Merge pull request #248 from rebelinux/testing

Enhance error handling in Get-CAHostObject and Find-ESC7  scripts

Author: jakehildreth

Private/Find-ESC7.ps1

@@ -35,8 +35,8 @@
     )
     process {
         $ADCSObjects | Where-Object {
-            ($_.objectClass -eq 'pKIEnrollmentService') -and
-            ( ($_.CAAdministrator -notmatch 'Failure|CA Unavailable') -or ($_.CertificateManager) )
+            ($_.objectClass -eq 'pKIEnrollmentService') -and $_.CAHostDistinguishedName -and
+            ( ($_.CAAdministrator) -or ($_.CertificateManager) )
         } | ForEach-Object {
             $UnsafeCAAdministrators = Write-Output $_.CAAdministrator -PipelineVariable admin | ForEach-Object {
                 $SID = Convert-IdentityReferenceToSid -Object $admin
@@ -64,8 +64,7 @@
                 }
                 if ($UnsafeCAAdministrators) {
                     $Issue.Issue = $Issue.Issue + @"
-Unexpected principals are granted "CA Administrator" rights on this Certification Authority.
-Unsafe CA Administrators: $($UnsafeCAAdministrators -join ', ').
+Unexpected prinicipals ($($UnsafeCAAdministrators -join ', ')) are granted "CA Administrator" rights on this Certification Authority.
 
 "@
                     $Issue.Fix = $Issue.Fix + @"
@@ -79,16 +78,15 @@ Reinstate CA Administrator rights for $($UnsafeCAAdministrators -join ', ')
                 }
                 if ($UnsafeCertificateManagers) {
                     $Issue.Issue = $Issue.Issue + @"
-Unexpected principals are granted "Certificate Manager" rights on this Certification Authority.
-Unexpected Principals: $($UnsafeCertificateManagers -join ', ')
+Unexpected prinicipals ($($UnsafeCertificateManagers -join ', ')) are granted "Certificate Manager" rights on this Certification Authority.
 
 "@
                     $Issue.Fix = $Issue.Fix + @"
-Revoke Certificate Manager rights from $($UnsafeCertificateManagers -join ', ')
+Revoke CA Administrator rights from $($UnsafeCertificateManagers -join ', ')
 
 "@
                     $Issue.Revert = $Issue.Revert + @"
-Reinstate Certificate Manager rights for $($UnsafeCertificateManagers -join ', ')
+Reinstate CA Administrator rights for $($UnsafeCertificateManagers -join ', ')
 
 "@
                 }

Private/Get-CAHostObject.ps1

@@ -40,11 +40,11 @@
     process {
         if ($Credential) {
             $ADCSObjects | Where-Object objectClass -Match 'pKIEnrollmentService' | ForEach-Object {
-                Get-ADObject $_.CAHostDistinguishedName -Properties * -Server $ForestGC -Credential $Credential
+                if ($_.CAHostDistinguishedName) { Get-ADObject $_.CAHostDistinguishedName -Properties * -Server $ForestGC -Credential $Credential } else { Write-Warning "Get-CAHostObject: Unable to get information from $($_.DisplayName)" }
             }
         } else {
             $ADCSObjects | Where-Object objectClass -Match 'pKIEnrollmentService' | ForEach-Object {
-                Get-ADObject $_.CAHostDistinguishedName -Properties * -Server $ForestGC
+                if ($_.CAHostDistinguishedName) { Get-ADObject -Identity $_.CAHostDistinguishedName -Properties * -Server $ForestGC } else { Write-Warning "Get-CAHostObject: Unable to get information from $($_.DisplayName)" }
             }
         }
     }