nslookup myip.opendns.com resolver1.opendns.com  

In my case we needed to use this token to perform tasks under the context of the AAD application such as accessing an Azure API Management API, as well as sending requests to the Azure GraphAPI.

After having no luck finding anything online, I decided to post my solution here.

function Get-oAuthToken {  
    <#
    .SYNOPSIS
       Function to connect to the Microsoft login OAuth endpoint and return an OAuth token.
    .DESCRIPTION
       This Function connects to the Microsoft AAD OAuth endpoint and generates an OAuth token. 
       This token can then be used for authentication against the resource supplied In the parameters.
    .PARAMETER ClientID
        The ClientID of the application used for authentication against Azure AD.
    .PARAMETER ClientSecret
        The Key generated within the application used for authentication against Azure AD.
        This key should have rights to the resource supplied in the ResourceName parameter.
    .PARAMETER TenantId
        The TenantId of the Azure AD that you wish to authenticate against.
    .PARAMETER ResourceName
        The name of the resource that you want to generate a token for.
    .EXAMPLE
       C:\PS> Get-ApiToken -ClientID '12345678-9012-3456-7890-123456789012' -ClientSecret 'AfXooIr8rswX24yrFXMrO4SbBgutwTtojAZEpQOaaaa=' -TenantId 'abcdefff-d0bc-1234-854a-114710c94dbb' -Resource 'https://test.onmicrosoft.com/apitest'
       Returns the authentication context object generated by the endpoint.
    .NOTES
        Version 1.0
    #>
    [Cmdletbinding()]
    Param(
        [Parameter(Mandatory=$true)][string]$ClientID,
        [Parameter(Mandatory=$true)][string]$ClientSecret,
        [Parameter(Mandatory=$true)][string]$TenantId,
        [Parameter(Mandatory=$false)][string]$ResourceName = "https://graph.windows.net",
        [Parameter(Mandatory=$false)][switch]$ChinaAuth
    )

    #This script will require the Web Application and permissions configured in Azure Active Directory.
    if($ChinaAuth){
        $LoginURL  = 'https://login.chinacloudapi.cn'
    }else{
        $LoginURL  = 'https://login.windows.net'
    }

    #Get an Oauth 2 access token based on client id, secret and tenant id
    $Body = @{grant_type="client_credentials";resource=$ResourceName;client_id=$ClientID;client_secret=$ClientSecret}
    Return Invoke-RestMethod -Method Post -Uri $LoginURL/$TenantId/oauth2/token?api-version=1.0 -Body $Body
}

The code is fairly straightforward, however I will expand on a few points:

1. In my case I needed the ability to generate tokens against multiple Azure regions, including the Azure China region. To ensure the China authentication requests hit the correct endpoint, I have added a switch -ChinaAuth. If this is specified it will attempt to authenticate to https://login.chinacloudapi.cn.
2. The function will return an object containing:
   • token_type
   • expires_in
   • ext_expires_in
   • expires_on
   • not_before
   • resource
   • access_token

This script uses the ActiveDirectory CMDlets included in the Active Directory Module for PowerShell, this is part of the Remote Server Administrative Tools (RSAT) pack available from Microsoft for client OSs.

Note that once RSAT has been installed, you will need to enable the Active Directory Module for PowerShell feature via Add and Remove Programs.

Import-Module ActiveDirectory

$attributeName = "SAMAccountName",
  "extensionattribute1",
  "extensionattribute2",
  "extensionattribute3",
  "extensionattribute4",
  "extensionattribute5",
  "extensionattribute6",
  "extensionattribute7",
  "extensionattribute8",
  "extensionattribute9",
  "extensionattribute10",
  "extensionattribute11",
  "extensionattribute12",
  "extensionattribute13",
  "extensionattribute14",
  "extensionattribute15"

$summary = "" | select $attributeName

foreach($attribute in $attributeName){  
    $summary.$attribute = (Get-ADuser -filter {$attribute -like "*"} -Properties $attribute).count
}
$summary | fl

