Updated PowerShell initialization to check for appropriate permissions when running IIS jobs.

Author: Bob Pokorny

CHANGELOG.md

@@ -5,6 +5,8 @@
 * .NET6 assemblies are no longer supported.
 * Fixed a problem when passing a bad CSP, the job was reporting successful, but did not actually add/bind the certificate.
 * Enhanced Crypto Service Provider (CSP) discovery and validation to work correctly on localized Windows installations. Customers running Traditional Chinese Windows (zh-TW / CP950) reported that certificate add jobs were failing with "Crypto Service Provider ... is either invalid or not found on this system." even when the requested CSP was installed. The root cause was that `Get-CryptoProviders` parsed `certutil -csplist` output and matched on the literal English label "Provider Name:", which is translated on non en-US Windows, causing the enumerated provider list to come back empty and every CSP name to fail validation. Provider enumeration now reads from the culture-invariant registry hive `HKLM:\SOFTWARE\Microsoft\Cryptography\Defaults\Provider` (with a code-page-safe `certutil` fallback for hardened systems where the registry hive is unavailable), and CSP name matching in `Validate-CryptoProvider` now uses ordinal, case-insensitive comparison so results are unaffected by the current thread culture (Turkish-I folding, full-/half-width character folding, etc.).
+* Since adding JEA, lower privileged users can now run the extension in a local PowerShell Runspace without needing to be a member of the Administrators group.  This is a security improvement, but it does require that the user has been granted access to the JEA endpoint on the target server.  When running IIS jobs without JEA endpoints, the credentials entered will still need Administrative permissions.  If you are running into permission issues, please check your JEA configuration and ensure that the user has been granted access to the endpoint.
+* Fixed IIS Inventory error propagation across all connection types (Local, WinRM, JEA, SSH). Previously, when the cmdlet encountered errors (e.g., insufficient admin rights), it used Write-Warning/Write-Information which didn't signal failure to the orchestrator. Over remote sessions, PS.HadErrors remained false and jobs returned 0 certificates with no indication of failure, making it impossible to distinguish between "no certificates found" vs "access denied". The cmdlet now returns structured KeyfactorResult JSON objects for all error scenarios, which the orchestrator detects and reports in JobResult.FailureMessage. This ensures reliable error detection and reporting regardless of connection type (Local PowerShell, WinRM HTTP/HTTPS, JEA endpoints, SSH sessions).
 
 3.0.2
 
@@ -23,26 +25,27 @@
 * Fixed the SNI/SSL flag being returned during inventory, now returns extended SSL flags
 * Fixed the SNI/SSL flag when binding the certificate to allow for extended SSL flags
 * Added SSL Flag validation to make sure the bit flag is correct.  These are the valid bit flags for the version of Windows:
-  ### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)
+### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)
+
 
   * 0    No SNI
   * 1    Use SNI
   * 2    Use Centralized SSL certificate store.
 
-  ### Windows Server 2016 (IIS 10.0)
+### Windows Server 2016 (IIS 10.0)
 
   * 0    No SNI
   * 1    Use SNI
   * 4    Disable HTTP/2.
 
-  ### Windows Server 2019 (IIS 10.0.17763)
+### Windows Server 2019 (IIS 10.0.17763)
 
   * 0    No SNI
   * 1    Use SNI
   * 4    Disable HTTP/2.
   * 8    Disable OCSP Stapling.
 
-  ### Windows Server 2022+ (IIS 10.0.20348+)
+### Windows Server 2022+ (IIS 10.0.20348+)
 
   * 0    No SNI
   * 1    Use SNI

IISU/ClientPSCertStoreReEnrollment.cs

@@ -94,7 +94,7 @@ public JobResult PerformReEnrollment(ReenrollmentJobConfiguration config, Submit
                 string clientMachineName = config.CertificateStoreDetails.ClientMachine;
                 string storePath = config.CertificateStoreDetails.StorePath;
 
-                _psHelper = new(protocol, port, includePortInSPN, clientMachineName, serverUserName, serverPassword, jeaEndpoint: jeaEndpoint);
+                _psHelper = new(protocol, port, includePortInSPN, clientMachineName, serverUserName, serverPassword, jeaEndpoint: jeaEndpoint, adminPrivilegesRequired: bindingType == CertStoreBindingTypeENUM.WinIIS);
                 _psHelper.Initialize();
 
                 using (_psHelper)

