Partager via

AD CS Migration: Appendix A

  • Article

Applies To: Windows Server 2008 R2, Windows Server 2012

The script in this section can be used to automate the addition of the Certification Authority role service to a computer running Windows Server 2008 or Windows Server 2008 R2.

SetupCA.vbs

To save SetupCA.vbs to a file

  1. Click Copy Code at the top of the code section.

  2. Start Notepad.

  3. On the Edit menu, click Paste.

  4. On the File menu, click Save.

  5. Type a path for the file, type the file name Setupca.vbs, and click Save.

    'Copyright (c) Microsoft Corporation. All rights reserved.

    'Disclaimer ' 'This sample script is not supported under any Microsoft standard support 'program or service. This sample script is provided AS IS without warranty of 'any kind. Microsoft further disclaims all implied warranties including, 'without limitation, any implied warranties of merchantability or of fitness 'for a particular purpose. The entire risk arising out of the use or 'performance of the sample scripts and documentation remains with you. In no 'event shall Microsoft, its authors, or anyone else involved in the creation, 'production, or delivery of the scripts be liable for any damages whatsoever '(including, without limitation, damages for loss of business profits, business 'interruption, loss of business information, or other pecuniary loss) arising 'out of the use of or inability to use this sample script or documentation, 'even if Microsoft has been advised of the possibility of such damages.

    ' Catch errors at compile time, sort of. Option Explicit

    '***************************************************************** 'Displays script-understood command line parameters ' Sub Usage() Call OutputLine(ECHOMINIMAL, "SetupCA.vbs - Certificate Services Setup Automation for Windows Server 2008/2008 R2") Call OutputLine(ECHOMINIMAL, "") Call OutputLine(ECHOMINIMAL, "Parameters:") Call OutputLine(ECHOMINIMAL, "/SP - Specify Provider") Call OutputLine(ECHOMINIMAL, "/SK - Specify Key length") Call OutputLine(ECHOMINIMAL, "/SA - Specify Hash algorithm") Call OutputLine(ECHOMINIMAL, "/SN - Specify CA Name") Call OutputLine(ECHOMINIMAL, "/DN - Specify DN Suffix for CA cert subject") Call OutputLine(ECHOMINIMAL, "/SR - Specify Root CA (Required for subordinate CA" & Chr(39) & "s and Web service)") Call OutputLine(ECHOMINIMAL, "") Call OutputLine(ECHOMINIMAL, "/OR - Save CA cert request to a file (Required for offline root CA" & Chr(39) & "s)") Call OutputLine(ECHOMINIMAL, "") Call OutputLine(ECHOMINIMAL, "/RK - Reuse Key") Call OutputLine(ECHOMINIMAL, "/RC - Reuse Cert and Key") Call OutputLine(ECHOMINIMAL, "") Call OutputLine(ECHOMINIMAL, "/interactive - Specifiy whether CA will be set to interact with desktop") Call OutputLine(ECHOMINIMAL, "") Call OutputLine(ECHOMINIMAL, "/IE - Install Enterprise Root CA Service") Call OutputLine(ECHOMINIMAL, "/IS - Install Standalone Root CA Service") Call OutputLine(ECHOMINIMAL, "/IF - Install Enterprise Subordinate CA Service") Call OutputLine(ECHOMINIMAL, "/IT - Install Standalone Subordinate CA Service") Call OutputLine(ECHOMINIMAL, "/IW - Install web CA Service - works with any of the above or by itself") Call OutputLine(ECHOMINIMAL, " This option is not relevant for server core machines") Call OutputLine(ECHOMINIMAL, "") Call OutputLine(ECHOMINIMAL, "/UC - Uninstall CA Service") Call OutputLine(ECHOMINIMAL, "") Call OutputLine(ECHOMINIMAL, "/? - Display this usage") Call OutputLine(ECHOMINIMAL, "") End Sub ' Usage

    '***************************************************************** 'Define external constant values ' ' CA Role Const ENTERPRISE_ROOTCA = 0 Const ENTERPRISE_SUBCA = 1 Const STANDALONE_ROOTCA = 3 Const STANDALONE_SUBCA = 4 Const NO_INSTALL_CA = -1 Const UNINSTALL_CA = 8 Const UNINSTALL_WEB_PAGES = 9

    'FileSystemObject defines Const FILE_FLAG_READ = 1 Const FILE_FLAG_WRITE = 2 Const FILE_FLAG_APPEND = 8

    'Logging level Const ECHOMINIMAL = 1

    'Error codes to handle: Const RPC_UNAVAILABLE = - 2147023174 '0x800706BA Const DOMAIN_UNAVAILABLE = - 2147023541 '0x8007054B Const REG_VALUE_NOT_FOUND = - 2147024894 '0x80070002 Const IMAGE_TAMPERED = - 2147024319 '0x80070241 Const VALUE_OUT_OF_RANGE = - 2147016574 '0x80072082 Const ROOT_CA_NOT_FOUND = 462

    'Properties that can be set: Const SETUPPROP_INVALID = - 1 Const SETUPPROP_CATYPE = 0 Const SETUPPROP_CAKEYINFORMATION = 1 Const SETUPPROP_INTERACTIVE = 2 Const SETUPPROP_CANAME = 3 Const SETUPPROP_CADSSUFFIX = 4 Const SETUPPROP_VALIDITYPERIOD = 5 Const SETUPPROP_VALIDITYPERIODUNIT = 6 Const SETUPPROP_EXPIRATIONDATE = 7 Const SETUPPROP_PRESERVEDATABASE = 8 Const SETUPPROP_DATABASEDIRECTORY = 9 Const SETUPPROP_LOGDIRECTORY = 10 Const SETUPPROP_SHAREDFOLDER = 11 Const SETUPPROP_PARENTCAMACHINE = 12 Const SETUPPROP_PARENTCANAME = 13 Const SETUPPROP_REQUESTFILE = 14 Const SETUPPROP_WEBCAMACHINE = 15 Const SETUPPROP_WEBCANAME = 16