Check the current SVCHOST processes, and the services assigned:
tasklist /SVC /FI "IMAGENAME eq svchost.exe"

Change a service to its own SVCHOST processes:
sc config <service name> type= own

Change a service back to a shared SVCHOST process:
sc config <service name> type= share

Note that once RSAT has been installed, you will need to enable the Active Directory Module for PowerShell feature via Add and Remove Programs.

function Get-UserPhoto(){  
    param(
        [string]$Username,
        [string]$Path = "C:\Temp\AD_Photos"
    )

    Import-Module ActiveDirectory
    $user = Get-ADUser $Username -properties thumbnailPhoto
    if(!(test-path $Path)){mkdir $Path}
    $user.thumbnailPhoto | Set-Content ("$Path\$($User.SamAccountName).jpg") -Encoding byte
}

I always recommend configuring the PDC Emulator to sync with a known good NTP source, then all other DCs be configured as Domain Heirs.
This configuration ensures that all of the DCs have the same time source, which in turn flows to all client PCs.

If the DC is configured with the Hyper-V time provider (as is the case with Azure VMs), this should be disabled before configuring NTP sync.
To disable the Hyper-V time provider, enter the following from an administrative command prompt:
reg add HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider /v Enabled /t reg_dword /d 0

Configuration of NTP on the Domain Controllers:

1. Locate the PDC Emulator:
   netdom query pdc
2. Open an administrative command prompt on the PDC Emulator.
3. Configure the peers for the PDC Emulator to sync with (in my case au.pool.ntp.org):
   w32tm /config /manualpeerlist:"au.pool.ntp.org,0x1;1.au.pool.ntp.org,0x1" /syncfromflags:MANUAL
4. Flag this DC as a reliable time source:
   w32tm /config /reliable:yes
5. Restart the w32time service, this should start the sync with the configured peers:
   net stop w32time && net start w32time
6. Check the event logs for time sync events. Note that event ID 47 in the System log could represent a firewall blocking the connection on port 123.
7. On all other DCs, run the following commands:
   w32tm /config /syncfromflags:domhier /update
net stop w32time && net start w32time

If required, here are some other helpful commands:

• Force a full sync: w32tm /resync /nowait
• List the NTP service status: w32tm /query /status
• List the configured NTP peers: w32tm /query /peers
• List the configured time Source: w32tm /query /source
• Check the NTP configuration: w32tm /query /configuration

At any time you can reset the w32time service configuration as follows:

1. Stop the w32time service:
   net stop w32time
2. Unregister the w32time service:
   w32tm /unregister
3. Re-register the w32time service:
   w32tm /register
4. Start the w32time service:
   net start w32time

psexec \\[computer name] -u [admin account name] -p [admin account password] -h -d powershell.exe "enable-psremoting -force"

This will authenticate the supplied user to the remote server, ensuring that future CIFS connections use the authenticate user account.
Note that if existing connections have been made with another user account, they will need to be removed first. You can display a list of connections using net use. Connections can be removed using net use \\<servername>\<sharename> /delete

One this command has completed successfully, open a Windows Explorer window and connect to the desired path as per normal.

1. Modify the KeePass group that contains the password entry
2. On the Autotype tab, enter the following (Replacing the Folder names if required):
   {TAB}{TAB}{TAB}{Title}{TAB}{Title}{TAB}{TAB}{TAB}{TAB}{SPACE}{DELAY 1000}{Password}{TAB}{Password}{TAB}{SPACE}{TAB}{SPACE}{TAB}{SPACE}
3. Save the changes to the group
4. Open AD Users and computers, and create a new user in the appropriate OU
5. Wait for the form to load, then with the first fileld selected, switch to KeePass
6. Press CTRL + V

This will autotype the KeePass entry details into AD Users and Computers for you.

This will autotype the KeePass entry details into the LastPass browser window for you.

To convert a PEM certificate file and a private key to PKCS#12 (.pfx .p12)
openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt