$ACL = Get-Acl "AD:$ESC1FilteredEnroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Administrators, $DefaultRights, $Allow, $EnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC1FilteredEnroll" -AclObject $ACL

$ESC2AutoEnroll = Get-ADObject "CN=ESC2AutoEnroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ESC2AutoEnrollProperties = @{
    'msPKI-Certificate-Name-Flag' = 1
    'msPKI-Enrollment-Flag'       = 0
}
Set-ADObject $ESC2AutoEnroll.DistinguishedName -Add $ESC2AutoEnrollProperties
Set-ADObject $ESC2AutoEnroll.DistinguishedName -Clear pKIExtendedKeyUsage
$ACL = Get-Acl "AD:$ESC2AutoEnroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $DefaultRights, $Allow, $AutoEnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC2AutoEnroll" -AclObject $ACL

$ESC2Enroll = Get-ADObject "CN=ESC2Enroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ESC2EnrollProperties = @{
    'msPKI-Certificate-Name-Flag' = 1
    'msPKI-Enrollment-Flag'       = 0
}
Set-ADObject $ESC2Enroll.DistinguishedName -Add $ESC2EnrollProperties
Set-ADObject $ESC2Enroll.DistinguishedName -Clear pKIExtendedKeyUsage
$ACL = Get-Acl "AD:$ESC2Enroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $DefaultRights, $Allow, $EnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC2Enroll" -AclObject $ACL

$ESC2FilteredAutoEnroll = Get-ADObject "CN=ESC2FilteredAutoEnroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ESC2FilteredAutoEnrollProperties = @{
    'msPKI-Certificate-Name-Flag' = 1
    'msPKI-Enrollment-Flag'       = 0
}
Set-ADObject $ESC2FilteredAutoEnroll.DistinguishedName -Add $ESC2FilteredAutoEnrollProperties
Set-ADObject $ESC2FilteredAutoEnroll.DistinguishedName -Clear pKIExtendedKeyUsage
$ACL = Get-Acl "AD:$ESC2FilteredAutoEnroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Administrators, $DefaultRights, $Allow, $AutoEnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC2FilteredAutoEnroll" -AclObject $ACL

$ESC2FilteredEnroll = Get-ADObject "CN=ESC2FilteredEnroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ESC2FilteredEnrollProperties = @{
    'msPKI-Certificate-Name-Flag' = 1
    'msPKI-Enrollment-Flag'       = 0
}
Set-ADObject $ESC2FilteredEnroll.DistinguishedName -Add $ESC2FilteredEnrollProperties
Set-ADObject $ESC2FilteredEnroll.DistinguishedName -Clear pKIExtendedKeyUsage
$ACL = Get-Acl "AD:$ESC2FilteredEnroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Administrators, $DefaultRights, $Allow, $EnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC2FilteredEnroll" -AclObject $ACL

$ESC3Condition1 = Get-ADObject "CN=ESC3Condition1,CN=Certificate Templates,$PKSContainer" -Properties *
$ESC3Condition1Properties = @{
    'DisplayName'                          = 'ESC3Condition1'
    'msPKI-Enrollment-Flag'                = 0
    'msPKI-Certificate-Application-Policy' = '1.3.6.1.4.1.311.20.2.1'
    'msPKI-Certificate-Name-Flag'          =    -2113929216
    # 'msPKI-Cert-Template-OID' = '1.3.6.1.4.1.311.21.8.11772860.15111666.14435736.6562275.12440657.32.7694220.3484220'
    #'msPKI-Minimal-Key-Size' = 2048
    #'msPKI-Private-Key-Flag' = 16842752
    'msPKI-RA-Signature'                   = 0
    # 'msPKI-Template-Minor-Revision' = 7
    'msPKI-Template-Schema-Version'        = 2
    'pKIExtendedKeyUsage'                  = '1.3.6.1.4.1.311.20.2.1'
}
Set-ADObject $ESC3Condition1.DistinguishedName -Add $ESC3Condition1Properties
$ACL = Get-Acl "AD:$ESC3Condition1"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $DefaultRights, $Allow, $EnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC3Condition1" -AclObject $ACL

# $ESC3Condition2Schema1 = Get-ADObject "CN=ESC3Condition2Schema1,CN=Certificate Templates,$PKSContainer" -Properties *
# $ESC3Condition2Schema1Properties = @{
# 'msPKI-Certificate-Name-Flag' = 1
# 'msPKI-Enrollment-Flag' = 0
# 'msPKI-RA-Signature' = 1
# # 'msPKI-Certificate-Application-Policy' = ''
# }
# Set-ADObject $ESC3Condition2Schema1.DistinguishedName -Add $ESC3Condition2Schema1Properties
# Set-ADObject $ESC3Condition2Schema1.DistinguishedName -Clear pKIExtendedKeyUsage
# $ACL = Get-Acl "AD:$ESC3Condition2Schema1"
# $AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers,$DefaultRights,$Allow,$EnrollGUID
# $ACL.AddAccessRule($AccessRule)
# Set-Acl "AD:$ESC3Condition2Schema1" -AclObject $ACL

