ActiveDirectoryManagementFramework · FriedrichWeinmann · Jun 19, 2026 · May 22, 2026 · Jun 19, 2026 · Jun 19, 2026
diff --git a/DomainManagement/DomainManagement.psd1 b/DomainManagement/DomainManagement.psd1
@@ -3,7 +3,7 @@
 	RootModule         = 'DomainManagement.psm1'
 
 	# Version number of this module.
-	ModuleVersion      = '1.9.249'
+	ModuleVersion      = '1.10.257'
 
 	# ID used to uniquely identify this module
 	GUID               = '0a405382-ebc2-445b-8325-541535810193'
@@ -46,14 +46,10 @@
 	# Functions to export from this module
 	FunctionsToExport  = @(
 		'Clear-DMConfiguration'
-		'Convert-DMSchemaGuid'
-		'Find-DMObjectCategoryItem'
 		'Get-DMAccessRule'
-		'Get-DMAccessRuleMode'
 		'Get-DMAcl'
 		'Get-DMCallback'
 		'Get-DMContentMode'
-		'Get-DMDomainCredential'
 		'Get-DMDomainData'
 		'Get-DMDomainLevel'
 		'Get-DMExchange'
@@ -67,8 +63,6 @@
 		'Get-DMGroupPolicy'
 		'Get-DMNameMapping'
 		'Get-DMObject'
-		'Get-DMObjectCategory'
-		'Get-DMObjectDefaultPermission'
 		'Get-DMOrganizationalUnit'
 		'Get-DMPasswordPolicy'
 		'Get-DMServiceAccount'
@@ -92,9 +86,7 @@
 		'Invoke-DMUser'
 		'Invoke-DMWmiFilter'
 		'Register-DMAccessRule'
-		'Register-DMAccessRuleMode'
 		'Register-DMAcl'
-		'Register-DMBuiltInSID'
 		'Register-DMCallback'
 		'Register-DMDomainData'
 		'Register-DMDomainLevel'
@@ -109,18 +101,13 @@
 		'Register-DMGroupPolicy'
 		'Register-DMNameMapping'
 		'Register-DMObject'
-		'Register-DMObjectCategory'
 		'Register-DMOrganizationalUnit'
 		'Register-DMPasswordPolicy'
 		'Register-DMServiceAccount'
 		'Register-DMUser'
 		'Register-DMWmiFilter'
-		'Reset-DMDomainCredential'
-		'Resolve-DMAccessRuleMode'
-		'Resolve-DMObjectCategory'
 		'Set-DMContentMode'
 		'Set-DMDomainContext'
-		'Set-DMDomainCredential'
 		'Set-DMRedForestContext'
 		'Test-DMAccessRule'
 		'Test-DMAcl'
@@ -140,7 +127,6 @@
 		'Test-DMUser'
 		'Test-DMWmiFilter'
 		'Unregister-DMAccessRule'
-		'Unregister-DMAccessRuleMode'
 		'Unregister-DMAcl'
 		'Unregister-DMCallback'
 		'Unregister-DMDomainData'
@@ -156,7 +142,6 @@
 		'Unregister-DMGroupPolicy'
 		'Unregister-DMNameMapping'
 		'Unregister-DMObject'
-		'Unregister-DMObjectCategory'
 		'Unregister-DMOrganizationalUnit'
 		'Unregister-DMPasswordPolicy'
 		'Unregister-DMServiceAccount'
@@ -165,13 +150,13 @@
 	)
 
 	# Cmdlets to export from this module
-	CmdletsToExport    = ''
+	CmdletsToExport    = @()
 
 	# Variables to export from this module
-	VariablesToExport  = ''
+	VariablesToExport  = @()
 
 	# Aliases to export from this module
-	AliasesToExport    = ''
+	AliasesToExport    = @()
 
 	# List of all modules packaged with this module
 	ModuleList         = @()

diff --git a/DomainManagement/changelog.md b/DomainManagement/changelog.md
@@ -1,5 +1,16 @@
 # Changelog
 
+## 1.10.257 (2026-06-19)
+
+- Upd: ACLs - removed exclusion from considering Containers.
+- Upd: Get-DMObjectDefaultPermission - removed the command, as part of the AccessRule switch-over to Admf.Core
+- Upd: AccessRules tooling - migrated a large portion of the tooling to Admf.Core
+- Fix: GPLink - deleting links for GPOs that are not accessible will show with an empty name in the test results
+- Fix: GPPermission - fixed error message when using a path-based GPPermission filter and the path does not exist
+- Rem: AccessRuleMode - Migrated component to Admf.Core.
+- Rem: DomainCredential - Migrated component to Admf.Core.
+- Rem: ObjectCategories - Migrated component to Admf.Core.
+
 ## 1.9.249 (2026-02-12)
 
