_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: $Results = Invoke-LDAPQuery @SearcherArguments -LDAPFilter "$GroupFilter"


_raw: Write-Verbose "[Get-RubeusForgeryArgs] filter string: $GroupFilter"


_raw: $DomainSID = $Account.objectsid.Substring(0, $Account.objectsid.LastIndexOf('-'))


_raw: $Account = Convert-LDAPProperty -Properties $Prop


_raw: foreach ($v in $_.Attributes[$a].GetValues([byte[]])) {


_raw: if (($a -eq 'objectsid') -or ($a -eq 'sidhistory') -or ($a -eq 'objectguid') -or ($a -eq 'usercertificate') -or ($a -eq 'ntsecuritydescriptor') -or ($a -eq 'logonhours')) {


_raw: foreach ($a in $_.Attributes.Keys | Sort-Object) {


_raw: if (Get-Member -inputobject $_ -name "Attributes" -Membertype Properties) {


_raw: $Results = Invoke-LDAPQuery @SearcherArguments -LDAPFilter "(|$Filter)"


_raw: Write-Verbose "[Get-RubeusForgeryArgs] filter string: (|$Filter)"


_raw: $DomainPolicy = Get-DomainPolicy -Policy Domain @SearcherArguments


_raw: Write-Error "[Get-RubeusForgeryArgs] Identity argument is required!"


_raw: $Identity | Get-IdentityFilterString | ForEach-Object {


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: if ($PSBoundParameters['Obfuscate']) {$SearcherArguments['Obfuscate'] = $Obfuscate }


_raw: if ($PSBoundParameters['SSL']) { $SearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Switch. Obfuscate the resulting LDAP filter string using hex encoding.


_raw: Switch. Use SSL for the connection to the LDAP server.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: or a dns host name (e.g. windows10.testlab.local). Wildcards accepted.


_raw: A SamAccountName (e.g. WINDOWS10$), DistinguishedName (e.g. CN=WINDOWS10,CN=Computers,DC=testlab,DC=local),


_raw: Return a string containing the arguments required to forge a valid ticket with Rubeus' golden and silver commands.


_raw: $OutObject = New-Object PSObject -Property @{


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True)]


_raw: Convert logonhours LDAP attribute from byte array to readable string.


_raw: elseif ($c -in 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'.ToCharArray()) {


_raw: if ($c -in 'abcdefghijklmnopqrstuvwxyz'.ToCharArray()) {


_raw: foreach ($c in $InputString.ToCharArray()) {


_raw: Write-Verbose "[Get-ObfuscatedFilterString] Filter string obfuscated: $($OutFilter)"


_raw: foreach ($Item in $AvoidHex) {if ($Next.ToLower() -match $Item) {$Skip = $True}}


_raw: if ((Get-Random -Maximum 2) -and (($Include -notmatch ':') -and ($Include -notmatch '<') -and ($Include -notmatch '>'))) {


_raw: $Include = Get-RandomizedCasing -InputString $Next


_raw: $OutFilter = $OutFilter.substring(0, $OutFilter.Length - 2) + '='


_raw: if (($Value -eq '*') -and ($OutFilter.substring($OutFilter.Length - 2, 1) -eq '~')) {


_raw: $OutFilter += $Nops[(Get-Random -Maximum $Nops.Length)]


_raw: if ((Get-Random -Maximum 2) -and ($AvoidNops -notcontains $LastAttribute)) {


_raw: for ($c=0; $c -lt $Value.Length; $c++) {


_raw: $OutValueHash[$Index] = '\{0:x}' -f [System.Convert]::ToUInt32($Value[$Index])


_raw: } While ($OutValueHash.keys -contains $Index)


_raw: $Index = Get-Random -Maximum $($Value.Length - 1)


_raw: if ($OutValueHash.keys -contains $Index) {


_raw: if (($OutValueHash.keys | Measure-Object).Count -ne 0) {


_raw: for ($c=0; $c -lt (Get-Random -Maximum $($Value.Length) -Minimum 1); $c++) {


_raw: $Value = Get-RandomizedCasing -InputString $Value


_raw: if (($Value -match '\*') -and ($OutFilter.substring($OutFilter.Length - 2, 1) -eq '~')) {


_raw: $Include = Get-RandomizedCasing -InputString $Parts[$i]


_raw: foreach ($Item in $AvoidHex) {if ($LastAttribute -notmatch $Item) {$Check += 1}}


_raw: $LastAttribute = $Parts[$i].SubString($Parts[$i].IndexOf('(') + 1).Trim('<').Trim('>').ToLower()


_raw: for ($i=1; $i -lt $Parts.Length; $i++) {


_raw: foreach ($Item in $AvoidHex) {if ($Parts[0].ToLower() -match $Item) {$Skip = $True}}


_raw: if ((Get-Random -Maximum 2) -and (($Include -notmatch ':') -and ($Include -notmatch '<') -and ($Include -notmatch '>'))) {


_raw: $Include = Get-RandomizedCasing -InputString $Parts[0]


_raw: Write-Verbose "[Get-ObfuscatedFilterString] Obfuscating filter string: $($LDAPFilter)"


_raw: [Parameter(Mandatory = $True, ValueFromPipeline = $True)]


_raw: Randomly obfuscate LDAP filter string with random hex characters, randomised casing and random null bytes.


_raw: if ($PSBoundParameters['FindOne']) { $Results = $Searcher.FindOne() }


_raw: Write-Verbose "[Invoke-LDAPQuery] filter string: $($Searcher.filter)"


_raw: $Searcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PageResponseControl.Cookie.Length -eq 0) {


_raw: if ($Response.ResultCode -eq 'Success') {


_raw: if ($LdapFilter -and $LdapFilter -ne '') {


_raw: $SDFlagsControl = New-Object -TypeName System.DirectoryServices.Protocols.SecurityDescriptorFlagControl -ArgumentList $SecurityMasks


_raw: $PageRequestControl = New-Object -TypeName System.DirectoryServices.Protocols.PageResultRequestControl -ArgumentList $MaxResultsToRequest


_raw: $Request = New-Object -TypeName System.DirectoryServices.Protocols.SearchRequest


_raw: $Searcher = Get-DomainSearcher @SearcherArguments -SSL


_raw: $LDAPFilter = Get-ObfuscatedFilterString -LDAPFilter $LDAPFilter


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['Owner']) { $SearcherArguments['SecurityMasks'] = 'Owner' }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Owner']) { $SearcherArguments['Properties'] = '*' }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: The raw DirectoryServices.SearchResult object, if -Raw is enabled.


_raw: Custom PSObject with translated user property fields.


_raw: Switch. Automatically obfuscate LDAP filter string using hex encoding.


_raw: Switch. Use SSL to connect to LDAP Server.


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Retrieve an LDAP query and return the results in a common format.


_raw: Set-DomainObject $Props['samaccountname'] -Set @{'altsecurityidentities'=$AltIDs}


_raw: if ($Props.keys -contains 'altsecurityidentities') {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: Write-Verbose "[Add-DomainAltSecurityIdentity] Using Alternate Identity string: $AltIDString"


_raw: Write-Error "[Add-DomainAltSecurityIdentity] A -Type must be set"


_raw: Write-Error "[Add-DomainAltSecurityIdentity] Certificate altSecurityIdentity requires a Subject"


_raw: $ReversedDomainDN = $DomainDNSplit -join ','


_raw: $DomainDN = Get-DomainDN @DomainDNArguments


_raw: if ($PSBoundParameters['Type'] -eq 'Certificate') {


_raw: $Identity | Get-IdentityFilterString | ForEach-Object {


_raw: Write-Verbose "[Add-DomainAltSecurityIdentity] Setting provided identities: $Identity"


_raw: if ($PSBoundParameters['Credential']) { $DomainDNArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $DomainDNArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $DomainDNArguments['Domain'] = $Domain }


_raw: $Searcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: The external Kerberos account to add, if Kerberos has been specified.


