microsoft / microsoft/CSS-Exchange

Create a Function to get DSACLS on an object and return a object list of the permissions

Open
#791 0 comments 0 reactions 1 assignee View on GitHub

@dpaulson45 is already working on this.

Since Dec 6, 2024.

Enhancement Setup Setup Assist
Dominant language
PowerShell
Stars
1.3k
Forks
395
Avg merge
14h 7m
Merged PRs (30d)
5

Description

Is your request related to a problem? Please describe.
This might be able to be used in Shared at some point, but would like to create a function that is able to dump out the dsacls on an object and return the permissions set on it in a testable object.

Describe The Request
Recently had a case where Schema Admins was restricted down on the ability to modify the Schema container. We were able to confirm with dsacls that this was the case and the cause rather quickly. However, it would be nice to have SetupAssist.ps1 call this out and other possible locations that we often run into that is unclear within the setup log as to what we are doing.

Additional context
Change this output from dsacls to an object that contains the following properties most likely:

  • Owner
  • Group
  • Access List
    • User
      • Permissions Set
      • Is Inherited
  • Access List Sub Objects
PS D:\> dsacls "CN=Schema,CN=Configuration,DC=Solo,DC=com"
Owner: SOLO\Schema Admins
Group: SOLO\Schema Admins

Access list:
Allow NT AUTHORITY\Authenticated Users
                                      SPECIAL ACCESS
                                      READ PERMISSONS
                                      LIST CONTENTS
                                      READ PROPERTY
                                      LIST OBJECT
Allow SOLO\Schema Admins              SPECIAL ACCESS
                                      READ PERMISSONS
                                      WRITE PERMISSIONS
                                      CHANGE OWNERSHIP
                                      CREATE CHILD
                                      LIST CONTENTS
                                      WRITE SELF
                                      WRITE PROPERTY
                                      READ PROPERTY
                                      LIST OBJECT
                                      CONTROL ACCESS
Allow NT AUTHORITY\SYSTEM             FULL CONTROL
Allow SOLO\Schema Admins              Change Schema Master
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
                                      Replicating Directory Changes
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
                                      Replication Synchronization
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
                                      Manage Replication Topology
Allow BUILTIN\Administrators          Replicating Directory Changes
Allow BUILTIN\Administrators          Replication Synchronization
Allow BUILTIN\Administrators          Manage Replication Topology
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
                                      Replicating Directory Changes All
Allow NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
                                      Replicating Directory Changes In Filtered Set
Allow BUILTIN\Administrators          Replicating Directory Changes All
Allow BUILTIN\Administrators          Replicating Directory Changes In Filtered Set
Allow SOLO\Enterprise Read-only Domain Controllers
                                      Replicating Directory Changes
Allow SOLO\Enterprise Read-only Domain Controllers
                                      Replicating Directory Changes All
Allow SOLO\Enterprise Read-only Domain Controllers
                                      Replicating Directory Changes In Filtered Set

Permissions inherited to subobjects are:
Inherited to all subobjects
Allow NT AUTHORITY\Authenticated Users
                                      SPECIAL ACCESS
                                      READ PERMISSONS
                                      LIST CONTENTS
                                      READ PROPERTY
                                      LIST OBJECT
Allow SOLO\Schema Admins              SPECIAL ACCESS
                                      READ PERMISSONS
                                      WRITE PERMISSIONS
                                      CHANGE OWNERSHIP
                                      CREATE CHILD
                                      LIST CONTENTS
                                      WRITE SELF
                                      WRITE PROPERTY
                                      READ PROPERTY
                                      LIST OBJECT
                                      CONTROL ACCESS
Allow NT AUTHORITY\SYSTEM             FULL CONTROL

The command completed successfully

Create a method that can take the object and test to see if User solo\schema admins contains a list of permissions required to do the job needed and that they are inherited or not.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.