Prepare for release 5.2

MichaelGrafnetter · MichaelGrafnetter · commit dba91c8648f4 · 2025-04-09T09:57:28.000+02:00
diff --git a/Documentation/CHANGELOG.md b/Documentation/CHANGELOG.md
@@ -7,6 +7,17 @@ All notable changes to this project will be documented in this file. The format
 
 ## [Unreleased]
 
+## [5.2] - 2025-04-09
+
+### Added
+
+- Added the [Set-ADDBAccountControl](PowerShell/Set-ADDBAccountControl.md#set-addbaccountcontrol) cmdlet for offline modification of the `userAccountControl` attribute flags.
+- Added a new parameter called `-PostInstallScriptPath` to the [New-ADDBRestoreFromMediaScript](PowerShell/New-ADDBRestoreFromMediaScript.md#new-addbrestorefrommediascript) cmdlet.
+
+### Fixed
+
+- Resolved issue #193: Call to `GetAccounts()` returns `NotImplementedException`.
+
 ## [5.1] - 2025-03-22
 
 ### Added
@@ -570,7 +581,8 @@ This is a [Chocolatey](https://chocolatey.org/packages/dsinternals-psmodule)-onl
 ## 1.0 - 2015-01-20
 Initial release!
 
-[Unreleased]: https://github.com/MichaelGrafnetter/DSInternals/compare/v5.1...HEAD
+[Unreleased]: https://github.com/MichaelGrafnetter/DSInternals/compare/v5.2...HEAD
+[5.2]: https://github.com/MichaelGrafnetter/DSInternals/compare/v5.1...v5.2
 [5.1]: https://github.com/MichaelGrafnetter/DSInternals/compare/v5.0...v5.1
 [5.0]: https://github.com/MichaelGrafnetter/DSInternals/compare/v4.16...v5.0
 [4.16]: https://github.com/MichaelGrafnetter/DSInternals/compare/v4.15.1...v4.16
diff --git a/Documentation/PowerShell/New-ADDBRestoreFromMediaScript.Sample.ps1 b/Documentation/PowerShell/New-ADDBRestoreFromMediaScript.Sample.ps1
@@ -25,7 +25,7 @@ The DSInternals PowerShell module must be installed for all users on the target
 It is recommended to change the DSRM password after DC promotion.
 
 Author:  Michael Grafnetter
-Version: 2.3
+Version: 2.4
 
 #>
 
@@ -42,7 +42,6 @@ Import-Module -Name DSInternals -ErrorAction Stop
 
 function Main {
     [string] $script:LogFile = "$env:windir\Logs\DSInternals-RestoreFromMedia.txt"
-    [System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8
     $PSDefaultParameterValues = @{ 'Out-File:Encoding' = 'utf8' }
     Write-Log -Message "Starting script execution in phase $Phase..."
 
@@ -303,6 +302,20 @@ function Main {
             # Update FRS subscription if present in AD.
             Update-FrsSubscription -DomainControllerDN 'CN=LON-DC1,OU=Domain Controllers,DC=Adatum,DC=com' `
                                    -SysvolPath 'C:\Windows\SYSVOL'
+            
+            # Continue to the next phase.
+            Register-ScheduledScript -ExecutePhase 8
+        }
+        8 {
+            # Execute an optional post-installation script.
+            [string] $postInstallScriptPath = 'C:\PostInstall.ps1'
+            if(-not [string]::IsNullOrEmpty($postInstallScriptPath)) {
+                Write-Log -Message 'Executing the post-installation script...'
+                & $postInstallScriptPath *>> $script:LogFile
+            } else {
+                Write-Log -Message 'No post-installation script is configured. Skipping execution.'
+            }
+
         }
     }
 
diff --git a/Documentation/PowerShell/New-ADDBRestoreFromMediaScript.md b/Documentation/PowerShell/New-ADDBRestoreFromMediaScript.md
@@ -14,8 +14,8 @@ Generates a PowerShell script that can be used to restore a domain controller fr
 
 ```
 New-ADDBRestoreFromMediaScript [-BootKey <Byte[]>] [-SysvolPath <String>]
- -SafeModeAdministratorPassword <SecureString> [-SkipDNSServer] -DatabasePath <String> [-LogPath <String>]
- [<CommonParameters>]
+ -SafeModeAdministratorPassword <SecureString> [-SkipDNSServer] [-PostInstallScriptPath <String>]
+ -DatabasePath <String> [-LogPath <String>] [<CommonParameters>]
 ```
 
