diff --git a/src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/AdmPwd.PSModule/AdmPwd.PS.dll b/src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/AdmPwd.PSModule/AdmPwd.PS.dll similarity index 100% rename from src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/AdmPwd.PSModule/AdmPwd.PS.dll rename to src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/AdmPwd.PSModule/AdmPwd.PS.dll diff --git a/src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/AdmPwd.PSModule/AdmPwd.PS.dll-Help.xml b/src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/AdmPwd.PSModule/AdmPwd.PS.dll-Help.xml similarity index 100% rename from src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/AdmPwd.PSModule/AdmPwd.PS.dll-Help.xml rename to src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/AdmPwd.PSModule/AdmPwd.PS.dll-Help.xml diff --git a/src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/AdmPwd.PSModule/AdmPwd.PS.format.ps1xml b/src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/AdmPwd.PSModule/AdmPwd.PS.format.ps1xml similarity index 100% rename from src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/AdmPwd.PSModule/AdmPwd.PS.format.ps1xml rename to src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/AdmPwd.PSModule/AdmPwd.PS.format.ps1xml diff --git a/src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/AdmPwd.PSModule/AdmPwd.PS.psd1 b/src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/AdmPwd.PSModule/AdmPwd.PS.psd1 similarity index 100% rename from src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/AdmPwd.PSModule/AdmPwd.PS.psd1 rename to src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/AdmPwd.PSModule/AdmPwd.PS.psd1 diff --git a/src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/AdmPwd.PSModule/AdmPwd.Utils.dll b/src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/AdmPwd.PSModule/AdmPwd.Utils.dll similarity index 100% rename from src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/AdmPwd.PSModule/AdmPwd.Utils.dll rename to src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/AdmPwd.PSModule/AdmPwd.Utils.dll diff --git a/src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/AdmPwd.PSModule/README.txt b/src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/AdmPwd.PSModule/README.txt similarity index 100% rename from src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/AdmPwd.PSModule/README.txt rename to src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/AdmPwd.PSModule/README.txt diff --git a/src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/Install/Install.ps1 b/src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/Install/Install.ps1 similarity index 95% rename from src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/Install/Install.ps1 rename to src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/Install/Install.ps1 index 98ff703..52a4637 100644 --- a/src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/Install/Install.ps1 +++ b/src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/Install/Install.ps1 @@ -1,8 +1,8 @@ <# Name: ResetLapsPassword -Version: 1.3 +Version: 1.4 Developer: htcfreek (Heiko Horwedel) -Created at: 16.04.2023 +Created at: 24.05.2023 Github URL: https://github.com/htcfreek/PreOS-ResetLapsPassword Systems requirements: @@ -57,6 +57,7 @@ Changes (Date / Version / Author / Change): 2023-03-30 / 1.1 / htcfreek / Fix incorrect detection of missing Windows LAPS on unsupported systems with missing Legacy CSE.; Clean up PXE log in EMC.; Other log improvements (reboot, managed user). 2023-04-04 / 1.2 / htcfreek / Improved reboot behavior on pending Domain join reboot.; Adding a description of the log levels. 2023-04-16 / 1.3 / htcfreek / Fix detection of disabled state for Windows LAPS in Legacy Mode.; Add logging of "Force disabled" state.; Now the script can skip the reset on Windows LAPS with Azure AD as target, if already done. +2023-05-24 / 1.4 / htcfreek / Fix getting Empirum variables.; Fix setting expiration time for Windows LAPS.; Additional non-existing user warnings.; Added hint about configuration details in debug log.; Other small improvements. #> @@ -126,7 +127,13 @@ function ReadEmpirumVariable ([string] $varName, [Switch] $isPwd, [Switch] $retu # $defaultValue = Value to return if variable is empty. If not set, the script aborts on an empty variable. # Return: The variable content as plain text or SecureString. - $varContent = Get-EmpirumVariable -Property $varName -Decrypt $isPwd + # Using the if here is required because "Get-EmpirumVariable ... -Decrypt $isPwd" doesn't work with "$isPwd = $false"!! (GH #20) + if ($isPwd) { + $varContent = Get-EmpirumVariable -Property $varName -Decrypt + } + else { + $varContent = Get-EmpirumVariable -Property $varName + } $isVarContentEmpty = (($null -eq $varContent) -or ($varContent -eq "") -or ($varContent -eq " ")) $logContent = if ($isPwd -and ($isVarContentEmpty -eq $false)) {"*****"} Else {$varContent} @@ -520,9 +527,10 @@ function Get-LapsResetTasks([bool]$LapsIsMandatory) # Get configuration WriteLogDebug "Detecting LAPS configuration ..." $legacyLapsProperties = Get-LegacyLapsState; - $legacyLapsUser = if ([string]::IsNullOrWhiteSpace($legacyLapsProperties.UserName)) { "" } Else { $legacyLapsProperties.UserName }; + $legacyLapsUser = if ([string]::IsNullOrWhiteSpace($legacyLapsProperties.UserName) -and $legacyLapsProperties.Enabled) { "" } Else { $legacyLapsProperties.UserName }; $winLapsProperties = Get-WindowsLapsState -IsLegacyCSE $legacyLapsProperties.Installed; - $winLapsUser = if ([string]::IsNullOrWhiteSpace($winLapsProperties.UserName)) { "" } Else { $winLapsProperties.UserName }; + $winLapsUser = if ([string]::IsNullOrWhiteSpace($winLapsProperties.UserName) -and $winLapsProperties.Enabled) { "" } Else { $winLapsProperties.UserName }; + WriteLogDebug "NOTICE: Some configuration details might be detected wrong in some edge cases if LAPS is not enabled." WriteLogDebug "Legacy Microsoft LAPS: Installed = $(ConvertTo-YesNo $legacyLapsProperties.Installed), Enabled = $(ConvertTo-YesNo $legacyLapsProperties.Enabled), GPO is disabled = $(ConvertTo-YesNo $legacyLapsProperties.ForceDisabled), Managed user = $($legacyLapsUser)" WriteLogDebug "Windows LAPS: Installed = $(ConvertTo-YesNo $winLapsProperties.Installed), Enabled = $(ConvertTo-YesNo $winLapsProperties.Enabled), Configuration set to disabled = $(ConvertTo-YesNo $winLapsProperties.ForceDisabled), Managed user = $($winLapsUser), Configuration source = $($winLapsProperties.ConfigSource), Target Directory = $($winLapsProperties.TargetDirectory), Legacy emulation mode = $(ConvertTo-YesNo $winLapsProperties.LegacyEmulation)" @@ -636,8 +644,14 @@ function Invoke-LapsResetCommands([PSCustomObject]$LapsResetTasks, [bool]$DoRese } Else { + # Checking user account ... + if ($LapsResetTasks.WinLapsUserExists -eq $false) + { + WriteLogInfo "WARNING: The Windows LAPS user does not exist." + } + # We don't need special credentials here because the system account is allowed to reset the password. - Set-LapsADPasswordExpirationTime -ComputerName $env:computername + Set-LapsADPasswordExpirationTime -Identity $env:computername } WriteLogInfo "Password reset for Windows LAPS user: Successfully done." @@ -656,6 +670,16 @@ function Invoke-LapsResetCommands([PSCustomObject]$LapsResetTasks, [bool]$DoRese try { + # Checking user account ... + if ($DoResetImmediately -and $LapsResetTasks.LegacyLapsUserExists -eq $false) + { + WriteLogInfo "WARNING: The Legacy Microsoft LAPS user does not exist! - Only expiration time will be set!" + } + elseif (($DoResetImmediately -eq $false) -and ($LapsResetTasks.WinLapsUserExists -eq $false)) + { + WriteLogInfo "WARNING: The Legacy Microsoft LAPS user does not exist." + } + # We don't need special credentials here because the system account is allowed to reset the password. Reset-AdmPwdPassword -ComputerName $env:computername @@ -664,10 +688,6 @@ function Invoke-LapsResetCommands([PSCustomObject]$LapsResetTasks, [bool]$DoRese # We don't need special credentials here because the system account is allowed to reset the password. & gpupdate.exe /target:computer /force } - elseif ($DoResetImmediately -and $LapsResetTasks.LegacyLapsUserExists -eq $false) - { - WriteLogInfo "WARNING: Legacy Microsoft LAPS user does not exist! - Only expiration time was set!" - } WriteLogInfo "Password reset for legacy Microsoft LAPS user: Successfully done." } diff --git a/src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/LICENSE.txt b/src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/LICENSE.txt similarity index 100% rename from src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/LICENSE.txt rename to src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/LICENSE.txt diff --git a/src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/README.txt b/src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/README.txt similarity index 99% rename from src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/README.txt rename to src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/README.txt index e5aa729..aac3082 100644 --- a/src/ResetLapsPassword 1.3/Data/htcfreek/OsPackages/ResetLapsPassword/1.3/README.txt +++ b/src/ResetLapsPassword 1.4/Data/htcfreek/OsPackages/ResetLapsPassword/1.4/README.txt @@ -5,7 +5,7 @@ PreOS-Package: ResetLapsPassword Author: Heiko Horwedel (htcfreek) -Version: 1.3 +Version: 1.4 PACKAGE INFORMATION diff --git a/src/ResetLapsPassword 1.3/EmpirumPackageData.xml b/src/ResetLapsPassword 1.4/EmpirumPackageData.xml similarity index 96% rename from src/ResetLapsPassword 1.3/EmpirumPackageData.xml rename to src/ResetLapsPassword 1.4/EmpirumPackageData.xml index 79a2a6b..faae5e7 100644 --- a/src/ResetLapsPassword 1.3/EmpirumPackageData.xml +++ b/src/ResetLapsPassword 1.4/EmpirumPackageData.xml @@ -1,6 +1,6 @@  - - + + This package triggers the reset of the LAPS password for the client on which it is running. @@ -10,8 +10,8 @@ 0001-01-01T00:00:00 - 6b9fb755-b8c0-4475-803d-5122cad13193 - ResetLapsPassword 1.3 + bdeb69f8-b2ec-47f5-a931-d69786ef4e79 + ResetLapsPassword 1.4 0 @@ -132,7 +132,7 @@ htcfreek - 1.3 + 1.4 false @@ -143,7 +143,7 @@ This package triggers the reset of the LAPS password for the client on which it is running. - %Packages%\htcfreek\OsPackages\ResetLapsPassword\1.3 + %Packages%\htcfreek\OsPackages\ResetLapsPassword\1.4 0 0 @@ -162,7 +162,7 @@ - htcfreek\OsPackages\ResetLapsPassword\1.3 + htcfreek\OsPackages\ResetLapsPassword\1.4 0