Create Get-PublishedTemplates

[SamErde]

Get-PublishedTemplates pulls a list of published templates with their name, OID, flags, enrollment flag, whenModified, revision, and minor revision. This should help us check if vulnerable templates are published and also ultimately check if the vulnerable version is in use by issued certificate requests.

Please review the bitwise checks for the template's flags and mspki-enrollment-flag properties to see if the logic is correct and returns all published templates in your test environments.

Contributes to #87.

[TrimarcJake]

Big comment in code. Feel free to hit me up for more details.

[TrimarcJake]

Your logic doesn't seem consistent with what's actually published, but it's very possible I'm missing something.

Your code returns this from my lab CA:

But the Certificate Templates list on my lab CA looks like this:

Which matches CA's object's cetificateTemplates attribute expanded:

Note: The Certificate Templates pane shows the templates displayName attribute while the expanded certificateTemplates list shows the name attribute.

This function should be rewritten to see if the template name exists within the certificateTemplates attribute on any pKIEnrollmentService object. We already collect the required attribute in Get-ADCSObject, so I think you could:

1. Collect all the published template names from all the CA objects
2. De-duplicate the list and store it as $PublishedTemplates
3. Loop through the templates to see if $PublishedTemplates -contains $TemplateName
4. Return $true or $false to enrich the template object as a custom attribute.

Or whatever you want to do. You probably have a more elegant way of doing it.

[SamErde]

Thinking about de-duplicating the list and the possibility of different versions of a template being published on different CAs. Is that possible, and if so: does a published template on multiple CAs have the same OID for each instance, or a unique one per CA?

EDIT: I think I found that the answer is no to both questions. One version across all CAs and the same OID for the template on all CAs.

[TrimarcJake]

@SamErde what's the status on this? The current version seems to return no result.

[SamErde]

Will try to find time to revive and resolve this week.

[TrimarcJake]

@SamErde and I chatted. We're gonna go a different route. Thanks for playing along at home, everyone!