 ## DESCRIPTION
@@ -128,6 +128,21 @@ Accept pipeline input: False
 Accept wildcard characters: False
 ```
 
+### -PostInstallScriptPath
+Specifies the path to an optional post-installation script that will be executed after the restore process is complete.
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
 ### -SafeModeAdministratorPassword
 Supplies the password for the administrator account when the computer is started in Safe Mode or a variant of Safe Mode, such as Directory Services Restore Mode. If no value is specified for this parameter, the cmdlet prompts you to enter and confirm a masked password. If specified with a value, the value must be a secure string.
 
diff --git a/Documentation/PowerShell/Readme.md b/Documentation/PowerShell/Readme.md
@@ -40,7 +40,7 @@ Disables an Active Directory account in an offline ntds.dit file.
 Unlocks an Active Directory account in an offline ntds.dit file.
 
 ### [Set-ADDBAccountControl](Set-ADDBAccountControl.md#set-addbaccountcontrol)
-Modifies user account control (UAC) values for an Active Directory account in an offline ntds.dit file.
+Modifies user account control values for an Active Directory account in an offline ntds.dit file.
 
 ### [Add-ADDBSidHistory](Add-ADDBSidHistory.md#add-addbsidhistory)
 Adds one or more values to the sIDHistory attribute of an object in a ntds.dit file.
diff --git a/Documentation/PowerShell/Set-ADDBAccountControl.md b/Documentation/PowerShell/Set-ADDBAccountControl.md
@@ -8,7 +8,7 @@ schema: 2.0.0
 # Set-ADDBAccountControl
 
 ## SYNOPSIS
-Modifies user account control (UAC) values for an Active Directory account in an offline ntds.dit file.
+Modifies user account control values for an Active Directory account in an offline ntds.dit file.
 
 ## SYNTAX
 
diff --git a/Src/DSInternals.Common/DSInternals.Common.nuspec b/Src/DSInternals.Common/DSInternals.Common.nuspec
@@ -14,7 +14,7 @@
     <description>This package is shared between all other DSInternals packages. Its main features are Azure AD Graph API and ADSI clients for for retrieval of cryptographic material. It contains implementations of common hash functions used by Windows, including NT hash, LM hash and OrgId hash. It also contains methods for SysKey/BootKey retrieval.</description>
     <summary>This package is shared between all other DSInternals packages.</summary>
     <releaseNotes>
-- Added support for retrieval of BitLocker recovery keys, LAPS passwords, DNS resource records, and contact information from Active Directory.
+- Added the UserAccountControlExtensions class.
     </releaseNotes>
     <copyright>Copyright (c) 2015-2025 Michael Grafnetter. All rights reserved.</copyright>
     <tags>ActiveDirectory Security AD AAD Identity Active Directory</tags>
diff --git a/Src/DSInternals.Common/Properties/AssemblyInfo.cs b/Src/DSInternals.Common/Properties/AssemblyInfo.cs
@@ -5,8 +5,8 @@
 // set of attributes. Change these attribute values to modify the information
 // associated with an assembly.
 [assembly: AssemblyTitle("DSInternals Common Library")]
-[assembly: AssemblyVersion("5.0")]
-[assembly: AssemblyFileVersion("5.0")]
+[assembly: AssemblyVersion("5.2")]
+[assembly: AssemblyFileVersion("5.2")]
 [assembly: AssemblyDescription("")]
 [assembly: AssemblyConfiguration("")]
 [assembly: AssemblyCompany("")]
diff --git a/Src/DSInternals.DataStore/DSInternals.DataStore.nuspec b/Src/DSInternals.DataStore/DSInternals.DataStore.nuspec
@@ -14,7 +14,7 @@
