diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 7ac4138..8465f7f 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -11,7 +11,7 @@ jobs: steps: - uses: actions/checkout@v1 - name: Install Prerequisites - run: .\build\vsts-prerequisites.ps1 + run: .\build\psf-prerequisites.ps1 shell: powershell - name: Validate run: .\build\vsts-validate.ps1 diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 5955876..3ddf2e9 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -8,7 +8,7 @@ jobs: steps: - uses: actions/checkout@v1 - name: Install Prerequisites - run: .\build\vsts-prerequisites.ps1 + run: .\build\psf-prerequisites.ps1 shell: powershell - name: Validate run: .\build\vsts-validate.ps1 diff --git a/ADMF/ADMF.psd1 b/ADMF/ADMF.psd1 index cc2b24a..b27b87c 100644 --- a/ADMF/ADMF.psd1 +++ b/ADMF/ADMF.psd1 @@ -3,7 +3,7 @@ RootModule = 'ADMF.psm1' # Version number of this module. - ModuleVersion = '1.14.112' + ModuleVersion = '1.15.120' # ID used to uniquely identify this module GUID = '43f2a890-942f-4dd7-bad0-b774b44ea849' @@ -26,15 +26,15 @@ # Modules that must be imported into the global environment prior to importing # this module RequiredModules = @( - @{ ModuleName = 'PSFramework'; ModuleVersion = '1.13.416' } + @{ ModuleName = 'PSFramework'; ModuleVersion = '1.14.449' } @{ ModuleName = 'ADSec'; ModuleVersion = '1.0.1' } @{ ModuleName = 'string'; ModuleVersion = '1.2.13' } @{ ModuleName = 'ResolveString'; ModuleVersion = '1.0.0' } - @{ ModuleName = 'Principal'; ModuleVersion = '1.0.0' } - @{ ModuleName = 'ADMF.Core'; ModuleVersion = '1.2.12' } + @{ ModuleName = 'Principal'; ModuleVersion = '1.0.1' } + @{ ModuleName = 'ADMF.Core'; ModuleVersion = '1.4.20' } @{ ModuleName = 'DCManagement'; ModuleVersion = '1.2.26' } - @{ ModuleName = 'DomainManagement'; ModuleVersion = '1.9.234' } - @{ ModuleName = 'ForestManagement'; ModuleVersion = '1.5.82' } + @{ ModuleName = 'DomainManagement'; ModuleVersion = '1.10.257' } + @{ ModuleName = 'ForestManagement'; ModuleVersion = '1.6.85' } ) # Assemblies that must be loaded prior to importing this module diff --git a/ADMF/bin/ADMF.dll b/ADMF/bin/ADMF.dll index 61235e1..da96e17 100644 Binary files a/ADMF/bin/ADMF.dll and b/ADMF/bin/ADMF.dll differ diff --git a/ADMF/bin/ADMF.pdb b/ADMF/bin/ADMF.pdb index 8e26915..7ecd0e4 100644 Binary files a/ADMF/bin/ADMF.pdb and b/ADMF/bin/ADMF.pdb differ diff --git a/ADMF/changelog.md b/ADMF/changelog.md index 5cd5158..0d75dda 100644 --- a/ADMF/changelog.md +++ b/ADMF/changelog.md @@ -1,5 +1,16 @@ # Changelog +## 1.15.120 (2026-06-19) + +- Upd: Components - Added support for Access Rules in Configuration and Schema Naming Contexts +- Upd: Components - Added support for Access Rule Modes in Configuration and Schema Naming Contexts +- Upd: Components - Added support for ACLs in Configuration and Schema Naming Contexts +- Upd: Components - Added support for Object Categories in Configuration and Schema Naming Contexts +- Upd: Components - Added support for Object Categories in Configuration and Schema Naming Contexts +- Upd: Components - Added support for Forest Content Modes, defining what part of the Configuration and Schema Naming Contexts are considered "under management" +- Upd: DefaultAccessRules - Added defaults definition for ACLs and AccessRules for the Configuration and Schema Naming Contexts +- Upd: Dependencies - PSFramework minimum version raised to 1.14.449 + ## 1.14.112 (2025-10-31) - New: Remoting - all PS Remoting connections can now be configured with session options or to use SSH diff --git a/ADMF/functions/Invoke-AdmfForest.ps1 b/ADMF/functions/Invoke-AdmfForest.ps1 index f7dc584..6e9800d 100644 --- a/ADMF/functions/Invoke-AdmfForest.ps1 +++ b/ADMF/functions/Invoke-AdmfForest.ps1 @@ -160,6 +160,20 @@ } else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Certificate' } } + if ($newOptions -band [UpdateForestOptions]::Acl) { + if (Get-FMAcl | Remove-PSFNull) { + Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Executing.Invoke' -StringValues 'Acls', $parameters.Server + Invoke-FMAcl @parameters + } + else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Acls' } + } + if ($newOptions -band [UpdateForestOptions]::AccessRule) { + if (Get-FMAccessRule) { + Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Executing.Invoke' -StringValues 'AccessRules', $parameters.Server + Invoke-FMAccessRule @parameters + } + else { Write-PSFMessage -Level Host -String 'Invoke-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'AccessRules' } + } } catch { Write-Error $_ diff --git a/ADMF/functions/Set-AdmfContext.ps1 b/ADMF/functions/Set-AdmfContext.ps1 index c209a1f..a8aec80 100644 --- a/ADMF/functions/Set-AdmfContext.ps1 +++ b/ADMF/functions/Set-AdmfContext.ps1 @@ -133,6 +133,9 @@ #region Forest $forestFields = @{ + 'accessrules' = Get-Command Register-FMAccessRule + 'accessrulemodes' = Get-Command Register-AdcAccessRuleMode + 'acls' = Get-Command Register-FMAcl 'exchangeschema' = Get-Command Register-FMExchangeSchema 'schema' = Get-Command Register-FMSchema 'schemaDefaultPermissions' = Get-Command Register-FMSchemaDefaultPermission @@ -163,6 +166,7 @@ } } + #region Schema Ldif if (Test-Path "$($ContextObject.Path)\forest\schemaldif") { $filesProcessed = @() @@ -215,7 +219,8 @@ } #endregion Process Ldif Files without configuration } - + #endregion Schema Ldif + # Forest Level $forestLevelPath = Resolve-DataFile -Path "$($ContextObject.Path)\forest\forest_level" if ($forestLevelPath) { @@ -310,13 +315,58 @@ } #endregion Certificates + #region Object Categories + foreach ($file in (Get-ChildItem "$($ContextObject.Path)\forest\objectcategories" -Filter '*.psd1' -ErrorAction Ignore)) { + try { + $dataSet = Import-PSFPowerShellDataFile -Path $file.FullName + $dataSet.TestScript = $dataSet.TestScript.Invoke() | Write-Output # Remove automatic scriptblock nesting + Register-AdcObjectCategory @dataSet -ContextName $ContextObject.Name + } + catch { + Clear-AdcConfiguration + Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.ForestConfig' -StringValues $ContextObject.Name, 'Object Categories', $file.FullName -ErrorRecord $_ + return + } + } + #endregion Object Categories + + #region Content Mode + $forestContentModePath = Resolve-DataFile -Path "$($ContextObject.Path)\forest\content_mode" + if ($forestContentModePath) { + $file = Get-Item -Path $forestContentModePath + Write-PSFMessage -Level Debug -String 'Set-AdmfContext.Context.Loading' -StringValues $ContextObject.Name, 'ContentMode', $file.FullName + try { + $dataSet = Import-PSFPowerShellDataFile -LiteralPath $file.FullName -Unsafe -ErrorAction Stop + if ($dataSet.Mode) { Set-FMContentMode -Mode $dataSet.Mode } + if ($dataSet.Include) { + $includes = @((Get-FMContentMode).Include) + foreach ($entry in $dataSet.Include) { $includes += $entry } + Set-FMContentMode -Include $includes + } + if ($dataSet.Exclude) { + $excludes = @((Get-FMContentMode).Exclude) + foreach ($entry in $dataSet.Exclude) { $excludes += $entry } + Set-FMContentMode -Exclude $excludes + } + if ($dataSet.Keys -contains 'ExcludeComponents') { + Set-FMContentMode -ExcludeComponents $dataSet.ExcludeComponents + } + } + catch { + Clear-AdcConfiguration + Stop-PSFFunction @stopParam -String 'Set-AdmfContext.Context.Error.ForestConfig' -StringValues $ContextObject.Name, 'ContentMode', $file.FullName -ErrorRecord $_ + return + } + } + #endregion Content Mode + #endregion Forest #region Domain $domainFields = @{ 'organizationalunits' = Get-Command Register-DMOrganizationalUnit 'accessrules' = Get-Command Register-DMAccessRule - 'accessrulemodes' = Get-Command Register-DMAccessRuleMode + 'accessrulemodes' = Get-Command Register-AdcAccessRuleMode 'acls' = Get-Command Register-DMAcl 'builtinsids' = Get-Command Register-DMBuiltInSID 'exchange' = Get-Command Register-DMExchange @@ -379,7 +429,7 @@ try { $dataSet = Import-PSFPowerShellDataFile -Path $file.FullName $dataSet.TestScript = $dataSet.TestScript.Invoke() | Write-Output # Remove automatic scriptblock nesting - Register-DMObjectCategory @dataSet -ContextName $ContextObject.Name + Register-AdcObjectCategory @dataSet -ContextName $ContextObject.Name } catch { Clear-AdcConfiguration diff --git a/ADMF/functions/Test-AdmfForest.ps1 b/ADMF/functions/Test-AdmfForest.ps1 index 1755480..14fcaa2 100644 --- a/ADMF/functions/Test-AdmfForest.ps1 +++ b/ADMF/functions/Test-AdmfForest.ps1 @@ -146,6 +146,20 @@ } else { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'ExchangeSchema' } } + if ($newOptions -band [UpdateForestOptions]::Acl) { + if (Get-FMAcl | Remove-PSFNull) { + Write-PSFMessage -Level Host -String 'Test-AdmfForest.Executing.Test' -StringValues 'Acls', $parameters.Server + Test-FMAcl @parameters + } + else { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'Acls' } + } + if ($newOptions -band [UpdateForestOptions]::AccessRule) { + if (Get-FMAccessRule) { + Write-PSFMessage -Level Host -String 'Test-AdmfForest.Executing.Test' -StringValues 'AccessRules', $parameters.Server + Test-FMAccessRule @parameters + } + else { Write-PSFMessage -Level Host -String 'Test-AdmfForest.Skipping.Test.NoConfiguration' -StringValues 'AccessRules' } + } } catch { Write-Error $_ diff --git a/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_configuration.