# $CertificateApplicationPolicies = @()
# $CertificateApplicationPolicies = @(
# '1.3.6.1.4.1.311.10.3.4'
# '1.3.6.1.5.5.7.3.4'
# '1.3.6.1.5.5.7.3.2'
# )

# $ESC3Condition2Schema2 = Get-ADObject "CN=ESC3Condition2Schema2,CN=Certificate Templates,$PKSContainer" -Properties *
# $ESC3Condition2Schema2Properties = @{
# 'msPKI-Certificate-Name-Flag' = 1
# 'msPKI-Enrollment-Flag' = 0
# 'msPKI-RA-Application-Policies' = '1.3.6.1.4.1.311.20.2.1'
# 'msPKI-RA-Signature' = 1
# # 'msPKI-Certificate-Application-Policies' = $CertificateApplicationPolicies
# 'msPKI-Cert-Template-OID' = '1.3.6.1.4.1.311.21.8.11772860.15111666.14435736.6562275.12440657.32.14251779.12149136'
# 'msPKI-Minimal-Key-Size' = 2048
# 'msPKI-Private-Key-Flag' = 16842768
# 'msPKI-Template-Minor-Revision' = 18
# 'msPKI-Template-Schema-Version' = 2
# }
# Set-ADObject $ESC3Condition2Schema2.DistinguishedName -Add $ESC3Condition2Schema2Properties
# Set-ADObject $ESC3Condition2Schema2.DistinguishedName -Clear pKIExtendedKeyUsage
# $ACL = Get-Acl "AD:$ESC3Condition2Schema2"
# $AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers,$DefaultRights,$Allow,$EnrollGUID
# $ACL.AddAccessRule($AccessRule)
# Set-Acl "AD:$ESC3Condition2Schema2" -AclObject $ACL

$ESC4FilteredAutoEnroll = Get-ADObject "CN=ESC4FilteredAutoEnroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC4FilteredAutoEnroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $DefaultRights, $Allow, $AutoEnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC4FilteredAutoEnroll" -AclObject $ACL

$ESC4FilteredEnroll = Get-ADObject "CN=ESC4FilteredEnroll,CN=Certificate Templates,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC4FilteredEnroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $DefaultRights, $Allow, $EnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC4FilteredEnroll" -AclObject $ACL

$ESC4FilteredOwner = Get-ADObject "CN=ESC4FilteredOwner,CN=Certificate Templates,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC4FilteredOwner"
$ACL.SetOwner($Administrators)
Set-Acl "AD:$ESC4FilteredOwner" -AclObject $ACL

$ESC4FilteredSafeUsers = Get-ADObject "CN=ESC4FilteredSafeUsers,CN=Certificate Templates,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC4FilteredSafeUsers"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Administrators, $GenericAll, $Allow
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC4FilteredSafeUsers" -AclObject $ACL

$ESC4GenericAll = Get-ADObject "CN=ESC4GenericAll,CN=Certificate Templates,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC4GenericAll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $GenericAll, $Allow
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC4GenericAll" -AclObject $ACL

$ESC4UnsafeOwner = Get-ADObject "CN=ESC4UnsafeOwner,CN=Certificate Templates,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC4UnsafeOwner"
$ACL.SetOwner($AuthenticatedUsers)
Set-Acl "AD:$ESC4UnsafeOwner" -AclObject $ACL

$ESC4WriteProperty = Get-ADObject "CN=ESC4WriteProperty,CN=Certificate Templates,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC4WriteProperty"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $WriteProperty, $Allow
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC4WriteProperty" -AclObject $ACL

$ESC4WriteOwner = Get-ADObject "CN=ESC4WriteOwner,CN=Certificate Templates,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC4WriteOwner"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $WriteOwner, $Allow
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC4WriteOwner" -AclObject $ACL

$ESC5FilteredAutoEnroll = Get-ADObject "CN=ESC5FilteredAutoEnroll,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC5FilteredAutoEnroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $DefaultRights, $Allow, $AutoEnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC5FilteredAutoEnroll" -AclObject $ACL

$ESC5FilteredEnroll = Get-ADObject "CN=ESC5FilteredEnroll,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC5FilteredEnroll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $DefaultRights, $Allow, $EnrollGUID
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC5FilteredEnroll" -AclObject $ACL

$ESC5FilteredOwner = Get-ADObject "CN=ESC5FilteredOwner,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC5FilteredOwner"
$ACL.SetOwner($Administrators)
Set-Acl "AD:$ESC5FilteredOwner" -AclObject $ACL