     <description>DSInternals DataStore is an advanced framework for offline ntds.dit file manipulation. It can be used to extract password hashes from Active Directory backups or to modify the sIDHistory and primaryGroupId attributes.</description>
     <summary>DSInternals DataStore is an advanced framework for offline ntds.dit file manipulation.</summary>
     <releaseNotes>
-- Added support for listing AD-integrated DNS zones.
+- Added support for modifying more ucerAccountControl flags.
     </releaseNotes>
     <copyright>Copyright (c) 2015-2025 Michael Grafnetter. All rights reserved.</copyright>
     <tags>ActiveDirectory Security NTDS AD Identity Active Directory</tags>
diff --git a/Src/DSInternals.DataStore/Properties/AssemblyInfo.cs b/Src/DSInternals.DataStore/Properties/AssemblyInfo.cs
@@ -5,8 +5,8 @@
 // set of attributes. Change these attribute values to modify the information
 // associated with an assembly.
 [assembly: AssemblyTitle("DSInternals DataStore Library")]
-[assembly: AssemblyVersion("5.1")]
-[assembly: AssemblyFileVersion("5.1")]
+[assembly: AssemblyVersion("5.2")]
+[assembly: AssemblyFileVersion("5.2")]
 [assembly: AssemblyDescription("")]
 [assembly: AssemblyConfiguration("")]
 [assembly: AssemblyCompany("")]
diff --git a/Src/DSInternals.PowerShell/ADDBRestoreFromMediaScriptTemplate.ps1 b/Src/DSInternals.PowerShell/ADDBRestoreFromMediaScriptTemplate.ps1
@@ -13,6 +13,7 @@ This script performs a multi-phase domain controller restore from an IFM backup:
 - Phase 5: Restore the AD database, re-encrypt it, and reconfigure LSA policies.
 - Phase 6: Replace the SYSVOL directory, restore ACLs if available, and reboot the server.
 - Phase 7: Reconfigure the SYSVOL replication subscription.
+- Phase 8: Run an optional post-installation script.
 
 Script exection logs can be found in the C:\Windows\Logs\DSInternals-RestoreFromMedia.txt file.
 
@@ -25,15 +26,15 @@ The DSInternals PowerShell module must be installed for all users on the target
 It is recommended to change the DSRM password after DC promotion.
 
 Author:  Michael Grafnetter
-Version: 2.3
+Version: 2.4
 
 #>
 
 #Requires -Version 3 -Modules DSInternals -RunAsAdministrator
 
 param(
     [Parameter(Mandatory = $false)]
-    [ValidateRange(0, 7)]
+    [ValidateRange(0, 8)]
     [int] $Phase = 0
 )
 
@@ -42,7 +43,6 @@ Import-Module -Name DSInternals -ErrorAction Stop
 
 function Main {
     [string] $script:LogFile = "$env:windir\Logs\DSInternals-RestoreFromMedia.txt"
-    [System.Console]::OutputEncoding = [System.Text.Encoding]::UTF8
     $PSDefaultParameterValues = @{ 'Out-File:Encoding' = 'utf8' }
     Write-Log -Message "Starting script execution in phase $Phase..."
 
@@ -303,6 +303,19 @@ function Main {
             # Update FRS subscription if present in AD.
             Update-FrsSubscription -DomainControllerDN '{DCDistinguishedName}' `
                                    -SysvolPath '{TargetSysvolPath}'
+
+            # Continue to the next phase.
+            Register-ScheduledScript -ExecutePhase 8
+        }
+        8 {
+            # Execute an optional post-installation script.
+            [string] $postInstallScriptPath = '{PostInstallScriptPath}'
+            if(-not [string]::IsNullOrEmpty($postInstallScriptPath)) {
+                Write-Log -Message 'Executing the post-installation script...'
+                & $postInstallScriptPath *>> $script:LogFile
+            } else {
+                Write-Log -Message 'No post-installation script is configured. Skipping execution.'