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_configuration.psd1 new file mode 100644 index 0000000..e3cf225 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_configuration.psd1 @@ -0,0 +1,825 @@ +#region Configuration Object +@{ + Path = '%ConfigurationDN%' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'Descendents' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = '%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = '%ConfigurationDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Manage-Topology' + InheritedObjectType = '' +} +@{ + Path = '%ConfigurationDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Synchronize' + InheritedObjectType = '' +} +@{ + Path = '%ConfigurationDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes' + InheritedObjectType = '' +} +@{ + Path = '%ConfigurationDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes-In-Filtered-Set' + InheritedObjectType = '' +} +@{ + Path = '%ConfigurationDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes-All' + InheritedObjectType = '' +} +@{ + Path = '%ConfigurationDN%' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes' + InheritedObjectType = '' +} +@{ + Path = '%ConfigurationDN%' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Synchronize' + InheritedObjectType = '' +} +@{ + Path = '%ConfigurationDN%' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Manage-Topology' + InheritedObjectType = '' +} +@{ + Path = '%ConfigurationDN%' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes-All' + InheritedObjectType = '' +} +@{ + Path = '%ConfigurationDN%' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes-In-Filtered-Set' + InheritedObjectType = '' +} +@{ + Path = '%ConfigurationDN%' + Identity = '%DomainSID%-498' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes' + InheritedObjectType = '' +} +@{ + Path = '%ConfigurationDN%' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion Configuration Object + +#region Wellknown Security Principals +@{ + Path = 'CN=WellKnown Security Principals,%ConfigurationDN%' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=WellKnown Security Principals,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=WellKnown Security Principals,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=WellKnown Security Principals,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion Wellknown Security Principals + +#region Foreign Security Principals +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-5-10' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ReadControl' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-5-32-548' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'User-Change-Password' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-5-10' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Receive-As' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-5-10' + ActiveDirectoryRights = 'ReadProperty, WriteProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Personal-Information' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-5-10' + ActiveDirectoryRights = 'ReadProperty, WriteProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Email-Information' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-5-10' + ActiveDirectoryRights = 'ReadProperty, WriteProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Web-Information' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-5-10' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'User-Change-Password' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-5-10' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Send-As' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ReadProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Personal-Information' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ReadProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Web-Information' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ReadProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Public-Information' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_foreignSecurityPrincipal' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ReadProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'General-Information' + InheritedObjectType = '' + Present = 'false' +} +#endregion Foreign Security Principals + +#region Physical Locations +@{ + Path = 'CN=Physical Locations,%ConfigurationDN%' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Physical Locations,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Physical Locations,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Physical Locations,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion Physical Locations + +#region ForestUpdates +@{ + Path = 'CN=ForestUpdates,%ConfigurationDN%' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=ForestUpdates,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=ForestUpdates,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'False' +} +@{ + Path = 'CN=ForestUpdates,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=ForestUpdates,%ConfigurationDN%' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Windows2003Update,CN=ForestUpdates,%ConfigurationDN%' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Windows2003Update,CN=ForestUpdates,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Windows2003Update,CN=ForestUpdates,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'False' +} +@{ + Path = 'CN=Windows2003Update,CN=ForestUpdates,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Windows2003Update,CN=ForestUpdates,%ConfigurationDN%' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=ActiveDirectoryUpdate,CN=ForestUpdates,%ConfigurationDN%' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=ActiveDirectoryUpdate,CN=ForestUpdates,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=ActiveDirectoryUpdate,CN=ForestUpdates,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'False' +} +@{ + Path = 'CN=ActiveDirectoryUpdate,CN=ForestUpdates,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=ActiveDirectoryUpdate,CN=ForestUpdates,%ConfigurationDN%' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=ActiveDirectoryRodcUpdate,CN=ForestUpdates,%ConfigurationDN%' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=ActiveDirectoryRodcUpdate,CN=ForestUpdates,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=ActiveDirectoryRodcUpdate,CN=ForestUpdates,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'False' +} +@{ + Path = 'CN=ActiveDirectoryRodcUpdate,CN=ForestUpdates,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=ActiveDirectoryRodcUpdate,CN=ForestUpdates,%ConfigurationDN%' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Operations,CN=ForestUpdates,%ConfigurationDN%' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Operations,CN=ForestUpdates,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Operations,CN=ForestUpdates,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'False' +} +@{ + Path = 'CN=Operations,CN=ForestUpdates,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Operations,CN=ForestUpdates,%ConfigurationDN%' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} + +@{ + ObjectCategory = 'cfg_ForestUpdateOperations' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'Undefined' +} +@{ + ObjectCategory = 'cfg_ForestUpdateOperations' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'Undefined' +} +@{ + ObjectCategory = 'cfg_ForestUpdateOperations' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'Undefined' # Tolerated if present +} +@{ + ObjectCategory = 'cfg_ForestUpdateOperations' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_ForestUpdateOperations' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_ForestUpdateOperations' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'Undefined' +} +#endregion ForestUpdates + +#region Wide-ranging Categories +@{ + ObjectCategory = 'cfg_container' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_container' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_displaySpecifier' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_displaySpecifier' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_displaySpecifier_2' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_displaySpecifier_2' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_controlAccessRight' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_controlAccessRight' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion Wide-ranging Categories + +#region Subnodes +@{ + Path = 'CN=LostAndFoundConfig,%ConfigurationDN%' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=LostAndFoundConfig,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=LostAndFoundConfig,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=LostAndFoundConfig,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=NTDS Quotas,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=NTDS Quotas,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion Subnodes \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_partitions.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_partitions.psd1 new file mode 100644 index 0000000..1cad96a --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_partitions.psd1 @@ -0,0 +1,201 @@ + +#region Partitions +@{ + Path = 'CN=Partitions,%ConfigurationDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'CreateChild' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Partitions,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ListObject, GenericExecute' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Partitions,%ConfigurationDN%' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Partitions,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Partitions,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ReadProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'FSMO-Role-Owner' + InheritedObjectType = '' +} +@{ + Path = 'CN=Partitions,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ReadProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'UPN-Suffixes' + InheritedObjectType = '' +} +@{ + Path = 'CN=Partitions,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ReadProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'ms-DS-SPN-Suffixes' + InheritedObjectType = '' +} +@{ + Path = 'CN=Partitions,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ReadProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'ms-DS-Enabled-Feature' + InheritedObjectType = '' +} +@{ + Path = 'CN=Partitions,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ReadProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'ms-DS-JetDB-Page-Size' + InheritedObjectType = '' + Present = 'Undefined' # 2025+ Domains only +} +@{ + Path = 'CN=Partitions,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ReadProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'ms-DS-Behavior-Version' + InheritedObjectType = '' +} +@{ + Path = 'CN=Partitions,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ReadProperty' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Public-Information' + InheritedObjectType = '' +} +@{ + Path = 'CN=Partitions,%ConfigurationDN%' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'WriteProperty' + InheritanceType = 'Descendents' + AccessControlType = 'Allow' + ObjectType = 'ms-DS-NC-RO-Replica-Locations' + InheritedObjectType = 'Cross-Ref' +} +@{ + Path = 'CN=Partitions,%ConfigurationDN%' + Identity = 'S-1-5-18' + ActiveDirectoryRights = '268435456' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Enterprise Configuration,CN=Partitions,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Enterprise Configuration,CN=Partitions,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Enterprise Schema,CN=Partitions,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Enterprise Schema,CN=Partitions,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} + +@{ + ObjectCategory = 'crossRef-DNSZone' + Identity = '%DomainSID%-516' + ActiveDirectoryRights = 'CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'Undefined' +} +@{ + ObjectCategory = 'crossRef-DNSZone' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'Undefined' +} + +@{ + ObjectCategory = 'crossRef-Domain' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'crossRef-Domain' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#region Partitions \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_schema.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_schema.psd1 new file mode 100644 index 0000000..a0827f5 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_schema.psd1 @@ -0,0 +1,183 @@ +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = '%RootDomainSID%-518' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Manage-Topology' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Synchronize' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes-In-Filtered-Set' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes-All' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Synchronize' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Manage-Topology' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes-In-Filtered-Set' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes-All' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = '%DomainSID%-498' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes-In-Filtered-Set' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = '%DomainSID%-498' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = '%DomainSID%-498' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'DS-Replication-Get-Changes-All' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = '%RootDomainSID%-518' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Change-Schema-Master' + InheritedObjectType = '' +} +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = '%SchemaDN%' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = '%SchemaDN%' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_services.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_services.psd1 new file mode 100644 index 0000000..fb810d8 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_services.psd1 @@ -0,0 +1,448 @@ +@{ + Path = 'CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=NetServices,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=NetServices,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=RRAS,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=RRAS,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=IdentityDictionary,CN=RRAS,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=IdentityDictionary,CN=RRAS,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=MsmqServices,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=MsmqServices,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Microsoft SPP,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Microsoft SPP,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Activation Objects,CN=Microsoft SPP,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Activation Objects,CN=Microsoft SPP,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Activation Objects,CN=Microsoft SPP,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Group Key Distribution Service,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Group Key Distribution