Skip to main content

The v1.15.120 Update - AccessRules & ACL in Configuration

· 3 min read
Friedrich Weinmann
Friedrich Weinmann
Cloud Solution Architect @MSFT

Proud to announce the latest versions of the ADMF, with a wide-ranging update to how AccessRules and ACL are being processed. Both are now available in both Domain and Forest nodes of a Context (and there scoped to the Configuration & Schema Naming Contexts).

A lot of the supporting tools were moved to ADMF.Core - for example, Convert-DMSchemaGuid became Convert-AdcSchemaGuid - to be accessible to both the previous implementation and the new one.

Privileged Group Set​

A completely new feature is in, to help manage some of the issues this change brings: Privileged Group Sets can be used to assign multiple acceptable owners to an ACL. This is intended to solve issues like defining ownership for Domain Controller objects under Sites (which would be owned by the Domain Admins of the Member-domain they come from).

They are calculated once per domain you target, until Context data is reset.

New Managed Name-Inserts​

Two new labels have been added to help referencing items in the Configuration & Schema Naming Contexts:

  • %ConfigurationDN%
  • %SchemaDN%

Both pointing their respective root DistinguishedName of the Naming contexts.

Forest Content Mode​

In the Domain node of an ADMF Configuration Context, we can already define a Domain Content Mode to help configure, which part of the Domain Naming Context we want to take control over. With the introduction of Access Rules and ACL Components to the Forest part, the same need - if to a lesser degree - has been created for a Forest Content Mode.

It works the same as in the Domain Content Mode, if with less options, since things like user objects are of no concern here.

Example Forest Content Mode:

forest/content_mode.psd1

@{
    Mode = 'Constrained'
    Include = @(
        '%ConfigurationDN%'
        '%SchemaDN%'
    )
    Exclude = @()
}

Object Categories in Forest​

Another aspect to managing Access Rules is the ability to define Object Categories. This allows dynamically assigning access configuration based on filter conditions on the object.

The same ability was needed for Access Rules in the Forest node, which is why they are now available there as well. Note, both Domain and Forest node Object Categories are stored centrally and available on both ends (and con potentially conflict). This change merely allows you to collocate the Object Category configuration in the node it is being used.

New Context with AD Access Baseline​

The Access Defaults Component offer when creating a new Context have been updated to include the default ACL & Access Rule settings for the Forest portion of the configuration. To generate a new Context with the default access configuration, run this:

New-AdmfContext -Name Default -Components DefaultAccessRules
info

The default access configuration still does not deploy content modes for domain or the new CM now available for forest. It is recommended to consider and apply both.

You can update already existing Contexts by generating a new, temporary Context and copy the relevant files from the forest node over (every folder that has files beyond just the readme).

Module Versions​

The new release comes with updated module versions:

  • ADMF: 1.15.120
  • ForestManagement: 1.6.85
  • DomainManagement: 1.10.257
  • ADMF.Core: 1.4.20
  • Principal: 1.0.1