    '***************************************************************** 'Define constants and defaults ' Const CONST_ERROR = 0 Const CONST_WSCRIPT = 1 Const CONST_CSCRIPT = 2 Const CONST_SHOW_USAGE = 3 Const CONST_PROCEED = 4

    Const DEFCANAME = "" Const DEFDNSUFFIX = "" Const DEFROOTCANAME = "" Const DEF_SEL_KEY_SIZE = "2048" Const DEF_SEL_HASH_ALG = "SHA1" Const DEF_INSTALL_WEB_OPTION = False Const DEF_INSTALL_SVC_OPTION = False Const DEF_LOG_FILENAME = "_SetupCA.log" Const DEF_INTERACTIVE = False

    'example Capi1 Provider: "Microsoft Strong Cryptographic Provider" 'example RSA CNG provider: "RSA#MicrosoftKSP" 'example ECC 256 provider: "ECDSA_P256#Microsoft Software Key Storage Provider" 'example ECC 384 provider: "ECDSA_P384#Microsoft Software Key Storage Provider" 'example ECC 521 provider: "ECDSA_P521#Microsoft Software Key Storage Provider" Const DEF_SEL_PROVIDER = "RSA#Microsoft Software Key Storage Provider"

    'Cert Server Role Dim eCARole eCARole = NO_INSTALL_CA

    'Root CA's name (if this is a subordinate) Dim strRootCAName strRootCAName = DEFROOTCANAME

    'This CA's name Dim strCAName Dim strDNSuffix strCAName = DEFCANAME strDNSuffix = DEFDNSUFFIX

    'Crypto provider to be used to sign certs this CA Issues Dim strSelectedCSP strSelectedCSP = "" ' DEF_SEL_PROVIDER

    'Hash algorithm to be used to sign certs this CA Issues Dim strSelectedHashAlg strSelectedHashAlg = "" ' DEF_SEL_HASH_ALG

    'Signing key length Dim iSelectedKeySize iSelectedKeySize = "" ' DEF_SEL_KEY_SIZE

    'Save request to file, for submitting to offline root Dim strRequestFile strRequestFile = ""

    'Key/Cert Re-use flags Dim bReuseKey Dim bReuseCert Dim bReuseDB bReuseKey = False bReuseCert = False bReuseDB = False

    'Interactive Flag Dim bInteractive bInteractive = DEF_INTERACTIVE

    'Default to install or uninstall Dim bInstall bInstall = True

    'Install the Web interface Dim bWebPages bWebPages = DEF_INSTALL_WEB_OPTION

    ' Install the Cert Server service. Dim bInstallService bInstallService = DEF_INSTALL_SVC_OPTION

    'Log file Dim OutputFile Dim OutputFile2

    'Needs to differentiate which package needs to be installed Dim PKGCA Dim PKGIIS Dim PKGWEB PKGCA = True PKGIIS = True PKGWEB = True

    'Set if installing on core build Dim bIsCore bIsCore = False

    'For the 'retry once' implementation Dim bRecursed bRecursed = False

    'Begin script logic

    'Ensure the output won't become hundreds of popup windows Call VerifyStandardStreams()

    'Set up Local logging Set OutputFile = CreateLogFile(DEF_LOG_FILENAME)

    Dim g_oCASetup

    'Start the script Call Main()

    '******************************************************************** '* '* Sub InstallPackages() '* '* Purpose: Install all required packagemanager packages '* '********************************************************************' Sub InstallPackages(Install)

    'Get shell object to determine system drive value
Dim WshShell
Set WshShell = WScript.CreateObject("WScript.Shell")

If (Install = True) Then

    If (PKGCA = True) Then
        Call OutputLine(ECHOMINIMAL, "Installing CA Packages, this will take several minutes...")
        Call WshShell.Run ("cmd /c servermanagercmd -install ADCS-Cert-Authority -resultPath installResult.xml", 0 , True)
    End If

    If (PKGWEB = True) Then
        Call OutputLine(ECHOMINIMAL, "Installing Web Page Packages, this will take several minutes...")
        Call WshShell.Run ("cmd /c servermanagercmd -install ADCS-Web-Enrollment -resultPath installResult.xml", 0 , True)
    End If

Else

    If (PKGWEB = True) Then
        Call OutputLine(ECHOMINIMAL, "Removing Web Page Packages, this will take several minutes...")
        Call WshShell.Run ("cmd /c servermanagercmd -remove ADCS-Web-Enrollment -resultPath installResult.xml", 0 , True)
    End If

    If (PKGCA = True) Then
        Call OutputLine(ECHOMINIMAL, "Removing CA Packages, this will take several minutes...")
        Call WshShell.Run ("cmd /c servermanagercmd -remove ADCS-Cert-Authority -resultPath installResult.xml", 0 , True)
    End If

End If

Call OutputLine(ECHOMINIMAL, "Installing Packages, this will take several minutes...")