_raw: The certificate subject, if a certificate has been specified.


_raw: The certificate issuer, if a Certificate has been specified.


_raw: The type of identity to add (Certificate or Kerberos).


_raw: or a dns host name (e.g. windows10.testlab.local). Wildcards accepted.


_raw: A SamAccountName (e.g. WINDOWS10$), DistinguishedName (e.g. CN=WINDOWS10,CN=Computers,DC=testlab,DC=local),


_raw: Adds a value to the altSecurityIdentites AD attribute while ensuring the current values remain the same.


_raw: Required Dependencies: Set-DomainObject, Get-DomainDN, Get-IdentityFilterString


_raw: Adds a value to the altSecurityIdentities AD attribute.


_raw: Get-DomainObject -LDAPFilter "(serviceprincipalname=MSSQLSvc*)" @SearcherArguments | select -expand serviceprincipalname | Where-Object {


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: for (serviceprincipalname=MSSQLSvc*) and modifying the relevent SPNs to be directly usable with


_raw: Returns a list of SQL instances for the current domain or the specified domain by searching


_raw: Required Dependencies: Get-DomainObject, Get-DomainDN


_raw: Returns a list of SQL instances for the current domain or the specified domain usable with PowerUPSQL cmdlets.


_raw: Get-DomainObject -SearchBase "CN=Configuration,$DomainDN" -LDAPFilter "(objectCategory=certificationAuthority)" @SearcherArguments


_raw: Write-Verbose "[Get-DomainCACertificates] Error extracting domain DN for '$Domain'"


_raw: Write-Verbose "[Get-DomainCACertificates] Got domain DN: $DomainDN"


_raw: $DomainDN = Get-DomainDN @SearcherArguments


_raw: PS Objects representing the specified domain CA certificates.


_raw: @harmj0y and @tifkin's Certified_Pre-Owned (https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf).


_raw: CN=Configuration,[DomainDN] for (objectCategory=pKIEnrollmentService) as described in


_raw: Returns the CA certificates for the current domain or the specified domain by searching


_raw: Returns the CA certificates for the current domain or the specified domain.


_raw: Get-DomainObject -SearchBase "CN=Configuration,$DomainDN" -LDAPFilter "(objectCategory=pKIEnrollmentService)" @SearcherArguments


_raw: Write-Verbose "[Get-DomainEnrollmentServers] Error extracting domain DN for '$Domain'"


_raw: Write-Verbose "[Get-DomainEnrollmentServers] Got domain DN: $DomainDN"


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: PS Objects representing the specified domain enrollment servers.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Returns the certificate enrollment servers for the current domain or the specified domain by searching


_raw: Required Dependencies: Get-DomainObject, Get-DomainDN


_raw: Returns the certificate enrollment servers for the current domain or the specified domain.


_raw: $OutObject | Add-Member "PrincipalSID" $PrincipalSID


_raw: $OutObject | Add-Member "RecursivePrincipalMembers" $PrincipalMembers


_raw: if ($Member.MemberObjectClass -ne 'group') {


_raw: $Principal | Get-DomainGroupMember -Recurse @SearcherArguments | ForEach-Object {


_raw: if ($OutObject.PrincipalType -eq 'GROUP_OBJECT' -or $OutObject.PrincipalType -eq 'ALIAS_OBJECT') {


_raw: $OutObject | Add-Member "PrincipalType" ($Principal.samaccounttype[0] -as $SamAccountTypeEnum)


_raw: $OutObject | Add-Member "PrincipalName" $Principal.samaccountname[0]


_raw: $OutObject | Add-Member "ActiveDirectoryRights" $ADRights


_raw: $OutObject | Add-Member "ObjectSID" $ObjectSID


_raw: $OutObject | Add-Member "ObjectType" ($Object.samaccounttype[0] -as $SamAccountTypeEnum)


_raw: $OutObject | Add-Member "ObjectName" $Object.samaccountname[0]


_raw: $Principal = $Accounts | ?{(New-Object System.Security.Principal.SecurityIdentifier($_.objectsid[0],0)).Value -eq $PrincipalSID}


_raw: $Object = $Accounts | ?{(New-Object System.Security.Principal.SecurityIdentifier($_.objectsid[0],0)).Value -eq $ObjectSID}


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: Write-Verbose "[Get-DomainLAPSReaders] Using filter: $($Searcher.filter)"


_raw: Write-Verbose "[Get-DomainLAPSReaders] Adding $($_.SecurityIdentifier) to filter"


_raw: if ($Filter -notmatch $_.SecurityIdentifier) {


_raw: Write-Verbose "[Get-DomainLAPSReaders] Adding $($_.ObjectSID) to filter"


_raw: if (!($Filter) -or ($Filter -notmatch $_.ObjectSID)) {


_raw: $Identity | Get-DomainObjectAcl -RightsFilter ReadLAPS @SearcherArguments | ForEach-Object {


_raw: $Identity = (Get-DomainComputer -HasLAPS @SearcherArguments).objectsid


_raw: $Searcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Returns the LAPS reader information in current domain.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: or a dns host name (e.g. windows10.testlab.local). Wildcards accepted.


_raw: A SamAccountName (e.g. WINDOWS10$), DistinguishedName (e.g. CN=WINDOWS10,CN=Computers,DC=testlab,DC=local),


_raw: Finds accounts that can view the LAPS password for machine accounts.


_raw: Write-Verbose "[Get-DomainDN] Error resolving domain DN for '$Domain'"


_raw: Write-Verbose "[Get-DomainDN] Error extracting domain DN for '$Domain'"


_raw: $DCDN = Get-DomainComputer @SearcherArguments -FindOne | Select-Object -First 1 -ExpandProperty distinguishedname


_raw: $DomainDN = "DC=$($Domain -replace '\.',',DC=')"


_raw: if ($PSBoundParameters['Obfuscate']) {$SearcherArguments['Obfuscate'] = $Obfuscate }


_raw: if ($PSBoundParameters['SSL']) { $SearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: A string representing the specified domain distinguished name.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Switch. Obfuscate the resulting LDAP filter string using hex encoding.


_raw: Switch. Use SSL for the connection to the LDAP server.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: is then extracted. Largely stolen from @harmj0y's Get-DomainSID.


_raw: to search for domain controllers through LDAP. The SID of the returned domain controller


_raw: Get-DomainComputer with the -LDAPFilter set to (userAccountControl:1.2.840.113556.1.4.803:=8192)


_raw: Returns the distinguished name for the current domain or the specified domain by executing


_raw: Returns the distinguished name for the current domain or the specified domain.