+            }
         }
     }
 
diff --git a/Src/DSInternals.PowerShell/Chocolatey/dsinternals-psmodule.nuspec b/Src/DSInternals.PowerShell/Chocolatey/dsinternals-psmodule.nuspec
@@ -3,7 +3,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>DSInternals-PSModule</id>
-    <version>5.1</version>
+    <version>5.2</version>
     <packageSourceUrl>https://github.com/MichaelGrafnetter/DSInternals/tree/master/Src/DSInternals.PowerShell/Chocolatey</packageSourceUrl>
     <owners>MichaelGrafnetter</owners>
     <title>DSInternals PowerShell Module</title>
@@ -37,8 +37,8 @@ The DSInternals PowerShell Module has these main features:
 ## Disclaimer
 Features exposed through these tools are not supported by Microsoft. Improper use might cause irreversible damage to domain controllers or negatively impact domain security.</description>
     <releaseNotes>
-* Added the `Get-ADDBDnsZone` cmdlet for listing AD-integrated DNS zones from ntds.dit files.
-* The `New-ADDBRestoreFromMediaScript` cmdlet has a new parameter called `-SkipDNSServer`, which prevents the DNS Server role from being installed on the restored domain controller.
+* Added the `Set-ADDBAccountControl` cmdlet for offline modification of the `userAccountControl` attribute flags.
+* The `New-ADDBRestoreFromMediaScript` cmdlet has a new parameter called `-PostInstallScriptPath`.
     </releaseNotes>
     <dependencies>
       <!-- Windows Management Framework 3+. For OS prior to Windows 8 and Windows Server 2012. -->
diff --git a/Src/DSInternals.PowerShell/Commands/Datastore/NewADDBRestoreFromMediaScriptCommand.cs b/Src/DSInternals.PowerShell/Commands/Datastore/NewADDBRestoreFromMediaScriptCommand.cs
@@ -58,6 +58,14 @@ public SwitchParameter SkipDNSServer
             set;
         }
 
+        [Parameter(Mandatory = false)]
+        [ValidateNotNullOrEmpty]
+        public string PostInstallScriptPath
+        {
+            get;
+            set;
+        }
+
         protected override void ProcessRecord()
         {
             DomainController dc = this.DirectoryContext.DomainController;
@@ -126,6 +134,13 @@ protected override void ProcessRecord()
             string targetDatabasePath = Path.Combine(targetDatabaseDirectory, "ntds.dit");
             string targetSysvolPath = Path.Combine(winDir, "SYSVOL");
 
+            string postInstallScriptAbsolutePath = string.Empty;
+
+            if (!string.IsNullOrEmpty(this.PostInstallScriptPath))
+            {
+                postInstallScriptAbsolutePath = this.ResolveFilePath(this.PostInstallScriptPath);
+            }
+
             // Load the RFM script template and replace placeholders with values from the DB:
             string template = LoadScriptTemplate();
             StringBuilder script = new StringBuilder(template).
@@ -158,7 +173,8 @@ protected override void ProcessRecord()
                 Replace("{TargetSysvolPath}", targetSysvolPath).
                 Replace("{DNSOnNetwork}", this.SkipDNSServer.IsPresent ? "Yes" : "No").
                 Replace("{InstallDNSComment}", this.SkipDNSServer.IsPresent ? "# " : string.Empty).
-                Replace("{InstallDNS}", this.SkipDNSServer.IsPresent ? "No" : "Yes");
+                Replace("{InstallDNS}", this.SkipDNSServer.IsPresent ? "No" : "Yes").
+                Replace("{PostInstallScriptPath}", postInstallScriptAbsolutePath);
 