IISU/ImplementedStoreTypes/WinIIS/Inventory.cs

@@ -128,7 +128,7 @@ public List<CurrentInventoryItem> QueryIISCertificates(RemoteSettings settings)
         {
             List<CurrentInventoryItem> Inventory = new();
 
-            using (PSHelper ps = new(settings.Protocol, settings.Port, settings.IncludePortInSPN, settings.ClientMachineName, settings.ServerUserName, settings.ServerPassword, jeaEndpoint: settings.JEAEndpointName))
+            using (PSHelper ps = new(settings.Protocol, settings.Port, settings.IncludePortInSPN, settings.ClientMachineName, settings.ServerUserName, settings.ServerPassword, jeaEndpoint: settings.JEAEndpointName, adminPrivilegesRequired: true))
             {
                 ps.Initialize();
 

IISU/ImplementedStoreTypes/WinIIS/Management.cs

@@ -97,7 +97,7 @@ public JobResult ProcessJob(ManagementJobConfiguration config)
                 // Assign the binding information
                 IISBindingInfo bindingInfo = new IISBindingInfo(config.JobProperties);
 
-                _psHelper = new(protocol, port, includePortInSPN, _clientMachineName, serverUserName, serverPassword, jeaEndpoint: jeaEndpoint);
+                _psHelper = new(protocol, port, includePortInSPN, _clientMachineName, serverUserName, serverPassword, jeaEndpoint: jeaEndpoint, adminPrivilegesRequired:true);
 
                 _psHelper.Initialize();
 

IISU/PSHelper.cs

@@ -62,6 +62,7 @@ public class PSHelper : IDisposable
         private bool isADFSStore = false;
         private string jeaEndpoint = "";
         private bool useJea => !string.IsNullOrEmpty(jeaEndpoint);
+        private bool adminPrivilegesRequired = false;
 
         public bool IsLocalMachine
         {
@@ -97,7 +98,7 @@ public PSHelper()
             _logger = LogHandler.GetClassLogger<PSHelper>();
         }
 
-        public PSHelper(string protocol, string port, bool useSPN, string clientMachineName, string serverUserName, string serverPassword, bool isADFSStore = false, string jeaEndpoint = "")
+        public PSHelper(string protocol, string port, bool useSPN, string clientMachineName, string serverUserName, string serverPassword, bool isADFSStore = false, string jeaEndpoint = "", bool adminPrivilegesRequired = false)
         {
             this.protocol = protocol.ToLower();
             this.port = port;
@@ -107,6 +108,7 @@ public PSHelper(string protocol, string port, bool useSPN, string clientMachineN
             this.serverPassword = serverPassword;
             this.isADFSStore = isADFSStore;
             this.jeaEndpoint = jeaEndpoint;
+            this.adminPrivilegesRequired = adminPrivilegesRequired;
 
             _logger = LogHandler.GetClassLogger<PSHelper>();
             _logger.LogTrace("Entered PSHelper Constructor");
@@ -185,6 +187,57 @@ public void Initialize()
                     _logger.LogTrace($"{result}");
                 }
             }
+
+            // Check if admin privileges are required and if the current user has them
+            if (adminPrivilegesRequired)
+            {
+                bool isAdmin;
+                string errorMessage = null;
+
+                if (isLocalMachine)
+                {
+                    if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
+                    {
+                        using var identity = System.Security.Principal.WindowsIdentity.GetCurrent();
+                        var principal = new System.Security.Principal.WindowsPrincipal(identity);
+                        isAdmin = principal.IsInRole(System.Security.Principal.WindowsBuiltInRole.Administrator);
+
+                        if (!isAdmin)
+                        {
+                            errorMessage = $"Administrator privileges are required to perform this operation. " +
+                                           $"Current identity: {identity.Name}.";
+                        }
+                    }
+                    else
+                    {
+                        isAdmin = false;
+                        errorMessage = "Administrator privileges are required to perform this operation.";
+                    }
+                }
+                else
+                {
+                    // Single source of truth: call the same cmdlet PowerShell callers use
+                    const string checkAdminScript = "Test-KeyfactorAdminRights -Step 'RemoteAdminCheck'";
+                    var results = ExecutePowerShell(checkAdminScript, isScript: true);
+
+                    if (results == null || results.Count == 0)
+                    {
+                        // Cmdlet returns $null when the identity has admin rights
+                        isAdmin = true;
+                    }
+                    else
+                    {
+                        isAdmin = false;
+                        errorMessage = results[0].Properties["ErrorMessage"]?.Value?.ToString()
+                            ?? "Administrator privileges are required to perform this operation.";
+                    }
+                }
+
+                if (!isAdmin)
+                {
+                    throw new Exception(errorMessage);
+                }
+            }
         }
 
         private void InitializeRemoteSession()

