Public/Get-PWSHPUKMGT-DeviceSerial.ps1
|
<# .SYNOPSIS Gets the crypto device serial number linked to a user. .DESCRIPTION Resolves the given identity in Active Directory, looks up its PWSHPUKMGT record in the configured hosting backend (flat file or Active Directory), and returns the linked crypto device serial number. The stored PUK is never included in the output. .PARAMETER Identity A SamAccountName, UserPrincipalName, or DistinguishedName identifying the user. Accepts pipeline input, including AD user objects. .PARAMETER Server The domain controller to run the underlying LDAP requests against. Defaults to the value configured in hosting.activeDirectory.server, or, if that is not set either, to the primary domain controller (PDC emulator) of the current domain. .EXAMPLE Get-PWSHPUKMGT-DeviceSerial -Identity 'alice' .EXAMPLE Get-ADUser -Filter * | Get-PWSHPUKMGT-DeviceSerial .OUTPUTS PSCustomObject Has Identity, DistinguishedName, and SerialNumber properties. #> function Get-PWSHPUKMGT-DeviceSerial { [CmdletBinding()] [OutputType([psobject])] param( [Parameter(Mandatory, Position = 0, ValueFromPipeline, ValueFromPipelineByPropertyName)] [Alias('SamAccountName', 'UserPrincipalName', 'DistinguishedName')] [string]$Identity, [string]$Server ) begin { $config = Get-PukModuleConfig $certificate = Test-PukCertificate -Thumbprint $config.certificate.thumbprint -StoreLocation $config.certificate.storeLocation -RequiredEkuOids $config.certificate.requiredEkuOids $effectiveServer = Resolve-PukServer -Server $Server -Config $config } process { $distinguishedName = Resolve-PukIdentity -Identity $Identity -Server $effectiveServer $record = Get-PukRecord -Config $config -Certificate $certificate -DistinguishedName $distinguishedName -Server $effectiveServer if (-not $record) { Write-Error "No PWSHPUKMGT record found for '$Identity'." return } [PSCustomObject]@{ PSTypeName = 'PWSHPUKMGT.DeviceSerialResult' Identity = $Identity DistinguishedName = $record.DistinguishedName SerialNumber = $record.SerialNumber } } } |