Get-UserSupportedEncryptionTypes.ps1

something exciting

Some information about the exciting thing

Table of contents generated with markdown-toc


Script

Import-Module ActiveDirectory

# Windows Server 2008 and above
# This account supports Kerberos AES 128 bit encryption
# This account supports Kerberos AES 256 bit encryption
# msDS-SupportedEncryptionTypes
# CRC (KERB_ENCTYPE_DES_CBC_CRC, 0x00000001): Supports CRC32
# MD5 (KERB_ENCTYPE_DES_CBC_MD5, 0x00000002): Supports RSA-MD5
# RC4 (KERB_ENCTYPE_RC4_HMAC_MD5, 0x00000004): Supports RC4-HMAC-MD5
# A128 (KERB_ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0x00000008): Supports HMAC-SHA1-96-AES128
# A256 (KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0x00000010): Supports HMAC-SHA1-96-AES256

function resolve-EncryptionTypes {
    param (
        [int]$key
    )
    switch ($key) {
        "1" { $SupportedEncryptionTypes = @("DES_CRC") }
        "2" { $SupportedEncryptionTypes = @("DES_MD5") }
        "3" { $SupportedEncryptionTypes = @("DES_CRC", "DES_MD5") }
        "4" { $SupportedEncryptionTypes = @("RC4") }
        "8" { $SupportedEncryptionTypes = @("AES128") }
        "16" { $SupportedEncryptionTypes = @("AES256") }
        "24" { $SupportedEncryptionTypes = @("AES128", "AES256") }
        "28" { $SupportedEncryptionTypes = @("RC4", "AES128", "AES256") }
        "31" { $SupportedEncryptionTypes = @("DES_CRC", "DES_MD5", "RC4", "AES128", "AES256") }
        default { $SupportedEncryptionTypes = @("Undefined value of $key") }
    }
    $SupportedEncryptionTypes
}
$Users = Get-ADUser -Properties * -LdapFilter "(&(objectclass=user)(objectcategory=user)(msDS-SupportedEncryptionTypes=*)(!msDS-SupportedEncryptionTypes=0))" | Select-Object -Property Name, @{N = "EncryptionTypes"; E = { resolve-EncryptionTypes $($_."msDS-SupportedEncryptionTypes") } }
foreach ($User in $Users) {
    $User.Name
    foreach ($EncryptionType in $User.EncryptionTypes) {
        $EncryptionType
    }
}

Back to Top


Download

Please feel free to copy parts of the script or if you would like to download the entire script, simple click the download button. You can download the complete repository in a zip file by clicking the Download link in the menu bar on the left hand side of the page.


Report Issues

You can report an issue or contribute to this site on GitHub. Simply click the button below and add any relevant notes. I will attempt to respond to all issues as soon as possible.

Issue


Back to Top