gets known registered service connection points (currently only exchange and ad rights management services) from active directory domain

find-scp

<#

Script to find AD, find the known registered Service Connection Point's, an list some information about them.

detects dns domain on the network you're on
tries to detect default domain from dns server
connects to AD, get information about AD RMS, Exchange (possible to add others!)

#>

 
 
Import-Module ActiveDirectory
$Networks = Get-WmiObject -Class Win32_NetworkAdapterConfiguration -Filter IPEnabled=TRUE
#detection 1
$dnsdomain=$Networks.DNSDomain
$server=$Networks.DNSDomain
#detection 2
$otherdnsdomain=[System.Net.Dns]::GetHostByAddress($networks.dnsserversearchorder[0])
$otherdnsdomain=$otherdnsdomain.hostname
$otherserver=$otherdnsdomain
$arr=$otherdnsdomain.split(".")
$var=""
for($i=1; $i -lt $arr.length; $i++ )
{
  $var+=$arr[$i]+"."
}
$var=$var.Substring(0,$var.Length-1)
$otherdnsdomain=$var
#auto choose
if($dnsdomain -eq $otherdnsdomain)
{
	$dnsdomain=$dnsdomain
	$server=$server
	write-host "autochoise: using $dnsdomain"
}
#manual choice
else
{
	write-host "choose wiseley"
	write-host "1. $dnsdomain - $server"
	write-host "2. $otherdnsdomain - $otherserver"
	write-host "3. $env:USERDNSDOMAIN"
  	write-host "4. enter custom domain"
	$choice=read-host "choice"
	switch($choice)
		{ 
			1 {
				$dnsdomain=$dnsdomain
				$server=$server
			}
			2 {
				$dnsdomain=$otherdnsdomain
				$server=$otherserver
			}
			3 {
				$dnsdomain=$env:USERDNSDOMAIN
				$server=$env:USERDNSDOMAIN
			}
      4{
        $dnsdomain=read-host "enter dnsdomain"
        $server=read-host "enter known domain controller"
      }
		}
}

$arr=$dnsdomain.split(".")
$var=""
foreach($word in $arr)
{
$var+="dc=$word,"
}
$var=$var.Substring(0,$var.Length-1)
$searchbase="cn=configuration,$var"
$creds = get-credential

write-host "connecting to $server, searchbase being $searchbase"
$objects=Get-ADObject -SearchBase $searchbase -Filter "objectclass -eq 'serviceconnectionpoint'" -server $server -Credential $creds 
$detailedobjects=@()
foreach($obj in $objects)
{
	$object=""
	try{
		$object=Get-ADObject $obj -server $server -Credential $creds -properties *
		write-host $object.serviceBindingInformation
		$detailedobjects+=$object
	}
	catch
	{
		write-host "not found"
	}
	$object=""
}


#rms
#cn=rightsmanagementservices,cn=services,$searchbase"
$rmsSCP=$detailedobjects | where {$_.distinguishedname -eq "cn=rightsmanagementservices,cn=services,$searchbase"}

#exchange
#CN=Microsoft Exchange Online,CN=Microsoft Exchange Autodiscover,CN=Services,$searchbase
$exchangeSCP=$detailedobjects | where {$_.distinguishedname -eq "CN=Microsoft Exchange Online,CN=Microsoft Exchange Autodiscover,CN=Services,$searchbase"}
$searchbase="cn=microsoft exchange,cn=services,cn=configuration,$var"
$exchangename=Get-ADObject -SearchBase $searchbase -Filter "*" -SearchScope 1 -server $server -Credential $creds 
$searchbase="CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),cn=$exchangename,cn=microsoft exchange,cn=services,cn=configuration,$var"
$exchangeservers=Get-ADObject -SearchBase $searchbase -Filter "*" -SearchScope 1 -server $server -Credential $creds 
write-host $exchangeservers