Skip to main content

The v1.15.125 Update - AccessRules Bugfixes & RODC Defaults

· 4 min read
Friedrich Weinmann
Friedrich Weinmann
Cloud Solution Architect @MSFT

A minor service update, including a few bugfixes and default settings for access rules.

Fix: PS 5.1, wrong test results when failing to resolve an identity​

In Windows PowerShell 5.1, when an identity could not be resolved, the associated change entry would use the wrong identity - the one from the last ACE IdentityReference resolved before - but delete the correct rule. Irritating when reviewing test results, should no longer happen.

Fix: Cannot find command Convert-DMSchemaGuid​

The 1.15.120 update broke any script using Convert-DMSchemaGuid. This issue was caused by the major restructuring around the AccessRule component, where the command was moved to Admf.Core, in order to be available for the Forest Component as well. The command was renamed to Convert-AdcSchemaGuid, to conform with module naming conventions, without adding an Alias for the old name.

The current update introduces an alias to restore the old name.

Fix: AccessRules - NoFixConfig was ignored​

One of the older bugs reported in 2024 finally got closed: Defining a default AccessRule would generate a "FixConfig" finding, unless specifying the NoFixConfig property in the configuration.

Only ADMF would ignore this configured property.

No Longer.

info

Apologies to Andi for this delay - he not just reported it, but even provided a PR to fix it back then that I lost track of, when it could easily have been merged.

Updates to DefaultAccess Component​

When creating a new Context, you can specify additional components through the -Components parameter. This creates the new Context with predefined settings, such as DefaultAccess, which provides the default AccessRule settings. Other Components include:

  • DefaultSchema: The default schema attributes an AD should come with, to help detect custmizations.
  • DefaultGroupMembers: The group membership settings an AD should have by default.
  • ExchangeDefaults: The changes installing an Exchange On-Prem setup brings with it.
  • ExchangeSPDefaults: The changes installing an Exchange On-Prem setup in Split Permissions mode brings with it.

These Defaults were updated, specifically the DefaultAccess component.

info

These changes do not apply to any existing ADMF deployment / Context configuration, merely to newly created Contexts. You can apply the updates to an existing Context by creating a new, temporary one and copying the files over.

Partial Content for RODCs​

Some of the updates needed to manage RODC-related access rules were added, including an ObjectCategory to target them. Some features are needed for the next version to address the rest:

Fixes​

  • Virtual Machine Objects may or may not grant their parent rights. That setting has been set to Present: Undefined, so it won't grant permissions, but tolerate them if present.
  • Domain Admin assignments were switched to SID-based assignment, to better handle non-English AD deployments (The groups have different names if the first DC of the forest had a non-English OS).
  • Domain Update objects - something found deep under the System container - were, configured incorrectly, potentially deleting the last permission for Domain Admins.

Fix: Context Picker in a Remoting Session​

When trying to run ADMF against a domain no Contexts have been configured for, a window pops up - the Context Picker - asking you to pick which Contexts apply.

This would fail when the user has no GUI available - e.g. when on a Core Server or connected via remoting.

Module Versions​

The new release comes with updated module versions:

  • ADMF: 1.15.125
  • ADMF.Core: 1.4.23