2 posts tagged with "domain"

A minor service update, including a few bugfixes and default settings for access rules.

Fix: PS 5.1, wrong test results when failing to resolve an identity​

In Windows PowerShell 5.1, when an identity could not be resolved, the associated change entry would use the wrong identity - the one from the last ACE IdentityReference resolved before - but delete the correct rule. Irritating when reviewing test results, should no longer happen.

Fix: Cannot find command Convert-DMSchemaGuid​

The 1.15.120 update broke any script using Convert-DMSchemaGuid. This issue was caused by the major restructuring around the AccessRule component, where the command was moved to Admf.Core, in order to be available for the Forest Component as well. The command was renamed to Convert-AdcSchemaGuid, to conform with module naming conventions, without adding an Alias for the old name.

The current update introduces an alias to restore the old name.

Fix: AccessRules - NoFixConfig was ignored​

One of the older bugs reported in 2024 finally got closed: Defining a default AccessRule would generate a "FixConfig" finding, unless specifying the NoFixConfig property in the configuration.

Only ADMF would ignore this configured property.

No Longer.

Updates to DefaultAccess Component​

When creating a new Context, you can specify additional components through the -Components parameter. This creates the new Context with predefined settings, such as DefaultAccess, which provides the default AccessRule settings. Other Components include:

• DefaultSchema: The default schema attributes an AD should come with, to help detect custmizations.
• DefaultGroupMembers: The group membership settings an AD should have by default.
• ExchangeDefaults: The changes installing an Exchange On-Prem setup brings with it.
• ExchangeSPDefaults: The changes installing an Exchange On-Prem setup in Split Permissions mode brings with it.

These Defaults were updated, specifically the DefaultAccess component.

Partial Content for RODCs​

Some of the updates needed to manage RODC-related access rules were added, including an ObjectCategory to target them. Some features are needed for the next version to address the rest:

• Assigning Rights to itself by SamAccountName, as RODCs get assigned rights by identity, rather than SELF.
• Assigning Rights to Parent of Parent. RODCs have several levels of hidden child-objects.
• Add support for Privileged Group Sets in AccessRules. Currently, Privileged Group Sets are only applicable for assigning owners. RODCs however have rights on their associated krbtgt_* user, which needs equivalent handling.

Fixes​

• Virtual Machine Objects may or may not grant their parent rights. That setting has been set to Present: Undefined, so it won't grant permissions, but tolerate them if present.
• Domain Admin assignments were switched to SID-based assignment, to better handle non-English AD deployments (The groups have different names if the first DC of the forest had a non-English OS).
• Domain Update objects - something found deep under the System container - were, configured incorrectly, potentially deleting the last permission for Domain Admins.

Fix: Context Picker in a Remoting Session​

When trying to run ADMF against a domain no Contexts have been configured for, a window pops up - the Context Picker - asking you to pick which Contexts apply.

This would fail when the user has no GUI available - e.g. when on a Core Server or connected via remoting.

Module Versions​

The new release comes with updated module versions:

• ADMF: 1.15.125
• ADMF.Core: 1.4.23

Proud to announce the latest versions of the ADMF, with a wide-ranging update to how AccessRules and ACL are being processed. Both are now available in both Domain and Forest nodes of a Context (and there scoped to the Configuration & Schema Naming Contexts).

• AccessRules in for Forest
• ACL in for Forest

A lot of the supporting tools were moved to ADMF.Core - for example, Convert-DMSchemaGuid became Convert-AdcSchemaGuid - to be accessible to both the previous implementation and the new one.

Privileged Group Set​

A completely new feature is in, to help manage some of the issues this change brings: Privileged Group Sets can be used to assign multiple acceptable owners to an ACL. This is intended to solve issues like defining ownership for Domain Controller objects under Sites (which would be owned by the Domain Admins of the Member-domain they come from).

They are calculated once per domain you target, until Context data is reset.

• Example Configuration
• Example on how to define your own

New Managed Name-Inserts​

Two new labels have been added to help referencing items in the Configuration & Schema Naming Contexts:

• %ConfigurationDN%
• %SchemaDN%

Both pointing their respective root DistinguishedName of the Naming contexts.

Forest Content Mode​

In the Domain node of an ADMF Configuration Context, we can already define a Domain Content Mode to help configure, which part of the Domain Naming Context we want to take control over. With the introduction of Access Rules and ACL Components to the Forest part, the same need - if to a lesser degree - has been created for a Forest Content Mode.

It works the same as in the Domain Content Mode, if with less options, since things like user objects are of no concern here.

Example Forest Content Mode:

forest/content_mode.psd1

@{
    Mode = 'Constrained'
    Include = @(
        '%ConfigurationDN%'
        '%SchemaDN%'
    )
    Exclude = @()
}

Object Categories in Forest​

Another aspect to managing Access Rules is the ability to define Object Categories. This allows dynamically assigning access configuration based on filter conditions on the object.

The same ability was needed for Access Rules in the Forest node, which is why they are now available there as well. Note, both Domain and Forest node Object Categories are stored centrally and available on both ends (and con potentially conflict). This change merely allows you to collocate the Object Category configuration in the node it is being used.

New Context with AD Access Baseline​

The Access Defaults Component offer when creating a new Context have been updated to include the default ACL & Access Rule settings for the Forest portion of the configuration. To generate a new Context with the default access configuration, run this:

New-AdmfContext -Name Default -Components DefaultAccessRules

You can update already existing Contexts by generating a new, temporary Context and copy the relevant files from the forest node over (every folder that has files beyond just the readme).

Module Versions​

The new release comes with updated module versions:

• ADMF: 1.15.120
• ForestManagement: 1.6.85
• DomainManagement: 1.10.257
• ADMF.Core: 1.4.20
• Principal: 1.0.1