Content Mode (Forest)

Synopsis

The Content Mode at the forest level operates similarly to how Content Mode works at the domain level. Its key difference is that it applies to a significantly smaller scope of objects.

info

For an introduction on just what a Content Mode is, please read the documentation on the Content Mode (Domain), as the same concepts apply to this article.

Description

The content mode is defined by the following properties:

• Mode
• Include
• Exclude
• ExcludeComponents

Content Mode is defined in either content_mode.json or content_mode.psd1 directly under the forest folder of a Context.

Mode (string: Additive|Constrained)

The mode defines, whether we consider anything at all beyond what we define:

• Additive: Do not consider anything outside of configuration.
• Constrained: Consider content in OUs defined by the Include & Exclude rules

If multiple Contexts define this property, the last one wins.

Default mode if no Context defines it: Additive

Include/Exclude (string[])

The paths considered to be under management. Each path - distinguishedName - supports regular name resolution.

Everything under Include is considered under management, everything under Exclude is not so. If paths overlap, the innermost applies.

If Exclude is defined but Include is omitted, then implicitly "%ConfigurationDN%" and "%SchemaDN%" are added to Include.

ExcludeComponents (hashtable)

Components to exclude from the Forest Content Mode. By including them here, non-configured objects of that type will no longer get deleted. (Details may vary, depending on the specific Component. See their respective documentation.)

Each entry should use the Component name as Key and a boolean as Value in the hashtable. If the value is considered $true, the Component is excluded. Settings from multiple configuration sets will be merged, rather than fully replacing the old hashtable with a new one.

Supported Components:

• AccessRules: Excluding them will fully skip testing any AD Object not explicitly defined via path rule.
• ACLs: Excluding them will not test only configured values for ownership and inheritance.

Example Configuration

Here is a quick example configuration that takes everything under management:

@{
    Mode = 'Constrained'
    Include = @(
        '%ConfigurationDN%'
        '%SchemaDN%'
    )
    Exclude = @()
}

note

In opposite to the Domain Naming Contexts, changes are assumed to be infrequent and only by highly privileged accounts. Generally, exemptions should be avoided, unintended changes instead investigated and either reverted or added to the configuration.