joeware – never stop exploring… :)

Information about joeware mixed with wild and crazy opinions...

3/17/2021

New Versions of AdFind and… GASP…. AdMod Released

by joe @ 10:53 pm. Filed under tech, updates

I have released AdFind V01.55.00 and AdMod V01.22.00. 🙂

AdFind

There are quite a few fixes and additions since the pre-Pandemic release. You can find a breakdown at http://www.joeware.net/freetools/tools/adfind/

AdMod

Surprise, it only took nine years to have a version of this I was comfortable enough to publicly release. Unlike AdFind, AdMod is exceptionally dangerous. If something is wrong it can really cause a lot of pain. So I am much slower to release updates.

The most exciting changes in AdMod in my mind are around the security descriptor functionality. In my opinion it is easier and WAAAAY faster than DSACLS and where DSACLS can only do a single object at a time AdMod will pop the security descriptors on multiple… Though… I will admit that DSACLS has better “you screwed up” assistance. I didn’t add code to catch every single bad/wrong thing that could be done which could result in it looking like it updated something but doesn’t or bail out with an error. It still uses the MSFT SDDL string to Security Descriptor functionality which has its own (sometimes apparently random) rules. I thought about writing the code to build my own binary security Descriptors but decided against it.

When using the Security Descriptor functionality always add –exterr to get the better error messages, and possibly you will need to use –log and look at the admod.log file to see what it thought it was doing. Always test in lab environments to make sure you understand what it will do. Check out the Security Descriptor Shortcuts as they do some of the most common things people need in an easy manner and are less likely to be messed up.

You can find a breakdown on most of the changes/additions at http://www.joeware.net/freetools/tools/admod/

NOTE: You may notice that there are version jumps from whatever versions you may have. Yes, especially for AdMod I have versions that are not publicly released. It isn’t you, it’s me. 🙂

NOTE 2: As of right now I am thinking these will be the last public releases of these tools unless I find some bad bugs or some cool functionality I absolutely want to put in and share. Microsoft’s investment in Active Directory has gotten worse and worse over the last 5 or so years and I don’t see it turning around unless someone there quickly figures out that that all Cloud all the time isn’t the future and I don’t see that happening; it is way better money for them right now to have people paying for Azure. So if they aren’t going to be investing in it and improving it etc there really isn’t a lot to with AdFind and AdMod now other than maybe focusing some energy on making them better for OpenLDAP which, you never know, may happy. Or it could be a whole new pair of tools written from scratch for OpenLDAP. The only think I have really thought about doing is to see how much work it will be to get them to compile successfully and run as x64 binaries. If that works out to not be too much work I will release those binaries.

If this is the end of the updates for these tools I would like to say it has been a pleasure working on them and making them better for folks and I love all of the emails over the years telling me how much time has been saved with them and how much has been accomplished that folks wouldn’t otherwise accomplish. I really loved hearing how people could dump “professional” tools that they had to pay for and use that money for other things.

I have a ton of other ideas I am planning on working on. Which ones I am really going to work on next? I am not sure yet.

joe

Rating 4.60 out of 5

Comments Off [link] [TB]

1/27/2021

AdFind and AdMod Production Releases

by joe @ 2:24 am. Filed under tech, updates

Hi, I just wanted to touch base on the upcoming releases.

I thought I would be releasing new production versions of AdFind and AdMod at the beginning of the month. Obviously that did not happen. I ran into a few bugs I needed to deal with and most recently ran into something I really wanted to dig into…

That thing I wanted to dig into was the –cv / –cva functionality for counting values in multi-valued attributes. Specifically I had a coworker who was having an issue with counting the members of a group that was somewhere between 2-3 million users. AdFind was damn slow doing it.

So those of you who were aware of and actually remember the history, AdFind did not start with CSV output and I kept saying it wouldn’t get it. Then on one of the early Microsoft MVP Summits out in Redmond, Washington in, I think 2005, I was having a chat with fellow MVP Jerold Schulman of the old JSI FAQ web site while we were waiting for a bus and he was pushing on me on how great it would be for AdFind to have CSV, I kept saying no, it isn’t going to happen until I produced an AdFind V2.0 engine and then suddenly, I realized I could actually hack it into the V1.0 engine without completely rewriting the main flow of the engine. It would impact perf but slightly slower overall AdFind functionality (which was already faster than everything else) was a decent tradeoff to get CSV output. I long intended to write that V2.0 engine but I just never really got a chance and with Active Directory being mostly ignored by MSFT now I am unlikely to spend that time doing it now. Anyway, sometime later I came up with the additional –cv hack on top of –csv to count multi-valued attributes. So –cv was a hack on a hack and so extra slow.

Anyway cut to my friend trying to count the members in this large group and AdFind taking a few hours to do it. That isn’t tenable. I had previously written a perl script that could get the count in less than a minute but not everyone has perl installed and I thought, maybe I can optimize some of the code specifically for the –cv functionality.

After digging into it I did in fact find some optimizations and was able to reduce the time for –cv by an order of magnitude.

In testing, against a local LDS instance to get the variability of network traffic out of the way with a group with 1.5 million users I had these perf numbers:

Original V01.54.00

"dn","member"

"CN=largegroup,OU=test,O=FULL","1500000"

Time Elapsed (sec): 7990

Initial optimization tweak to optimize -cv specifically in V01.55.00beta

"dn","member"

"CN=largegroup,OU=test,O=FULL","1500000"

Time Elapsed (sec): 665

So a reduction from 7990 seconds (~2.2 *hours*) down to 665 seconds (11 minutes).

I thought that isn’t bad. But I had noted that when I was watching the processing I realized that all of the time was getting stacked up in some routines that are part of the CSV hack that perform some string manipulations. So I thought, hmmm, I wonder if the std::string functions are maybe not great for performance for large strings (100’s of K to MBs) so I wrote my own string replace function and the processing got SO much faster… I gained another order of magnitude of speed reduction.

Additional optimization by writing my own std::string replace function in V01.55.00beta
"dn","member"

"CN=largegroup,OU=test,O=FULL","1500000"

Time Elapsed (sec): 44

So yep, that is 44 seconds…. From the original initial performance of over 2 hours!

