Most of the parameters are the same as the request parameters, though there are a couple of important additions:
|
| { "computerName": "LPC-1Z97F", "domainName": "company.com", "batchName": "Unspecified", "reservedUserName": "jsmith", "state": "RESERVED", "name": "adp-f39701c5-94ac-47ee-a1ac-920c6c60445e" } |
| { "results":[ { "computerName":"LPC-1Z97F", "domainName":"company.com", "batchName":"Unspecified", "reservedUserName":"jsmith", "state":"RESERVED", "name":"adp-f39701c5-94ac-47ee-a1ac-920c6c60445e" }, { "computerName":"LPC-3G14Q", "domainName":"company.com", "livepcId": "win7-a", "batchName":"set1", "state":"AVAILABLE", "name":"adp-311ceaed-a832-46c6-9fc8-b170912662a3" } ], "count":2 } |
|
param (
[string]$computerName = $(throw "-m5domainName is required."),
[string]$reservedName,
[string]$livepcid,
[string]$m5domainName = $(throw "-m5domainName is required."),
[boolean]$issueCert = $false
)
$ErrorActionPreference = "Stop"
# imports
. .\gencert.ps1
# Configuration
################
$m5host = "m5.mycompany.com" #DNS name of your Moka5 Management Server
$m5port = 443
$m5user = "username1" #account that has Author role permissions in Moka5 Management Console
$m5pass = "password1" #password for $m5user
$domain = "mycompany.com" #FQDN domain name
$domainUser = "username2" #AD account that has permissions to create computer objects
$domainPass = "password2" #password for $domainUser
$certTemplate = "WorkstationAuth2"
################
$PACKETS_PATH = "/webapp/rest/api/adpackets"
# I) Create packet with djoin.exe
$adPackFile = [io.path]::GetTempFileName()
# a) if running this script already logged in as a domain admin:
#$output = (djoin.exe /provision /reuse /domain "$domain" /machine "$computerName" /downlevel /savefile "$adPackFile")
# b) if not running script as a domain admin:
$output = (cmd /c m5runas.exe -u "$domainUser" -p "$domainPass" -d "$domain" -netonly -app djoin.exe -args /provision /reuse /domain "$domain" /machine "$computerName" /downlevel /savefile "$adPackFile")
$output = $output -join "n"
if (!$output.contains("")) {
Write-Host "Error creating domain join packet"
Write-Host $output
return
}
$packet = Get-Content $adPackFile | out-string
rm $adPackFile
if (!$packet) {
Write-Host "Error reading AD packet file"
return
}
Write-Host "Successfully generated AD packet"
# II) Generate certificate
if ($issueCert) {
$pfxBytes = GenerateMachineCert $computerName $domain $certTemplate $domainUser $domainPass
if (!$pfxBytes) {
Write-Host "Error generating machine certificate"
return
}
$pfx = [System.Convert]::ToBase64String($pfxBytes)
Write-Host "Successfully generated machine certificate"
}
# III) Upload packet to m5 console
$packetRequest = @{
"data" = $packet;
"certificate" = $pfx;
"livepcId" = $livepcid;
"computerName" = $computerName;
"domainName" = $m5domainName;
"reservedUserName" = $reservedName;
#"batchName" = "set2";
}
$basicAuth = [System.Convert]::ToBase64String(
[System.Text.Encoding]::UTF8.GetBytes("${m5user}:$m5pass")
)
$headers = @{
"Authorization" = "Basic $basicAuth";
}
$packetRequestJson = $packetRequest | ConvertTo-Json
Write-Host "https://${m5host}:$m5port$PACKETS_PATH" -Body $packetRequestJson -Method "Post" -Headers $headers -ContentType "application/json"
Invoke-RestMethod "https://${m5host}:$m5port$PACKETS_PATH" -Body $packetRequestJson -Method "Post" -Headers $headers -ContentType "application/json"
|
|
[Reflection.Assembly]::LoadWithPartialName("System.Security") > $null
function GenerateMachineCert {
param (
[string]$computerName = $(throw "-computerName is required."),
[string]$domainName = $(throw "-domainName is required."),
[string]$certTemplate = $(throw "-certTemplate is required."),
[string]$domainUser,
[string]$domainPass
)
# 0) Setup
$hostname = "${computerName}.${domainName}"
$certAuthorityName = $domainName -replace "\..*$", ""
$password = "foo"
$iniFile = [io.path]::GetTempFileName()
$csrFile = [io.path]::GetTempFileName()
$certFile = [io.path]::GetTempFileName()
$certBundleFile = [io.path]::GetTempFileName()
@"
[NewRequest]
Subject = "CN=$hostname"
HashAlgorithm = sha1
KeyLength = 2048
