Skip to content

Commit 5780a1f

Browse files
bcwilhitechasewilson
bcwilhite
authored and
chasewilson
committed
Fix for Feature Request #49 - ObjectType Parameter in ActiveDirectoryAuditRuleEntry (#50)
* refactor work * daily commit for refactor work * add support for objecttype and central localization text * updated code to be in line with style guide lines. * updated NTFSAccessEntry with import localization based on PSUICulture * updated/refactor tests to handle objecttype parameter
1 parent 28b4a1d commit 5780a1f

8 files changed

+906
-834
lines changed

‎AccessControlDsc.psd1

+6-66
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,6 @@
1-
#
2-
# Module manifest for module 'AccessControlDsc'
3-
#
4-
# Generated by: Adam Hynes
5-
#
6-
# Generated on: 8/21/2017
7-
#
1+
2+
# Copyright (c) Microsoft Corporation. All rights reserved.
3+
# Licensed under the MIT License.
84

95
@{
106
# Version number of this module.
@@ -28,39 +24,6 @@
2824
# Minimum version of the Windows PowerShell engine required by this module
2925
PowerShellVersion = '4.0'
3026

31-
# Name of the Windows PowerShell host required by this module
32-
# PowerShellHostName = ''
33-
34-
# Minimum version of the Windows PowerShell host required by this module
35-
# PowerShellHostVersion = ''
36-
37-
# Minimum version of the .NET Framework required by this module
38-
# DotNetFrameworkVersion = ''
39-
40-
# Minimum version of the common language runtime (CLR) required by this module
41-
# CLRVersion = ''
42-
43-
# Processor architecture (None, X86, Amd64) required by this module
44-
# ProcessorArchitecture = ''
45-
46-
# Modules that must be imported into the global environment prior to importing this module
47-
# RequiredModules = @()
48-
49-
# Assemblies that must be loaded prior to importing this module
50-
# RequiredAssemblies = @()
51-
52-
# Script files (.ps1) that are run in the caller's environment prior to importing this module.
53-
# ScriptsToProcess = ''
54-
55-
# Type files (.ps1xml) to be loaded when importing this module
56-
# TypesToProcess = 'PowerShellAccessControl.types.ps1xml'
57-
58-
# Format files (.ps1xml) to be loaded when importing this module
59-
# FormatsToProcess = ''
60-
61-
# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
62-
# NestedModules = @()
63-
6427
# Functions to export from this module
6528
FunctionsToExport = @()
6629

@@ -73,23 +36,8 @@
7336
# Aliases to export from this module
7437
AliasesToExport = @()
7538

76-
# List of all modules packaged with this module.
77-
# ModuleList = @()
78-
79-
# List of all files packaged with this module
80-
# FileList = @()
81-
82-
# Private data to pass to the module specified in RootModule/ModuleToProcess
83-
# PrivateData = ''
84-
85-
# HelpInfo URI of this module
86-
# HelpInfoURI = ''
87-
88-
# Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.
89-
# DefaultCommandPrefix = ''
90-
9139
# Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell.
92-
PrivateData = @{
40+
PrivateData = @{
9341

9442
PSData = @{
9543

@@ -102,14 +50,6 @@ PrivateData = @{
10250

10351
# A URL to the main website for this project.
10452
ProjectUri = 'https://github.com/mcollera/AccessControlDsc'
105-
106-
# A URL to an icon representing this module.
107-
# IconUri = ''
108-
109-
# ReleaseNotes of this module
110-
#ReleaseNotes = ''
111-
} # End of PSData hashtable
112-
113-
} # End of PrivateData hashtable
114-
53+
}
54+
}
11555
}

‎DscResources/AccessControlResourceHelper/AccessControlResourceHelper.psm1

+111-26
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,31 @@
1+
try
2+
{
3+
$importLocalizedDataParams = @{
4+
BaseDirectory = $PSScriptRoot
5+
UICulture = $PSUICulture
6+
FileName = 'AccessControlResourceHelper.strings.psd1'
7+
ErrorAction = 'Stop'
8+
}
9+
$script:localizedData = Import-LocalizedData @importLocalizedDataParams
10+
}
11+
catch
12+
{
13+
$importLocalizedDataParams.UICulture = 'en-US'
14+
try
15+
{
16+
$script:localizedData = Import-LocalizedData @importLocalizedDataParams
17+
}
18+
catch
19+
{
20+
throw 'Unable to load localized data'
21+
}
22+
}
23+
124
function Resolve-Identity
225
{
326
<#
427
.SYNOPSIS
5-
Resolves the principal name SID
28+
Resolves the principal name SID
629
730
.PARAMETER Identity
831
Specifies the identity of the principal.
@@ -24,7 +47,7 @@ function Resolve-Identity
2447

