Script is getting "Currently logged-in user" wrong? about set-outlooksignatures HOT 3 CLOSED

Hi @derGali,

this can't be answered definitely without the verbose output of the script.

From your description and the partial script output, the most likely is the following:

1. Parameter GraphOnly is not set, to Set-OutlookSignatures tries to connect to an on-prem Active Directory first. It get's the logged-in user's Distinguised Name with the following command: Add-Type -AssemblyName System.DirectoryServices.AccountManagement; (Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\IdentityStore\Cache\$(([System.Security.Principal.WindowsIdentity]::GetCurrent()).User.Value)\IdentityCache\$(([System.Security.Principal.WindowsIdentity]::GetCurrent()).User.Value)" -Name 'UserName' -ErrorAction SilentlyContinue)
2. According to the output, Set-OutlookSignatures then still decides to connect to Graph anyhow. This means that at least one of the following conditions is met:

• The on-prem Active Directory query from step 1 brought no result
• You use New Outlook (this information is missing, as not the whole output is posted in the issue description)
• GraphOnly is set to true (this is not the case here)
• GraphOnly is set to false AND the Distinguished Name is found in the on-prem Active Directory AND the mailbox is in the cloud AND (SetCurrentUserOOFMessageAND/ORSetCurrentUserOutlookWebSignature` is set to true (which is the default value for both parameters)) - this is very likely what happens

3. When there is no MSAL.PS Graph token cache file, three authentication attempts towards Graph happen one after the other (verbose output shows details):

• Integrated Windows Authentication
• Silent with a login hint (result from step 1)
• Via Prompt with LoginHint and Timeout

What does the command from step 1 output as result?

Which output is in the verbose log?

from set-outlooksignatures.

The result from step 1 is ... nothing. The query fails. In fact, there is no IndetityCache Key in HKLM:\SOFTWARE\Microsoft\IdentityStore\Cache\S-1-5-21-1409082233-299502267-xxxxxxx-xxxx

I do not use new outlook, GraphOnly is false. In the verbose log I can read the following:
...
AUSFÜHRLICH: Current user:
AUSFÜHRLICH: Authentication
AUSFÜHRLICH: Via IntegratedWindowsAuth
AUSFÜHRLICH: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new
location, you must use multi-factor authentication to access '00000003-0000-0000-c000-000000000000'. Trace ID:
8ab7e964-ad0f-4f86-9bcb-583aca7ffc00 Correlation ID: f0e2030f-f33c-41c9-9389-c7c092f43bb6 Timestamp: 2023-11-24
14:17:19Z
AUSFÜHRLICH: Via Silent with LoginHint
AUSFÜHRLICH: No account or login hint was passed to the AcquireTokenSilent call.
AUSFÜHRLICH: Via Prompt with LoginHint and Timeout
...

... actually NOW it works nevertheless and the script gets my correct user right. I really don't know what has happend since last try, I changed nothing, not even the powershell session.

Thank you very much for the quick response, I think from here on I can manage on my own.

from set-outlooksignatures.

You are welcome! Gern geschehen!

from set-outlooksignatures.