LM, NTLMv1 und NTLMv2: sei‘ vobei! (Hexhex)

Import-Module ActiveDirectory

function Debug-LdapFilterValue {
  param([Parameter(Mandatory)][string]$Value)
  # LDAP filter escaping: \  *  (  )  NUL
  $Value = $Value -replace '\\','\5c'
  $Value = $Value -replace '\*','\2a'
  $Value = $Value -replace '\(','\28'
  $Value = $Value -replace '\)','\29'
  $Value = $Value -replace "`0",'\00'
  return $Value
}

function Sync-IpSpnsForComputer {
  [CmdletBinding(SupportsShouldProcess)]
  param(
    [Parameter(Mandatory)]
    [string]$ComputerName,

    [switch]$AllIPv4,
    [switch]$RemoveStale
  )

  $ipv4Regex = '^\d{1,3}(\.\d{1,3}){3}$'

  $adComp = Get-ADComputer -Identity $ComputerName -Properties servicePrincipalName, dNSHostName
  $currentSpns = @($adComp.servicePrincipalName)
  if (-not $currentSpns) { throw "Computer '$ComputerName' hat keine SPNs." }

  $dnsName = if ($adComp.dNSHostName) { $adComp.dNSHostName } else { $ComputerName }
  $dnsIPv4s = @(Resolve-DnsName -Name $dnsName -Type A -ErrorAction Stop |
      Where-Object { $_.IPAddress -match $ipv4Regex } |
      Select-Object -ExpandProperty IPAddress -Unique)

  if (-not $dnsIPv4s) { throw "Keine IPv4 für '$dnsName' gefunden." }
  if (-not $AllIPv4) { $dnsIPv4s = @($dnsIPv4s[0]) }

  # Serviceklassen aus hostbasierten SPNs ableiten
  $serviceClasses = @(
    foreach ($spn in $currentSpns) {
      if ($spn -match '^(?[^/]+)/(?.+)$') {
        $rhs = $matches['rhs']
        $hostPart = ($rhs -split ':', 2)[0]
        if ($hostPart -notmatch $ipv4Regex) { $matches['svc'] }
      }
    }
  ) | Select-Object -Unique

  if (-not $serviceClasses) { throw "Keine hostbasierten SPNs gefunden." }

  $wantedIpSpns = foreach ($ip in $dnsIPv4s) {
    foreach ($svc in $serviceClasses) { "$svc/$ip" }
  }

  $toAdd = $wantedIpSpns | Where-Object { $currentSpns -notcontains $_ } | Select-Object -Unique

  $toRemove = @()
  if ($RemoveStale) {
    $svcRegex = ($serviceClasses | ForEach-Object { [regex]::Escape($_) }) -join '|'
    $ipSpnRegex = "^(?:$svcRegex)\/(?\d{1,3}(?:\.\d{1,3}){3})$"

    $toRemove = $currentSpns | Where-Object {
      ($_ -match $ipSpnRegex) -and ($matches['ip'] -notin $dnsIPv4s)
    } | Select-Object -Unique
  }

  # Duplikat-Check in AD (alle Objekttypen)
  foreach ($spn in $toAdd) {
    $escaped = Debug-LdapFilterValue $spn
    $dup = Get-ADObject -LDAPFilter "(servicePrincipalName=$escaped)" -Properties servicePrincipalName -ErrorAction Stop

    if ($dup -and ($dup.DistinguishedName -ne $adComp.DistinguishedName)) {
      throw "SPN '$spn' existiert bereits auf '$($dup.DistinguishedName)'. Abbruch (Duplikat/SPN-Konflikt)."
    }
  }

    $toAdd = @($toAdd | Where-Object { $_ } | ForEach-Object { [string]$_ } | Select-Object -Unique)

    if ($toAdd.Count -gt 0) {
          foreach ($spn in $toAdd) {
            & setspn.exe -S $spn $adComp.Name
            if ($LASTEXITCODE -ne 0) { Write-Warning "Konnte SPN nicht hinzufügen: $spn" }
          }
        }

        if ($toRemove.Count -gt 0) {
          foreach ($spn in $toRemove) {
            & setspn.exe -D $spn $adComp.Name
            if ($LASTEXITCODE -ne 0) { Write-Warning "Konnte SPN nicht entfernen: $spn" }
          }
        }

  [pscustomobject]@{
    ComputerName          = $ComputerName
    DnsName               = $dnsName
    DnsIPv4               = ($dnsIPv4s -join ', ')
    DerivedServiceClasses = ($serviceClasses -join ', ')
    Added                 = ($toAdd -join ', ')
    Removed               = ($toRemove -join ', ')
  }
}