get-help about_signing

My CA is (still) a Windows Server 2003 DC, so that’s what this is based on.

1. Connect to your CA using the Certification Authority snapin, and ensure that the Code Signing certificate template is enabled/loaded. If it isn’t, just right-click on Certificate Templates and select New –> Certificate Template to Issue
   
   
2. Ensure that HTTPS is enabled for your CA’s Certificate Services virtual directory, and then navigate to it using IE from your own PC;
   
   https://{CA-name}/certsrv
3. Go to Request a certificate, User Certificate (click Yes, to any IE popups at this point), go to More Options >>>, Use the Advanced Certificate Request form, select the Code Signing certificate template, and then Submit your request.
4. Once your certificate is issued and installed, you’ll be able to view its details using this Powershell command:

Get-ChildItem cert:\CurrentUser\My -codesigning

5. Sign your Powershell script with the following command. I ran into an issue where I received an “Unknown Error”, but this turned out to be because I had created the script from within the Powershell ISE. This handy blog post helped me out.

Set-AuthenticodeSignature .\{script name}.ps1 @(Get-ChildItem cert:\CurrentUser\My -codesigning)[0]

There’s some pretty useful info here, on powershell.com

It probably isn’t too efficient, as it creates a new object and then kills it every time the function is called, but it’s fine for my purposes.

‘Error Handling
On Error Resume Next

‘ *****************************************************
‘This function checks to see if the passed group name contains the current
‘ user as a member. Returns True or False
Function IsMember(groupName)
    If IsEmpty(groupListD) then
        Set groupListD = CreateObject(“Scripting.Dictionary”)
        groupListD.CompareMode = TextCompare
        ADSPath = EnvString(“userdomain”) & “/” & EnvString(“username”)
        Set userPath = GetObject(“WinNT://” & ADSPath & “,user”)
        For Each listGroup in userPath.Groups
            groupListD.Add listGroup.Name, “-”
        Next
    End if
    IsMember = CBool(groupListD.Exists(groupName))
End Function
‘ *****************************************************

‘ *****************************************************
‘This function returns a particular environment variable’s value.
‘ for example, if you use EnvString(“username”), it would return
‘ the value of %username%.
Function EnvString(variable)
    set objShell = WScript.CreateObject( “WScript.Shell” )
    variable = “%” & variable & “%”
    EnvString = objShell.ExpandEnvironmentStrings(variable)    
    Set objShell = Nothing    
End Function
‘ *****************************************************

The main reason I like this over the old con2prt.exe is that you can remove individual mappings to printers – you don’t have to remove all the mapped printers at once with a ‘con2prt /f’ if you don’t want to.
Here’s the full info text that “rundll32 printui.dll,PrintUIEntry /?” produces.

Usage: rundll32 printui.dll,PrintUIEntry [options] [@commandfile]
/a[file] binary file name
/b[name] base printer name
/c[name] unc machine name if the action is on a remote machine
/dl delete local printer
/dn delete network printer connection
/dd delete printer driver
/e display printing preferences
/f[file] either inf file or output file
/ga add per machine printer connections
/ge enum per machine printer connections
/gd delete per machine printer connections
/h[arch] driver architecture one of the following, Alpha | Intel | IA64 | x64
/ia install printer driver using inf file
/id install printer driver using add printer driver wizard
/if install printer using inf file
/ii install printer using add printer wizard with an inf file
/il install printer using add printer wizard
/in add network printer connection
/j[provider] print provider name
/k print test page to specified printer, cannot be combined with command when installing a printer
/l[path] printer driver source path
/m[model] printer driver model name
/n[name] printer name
/o display printer queue view
/p display printer properties
/q quiet mode, do not display error messages
/r[port] port name
/s display server properties
/Ss Store printer settings into a file
/Sr Restore printer settings from a file
Store or restore printer settings option flags that must be placed at the end of command:
2 PRINTER_INFO_2
7 PRINTER_INFO_7
c Color Profile
d PrinterData
s Security descriptor
g Global DevMode
m Minimal settings
u User DevMode
r Resolve name conflicts
f Force name
p Resolve port
/u use the existing printer driver if it’s already installed
/t[#] zero based index page to start on
/v[version] driver version one of the following, Windows 95, 98 and Me | Windows NT 4.0 | Windows NT 4.0 or 2000 | Windows 2000 or XP | Windows XP
/w prompt the user for a driver if specified driver is not found in the inf
/y set printer as the default
/Xg get printer settings
/Xs set printer settings
/z do not auto share this printer
/Y do not auto generate a printer name
/K changes the meaning of /v and /h to accept 0,1,2,3, respectively for Windows x64 and Windows IA64 | Windows NT x86 | Windows NT Alpha_AXP | Windows 4.0
/Z share this printer, can only be used with the /if option
/? help this message
@[file] command line argument file
/Mw[message] show a warning message before committing the command
/Mq[message] show a confirmation message before committing the command
/W[flags] specifies flags and switches for the wizards (for APW & APDW)
r make the wizards to be restart-able from the last page
/G[flags] specifies global flags and switches
w suppress setup driver warnings UI (super quiet mode)

