The inventory-gathering capabilities of the FlexNet Inventory Agent are extended using InventorySettings.xml, which includes PowerShell scripts to collect data about various software, including:

• Microsoft Windows Server user access logging
• Microsoft CAL/SharePoint Server
• Microsoft Exchange Server
• Microsoft Lync Server

The script related to Exchange Server in InventorySettings.xml dynamically builds and executes a PowerShell command line to decrypt Exchange Server edition information that has been retrieved from Active Directory. The command line includes an encrypted byte array containing information retrieved from Active Directory.

Some security software can detect and flag execution of PowerShell in this way. Command line may be reported as containing non-ASCII character data.

Exchange edition decode algorithm

The PowerShell script described above decodes binary data containing Exchange edition information retrieved from Active Directory. This is a decoding method derived from Microsoft’s documentation on Exchange Server Active Directory schema changes. Details on this method are available in Exchange Server 2003 to Exchange Server 2010 Active Directory Schema Changes Reference.doc.

Using the type attribute of the msExchExchangeServer object from Active Directory, the following steps represented in C#-like pseudocode decode the encrypted value.

1.  Establish constants for encoding

 Two constants establish the encoding seed and magic numbers used by the algorithm.

const byte Seed = 0x49;
const byte Magic = 0x43;

2. Convert the Unicode string to a little-endian byte array

byte[] decodeBuf = Encoding.Unicode.GetBytes((string)value);

3. Decode the byte array

Start from the end of the buffer and decode each byte [n-1] by XORing it with the result of XOR between the seed and byte [n-2]. This decodes all bytes except the first one. Each decoded byte will be an ASCII printable character.

for (int i = decodeBuf.Length; i > 1; i--) {
  decodeBuf[i - 1] ^= (byte)(decodeBuf[i - 2] ^ Seed);
}

4. Decode the first byte

Use XOR with the bitwise OR of the seed and magic number:

decodeBuf[0] ^= Seed | Magic;

5. Convert the byte array back to a Unicode string

The byte array now has a little-endian array of Unicode bytes that can be converted back to a Unicode string.

string decodedType = Encoding.Unicode.GetString(decodeBuf);

6. Interpret the converted string

The converted string has the following format: {ServerType};{EncodeDate};{SetupType}

Each field is a hexadecimal string of the format 0xhhhhhhhh. For example: 0x00000001;0x32984c50;0x00000001.

The MAP Toolkit is concerned only with the ServerType and SetupType fields, each of which shares the same enumeration values, as shown in the following table.

Additional information about processes executed during the inventory gathering process on Windows operating systems can be found here: Common: Child Processes on Windows Platforms.