Capabilitysids

AccessControlDsc.psd1

@@ -4,7 +4,8 @@
 
 @{
     # Version number of this module.
-    ModuleVersion = '1.4.1'
+
+    ModuleVersion = '1.4.3'
 
     # ID used to uniquely identify this module
     GUID = 'a544c26f-3f96-4c1e-8351-1604867aafc5'

DscResources/AccessControlResourceHelper/AccessControlResourceHelper.psm1

@@ -52,6 +52,15 @@ function Resolve-Identity
             if ($Identity -match '^S-\d-(\d+-){1,14}\d+$')
             {
                 [System.Security.Principal.SecurityIdentifier]$Identity = $Identity
+
+                # Support for capability sids
+                if ($Identity.Value.StartsWith('S-1-15-3-'))
+                {
+                    return [PSCustomObject]@{
+                        Name = $Identity.Value
+                        SID = $Identity.Value
+                    }
+                }
             }
             else
             {
@@ -463,3 +472,79 @@ function Remove-NtPrincipalDomain
     $returnIdentity = New-Object -Type System.Security.Principal.NTAccount -ArgumentList $modifiedIdentity
     return $returnIdentity
 }
+
+function Assert-Module
+{
+    [CmdletBinding()]
+    param
+    (
+        [Parameter()]
+        [ValidateNotNullOrEmpty()]
+        [System.String]
+        $ModuleName
+    )
+
+    if (-not (Get-Module -Name $ModuleName -ListAvailable))
+    {
+        $errorId = '{0}_ModuleNotFound' -f $ModuleName;
+        $errorMessage = $localizedString.RoleNotFoundError -f $ModuleName;
+        ThrowInvalidOperationError -ErrorId $errorId -ErrorMessage $errorMessage;
+    }
+} 
+
+function Get-DelegationRightsGuid
+{
+    Param 
+    (
+        [Parameter()]
+        [string]
+        $ObjectName
+    )
+
+    if($ObjectName)
+    {
+        # Create a hashtable to store the GUID value of each schemaGuids and rightsGuids
+        $guidmap = @{}
+        $rootdse = Get-ADRootDSE
+        Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties Name,schemaIDGUID | 
+            Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.schemaIDGUID }
+
+        Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties Name,rightsGuid | 
+            Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.rightsGuid }
+
+        return [system.guid]$guidmap[$ObjectName]
+    }
+    else
+    {
+        return [system.guid]"00000000-0000-0000-0000-000000000000"
+    }
+}
+
+function Get-SchemaObjectName
+{
+    Param
+    (
+        [Parameter()]
+        [guid]
+        $SchemaIdGuid
+    )
+
+    if($SchemaIdGuid)
+    {
+        $guidmap = @{}
+        $rootdse = Get-ADRootDSE
+        Get-ADObject -SearchBase ($rootdse.SchemaNamingContext) -LDAPFilter "(schemaidguid=*)" -Properties Name,schemaIDGUID | 
+            Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.schemaIDGUID }
+
+        Get-ADObject -SearchBase ($rootdse.ConfigurationNamingContext) -LDAPFilter "(&(objectclass=controlAccessRight)(rightsguid=*))" -Properties Name,rightsGuid | 
+            Foreach-Object -Process { $guidmap[$_.Name] = [System.GUID]$_.rightsGuid }
+
+        # This is to address the edge case where one guid resolves to multiple names ex. f3a64788-5306-11d1-a9c5-0000f80367c1 resolves to Service-Principal-Name,Validated-SPN
+        $names = ( $guidmap.GetEnumerator() | Where-Object -FilterScript { $_.Value -eq $SchemaIdGuid } ).Name
+        return $names -join ','
+    }
+    else
+    {
+        return "none"
+    }
+}

DscResources/ActiveDirectoryAccessEntry/ActiveDirectoryAccessEntry.psm1

@@ -400,7 +400,7 @@ Function Compare-ActiveDirectoryAccessRule
             $_.InheritanceType -eq $referenceObject.InheritanceType -and
             $_.InheritedObjectType -eq $referenceObject.InheritedObjectType -and
             $_.ObjectType -eq $referenceObject.ObjectType -and
-            $_.IdentityReference -eq $referenceObject.IdentityReference
+            $_.IdentityReference.Value -eq $referenceObject.IdentityReference.Value
         })
         if($match.Count -ge 1)
         {
@@ -426,7 +426,7 @@ Function Compare-ActiveDirectoryAccessRule
             $_.InheritanceType -eq $referenceObject.InheritanceType -and
             $_.InheritedObjectType -eq $referenceObject.InheritedObjectType -and
             $_.ObjectType -eq $referenceObject.ObjectType -and
-            $_.IdentityReference -eq $referenceObject.IdentityReference
+            $_.IdentityReference.Value -eq $referenceObject.IdentityReference.Value
         })
         if($match.Count -gt 0)
         {
@@ -444,7 +444,7 @@ Function Compare-ActiveDirectoryAccessRule
             $_.InheritanceType -eq $referenceObject.InheritanceType -and
             $_.InheritedObjectType -eq $referenceObject.InheritedObjectType -and
             $_.ObjectType -eq $referenceObject.ObjectType -and
-            $_.IdentityReference -eq $referenceObject.IdentityReference
+            $_.IdentityReference.Value -eq $referenceObject.IdentityReference.Value
         })
         if($match.Count -eq 0)
         {

DscResources/ActiveDirectoryAuditRuleEntry/ActiveDirectoryAuditRuleEntry.psm1

@@ -498,7 +498,7 @@ function Test-ActiveDirectoryAuditRuleMatch
             $_.ObjectType -eq $ReferenceRule.ObjectType -and
             $_.InheritanceType -eq $ReferenceRule.InheritanceType -and
             $_.InheritedObjectType -eq $ReferenceRule.InheritedObjectType -and
-            $_.IdentityReference -eq $ReferenceRule.IdentityReference
+            $_.IdentityReference.Value -eq $ReferenceRule.IdentityReference.Value
         })
     }
     else
@@ -512,7 +512,7 @@ function Test-ActiveDirectoryAuditRuleMatch
             $_.ObjectType -eq $ReferenceRule.ObjectType -and
             $_.InheritanceType -eq $ReferenceRule.InheritanceType -and
             $_.InheritedObjectType -eq $ReferenceRule.InheritedObjectType -and
-            $_.IdentityReference -eq $ReferenceRule.IdentityReference
+            $_.IdentityReference.Value -eq $ReferenceRule.IdentityReference.Value
         })
     }
 }