0

I have an issue whereby our users are having their AD accounts locked out due to stored Generic Credentials (GC's). Issue is resolved by removing the GC's but they will return when the users log in to a new machine.

I can find heaps of information around removing all stored credentials except the GC's but this is the reverse of what I need and the other credentials must remain intact.

I have generated a batch file but it will only remove the "basic" CG's that do not have any special characters. I suspect the command cmdkey /delete cannot deal with the complex names. i.e, LegacyGeneric:target=Microsoft_OC1:uri=Joe.Bloggs@example.com.au:certificate:OCS:1

The Batch File,

cmdkey.exe /list > "%TEMP%\List.txt"
findstr.exe LegacyGeneric "%TEMP%\List.txt" > "%TEMP%\tokensonly.txt"
FOR /F "tokens=1,2 delims= " %a IN (%TEMP%\tokensonly.txt) DO cmdkey.exe /delete:%b
del "%TEMP%\List.txt" /s /f /q
del "%TEMP%\tokensonly.txt" /s /f /q

I will also have issues getting a batch file around our Application White Listing when it goes live in 2 weeks. So a PowerShell Script would be better but I'm open to other languages.

I am sure there must be a script capable of processing this request but I have hit a knowledge wall.

Any help will be appreciated.

Cheers, Tim

Tim Seddon-Brown
  • 13
  • 1
  • 2

2 Answers2

0

Hope this helps!It will delete windows generic credential by powershell

$key_dat =@((cmdkey /listall | Where-Object{$_ -like "*LegacyGeneric*"}).replace("Target: ",""))
for($k =0; $k -le ($key_dat.Count -1); $k++)
{
[string]$dele_data =$key_dat[$k].trim()
cmdkey /delete:$dele_data
}
Aameer
  • 221
  • 2
  • 4
  • The syntax : cmdkey /delete:targetname does not work when you attempt to delete all the entries. – Clint May 22 '19 at 06:55
0

the script works for me combining the threads above. I especially had to delete old OUTLOOK entries and succeed running this script in user context. Please bare in mind that EXECUTION POLICY has to be set in another administrative script since this runs in user context.

$key_dat = @((cmdkey /listall | Where-Object{$_ -like "*LegacyGeneric:target=MS.Outlook*"}).replace("Target: ",""))
for($k =0; $k -le ($key_dat.Count -1); $k++)
{
[string]$dele_data =$key_dat[$k].split()[-1]
cmdkey /delete:$dele_data
}
Stefan X.
  • 1
  • 1