$ESC5FilteredSafeUsers = Get-ADObject "CN=ESC5FilteredSafeUsers,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC5FilteredSafeUsers"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Administrators, $GenericAll, $Allow
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC5FilteredSafeUsers" -AclObject $ACL

$ESC5GenericAll = Get-ADObject "CN=ESC5GenericAll,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC5GenericAll"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $GenericAll, $Allow
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC5GenericAll" -AclObject $ACL

$ESC5UnsafeOwner = Get-ADObject "CN=ESC5UnsafeOwner,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC5UnsafeOwner"
$ACL.SetOwner($AuthenticatedUsers)
Set-Acl "AD:$ESC5UnsafeOwner" -AclObject $ACL

$ESC5WriteProperty = Get-ADObject "CN=ESC5WriteProperty,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC5WriteProperty"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $WriteProperty, $Allow
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC5WriteProperty" -AclObject $ACL

$ESC5WriteOwner = Get-ADObject "CN=ESC5WriteOwner,$PKSContainer" -Properties *
$ACL = Get-Acl "AD:$ESC5WriteOwner"
$AccessRule = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $AuthenticatedUsers, $WriteOwner, $Allow
$ACL.AddAccessRule($AccessRule)
Set-Acl "AD:$ESC5WriteOwner" -AclObject $ACL

Get-ADObject -Filter 'objectClass -eq "pKIEnrollmentService"' -SearchBase $PKSContainer -Properties * | ForEach-Object {
    $ForestGC = $(Get-ADDomainController -Discover -Service GlobalCatalog -ForceDiscover | Select-Object -ExpandProperty Hostname) + ':3268'
    [string]$CAFullName = "$($_.dNSHostName)\$($_.Name)"
    $CAHostname = $_.dNSHostName.split('.')[0]
    $CAHostFQDN = (Get-ADObject -Filter { (Name -eq $CAHostName) -and (objectclass -eq 'computer') } -Properties DnsHostname -Server $ForestGC).DnsHostname
    $ping = Test-Connection -ComputerName $CAHostFQDN -Quiet
    if ($ping) {
        try {
            $CertutilAudit = certutil -config $CAFullName -getreg CA\AuditFilter
        } catch {
            $AuditFilter = 'Failure'
        }
        try {
            $CertutilFlag = certutil -config $CAFullName -getreg policy\EditFlags
        } catch {
            $AuditFilter = 'Failure'
        }
        try {
            $CertutilInterfaceFlag = certutil -config $CAFullName -getreg CA\InterfaceFlags
        } catch {
            $CertutilInterfaceFlag = 'Failure'
        }
    } else {
        $AuditFilter = 'CA Unavailable'
        $SANFlag = 'CA Unavailable'
        $InterfaceFlag = 'CA Unavailable'
    }
    if ($CertutilAudit) {
        try {
            [string]$AuditFilter = $CertutilAudit | Select-String 'AuditFilter REG_DWORD = ' | Select-String '\('
            $AuditFilter = $AuditFilter.split('(')[1].split(')')[0]
        } catch {
            try {
                [string]$AuditFilter = $CertutilAudit | Select-String 'AuditFilter REG_DWORD = '
                $AuditFilter = $AuditFilter.split('=')[1].trim()
            } catch {
                $AuditFilter = 'Never Configured'
            }
        }
    }
    if ($CertutilFlag) {
        [string]$SANFlag = $CertutilFlag | Select-String ' EDITF_ATTRIBUTESUBJECTALTNAME2 -- 40000 \('
        if ($SANFlag) {
            $SANFlag = 'Yes'
        } else {
            $SANFlag = 'No'
        }
    }
    if ($CertutilInterfaceFlag) {
        [string]$InterfaceFlag = $CertutilInterfaceFlag | Select-String ' IF_ENFORCEENCRYPTICERTREQUEST -- 200 \('
        if ($InterfaceFlag) {
            $InterfaceFlag = 'Yes'
        } else {
            $InterfaceFlag = 'No'
        }
    }

    if ( ($AuditFilter -ne '0') -and ($AuditFilter -ne 'Never Configured') ) {
        certutil -config $CAFullname -setreg CA\AuditFilter 0
        Invoke-Command -ComputerName $CAHostFQDN -ScriptBlock { Get-Service -Name 'certsvc' | Restart-Service -Force }
    }

    if ($SANFlag -eq 'No') {
        certutil -config $CAFullname -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
        Invoke-Command -ComputerName $CAHostFQDN -ScriptBlock { Get-Service -Name 'certsvc' | Restart-Service -Force }
    }

    if ($InterfaceFlag -eq 'Yes') {
        certutil -config $CAFullname -setreg CA\InterfaceFlags -IF_ENFORCEENCRYPTICERTREQUEST
        Invoke-Command -ComputerName $CAHostFQDN -ScriptBlock { Get-Service -Name 'certsvc' | Restart-Service -Force }
    }
}