IISU/PowerShell/Keyfactor.WinCert.Common/Private/Test-KeyfactorAdminRights.ps1

@@ -2,21 +2,37 @@ function Test-KeyfactorAdminRights {
     [CmdletBinding()]
     [OutputType([pscustomobject])]
     param(
-        [string]$Step = "AdminCheck"
+        [string]$Step = "AdminCheck",
+        [switch]$Force
     )
 
-    $currentIdentity = [Security.Principal.WindowsIdentity]::GetCurrent()
-    $principal = [Security.Principal.WindowsPrincipal]::new($currentIdentity)
-
-    if ($principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
-        return $null
+    # Return cached result if we've already checked this session (identity won't
+    # change mid-session, so this avoids redundant token lookups on repeat calls)
+    if (-not $Force -and $script:__KfAdminCheckDone) {
+        return $script:__KfAdminCheckResult
     }
 
-    $errorMessage = "This operation requires an elevated session (Run as Administrator) " +
-        "or a JEA endpoint whose RunAs identity has local Administrator rights on this machine. " +
-        "Current identity: $($currentIdentity.Name)."
+    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+    try {
+        $isAdmin = [Security.Principal.WindowsPrincipal]::new($identity).IsInRole(
+            [Security.Principal.WindowsBuiltInRole]::Administrator)
 
-    Write-Warning $errorMessage
+        if ($isAdmin) {
+            $result = $null
+        }
+        else {
+            $errorMessage = "This operation requires an elevated session (Run as Administrator) " +
+                "or a JEA endpoint whose RunAs identity has local Administrator rights on this machine. " +
+                "Current identity: $($identity.Name)."
+            Write-Warning $errorMessage
+            $result = New-KeyfactorResult -Status Error -Code 240 -Step $Step -ErrorMessage $errorMessage
+        }
 
-    return New-KeyfactorResult -Status Error -Code 240 -Step $Step -ErrorMessage $errorMessage
-}
+        $script:__KfAdminCheckResult = $result
+        $script:__KfAdminCheckDone = $true
+        return $result
+    }
+    finally {
+        $identity.Dispose()
+    }
+}

IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Get-KeyfactorIISBoundCertificates.ps1

@@ -3,14 +3,6 @@ function Get-KeyfactorIISBoundCertificates {
     $certificates = @()
     $totalBoundCertificates = 0
 
-    #
-    # Verify the current process is running with an elevated token.
-    #
-    $adminCheck = Test-KeyfactorAdminRights
-    if ($adminCheck) {
-        Write-Error $adminCheck.ErrorMessage -ErrorAction Stop
-    }
-
     try {
         Add-Type -Path "$env:windir\System32\inetsrv\Microsoft.Web.Administration.dll" -ErrorAction Stop
         $serverManager = [Microsoft.Web.Administration.ServerManager]::new()

IISU/PowerShell/Keyfactor.WinCert.IIS/Public/New-KeyfactorIISSiteBinding.ps1

@@ -25,10 +25,6 @@
     Write-Information "[VERBOSE] Parameters: $(($PSBoundParameters.GetEnumerator() | ForEach-Object { "$($_.Key): '$($_.Value)'" }) -join ', ')"
 
     try {
-        $adminCheck = Test-KeyfactorAdminRights
-        if ($adminCheck) {
-            return $adminCheck
-        }
 
         # Step 1: Perform verifications and get management info
         # Check SslFlags

IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Remove-KeyfactorIISCertificateIfUnused.ps1

@@ -9,11 +9,6 @@ function Remove-KeyfactorIISCertificateIfUnused {
         [string]$StoreName = "My"
     )
 
-    $adminCheck = Test-KeyfactorAdminRights
-    if ($adminCheck) {
-        return $adminCheck
-    }
-
     try {
         Add-Type -Path "$env:windir\System32\inetsrv\Microsoft.Web.Administration.dll"
     }

IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Remove-KeyfactorIISSiteBinding.ps1

@@ -13,11 +13,6 @@
         [System.Nullable[bool]]$UseIISDrive = $null
     )
 
-    $adminCheck = Test-KeyfactorAdminRights
-    if ($adminCheck) {
-        return $adminCheck
-    }
-
     # Auto-detect IIS Drive availability if not explicitly provided
     if ($null -eq $UseIISDrive) {
         $UseIISDrive = Test-IISDrive