             // We need to inject cleartext version of the password into the script for dcpromo. The SecureString will therefore have to appear in managed memory, which is against best practices.
             using (var dsrmPassword = new SafeUnicodeSecureStringPointer(this.SafeModeAdministratorPassword))
diff --git a/Src/DSInternals.PowerShell/DSInternals.psd1 b/Src/DSInternals.PowerShell/DSInternals.psd1
@@ -8,7 +8,7 @@
 RootModule = 'DSInternals.Bootstrap.psm1'
 
 # Version number of this module.
-ModuleVersion = '5.1'
+ModuleVersion = '5.2'
 
 # Supported PSEditions
 # CompatiblePSEditions = 'Desktop'
@@ -156,8 +156,8 @@ PrivateData = @{
 
         # ReleaseNotes of this module
         ReleaseNotes = @"
-- Added the Get-ADDBDnsZone cmdlet for listing AD-integrated DNS zones from ntds.dit files.
-- The New-ADDBRestoreFromMediaScript cmdlet has a new parameter called -SkipDNSServer, which prevents the DNS Server role from being installed on the restored domain controller.
+- Added the Set-ADDBAccountControl cmdlet for offline modification of the userAccountControl attribute flags.
+- The New-ADDBRestoreFromMediaScript cmdlet has a new parameter called -PostInstallScriptPath.
 "@
     } # End of PSData hashtable
 
diff --git a/Src/DSInternals.PowerShell/Properties/AssemblyInfo.cs b/Src/DSInternals.PowerShell/Properties/AssemblyInfo.cs
@@ -5,8 +5,8 @@
 // set of attributes. Change these attribute values to modify the information
 // associated with an assembly.
 [assembly: AssemblyTitle("DSInternals PowerShell Commands")]
-[assembly: AssemblyVersion("5.1")]
-[assembly: AssemblyFileVersion("5.1")]
+[assembly: AssemblyVersion("5.2")]
+[assembly: AssemblyFileVersion("5.2")]
 [assembly: AssemblyDescription("")]
 [assembly: AssemblyConfiguration("")]
 [assembly: AssemblyCompany("")]
diff --git a/Src/DSInternals.PowerShell/en-US/DSInternals.PowerShell.dll-Help.xml b/Src/DSInternals.PowerShell/en-US/DSInternals.PowerShell.dll-Help.xml
@@ -8964,6 +8964,18 @@ PasswordHistoryCount        : 0
           </dev:type>
           <dev:defaultValue>None</dev:defaultValue>
         </command:parameter>
+        <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none">
+          <maml:name>PostInstallScriptPath</maml:name>
+          <maml:description>
+            <maml:para>Specifies the path to an optional post-installation script that will be executed after the restore process is complete.</maml:para>
+          </maml:description>
+          <command:parameterValue required="true" variableLength="false">String</command:parameterValue>
+          <dev:type>
+            <maml:name>String</maml:name>
+            <maml:uri />
+          </dev:type>
+          <dev:defaultValue>None</dev:defaultValue>
+        </command:parameter>
         <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="SafeModeAdminPassword, AdminPassword, DSRMPassword">
           <maml:name>SafeModeAdministratorPassword</maml:name>
           <maml:description>
@@ -9038,6 +9050,18 @@ PasswordHistoryCount        : 0
         </dev:type>
         <dev:defaultValue>None</dev:defaultValue>
       </command:parameter>
+      <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="none">
+        <maml:name>PostInstallScriptPath</maml:name>
+        <maml:description>
+          <maml:para>Specifies the path to an optional post-installation script that will be executed after the restore process is complete.</maml:para>
+        </maml:description>
+        <command:parameterValue required="true" variableLength="false">String</command:parameterValue>