_raw: Write-Warning "[Set-DomainObjectSD] Make sure you have Owner privileges"


_raw: Write-Warning "[Set-DomainObjectSD] Error setting security descriptor for object '$($Object.Properties.samaccountname)' : $SDBytes"


_raw: Write-Verbose "[Set-DomainObjectSD] Setting 'ntsecuritydescriptor' to '$SDBytes' for object '$($Object.Properties.samaccountname)'"


_raw: $SDBytes = New-Object byte[] ($SD.BinaryLength)


_raw: $SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $SDDLString


_raw: Write-Verbose "[Set-DomainObjectSD] Building raw SD from SDDL string: $SDDLString"


_raw: $ObjectSid = (New-Object System.Security.Principal.SecurityIdentifier($Object.Properties.objectsid[0],0)).Value


_raw: if ($Object.Properties.objectsid -and $Object.Properties.objectsid[0]) {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: $Identity | Get-IdentityFilterString | ForEach-Object {


_raw: Write-Verbose "[Set-DomainObjectSD] Setting provided identities: $Identity"


_raw: $RestoreTargets.keys | Get-IdentityFilterString | ForEach-Object {


_raw: Write-Warning "[Set-DomainObjectSD] Unable to read $InputFile"


_raw: Import-Csv $InputFile | ForEach-Object {


_raw: Write-Verbose "[Set-DomainObjectSD] Reading provided input file: $InputFile"


_raw: $Searcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Restore all of the SD's contained within the file .\backup-sds.csv.


_raw: Set the SD for the charlie.clark user in the testlab.local domain to


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: SDDL String to use to restore the SD for Object(s) specified by Identity.


_raw: Input file containing the SD's to be restored in the CSV format that Get-DomainObjectSD outputs.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: the DACL for the object(s) is returned, but the SACL can be returned with -Sacl.


_raw: Returns the ACLs associated with a specific active directory object. By default


_raw: Write-Warning "[Get-DomainObjectSD] Unable to write $OutFile"


_raw: $Objects | ForEach-Object { Export-Csv -InputObject $_ -Path $OutFile -Append }


_raw: Write-Verbose "[Get-DomainObjectSD] Writing object SD information to $OutFile"


_raw: Write-Warning "[Get-DomainObjectSD] SD for $($Object.samaccountname) is different to the one provided"


_raw: Write-Warning "[Get-DomainObjectSD] SD for $($Object.samaccountname) is the same as the one provided"


_raw: elseif ($PSBoundParameters['Check'] -and $Check -eq $SDDLObject.ObjectSDDL) {


_raw: Write-Verbose "[Get-DomainObjectSD] SD for $($Object.samaccountname) is the same as the one provided"


_raw: if ($SDDLtoCheck.ObjectSDDL -eq $SDDLObject.ObjectSDDL) {


_raw: $SDDLtoCheck = $Checks | Where-Object {$_.ObjectSID -eq $ObjectSid}


_raw: $SDDLObject | Add-Member "ObjectSDDL" $SecurityDescriptor.GetSddlForm(15)


_raw: $SDDLObject | Add-Member "ObjectSID" $ObjectSid


_raw: $SecurityDescriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Object['ntsecuritydescriptor'][0], 0


_raw: $ObjectSid = (New-Object System.Security.Principal.SecurityIdentifier($Object.objectsid[0],0)).Value


_raw: if ($Object.objectsid -and $Object.objectsid[0]) {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: Write-Verbose "[Get-DomainObjectSD] Using filter: $($Searcher.filter)"


_raw: $Checks | ForEach-Object {$Filter += Get-IdentityFilterString $_.ObjectSID}


_raw: if (!($Filter) -and $PSBoundParameters['Check'] -and (Test-Path -Path $Check -PathType Leaf)) {


_raw: $Identity | Get-IdentityFilterString | ForEach-Object {


_raw: $Searcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Restore all of the SD's contained within the file .\backup-sds.csv.


_raw: Set the SD for the charlie.clark user in the testlab.local domain to


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Check the SD with the provided SD and report if it's the same or different.


_raw: Output file of the SD's to be backed up in the CSV format.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: the DACL for the object(s) is returned, but the SACL can be returned with -Sacl.


_raw: Returns the ACLs associated with a specific active directory object. By default


_raw: Write-Verbose "[Get-DomainDCSync] Error disposing of the Results object: $_"


_raw: $Object = Convert-LDAPProperty -Properties $_.Properties


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: else { $Results = $ObjectSearcher.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $ObjectSearcher.FindOne() }


_raw: Write-Verbose "[Get-DomainDCSync] Get-DomainDCSync filter string: $($ObjectSearcher.filter)"


_raw: Write-Verbose "[Get-DomainDCSync] Using additional LDAP filter: $LDAPFilter"


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: if (($NoType) -Or ((($PSBoundParameters['Users']) -And ($Object.samaccounttype -eq 'USER_OBJECT')) -Or (($PSBoundParameters['Computers']) -And ($Object.samaccounttype -eq 'MACHINE_ACCOUNT')))) {


_raw: elseif (!($Check -contains $ObjectSID)) {


_raw: elseif (!($Check -contains $MemberSID)) {


_raw: if (($NoType) -Or ((($PSBoundParameters['Users']) -And ($_.MemberObjectClass -eq 'user')) -Or (($PSBoundParameters['Computers']) -And ($_.MemberObjectClass -eq 'computer')))) {


_raw: if ($_.MemberObjectClass -ne 'group' -and !($Check -contains $MemberSID)) {


_raw: $Object | Get-DomainGroupMember -Recurse @SearcherArguments | ForEach-Object {


_raw: if ($PSBoundParameters['Groups'] -and !($Check -contains $ObjectSID)) {


_raw: if ($Object.objectclass -contains 'group') {


_raw: # Keep track of SIDs that have been added


_raw: if ($TypeFilter -and ($TypeFilter.Trim() -ne '')) {


_raw: elseif (!($Privs.$SID -contains $ACEType)) {


_raw: if ($ADRights -eq 'GenericAll' -or ($ADRights -eq 'ExtendedRight' -and !($ACE.ObjectAceType) -and !($ACE.InheritedObjectAceType))) {


_raw: Get-DomainObjectACL $DomainDN -RightsFilter DCSync @SearcherArguments | ForEach-Object {


_raw: if ($PSBoundParameters['Users'] -or $PSBoundParameters['Computers'] -or $PSBoundParameters['Groups']) {


_raw: # Hash Table for storing DCSync privileges


_raw: Write-Verbose "[Get-DomainDCSync] Retrieved the domain distinguishedname: $DomainDN"


_raw: $DomainDN = Get-DomainDN @DNSearcherArguments


_raw: $ObjectSearcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server; $DNSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain; $DNSearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: Returns accounts that have DCSync privileges in current domain.


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Finds accounts that have DCSync privileges.


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: Write-Verbose "[Get-IdentityFilterString] Extracted domain '$ObjectDomain' from '$IdentityInstance'"


_raw: $ObjectDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/'))


_raw: $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical


_raw: $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join ''


_raw: #Write-Warning "[Get-IdentityFilterString] Unable to retrieve domain searcher for '$IdentityDomain'"


_raw: Write-Verbose "[Get-IdentityFilterString] Extracted domain '$IdentityDomain' from '$IdentityInstance'"


_raw: $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname


_raw: if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {


_raw: elseif ($IdentityInstance -match '^(CN|OU|DC)=') {


_raw: $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')


_raw: $Identity | Where-Object {$_} | ForEach-Object {


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Returns an LDAP search string for provided identites


_raw: or a dns host name (e.g. windows10.testlab.local). Wildcards accepted.


