POSH-UserPukMGT

0.1.2

Private/Storage/ActiveDirectory/Get-PukAdAllRecords.ps1

function Get-PukAdAllRecords {
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseSingularNouns', '', Justification = 'Bulk-fetch-all private helper; "AllRecords" is the clearest name for this specific verb+noun family (see Get-PukAdRecord for the single-record counterpart) and is not part of the public cmdlet surface.')]
    [CmdletBinding()]
    [OutputType([System.Object[]])]
    param(
        [Parameter(Mandatory)]
        [string]$AttributeName,

        [Parameter(Mandatory)]
        [System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate,

        [string]$Server,

        [string]$SearchBase
    )

    Import-PukActiveDirectoryModule

    # The attribute stores an AES-encrypted blob, so every candidate user must be fetched and
    # decrypted client-side -- there is no way to filter on the plaintext contents server-side.
    $filterParams = @{
        Filter      = "$AttributeName -like '*'"
        Properties  = @($AttributeName)
        ErrorAction = 'Stop'
    }
    if ($Server) { $filterParams.Server = $Server }
    if ($SearchBase) { $filterParams.SearchBase = $SearchBase }

    $candidates = @(Get-ADUser @filterParams)
    $records = @()

    foreach ($candidate in $candidates) {
        $encryptedValue = $candidate.$AttributeName
        if ([string]::IsNullOrEmpty($encryptedValue)) {
            continue
        }

        try {
            $decrypted = Unprotect-PukAdAttributeValue -Value $encryptedValue -Certificate $Certificate
        }
        catch {
            continue
        }

        $records += [PSCustomObject]@{
            DistinguishedName = $candidate.DistinguishedName
            SerialNumber      = $decrypted.SerialNumber
            Puk               = $decrypted.Puk
        }
    }

    return $records
}