+        <dev:type>
+          <maml:name>String</maml:name>
+          <maml:uri />
+        </dev:type>
+        <dev:defaultValue>None</dev:defaultValue>
+      </command:parameter>
       <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="SafeModeAdminPassword, AdminPassword, DSRMPassword">
         <maml:name>SafeModeAdministratorPassword</maml:name>
         <maml:description>
@@ -9697,7 +9721,7 @@ PS C:\&gt; Get-ADSIAccount -Server 'lon-dc1.contoso.com' | Save-DPAPIBlob -Direc
       <command:verb>Set</command:verb>
       <command:noun>ADDBAccountControl</command:noun>
       <maml:description>
-        <maml:para>Modifies user account control (UAC) values for an Active Directory account in an offline ntds.dit file.</maml:para>
+        <maml:para>Modifies user account control values for an Active Directory account in an offline ntds.dit file.</maml:para>
       </maml:description>
     </command:details>
     <maml:description>
diff --git a/Src/DSInternals.Replication.Interop/AssemblyInfo.cpp b/Src/DSInternals.Replication.Interop/AssemblyInfo.cpp
@@ -14,7 +14,7 @@ using namespace System::Security::Permissions;
 //
 [assembly:AssemblyTitleAttribute(L"DSInternals Replication Interop Library")];
 // Note: Do not forget to change the version in version.rc files.
-[assembly:AssemblyVersionAttribute("4.14")];
+[assembly:AssemblyVersionAttribute("5.2")];
 [assembly:AssemblyDescriptionAttribute(L"")];
 [assembly:AssemblyConfigurationAttribute(L"")];
 [assembly:AssemblyCompanyAttribute(L"")];
diff --git a/Src/DSInternals.Replication.Interop/version.rc b/Src/DSInternals.Replication.Interop/version.rc
@@ -39,8 +39,8 @@ END
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 5,0,0,0
- PRODUCTVERSION 5,0,0,0
+ FILEVERSION 5,2,0,0
+ PRODUCTVERSION 5,2,0,0
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -57,12 +57,12 @@ BEGIN
         BEGIN
             VALUE "CompanyName", "Michael Grafnetter"
             VALUE "FileDescription", "DSInternals Replication Interop Library"
-            VALUE "FileVersion", "5.0.0.0"
+            VALUE "FileVersion", "5.2.0.0"
             VALUE "InternalName", "DSInternals.Replication.Interop"
             VALUE "LegalCopyright", "Copyright © 2015-2025 Michael Grafnetter"
             VALUE "OriginalFilename", "DSInternals.Replication.Interop.dll"
             VALUE "ProductName", "DSInternals PowerShell Module"
-            VALUE "ProductVersion", "5.0.0.0"
+            VALUE "ProductVersion", "5.2.0.0"
         END
     END
     BLOCK "VarFileInfo"
diff --git a/Src/DSInternals.Replication.Model/Properties/AssemblyInfo.cs b/Src/DSInternals.Replication.Model/Properties/AssemblyInfo.cs
@@ -5,8 +5,8 @@
 // set of attributes. Change these attribute values to modify the information
 // associated with an assembly.
 [assembly: AssemblyTitle("DSInternals Replication Data Model")]
-[assembly: AssemblyVersion("5.0")]
-[assembly: AssemblyFileVersion("5.0")]
+[assembly: AssemblyVersion("5.2")]
+[assembly: AssemblyFileVersion("5.2")]
 [assembly: AssemblyDescription("")]
 [assembly: AssemblyConfiguration("")]
 [assembly: AssemblyCompany("")]
diff --git a/Src/DSInternals.Replication/DSInternals.Replication.nuspec b/Src/DSInternals.Replication/DSInternals.Replication.nuspec
diff --git a/Src/DSInternals.Replication/Properties/AssemblyInfo.cs b/Src/DSInternals.Replication/Properties/AssemblyInfo.cs
diff --git a/Src/DSInternals.SAM/Properties/AssemblyInfo.cs b/Src/DSInternals.SAM/Properties/AssemblyInfo.cs