_raw: A SamAccountName (e.g. WINDOWS10$), DistinguishedName (e.g. CN=WINDOWS10,CN=Computers,DC=testlab,DC=local),


_raw: Pulled from @harmj0y's Get-DomainUser function.


_raw: Helper function to retrieve the IdentityFilter string to avoid code duplication.


_raw: Write-Verbose "[Set-DomainRBCD] Error disposing of the Results object: $_"


_raw: Write-Warning "[Set-DomainRBCD] Error setting/replacing properties for object '$($Object.Properties.samaccountname)' : $SDBytes"


_raw: Write-Verbose "[Set-DomainRBCD] Setting 'msds-allowedtoactonbehalfofotheridentity' to '$SDBytes' for object '$($Object.Properties.samaccountname)'"


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: else { $Results = $IdentitySearcher.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $RBCDSearcher.FindOne() }


_raw: Write-Verbose "[Set-DomainRBCD] Set-DomainRBCD filter string: $($RBCDSearcher.filter)"


_raw: Write-Verbose "[Set-DomainRBCD] Using additional LDAP filter: $LDAPFilter"


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: $Identity | Get-IdentityFilterString | ForEach-Object {


_raw: $IdentitySearcher = Get-DomainSearcher @SearcherArguments


_raw: $SDBytes = New-Object byte[] ($SD.BinaryLength)


_raw: $SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $SDDLString


_raw: Write-Verbose "[Set-DomainRBCD] Using SDDL string: $SDDLString"


_raw: Write-Verbose "[Set-DomainRBCD] Appending to SDDL string: (A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($Object.objectsid))"


_raw: $Object = Convert-LDAPProperty -Properties $_.Properties


_raw: Write-Verbose "[Set-DomainRBCD] Appending DelegateFilter: $_"


_raw: $DelegateFrom.Split('|') | Get-IdentityFilterString | ForEach-Object {


_raw: # form SDDL string and resulting SD bytes


_raw: New-DynamicParameter -CreateVariables -BoundParameters $PSBoundParameters


_raw: if ($PSBoundParameters -and ($PSBoundParameters.Count -ne 0)) {


_raw: #bind dynamic parameter to a friendly variable


_raw: $RBCDSearcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Configured RBCD on Computer1 to allow Computer2 and Computer3 delegation rights.


_raw: Set-DomainRBCD Computer1 -DelegateFrom Computer2|Computer3


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Remove the contents of the msds-allowedtoactonbehalfofotheridentity attribute.


_raw: The accounts that are going to be allowed to delegate to this account(s) specified by Identity.


_raw: or a dns host name (e.g. windows10.testlab.local). Wildcards accepted.


_raw: A SamAccountName (e.g. WINDOWS10$), DistinguishedName (e.g. CN=WINDOWS10,CN=Computers,DC=testlab,DC=local),


_raw: Configure resource-based constrained delegation for accounts.


_raw: Write-Verbose "[Get-DomainRBCD] Error disposing of the Results object: $_"


_raw: $RBCDObject | Add-Member "DelegatedDistinguishedName" $Delegated.distinguishedname


_raw: $RBCDObject | Add-Member "DelegatedAccountControl" $Delegated.useraccountcontrol


_raw: $RBCDObject | Add-Member "DelegatedSID" $_.SecurityIdentifier


_raw: $RBCDObject | Add-Member "DelegatedType" $Delegated.samaccounttype


_raw: $RBCDObject | Add-Member "DelegatedName" $Delegated.samaccountname


_raw: $Delegated = Get-DomainObject $_.SecurityIdentifier


_raw: $RBCDObject | Add-Member "ServicePrincipalName" $Object.serviceprincipalname


_raw: $RBCDObject | Add-Member "SourceDistinguishedName" $Object.distinguishedname


_raw: $RBCDObject | Add-Member "SourceAccountControl" $Object.useraccountcontrol


_raw: $RBCDObject | Add-Member "SourceSID" $Object.objectsid


_raw: $RBCDObject | Add-Member "SourceType" $Object.samaccounttype


_raw: $RBCDObject | Add-Member "SourceName" $Object.samaccountname


_raw: $d = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $r, 0


_raw: $r = $Object | select -expand msds-allowedtoactonbehalfofotheridentity


_raw: $Object = Convert-LDAPProperty -Properties $_.Properties


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: else { $Results = $RBCDSearcher.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $RBCDSearcher.FindOne() }


_raw: Write-Verbose "[Get-DomainRBCD] Get-DomainRBCD filter string: $($RBCDSearcher.filter)"


_raw: Write-Verbose "[Get-DomainRBCD] Using additional LDAP filter: $LDAPFilter"


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: $Identity | Get-IdentityFilterString | ForEach-Object {


_raw: New-DynamicParameter -CreateVariables -BoundParameters $PSBoundParameters


_raw: if ($PSBoundParameters -and ($PSBoundParameters.Count -ne 0)) {


_raw: #bind dynamic parameter to a friendly variable


_raw: $RBCDSearcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Returns the RBCD configuration for accounts in current domain.


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: or a dns host name (e.g. windows10.testlab.local). Wildcards accepted.


_raw: A SamAccountName (e.g. WINDOWS10$), DistinguishedName (e.g. CN=WINDOWS10,CN=Computers,DC=testlab,DC=local),


_raw: Finds accounts that are configured for resource-based constrained delegation and returns configuration.


_raw: Write-Verbose "[Find-HighValueAccounts] Error disposing of the Results object: $_"


_raw: $Object = Convert-LDAPProperty -Properties $_.Properties


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: Write-Verbose "[Find-HighValueAccounts] Find-HighValueAccounts filter string: $($ObjectSearcher.filter)"


_raw: Write-Verbose '[Find-HighValueAccounts] Searching for users whose passwords never expire'


_raw: Write-Verbose '[Find-HighValueAccounts] Searching for users who are sensitive and not trusted for delegation'


_raw: # negation of "Accounts that are sensitive and not trusted for delegation"


_raw: Write-Verbose '[Find-HighValueAccounts] Searching for users who can be delegated'


_raw: # inclusion of "Accounts that are disabled"


_raw: Write-Verbose '[Find-HighValueAccounts] Searching for users who are disabled'


_raw: # negation of "Accounts that are disabled"


_raw: Write-Verbose '[Find-HighValueAccounts] Searching for users who are enabled'


_raw: Write-Verbose '[Find-HighValueAccounts] Searching for non-null service principal names'


_raw: if (($MemberName) -and (($Check.Count -eq 0 ) -Or (!($Check.Contains($MemberName))))) {


_raw: if (((!($Users)) -And (!($Computers))) -Or ((($Users) -And ($_.MemberObjectClass -eq 'user')) -Or (($Computers) -And ($_.MemberObjectClass -eq 'computer')))) {


_raw: Get-DomainGroupMember $AdminGroup -Recurse @SearcherArguments | ?{$_.MemberObjectClass -ne 'group'} | ForEach-Object {


_raw: # array of high privileged groups from https://stealthbits.com/blog/fun-with-active-directorys-admincount-attribute/


_raw: $ObjectSearcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: Returns all enabled high value accounts.


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Switch. Return accounts whose passwords do not expire.


_raw: Switch. Return accounts that are marked as 'sensitive and not allowed for delegation'


_raw: Switch. Return accounts that are not marked as 'sensitive and not allowed for delegation'


_raw: Switch. Return accounts that are currently disabled.


