joeware - never stop exploring... :)

AdFind V01.32.00 is officially released…

You can download it from http://www.joeware.net/win/free/tools/adfind.htm

I have posted several glimpses into what this version can do here on the blog, here are the changes:

• Fixed bug in -adcsv, added more data to -adcsv header
• Fixed bug in -noctl
• Fixed bug in SDDL SID Decode
• Added subnets and exch to DN Replace option
• Added support to decode longhorn mode values
• Expanded partitions msDS-Behavior-Version decoded on
• Decode defaultSecurityDescriptor
• Changed usage switches around – see adfind /?
• Added switches -sddl++, -sddlfilter, -sddlnotfilter, -recmute, -noowner, -nogroup, -nodacl, -nosacl, -decsddlacl, -tdca, -tdcas, -tdcgt, -tdcgts
• Allow ACEs in SDDL+/SDDL++ output to be filtered with -mvfilter
• Fixed -maxe so it works for values >1000
• Increased buffer size of -ef and -ff options to 10MB
• Special Exchange specific decode of msExchMailboxSecurityDescriptor with sddl+
• Added shortcuts listpropsets, listpropsetsl, listpropsetscsv, listvwrites, listvwritesl, listvwritescsv, listxrights,listxrightsl,listxrightscsv,exchmbxs, exchme, sdfilter, sdfilterns, explaces

I hope you enjoy it and find it useful. As always, if you encounter issues, please read the USAGE screens carefully and if that doesn’t clear it up, drop me an email. Oh, one thing you don’t have to tell me is that there aren’t examples of every switch, I know that. 🙂 I could end up writing examples of everything and I would end up with more lines of code dedicated to documenting the tool than the functions of the tool, since this is a free tool, that doesn’t make a whole lot of sense from my standpoint.

    joe

AdMod V01.07.00 is officially released…

You can download it from http://www.joeware.net/win/free/tools/admod.htm

As with AdFind, I have posted several glimpses into what this version can do here on the blog. Note that a couple of the previous usage scenarios were modified based on some usage feedback which should help make some things a little less confusing. Please read the USAGE screens completely for this new version, there is a TON of new features and they have oodles[1] of power. Here are the changes:

• Fixed some memory leaks
• Added +- operation, remove all values of multivalue and replace with specified values.
• Added switches -permissive, -xdom, -delegation, -u, -up, -simple, -ssl, -rootdse, -null, -schema, -root, -config, -default, -rb, -upto, -counterstart, -expand, -bmod, -autobase, -po, -e, -ef, -import, -importexclattr, -replacedn, -replacedndelim, -dotcount
• Added TXT## to binary encode
• Added CSV functionality, see admod /sc?
• Broke usage screens into sections
• Output directory type/port info
• Added shortcuts

I hope you enjoy it and find it useful. As always, if you encounter issues, please read the USAGE screens carefully and if that doesn’t clear it up, drop me an email. Oh, one thing you don’t have to tell me is that there aren’t examples of every switch, I know that. 🙂 I could end up writing examples of everything and I would end up with more lines of code dedicated to documenting the tool than the functions of the tool, since this is a free tool, that doesn’t make a whole lot of sense from my standpoint.

  joe

[1] Technical term… 🙂

One popular request I have received over the years for AdFind was to decode the Generalized Time fields like I decode some of the common int8 (64 bit) time fields. I have always said no to this because I don’t consider the fields encoded so not in need of decoding… I see something like

>whenCreated: 20021023015020.0Z
>whenChanged: 20050514161046.0Z

and I have absolutely no issue reading it and understanding what it is telling me. On the other hand I see

>pwdLastSet: 127910506324095116

and I have no clue what that is. Hence, the second is an obvious field to decode while the first doesn’t, IMO, need it…

Well Brian Desmond (fellow MVP) emailed me and asked for this decoding to take place and actually gave an argument for “decoding” Generalized Time fields that I could appreciate and that combined with the fact that I was feeling mellow this morning added it in… So now the Generalized time fields *can* look like

>whenCreated: 2002/10/22-21:50:20 Eastern Daylight Time
>whenChanged: 2005/05/14-12:10:46 Eastern Daylight Time

This is handled through 4 new switches… Why 4? I want to give you (and myself) flexibility. I can’t assume everyone wants to “decode” those fields so I added -tdcgt and -tdcgts which are decode generalized time and decode generalized time in sortable format. I also decided that some people will want to decode both the int8 stuff as well as the generalized time so made it so they can do so with a single switch, either -tdca or -tdcas where the A stands for all.

The second request I added in is the decoding of some well known “delta” int8 values… These are int8 values that don’t have an actual time value but instead are a delta to be used for something or other, examples include:

>forceLogoff: -9223372036854775808
>lockoutDuration: -18000000000
>lockOutObservationWindow: -6000000000
>maxPwdAge: -78624000000000
>minPwdAge: 0

I added the decode of these to the -samdc (SAM Decode) switch functionality so they can now look like:

>forceLogoff: -9223372036854775808 [undefined]
>lockoutDuration: -18000000000 [-30.00 minutes(s)]
>lockOutObservationWindow: -6000000000 [-10.00 minutes(s)]
>maxPwdAge: -78624000000000 [-91.00 day(s)]
>minPwdAge: 0 [0.00 day(s)]

I am finishing up most of the tests of AdFind and AdMod and rereading the usage screens to make sure I didn’t miss changes. After that I have to update the Web Pages (there will be a format change there as it is getting too cumbersome and error prone to maintain the way it is) and I will upload everything for your enjoyment.

   joe