CodeB Admin CLI reference.

Overview

The CLI automates what the GUI linkers do, so one admin workstation can enrol cards for the whole company from a script. It works against Active Directory and local accounts. Download: CodeBAdminCLI.zip (also on the downloads page).

Run CodeBAdminCLI.exe /help (or /h, /?) for the built-in help.

Syntax

CodeBAdminCLI.exe /command [/parameter value] …

• Switches start with /, - or --.
• A value can follow after a space, a colon or an equals sign: /pin 1234, /pin:1234 and /pin=1234 are the same.
• Several commands can be given in one call; they run in this order: /clearad, /add2fa, /changepw, /add2ad, /add2fs, /deletecard, /list2fa, /list2facards, /list2adcards.

Commands

Parameters

Examples

:: 1. link a card to a user as second factor in AD
CodeBAdminCLI.exe /add2fa /user stefan /domain CodeB /serial AAFFBBCC

:: 2. store the encrypted credential token in AD (card + PIN 1234)
CodeBAdminCLI.exe /add2ad /user stefan /domain CodeB /password letmein /serial AAFFBBCC /pin:1234
:: ... and a second card for the same user
CodeBAdminCLI.exe /add2ad /user stefan /domain CodeB /password letmein /serial CCDDEEFF /pin:0155

:: 3. create a soft token file on a share, lock the screen on card removal
CodeBAdminCLI.exe /add2fs /user CodeB\stefan /password letmein /serial AAFFBBCC /action 1 /datafolder \\server\codeb\

:: 4. list all second-factor cards of a user
CodeBAdminCLI.exe /list2facards /user stefan /domain CodeB

:: 5. which user owns this card?
CodeBAdminCLI.exe /list2fa /serial AAFFBBFF

:: 6. remove a card everywhere (lost card)
CodeBAdminCLI.exe /deletecard /cardserial AAFFBBFF /user stefan

Password rotation without breaking card logon

/changepw sets the new AD password and updates the encrypted soft token stored for the user in AD in the same call. Card logon keeps working — no re-enrolment and no window in which the stored password is outdated.

CodeBAdminCLI.exe /changepw /user testuser /domain codeb /password oldalibaba /newpassword newalibaba

Bulk enrolment from a CSV file

Example PowerShell loop over a CSV with the columns User,Domain,Serial,Pin. It links each card as a second factor and reports failures by exit code. Adapt it to /add2ad if the token itself should be stored in AD (then a password column is needed).

# cards.csv:  User,Domain,Serial,Pin
$cli = "C:\Tools\CodeB\CodeBAdminCLI.exe"
Import-Csv .\cards.csv | ForEach-Object {
    & $cli /add2fa /user $_.User /domain $_.Domain /serial $_.Serial
    if ($LASTEXITCODE -ne 0) { Write-Warning "$($_.User): exit code $LASTEXITCODE" }
}

Exit codes

Security notes

• Passwords given on the command line can end up in shell history, script files and process lists. Run the CLI on a protected admin workstation, read passwords from a secure source in your script and delete temporary CSV files afterwards.
• With AD storage, only the altSecurityIdentities permission is needed (see storage); no local administrator rights are required on the target PCs.
• A card linked with the default PIN (0000 unless DefaultSerialPIN says otherwise) logs on with the tap alone. Use /pin when you want card + PIN.

Frequently asked questions