_raw: Switch. Return accounts that are currently enabled.


_raw: Switch. Only return user objects with non-null service principal names.


_raw: Finds users that are currently high value accounts as AdminCount doesn't necessarily mean the privileges are current.


_raw: $GpoACL | Add-Member Noteproperty 'ActiveDirectoryRights' $ACL.ActiveDirectoryRights


_raw: $GpoACL | Add-Member Noteproperty 'IdentityReference' $ACL.IdentityReference


_raw: $GpoACL | Add-Member Noteproperty 'GPODisplayName' $gpo.Properties.displayname


_raw: $GpoACL | Add-Member Noteproperty 'ADSPath' $gpo.Properties.adspath


_raw: $ACL = ([ADSI]$gpo.path).ObjectSecurity.Access | ? {$_.ActiveDirectoryRights -match "Write" -and $_.AccessControlType -eq "Allow" -and  $Exclusions -notcontains $_.IdentityReference.toString().split("\")[1] -and $_.IdentityReference -ne "CREATOR OWNER"}


_raw: $Searcher = New-Object System.DirectoryServices.DirectorySearcher


_raw: $Domains = $DomainList | foreach { $_.GetDirectoryEntry() }


_raw: $Exclusions = @('SYSTEM','Domain Admins','Enterprise Admins')


_raw: Returns all GPO delegations on a given GPO.


_raw: Returns all GPO delegations in current forest.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: The GPO display name to query for, wildcards accepted.


_raw: Finds users with write permissions on GPO objects which may allow privilege escalation within the domain.


_raw: Write-Verbose "[Get-DomainTrustMapping] Error: $_"


_raw: if ($Trust.SourceName -and $Trust.TargetName) {


_raw: $Trusts += Get-ForestTrust @ForestTrustArguments


_raw: if ($PSBoundParameters['Credential']) { $ForestTrustArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Forest']) { $ForestTrustArguments['Forest'] = $Forest }


_raw: if ($PsCmdlet.ParameterSetName -eq 'NET') {


_raw: $Trusts = Get-DomainTrust @DomainTrustArguments


_raw: Write-Verbose "[Get-DomainTrustMapping] Enumerating trusts for domain: '$Domain'"


_raw: if ($Domain -and ($Domain.Trim() -ne '') -and (-not $SeenDomains.ContainsKey($Domain))) {


_raw: $CurrentDomain = (Get-Domain -Credential $Credential).Name


_raw: # get the current domain and push it onto the stack


_raw: if ($PSBoundParameters['Credential']) { $DomainTrustArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $DomainTrustArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $DomainTrustArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $DomainTrustArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $DomainTrustArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $DomainTrustArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $DomainTrustArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $DomainTrustArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['LDAPFilter']) { $DomainTrustArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['NET']) { $DomainTrustArguments['NET'] = $NET }


_raw: if ($PSBoundParameters['API']) { $DomainTrustArguments['API'] = $API }


_raw: $Domains = New-Object System.Collections.Stack


_raw: # keep track of domains seen so we don't hit infinite recursion


_raw: Custom PSObject with translated domain API trust result fields.


_raw: A TrustRelationshipInformationCollection returned when using .NET methods.


_raw: Custom PSObject with translated domain LDAP trust result fields (default).


_raw: using the specified alternate credentials, and output everything to a .csv file.


_raw: Map all reachable domain trusts using LDAP, binding to the PRIMARY.testlab.local server for queries


_raw: Get-DomainTrustMapping -Server 'PRIMARY.testlab.local' | Export-CSV -NoTypeInformation trusts.csv


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Map all reachable domain trusts using .NET methods and output everything to a .csv file.


_raw: Get-DomainTrustMapping -NET | Export-CSV -NoTypeInformation trusts.csv


_raw: Map all reachable domain trusts using Win32 API calls and output everything to a .csv file.


_raw: Get-DomainTrustMapping -API | Export-CSV -NoTypeInformation trusts.csv


_raw: Get-DomainTrustMapping | Export-CSV -NoTypeInformation trusts.csv


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Switch. Use .NET queries to enumerate trusts instead of the default LDAP method.


_raw: Switch. Use an API call (DsEnumerateDomainTrusts) to enumerate the trusts instead of the


_raw: object. If the -API flag is specified, the Win32 API DsEnumerateDomainTrusts() call is


_raw: GetAllTrustRelationships() is used on the System.DirectoryServices.ActiveDirectory.Domain


_raw: LDAP is used as well. If the -NET flag is specified, the .NET method


_raw: '(objectClass=trustedDomain)' is used- if any LDAP-appropriate parameters are specified


_raw: mapping all reachable trust relationships. By default, and LDAP search using the filter


_raw: a number of methods, and then enumerates all trusts for each found domain, recursively


_raw: This function will enumerate domain trust relationships for the current domain using


_raw: Required Dependencies: Get-Domain, Get-DomainTrust, Get-ForestTrust


_raw: This function enumerates all trusts for the current domain and then enumerates


_raw: $ForeignGroupMember | Add-Member Noteproperty 'MemberDistinguishedName' $MemberDistinguishedName


_raw: $ForeignGroupMember | Add-Member Noteproperty 'MemberName' $MemberName


_raw: $ForeignGroupMember | Add-Member Noteproperty 'MemberDomain' $MemberDomain


_raw: $ForeignGroupMember | Add-Member Noteproperty 'GroupDistinguishedName' $GroupDistinguishedName


_raw: $ForeignGroupMember | Add-Member Noteproperty 'GroupName' $GroupName


_raw: $ForeignGroupMember | Add-Member Noteproperty 'GroupDomain' $GroupDomain


_raw: $ForeignGroupMember = New-Object PSObject


_raw: if (($_ -match 'CN=S-1-5-21.*-.*') -or ($GroupDomain -ne $MemberDomain)) {


_raw: $MemberDomain = $_.SubString($_.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: #   or if the DN doesn't end with the proper DN for the queried domain


_raw: # filter for foreign SIDs in the cn field for users in another domain,


_raw: $GroupDomain = $GroupDistinguishedName.SubString($GroupDistinguishedName.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: Get-DomainGroup @SearcherArguments | Where-Object { $ExcludeGroups -notcontains $_.samaccountname } | ForEach-Object {


_raw: $ExcludeGroups = @('Users', 'Domain Users', 'Guests')


_raw: if ($PSBoundParameters['Raw']) { $SearcherArguments['Raw'] = $Raw }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated group member property fields.


_raw: queries, and using the specified alternate credentials.


_raw: not in dev.testlab.local. binding to the secondary.dev.testlab.local for


_raw: Return all group members in the dev.testlab.local domain where the member is


_raw: Get-DomainForeignGroupMember -Domain dev.testlab.local -Server secondary.dev.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Return all group members in the dev.testlab.local domain where the member is not in dev.testlab.local.


_raw: Return all group members in the current domain where the group and member differ.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: name to the parent group's domain name, outputting the member if the domains differ.


_raw: then enumerates the members of each group, and compares the member's domain


_raw: Uses Get-DomainGroup to enumerate all groups for the current (or target) domain,


_raw: Required Dependencies: Get-Domain, Get-DomainGroup


_raw: each foreign member. This is a domain's "incoming" access.