 - Fix: ServiceAccounts - fixed typo.
@@ -255,7 +266,7 @@
 
 ## 1.3.76 (2020-07-31)
 
-- New: Reset-DMDomainCredential - Resets cached credentials for contacting domains.
+- New: Reset-AdcDomainCredential - Resets cached credentials for contacting domains.
 - Upd: Component Group Membership - now can define Group Processing Mode, introducing Constrained and Additive Modes to a group's memberships.
 - Upd: Component Group Membership - configured names may now include SIDs, such as the SIDs of built-in accounts or groups.
 - Fix: Register-DMGroupMembership - explicitly registering empty as $false no longer clears configured settings.

diff --git a/DomainManagement/en-us/strings.psd1 b/DomainManagement/en-us/strings.psd1
@@ -5,26 +5,8 @@
 
 	'Assert-Configuration.NotConfigured'                                = 'No configuration data provided for: {0}' # ($Type -join ", ")
 
-	'Convert-AccessRule.Identity.ResolutionError'                       = 'Failed to convert identity. This generally means a configuration error, especially when referencing the parent as identity.' # 
-
-	'Convert-Principal.Processing'                                      = 'Converting principal: {0}' # $Name
-	'Convert-Principal.Processing.InputNT'                              = 'Input detected as NT: {0}' # $Name
-	'Convert-Principal.Processing.InputSID'                             = 'Input detected as SID: {0}' # $Name
-	'Convert-Principal.Processing.NT.LdapFilter'                        = 'Resolving NT identity via AD using the following filter: {0}' # "(samAccountName=$namePart)"
-	'Convert-Principal.Processing.NTDetails'                            = 'Resolved NT identity: Domain = {0} | Name = {1}' # $domainPart, $namePart
-
-	'Find-DMObjectCategoryItem.ADError'                                 = 'Error retrieving AD Objects for object category {0}' # $Name
-	'Find-DMObjectCategoryItem.Category.NotFound'                       = 'No such object category defined: {0}' # $Name
-
 	'General.Invalid.Input'                                             = 'Invalid input: {1}! This command only accepts output objects from {0}' # 'Test-DMAccessRule', $testItem
 
-	'Get-PermissionGuidMapping.Processing'                              = 'Processing Permission Guids for domain: {0} (This may take a while)' # $identity
-
-	'Get-Principal.Resolution.Failed'                                   = 'Failed to resolve principal: SID {0} | Name {1} | ObjectClass {2} | Domain {3}' # $Sid, $Name, $ObjectClass, $Domain
-	'Get-Principal.Resolution.FailedWithTarget'                         = 'Failed to resolve principal: SID {0} | Name {1} | ObjectClass {2} | Domain {3} | Target {4}' # $Sid, $Name, $ObjectClass, $Domain, $Target
-
-	'Get-SchemaGuidMapping.Processing'                                  = 'Processing Schema Guids for domain: {0} (This may take a while)' # $identity
-
 	'Install-GroupPolicy.CopyingFiles'                                  = 'Copying GPO files for "{0}"' # $Configuration.DisplayName
 	'Install-GroupPolicy.CopyingFiles.Failed'                           = 'Failed to copy the GPO files for "{0}"' # $Configuration.DisplayName
 	'Install-GroupPolicy.DeletingImportFiles'                           = 'Deleting the GPO files for "{0}"' # $Configuration.DisplayName
@@ -180,14 +162,10 @@
 	'Resolve-ContentSearchBase.Include.NotFound'                        = 'Failed to find included ou/container: {0}' # $item.Name
 	'Resolve-ContentSearchBase.Searchbase.Found'                        = 'Resolved searchbase in {2}: {0} | {1}' # $searchBase.SearchScope, $searchBase.SearchBase, $script:domainContext.Fqdn
 
-	'Resolve-DMAccessRuleMode.PathResolution.Failed'                    = 'Unable to resolve path: {0}' # $mode.Path
-
 	'Resolve-GPFilterMapping.Filter.Path.DoesNotExist.SilentlyContinue' = 'Issue resolving filter condition {0}: The specified path {1} could not be found, skipping.' # $Condition.Name, $searchBase
 
 	'Resolve-GPTargetServer.Info.ChangingToPDC'                         = 'Changing target server from "{0}" to the PDC Emulator: "{1}". Group Policy components default to working against the PDC, as most GPO tools (including the default GPMC console) do the same. This behavior can be disabled in the module configuration settings.' # $Server, $domainObject.PDCEmulator
 
-	'Resolve-Identity.ParentObject.NoSecurityPrincipal'                 = 'Error processing parent of {0} : {1} of type {2} is no legal security principal and cannot be assigned permissions!' # $ADObject, $parentObject.Name, $parentObject.ObjectClass
-
 	'Resolve-PolicyRevision.Result.ErrorOnConfigImport'                 = 'Failed to read configuration for {0}: {1}' # $Policy.DisplayName, $result.Error.Exception.Message
 	'Resolve-PolicyRevision.Result.PolicyError'                         = 'Policy object not found in filesystem: {0}. Check existence and permissions!' # $Policy.DisplayName
 	'Resolve-PolicyRevision.Result.Result.SuccessNotYetManaged'         = 'Policy found: {0}. Has not yet been managed, will need to be overwritten.' # $Policy.DisplayName
@@ -202,6 +180,7 @@
 