I looked at it some more and then realized I could reduce it even more, likely to get it down below 10 seconds but that would take some serious additional hacking of the flow to pull the count functionality out of the normal flow completely and leverage some underlying implementation details of AD and how it handled large groups but felt it really wasn’t worth the effort. I am good with less than a minute to count the group members for a group that has 1.5 million members as there aren’t many companies out there that have groups of that scale. Groups with members in the tens of thousands can be counted in milliseconds and most companies don’t even have groups that large.

Anyway, with this deeper string functionality change I am doing a lot more tests to make sure I didn’t make some mistake that could be very painful.

So once again, sorry for the delay, but AdFind is getting very close and I am using the new version of AdMod daily at work as well as allowed several co-workers to get it and use it as well and I have heard a couple “OH THAT IS SO COOL” comments for some of the new functionality. Smile

joe

Rating 4.33 out of 5

Comments Off [link] [TB]

12/20/2020

ESAE (aka Red Forest) is finally dead. About time.

by joe @ 3:27 pm. Filed under tech

https://docs.microsoft.com/en-us/security/compass/esae-retirement

”We have found that ESAE projects are often detrimental to overall security posture as they are high cost, difficult to use and support, and provide a limited set of security (only Active Directory administrators and only preventive controls).”

What took so long to figure that out? Oh, they knew, they just didn’t have something else to sell.

Some of the ideas make some sense, a lot of it doesn’t. I never thought the cost value equation made sense. It assumes you run your main forest for shit with idiots and that you somehow magically do it right with intelligent people for the Red Forest. This was all designed by consultants who don’t perform any long term support of AD anywhere and likely never have. Now don’t get me wrong, there are people who do understand AD Support and have set up some Red Forest Hybrids that are worth looking at. If you want something like that, talk to my friend and co-author Brian Desmond. Brian actually has a clue how AD Security works and he can set up something realistic for you that actually works and is manageable.

My all time favorite moment when there was a special Red Forest MCS team in a Fortune X company setting up Red Forest and I heard the MCS guy say to someone, “Just add the Gold card ID from the Red Forest to the destination forest Domain Admins group…”. I started laughing and walked away knowing I would never speak to that person as it wasn’t my job to teach MCS Consultants, again. The Red Forest implementations I saw showed that the MCS people positively don’t actually know how AD Security works.

I don’t even know why MSFT is talking about a Cloud model for this now. They don’t even give a shit about AD anymore, they think everyone is just going to go to Azure AD (bad assumption), so AD is currently dying on the vine. I have found multiple bugs in AD and ADLDS and those DCRs/Bug filings go no where. Hopefully they eventually realize not everyone is going full Cloud. Hopefully they will figure out that the real sweet spot where large companies will eventually land is a Cloud hybrid model. A model where they have the ability to transparently shift workloads between on-premises internal “Cloud” and the hyper-converged “Cloud” depending on what makes the most sense for the workload requirements and for cost effectiveness.

joe

Rating 4.33 out of 5

[Comments (7)] [link] [TB]

Beta versions of AdFind V01.53.00 and AdMod V01.21.00

by joe @ 2:45 pm. Filed under tech

For a short time only I have the latest daily build Beta versions of AdFind V01.53.00 and AdMod V01.21.00 out on the joeware website at

https://www.joeware.net/downloads/beta/20201231_expire/

As the folder name implies, these versions will expire on December 31, 2020 UTC.

These may actually be the Release Candidates unless I find something in the next week that concerns me. Smile

joe

Rating 4.33 out of 5

Comments Off [link] [TB]

11/23/2020

A Glimpse At Some AdMod Security Descriptor Fun…

by joe @ 12:45 am. Filed under tech

So say you hate Account Operators group as much as I do and want to just strip the AO ACEs off of objects… Then this output below is something you will like… Less than 30 seconds to strip all AO access off of 20 objects remotely from a non-domain joined PC over wireless to a low power virtual DC. How long to do that with DSACLS? ADUC? ADAC? Or even PowerShell if you are brave enough to do Security Descriptors with PowerShell especially with Security Principals that don’t exist on Windows 10.

Note: I am finally updating AdMod usage which means I am getting close to a public release. First public release since 2012. Not that I haven’t been updating it all along and personally been using the updated versions (I call the joe only versions BAdMon – Beta AdMod), I am just a TON more careful with AdMod than AdFind because it can hurt you, it can hurt you bad. While everyone should be testing everything they do before doing it in production, I don’t even want to help someone to blow up their environments so try to do things as safely as possible.

[Sun 11/22/2020 22:18:21.39]
E:\DEV\cpp\vs\AdMod\Debug>adfind -rb cn=users -dsq | adfind -jsdenl ;;;;;"account operators"

AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) October 2020

Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)

dn:CN=Users,DC=lockout,DC=test,DC=loc
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];user;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];group;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];inetOrgPerson;;BUILTIN\Account Operators

dn:CN=WinRMRemoteWMIUsers__,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Guest,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Domain Computers,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Cert Publishers,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Domain Users,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Domain Guests,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=RAS and IAS Servers,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Allowed RODC Password Replication Group,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Enterprise Read-only Domain Controllers,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Read-only Domain Controllers,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Domain Controllers,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Administrator,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Denied RODC Password Replication Group,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Enterprise Admins,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Domain Admins,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Group Policy Creator Owners,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Schema Admins,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=krbtgt,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=ADACL-Root-ReanimateTombstone,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=dnsadmin,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=monitortest,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Cloneable Domain Controllers,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Protected Users,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Key Admins,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=Enterprise Key Admins,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

dn:CN=DefaultAccount,CN=Users,DC=lockout,DC=test,DC=loc
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators

27 Objects returned

[Sun 11/22/2020 22:18:26.60]
E:\DEV\cpp\vs\AdMod\Debug>adfind -rb cn=users -dsq | admod SD##ntsecuritydescriptor::{GETSD}{-D=(*;*;*;*;*;AO)}

AdMod V01.21.00cppBETA Joe Richards (support@joeware.net) November 2020

DN Count: 27

More DNs than allowed for by safety setting of 10
Use safety parameter to specify larger safety size.

