Gerenios / AADInternals

AADInternals PowerShell module for administering Azure AD and Office 365
http://aadinternals.com/aadinternals
MIT License
1.24k stars 214 forks source link

Join-AADIntDeviceToAzureAD "Invalid JWT token" #40

Closed CravateRouge closed 1 year ago

CravateRouge commented 1 year ago

I want to join a fake device but I have the following result doing so:

Get-AADIntAccessTokenForAADJoin -SaveToCache
Join-AADIntDeviceToAzureAD -DeviceName "MyComputer"

Register-DeviceToAzureAD : {"ErrorType":"AuthenticationError","Message":"Invalid JWT
token.","TraceId":"29922db7-0f4c-449f-bfc4-3bb835d4bd28","Time":"10-15-2022 9:58:46Z"}
Au caractère C:\Users\MyUser\Documents\WindowsPowerShell\Modules\AADInternals\0.7.3\PRT.ps1:464 : 31
+ ... tResponse = Register-DeviceToAzureAD -AccessToken $AccessToken -Devic ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Register-DeviceToAzureAD

I don't understand because Get-AADIntAccessTokenForAADJoin generates a token specifically for this purpose but it is still considered as invalid? Could you enlight me on what's happening? Is it because of a policy or MFA?

NestoriSyynimaa commented 1 year ago

I just updated AADInternals as it had some bugs related to writing binary files. Could be reason for that, so just update with Update-Module AADInternalsand try again.

If the problem still exists, please try again with -Verbose switch to see what's happening.

Finally, you can't get access token to join a device from a device that is already AAD joined. That is, if you are running AADInternals on AAD joined device to get the AADJoin token, it will fail. This is due to some internals Windows stuff I haven't figured out yet.

CravateRouge commented 1 year ago

I'm in the last case so this is why it's not working. If you figure this out I would be curious to know!