2548
$tryNTService = $false
2649

27-
try
50+
try
2851
{
2952
if ($Identity -match '^S-\d-(\d+-){1,14}\d+$')
3053
{
@@ -58,20 +81,20 @@ function Resolve-Identity
5881
[System.Security.Principal.NTAccount]$Id = "NT Service\" + $Identity
5982
$SID = $Id.Translate([System.Security.Principal.SecurityIdentifier])
6083
$NTAccount = $SID.Translate([System.Security.Principal.NTAccount])
61-
84+
6285
$Principal = [PSCustomObject]@{
6386
Name = $NTAccount.Value
6487
SID = $SID.Value
6588
}
66-
89+
6790
return $Principal
6891
}
6992
catch
7093
{
7194
$ErrorMessage = "Could not resolve identity '{0}': '{1}'." -f $Identity, $_.Exception.Message
7295
Write-Error -Exception $_.Exception -Message $ErrorMessage
7396
}
74-
}
97+
}
7598
}
7699
}
77100

@@ -80,7 +103,7 @@ function Resolve-Identity
80103
Takes identity name and translates to SID
81104
82105
.PARAMETER IdentityReference
83-
System.Security.Principal.NTAccount object
106+
System.Security.Principal.NTAccount object
84107
85108
.EXAMPLE
86109
$IdentityReference = (Get-Acl -Path C:\temp).access[0].IdentityReference
@@ -96,27 +119,27 @@ function ConvertTo-SID
96119
$IdentityReference
97120
)
98121

99-
try
122+
try
100123
{
101124
If($IdentityReference.Contains("\"))
102125
{
103126
$IdentityReference = $IdentityReference.split('\')[1]
104127
}
105-
128+
106129
[System.Security.Principal.NTAccount]$PrinicipalName = $IdentityReference
107130
$SID = $PrinicipalName.Translate([System.Security.Principal.SecurityIdentifier])
108-
131+
109132
Return $SID
110133
}
111-
catch
134+
catch
112135
{
113136
# Probably NT Service which needs domain portion to translate without error
114137
[System.Security.Principal.NTAccount]$Id = "NT Service\" + $IdentityReference
115138
$SID = $Id.Translate([System.Security.Principal.SecurityIdentifier])
116139

117140
return $SID
118141
}
119-
142+
120143
}
121144

122145
function Assert-Module
@@ -136,33 +159,33 @@ function Assert-Module
136159
$errorMessage = $localizedString.RoleNotFoundError -f $ModuleName;
137160
ThrowInvalidOperationError -ErrorId $errorId -ErrorMessage $errorMessage;
138161
}
139-
}
162+
}
140163

141164
function Get-DelegationRightsGuid
142165
{
143-
Param
166+
Param
144167
(
145168
[Parameter()]
146169
[string]
147170
$ObjectName
148171
)
149172

150-
if($ObjectName)
173+
if ($ObjectName)
151174
{
152175
# Create a hashtable to store the GUID value of each schemaGuids and rightsGuids
153176
$guidmap = @{}
154177
$rootdse = Get-ADRootDSE
155-
Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties Name,schemaIDGUID |
156-
Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.schemaIDGUID }
178+
Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties Name,schemaIDGUID |
179+
Foreach-Object -Process {$guidmap[$_.Name] = [System.GUID]$_.schemaIDGUID}
157180

158-
Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties Name,rightsGuid |
159-
Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.rightsGuid }
181+
Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties Name,rightsGuid |
182+
Foreach-Object -Process {$guidmap[$_.Name] = [System.GUID]$_.rightsGuid}
160183

161184
return [system.guid]$guidmap[$ObjectName]
162185
}
163186
else
164187
{
165-
return [system.guid]"00000000-0000-0000-0000-000000000000"
188+
return [system.guid]'00000000-0000-0000-0000-000000000000'
166189
}
167190
}
168191

@@ -175,22 +198,84 @@ function Get-SchemaObjectName
175198
$SchemaIdGuid
176199
)
177200

178-
if($SchemaIdGuid)
201+
if ($SchemaIdGuid -and ($SchemaIdGuid.Guid -ne '00000000-0000-0000-0000-000000000000'))
179202
{
180203
$guidmap = @{}
181204
$rootdse = Get-ADRootDSE
182-
Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties Name,schemaIDGUID |
183-
Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.schemaIDGUID }
205+
Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties Name,schemaIDGUID |
206+
Foreach-Object -Process {$guidmap[$_.Name] = [System.GUID]$_.schemaIDGUID}
184207

185-
Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties Name,rightsGuid |
186-
Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.rightsGuid }
208+
Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties Name,rightsGuid |
209+
Foreach-Object -Process {$guidmap[$_.Name] = [System.GUID]$_.rightsGuid}
187210