Service,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Master Root Keys,CN=Group Key Distribution Service,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Master Root Keys,CN=Group Key Distribution Service,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Server Configuration,CN=Group Key Distribution Service,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Server Configuration,CN=Group Key Distribution Service,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Group Key Distribution Service Server Configuration,CN=Server Configuration,CN=Group Key Distribution Service,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Group Key Distribution Service Server Configuration,CN=Server Configuration,CN=Group Key Distribution Service,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Group Key Distribution Service Server Configuration,CN=Server Configuration,CN=Group Key Distribution Service,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Group Key Distribution Service Server Configuration,CN=Server Configuration,CN=Group Key Distribution Service,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=AuthN Policy Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=AuthN Policy Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Privileged Access Management Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Privileged Access Management Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Database 32k Pages Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Optional = $true +} +@{ + Path = 'CN=Database 32k Pages Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' + Optional = $true +} +@{ + Path = 'CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Default Query Policy,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Default Query Policy,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_services_claims.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_services_claims.psd1 new file mode 100644 index 0000000..63a340f --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_services_claims.psd1 @@ -0,0 +1,251 @@ +@{ + Path = 'CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Claim Types,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Claim Types,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Resource Properties,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Resource Properties,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Value Types,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Value Types,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Global Resource Property List,CN=Resource Property Lists,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'DeleteTree, Delete' + InheritanceType = 'None' + AccessControlType = 'Deny' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Global Resource Property List,CN=Resource Property Lists,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Global Resource Property List,CN=Resource Property Lists,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Central Access Policies,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Central Access Policies,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Central Access Rules,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Central Access Rules,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Claims Transformation Policies,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Claims Transformation Policies,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Claims Transformation Policies,CN=Claims Configuration,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} + +#region Resource Properties +@{ + ObjectCategory = 'cfg_claim_resourceProperty' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'DeleteTree, Delete' + InheritanceType = 'None' + AccessControlType = 'Deny' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_claim_resourceProperty' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_claim_resourceProperty' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion Resource Properties + +#region Value Types +@{ + ObjectCategory = 'cfg_claim_valueType' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'DeleteTree, Delete' + InheritanceType = 'None' + AccessControlType = 'Deny' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_claim_valueType' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_claim_valueType' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_claim_valueType' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_claim_valueType' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion Value Types \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_services_pki.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_services_pki.psd1 new file mode 100644 index 0000000..32d7120 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_services_pki.psd1 @@ -0,0 +1,1010 @@ +@{ + Path = 'CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Enrollment Services,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Enrollment Services,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=Certification Authorities,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Certification Authorities,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=AIA,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-517' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=AIA,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=AIA,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=CDP,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=CDP,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=KRA,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=KRA,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=OID,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=OID,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=NTAuthCertificates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=NTAuthCertificates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +#TODO: Review and potentially replace +@{ + Path = 'CN=NTAuthCertificates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=NTAuthCertificates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=NTAuthCertificates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=NTAuthCertificates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=NTAuthCertificates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} + +#region Template Standards +#TODO: Update to new DA-selector +@{ + ObjectCategory = 'cfg_certificateTemplates' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_certificateTemplates' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +#TODO: Update to new DA-selector +@{ + ObjectCategory = 'cfg_certificateTemplates' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +#TODO: Review Domain Users +@{ + ObjectCategory = 'cfg_certificateTemplates' + Identity = '%RootDomainSID%-513' # Domain Users + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_certificateTemplates' + Identity = '%DomainSID%-513' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_certificateTemplates' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_certificateTemplates' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_certificateTemplates' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion Template Standards + +#region Default Template Overrides +@{ + Path = 'CN=User,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-513' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=UserSignature,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-513' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=ClientAuth,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-513' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=EFS,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-513' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=Machine,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-515' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DomainController,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DomainController,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-498' + ActiveDirectoryRights = 'ReadProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DomainController,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-516' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=IPSECIntermediateOnline,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-515' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=IPSECIntermediateOnline,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-516' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DomainControllerAuthentication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DomainControllerAuthentication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-AutoEnrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DomainControllerAuthentication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-498' + ActiveDirectoryRights = 'ReadProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-AutoEnrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DomainControllerAuthentication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-498' + ActiveDirectoryRights = 'ReadProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DomainControllerAuthentication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-516' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-AutoEnrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DomainControllerAuthentication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-516' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DirectoryEmailReplication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DirectoryEmailReplication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-AutoEnrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DirectoryEmailReplication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-498' + ActiveDirectoryRights = 'ReadProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-AutoEnrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DirectoryEmailReplication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-498' + ActiveDirectoryRights = 'ReadProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DirectoryEmailReplication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-516' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-AutoEnrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=DirectoryEmailReplication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-516' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=Workstation,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-515' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=RASAndIASServer,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-553' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=KerberosAuthentication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=KerberosAuthentication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = 'S-1-5-9' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-AutoEnrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=KerberosAuthentication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-498' + ActiveDirectoryRights = 'ReadProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-AutoEnrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=KerberosAuthentication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-498' + ActiveDirectoryRights = 'ReadProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=KerberosAuthentication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-516' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-AutoEnrollment' + InheritedObjectType = '' +} +@{ + Path = 'CN=KerberosAuthentication,CN=Certificate Templates,CN=Public Key Services,CN=Services,%ConfigurationDN%' + Identity = '%DomainSID%-516' + ActiveDirectoryRights = 'ReadProperty, WriteProperty, ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +#endregion Default Template Overrides + +#region Enrollment Services +@{ + ObjectCategory = 'cfg_pki_EnrollmentService' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_EnrollmentService' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_EnrollmentService' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'ExtendedRight' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = 'Certificate-Enrollment' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_EnrollmentService' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_pki_EnrollmentService' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_pki_EnrollmentService' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion Enrollment Services + +#region Certificate Authority +@{ + ObjectCategory = 'cfg_pki_certificationAuthority' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_certificationAuthority' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +#TODO: Review & Update +@{ + ObjectCategory = 'cfg_pki_certificationAuthority' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_certificationAuthority' + Identity = '%DomainSID%-517' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_certificationAuthority' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_certificationAuthority' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_pki_certificationAuthority' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_pki_certificationAuthority' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion Certificate Authority + +#region AIA Authority +@{ + ObjectCategory = 'cfg_pki_aiaAuthority' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_aiaAuthority' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +#TODO: Review & Update +@{ + ObjectCategory = 'cfg_pki_aiaAuthority' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_aiaAuthority' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_aiaAuthority' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_pki_aiaAuthority' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_pki_aiaAuthority' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion AIA Authority + +#region CDP +@{ + ObjectCategory = 'cfg_pki_CDP' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_CDP' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +#TODO: Review & Update +@{ + ObjectCategory = 'cfg_pki_CDP' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_CDP' + Identity = '%DomainSID%-517' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_CDP' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_CDP' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_pki_CDP' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_pki_CDP' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion CDP + +#region CRL Distribution Point +@{ + ObjectCategory = 'cfg_pki_cRLDistributionPoint' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_cRLDistributionPoint' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +#TODO: Review & Update +@{ + ObjectCategory = 'cfg_pki_cRLDistributionPoint' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_cRLDistributionPoint' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_cRLDistributionPoint' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_pki_cRLDistributionPoint' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_pki_cRLDistributionPoint' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion CRL Distribution Point + +#region Private Key Recovery Agent +@{ + ObjectCategory = 'cfg_pki_msPKI-PrivateKeyRecoveryAgent' + Identity = 'S-1-1-0' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_msPKI-PrivateKeyRecoveryAgent' + Identity = 'S-1-5-32-544' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +#TODO: Review & Update +@{ + ObjectCategory = 'cfg_pki_msPKI-PrivateKeyRecoveryAgent' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_msPKI-PrivateKeyRecoveryAgent' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'All' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_pki_msPKI-PrivateKeyRecoveryAgent' + Identity = 'S-1-5-11' + ActiveDirectoryRights = 'GenericRead' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_pki_msPKI-PrivateKeyRecoveryAgent' + Identity = 'S-1-5-18' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + ObjectCategory = 'cfg_pki_msPKI-PrivateKeyRecoveryAgent' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +#endregion Private Key Recovery Agent \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_sites.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_sites.psd1 new file mode 100644 index 0000000..d89b44a --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/accessRules/addefault_sites.psd1 @@ -0,0 +1,177 @@ +@{ + Path = 'CN=Sites,%ConfigurationDN%' + Identity = '%RootDomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Sites,%ConfigurationDN%' + Identity = '%RootDomainSID%-498' + ActiveDirectoryRights = 'Self' + InheritanceType = 'Descendents' + AccessControlType = 'Allow' + ObjectType = 'ms-DS-JetDB-Page-Size' + InheritedObjectType = 'NTDS-DSA' + Present = 'Undefined' # 2025+ Domains only +} +@{ + Path = 'CN=Sites,%ConfigurationDN%' + Identity = '%RootDomainSID%-498' + ActiveDirectoryRights = 'Self' + InheritanceType = 'Descendents' + AccessControlType = 'Allow' + ObjectType = 'ms-DS-Behavior-Version' + InheritedObjectType = 'NTDS-DSA' +} +@{ + Path = 'CN=Sites,%ConfigurationDN%' + Identity = '%RootDomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} + +@{ + ObjectCategory = 'cfg_ntdssettings' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, DeleteTree, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_ntdssettings' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} + +@{ + ObjectCategory = 'cfg_nTDSSiteSettings' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, DeleteTree, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_nTDSSiteSettings' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} + +@{ + Path = 'CN=Subnets,CN=Sites,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Subnets,CN=Sites,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} + +@{ + Path = 'CN=Inter-Site Transports,CN=Sites,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=Inter-Site Transports,CN=Sites,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} + +@{ + Path = 'CN=IP,CN=Inter-Site Transports,CN=Sites,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=IP,CN=Inter-Site Transports,CN=Sites,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} +@{ + Path = 'CN=SMTP,CN=Inter-Site Transports,CN=Sites,%ConfigurationDN%' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + Path = 'CN=SMTP,CN=Inter-Site Transports,CN=Sites,%ConfigurationDN%' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} + +@{ + ObjectCategory = 'cfg_siteLink' + Identity = '%DomainSID%-519' + ActiveDirectoryRights = 'CreateChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' +} +@{ + ObjectCategory = 'cfg_siteLink' + Identity = '%DomainSID%-512' + ActiveDirectoryRights = 'GenericAll' + InheritanceType = 'None' + AccessControlType = 'Allow' + ObjectType = '' + InheritedObjectType = '' + Present = 'false' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/acls/addefault_configuration.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/acls/addefault_configuration.psd1 new file mode 100644 index 0000000..15735e1 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/acls/addefault_configuration.psd1 @@ -0,0 +1,33 @@ +@{ + Owner = '%RootDomainSID%-519' + DefaultOwner = $true +} +@{ + ObjectCategory = 'crossRef-DNSZone' + Owner = 'S-1-5-18' # System +} +@{ + ObjectCategory = 'msDNS-ServerSettings' + Owner = 'S-1-5-18' # System +} +@{ + ObjectCategory = 'cfg_ForestUpdateOperations' + Owner = '__DomainAdminsEx__' +} +@{ + ObjectCategory = 'cfg_ntdssettings' + Owner = '__DomainAdminsEx__' +} +@{ + ObjectCategory = 'cfg_ntdsconnection' + Owner = '__DomainAdminsEx__' +} +@{ + ObjectCategory = 'cfg_siteserver' + Owner = '__DomainAdminsEx__' +} +@{ + ObjectCategory = 'cfg_certificateTemplates' + Owner = '%RootDomainSID%-519' + NoInheritance = $true +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/acls/addefault_schema.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/acls/addefault_schema.psd1 new file mode 100644 index 0000000..a7543d5 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/acls/addefault_schema.psd1 @@ -0,0 +1,12 @@ +@{ + Path = '%SchemaDN%' + Owner = '%RootDomainSID%-518' # Schema Admins +} +@{ + ObjectCategory = 'schemaClass' + Owner = '%RootDomainSID%-518' # Schema Admins +} +@{ + ObjectCategory = 'schemaAttribute' + Owner = '%RootDomainSID%-518' # Schema Admins +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_ForestUpdateOperations.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_ForestUpdateOperations.psd1 new file mode 100644 index 0000000..5fcb56a --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_ForestUpdateOperations.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_ForestUpdateOperations' + ObjectClass = 'container' + Property = @('Name') + TestScript = { $args[0].Name -like "*-*" } + LDAPFilter = '(name=*-*)' + SearchBase = 'CN=Operations,CN=ForestUpdates,%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_certificateTemplates.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_certificateTemplates.psd1 new file mode 100644 index 0000000..e72d70b --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_certificateTemplates.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_certificateTemplates' + ObjectClass = 'pKICertificateTemplate' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=pKICertificateTemplate)' + SearchBase = 'CN=Public Key Services,CN=Services,%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_claim_resourceProperty.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_claim_resourceProperty.psd1 new file mode 100644 index 0000000..60d7a3d --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_claim_resourceProperty.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_claim_resourceProperty' + ObjectClass = 'msDS-ResourceProperty' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=msDS-ResourceProperty)' + SearchBase = 'CN=Claims Configuration,CN=Services,%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_claim_valueType.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_claim_valueType.psd1 new file mode 100644 index 0000000..5beb90a --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_claim_valueType.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_claim_valueType' + ObjectClass = 'msDS-ValueType' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=msDS-ValueType)' + SearchBase = 'CN=Claims Configuration,CN=Services,%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_container.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_container.psd1 new file mode 100644 index 0000000..85303b8 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_container.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_container' + ObjectClass = 'Container' + Property = @('DistinguishedName') + TestScript = { $args[0].DistinguishedName -notmatch ',CN=ForestUpdates,' } + LDAPFilter = '(objectClass=container)(!(distinguishedName=*CN=ForestUpdates,%ConfigurationDN%))' + SearchBase = '%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_controlAccessRight.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_controlAccessRight.psd1 new file mode 100644 index 0000000..ccf5c2f --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_controlAccessRight.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_controlAccessRight' + ObjectClass = 'controlAccessRight' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=controlAccessRight)' + SearchBase = '%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_crossRef-DNSZone.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_crossRef-DNSZone.psd1 new file mode 100644 index 0000000..710d8dc --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_crossRef-DNSZone.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'crossRef-DNSZone' + ObjectClass = 'crossRef' + Property = @('systemFlags') + TestScript = { $args[0].systemFlags -eq 5 } + LDAPFilter = '(systemFlags=5)' + SearchBase = 'CN=Partitions,%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_crossRef-Domain.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_crossRef-Domain.psd1 new file mode 100644 index 0000000..475fb43 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_crossRef-Domain.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'crossRef-Domain' + ObjectClass = 'crossRef' + Property = @('systemFlags') + TestScript = { $args[0].systemFlags -eq 3 } + LDAPFilter = '(systemFlags=3)' + SearchBase = 'CN=Partitions,%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_displaySpecifier.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_displaySpecifier.psd1 new file mode 100644 index 0000000..43b0b71 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_displaySpecifier.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_displaySpecifier' + ObjectClass = 'displaySpecifier' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=displaySpecifier)' + SearchBase = '%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_displaySpecifier_2.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_displaySpecifier_2.psd1 new file mode 100644 index 0000000..1b7c679 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_displaySpecifier_2.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_displaySpecifier_2' + ObjectClass = 'dSUISettings' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=dSUISettings)' + SearchBase = '%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_foreignSecurityPrincipal.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_foreignSecurityPrincipal.psd1 new file mode 100644 index 0000000..77b3ac8 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_foreignSecurityPrincipal.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_foreignSecurityPrincipal' + ObjectClass = 'foreignSecurityPrincipal' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=foreignSecurityPrincipal)' + SearchBase = '%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_msDNS-ServerSettings.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_msDNS-ServerSettings.psd1 new file mode 100644 index 0000000..d3c0514 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_msDNS-ServerSettings.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'msDNS-ServerSettings' + ObjectClass = 'msDNS-ServerSettings' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=msDNS-ServerSettings)' + SearchBase = 'CN=Sites,%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_nTDSSiteSettings.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_nTDSSiteSettings.psd1 new file mode 100644 index 0000000..181493f --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_nTDSSiteSettings.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_nTDSSiteSettings' + ObjectClass = 'nTDSSiteSettings' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=nTDSSiteSettings)' + SearchBase = 'CN=Sites,%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_ntdsconnection.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_ntdsconnection.psd1 new file mode 100644 index 0000000..8833b64 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_ntdsconnection.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_ntdsconnection' + ObjectClass = 'nTDSConnection' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=nTDSConnection)' + SearchBase = 'CN=Sites,%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_ntdssettings.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_ntdssettings.psd1 new file mode 100644 index 0000000..12ef5f6 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_ntdssettings.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_ntdssettings' + ObjectClass = 'nTDSDSA' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=nTDSDSA)' + SearchBase = 'CN=Sites,%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_EnrollmentService.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_EnrollmentService.psd1 new file mode 100644 index 0000000..8373109 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_EnrollmentService.psd1 @@ -0,0 +1,9 @@ +@{ + Name = 'cfg_pki_EnrollmentService' + ObjectClass = 'pKIEnrollmentService' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=pKIEnrollmentService)' + SearchBase = 'CN=Enrollment Services,CN=Public Key Services,CN=Services,%ConfigurationDN%' + SearchScope = 'OneLevel' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_aiaAuthority.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_aiaAuthority.psd1 new file mode 100644 index 0000000..e699b6f --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_aiaAuthority.psd1 @@ -0,0 +1,9 @@ +@{ + Name = 'cfg_pki_aiaAuthority' + ObjectClass = 'certificationAuthority' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=certificationAuthority)' + SearchBase = 'CN=AIA,CN=Public Key Services,CN=Services,%ConfigurationDN%' + SearchScope = 'OneLevel' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_cRLDistributionPoint.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_cRLDistributionPoint.psd1 new file mode 100644 index 0000000..d64a7a0 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_cRLDistributionPoint.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_pki_cRLDistributionPoint' + ObjectClass = 'cRLDistributionPoint' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=cRLDistributionPoint)' + SearchBase = 'CN=CDP,CN=Public Key Services,CN=Services,%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_cdp.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_cdp.psd1 new file mode 100644 index 0000000..aa38176 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_cdp.psd1 @@ -0,0 +1,9 @@ +@{ + Name = 'cfg_pki_CDP' + ObjectClass = 'container' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=container)' + SearchBase = 'CN=CDP,CN=Public Key Services,CN=Services,%ConfigurationDN%' + SearchScope = 'OneLevel' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_certificationAuthority.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_certificationAuthority.psd1 new file mode 100644 index 0000000..5dc12dd --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_certificationAuthority.psd1 @@ -0,0 +1,9 @@ +@{ + Name = 'cfg_pki_certificationAuthority' + ObjectClass = 'certificationAuthority' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=certificationAuthority)' + SearchBase = 'CN=Certification Authorities,CN=Public Key Services,CN=Services,%ConfigurationDN%' + SearchScope = 'OneLevel' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_msPKI-PrivateKeyRecoveryAgent.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_msPKI-PrivateKeyRecoveryAgent.psd1 new file mode 100644 index 0000000..50dc1f5 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_pki_msPKI-PrivateKeyRecoveryAgent.psd1 @@ -0,0 +1,9 @@ +@{ + Name = 'cfg_pki_msPKI-PrivateKeyRecoveryAgent' + ObjectClass = 'msPKI-PrivateKeyRecoveryAgent' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=msPKI-PrivateKeyRecoveryAgent)' + SearchBase = 'CN=KRA,CN=Public Key Services,CN=Services,%ConfigurationDN%' + SearchScope = 'OneLevel' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_schemaAttribute.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_schemaAttribute.psd1 new file mode 100644 index 0000000..a09b927 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_schemaAttribute.psd1 @@ -0,0 +1,7 @@ +@{ + Name = 'schemaAttribute' + ObjectClass = 'attributeSchema' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=attributeSchema)' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_schemaClass.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_schemaClass.psd1 new file mode 100644 index 0000000..a48e342 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_schemaClass.psd1 @@ -0,0 +1,7 @@ +@{ + Name = 'schemaClass' + ObjectClass = 'classSchema' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=classSchema)' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_siteLink.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_siteLink.psd1 new file mode 100644 index 0000000..71f07ac --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_siteLink.