Examples:
Run server properties:
rundll32 printui.dll,PrintUIEntry /s /t1 /n\\machine
Run printer properties:
rundll32 printui.dll,PrintUIEntry /p /n\\machine\printer
Run add printer wizard localy:
rundll32 printui.dll,PrintUIEntry /il
Run add printer wizard on \\machine:
rundll32 printui.dll,PrintUIEntry /il /c\\machine
Run queue view:
rundll32 printui.dll,PrintUIEntry /o /n\\machine\printer
Run inf install:
rundll32 printui.dll,PrintUIEntry /if /b “Test Printer” /f %windir%\inf\ntprint.inf /r “lpt1:” /m “AGFA-AccuSet v52.3″
Run add printer wizard using inf:
rundll32 printui.dll,PrintUIEntry /ii /f %windir%\inf\ntprint.inf
Add per machine printer connection:
rundll32 printui.dll,PrintUIEntry /ga /c\\machine /n\\machine\printer /j”LanMan Print Services”
Delete per machine printer connection:
rundll32 printui.dll,PrintUIEntry /gd /c\\machine /n\\machine\printer
Enumerate per machine printer connections:
rundll32 printui.dll,PrintUIEntry /ge /c\\machine
Add printer driver using inf:
rundll32 printui.dll,PrintUIEntry /ia /c\\machine /m “AGFA-AccuSet v52.3″ /h “Intel” /v “Windows 2000 or XP” /f %windir%\inf\ntprint.inf
Add printer driver using inf:
rundll32 printui.dll,PrintUIEntry /ia /K /c\\machine /m “AGFA-AccuSet v52.3″ /h “Windows NT x86″ /v 3
Remove printer driver:
rundll32 printui.dll,PrintUIEntry /dd /c\\machine /m “AGFA-AccuSet v52.3″ /h “Intel” /v “Windows 2000 or XP”
Remove printer driver:
rundll32 printui.dll,PrintUIEntry /dd /K /c\\machine /m “AGFA-AccuSet v52.3″ /h “Windows NT x86″ /v 3
Set printer as default:
rundll32 printui.dll,PrintUIEntry /y /n “printer”
Set printer comment:
rundll32 printui.dll,PrintUIEntry /Xs /n “printer” comment “My Cool Printer”
Get printer settings:
rundll32 printui.dll,PrintUIEntry /Xg /n “printer”
Get printer settings saving results in a file:
rundll32 printui.dll,PrintUIEntry /f “results.txt” /Xg /n “printer”
Set printer settings command usage:
rundll32 printui.dll,PrintUIEntry /Xs /n “printer” ?
Store all printer settings into a file:
rundll32 printui.dll,PrintUIEntry /Ss /n “printer” /a “file.dat”
Restore all printer settings from a file:
rundll32 printui.dll,PrintUIEntry /Sr /n “printer” /a “file.dat”
Store printer information on level 2 into a file :
rundll32 printui.dll,PrintUIEntry /Ss /n “printer” /a “file.dat” 2
Restore from a file printer security descriptor:
rundll32 printui.dll,PrintUIEntry /Sr /n “printer” /a “file.dat” s
Restore from a file printer global devmode and printer data:
rundll32 printui.dll,PrintUIEntry /Sr /n “printer” /a “file.dat” g d
Restore from a file minimum settings and resolve port name:
rundll32 printui.dll,PrintUIEntry /Sr /n “printer” /a “file.dat” m p

The commands I found useful were:

Delete a local printer driver:
rundll32 printui.dll,PrintUIEntry /dd /m “PrinterNameHere123″

Usage:
rundll32 printui.dll,PrintUIEntry /dd /m “RICOH Aficio 3245C PCL 6″

Delete a network printer:
rundll32 printui.dll,PrintUIEntry /dn /n \\servername\printsharename
Usage:
rundll32 printui.dll,PrintUIEntry /dn /n \\server01\mfc_blue_bw
rundll32 printui.dll,PrintUIEntry /dn /n \\server01\mfc_blue_colour
rundll32 printui.dll,PrintUIEntry /dn /n \\server01\mfc_yellow_colour
rundll32 printui.dll,PrintUIEntry /dn /n \\server01\mfc_yellow_bw

Install a network printer:
rundll32 printui.dll,PrintUIEntry /in /n \\servername\printsharename
Usage:
rundll32 printui.dll,PrintUIEntry /in /n \\ads01\mfc_blue_colour

Install Printer Driver from INF File:
rundll32 printui.dll,PrintUIEntry /ia /m “PrinterModelName” /h “Intel” /v “Windows 2000 or XP” /f \\servername\filename.INF
Usage:
rundll32 printui.dll,PrintUIEntry /ia /m “RICOH Aficio 3245C PCL 6″ /h “Intel” /v “Windows 2000 or XP” /f \\ads01\public\PrinterDrivers\3245pcl\disk1\OEMSETUP.INF

Set a printer as the default:
(Note that printer must be connected already for this to work)
rundll32 printui.dll,PrintUIEntry /y /n \\servername\printsharename
Usage:
rundll32 printui.dll,PrintUIEntry /y /n \\PC01\HPLaserJet2420

What IIFP does according to Microsoft: “Identity Integration Feature Pack 1a for Microsoft® Windows Serverâ„¢ Active Directory® manages identities and coordinates user details across Microsoft Active Directory, Active Directory Application Mode (ADAM), Microsoft Exchange 2000 Server, and Exchange Server 2003 implementations. ”

The download link:
IIFP Download

There’s only one catch: you need an enterprise version of Windows 2003 Server to be able to install the feature pack. A little birdie tells me that if you use Orca from the Windows 2003 Server SDK, you can modify the installation requirements to get it working on a non-enterprise version of Windows 2003 Server.

Here’s a tutorial from MSExchange.org on GAL synchronisation:
http://www.msexchange.org/pages/article_p.asp?id=668

I couldn’t end up getting it to work because of domain naming issues between the two domains (one is named as a parent of the other one without actually being the AD parent domain), but it looks like it could be a very useful tool.