ArcforServerSamples/ArcESUEnabled.ps1 at main · nitinbps/ArcforServerSamples · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
# Get the Extended Security Update License contents.
function Get-ESUDocument {
    [CmdletBinding()]
    param
    (
        [Parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        [string] $ESUSignedDocument
    )
    $attestedDoc = (Get-Content $ESUSignedDocument | Out-String | ConvertFrom-Json);
    $signature = [System.Convert]::FromBase64String($attestedDoc.signature);
    $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]($signature);
    $chain = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Chain;
    $chain.Build($cert) | Out-Null;
    $certificateChain = '';
    foreach($element in $chain.ChainElements)
    {
        $certificateChain = $certificateChain + $element.Certificate.Subject + ';';
    }

    Add-Type -AssemblyName System.Security;
    $signedCms = New-Object -TypeName System.Security.Cryptography.Pkcs.SignedCms;
    $signedCms.Decode($signature);
    $content = [System.Text.Encoding]::UTF8.GetString($signedCms.ContentInfo.Content);
    $json = $content | ConvertFrom-Json;
    $json | add-member -Name 'schemaVersion' -value $attestedDoc.schemaVersion -MemberType NoteProperty;
    $json | add-member -Name 'certificateChain' -value $certificateChain -MemberType NoteProperty;
    return $json;
}

# Get the Extended Security Update License contents.
function Get-ESUDocumentSignatureChain {
    [CmdletBinding()]
    param
    (
        [Parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        [string] $ESUSignedDocument
    )
    $attestedDoc = (Get-Content $ESUSignedDocument | Out-String | ConvertFrom-Json);
    $signature = [System.Convert]::FromBase64String($attestedDoc.signature);
    $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]($signature);
    $chain = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Chain;
    $chain.Build($cert) | Out-Null;
    $certificateChain = '';
    foreach($element in $chain.ChainElements)
    {
        $certificateChain = $certificateChain + $element.Certificate.Subject + ';';
    }

    return $certificateChain;
}

# Test the Extended Security Update enrollment.
function Test-ESUEnrollment {
    [CmdletBinding()]
    [OutputType([Boolean])]
    param
    (
    )

    $esuSignedDocument = [System.Environment]::ExpandEnvironmentVariables("%programdata%\\AzureConnectedMachineAgent\\Certs\\License.json");
    if(-not (Test-Path $esuSignedDocument -PathType Leaf))
    {
        Write-Verbose 'Extended Security Update License does not exist.';
        return $false;
    }

    $esuDocument = Get-ESUDocument -ESUSignedDocument $esuSignedDocument;
    if(([Datetime]$esuDocument.timeStamp.expiresOn) -lt (Get-Date))
    {
        Write-Verbose 'Extended Security Update License is expired.';
        return $false;
    }

    if((Get-Date $esuDocument.timeStamp.createdOn) -gt (Get-Date))
    {
        Write-Verbose 'Extended Security Update License does not have a valid start date.';
        return $false;
    }

    $esuRegistryKey = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Azure Connected Machine Agent\ArcESU' -ErrorAction SilentlyContinue;
    if(($esuRegistryKey -eq $null) -or ($esuRegistryKey.'Enabled' -ne 1))
    {
        Write-Verbose 'Extended Security Update is not enabled.';
        return $false;
    }

    Write-Verbose 'Extended Security Update is enabled.';
    return $true;
}

Test-ESUEnrollment -Verbose