Skip to content

Commit c5f10d2

Browse files
jcwalkerregedit32
jcwalker
authored and
regedit32
committed
Rights guid (#32)
* Updated ActiveDirectoryAccessEntry example with a valid ADRights value Refactored Get-SchemaGuidId helper function to Get-DelegationRightsGuid so it returns schemaGuids and rightsGuids * typo corrections * Update Get-SchemaObjectName to resolve SchemaGuids and RightsGuids * Added $guidmap to Get-SchemaObjectName * Added $rootDse to Get-SchemaObjectName
1 parent bfd7cf5 commit c5f10d2

File tree

6 files changed

+39
-21
lines changed

6 files changed

+39
-21
lines changed

‎DscResources/AccessControlResourceHelper/AccessControlResourceHelper.psm1

+28-10
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,8 @@ function Assert-Module
124124
[CmdletBinding()]
125125
param
126126
(
127-
[Parameter()] [ValidateNotNullOrEmpty()]
127+
[Parameter()]
128+
[ValidateNotNullOrEmpty()]
128129
[System.String]
129130
$ModuleName
130131
)
@@ -137,7 +138,7 @@ function Assert-Module
137138
}
138139
}
139140

140-
Function Get-SchemaIdGuid
141+
function Get-DelegationRightsGuid
141142
{
142143
Param
143144
(
@@ -148,31 +149,48 @@ Function Get-SchemaIdGuid
148149

149150
if($ObjectName)
150151
{
151-
$value = Get-ADObject -filter {name -eq $ObjectName} -SearchBase (Get-ADRootDSE).schemaNamingContext -prop schemaIDGUID
152-
return [system.guid]$value.schemaIDGUID
152+
# Create a hashtable to store the GUID value of each schemaGuids and rightsGuids
153+
$guidmap = @{}
154+
$rootdse = Get-ADRootDSE
155+
Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties Name,schemaIDGUID |
156+
Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.schemaIDGUID }
157+
158+
Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties Name,rightsGuid |
159+
Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.rightsGuid }
160+
161+
return [system.guid]$guidmap[$ObjectName]
153162
}
154163
else
155164
{
156165
return [system.guid]"00000000-0000-0000-0000-000000000000"
157166
}
158167
}
159168

160-
Function Get-SchemaObjectName
169+
function Get-SchemaObjectName
161170
{
162-
Param
171+
Param
163172
(
164173
[Parameter()]
165174
[guid]
166175
$SchemaIdGuid
167176
)
168177

169-
If($SchemaIdGuid)
178+
if($SchemaIdGuid)
170179
{
171-
$value = Get-ADObject -filter {schemaIDGUID -eq $SchemaIdGuid} -SearchBase (Get-ADRootDSE).schemaNamingContext -prop schemaIDGUID
172-
return $value.name
180+
$guidmap = @{}
181+
$rootdse = Get-ADRootDSE
182+
Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties Name,schemaIDGUID |
183+
Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.schemaIDGUID }
184+
185+
Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties Name,rightsGuid |
186+
Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.rightsGuid }
187+
188+
# This is to address the edge case where one guid resolves to multiple names ex. f3a64788-5306-11d1-a9c5-0000f80367c1 resolves to Service-Principal-Name,Validated-SPN
189+
$names = ( $guidmap.GetEnumerator() | Where-Object -FilterScript { $_.Value -eq $SchemaIdGuid } ).Name
190+
return $names -join ','
173191
}
174192
else
175193
{
176194
return "none"
177-
}
195+
}
178196
}

‎DscResources/ActiveDirectoryAccessEntry/ActiveDirectoryAccessEntry.psm1

+2-2
Original file line numberDiff line numberDiff line change
@@ -361,8 +361,8 @@ Function ConvertTo-ActiveDirectoryAccessRule
361361

362362
foreach($ace in $AccessControlList.AccessControlEntry)
363363
{
364-
$inheritedObjectType = Get-SchemaIdGuid -ObjectName $ace.InheritedObjectType
365-
$objectType = Get-SchemaIdGuid -ObjectName $ace.ObjectType
364+
$inheritedObjectType = Get-DelegationRightsGuid -ObjectName $ace.InheritedObjectType
365+
$objectType = Get-DelegationRightsGuid -ObjectName $ace.ObjectType
366366
$rule = [PSCustomObject]@{
367367
Rules = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($IdentityRef, $ace.ActiveDirectoryRights, $ace.AccessControlType, $objectType, $ace.InheritanceType, $inheritedObjectType)
368368
Ensure = $ace.Ensure

‎DscResources/ActiveDirectoryAuditRuleEntry/ActiveDirectoryAuditRuleEntry.psm1

+1-1
Original file line numberDiff line numberDiff line change
@@ -406,7 +406,7 @@ Function ConvertTo-ActiveDirectoryAuditRule
406406