The command did not complete successfully

[Sun 11/22/2020 22:19:03.67]
E:\DEV\cpp\vs\AdMod\Debug>adfind -rb cn=users -dsq | admod SD##ntsecuritydescriptor::{GETSD}{-D=(*;*;*;*;*;AO)} -unsafe

AdMod V01.21.00cppBETA Joe Richards (support@joeware.net) November 2020

DN Count: 27
Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)
Modifying specified objects…
   DN: CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=WinRMRemoteWMIUsers__,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Guest,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Domain Computers,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Cert Publishers,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Domain Users,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Domain Guests,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=RAS and IAS Servers,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Allowed RODC Password Replication Group,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Enterprise Read-only Domain Controllers,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Read-only Domain Controllers,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Domain Controllers,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Administrator,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Denied RODC Password Replication Group,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Enterprise Admins,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Domain Admins,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Group Policy Creator Owners,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Schema Admins,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=krbtgt,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=ADACL-Root-ReanimateTombstone,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=dnsadmin,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=monitortest,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Cloneable Domain Controllers,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Protected Users,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Key Admins,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=Enterprise Key Admins,CN=Users,DC=lockout,DC=test,DC=loc…
   DN: CN=DefaultAccount,CN=Users,DC=lockout,DC=test,DC=loc…

The command completed successfully

[Sun 11/22/2020 22:19:32.58]
E:\DEV\cpp\vs\AdMod\Debug>adfind -rb cn=users -dsq | adfind -jsdenl ;;;;;"account operators"

AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) October 2020

Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)

dn:CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=WinRMRemoteWMIUsers__,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Guest,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Domain Computers,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Cert Publishers,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Domain Users,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Domain Guests,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=RAS and IAS Servers,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Allowed RODC Password Replication Group,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Enterprise Read-only Domain Controllers,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Read-only Domain Controllers,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Domain Controllers,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Administrator,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Denied RODC Password Replication Group,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Enterprise Admins,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Domain Admins,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Group Policy Creator Owners,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Schema Admins,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=krbtgt,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=ADACL-Root-ReanimateTombstone,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=dnsadmin,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=monitortest,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Cloneable Domain Controllers,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Protected Users,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Key Admins,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=Enterprise Key Admins,CN=Users,DC=lockout,DC=test,DC=loc

dn:CN=DefaultAccount,CN=Users,DC=lockout,DC=test,DC=loc

27 Objects returned

[Sun 11/22/2020 22:19:40.82]

Rating 4.33 out of 5

Comments Off [link] [TB]

11/22/2020

Looking for the proper Holiday Ornament for this very tricky year?

by joe @ 1:59 am. Filed under general

Look no further, check out the custom ornament my niece put together just for 2020.

https://www.etsy.com/shop/CustomDesignByBrooke

Grinch Stink Stank Stunk Ornament image 0

ENJOY!

joe

Rating 4.00 out of 5

Comments Off [link] [TB]

10/10/2020

9 out of 10 hackers prefer AdFind for AD Recon…

by joe @ 2:51 pm. Filed under general

https://thedfirreport.com/2020/10/08/ryuks-return/

This isn’t the first I have read about AdFind being used by bad actors, it won’t be the last.

I first started hearing about AdFind being used in exploits and recon work roughly 2.5 or so years ago when IR teams and Security Researchers started emailing me about it and asking for hashes of older versions etc. AdFind is not, by far, the first of my tools used by the bad actors, it won’t be the last. I have had several tools used by them over the years and have shown up in malware packages as well as anti-hacker toolkits (none of which I ever get any sort of kickback for – so you know who you are that make money off of me, wth???). I mean come on, who can blame them? The tools are fast and they work and don’t require a huge infrastructure around them to function and will often work in environments when other heavier tools based on fat frameworks go sideways. Perfect for Admins trying to get shit done and hackers trying to get into shit, quickly.

With that being said, dear hackers… if you are making money off my tools, how about you do me a solid and do some donating by clicking that Pay Pal button up in the corner?? I mean seriously, if you can score a few million USD in ransom you can easily kick me $100k or so right? Seriously. It is only fair.

And you pen testers and other anti-hackers, how about you too step up and donate.

joe

Rating 4.78 out of 5

Comments Off [link] [TB]

8/18/2020

Beta version of AdMod and DACLs…

by joe @ 12:57 am. Filed under tech

Thoughts?

[Tue 08/18/2020 0:24:46.40]
E:\DEV\cpp\vs\AdMod\Debug>adfind -f ou=tobedeleted -jsdenl

AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) July 2020

Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)
Base DN: DC=lockout,DC=test,DC=loc

dn:OU=tobedeleted,DC=lockout,DC=test,DC=loc
[OWNER] LOCKOUT\Domain Admins
[GROUP] LOCKOUT\Domain Admins
[DACL] (FLAGS:INHERIT)
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];inetOrgPerson;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];computer;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];group;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];printQueue;;BUILTIN\Printer Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];user;;BUILTIN\Account Operators
[DACL] ALLOW;;[FC];;;LOCKOUT\Domain Admins
[DACL] ALLOW;;[LIST CHILDREN][READ PROP][LIST OBJ][READ];;;NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
[DACL] ALLOW;;[LIST CHILDREN][READ PROP][LIST OBJ][READ];;;NT AUTHORITY\Authenticated Users
[DACL] ALLOW;;[FC];;;NT AUTHORITY\SYSTEM

1 Objects returned

[Tue 08/18/2020 0:24:51.87]
E:\DEV\cpp\vs\AdMod\Debug>adfind -f ou=tobedeleted -daclpipe | admod "SD##ntsecuritydescriptor::{{.}}{+D=AI(A;;[CR CHILD][DEL CHILD];;;WD)}{+O=EA}{-D=(*;*;*;*;*;AO)}{-D=(*;*;*;*;*;AO)}{+D=(DENY;;[del tree][del];;;everyone)}"

AdMod V01.21.00cppBETA Joe Richards (support@joeware.net) August 2020

DN Count: 1
Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)

Modifying specified objects…
DN: OU=tobedeleted,DC=lockout,DC=test,DC=loc…

The command completed successfully

[Tue 08/18/2020 0:25:02.79]
E:\DEV\cpp\vs\AdMod\Debug>adfind -f ou=tobedeleted -jsdenl

AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) July 2020

Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)
Base DN: DC=lockout,DC=test,DC=loc

dn:OU=tobedeleted,DC=lockout,DC=test,DC=loc
[OWNER] LOCKOUT\Enterprise Admins
[GROUP] LOCKOUT\Domain Users
[DACL] (FLAGS:INHERIT)
[DACL] DENY;;[DEL TREE][DEL];;;Everyone
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];printQueue;;BUILTIN\Printer Operators
[DACL] ALLOW;;[FC];;;LOCKOUT\Domain Admins
[DACL] ALLOW;;[CR CHILD][DEL CHILD];;;Everyone
[DACL] ALLOW;;[LIST CHILDREN][READ PROP][LIST OBJ][READ];;;NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
[DACL] ALLOW;;[LIST CHILDREN][READ PROP][LIST OBJ][READ];;;NT AUTHORITY\Authenticated Users
[DACL] ALLOW;;[FC];;;NT AUTHORITY\SYSTEM

