Advertisement
dantpro

Disable Kerberos Group SID Compression

Apr 11th, 2014
690
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 1.08 KB | None
  1. # DisableKerbGroupCompression.ps1
  2. # http://support.microsoft.com/kb/2774190
  3. #
  4. # Script to Disable Kerberos Group SID Compression
  5. #
  6. param( $principalName)
  7. $newValue = 0
  8. # Get the AD principal and value
  9. $obj = get-adobject -Filter {(cn -like $principalName)} -Properties *
  10. if($obj -eq $null)
  11. {
  12.   Write-Host "Cannot find $principalName in the directory"
  13.   break
  14. }
  15. $newValue = $value = $obj."msDS-SupportedEncryptionTypes"
  16. $msgBefore =$msgAfter = "Resource group compression status on principal {0}: " -f $principalName
  17. if( ($value -band 0x0080000) -eq 0)
  18.   {$msgBefore += "Enabled"}
  19. else
  20.   {$msgBefore += "Disabled"}
  21. Write-Host $msgBefore
  22. if( ($value -band 0x00080000) -eq 0) #enable the disable bit
  23.   {$newValue = $value -bor 0x00080000}
  24. if($newValue -ne $value) #update if values are different
  25. {
  26.   Set-ADObject $obj -Replace @{"msDS-SupportedEncryptionTypes"=$newValue}
  27.   if( ($newvalue -band 0x0080000) -eq 0)
  28.     {$msgAfter += "Enabled"}
  29.   else
  30.     {$msgAfter += "Disabled"}
  31.   Write-Host $msgAfter
  32. }
  33. else
  34. { Write-Host "Resource group compression did not change."}
Advertisement
RAW Paste Data Copied
Advertisement