_raw: Enumerates groups with users outside of the group's domain and returns


_raw: $ForeignUser | Add-Member Noteproperty 'GroupDistinguishedName' $Membership


_raw: $ForeignUser | Add-Member Noteproperty 'GroupName' $GroupName


_raw: $ForeignUser | Add-Member Noteproperty 'GroupDomain' $GroupDomain


_raw: $ForeignUser | Add-Member Noteproperty 'UserDistinguishedName' $_.distinguishedname


_raw: $ForeignUser | Add-Member Noteproperty 'UserName' $_.samaccountname


_raw: $ForeignUser | Add-Member Noteproperty 'UserDomain' $UserDomain


_raw: # if the group domain doesn't match the user domain, display it


_raw: $UserDomain = $($_.distinguishedname.SubString($UserIndex)) -replace 'DC=','' -replace ',','.'


_raw: $GroupDomain = $($Membership.SubString($Index)) -replace 'DC=','' -replace ',','.'


_raw: Get-DomainUser @SearcherArguments  | ForEach-Object {


_raw: if ($PSBoundParameters['Raw']) { $SearcherArguments['Raw'] = $Raw }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated user property fields.


_raw: using the specified alternate credentials.


_raw: dev.testlab.local domain, binding to the secondary.dev.testlab.local for queries, and


_raw: Return all users in the dev.testlab.local domain who are in groups not in the


_raw: Get-DomainForeignUser -Domain dev.testlab.local -Server secondary.dev.testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Return all users in the current domain who are in groups not in the


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: This domain name is compared to the queried domain, and the user object is


_raw: then calculates the given user's domain name based on the user's distinguishedName.


_raw: Uses Get-DomainUser to enumerate all users for the current (or target) domain,


_raw: Required Dependencies: Get-Domain, Get-DomainUser


_raw: Enumerates users who are in groups outside of the user's domain.


_raw: $FoundForest.GetAllTrustRelationships() | ForEach-Object {


_raw: $FoundForest = Get-Forest @NetForestArguments


_raw: if ($PSBoundParameters['Credential']) { $NetForestArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Forest']) { $NetForestArguments['Forest'] = $Forest }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A TrustRelationshipInformationCollection returned when using .NET methods (default).


_raw: Return trusts for the "external.local" forest using the specified alternate credenitals.


_raw: Get-ForestTrust -Forest "external.local" -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Return trusts for the "external.local" forest.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the forest to query for trusts, defaults to the current forest.


_raw: System.DirectoryServices.ActiveDirectory.Forest returned by Get-Forest.


_raw: forest using number of method using the .NET method GetAllTrustRelationships() on a


_raw: This function will enumerate domain trust relationships for the current (or a remote)


_raw: Return all forest trusts for the current forest or a specified forest.


_raw: $FoundDomain.GetAllTrustRelationships() | ForEach-Object {


_raw: $FoundDomain = Get-Domain @NetSearcherArguments


_raw: # if we're searching for domain trusts through .NET methods


_raw: Write-Verbose "[Get-DomainTrust] Error: $(([ComponentModel.Win32Exception] $Result).Message)"


_raw: $DomainTrust | Add-Member Noteproperty 'TargetGuid' $Info.DomainGuid


_raw: $DomainTrust | Add-Member Noteproperty 'TargetSid' $SidString


_raw: $DomainTrust | Add-Member Noteproperty 'TrustAttributes' $Info.TrustAttributes


_raw: $DomainTrust | Add-Member Noteproperty 'TrustType' $Info.TrustType


_raw: $DomainTrust | Add-Member Noteproperty 'ParentIndex' $Info.ParentIndex


_raw: $DomainTrust | Add-Member Noteproperty 'Flags' $Info.Flags


_raw: $DomainTrust | Add-Member Noteproperty 'TargetNetbiosName' $Info.NetbiosDomainName


_raw: $DomainTrust | Add-Member Noteproperty 'TargetName' $Info.DnsDomainName


_raw: $DomainTrust | Add-Member Noteproperty 'SourceName' $SourceDomain


_raw: Write-Verbose "[Get-DomainTrust] Error: $(([ComponentModel.Win32Exception] $LastError).Message)"


_raw: $Result = $Advapi32::ConvertSidToStringSid($Info.DomainSid, [ref]$SidString);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error()


_raw: $Info = $NewIntPtr -as $DS_DOMAIN_TRUSTS


_raw: $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset


_raw: # create a new int ptr at the given offset and cast the pointer as our result structure


_raw: for ($i = 0; ($i -lt $DomainCount); $i++) {


_raw: # Work out how much to increment the pointer by finding out the size of the structure


_raw: if (($Result -eq 0) -and ($Offset -gt 0)) {


_raw: # Locate the offset of the initial intPtr


_raw: $Result = $Netapi32::DsEnumerateDomainTrusts($TargetDC, $Flags, [ref]$PtrInfo, [ref]$DomainCount)


_raw: # get the trust information from the target server


_raw: # 63 = DS_DOMAIN_IN_FOREST + DS_DOMAIN_DIRECT_OUTBOUND + DS_DOMAIN_TREE_ROOT + DS_DOMAIN_PRIMARY + DS_DOMAIN_NATIVE_MODE + DS_DOMAIN_DIRECT_INBOUND


_raw: # see https://msdn.microsoft.com/en-us/library/ms675976(v=vs.85).aspx for default NULL behavior


_raw: elseif ($Domain -and $Domain.Trim() -ne '') {


_raw: # if we're searching for domain trusts through Win32 API functions


_raw: elseif ($PsCmdlet.ParameterSetName -eq 'API') {


_raw: Write-Verbose "[Get-DomainTrust] Error disposing of the Results object: $_"


_raw: $DomainTrust | Add-Member Noteproperty 'WhenChanged' $Props.whenchanged[0]


_raw: $DomainTrust | Add-Member Noteproperty 'WhenCreated' $Props.whencreated[0]


_raw: $DomainTrust | Add-Member Noteproperty 'TrustDirection' "$Direction"


_raw: $DomainTrust | Add-Member Noteproperty 'TrustAttributes' $($TrustAttrib -join ',')


_raw: $DomainTrust | Add-Member Noteproperty 'TrustType' $TrustType


_raw: # $DomainTrust | Add-Member Noteproperty 'TargetGuid' "{$ObjectGuid}"


_raw: $DomainTrust | Add-Member Noteproperty 'TargetName' $Props.name[0]


_raw: $DomainTrust | Add-Member Noteproperty 'SourceName' $SourceDomain


_raw: $TargetSID = (New-Object System.Security.Principal.SecurityIdentifier($Props.securityidentifier[0],0)).Value


_raw: $ObjectGuid = New-Object Guid @(,$Props.objectguid[0])


_raw: $TargetDomain = $Distinguishedname.SubString(3, $TargetNameIndex-3)


_raw: $SourceDomain = $($Distinguishedname.SubString($SourceNameIndex)) -replace 'DC=','' -replace ',','.'