1 Objects returned

Rating 4.00 out of 5

Comments Off [link] [TB]

7/9/2020

Clearing the DENY DELETE EVERYONE from OUs with AdFind|AdMod

by joe @ 4:17 pm. Filed under tech

Another common thing that people want to do from the command line with AdFind | AdMod is to clear the “Protect object from accidental deletion” setting that is implemented with a deny delete ACE on the object, specifically

[DACL] DENY;;[DEL TREE][DEL];;;Everyone

As mentioned previously, the Security Descriptor is a BLOB so you have to deal with an whole DACL at once. This is a pretty easy mod though.

You simply have to remove the “(D;;DTSD;;;WD)” portion of the SDDL.

That looks like:

adfind -b <BASE> –f <FILTER> ntsecuritydescriptor -rawsddlexpl -rawsddlnl -onlydacl -csvmvdelim "|" -adcsv | admod SD##ntsecuritydescriptor::{{.:r:(D;;DTSD;;;WD):}}

So for example:

[Thu 07/09/2020 14:46:27.47]
E:\DEV\cpp\vs\AdMod\Debug>
[Thu 07/09/2020 14:49:18.38]
E:\DEV\cpp\vs\AdMod\Debug>adfind -f ou=tobedeleted -jsdenl

AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) May 2020

Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)
Base DN: DC=lockout,DC=test,DC=loc

dn:OU=tobedeleted,DC=lockout,DC=test,DC=loc
[OWNER] LOCKOUT\Domain Admins
[GROUP] LOCKOUT\Domain Admins
[DACL] (FLAGS:INHERIT)
[DACL] DENY;;[DEL TREE][DEL];;;Everyone
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];inetOrgPerson;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];computer;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];group;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];printQueue;;BUILTIN\Printer Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];user;;BUILTIN\Account Operators
[DACL] ALLOW;;[FC];;;LOCKOUT\Domain Admins
[DACL] ALLOW;;[LIST CHILDREN][READ PROP][LIST OBJ][READ];;;NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
[DACL] ALLOW;;[LIST CHILDREN][READ PROP][LIST OBJ][READ];;;NT AUTHORITY\Authenticated Users
[DACL] ALLOW;;[FC];;;NT AUTHORITY\SYSTEM

1 Objects returned

[Thu 07/09/2020 14:50:50.40]
E:\DEV\cpp\vs\AdMod\Debug>adfind -f ou=tobedeleted ntsecuritydescriptor -rawsddlexpl -rawsddlnl -onlydacl -csvmvdelim "|" -adcsv | admod SD##ntsecuritydescriptor::{{.:r:(D;;DTSD;;;WD):}}

AdMod V01.21.00cppBETA Joe Richards (support@joeware.net) June 2020

DN Count: 1
Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)

Modifying specified objects…
DN: OU=tobedeleted,DC=lockout,DC=test,DC=loc…

The command completed successfully

[Thu 07/09/2020 14:51:05.75]
E:\DEV\cpp\vs\AdMod\Debug>adfind -f ou=tobedeleted -jsdenl

AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) May 2020

Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)
Base DN: DC=lockout,DC=test,DC=loc

dn:OU=tobedeleted,DC=lockout,DC=test,DC=loc
[OWNER] LOCKOUT\Domain Admins
[GROUP] LOCKOUT\Domain Admins
[DACL] (FLAGS:INHERIT)
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];inetOrgPerson;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];computer;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];group;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];printQueue;;BUILTIN\Printer Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];user;;BUILTIN\Account Operators
[DACL] ALLOW;;[FC];;;LOCKOUT\Domain Admins
[DACL] ALLOW;;[LIST CHILDREN][READ PROP][LIST OBJ][READ];;;NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
[DACL] ALLOW;;[LIST CHILDREN][READ PROP][LIST OBJ][READ];;;NT AUTHORITY\Authenticated Users
[DACL] ALLOW;;[FC];;;NT AUTHORITY\SYSTEM

1 Objects returned

And what if you want to put it back?

[Thu 07/09/2020 14:51:15.15]
E:\DEV\cpp\vs\AdMod\Debug>adfind -f ou=tobedeleted -jsdenl

AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) May 2020

Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)
Base DN: DC=lockout,DC=test,DC=loc

dn:OU=tobedeleted,DC=lockout,DC=test,DC=loc
[OWNER] LOCKOUT\Domain Admins
[GROUP] LOCKOUT\Domain Admins
[DACL] (FLAGS:INHERIT)
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];inetOrgPerson;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];computer;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];group;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];printQueue;;BUILTIN\Printer Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];user;;BUILTIN\Account Operators
[DACL] ALLOW;;[FC];;;LOCKOUT\Domain Admins
[DACL] ALLOW;;[LIST CHILDREN][READ PROP][LIST OBJ][READ];;;NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
[DACL] ALLOW;;[LIST CHILDREN][READ PROP][LIST OBJ][READ];;;NT AUTHORITY\Authenticated Users
[DACL] ALLOW;;[FC];;;NT AUTHORITY\SYSTEM

1 Objects returned

[Thu 07/09/2020 14:53:08.62]
E:\DEV\cpp\vs\AdMod\Debug>adfind -f ou=tobedeleted ntsecuritydescriptor -rawsddlexpl -rawsddlnl -onlydacl -csvmvdelim "|" -adcsv | admod SD##ntsecuritydescriptor::{{.:r:AI(:AI(D;;DTSD;;;WD)(}}

AdMod V01.21.00cppBETA Joe Richards (support@joeware.net) June 2020

DN Count: 1
Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)

Modifying specified objects…
DN: OU=tobedeleted,DC=lockout,DC=test,DC=loc…

The command completed successfully

[Thu 07/09/2020 14:53:16.31]
E:\DEV\cpp\vs\AdMod\Debug>adfind -f ou=tobedeleted -jsdenl

AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) May 2020

Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)
Base DN: DC=lockout,DC=test,DC=loc

dn:OU=tobedeleted,DC=lockout,DC=test,DC=loc
[OWNER] LOCKOUT\Domain Admins
[GROUP] LOCKOUT\Domain Admins
[DACL] (FLAGS:INHERIT)
[DACL] DENY;;[DEL TREE][DEL];;;Everyone
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];inetOrgPerson;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];computer;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];group;;BUILTIN\Account Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];printQueue;;BUILTIN\Printer Operators
[DACL] OBJ ALLOW;;[CR CHILD][DEL CHILD];user;;BUILTIN\Account Operators
[DACL] ALLOW;;[FC];;;LOCKOUT\Domain Admins
[DACL] ALLOW;;[LIST CHILDREN][READ PROP][LIST OBJ][READ];;;NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
[DACL] ALLOW;;[LIST CHILDREN][READ PROP][LIST OBJ][READ];;;NT AUTHORITY\Authenticated Users
[DACL] ALLOW;;[FC];;;NT AUTHORITY\SYSTEM

1 Objects returned

joe

Rating 4.60 out of 5

Comments Off [link] [TB]

How Do I Make an Object’s Security Descriptor Inheritable and also while I am at it… resetting from AdminSDHolder…

by joe @ 12:18 pm. Filed under tech

I recently received an email of:

<SNIP>

I have a bunch of previously sensitive&protected accounts where I like to enable inheritance..

Is it possible to remove protected inheritance flag with admod?

<SNIP>

The quick answer to the direct question is yes, there is an easy way to turn inheritance back on for an arbitrary object or set of objects with AdFind|Admod.

You need to send the current Security Descriptor of the object into AdMod and ask it to tweak the DACL flags. Well really you only need the Explicit DACL portion of the Security Descriptor, not the rest. But it works with it nibbled down to just that or not.

So something like:

adfind -s <base> -f <filter> ntsecuritydescriptor -rawsddlexpl -rawsddlnl -onlydacl -adcsv | admod SD##ntsecuritydescriptor::{{.:$r$D:PAI$D:AI}} -exterr

For example:

adfind -default -f "&(objectclass=user)(admincount=1)" ntsecuritydescriptor -rawsddlexpl -rawsddlnl -onlydacl -adcsv | admod SD##ntsecuritydescriptor::{{.:$r$D:PAI$D:AI}} -exterr

The reason you have to pass the current security descriptor (or at least the DACL portion of the Security Descriptor) is because the Security Descriptor is a BLOB (chunk of binary) and each ACE is buried somewhere in that BLOB. You cannot just ask AD to add or remove an ACE or update just the flags so you have to update the entire DACL portion of the Security Descriptor at a minimum.

So that question is answered, or is it? As you think about this a little longer, the adminSDHolder functionality doesn’t just protect the DACL of an object, it also rewrites the Explicit ACEs as well. Otherwise, by default, Account Operators[1] could update Domain Admin accounts.

Luckily there is a place where the correct default DACL is kept for most objectclasses, the schema. That is the defaultSecurityDescriptor attribute on the classSchema objectclass definition object. The defaultSecurityDescriptor can be a full Security Descriptor but in only a few cases does it, for example, list a value for the Owner, Group, or SACL by default (not that you can’t modify that to your heart’s delight).

Example of defaultSecurityDescriptor:

[Tue 07/07/2020 21:52:16.82]
E:\DEV\cpp\vs\AdMod\Debug>adfind -sc s:user defaultsecuritydescriptor

AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) May 2020

Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)
Base DN: CN=Schema,CN=Configuration,DC=lockout,DC=test,DC=loc

dn:CN=User,CN=Schema,CN=Configuration,DC=lockout,DC=test,DC=loc
> defaultSecurityDescriptor: D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)(A;;RPLCLORC;;;PS)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a56-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;RPWP;77B5B886-944A-11d1-AEBD-0000F80367C1;;PS)(OA;;RPWP;E45795B2-9455-11d1-AEBD-0000F80367C1;;PS)(OA;;RPWP;E45795B3-9455-11d1-AEBD-0000F80367C1;;PS)(OA;;RP;037088f8-0ae1-11d2-b422-00a0c968f939;;RS)(OA;;RP;4c164200-20c0-11d0-a768-00aa006e0529;;RS)(OA;;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;;RS)(A;;RC;;;AU)(OA;;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;;AU)(OA;;RP;77B5B886-944A-11d1-AEBD-0000F80367C1;;AU)(OA;;RP;E45795B3-9455-11d1-AEBD-0000F80367C1;;AU)(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)(OA;;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;;RS)(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;CA)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;WPRP;6db69a1c-9422-11d1-aebd-0000f80367c1;;S-1-5-32-561)(OA;;WPRP;5805bc62-bdc9-4428-a5e2-856a0f4c185e;;S-1-5-32-561)

1 Objects returned

Broken out that looks like:

[Tue 07/07/2020 22:01:56.84]
E:\DEV\cpp\vs\AdMod\Debug>adfind -schema -f ldapdisplayname=user defaultsecuritydescriptor -sddl+

AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) May 2020

Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)
Base DN: CN=Schema,CN=Configuration,DC=lockout,DC=test,DC=loc

dn:CN=User,CN=Schema,CN=Configuration,DC=lockout,DC=test,DC=loc
> defaultSecurityDescriptor: [DACL]
>defaultSecurityDescriptor: [DACL] A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA
> defaultSecurityDescriptor: [DACL] A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY
> defaultSecurityDescriptor: [DACL] A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO
> defaultSecurityDescriptor: [DACL] A;;RPLCLORC;;;PS
> defaultSecurityDescriptor: [DACL] OA;;CR;Change Password;;PS
> defaultSecurityDescriptor: [DACL] OA;;CR;Send As;;PS
> defaultSecurityDescriptor: [DACL] OA;;CR;Receive As;;PS
> defaultSecurityDescriptor: [DACL] OA;;RPWP;Personal Information;;PS
> defaultSecurityDescriptor: [DACL] OA;;RPWP;Phone and Mail Options;;PS
> defaultSecurityDescriptor: [DACL] OA;;RPWP;Web Information;;PS
> defaultSecurityDescriptor: [DACL] OA;;RP;Remote Access Information;;RS
> defaultSecurityDescriptor: [DACL] OA;;RP;Account Restrictions;;RS
> defaultSecurityDescriptor: [DACL] OA;;RP;Group Membership;;RS
> defaultSecurityDescriptor: [DACL] A;;RC;;;AU
> defaultSecurityDescriptor: [DACL] OA;;RP;General Information;;AU
> defaultSecurityDescriptor: [DACL] OA;;RP;Personal Information;;AU
> defaultSecurityDescriptor: [DACL] OA;;RP;Web Information;;AU
> defaultSecurityDescriptor: [DACL] OA;;RP;Public Information;;AU
> defaultSecurityDescriptor: [DACL] OA;;CR;Change Password;;WD
> defaultSecurityDescriptor: [DACL] OA;;RP;Logon Information;;RS
> defaultSecurityDescriptor: [DACL] OA;;RPWP;userCertificate;;CA
> defaultSecurityDescriptor: [DACL] OA;;RP;tokenGroupsGlobalAndUniversal;;S-1-5-32-560
> defaultSecurityDescriptor: [DACL] OA;;WPRP;terminalServer;;S-1-5-32-561
> defaultSecurityDescriptor: [DACL] OA;;WPRP;Terminal Server License Server;;S-1-5-32-561

