microsoft / microsoft/CSS-Exchange
Create a Function to get DSACLS on an object and return a object list of the permissions
@dpaulson45 is already working on this.
Since Dec 6, 2024.
- Dominant language
- PowerShell
- Stars
- 1.3k
- Forks
- 395
- Avg merge
- 14h 7m
- Merged PRs (30d)
- 5
Description
Is your request related to a problem? Please describe.
This might be able to be used in Shared at some point, but would like to create a function that is able to dump out the dsacls on an object and return the permissions set on it in a testable object.
Describe The Request
Recently had a case where Schema Admins was restricted down on the ability to modify the Schema container. We were able to confirm with dsacls that this was the case and the cause rather quickly. However, it would be nice to have SetupAssist.ps1 call this out and other possible locations that we often run into that is unclear within the setup log as to what we are doing.
Additional context
Change this output from dsacls to an object that contains the following properties most likely:
- Owner
- Group
- Access List
- User
- Permissions Set
- Is Inherited
- User
- Access List Sub Objects
PS D:\> dsacls "CN=Schema,CN=Configuration,DC=Solo,DC=com"
Owner: SOLO\Schema Admins
Group: SOLO\Schema Admins
Access list:
Allow NT AUTHORITY\Authenticated Users
SPECIAL ACCESS
READ PERMISSONS
LIST CONTENTS
READ PROPERTY
LIST OBJECT
Allow SOLO\Schema Admins SPECIAL ACCESS
READ PERMISSONS
WRITE PERMISSIONS
CHANGE OWNERSHIP
CREATE CHILD
LIST CONTENTS
WRITE SELF
WRITE PROPERTY
READ PROPERTY
LIST OBJECT
CONTROL ACCESS
Allow NT AUTHORITY\SYSTEM FULL CONTROL
Allow SOLO\Schema Admins Change Schema Master
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
Replicating Directory Changes
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
Replication Synchronization
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
Manage Replication Topology
Allow BUILTIN\Administrators Replicating Directory Changes
Allow BUILTIN\Administrators Replication Synchronization
Allow BUILTIN\Administrators Manage Replication Topology
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
Replicating Directory Changes All
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
Replicating Directory Changes In Filtered Set
Allow BUILTIN\Administrators Replicating Directory Changes All
Allow BUILTIN\Administrators Replicating Directory Changes In Filtered Set
Allow SOLO\Enterprise Read-only Domain Controllers
Replicating Directory Changes
Allow SOLO\Enterprise Read-only Domain Controllers
Replicating Directory Changes All
Allow SOLO\Enterprise Read-only Domain Controllers
Replicating Directory Changes In Filtered Set
Permissions inherited to subobjects are:
Inherited to all subobjects
Allow NT AUTHORITY\Authenticated Users
SPECIAL ACCESS
READ PERMISSONS
LIST CONTENTS
READ PROPERTY
LIST OBJECT
Allow SOLO\Schema Admins SPECIAL ACCESS
READ PERMISSONS
WRITE PERMISSIONS
CHANGE OWNERSHIP
CREATE CHILD
LIST CONTENTS
WRITE SELF
WRITE PROPERTY
READ PROPERTY
LIST OBJECT
CONTROL ACCESS
Allow NT AUTHORITY\SYSTEM FULL CONTROL
The command completed successfully
Create a method that can take the object and test to see if User solo\schema admins contains a list of permissions required to do the job needed and that they are inherited or not.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.