#Requires -Version 5.1
<#
    JbTecWiz Support Centre -- generated fix script

    Fault : LDAP channel binding and signing enforcement breaks applications
    Fix   : Restore service, then fix the client properly
    Source: https://jbtecwiz.com/support/srv-id-ldap-signing

    Run as     : Elevated PowerShell
    Expect     : 60 minutes
    Risk       : high
    Reversible : yes

    WHEN THIS IS THE RIGHT FIX
    Enforcement is already on and something is broken.

    HOW TO UNDO IT
    The value can be set back to 1 or 0 while clients are remediated.

    This script walks the fix one step at a time and asks before each
    one. Steps with no command are things you do yourself -- it prints
    those and waits. Run with -DryRun to print without executing.

    --------------------------------------------------------------------
    NO WARRANTY - USE AT YOUR OWN RISK

    This script is provided by JbTecWiz as-is and with no warranty of any
    kind, express or implied. You run it entirely at your own risk.

    JbTecWiz accepts no liability for any loss or damage arising from its
    use, including but not limited to data loss, downtime, or configuration
    changes that turn out to be wrong for your system.

    You are responsible for reading this script before running it, for
    satisfying yourself that it suits the machine in front of you, and for
    having a working backup first. Some steps cannot be undone.
    --------------------------------------------------------------------
#>

[CmdletBinding()]
param(
    # Print every step and command without running anything.
    [switch]$DryRun,
    # Do not ask before each step. Read the script first if you use this.
    [switch]$Unattended
)

$ErrorActionPreference = 'Stop'
$script:Failed = 0

function Write-Rule { param([string]$Text)
    Write-Host ''
    Write-Host ('-' * 70) -ForegroundColor DarkGray
    if ($Text) { Write-Host $Text -ForegroundColor Cyan }
}

function Show-Prose { param([string]$Text, [string]$Colour = "Gray")
    if (-not $Text) { return }
    $words = $Text -split "\s+"; $line = "  "
    foreach ($w in $words) {
        if (($line.Length + $w.Length) -gt 74) { Write-Host $line -ForegroundColor $Colour; $line = "  " }
        $line += "$w "
    }
    if ($line.Trim()) { Write-Host $line -ForegroundColor $Colour }
}

function Invoke-Step {
    param(
        [int]$Number, [string]$Do, [string]$Why,
        [scriptblock]$Command, [switch]$Manual, [string]$Shell = "powershell"
    )
    Write-Rule "  Step $Number of 5"
    Show-Prose $Do "White"
    if ($Why) { Write-Host ""; Show-Prose $Why "DarkGray" }

    if ($Manual) {
        Write-Host ''
        Write-Host '  -> Do this yourself, then press Enter to carry on.' -ForegroundColor Yellow
        if (-not $Unattended -and -not $DryRun) { [void](Read-Host) }
        return
    }

    Write-Host ''
    foreach ($l in ($Command.ToString().Trim() -split "`n")) {
        Write-Host ("    " + $l.Trim()) -ForegroundColor Green
    }
    Write-Host ''

    if ($DryRun) { Write-Host "  (dry run -- not executed)" -ForegroundColor DarkGray; return }
    if (-not $Unattended) {
        $a = Read-Host "  Run this step? [Y]es / [S]kip / [Q]uit"
        if ($a -match "^[Qq]") { Write-Host "  Stopped at your request."; exit 0 }
        if ($a -match "^[Ss]") { Write-Host "  Skipped." -ForegroundColor DarkGray; return }
    }
    try { & $Command }
    catch {
        $script:Failed++
        Write-Host ("  Step $Number failed: " + $_.Exception.Message) -ForegroundColor Red
        Show-Prose "The rest of the fix may depend on this. Read the write-up before carrying on." "Red"
        if (-not $Unattended) {
            $c = Read-Host "  Carry on anyway? [y/N]"
            if ($c -notmatch "^[Yy]") { exit 1 }
        }
    }
}

Write-Rule
Write-Host '  LDAP channel binding and signing enforcement breaks applications' -ForegroundColor White
Write-Host '  Restore service, then fix the client properly' -ForegroundColor Cyan
Write-Host ''
Write-Host '  Risk: high   Reversible   60 minutes'
Write-Host ''
Show-Prose 'No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.' 'DarkYellow'
Write-Rule

if (-not $Unattended -and -not $DryRun) {
    $go = Read-Host '  Ready? [y/N]'
    if ($go -notmatch "^[Yy]") { Write-Host "  Nothing was changed."; exit 0 }
}

Invoke-Step -Number 1 -Do 'Identify what is failing, from the controller''s own log.' -Command {
    Get-WinEvent -LogName 'Directory Service' -MaxEvents 200 | Where-Object Id -in 2889,3039,3040 | Format-List TimeCreated,Id,Message
}

Invoke-Step -Number 2 -Do 'Fix the client first if you can -- configure it for LDAPS on 636. That is the permanent answer and it is often a single setting.' -Command {
    Test-NetConnection dc01.example.local -Port 636 -InformationLevel Detailed
}

Invoke-Step -Number 3 -Do 'Confirm the controller has a certificate suitable for LDAPS, or the client cannot switch even when configured to.' -Command {
    Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.EnhancedKeyUsageList.FriendlyName -contains 'Server Authentication' } | Format-Table Subject,NotAfter,Thumbprint
}

Invoke-Step -Number 4 -Do 'Only if a critical system cannot be fixed immediately, relax enforcement temporarily and schedule the real fix.' -Why 'Value 1 is "when supported", which lets older clients through. It is a genuine reduction in protection against relay attacks, so it belongs on a dated ticket rather than in the permanent configuration.' -Command {
    Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Name LdapEnforceChannelBinding -Value 1 -Type DWord
    Restart-Service NTDS -Force
}

Invoke-Step -Number 5 -Do 'Restore enforcement once the clients are fixed.' -Command {
    Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Name LdapEnforceChannelBinding -Value 2 -Type DWord
}

Write-Rule "  Confirm it worked"
Show-Prose 'The application authenticates over LDAPS and enforcement is back at 2.' 'White'
Write-Host ''
if (-not $DryRun) {
    Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' | Format-List LdapEnforceChannelBinding,LDAPServerIntegrity
}

Write-Rule
if ($script:Failed -gt 0) {
    Write-Host ("  Finished with " + $script:Failed + " failed step(s).") -ForegroundColor Yellow
    Show-Prose 'Read the full write-up at https://jbtecwiz.com/support/srv-id-ldap-signing' 'Yellow'
} else {
    Write-Host '  Finished.' -ForegroundColor Green
}
Write-Host ''
Show-Prose 'To undo: The value can be set back to 1 or 0 while clients are remediated.' 'DarkGray'
Write-Rule