Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Rights guid #32

Merged
merged 6 commits into from
Feb 9, 2018
Merged

Rights guid #32

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e7c2c5f
Updated ActiveDirectoryAccessEntry example with a valid ADRights value
jcwalker Feb 8, 2018
88ceb3a
typo corrections
jcwalker Feb 8, 2018
00b8452
Update Get-SchemaObjectName to resolve SchemaGuids and RightsGuids
jcwalker Feb 9, 2018
0113c19
Added $guidmap to Get-SchemaObjectName
jcwalker Feb 9, 2018
0271211
Added $rootDse to Get-SchemaObjectName
jcwalker Feb 9, 2018
613fdea
Merge branch 'Dev' into rightsGuid
regedit32 Feb 9, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 28 additions & 10 deletions DscResources/AccessControlResourceHelper/AccessControlResourceHelper.psm1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,8 @@ function Assert-Module
[CmdletBinding()]
param
(
[Parameter()] [ValidateNotNullOrEmpty()]
[Parameter()]
[ValidateNotNullOrEmpty()]
[System.String]
$ModuleName
)
Expand All @@ -137,7 +138,7 @@ function Assert-Module
}
}

Function Get-SchemaIdGuid
function Get-DelegationRightsGuid
{
Param
(
Expand All @@ -148,31 +149,48 @@ Function Get-SchemaIdGuid

if($ObjectName)
{
$value = Get-ADObject -filter {name -eq $ObjectName} -SearchBase (Get-ADRootDSE).schemaNamingContext -prop schemaIDGUID
return [system.guid]$value.schemaIDGUID
# Create a hashtable to store the GUID value of each schemaGuids and rightsGuids
$guidmap = @{}
$rootdse = Get-ADRootDSE
Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties Name,schemaIDGUID |
Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.schemaIDGUID }

Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties Name,rightsGuid |
Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.rightsGuid }

return [system.guid]$guidmap[$ObjectName]
}
else
{
return [system.guid]"00000000-0000-0000-0000-000000000000"
}
}

Function Get-SchemaObjectName
function Get-SchemaObjectName
{
Param
Param
(
[Parameter()]
[guid]
$SchemaIdGuid
)

If($SchemaIdGuid)
if($SchemaIdGuid)
{
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This won't find the rights guid name. It should be a reverse lookup version of the function update you made to Get-DelegationRightsGuid

$value = Get-ADObject -filter {schemaIDGUID -eq $SchemaIdGuid} -SearchBase (Get-ADRootDSE).schemaNamingContext -prop schemaIDGUID
return $value.name
$guidmap = @{}
$rootdse = Get-ADRootDSE
Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties Name,schemaIDGUID |
Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.schemaIDGUID }

Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties Name,rightsGuid |
Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.rightsGuid }

# This is to address the edge case where one guid resolves to multiple names ex. f3a64788-5306-11d1-a9c5-0000f80367c1 resolves to Service-Principal-Name,Validated-SPN
$names = ( $guidmap.GetEnumerator() | Where-Object -FilterScript { $_.Value -eq $SchemaIdGuid } ).Name
return $names -join ','
}
else
{
return "none"
}
}
}
4 changes: 2 additions & 2 deletions DscResources/ActiveDirectoryAccessEntry/ActiveDirectoryAccessEntry.psm1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -361,8 +361,8 @@ Function ConvertTo-ActiveDirectoryAccessRule

foreach($ace in $AccessControlList.AccessControlEntry)
{
$inheritedObjectType = Get-SchemaIdGuid -ObjectName $ace.InheritedObjectType
$objectType = Get-SchemaIdGuid -ObjectName $ace.ObjectType
$inheritedObjectType = Get-DelegationRightsGuid -ObjectName $ace.InheritedObjectType
$objectType = Get-DelegationRightsGuid -ObjectName $ace.ObjectType
$rule = [PSCustomObject]@{
Rules = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($IdentityRef, $ace.ActiveDirectoryRights, $ace.AccessControlType, $objectType, $ace.InheritanceType, $inheritedObjectType)
Ensure = $ace.Ensure
Expand Down
2 changes: 1 addition & 1 deletion DscResources/ActiveDirectoryAuditRuleEntry/ActiveDirectoryAuditRuleEntry.psm1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -406,7 +406,7 @@ Function ConvertTo-ActiveDirectoryAuditRule

