Isolate a DC - Part 9: Reset Intraforest trust passwords

This is Part 9 of a series on Active Directory Forest recovery; trust no-one, or at least no peer domains.

Reset Intraforest trust passwords

To avoid accidentally permitting interforest authentication with a Domain Controller that hasn’t been restored yet we need to reset the Intra-Forest trust passwords to a common value on both sides. This way the restored domains will all talk with the same hash. Update the trust shared secret to something actually secret before running this command.

function Reset-IntraForestTrustPasswords{
    [CmdletBinding(
    SupportsShouldProcess = $true,
    ConfirmImpact = 'High')]param([parameter(Mandatory=$true)]
    [String[]]$trustSharedSecret)
    $trusts = get-adtrust -filter {intraforest -eq $true}
    $localdomain = [system.directoryservices.activedirectory.domain]::GetCurrentDomain()
    Write-Warning "Resetting the Intra-frest Trust passwords will break the Intraforest trusts, the same password must be used to reset the password on the other side to restore trust connectivity"
    $trusts.name | %{
        if ($pscmdlet.ShouldProcess($_)){
            $localdomain.UpdateLocalSideOfTrustRelationship($_,$trustSharedSecret) 
        }   
    } 
}

Reset-IntraForestTrustPasswords -trustSharedSecret "OhWhatASecretySecretThisIs!Somuchsecret"

All the other parts of this series are available here