1 Objects returned

Broken out even more…

[Tue 07/07/2020 22:07:32.31]
E:\DEV\cpp\vs\AdMod\Debug>adfind -schema -f ldapdisplayname=user defaultsecuritydescriptor -sddl++ -resolvesids

AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) May 2020

Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)
Base DN: CN=Schema,CN=Configuration,DC=lockout,DC=test,DC=loc

dn:CN=User,CN=Schema,CN=Configuration,DC=lockout,DC=test,DC=loc
> defaultSecurityDescriptor: [DACL] (FLAGS:)
> defaultSecurityDescriptor: [DACL] ALLOW;;[FC];;;Non-specific Domain Admins
> defaultSecurityDescriptor: [DACL] ALLOW;;[FC];;;NT AUTHORITY\SYSTEM
> defaultSecurityDescriptor: [DACL] ALLOW;;[FC];;;BUILTIN\Account Operators
> defaultSecurityDescriptor: [DACL] ALLOW;;[READ PROP][LIST CHILDREN][LIST OBJ][READ];;;NT AUTHORITY\SELF
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[CTL];Change Password;;NT AUTHORITY\SELF
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[CTL];Send As;;NT AUTHORITY\SELF
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[CTL];Receive As;;NT AUTHORITY\SELF
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[READ PROP][WRT PROP];Personal Information;;NT AUTHORITY\SELF
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[READ PROP][WRT PROP];Phone and Mail Options;;NT AUTHORITY\SELF
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[READ PROP][WRT PROP];Web Information;;NT AUTHORITY\SELF
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[READ PROP];Remote Access Information;;Non-specific RAS Servers Group
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[READ PROP];Account Restrictions;;Non-specific RAS Servers Group
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[READ PROP];Group Membership;;Non-specific RAS Servers Group
>defaultSecurityDescriptor: [DACL] ALLOW;;[READ];;;NT AUTHORITY\Authenticated Users
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[READ PROP];General Information;;NT AUTHORITY\Authenticated Users
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[READ PROP];Personal Information;;NT AUTHORITY\Authenticated Users
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[READ PROP];Web Information;;NT AUTHORITY\Authenticated Users
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[READ PROP];Public Information;;NT AUTHORITY\Authenticated Users
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[CTL];Change Password;;Everyone
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[READ PROP];Logon Information;;Non-specific RAS Servers Group
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[READ PROP][WRT PROP];userCertificate;;Non-specific Certificate Server Admins
>defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[READ PROP];tokenGroupsGlobalAndUniversal;;BUILTIN\Windows Authorization Access Group
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[WRT PROP][READ PROP];terminalServer;;BUILTIN\Terminal Server License Servers
> defaultSecurityDescriptor: [DACL] OBJ ALLOW;;[WRT PROP][READ PROP];Terminal Server License Server;;BUILTIN\Terminal Server License Servers

1 Objects returned

So this is cool, besides the missing DACL flags (did you catch that in the output?) it seems like we should just be able to plug that into AdMod and run with it. And in a single domain forest with a domain joined machine you absolutely can. In a multi-domain forest it gets a little trickier, so don’t do it yet. At least if you want the ACEs highlighted in red to possibly be wrong.

Full stop! So joe… I have a single domain forest, how do I just do that, I don’t care about the multi-domain forests…

I would say the simplest way straight away without creating additional objects (more on that later) is to get the default security from the user objectclass corrected with DACL flags and into a format that you can use…

for /f "tokens=1,2 delims=," %i in (‘adfind -sc s:* -af "(ldapdisplayname=user)" ldapdisplayname "defaultsecuritydescriptor:s/D:/D:AI/" -nodn -jcsv2 -csvmvdelim $’) do set DSD_%i=%j

Which leaves you with an env var of

[Tue 07/07/2020 22:08:51.68]
E:\DEV\cpp\vs\AdMod\Debug>set dsd_user
DSD_user=D:AI(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;AO)(A;;RPLCLORC;;;PS)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a56-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;RPWP;77B5B886-944A-11d1-AEBD-0000F80367C1;;PS)(OA;;RPWP;E45795B2-9455-11d1-AEBD-0000F80367C1;;PS)(OA;;RPWP;E45795B3-9455-11d1-AEBD-0000F80367C1;;PS)(OA;;RP;037088f8-0ae1-11d2-b422-00a0c968f939;;RS)(OA;;RP;4c164200-20c0-11d0-a768-00aa006e0529;;RS)(OA;;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;;RS)(A;;RC;;;AU)(OA;;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;;AU)(OA;;RP;77B5B886-944A-11d1-AEBD-0000F80367C1;;AU)(OA;;RP;E45795B3-9455-11d1-AEBD-0000F80367C1;;AU)(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)(OA;;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;;RS)(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;CA)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;WPRP;6db69a1c-9422-11d1-aebd-0000f80367c1;;S-1-5-32-561)(OA;;WPRP;5805bc62-bdc9-4428-a5e2-856a0f4c185e;;S-1-5-32-561)

and then a simple command of

adfind –b <BASE> –f <filter> -dsq | admod SD##ntsecuritydescriptor::%DSD_user% -exterr

will set the security descriptors back to default and enable inheritance.

adfind -default -f "&(objectclass=user)(admincount=1)" ntsecuritydescriptor -rawsddlexpl -rawsddlnl -onlydacl -adcsv | admod SD##ntsecuritydescriptor::%DSD_user% -exterr

Oh and while we are here, we might as well clear admincount as well…

adfind -default -f "&(objectclass=user)(admincount=1)" ntsecuritydescriptor -rawsddlexpl -rawsddlnl -onlydacl -adcsv | admod SD##ntsecuritydescriptor::%DSD_user% admincount:- -exterr

Cool! But why the domain joined machine requirement and what is going on that is so different for a multi-domain forest???