_raw: $TrustType = Switch ($Props.trusttype) {


_raw: $Direction = Switch ($Props.trustdirection) {


_raw: $TrustAttrib += $TrustAttributes.Keys | Where-Object { $Props.trustattributes[0] -band $_ } | ForEach-Object { $TrustAttributes[$_] }


_raw: foreach ($v in $_.Attributes[$a].GetValues([byte[]])) {


_raw: if (($a -eq 'objectsid') -or ($a -eq 'sidhistory') -or ($a -eq 'objectguid') -or ($a -eq 'usercertificate') -or ($a -eq 'securityidentifier')) {


_raw: foreach ($a in $_.Attributes.Keys | Sort-Object) {


_raw: if (Get-Member -inputobject $_ -name "Attributes" -Membertype Properties) {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: $Results = Invoke-LDAPQuery @LdapSearcherArguments -LDAPFilter "(objectClass=trustedDomain)"


_raw: $SourceSID = Get-DomainSID @NetSearcherArguments


_raw: # if we're searching for domain trusts through LDAP/ADSI


_raw: if ($PsCmdlet.ParameterSetName -eq 'LDAP') {


_raw: if ($Domain -and $Domain.Trim() -ne '') {


_raw: elseif ($PsCmdlet.ParameterSetName -ne 'NET') {


_raw: $SourceDomain = (Get-Domain -Credential $Credential).Name


_raw: if ($PsCmdlet.ParameterSetName -ne 'API') {


_raw: if ($PSBoundParameters['Obfuscate']) {$NetSearcherArguments['Obfuscate'] = $Obfuscate }


_raw: if ($PSBoundParameters['SSL']) { $NetSearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Server']) { $LdapSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $LdapSearcherArguments['Domain'] = $Domain }


_raw: if ($PSBoundParameters['Obfuscate']) {$LdapSearcherArguments['Obfuscate'] = $Obfuscate }


_raw: if ($PSBoundParameters['SSL']) { $LdapSearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $LdapSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $LdapSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $LdapSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $LdapSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $LdapSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['SearchBase']) { $LdapSearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $LdapSearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['LDAPFilter']) { $LdapSearcherArguments['LDAPFilter'] = $LDAPFilter }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated domain API trust result fields.


_raw: A TrustRelationshipInformationCollection returned when using .NET methods.


_raw: Custom PSObject with translated domain LDAP trust result fields (default).


_raw: Return domain trusts for the "prod.testlab.local" domain enumerated through API calls.


_raw: Get-DomainTrust -API -Domain "prod.testlab.local"


_raw: queries, binding to the PRIMARY.testlab.local server for queries, and using the specified


_raw: Return domain trusts for the "prod.testlab.local" domain enumerated through LDAP


_raw: Get-DomainTrust -Domain "prod.testlab.local" -Server "PRIMARY.testlab.local" -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Return domain trusts for the "prod.testlab.local" domain using .NET methods


_raw: Get-DomainTrust -NET -Domain "prod.testlab.local"


_raw: Return domain trusts for the current domain using built in .LDAP methods.


_raw: Switch. Obfuscate the resulting LDAP filter string using hex encoding.


_raw: Switch. Use SSL for the connection to the LDAP server.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Switch. Use .NET queries to enumerate trusts instead of the default LDAP method.


_raw: Switch. Use an API call (DsEnumerateDomainTrusts) to enumerate the trusts instead of the built-in


_raw: Specifies the domain to query for trusts, defaults to the current domain.


_raw: object. If the -API flag is specified, the Win32 API DsEnumerateDomainTrusts() call is


_raw: GetAllTrustRelationships() is used on the System.DirectoryServices.ActiveDirectory.Domain


_raw: LDAP is used as well. If the -NET flag is specified, the .NET method


_raw: '(objectClass=trustedDomain)' is used- if any LDAP-appropriate parameters are specified


_raw: domain using a number of methods. By default, and LDAP search using the filter


_raw: This function will enumerate domain trust relationships for the current (or a remote)


_raw: Required Dependencies: Get-Domain, Get-DomainSearcher, Get-DomainSID, PSReflect


_raw: Return all domain trusts for the current domain or a specified domain.


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-DomainLocalGroupMember] Using threading with threads: $Threads"


_raw: Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $GroupName, $Method, $LogonToken


_raw: Write-Verbose "[Find-DomainLocalGroupMember] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-DomainLocalGroupMember] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-DomainLocalGroupMember] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet


_raw: # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation


_raw: $GroupName = ($AdminSecurityIdentifier.Translate([System.Security.Principal.NTAccount]).Value -split "\\")[-1]


_raw: # Add check if user defaults to/selects "Administrators"


_raw: Param($ComputerName, $GroupName, $Method, $TokenHandle)


_raw: # the host enumeration block we're using to enumerate all servers


_raw: throw '[Find-DomainLocalGroupMember] No hosts found to enumerate'


_raw: Write-Verbose "[Find-DomainLocalGroupMember] TargetComputers length: $($TargetComputers.Length)"


_raw: $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose '[Find-DomainLocalGroupMember] Querying computers in the domain'


_raw: if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName }


_raw: if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack }


_raw: if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem }


_raw: if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter }


_raw: if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated group property fields from WinNT results.


_raw: Custom PSObject with translated group property fields from API results.


_raw: Enumerates the local group memberships for all reachable machines the dev.testlab.local


_raw: Find-DomainLocalGroupMember -Domain testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Enumerates the local group memberships for all reachable machines the dev.testlab.local domain.


_raw: Enumerates the local group memberships for all reachable machines in the current domain.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: for connection to the target domain and target systems.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The collection method to use, defaults to 'API', also accepts 'WinNT'.


_raw: The local group name to query for users. If not given, it defaults to "Administrators".


_raw: Search computers in the specific AD Site name, wildcards accepted.


_raw: Search computers with a specific service pack, wildcards accepted.


_raw: Search computers with a specific operating system, wildcards accepted.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for computers,


_raw: Specifies an LDAP query string that is used to search for computer objects.


_raw: Specifies the domain to query for computers, defaults to the current domain.


_raw: in the domain returned by Get-DomainComputer.


_raw: If -ComputerName is not passed, the default behavior is to enumerate all machines


_raw: Specifies an array of one or more hosts to enumerate, passable on the pipeline.


_raw: By default, the API method is used, but this can be modified with '-Method winnt'


_raw: group (default of Administrators) for each machine using Get-NetLocalGroupMember.


_raw: using Get-DomainComputer, and enumerates the members of the specified local


_raw: This function enumerates all machines on the current (or specified) domain


_raw: Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetLocalGroupMember, New-ThreadedFunction


_raw: for all the targeted machines on the current (or specified) domain.


_raw: Enumerates the members of specified local group (default administrators)


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-LocalAdminAccess] Using threading with threads: $Threads"


_raw: Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $LogonToken


_raw: Write-Verbose "[Find-LocalAdminAccess] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-LocalAdminAccess] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-LocalAdminAccess] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: $Access = Test-AdminAccess -ComputerName $TargetComputer


_raw: # check if the current user has local admin access to this server


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet


_raw: # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation


_raw: # the host enumeration block we're using to enumerate all servers


_raw: throw '[Find-LocalAdminAccess] No hosts found to enumerate'


_raw: Write-Verbose "[Find-LocalAdminAccess] TargetComputers length: $($TargetComputers.Length)"


_raw: $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose '[Find-LocalAdminAccess] Querying computers in the domain'


_raw: if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName }


_raw: if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack }


_raw: if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem }


_raw: if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter }


_raw: if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Computer dnshostnames the current user has administrative access to.


_raw: Finds machines in the testlab.local domain that the user with the specified -Credential


_raw: Find-LocalAdminAccess -Domain testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Finds machines in the dev.testlab.local domain the current user has admin access to.


_raw: Finds machines in the current domain the current user has admin access to.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: for connection to the target domain and target systems.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Switch. Only display found shares that the local user has access to.