 	'Test-DMAcl.ADObjectNotFound'                                       = 'The target object could not be found: {0}' # $resolvedPath
 	'Test-DMAcl.NoAccess'                                               = 'Failed to access Acl on {0}' # $resolvedPath
+	'Test-DMAcl.ResolveOwner'                                           = 'Resolving acceptable owners via Privileged Group Set {0} for object {1}' # $Category.Owner.Trim('_'),$ADObject.DistinguishedName
 
 	'Test-DMGPLink.OUNotFound'                                          = 'Failed to find the configured OU: {0} - Please validate your OU configuration and bring your OU estate into the desired state first!' # $ouDatum.OrganizationalUnit
 

diff --git a/DomainManagement/functions/AccessRule/Invoke-DMAccessRule.ps1 b/DomainManagement/functions/AccessRule/Invoke-DMAccessRule.ps1
@@ -89,7 +89,7 @@
 
 							$stillThere = $false
 							foreach ($rule in $aclObject.GetAccessRules($true, $false, [System.Security.Principal.NTAccount])) {
-								if (Test-AccessRuleEquality -Parameters $parameters -Rule1 $rule -Rule2 $changeEntry.ADObject.OriginalRule) {
+								if (Test-AdcAccessRuleEquality -Parameters $parameters -Rule1 $rule -Rule2 $changeEntry.ADObject.OriginalRule) {
 									$stillThere = $true
 									$failedCount = $failedCount + 1
 									break
@@ -102,7 +102,7 @@
 
 								$stillThere = $false
 								foreach ($rule in $aclObject.GetAccessRules($true, $false, [System.Security.Principal.NTAccount])) {
-									if (Test-AccessRuleEquality -Parameters $parameters -Rule1 $rule -Rule2 $changeEntry.ADObject.OriginalRule) {
+									if (Test-AdcAccessRuleEquality -Parameters $parameters -Rule1 $rule -Rule2 $changeEntry.ADObject.OriginalRule) {
 										$stillThere = $true
 										$failedCount = $failedCount + 1
 										break
@@ -123,7 +123,7 @@
 							try {
 								if (-not $changeEntry.Configuration.ObjectType) { throw "Unknown ObjectType! Unable to translate $($changeEntry.Configuration.ObjectTypeName). Validate the configuration and ensure pending schema updates (e.g. Exchange, Skype, etc.) have been applied." }
 								if (-not $changeEntry.Configuration.InheritedObjectType) { throw "Unknown InheritedObjectType! Unable to translate $($changeEntry.Configuration.InheritedObjectTypeName). Validate the configuration and ensure pending schema updates (e.g. Exchange, Skype, etc.) have been applied." }
-								$accessRule = [System.DirectoryServices.ActiveDirectoryAccessRule]::new((Convert-Principal @parameters -Name $changeEntry.Configuration.IdentityReference), $changeEntry.Configuration.ActiveDirectoryRights, $changeEntry.Configuration.AccessControlType, $changeEntry.Configuration.ObjectType, $changeEntry.Configuration.InheritanceType, $changeEntry.Configuration.InheritedObjectType)
+								$accessRule = [System.DirectoryServices.ActiveDirectoryAccessRule]::new((Convert-AdcPrincipal @parameters -Name $changeEntry.Configuration.IdentityReference), $changeEntry.Configuration.ActiveDirectoryRights, $changeEntry.Configuration.AccessControlType, $changeEntry.Configuration.ObjectType, $changeEntry.Configuration.InheritanceType, $changeEntry.Configuration.InheritedObjectType)
 							}
 							catch {
 								$failedCount = $failedCount + 1
@@ -141,7 +141,7 @@
 							try {
 								if (-not $changeEntry.Configuration.ObjectType) { throw "Unknown ObjectType! Unable to translate $($changeEntry.Configuration.ObjectTypeName). Validate the configuration and ensure pending schema updates (e.g. Exchange, Skype, etc.) have been applied." }
 								if (-not $changeEntry.Configuration.InheritedObjectType) { throw "Unknown InheritedObjectType! Unable to translate $($changeEntry.Configuration.InheritedObjectTypeName). Validate the configuration and ensure pending schema updates (e.g. Exchange, Skype, etc.) have been applied." }
-								$accessRule = [System.DirectoryServices.ActiveDirectoryAccessRule]::new((Convert-Principal @parameters -Name $changeEntry.Configuration.IdentityReference), $changeEntry.Configuration.ActiveDirectoryRights, $changeEntry.Configuration.AccessControlType, $changeEntry.Configuration.ObjectType, $changeEntry.Configuration.InheritanceType, $changeEntry.Configuration.InheritedObjectType)
+								$accessRule = [System.DirectoryServices.ActiveDirectoryAccessRule]::new((Convert-AdcPrincipal @parameters -Name $changeEntry.Configuration.IdentityReference), $changeEntry.Configuration.ActiveDirectoryRights, $changeEntry.Configuration.AccessControlType, $changeEntry.Configuration.ObjectType, $changeEntry.Configuration.InheritanceType, $changeEntry.Configuration.InheritedObjectType)
 							}
 							catch {
 								$failedCount = $failedCount + 1