407407
foreach($ace in $AccessControlList.AccessControlEntry)
408408
{
409-
$InheritedObjectType = Get-SchemaIdGuid -ObjectName $ace.InheritedObjectType
409+
$InheritedObjectType = Get-DelegationRightsGuid -ObjectName $ace.InheritedObjectType
410410
$rule = [PSCustomObject]@{
411411
Rules = New-Object System.DirectoryServices.ActiveDirectoryAuditRule($IdentityRef, $ace.ActiveDirectoryRights, $ace.AuditFlags, $ace.InheritanceType, $InheritedObjectType)
412412
Ensure = $ace.Ensure

‎Examples/ActiveDirectoryAccessEntry_example.ps1

+4-4
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@ configuration Sample_ADAccessControl
1515
ActiveDirectoryAccessRule
1616
{
1717
AccessControlType = 'Allow'
18-
ActiveDirectoryRights = 'FullControl'
18+
ActiveDirectoryRights = 'GenericAll'
1919
InheritanceType = 'Descendents'
2020
Ensure = 'Present'
2121
}
22-
)
22+
)
2323
}
2424
)
2525
}
@@ -40,7 +40,7 @@ configuration Sample_ADAccessControl
4040
InheritedObjectType = 'organizational-unit'
4141
Ensure = 'Present'
4242
}
43-
)
43+
)
4444
}
4545
ActiveDirectoryAccessControlList
4646
{
@@ -55,7 +55,7 @@ configuration Sample_ADAccessControl
5555
ObjectType = 'computer'
5656
Ensure = 'Present'
5757
}
58-
)
58+
)
5959
}
6060
)
6161
}

‎Tests/Unit/ActiveDirectoryAccessEntry.Tests.ps1

+2-2
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ InModuleScope ActiveDirectoryAccessEntry {
111111
Mock -CommandName Test-Path -MockWith { return $true } -ModuleName $DSCResourceName
112112
Mock -CommandName Assert-Module -MockWith {} -ModuleName $DSCResourceName
113113
Mock -CommandName Import-Module -MockWith {} -ParameterFilter {$name -eq 'ActiveDirectory'}-ModuleName $DSCResourceName
114-
Mock -CommandName Get-SchemaIdGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
114+
Mock -CommandName Get-DelegationRightsGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
115115
Mock -CommandName Get-SchemaObjectName -MockWith { return "Pwd-Last-Set" } -ModuleName $DSCResourceName
116116

117117
Mock -CommandName Get-Acl -MockWith {
@@ -218,7 +218,7 @@ InModuleScope ActiveDirectoryAccessEntry {
218218
Mock -CommandName Test-Path -MockWith { return $true } -ModuleName $DSCResourceName
219219
Mock -CommandName Assert-Module -MockWith {} -ModuleName $DSCResourceName
220220
Mock -CommandName Import-Module -MockWith {} -ParameterFilter {$name -eq 'ActiveDirectory'} -ModuleName $DSCResourceName
221-
Mock -CommandName Get-SchemaIdGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
221+
Mock -CommandName Get-DelegationRightsGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
222222
Mock -CommandName Get-SchemaObjectName -MockWith { return "Pwd-Last-Set" } -ModuleName $DSCResourceName
223223

224224
$identity = Resolve-Identity -Identity "Everyone"

‎Tests/Unit/ActiveDirectoryAuditRuleEntry.Tests.ps1

+2-2
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ Import-Module "$($PSScriptRoot)\..\TestHelper.psm1" -Force
111111
Mock -CommandName Test-Path -MockWith { return $true } -ModuleName $DSCResourceName
112112
Mock -CommandName Assert-Module -MockWith {} -ModuleName $DSCResourceName
113113
Mock -CommandName Import-Module -MockWith {} -ParameterFilter {$Name -eq 'ActiveDirectory'}-ModuleName $DSCResourceName
114-
Mock -CommandName Get-SchemaIdGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
114+
Mock -CommandName Get-DelegationRightsGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
115115
Mock -CommandName Get-SchemaObjectName -MockWith { return "Pwd-Last-Set" } -ModuleName $DSCResourceName
116116

117117
Mock -CommandName Get-Acl -MockWith {
@@ -261,7 +261,7 @@ Import-Module "$($PSScriptRoot)\..\TestHelper.psm1" -Force
261261
Mock -CommandName Test-Path -MockWith { return $true } -ModuleName $DSCResourceName
262262
Mock -CommandName Assert-Module -MockWith {} -ModuleName $DSCResourceName
263263
Mock -CommandName Import-Module -MockWith {} -ParameterFilter {$Name -eq 'ActiveDirectory'} -ModuleName $DSCResourceName
264-
Mock -CommandName Get-SchemaIdGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
264+
Mock -CommandName Get-DelegationRightsGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
265265
Mock -CommandName Get-SchemaObjectName -MockWith { return "Pwd-Last-Set" } -ModuleName $DSCResourceName
266266

267267
$Identity = Resolve-Identity -Identity "Everyone"

0 commit comments

Comments
 (0)