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_siteLink' + ObjectClass = 'siteLink' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=siteLink)' + SearchBase = 'CN=Sites,%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_siteserver.psd1 b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_siteserver.psd1 new file mode 100644 index 0000000..ab2f0b5 --- /dev/null +++ b/ADMF/internal/components/DefaultAccessRules/forest/objectcategories/addefault_siteserver.psd1 @@ -0,0 +1,8 @@ +@{ + Name = 'cfg_siteserver' + ObjectClass = 'server' + Property = @('Name') + TestScript = { $true } + LDAPFilter = '(objectClass=server)' + SearchBase = 'CN=Sites,%ConfigurationDN%' +} \ No newline at end of file diff --git a/ADMF/internal/data/context/forest/accessrulemodes/readme.md b/ADMF/internal/data/context/forest/accessrulemodes/readme.md new file mode 100644 index 0000000..4dddca0 --- /dev/null +++ b/ADMF/internal/data/context/forest/accessrulemodes/readme.md @@ -0,0 +1,100 @@ +# AccessRule Processing Mode + +## Description + +When processing AccessRules, by default all undesired rules on a configured object will be removed. +This is great for objects fully under your control. +But what about scenarios where you just want to enable another process to self-manage an environment? +At that point, where other servies may interfere with your deployed configuration you may want to instead define your settings as a minimum while disregarding/ignoring other rules defined. + +This is what the AccessRule Processing Mode controls. + +With that you can define which objects to fully control and where to just add to. +You can target by: + ++ Explicit Path ++ SubTree under a specific path ++ ObjectCategory + +## Precedence + +With the various targeting modes, several rules may apply to the same AD object. +When that happens, the settings are applied in the following, descending precedence: + ++ Explicit Path ++ ObjectCategory ++ SubTree-item with the longest name among applicable SubTree-definitions + +This allows to define multiple SubTree tiers, where only the most specific one will apply to a given object. + +## Overriding settings + +Each Processing Mode can be overridden by a different Context. +A Processing Mode is identified by: PathMode & Path or ObjectCategory. + +This means an Explicit Path rule can only be overriden by a matching Explicit Path rule (which may have a different Processing Mode). + +## Example Configurations + +Configuration entries can be defined by adding them to the current folder as json files. +The specific filename is not important and any number of configuration files can be defined. + +> Explicit Path Rule + +```json +{ + "Path": "CN=MyGroup3,OU=Groups,OU=DomainContent,%DomainDN%", + "Mode": "Additive" +} +``` + +> SubTree Path Rule + +```json +{ + "Path": "OU=Groups,OU=DomainContent,%DomainDN%", + "PathMode": "SubTree", + "Mode": "Additive" +} +``` + +> ObjectCategory Rule + +```json +{ + "ObjectCategory": "DomainControllers", + "Mode": "Constrained" +} +``` + +## Parameters + +### Path + +> Supports string replacement + +The path in ad to the targeted item. +Whether this is an Explicit or SubTree Path-rule is determined by the `PathMode` rule. + +### PathMode + +Optional: true | Options: SingleItem, SubTree | Default: SingleItem + +Determines whether a Path-rule is either Explicit or SubTree: + ++ SingleItem: Processing Mode only applies to the exactly specified path. ++ SubTree: Processing Mode applies to specified path and all items beneath it (unless overridden). + +### ObjectCategory + +Instead of targeting by path, target a specific ObjectCategory. + +### Mode + +Options: 'Constrained', 'Additive' + +The AccessRule Processing Mode to apply: + ++ Constrained: Any non-defined AccessRule will be removed ++ Additive: Any non-defined AccessRule will be ignored ++ Defined: Any non-defined [AccessRule](accessrules.html) will be ignored, _unless_ it affects an identity for which a non-matching definition exists. diff --git a/ADMF/internal/data/context/forest/accessrules/readme.md b/ADMF/internal/data/context/forest/accessrules/readme.md new file mode 100644 index 0000000..a9b239d --- /dev/null +++ b/ADMF/internal/data/context/forest/accessrules/readme.md @@ -0,0 +1,13 @@ +# accessrules + +## Synopsis + +Add configuration data to manage accessrules + +Place any number of json files in this folder. +Each file should contain an array of objects. +What properties to place on each object depends on the parameters present on the relevant 'Register-*'-Command. +For a full description of the supported properties, see the parameter descriptions: + + Get-Help Register-DMAccessRule -Detailed + diff --git a/ADMF/internal/data/context/forest/acls/readme.md b/ADMF/internal/data/context/forest/acls/readme.md new file mode 100644 index 0000000..3b75239 --- /dev/null +++ b/ADMF/internal/data/context/forest/acls/readme.md @@ -0,0 +1,13 @@ +# Acls + +## Synopsis + +Add configuration data to manage acls + +Place any number of json files in this folder. +Each file should contain an array of objects. +What properties to place on each object depends on the parameters present on the relevant 'Register-*'-Command. +For a full description of the supported properties, see the parameter descriptions: + + Get-Help Register-DMAcl -Detailed + diff --git a/ADMF/internal/data/context/forest/objectcategories/readme.md b/ADMF/internal/data/context/forest/objectcategories/readme.md new file mode 100644 index 0000000..e4d627d --- /dev/null +++ b/ADMF/internal/data/context/forest/objectcategories/readme.md @@ -0,0 +1,30 @@ +# Object Categories + +## Synopsis + +Add configuration data to manage object categories. +Some rules & settings can be applied to objects of a given Object Category, rather than a specific identity. + +Each file must be a psd1 file returning a single hashtable containing the following key/value pairs: + +- Name: The name by which to address the category. +- ObjectClass: The object class this category applies to. Important for performance reasons. +- Property: The properties needed to verify, whether a given object of the defined objectclass is also part of this category. +- TestScript: A scriptblock that returns $true if the first argument (an AD object) is part of the category. +- LDAPFilter: An LDAP filter to retrieve all objects of this category. + +Example category from the default access rule set: + +```powershell +@{ + Name = 'DomainController' + ObjectClass = 'computer' + Property = @('PrimaryGroupID') + TestScript = { $args[0].PrimaryGroupID -eq 516 } + LDAPFilter = '(&(objectCategory=computer)(primaryGroupID=516))' +} +``` + +For more details, see: + + Get-Help Register-DMObjectCategory -Detailed diff --git a/build/psf-prerequisites.ps1 b/build/psf-prerequisites.ps1 new file mode 100644 index 0000000..236d3ec --- /dev/null +++ b/build/psf-prerequisites.ps1 @@ -0,0 +1,32 @@ +<# +Uses PSFramework.Nuget to install all modules required to run the pipeline. +#> +[CmdletBinding()] +param ( + [string] + $Repository = 'PSGallery' +) + +Invoke-WebRequest 'https://raw.githubusercontent.com/PowershellFrameworkCollective/PSFramework.NuGet/refs/heads/master/bootstrap.ps1' -UseBasicParsing | Invoke-Expression +Install-PSFPowerShellGet + +$modules = @( + 'Pester' # Testing Framework + 'PSScriptAnalyzer' # Best Practices Analyzer used during tests + 'PSModuleDevelopment' # Potentially used in Tests or Publish +) + +# Automatically add missing dependencies +$data = Import-PowerShellDataFile -Path "$PSScriptRoot\..\ADMF\ADMF.psd1" +foreach ($dependency in $data.RequiredModules) { + if ($dependency -is [string]) { + if ($modules -contains $dependency) { continue } + $modules += $dependency + } + else { + if ($modules -contains $dependency.ModuleName) { continue } + $modules += $dependency.ModuleName + } +} + +Install-PSFModule -Name $modules -Repository $Repository -TrustRepository \ No newline at end of file diff --git a/library/ADMF/ADMF/UpdateForestOptions.cs b/library/ADMF/ADMF/UpdateForestOptions.cs index 387c073..38f65f8 100644 --- a/library/ADMF/ADMF/UpdateForestOptions.cs +++ b/library/ADMF/ADMF/UpdateForestOptions.cs @@ -17,10 +17,13 @@ public enum UpdateForestOptions SchemaDefaultPermissions = 512, Certificates = 1024, SchemaManage = 2048, + AccessRule = 4096, + Acl = 8192, Default = Sites | Subnets | SiteLinks | NTAuthStore | Certificates, - All = Default | ServerRelocate | ForestLevel | AllSchema, + All = Default | ServerRelocate | ForestLevel | AllSchema | AllAccess, Topology = Sites | Subnets | SiteLinks, - AllSchema = Schema | SchemaLdif | ExchangeSchema | SchemaDefaultPermissions + AllSchema = Schema | SchemaLdif | ExchangeSchema | SchemaDefaultPermissions, + AllAccess = AccessRule | Acl } } \ No newline at end of file