188211
# This is to address the edge case where one guid resolves to multiple names ex. f3a64788-5306-11d1-a9c5-0000f80367c1 resolves to Service-Principal-Name,Validated-SPN
189-
$names = ( $guidmap.GetEnumerator() | Where-Object -FilterScript { $_.Value -eq $SchemaIdGuid } ).Name
212+
$names = ($guidmap.GetEnumerator() | Where-Object -FilterScript {$_.Value -eq $SchemaIdGuid}).Name
190213
return $names -join ','
191214
}
192215
else
193216
{
194-
return "none"
217+
return 'None'
218+
}
219+
}
220+
221+
function Write-CustomVerboseMessage
222+
{
223+
param
224+
(
225+
[Parameter(Mandatory = $true)]
226+
[System.String]
227+
$Action,
228+
229+
[Parameter(Mandatory = $true)]
230+
[System.String]
231+
$Path,
232+
233+
[Parameter(Mandatory = $true)]
234+
[ValidateScript({
235+
$_ -is [System.DirectoryServices.ActiveDirectoryAccessRule] -or
236+
$_ -is [System.DirectoryServices.ActiveDirectoryAuditRule] -or
237+
$_ -is [System.Security.AccessControl.FileSystemAccessRule]
238+
})]
239+
$Rule
240+
)
241+
242+
$properties = [ordered]@{
243+
IdentityReference = $Rule.IdentityReference
244+
}
245+
246+
switch ($Rule.GetType().Name)
247+
{
248+
'ActiveDirectoryAccessRule'
249+
{
250+
# future expansion
251+
break
252+
}
253+
254+
'ActiveDirectoryAuditRule'
255+
{
256+
$properties.Add('ActiveDirectoryRights', $Rule.ActiveDirectoryRights)
257+
$properties.Add('AuditFlags', $Rule.AuditFlags)
258+
$properties.Add('ObjectType', $(Get-SchemaObjectName -SchemaIdGuid $Rule.ObjectType))
259+
$properties.Add('InheritanceType', $Rule.InheritanceType)
260+
$properties.Add('InheritedObjectType', $(Get-SchemaObjectName -SchemaIdGuid $Rule.InheritedObjectType))
261+
break
262+
}
263+
264+
'FileSystemAccessRule'
265+
{
266+
$properties.Add('AccessControlType', $Rule.AccessControlType)
267+
$properties.Add('FileSystemRights', $Rule.FileSystemRights)
268+
$properties.Add('InheritanceFlags', $Rule.InheritanceFlags)
269+
$properties.Add('PropagationFlags', $Rule.PropagationFlags)
270+
break
271+
}
272+
}
273+
274+
Write-Verbose -Message $localizedData[$Action] -Verbose
275+
Write-Verbose -Message ($localizedData.Path -f $Path) -Verbose
276+
277+
foreach ($property in $properties.Keys -as [array])
278+
{
279+
Write-Verbose -Message ($localizedData[$property] -f $properties[$property]) -Verbose
195280
}
196281
}

‎DscResources/AccessControlResourceHelper/en-US/AccessControlResourceHelper.strings.psd1

+30-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,31 @@
1-
ConvertFrom-StringData -StringData @'
2-
1+
ConvertFrom-StringData -StringData @'
2+
ErrorPathNotFound = The requested path '{0}' cannot be found.
3+
AclNotFound = Error obtaining '{0}' ACL.
4+
AclFound = Obtained '{0}' ACL.
5+
RemoveAccessError = Unable to remove access for '{0}'.
6+
RemoveAuditError = Unable to remove audit for '{0}'.
7+
InheritanceDetectedForce = Force set to '{0}', Inheritance detected on path '{1}', returning 'false'
8+
ResetDisableInheritance = Disabling inheritance and wiping all existing inherited rules.
9+
ActionAddAccess = Adding access rule:
10+
ActionAddAudit = Adding audit rule:
11+
ActionRemoveAccess = Removing access rule:
12+
ActionRemoveAudit = Removing audit rule:
13+
ActionResetAdd = Resetting explicit access control list and adding access rule:
14+
ActionNonMatchPermission = Non-matching permission entry found:
15+
ActionNonMatchAudit = Non-matching audit rule found:
16+
ActionMissPresentPerm = Found missing [Ensure = Present] permission rule:
17+
ActionMissPresentAudit = Found missing [Ensure = Present] audit rule:
18+
ActionAbsentPermission = Found [Ensure = Absent] permission rule:
19+
ActionAbsentAudit = Found [Ensure = Absent] audit rule:
20+
Path = > Path : '{0}'
21+
IdentityReference = > IdentityReference : '{0}'
22+
AccessControlType = > AccessControlType : '{0}'
23+
FileSystemRights = > FileSystemRights : '{0}'
24+
ActiveDirectoryRights = > ActiveDirectoryRights : '{0}'
25+
InheritanceFlags = > InheritanceFlags : '{0}'
26+
PropagationFlags = > PropagationFlags : '{0}'
27+
AuditFlags = > AuditFlags : '{0}'
28+
ObjectType = > ObjectType : '{0}'
29+
InheritanceType = > InheritanceType : '{0}'
30+
InheritedObjectType = > InheritedObjectType : '{0}'
331
'@

0 commit comments

Comments
 (0)