Skip to main content

Privileged Group Set

Synopsis​

Privileged Group Sets (PGS) allow defining a group of identities, each of which may be a selected identity. PGS are evaluated on a per-Domain basis.

Description​

A Privileged Group Set is essentially a data collector script that is run against a domain the first time it is applied on a setting tested for that domain. It generates two results:

  • SIDs <string[]>: The list of SIDs that are matched. Must be at least one valid sid.
  • DefaultSID <string>: The SID to use for the change if the target is none of the permitted SIDs. This SID should ALSO be included in "SIDs".

When used in a Component that tests identity assignments (and implements PGS), any of the SIDs in SIDs will suffice as a match. In case of a non-match, a create/update change is created, using the SID in DefaultSID.

The SIDs may come from any domain, not just the one targeted.

Example

The default PGS DomainAdminsEx will include the Enterprise Admins and the Domain Admins for every member domain. It uses the SID for the Enterprise Admins as the Default SID. Defining ownership for an object to DomainAdminsEx will satisfy the tests if any Domain Admin within the Forest (or the Enterprise Admins) is assigned ownership. If this is not the case, it will attempt to change ownership to the Enterprise Admins.

Components That Support Privileged Group Sets

Currently, adoption of PGS is limited to:

Using a Privileged Group Set​

All available PGS can be retrieved using this command:

Get-AdcPrivilegedGroupSet

When specifying them in configuration, whereever you would place an Identity (NT Account / SID), use instead __<PGS Name>__. Example configuration:

# ACL (Forest) configuration: Server Objects in a Site usually belong to their home Domain's Domain Admins.
@{
    ObjectCategory = 'cfg_siteserver'
    Owner          = '__DomainAdminsEx__'
}

What SIDs should be part of a GPS is determined once when processing the first configuration setting using it against the domain. Subsequent tests use the cached values.

If later changes applied by ADMF invocations would expand the list of legal SIDs, the PGS will not update until the cache invalidates (at worst after starting a new console).

Default Privileged Group Sets​

By default, ADMF includes the following PGS out of the box:

  • DomainAdmins: Includes the Domain Admin groups of all domains in the forests, irrespecive of localization. Will default to the Domain Admins group of the root domain.
  • DomainAdminsEx: Includes the Domain Admin groups of all domains in the forests, plus the Enterprise Admins, irrespecive of localization. Will default to the Enterprise Admins group.

Defining a Privileged Group Set​

Use the following command to register a new PGS:

Register-AdcPrivilegedGroupSet

This is not exposed through a Context folder, however you can place the definition in a Context's preimport.ps1 or postimport.ps1 if you want to keep PGS and its use together in a single Context. As they are without effect if not configured, it is generally recommended to define them outside the scope of a single Context, to allow consistent access across Contexts.

For example, a good location may be in the import sequence of an ADMF Module.

Here an example implementation of a Privileged Group Set:

$param = @{
    Name        = 'DomainAdminsEx'
    Description = 'Any domain admin group in the Forest or the Enterprise Admins group of the Forest Root Domain. Defaults to the Enterprise Admins of the Forest Root Domain.'
    Code        = {
        param (
            $Parameters,
            $Domain
        )

        $forest = Get-ADForest @Parameters
        $domains = $forest | ForEach-Object Domains | Get-ADDomain @Parameters
        $rootDomain = $domains | Where-Object DnsRoot -EQ $forest.RootDomain
        @{
            SIDs       = @($domains.DomainSID | Format-String '{0}-512') + "$($rootDomain.DomainSID)-519"
            DefaultSID = '{0}-519' -f $rootDomain.DomainSID
        }
    }
}
Register-AdcPrivilegedGroupSet @param

You can test-resolve a PGS using the command Resolve-AdcPrivilegedGroupSet:

Resolve-AdcPrivilegedGroupSet -Type DomainAdminsEx -Server contoso.com

Name​

The name of the PGS. It is later referenced by this name in configuration.

Assuming a PGS is named "PKIAdmins" it would be referenced in configuration as __PKIAdmins__.

Description​

A simple explanation of the PGS. It is strongly recommended to use this to explain what will be in the SIDs and what will become the DefaultSID.

Code​

The scriptblock doing the calculation. It receives two parameters:

  • Parameters <Hashtable>: The server/credential pair used for the current execution.
  • Domain <ADDomain>: The domain object targeted - as returned by Get-ADDomain

The scriptblock should return a hashtable or custom object that has two entries/properties:

  • SIDs <string[]>: The list of SIDs that are matched. Must be at least one valid sid.
  • DefaultSID <string>: The SID to use for the change if the target is none of the permitted SIDs. This SID should ALSO be included in "SIDs".