The issue goes back to the same issue for both which is related to the defaultSecurityDescriptor, specifically that it uses (correctly of course) the generic form of several of the security principals, most critically (IMO), the Domain Admins security principal of DA.

For example:

[DACL] A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA

Which is

[DACL] ALLOW;;[FC];;;Non-specific Domain Admins

The underlying function used by AdMod to handle Security Descriptors is ConvertStringSecurityDescriptorToSecurityDescriptor and it doesn’t allow you to specify a remote machine to for the SID expansion so if you aren’t in the same domain (in another domain or not in any domain) then it doesn’t know how to resolve DA (and also RS and CA) to a proper SID for the given domain to put into the Security Descriptor BLOB and it results in EITHER the wrong Domain Admin SID being stamped on the object in the case of being in a different domain or an error of “The security ID structure is invalid.” if the machine is not in any domain because those principals aren’t resolveable on a standalone machine. MSFT could have easily fixed that by allowing you to specify a resolver machine in the API call but alas, no such luck. If you want to handle this you have to manually unpack, convert the non-specific stuff to specific SIDs, and then repack the SDDL and use that.

AdMod does not currently (and unfortunately may or may not get it in the future) have the ability to correct this shortcoming in the API call. I am thinking about ways to handle it in the code itself but right now the best I have is to use “template” objects sort of like AdminSDHolder. Where you have objects defined that have the DACL (or full Security Descriptor) you want applied. You can even do this by groups, say certain groups will mean you get certain DACLs applied to the object and then have a service that is applying that regularly… A la poor man’s AdminSDHolder.

Anyway, this is about cleaning up old AdminSDHolder impacted objects likely because you realized you had too many admins and start cleaning stuff up (kudos to you btw).

So this is an example of some common template objects:

[Wed 07/08/2020 15:30:30.39]
E:\DEV\cpp\vs\AdMod\Debug>adfind -f cn=sdtemplates -dsq | adfind -s one -dn

AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) May 2020

Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)

dn:CN=contact,CN=SDTemplates,CN=System,DC=lockout,DC=test,DC=loc
dn:CN=group,CN=SDTemplates,CN=System,DC=lockout,DC=test,DC=loc
dn:CN=organizationalunit,CN=SDTemplates,CN=System,DC=lockout,DC=test,DC=loc
dn:CN=user,CN=SDTemplates,CN=System,DC=lockout,DC=test,DC=loc

4 Objects returned

And an expanded user template showing the DACL.

[Wed 07/08/2020 15:32:09.30]
E:\DEV\cpp\vs\AdMod\Debug>adfind -system -rb CN=SDTemplates -f cn=user -jsdenl -onlydacl

AdFind V01.53.00cppBETA Joe Richards (support@joeware.net) May 2020

Using server: LO-DC4.lockout.test.loc:389
Directory: Windows Server 2019 (10.0.17134.1)
Base DN: CN=SDTemplates,CN=System,DC=lockout,DC=test,DC=loc

dn:CN=user,CN=SDTemplates,CN=System,DC=lockout,DC=test,DC=loc
[DACL] (FLAGS:INHERIT)
[DACL] OBJ ALLOW;;[READ PROP];Account Restrictions;;LOCKOUT\RAS and IAS Servers
[DACL] OBJ ALLOW;;[READ PROP];Logon Information;;LOCKOUT\RAS and IAS Servers
[DACL] OBJ ALLOW;;[READ PROP];Group Membership;;LOCKOUT\RAS and IAS Servers
[DACL] OBJ ALLOW;;[READ PROP];Remote Access Information;;LOCKOUT\RAS and IAS Servers
[DACL] OBJ ALLOW;;[READ PROP][WRT PROP];userCertificate;;LOCKOUT\Cert Publishers
[DACL] OBJ ALLOW;;[READ PROP];tokenGroupsGlobalAndUniversal;;BUILTIN\Windows Authorization Access Group
[DACL] OBJ ALLOW;;[READ PROP][WRT PROP];terminalServer;;BUILTIN\Terminal Server License Servers
[DACL] OBJ ALLOW;;[READ PROP][WRT PROP];Terminal Server License Server;;BUILTIN\Terminal Server License Servers
[DACL] OBJ ALLOW;;[CTL];Change Password;;Everyone
[DACL] OBJ ALLOW;;[CTL];Change Password;;NT AUTHORITY\SELF
[DACL] OBJ ALLOW;;[CTL];Send As;;NT AUTHORITY\SELF
[DACL] OBJ ALLOW;;[CTL];Receive As;;NT AUTHORITY\SELF
[DACL] OBJ ALLOW;;[READ PROP];General Information;;NT AUTHORITY\Authenticated Users
[DACL] OBJ ALLOW;;[READ PROP];Public Information;;NT AUTHORITY\Authenticated Users
[DACL] OBJ ALLOW;;[READ PROP];Personal Information;;NT AUTHORITY\Authenticated Users
[DACL] OBJ ALLOW;;[READ PROP];Web Information;;NT AUTHORITY\Authenticated Users
[DACL] OBJ ALLOW;;[READ PROP][WRT PROP];Personal Information;;NT AUTHORITY\SELF
[DACL] OBJ ALLOW;;[READ PROP][WRT PROP];Phone and Mail Options;;NT AUTHORITY\SELF
[DACL] OBJ ALLOW;;[READ PROP][WRT PROP];Web Information;;NT AUTHORITY\SELF
[DACL] ALLOW;;[FC];;;LOCKOUT\Domain Admins
[DACL] ALLOW;;[FC];;;BUILTIN\Account Operators
[DACL] ALLOW;;[READ];;;NT AUTHORITY\Authenticated Users
[DACL] ALLOW;;[LIST CHILDREN][READ PROP][LIST OBJ][READ];;;NT AUTHORITY\SELF
[DACL] ALLOW;;[FC];;;NT AUTHORITY\SYSTEM

1 Objects returned

and note, that just like AdminSDHolder, it is simply a container object. You could use an actual user object if you wanted but then someone somewhere should be trying to clean that up when it seems inactive for a not too long period of time (weeks to months at most). I mean they better be, if you aren’t looking for and cleaning up inactive objects you have really really bad security. And not don’t just make it non-expiring, that is really really bad security too. In fact, if you have any userids that are set up as non-expiring, just expect that if I saw it I would say this is really really bad security.