foreach($ace in $AccessControlList.AccessControlEntry)
{
$InheritedObjectType = Get-SchemaIdGuid -ObjectName $ace.InheritedObjectType
$InheritedObjectType = Get-DelegationRightsGuid -ObjectName $ace.InheritedObjectType
$rule = [PSCustomObject]@{
Rules = New-Object System.DirectoryServices.ActiveDirectoryAuditRule($IdentityRef, $ace.ActiveDirectoryRights, $ace.AuditFlags, $ace.InheritanceType, $InheritedObjectType)
Ensure = $ace.Ensure
Expand Down
8 changes: 4 additions & 4 deletions Examples/ActiveDirectoryAccessEntry_example.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,11 @@ configuration Sample_ADAccessControl
ActiveDirectoryAccessRule
{
AccessControlType = 'Allow'
ActiveDirectoryRights = 'FullControl'
ActiveDirectoryRights = 'GenericAll'
InheritanceType = 'Descendents'
Ensure = 'Present'
}
)
)
}
)
}
Expand All @@ -40,7 +40,7 @@ configuration Sample_ADAccessControl
InheritedObjectType = 'organizational-unit'
Ensure = 'Present'
}
)
)
}
ActiveDirectoryAccessControlList
{
Expand All @@ -55,7 +55,7 @@ configuration Sample_ADAccessControl
ObjectType = 'computer'
Ensure = 'Present'
}
)
)
}
)
}
Expand Down
4 changes: 2 additions & 2 deletions Tests/Unit/ActiveDirectoryAccessEntry.Tests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ InModuleScope ActiveDirectoryAccessEntry {
Mock -CommandName Test-Path -MockWith { return $true } -ModuleName $DSCResourceName
Mock -CommandName Assert-Module -MockWith {} -ModuleName $DSCResourceName
Mock -CommandName Import-Module -MockWith {} -ParameterFilter {$name -eq 'ActiveDirectory'}-ModuleName $DSCResourceName
Mock -CommandName Get-SchemaIdGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
Mock -CommandName Get-DelegationRightsGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
Mock -CommandName Get-SchemaObjectName -MockWith { return "Pwd-Last-Set" } -ModuleName $DSCResourceName

Mock -CommandName Get-Acl -MockWith {
Expand Down Expand Up @@ -218,7 +218,7 @@ InModuleScope ActiveDirectoryAccessEntry {
Mock -CommandName Test-Path -MockWith { return $true } -ModuleName $DSCResourceName
Mock -CommandName Assert-Module -MockWith {} -ModuleName $DSCResourceName
Mock -CommandName Import-Module -MockWith {} -ParameterFilter {$name -eq 'ActiveDirectory'} -ModuleName $DSCResourceName
Mock -CommandName Get-SchemaIdGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
Mock -CommandName Get-DelegationRightsGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
Mock -CommandName Get-SchemaObjectName -MockWith { return "Pwd-Last-Set" } -ModuleName $DSCResourceName

$identity = Resolve-Identity -Identity "Everyone"
Expand Down
4 changes: 2 additions & 2 deletions Tests/Unit/ActiveDirectoryAuditRuleEntry.Tests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ Import-Module "$($PSScriptRoot)\..\TestHelper.psm1" -Force
Mock -CommandName Test-Path -MockWith { return $true } -ModuleName $DSCResourceName
Mock -CommandName Assert-Module -MockWith {} -ModuleName $DSCResourceName
Mock -CommandName Import-Module -MockWith {} -ParameterFilter {$Name -eq 'ActiveDirectory'}-ModuleName $DSCResourceName
Mock -CommandName Get-SchemaIdGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
Mock -CommandName Get-DelegationRightsGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
Mock -CommandName Get-SchemaObjectName -MockWith { return "Pwd-Last-Set" } -ModuleName $DSCResourceName

Mock -CommandName Get-Acl -MockWith {
Expand Down Expand Up @@ -261,7 +261,7 @@ Import-Module "$($PSScriptRoot)\..\TestHelper.psm1" -Force
Mock -CommandName Test-Path -MockWith { return $true } -ModuleName $DSCResourceName
Mock -CommandName Assert-Module -MockWith {} -ModuleName $DSCResourceName
Mock -CommandName Import-Module -MockWith {} -ParameterFilter {$Name -eq 'ActiveDirectory'} -ModuleName $DSCResourceName
Mock -CommandName Get-SchemaIdGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
Mock -CommandName Get-DelegationRightsGuid -MockWith { return [guid]"52ea1a9a-be7e-4213-9e69-5f28cb89b56a" } -ModuleName $DSCResourceName
Mock -CommandName Get-SchemaObjectName -MockWith { return "Pwd-Last-Set" } -ModuleName $DSCResourceName

$Identity = Resolve-Identity -Identity "Everyone"
Expand Down