Set WShShell = Nothing

    End Sub 'InstallPackage

    '******************************************************************** '* '* Sub Main() '* '* Purpose: Executes the main script logic '* Input:
    '* '* Output:
    '* '******************************************************************** Sub Main () Dim intOpMode

    'Parse the command line
intOpMode = intParseCmdLine()

Select Case intOpMode

    Case CONST_SHOW_USAGE
        Call Usage()
        Exit Sub

    Case CONST_PROCEED
        'Do Nothing

    Case CONST_ERROR
        Call OutputLine(ECHOMINIMAL,"Error occurred in passing parameters.")
        Exit Sub

    Case Else                    'Default -- should never happen
        Call OutputLine(ECHOMINIMAL,"Error occurred in passing parameters.")
        Exit Sub

End Select

'Check if certocm.dll is present, if not we are most likely running on core and need
'to use ocsetup to install CA package to get certocm.dll
Dim FSO
Set FSO = CreateObject("Scripting.FileSystemObject")

Dim WshShell
Dim envVars
Dim strWinDir
Set WshShell = WScript.CreateObject("WScript.Shell")
Set envVars  = WshShell.Environment("process")

strWinDir    = envVars("windir")

wscript.echo "Checking if certocm.dll is present..."

If Not FSO.FileExists(strWinDir + "\system32\certocm.dll") Then
    bisCore = True
    wscript.echo "Certocm.dll is not present installing CA package..."
    Call WshShell.Run ("cmd /c start /w ocsetup CertificateServices /norestart /quiet", 0 , True)
    wscript.echo "CA package installed..."
Else
    wscript.echo "Certocm.dll is present not installing CA package"
End If

Set WshShell = Nothing
Set envVars  = Nothing

Set g_oCASetup = CreateObject("certocm.CertSrvSetup")

'Install Packages
Call OutputLine(ECHOMINIMAL,"Proceeding to update packages ...")
Call InstallPackages(bInstall)

    wscript.echo "bInstallService: " & bInstallService wscript.echo "eCARole: " & eCARole wscript.echo "bWebPages: " & bWebPages If ((eCARole <> NO_INSTALL_CA) And (eCARole <> UNINSTALL_CA) And (eCARole <> UNINSTALL_WEB_PAGES)) or (bWebPages <> False) Then Call OutputLine(ECHOMINIMAL, "Main: Info collection complete. Starting install phase..." ) ' got the info we needed, now install.. Call OutputFile.WriteLine("Main: Installing...")

        If (True = InstallAndVerifyCA(eCARole, bInstallService, bWebPages)) Then
        Call OutputFile.WriteLine("Main: Install complete! Passed")
    Else
        Call OutputFile.WriteLine("Main: Install complete! Failed")
        Call WScript.Quit (1)
    End If 'Installed without errors
Else
    If (eCARole = UNINSTALL_CA or eCARole = UNINSTALL_WEB_PAGES) Then
        If (eCARole = UNINSTALL_WEB_PAGES) Then
            Call OutputLine(ECHOMINIMAL, "Main: Uninstalling Web pages only...")
            'Uninstall web pages only
            Call UninstallCA(True)
            Call OutputLine(ECHOMINIMAL, "Main: web pages Uninstalled!")
        Else
            Call OutputLine(ECHOMINIMAL, "Main: Uninstalling CA...")
            'Uninstall web pages only
            Call UninstallCA(False)
            Call OutputLine(ECHOMINIMAL, "Main: Uninstalled!")
        End If
    End If
End If

' Clean Up
Call OutputFile.Close()

    End Sub 'Main

    '******************************************************************** '* '* Sub VerifyStandardStreams() '* '* Purpose: verify CScript.exe was used to launch this script. '* '******************************************************************** Sub VerifyStandardStreams() On Error Resume Next

    'Attempt to write to the error stream
Call WScript.StdOut.WriteLine()

'If couldn't display the error because cscript wasn't used, 

If (Err.Number <> 0) Then

    'Report problem
    Call WScript.Echo("Please run this script from cscript.")

    'Exit the script
    Call WScript.Quit (1)
End If

On Error Goto 0

    End Sub 'VerifyStandardStreams

    '******************************************************************** '* '* Sub OutputLine() '* '* Purpose: Control the debug output at one location '* '* Input: Level compare to verbosity - if lower, do not display '* string String to output. '* '******************************************************************** Sub OutputLine(ByVal level, ByVal String)

    Call OutputFile.WriteLine(String)
WScript.StdOut.WriteLine String

    End Sub ' OutputLine

    '******************************************************************** '* '* Sub PrintErrorInfo() '* '* Purpose: Control the debug output at one location '* '* Input: Message Message to log '* Err Error obejct to get info from '* '******************************************************************** Sub PrintErrorInfo(ByVal Message, ByVal oErr) Call OutputLine(ECHOMINIMAL, Message) Call OutputLine(ECHOMINIMAL, "Error Info: " & oErr.Number & ": " & oErr.Description) Call OutputLine(ECHOMINIMAL, "Error Source: " & oErr.Source) End Sub ' OutputLine

    '******************************************************************** '* '* Function intParseCmdLine() '* '* Purpose: Parses the command line. '*
    '* Input: none '* '* Output: none '* '******************************************************************** Function intParseCmdLine() On Error Resume Next

    Dim strFlag
Dim intState
Dim ArgTemp
Dim intArgIter
Dim objFileSystem

If Wscript.Arguments.Count > 0 Then
    Call OutputFile.WriteLine("parsing arguments: ")

    For Each ArgTemp in WScript.Arguments

        If (InStr(ArgTemp," ") > 0) Then
            Call OutputFile.Write(Chr(34) & ArgTemp & Chr(34) & " ")
        Else
            Call OutputFile.Write(ArgTemp & " ")
        End If

    Next ' ArgTemp

    Call OutputFile.WriteLine
    strFlag = Wscript.arguments.Item(0)
End If

'No arguments have been received

If IsEmpty(strFlag) Then
    intParseCmdLine = CONST_SHOW_USAGE
    Exit Function ' intParseCmdLine
End If

'Check if the user is asking for help or is just confused

If (strFlag = "help") Or (strFlag = "/h") Or (strFlag = "\h") Or (strFlag = "-h") _
    Or (strFlag = "\?") Or (strFlag = "/?") Or (strFlag = "?") _
    Or (strFlag = "h") Then
    intParseCmdLine = CONST_SHOW_USAGE
    Exit Function ' intParseCmdLine
End If

'Retrieve the command line and set appropriate variables
intArgIter = 0

Do While intArgIter <= Wscript.arguments.Count - 1

    Select Case Left(LCase(Wscript.arguments.Item(intArgIter)),4)
        Case "/int"
            bInteractive = True
            intArgIter   = intArgIter + 1

        Case "/sp"

            If Not blnGetArg("Crypto Provider", strSelectedCSP, intArgIter) Then
                intParseCmdLine = CONST_ERROR
                Exit Function ' intParseCmdLine
            End If

            intArgIter = intArgIter + 1

        Case "/sk"

            If Not blnGetArg("Key length", iSelectedKeySize, intArgIter) Then
                intParseCmdLine = CONST_ERROR
                Exit Function ' intParseCmdLine
            End If

            intArgIter = intArgIter + 1

        Case "/sa"

            If Not blnGetArg("Hash algorithm",strSelectedHashAlg, intArgIter) Then
                intParseCmdLine = CONST_ERROR
                Exit Function ' intParseCmdLine
            End If

            intArgIter = intArgIter + 1

        Case "/sn"

            If Not blnGetArg("CA Name", strCAName, intArgIter) Then
                intParseCmdLine = CONST_ERROR
                Exit Function ' intParseCmdLine
            End If

            intArgIter = intArgIter + 1

        Case "/dn"

            If Not blnGetArg("DN Suffix", strDNSuffix, intArgIter) Then
                intParseCmdLine = CONST_ERROR
                Exit Function ' intParseCmdLine
            End If

            intArgIter = intArgIter + 1


        Case "/sr"

            If Not blnGetArg("Root CA", strRootCAName, intArgIter) Then
                intParseCmdLine = CONST_ERROR
                Exit Function ' intParseCmdLine
            End If

            intArgIter = intArgIter + 1

        Case "/or"

            If Not blnGetArg("Request File", strRequestFile, intArgIter) Then
                intParseCmdLine = CONST_ERROR
                Exit Function ' intParseCmdLine
            End If

            intArgIter = intArgIter + 1

        Case "/iw"

            If bIsCore = False Then
                bWebPages = True
            End If

            intArgIter = intArgIter + 1

        Case "/ie"

            If (eCARole <> NO_INSTALL_CA) Then
                intParseCmdLine = CONST_ERROR
                Exit Function ' intParseCmdLine
            End If

            intParseCmdLine = CONST_PROCEED
            bInstallService = True
            eCARole         = ENTERPRISE_ROOTCA
            intArgIter      = intArgIter + 1

        Case "/is"

            If (eCARole <> NO_INSTALL_CA) Then
                intParseCmdLine = CONST_ERROR
                Exit Function ' intParseCmdLine
            End If

            intParseCmdLine = CONST_PROCEED
            bInstallService = True
            eCARole         = STANDALONE_ROOTCA
            intArgIter      = intArgIter + 1

        Case "/if"

            If (eCARole <> NO_INSTALL_CA) Then
                intParseCmdLine = CONST_ERROR
                Exit Function ' intParseCmdLine
            End If

            intParseCmdLine = CONST_PROCEED
            bInstallService = True
            eCARole         = ENTERPRISE_SUBCA
            intArgIter      = intArgIter + 1

        Case "/it"

            If (eCARole <> NO_INSTALL_CA) Then
                intParseCmdLine = CONST_ERROR
                Exit Function ' intParseCmdLine
            End If

            intParseCmdLine = CONST_PROCEED
            bInstallService = True
            eCARole         = STANDALONE_SUBCA
            intArgIter      = intArgIter + 1

        Case "/uc"

            If (eCARole <> NO_INSTALL_CA) And (eCARole <> UNINSTALL_CA)  Then
                intParseCmdLine = CONST_ERROR
                Exit Function ' intParseCmdLine
            End If

            bInstallService = False
            bWebPages      = False
            bInstall        = False
            eCARole         = UNINSTALL_CA
            intParseCmdLine = CONST_PROCEED
            intArgIter      = intArgIter + 1

        Case "/uw"

            If (eCARole <> NO_INSTALL_CA) And (eCARole <> UNINSTALL_CA) Then
                intParseCmdLine = CONST_ERROR
                Exit Function ' intParseCmdLine
            End If

            bWebPages      = False
            bInstall        = False
            eCARole         = UNINSTALL_WEB_PAGES
            intParseCmdLine = CONST_PROCEED
            intArgIter      = intArgIter + 1

        Case "/rk"
            bReuseKey  = True
            intArgIter = intArgIter + 1

        Case "/rc"
            bReuseCert = True
            intArgIter = intArgIter + 1

        Case "/rcd"
            bReuseCert = True
            bReuseDB   = True
            intArgIter = intArgIter + 1

            'Depricated switches kept to prevent automation from failing
        Case "/sl"
            intArgIter = intArgIter + 2
        Case "/sc"
            intArgIter = intArgIter + 2
        Case "/si"
            intArgIter = intArgIter + 2

        Case Else 'We shouldn't get here
            Call OutputLine(ECHOMINIMAL, "Invalid or misplaced parameter: " & Wscript.arguments.Item(intArgIter))
            Call OutputLine(ECHOMINIMAL, "Please check the input and try again")
            Call OutputLine(ECHOMINIMAL, "or invoke with " & Chr(39) & "/?" & Chr(39) & " for help with the syntax.")
            Wscript.Quit

    End Select

Loop '** intArgIter <= Wscript.arguments.Count - 1

intParseCmdLine = CONST_PROCEED

    End Function

    '******************************************************************** '* '* Function blnGetArg() '* '* Purpose: Helper to intParseCmdLine() '* '* Usage: '* '* Case "/s" '* blnGetArg ("server name", strServer, intArgIter) '* '********************************************************************

    Private Function blnGetArg (ByVal StrVarName, _ ByRef strVar, _ ByRef intArgIter)

    blnGetArg = False 'failure, changed to True upon successful completion
Err.Clear

If Len(Wscript.Arguments(intArgIter)) > 3 Then

    If Mid(Wscript.Arguments(intArgIter),4,1) = ":" Then

        If Len(Wscript.Arguments(intArgIter)) > 4 Then
            strVar    = Right(Wscript.Arguments(intArgIter), _
            Len(Wscript.Arguments(intArgIter)) - 4)
            blnGetArg = True
            Exit Function
        Else
            intArgIter = intArgIter + 1

            If intArgIter > (Wscript.Arguments.Count - 1) Then
                Call OutputLine(ECHOMINIMAL, "Parameter Missing: " & StrVarName & ".")
                Call OutputLine(ECHOMINIMAL, "Invalid " & StrVarName & ".")
                Call OutputLine(ECHOMINIMAL, "Please check the input and try again.")
                Exit Function
            End If

            strVar = Wscript.Arguments.Item(intArgIter)

            If Err.Number Then
                Call OutputLine(ECHOMINIMAL, "Error: " & Err.Number & ": " & Err.Description & ".")
                Call OutputLine(ECHOMINIMAL, "Invalid " & StrVarName & ".")
                Call OutputLine(ECHOMINIMAL, "Please check the input and try again.")
                Exit Function
            End If

            If InStr(strVar, "/") Then
                Call OutputLine(ECHOMINIMAL, "Invalid " & StrVarName)
                Call OutputLine(ECHOMINIMAL, "Invalid Parameter was:" & StrVar)
                Call OutputLine(ECHOMINIMAL, "Please check the input and try again.")
                Exit Function
            End If

            blnGetArg = True 'success
        End If

    Else
        strVar    = Right(Wscript.Arguments(intArgIter), _
        Len(Wscript.Arguments(intArgIter)) - 4)
        blnGetArg = True 'success
        Exit Function
    End If

Else
    intArgIter = intArgIter + 1

    If intArgIter > (Wscript.Arguments.Count - 1) Then
        Call OutputLine(ECHOMINIMAL, "Parameter Missing: " & StrVarName & ".")
        Call OutputLine(ECHOMINIMAL, "Invalid " & StrVarName & ".")
        Call OutputLine(ECHOMINIMAL, "Please check the input and try again.")
        Exit Function
    End If

    strVar = Wscript.Arguments.Item(intArgIter)

    If Err.Number Then
        Call OutputLine(ECHOMINIMAL, "Error: " & Err.Number & ": " & Err.Description & ".")
        Call OutputLine(ECHOMINIMAL, "Invalid " & StrVarName & ".")
        Call OutputLine(ECHOMINIMAL, "Please check the input and try again.")
        Exit Function
    End If

    If InStr(strVar, "/") Then
        Call OutputLine(ECHOMINIMAL, "Invalid " & StrVarName)
        Call OutputLine(ECHOMINIMAL, "Invalid Parameter was:" & StrVar)
        Call OutputLine(ECHOMINIMAL, "Please check the input and try again.")
        Exit Function
    End If

    blnGetArg = True 'success
End If

    End Function

    '******************************************************************** '* '* Function CreateLogFile() '* '* Purpose: Creates the local log file of all of the script output '* '* Input: strLogFileName '* '******************************************************************** Function CreateLogFile(ByVal strLogFileName) Dim FileSystem Set FileSystem = CreateObject("Scripting.FileSystemObject")

    'Get the actual path
Dim strFileName
strFileName = FileSystem.GetAbsolutePathName(strLogFileName)

Call WScript.StdOut.WriteLine ("Log file = " & strFileName)

On Error Resume Next

' just append to

If FileSystem.FileExists(strFileName) Then
    'Open Existing log
    Set CreateLogFile = FileSystem.OpenTextFile(strFileName, FILE_FLAG_APPEND, True)
Else
    'Open new log
    Set CreateLogFile = FileSystem.CreateTextFile(strFileName, True)
End If

Set FileSystem = Nothing

If Err.Number <> 0 Then
    Call WScript.StdErr.WriteLine ("Error creating the log file " & strFileName)
    Call WScript.StdErr.WriteLine ("Error " & Err.Number & " - " & Err.Description)
    Call WScript.Quit (1)
End If

On Error Goto 0

    End Function ' CreateLogFile

    '******************************************************************** '* '* Function SetProvider() '* '* Purpose: '* '* Input: ProviderString '* HashAlg '* KeyLen '* '******************************************************************** Function SetProvider(ByRef oCASetup, ByVal ProviderString, ByVal HashAlg, ByVal KeyLen) Call OutputLine(ECHOMINIMAL, _ "SetProvider called with " & _ Chr(34) & ProviderString & Chr(34) & ", " & _ Chr(34) & HashAlg & Chr(34) & ", " & _ Chr(34) & KeyLen & Chr(34))

    'Declare variable to store KeyInfo object
Dim oCAKeyInfo
Dim retVal

retVal = False

Call OutputLine(ECHOMINIMAL, "SetProvider: Creating oCAKeyInfo by calling oCASetup.GetCASetupProperty(SETUPPROP_CAKEYINFORMATION )")
' Create CA KeyInfo object
Set oCAKeyInfo = oCASetup.GetCASetupProperty(SETUPPROP_CAKEYINFORMATION)

If ("" <> ProviderString) Then
    Call OutputLine(ECHOMINIMAL, "SetProvider: Changing oCAKeyInfo.ProviderName to " & ProviderString)
    oCAKeyInfo.ProviderName = ProviderString
End If

' only modify key length if it was specified

If ("" <> KeyLen) Then
    Call OutputLine(ECHOMINIMAL, "SetProvider: Changing oCAKeyInfo.Length to " & KeyLen)
    oCAKeyInfo.Length = KeyLen
End If

' Only modify hash algorithm if it was specified

If ("" <> HashAlg) Then
    Call OutputLine(ECHOMINIMAL, "SetProvider: Changing oCAKeyInfo.HashAlgorithm to " & HashAlg)
    oCAKeyInfo.HashAlgorithm = HashAlg
End If

Call OutputLine(ECHOMINIMAL, "SetProvider: Calling oCASetup.SetCASetupProperty(SETUPPROP_CAKEYINFORMATION, oCAKeyInfo) ")

On Error Resume Next
Call Err.Clear()

' Set the keyInfo property
Call oCASetup.SetCASetupProperty(SETUPPROP_CAKEYINFORMATION, oCAKeyInfo)

If (Err.Number <> 0) Then
    Call OutputLine(ECHOMINIMAL, "SetProvider1: Error " & Err.Number & ": " & Err.Description)
    Call OutputLine(ECHOMINIMAL, "Error Source: " & Err.Source)
    'Exit the script
    Call WScript.Quit (1)
End If ' error occurred

SetProvider = True

    End Function 'SetProvider

    '******************************************************************** '* '* Function InstallAndVerifyCA() '* '* Purpose: runs setup on CA object with specified parameters '* '* Input: CAType '* CAService '* WebPages '* '********************************************************************' Function InstallAndVerifyCA(ByVal CAType, ByVal CAService, ByVal WebPages) Dim LocalCAConfig Dim CADBPath

    ' Default to failed
InstallAndVerifyCA = False

On Error Resume Next

Call Err.Clear()

Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: InitializeDefaults")
Call OutputLine(ECHOMINIMAL, "CAService: " & CAService)
Call OutputLine(ECHOMINIMAL, "WebPages: " & WebPages)

Err.Number = 0

' Call this function with an error handling wrapper, or vbscript equivalent..
Call g_oCASetup.InitializeDefaults(CAService, WebPages)

If (0 <> Err.Number) Then

    If (5 = Err.Number) Then
        ' uninstall

        If(bRecursed          = False) Then
            bRecursed          = True
            Call UninstallCA(False)
            InstallAndVerifyCA = InstallAndVerifyCA( CAType, CAService, WebPages)
            Exit Function
        End If

    End If 'error is already installed

    Call PrintErrorInfo("CA Already install and cannot uninstall", Err)
    Call OutputLine(ECHOMINIMAL, "")
    Exit Function 'InstallAndVerifyCA
End If 'error occurred

    'CA Service setup section If (CAService = True) then 'Specify CA role Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: SetCASetupProperty - CAType = " & CAType) Call g_oCASetup.SetCASetupProperty(SETUPPROP_CATYPE, CAType)

    If (0 <> Err.Number) And (VALUE_OUT_OF_RANGE <> Err.Number) Then Call PrintErrorInfo("InstallAndVerifyCA3:unable to set SETUPPROP_CATYPE!", Err) Exit Function 'InstallAndVerifyCA End If 'not a domain admin and error occurred

    If (VALUE_OUT_OF_RANGE = Err.Number) Then Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: Error! Must be a domain administrator to create Enterprise CA") Exit Function 'InstallAndVerifyCA End If ' not a domain admin

    Call Err.Clear()

    if (bInteractive <> FALSE) then Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: SetCASetupProperty - Interactive = " & bInteractive) Call g_oCASetup.SetCASetupProperty(SETUPPROP_INTERACTIVE, bInteractive)

    If (0 <> Err.Number) Then Call PrintErrorInfo("InstallAndVerifyCA:unable to set Interactive!", Err) Call OutputLine(ECHOMINIMAL, "") Exit Function 'InstallAndVerifyCA End If end if

    If (False <> bReuseKey) Or (False <> bReuseCert) Then

    If (False = SetupKeyReuse(bReuseKey, bReuseCert, strCAName)) Then Call PrintErrorInfo("InstallAndVerifyCA: SetupKeyReuse failed.", Err) Exit Function End If

    Else If "" <> strCAName then Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: SetCADistinguishedName") 'CAName, ignore UTF8, overwrite existing key, overwrite CA in DS Dim strCAFullDN strCAFullDN = "CN=" & strCAName If "" <> strDNSuffix then strCAFullDN = strCAFullDN & "," & strDNSuffix

    Call g_oCASetup.SetCADistinguishedName(strCAFullDN, True, True, True) 'Display errors

    If (g_oCASetup.CAErrorId <> 0) Then Call PrintErrorInfo("InstallAndVerifyCA:SetCADistinguishedName failed. ", Err) End If

    End If

    End If

    Call Err.Clear()

    If (CAType <> ENTERPRISE_ROOTCA) And (CAType <> STANDALONE_ROOTCA) And (bReuseCert <> True) Then If (strRequestFile = "") Then Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: SetParentCAInformation") 'Set parent CA information if it is a subordinate Call g_oCASetup.SetParentCAInformation(strRootCAName)

    If (0 <> Err.Number) And (ROOT_CA_NOT_FOUND <> Err.Number) Then Call PrintErrorInfo("InstallAndVerifyCA:unable to set ParentCAInformation!", Err) Call OutputLine(ECHOMINIMAL, "") Exit Function 'InstallAndVerifyCA End If ' root ca not found

    If (ROOT_CA_NOT_FOUND = Err.Number) Then Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: Root CA (to Subordinate to) could not be found!") Exit Function 'InstallAndVerifyCA End If ' root ca not found Else Call g_oCASetup.SetCASetupProperty(SETUPPROP_REQUESTFILE, strRequestFile) End If End If ' not root

    If (bReuseCert = False) Then Dim bProviderSet bProviderSet = SetProvider(g_oCASetup, strSelectedCSP, strSelectedHashAlg, iSelectedKeySize)

    If (False = bProviderSet) Then Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA:unable to set key properties!") Exit Function 'InstallAndVerifyCA End If 'error occurred End If

    Call Err.Clear() End If

    If (True = WebPages) And (CAType = NO_INSTALL_CA) Then Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: SetWebCAInformation") 'Set web CA information if it is a web pages Call g_oCASetup.SetWebCAInformation(strRootCAName)

        If (0 <> Err.Number) Then

        If ( REG_VALUE_NOT_FOUND <> Err.Number) Then
            Call PrintErrorInfo("InstallAndVerifyCA:unable to set SetWebCAInformation!", Err)
            Call OutputLine(ECHOMINIMAL, "")
        Else
            Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: install failed, registry key not present!")
        End If

        Exit Function 'InstallAndVerifyCA
    End If ' error

End If ' web pages should be installed

Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: Setting Key Properties")

Call Err.Clear()

Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: calling SetProvider")

'Dim KeyLenVar
'KeyLenVar = ProviderKeyLength(strSelectedCSP)

'If ("" <> KeyLenVar) Then
'  iSelectedKeySize = KeyLenVar
'End If

Call Err.Clear()

Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: BeforeInstall!")

Call g_oCASetup.Install()

If (0 <> Err.Number) Then

    If ( REG_VALUE_NOT_FOUND <> Err.Number) Then
        Call PrintErrorInfo("InstallAndVerifyCA:Install failed!", Err)
        Call OutputLine(ECHOMINIMAL, "")
    Else
        Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: install failed, registry key not present!")
        Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: " & Err.Number & ": " & Err.Description)
    End If

    Exit Function 'InstallAndVerifyCA
End If 'error occurred

Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: AfterInstall!")

On Error GoTo 0

Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: calling GetLocalCAConfig")

LocalCAConfig = GetLocalCAConfig()

If (LocalCAConfig = "") Then
    Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: CA Reg entry not present!")
    Exit Function 'InstallAndVerifyCA
End If ' getlocalcaconfig failed

WScript.Sleep 30000

If (CAService = True) Then

    If (0 <> PingCA(LocalCAConfig)) Then
        Call OutputLine(ECHOMINIMAL, "InstallAndVerifyCA: Service not started!")
        Exit Function 'InstallAndVerifyCA
    End If ' can't ping service

End If ' ca set to install as a service

InstallAndVerifyCA = True

    End Function 'InstallAndVerifyCA

    '******************************************************************** '* '* Function UninstallCA() '* '* Purpose: Uninstalls all of the CA server components or optionally just the pages '* '* Input:
    '* '********************************************************************' Function UninstallCA(ByVal WebPagesOnly) Dim LocalCAConfig

    Call OutputLine(ECHOMINIMAL, "UninstallCA: calling GetLocalCAConfig")

' See where the server is at currently
LocalCAConfig = GetLocalCAConfig()

    if (WebPagesOnly = False) Then If ("" = LocalCAConfig) Then Call OutputLine(ECHOMINIMAL, "UninstallCA: CA not installed!") UninstallCA = True Exit Function 'UninstallCA End If ' getlocalcaconfig failed End If

    Call OutputLine(ECHOMINIMAL, "UninstallCA: calling .PreUninstall")

' Clean up the web pages
On Error Resume Next
Call g_oCASetup.PreUninstall(WebPagesOnly)

If Err.Number <> 0 Then
    Call PrintErrorInfo("UninstallCA: ", Err)
End If

Call OutputLine(ECHOMINIMAL, "UninstallCA: calling .PostUninstall")

Call g_oCASetup.PostUninstall()

Call OutputLine(ECHOMINIMAL, "UninstallCA: calling .GetLocalCAConfig")

' Check registry to see if CA is still installed 
LocalCAConfig = GetLocalCAConfig()

If ("" = LocalCAConfig) Then
    'Not installed!
    Call OutputLine(ECHOMINIMAL, "UninstallCA: Uninstall completed Successfully!")
    UninstallCA = True
    Exit Function 'UninstallCA
End If 'getlocalcaconfig failed

Call OutputLine(ECHOMINIMAL, "UninstallCA: calling PingCA")

' If the registry is still there, it might just be slow. 
' Try pinging the CA 

If (0 <> PingCA("")) Then
    UninstallCA = True
    Exit Function 'UninstallCA
End If ' can't ping service

' Default to error
UninstallCA = False

    End Function 'UninstallCA

    '******************************************************************** '* '* Function GetLocalCAConfig() '* '* Purpose: Determine role of CA if installed '* '* Input:
    '* '********************************************************************' Function GetLocalCAConfig() Dim WshShell Dim ActiveConfig Dim CAName Dim CAServer

    On Error Resume Next

Set WshShell = WScript.CreateObject("WScript.Shell")
ActiveConfig = WshShell.RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\Active")

If (Err.Number <> 0) Then

    If (REG_VALUE_NOT_FOUND <> Err.Number) Then
        GetLocalCAConfig = ""
        Call PrintErrorInfo("GetLocalCAConfig: ", Err)
        Exit Function 'GetLocalCAConfig
    Else ' reg value not found
        GetLocalCAConfig = ""
        Call OutputLine(ECHOMINIMAL, "GetLocalCAConfig: CA Not Installed!")
        Call OutputLine(ECHOMINIMAL, "")
        Exit Function 'GetLocalCAConfig
    End If ' reg value found

End If ' error occurred

Call OutputLine(ECHOMINIMAL," Reading HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\" & ActiveConfig & "\CommonName")
CAName = WshShell.RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\" & ActiveConfig & "\CommonName")
Call OutputLine(ECHOMINIMAL, "CAName: " & CAName)

Call OutputLine(ECHOMINIMAL," Reading HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\" & ActiveConfig & "\CAServerName")
CAServer = WshShell.RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\" & ActiveConfig & "\CAServerName")
Call OutputLine(ECHOMINIMAL, "CAServer: " & CAServer)

' Cleanup
Set WShShell = Nothing

'Set Return value
GetLocalCAConfig = CAServer & "\" & CAName

    End Function 'GetLocalCAConfig

    '******************************************************************** '* '* Function PingCA() '* '* Purpose: use CertUtil to ping the CA '* '* Input:
    '* '********************************************************************' Function PingCA(ByVal CAConfig) Dim WshShell Dim command Dim RunRet

    Set WshShell = WScript.CreateObject("WScript.Shell")

If ("" <> CAConfig) Then
    command = "certutil -config " & CAConfig & " -ping"
Else 'caconfig param null
    command = "certutil -ping"
End If ' caconfig param passed

RunRet       = WshShell.Run(command, 1, False)

Set WShShell = Nothing
PingCA       = RunRet

    End Function ' PingCA

    '******************************************************************** '* '* Function SetUpKeyReuse() '* '* Purpose: use CertUtil to ping the CA '* '* Input:
    '* '********************************************************************' Function SetUpKeyReuse(ByVal bReuseKey, ByVal bReuseCert, ByVal KeyName)

    Dim oCAKeyInfo
Dim oExistingCerts
Dim CertInfo

On Error Resume Next

Set oCAKeyInfo     = g_oCASetup.GetCASetupProperty(SETUPPROP_CAKEYINFORMATION)
Set oExistingCerts = g_oCASetup.GetExistingCACertificates()

Call OutputLine(ECHOMINIMAL,"Searching Existing Machine Keys")

For Each CertInfo in oExistingCerts
    wscript.echo "Existing Cert: " & certinfo.ContainerName

    If (KeyName = certinfo.ContainerName) Then
        wscript.echo "Found cert!"
        oCAKeyInfo.Existing      = True
        If (Err.Number <> 0) Then Call PrintErrorInfo("SetUpKeyReuse: oCAKeyInfo.Existing", Err)
        oCAKeyInfo.ContainerName = CertInfo.ContainerName
        If (Err.Number <> 0) Then Call PrintErrorInfo("SetUpKeyReuse: oCAKeyInfo.ContainerName", Err)
        oCAKeyInfo.HashAlgorithm = CertInfo.HashAlgorithm
        If (Err.Number <> 0) Then Call PrintErrorInfo("SetUpKeyReuse: oCAKeyInfo.HashAlgorithm", Err)
        oCAKeyInfo.Length        = CertInfo.Length
        If (Err.Number <> 0) Then Call PrintErrorInfo("SetUpKeyReuse: oCAKeyInfo.Length", Err)
        oCAKeyInfo.ProviderName  = CertInfo.ProviderName
        If (Err.Number <> 0) Then Call PrintErrorInfo("SetUpKeyReuse: oCAKeyInfo.ProviderName", Err)

        If (bReuseCert = True) Then
            oCAKeyInfo.ExistingCACertificate = CertInfo.ExistingCACertificate
            If (Err.Number <> 0) Then Call PrintErrorInfo("SetUpKeyReuse: oCAKeyInfo.ExistingCACertificate", Err)
        End If

        Call g_oCASetup.SetCASetupProperty(SETUPPROP_CAKEYINFORMATION, oCAKeyInfo)
        If (Err.Number <> 0) Then Call PrintErrorInfo("SetUpKeyReuse: g_oCASetup.SetCASetupProperty(1, oCAKeyInfo)", Err)
        wscript.echo g_oCASetup.GetCASetupProperty(SETUPPROP_CANAME)
        wscript.echo g_oCASetup.GetCASetupProperty(SETUPPROP_CADSSUFFIX)
    End If

Next

SetupKeyReuse = True

    End Function ' SetKeyReuse

See also