So the easiest model is just to copy the explicit part of the DACL from the template object from a given domain and apply it to the user objects you need to “reset”.

So first get the DACL string

adfind -system -rb CN=SDTemplates -f cn=user ntsecuritydescriptor -rawsddlexpl -rawsddlnl –onlydacl –list

and copy the output which in this case would be:

D:AI(OA;;RP;4c164200-20c0-11d0-a768-00aa006e0529;;S-1-5-21-3057091654-2329156990-3385121676-553)(OA;;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;;S-1-5-21-3057091654-2329156990-3385121676-553)(OA;;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;;S-1-5-21-3057091654-2329156990-3385121676-553)(OA;;RP;037088f8-0ae1-11d2-b422-00a0c968f939;;S-1-5-21-3057091654-2329156990-3385121676-553)(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;S-1-5-21-3057091654-2329156990-3385121676-517)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;RPWP;6db69a1c-9422-11d1-aebd-0000f80367c1;;S-1-5-32-561)(OA;;RPWP;5805bc62-bdc9-4428-a5e2-856a0f4c185e;;S-1-5-32-561)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a56-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;;AU)(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)(OA;;RP;77b5b886-944a-11d1-aebd-0000f80367c1;;AU)(OA;;RP;e45795b3-9455-11d1-aebd-0000f80367c1;;AU)(OA;;RPWP;77b5b886-944a-11d1-aebd-0000f80367c1;;PS)(OA;;RPWP;e45795b2-9455-11d1-aebd-0000f80367c1;;PS)(OA;;RPWP;e45795b3-9455-11d1-aebd-0000f80367c1;;PS)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-3057091654-2329156990-3385121676-512)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AO)(A;;RC;;;AU)(A;;LCRPLORC;;;PS)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)

and then apply it to a given object

admod –b <objectDN> SD##ntsecuritydescriptor::D:AI(OA;;RP;4c164200-20c0-11d0-a768-00aa006e0529;;S-1-5-21-3057091654-2329156990-3385121676-553)(OA;;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;;S-1-5-21-3057091654-2329156990-3385121676-553)(OA;;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;;S-1-5-21-3057091654-2329156990-3385121676-553)(OA;;RP;037088f8-0ae1-11d2-b422-00a0c968f939;;S-1-5-21-3057091654-2329156990-3385121676-553)(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;S-1-5-21-3057091654-2329156990-3385121676-517)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;RPWP;6db69a1c-9422-11d1-aebd-0000f80367c1;;S-1-5-32-561)(OA;;RPWP;5805bc62-bdc9-4428-a5e2-856a0f4c185e;;S-1-5-32-561)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a56-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;;AU)(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)(OA;;RP;77b5b886-944a-11d1-aebd-0000f80367c1;;AU)(OA;;RP;e45795b3-9455-11d1-aebd-0000f80367c1;;AU)(OA;;RPWP;77b5b886-944a-11d1-aebd-0000f80367c1;;PS)(OA;;RPWP;e45795b2-9455-11d1-aebd-0000f80367c1;;PS)(OA;;RPWP;e45795b3-9455-11d1-aebd-0000f80367c1;;PS)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-3057091654-2329156990-3385121676-512)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AO)(A;;RC;;;AU)(A;;LCRPLORC;;;PS)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)

Boom, the object has been set to inheriting and the value of the defaultSecurityDescriptor specific to the domain in question.

You could do a group of accounts at once if you can feed the DACL in to the AdFind|AdMod pipeline, one such way to do it would be with a for /f loop like so:

for /f %i in (‘adfind -system -rb "CN=SDTemplates" -f "cn=user" ntsecuritydescriptor -rawsddlexpl -rawsddlnl -onlydacl -list’) do adfind -f "name=oldadmin*" -dsq | admod SD##ntsecuritydescriptor::%i -exterr

That command pulls the DACL and then performs a normal AdFind|AdMod pipeline and feeds in the DACL so you don’t have to copy and paste it.

You could expand that doing it for an entire multidomain forest with (assuming you created similar template objects in each domain):

for /f %i in (‘adfind -sc domainlist’) do for /f %j in (‘adfind -h %i -system -rb "CN=SDTemplates" -f "cn=user" ntsecuritydescriptor -rawsddlexpl -rawsddlnl -onlydacl -list’) do adfind -h %i -f "name=oldadmin*" -dsq | admod SD##ntsecuritydescriptor::%j -exterr

And if you want to clear the admincount attribute, don’t forget to add the admincount:- to it as well.

Note this is a good way to specify the standard owner for objects as well if you like along with the DACL. The owner is critical because the owner has special powers over the objects by default. I highly recommend, unless you are using AD quotas, to specify standard owners for objects so you can very closely control who can do what to all objects. Especially any elevated rights objects.

joe

[1] Speaking of Account Operators, you aren’t still using that are you? If you are, STOP. That was for NT4 and hybrid NT4/2000 mode. Not pure Windows Active Directory domains.

Rating 4.50 out of 5

Comments Off [link] [TB]

[joeware – never stop exploring… :) is proudly powered by WordPress.]

joeware - never stop exploring... :)

3/17/2021

New Versions of AdFind and… GASP…. AdMod Released

1/27/2021

AdFind and AdMod Production Releases

12/20/2020

ESAE (aka Red Forest) is finally dead. About time.

Beta versions of AdFind V01.53.00 and AdMod V01.21.00

11/23/2020

A Glimpse At Some AdMod Security Descriptor Fun…

11/22/2020

Looking for the proper Holiday Ornament for this very tricky year?

10/10/2020

9 out of 10 hackers prefer AdFind for AD Recon…

8/18/2020

Beta version of AdMod and DACLs…

7/9/2020

Clearing the DENY DELETE EVERYONE from OUs with AdFind|AdMod

How Do I Make an Object’s Security Descriptor Inheritable and also while I am at it… resetting from AdminSDHolder…

tip jar:

internal links:

logon:

Links

categories:

search blog:

calendar:

archive:

other:

visitors:

store:

Sponsored Links

archive:

visitors in motion:

Recent Comments