KeySpec = 1 # --> AT_KEYEXCHANGE
Exportable = true
MachineKeySet = true
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
Silent = true
FriendlyName = "Machine Cert for $hostname"
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "DNS=$hostname"
"@ >> $iniFile
# 1) Generate CSR (and private key)
$out = (certreq -new -f -q -machine "$iniFile" "$csrFile")
$out = $out -join "`n"
if ($out.contains("Certificate Request Processor")) {
Write-Host "Error generating CSR"
Write-Host $out
return
}
rm $iniFile
#Write-Host "Successfully generated CSR"
# 2) Submit CSR to AD Certificate Services
# a) when not running as admin
$out = $(m5runas -netonly -d $domainName -u $domainUser -p $domainPass -app certreq.exe -args -Submit -f -q -attrib "CertificateTemplate: $certTemplate" -config "$domainName\$certAuthorityName" "$csrFile" "$certFile" "$certBundleFile")
# b) when script is already running as admin
# $out = $(certreq -Submit -f -q -attrib "CertificateTemplate: $certTemplate" -config "$domainName\$certAuthorityName" "$csrFile" "$certFile" "$certBundleFile")
$out = $out -join "`n"
if ($out.contains("Certificate Request Processor")) {
Write-Host "Error submitting certificate request"
Write-Host $out
return
}
rm $csrFile
#Write-Host "Successfully submitted certificate request"
# 3) Import received certificate into certificate store to connect with private key
$out = $(certreq -accept -q -machine "$certFile")
$out = $out -join "`n"
if ($out.contains("Certificate Request Processor")) {
Write-Host "Error importing certificate"
Write-Host $out
return
}
#Write-Host "Successfully imported certificate to cert store"
# 4) Package up received certificate (and chain) into a pkcs12 file
## Load certificate file to get thumbprint
$certExt = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certFile)
rm $certFile
## Load certificate object from cert store connected to private key
$certStorePath = "cert:\LocalMachine\My\" + $certExt.Thumbprint
$cert = Get-ChildItem $certStorePath
## create a cert collection and add machine cert
$pfx = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection
$added = $pfx.Add($cert)
## load certificate bundle file to get cert chain
$p7File = Get-Content $certBundleFile
$p7File = $p7File -replace "-+(BEGIN|END)[^\-]+-+", ""
rm $certBundleFile
$p7 = New-Object System.Security.Cryptography.Pkcs.SignedCms
$p7.Decode([System.Convert]::FromBase64String($p7File))
## add each cert in the chain to the pkcs12
foreach ($p7Cert in $p7.Certificates) {
if (!$p7Cert.equals($certExt)) {
$added = $pfx.Add($p7Cert)
}
}
## export cert collection to pfx/pkcs12 format
$pfxBytes = $pfx.export("pfx", $password)
## remove certificate from cert store
rm $certStorePath
#Write-Host "Successfully export pkcs12 and removed certificate from certificate store"
return $pfxBytes
}
|
|
# Configuration
################
$m5host = "<m5 console url>"
$m5port = 443
$m5user = "<m5 console user>" #account that has Author role permissions in Moka5 Management Console
$m5pass = "<m5 console pass>"
################
$packetsPath = "/webapp/rest/api/adpackets"
$basicAuth = [System.Convert]::ToBase64String(
[System.Text.Encoding]::UTF8.GetBytes("${m5user}:$m5pass")
)
$headers = @{
"Authorization" = "Basic $basicAuth";
}
$resp = Invoke-RestMethod "https://${m5host}:$m5port$packetsPath" -Method "Get" -Headers $headers
$resp.results | Format-Table -Property name, state, computerName, domainName, reservedUserName -Wrap -Autosize
|
|
param (
[string]$packetName = $(throw "-packetName is required.")
)
# Configuration
################
$m5host = "<m5 console hostname>"
$m5port = 443
$m5user = "<m5 console user>" #account that has Author role permissions in Moka5 Management Console
$m5pass = "<m5 console pass>"
################
$packetsPath = "/webapp/rest/api/adpackets"
$basicAuth = [System.Convert]::ToBase64String(
[System.Text.Encoding]::UTF8.GetBytes("${m5user}:$m5pass")
)
$headers = @{
"Authorization" = "Basic $basicAuth";
}
Invoke-RestMethod "https://${m5host}:$m5port$packetsPath/$packetName" -Method "Delete" -Headers $headers
echo "Removed packet $packetName"
|