Powershell script to check if Azure AD Connect is affected by the vulnerability described in CVE-2021-36949

The script below will check if your Azure AD Connect is running a version affected by the vulnerability described in CVE-2021-36949. Affected versions are 1.6.4.0 and 2.0.3.0.

#Disclaimer: This script is provided as-is with no warranties of any kind

Write-Host "Checking if your Azure AD Connect version is affected by the vulnerability described in CVE-2021-36949"

Try
{
$params = ((Get-ADSyncGlobalSettings).Parameters | select Name,Value)
foreach($p in $params)
{
if($p.name -eq 'Microsoft.Synchronize.ServerConfigurationVersion')
{
Write-Host 'Your version is' $p.value
if($p.Value -eq '1.6.4.0' -or $p.Value -eq '2.0.3.0')
{
Write-Host 'You are running a version that is vulnerable - update your Azure AD Connect installation' -BackgroundColor DarkRed -ForegroundColor White
}
else
{
Write-Host 'You are running a version that is not affected' -BackgroundColor DarkGreen -ForegroundColor White
}
break
}
}
}
Catch
{
Write-Host "Unable to check Azure AD Connect version - make sure you are running this script on the server where AAD Connect is installed."
}

Try
{
if(Get-ADSyncAutoUpgrade)
{
Write-Host "AutoUpgrade is enabled."
}
else
{
Write-Host "AutoUpgrade is not enabled."
}
}
Catch
{
Write-Host "Unable to check if Azure AD Connect AutoUpgrade is enabled."
}