_raw: Search computers in the specific AD Site name, wildcards accepted.


_raw: Search computers with a specific service pack, wildcards accepted.


_raw: Search computers with a specific operating system, wildcards accepted.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for computers,


_raw: Specifies an LDAP query string that is used to search for computer objects.


_raw: Specifies the domain to query for computers, defaults to the current domain.


_raw: in the domain returned by Get-DomainComputer.


_raw: If -ComputerName is not passed, the default behavior is to enumerate all machines


_raw: Specifies an array of one or more hosts to enumerate, passable on the pipeline.


_raw: 'Royce Davis "r3dy" <rdavis[at]accuvant.com>'


_raw: 'Thomas McCarthy "smilingraccoon" <smilingraccoon[at]gmail.com>'


_raw: 'Brandon McCann "zeknox" <bmccann[at]accuvant.com>'


_raw: Idea adapted from the local_admin_search_enum post module in Metasploit written by:


_raw: before enumeration, reverting after with Invoke-RevertToSelf.


_raw: then Invoke-UserImpersonation is used to impersonate the specified user


_raw: has local administrator access using Test-AdminAccess. If -Credential is passed,


_raw: using Get-DomainComputer, and for each computer it checks if the current user


_raw: This function enumerates all machines on the current (or specified) domain


_raw: Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Test-AdminAccess, New-ThreadedFunction


_raw: Finds machines on the local domain where the current user has local administrator access.


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-InterestingDomainShareFile] Using threading with threads: $Threads"


_raw: Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $Include, $ExcludedShares, $OfficeDocs, $ExcludeHidden, $FreshEXEs, $CheckWriteAccess, $LogonToken


_raw: Write-Verbose "[Find-InterestingDomainShareFile] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-InterestingDomainShareFile] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-InterestingDomainShareFile] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: # check if the user has access to this path


_raw: if ($ExcludedShares -NotContains $ShareName) {


_raw: # skip this share if it's in the exclude list


_raw: if (($ShareName) -and ($ShareName.Trim() -ne '')) {


_raw: # make sure we get a real share name back


_raw: $Shares = Get-NetShare -ComputerName $TargetComputer


_raw: # get the shares for this host and display what we find


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet


_raw: # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation


_raw: Param($ComputerName, $Include, $ExcludedShares, $OfficeDocs, $ExcludeHidden, $FreshEXEs, $CheckWriteAccess, $TokenHandle)


_raw: # the host enumeration block we're using to enumerate all servers


_raw: throw '[Find-InterestingDomainShareFile] No hosts found to enumerate'


_raw: Write-Verbose "[Find-InterestingDomainShareFile] TargetComputers length: $($TargetComputers.Length)"


_raw: $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose '[Find-InterestingDomainShareFile] Querying computers in the domain'


_raw: if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName }


_raw: if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack }


_raw: if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter }


_raw: if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain }


_raw: $ExcludedShares = @('C$', 'Admin$', 'Print$', 'IPC$'),


_raw: $Include = @('*password*', '*sensitive*', '*admin*', '*login*', '*secret*', 'unattend*.xml', '*.vmdk', '*creds*', '*credential*', '*.config'),


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Searches interesting files in the testlab.local domain using the specified alternate credentials.


_raw: Find-DomainShare -Domain testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('DEV\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Finds 'interesting' files on readable shares on the specified systems.


_raw: Finds 'interesting' files on the current domain.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: for connection to the target domain and target systems.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Switch. Find .EXEs accessed within the last 7 days.


_raw: Switch. Search for office documents (*.doc*, *.xls*, *.ppt*)


_raw: Only return files with a CreationTime greater than this date value.


_raw: Only return files with a LastWriteTime greater than this date value.


_raw: Only return files with a LastAccessTime greater than this date value.


_raw: Specifies share paths to exclude, default of C$, Admin$, Print$, IPC$.


_raw: Specifies one or more specific share paths to search, in the form \\COMPUTER\Share


_raw: Only return files/folders that match the specified array of strings,


_raw: Search computers in the specific AD Site name, wildcards accepted.


_raw: Search computers with a specific service pack, wildcards accepted.


_raw: Search computers with a specific operating system, wildcards accepted.


_raw: e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries.


_raw: Specifies the LDAP source to search through for computers,


_raw: Specifies an LDAP query string that is used to search for computer objects.


_raw: Specifies the domain to query for computers, defaults to the current domain.


_raw: in the domain returned by Get-DomainComputer.


_raw: If -ComputerName is not passed, the default behavior is to enumerate all machines


_raw: Specifies an array of one or more hosts to enumerate, passable on the pipeline.


_raw: user before enumeration, reverting after with Invoke-RevertToSelf.


_raw: is passed, then Invoke-UserImpersonation is used to impersonate the specified


_raw: readhable share, searching for files marching specific criteria. If -Credential


_raw: machine with Get-NetShare. It will then use Find-InterestingFile on each


_raw: using Get-DomainComputer, and enumerates the available shares for each


_raw: This function enumerates all machines on the current (or specified) domain


_raw: Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetShare, Find-InterestingFile, New-ThreadedFunction


_raw: Searches for files matching specific criteria on readable shares


_raw: New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params


_raw: # if we're using threading, kick off the script block with New-ThreadedFunction


_raw: Write-Verbose "[Find-DomainShare] Using threading with threads: $Threads"


_raw: Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $CheckShareAccess, $LogonToken


_raw: Write-Verbose "[Find-DomainShare] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))"


_raw: Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay)


_raw: # sleep for our semi-randomized interval


_raw: ForEach ($TargetComputer in $TargetComputers) {


_raw: Write-Verbose "[Find-DomainShare] Delay: $Delay, Jitter: $Jitter"


_raw: Write-Verbose "[Find-DomainShare] Total number of hosts: $($TargetComputers.count)"


_raw: if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) {


_raw: # only ignore threading if -Delay is passed


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet


_raw: $LogonToken = Invoke-UserImpersonation -Credential $Credential


_raw: Write-Verbose "Error accessing share path $Path : $_"


_raw: # check if the user has access to this path


_raw: # see if we want to check access to this share


_raw: if (($ShareName) -and ($ShareName.trim() -ne '')) {


_raw: $Shares = Get-NetShare -ComputerName $TargetComputer


_raw: # get the shares for this host and check what we find


_raw: $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer


_raw: ForEach ($TargetComputer in $ComputerName) {


_raw: $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet


_raw: # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation


_raw: # the host enumeration block we're using to enumerate all servers


_raw: throw '[Find-DomainShare] No hosts found to enumerate'


_raw: Write-Verbose "[Find-DomainShare] TargetComputers length: $($TargetComputers.Length)"


_raw: $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname


_raw: Write-Verbose '[Find-DomainShare] Querying computers in the domain'


_raw: if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName }


_raw: if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack }


_raw: if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem }


_raw: if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained }


_raw: if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase }


_raw: if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter }


_raw: if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Searches for domain shares in the testlab.local domain using the specified alternate credentials.


_raw: Find-DomainShare -Domain testlab.local -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Find all domain shares in the current domain that the current user has


_raw: Find all domain shares in the current domain.


_raw: The number of threads to use for user searching, defaults to 20.


_raw: Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3


_raw: Specifies the delay (in seconds) between enumerating hosts, defaults to 0.


_raw: for connection to the target domain and target systems.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree).