Exception

[xennn]

Get-AuditCertificateTemplate: C:\git\PSPKIAudit\Code\Invoke-PKIAudit.ps1:101
Line |
101 | $CATemplates = Get-AuditCertificateTemplate @Args
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Exception calling "GetSecurityDescriptor" with "0" argument(s): "Some or all identity references could
| not be translated."

[Crypt32]

This is a bug in the underlying library, which is already fixed in sources: PKISolutions/pkix.net@73656c5#diff-c03f25716219c8e87ab3cbb2f2c94261bd961fb79487fa708b7b5822aeb8cff9

the root cause of this is that user account who created this template was deleted from AD. And there is a problem when .NET CommonObjectSecurity.GetOwner() throws exception if owner account cannot be resolved, while it handles same case in DACL/SACL. As a temporary workaround (until new PSPKI is released), I can offer compiled updated libraries.

[xennn]

Thanks for the information. Yes, you are very welcome to make the binaries available.

[Crypt32]

To all, who face issue with this error, I recommend to update the following files in PowerShell PKI library folder: $PsModulePath\PSPKI\Library, where $PsmodulePath is PSPKI module installation folder. To get module's installation path, just run the following command:

(gmo -li -name pspki).path

ZIP with updated and signed DLLs that resolve this issue: SysadminsLV.PKI.zip

[leechristensen]

@Crypt32 Would you be opposed to us bundling that in a release package on this repo until the next version of PSPKI is released? Thank you so much for addressing the bugs we've seen crop up in PSPKI!

[Crypt32]

As long as they are properly attributed, then I wouldn't mind if you host them until next release.

[leechristensen]

Most definitely. You wouldn't by chance be able to build/sign a Windows PowerShell compatible version would you @Crypt32 ? Only able to load those newer libraries on PowerShell Core right now:

[Crypt32]

It does load for me even on PowerShell 3.0. Make sure that you haven't loaded different versions of this library in the current session.

[leechristensen]

My fault, after diving it deeper it was mark of the web. Apparently PS core ignores that.... O.o...

[leechristensen]

New version should be merged. @Crypt32 please take a look at the top of the readme for the attribution and let us know if you'd like us to change anything. Thanks again for your help!

[Crypt32]

Looks ok to me.