0

I am trying to get a report out of Powershell and AD that will show me the list of items on this property page from Active Directory –

From ADUC, right click your Root Domain OU -> properties->Security tab->Advanced->Auditing-> Select/Open one of the auditing entries. It will look Something like this:

enter image description here

On that page you will see the Principal, Type, and Applies To fields at the top and on the bottom section, the Permissions and Properties being audited, checked or unchecked.

I want to list those items and their values via Powershell.

I get to that Auditing page by doing this:


 AD:\> $acl = get-acl 'DC=domain,DC=company,DC=com' -Audit

 AD:\> $acl.Audit

Then single out one of the entries:

AD:\> $acl.Audit[0]

ActiveDirectoryRights : GenericAll
InheritanceType       : All
ObjectType            : 00000000-0000-0000-0000-000000000000
InheritedObjectType   : 00000000-0000-0000-0000-000000000000
ObjectFlags           : None
AuditFlags            : Success, Failure
IdentityReference     : Everyone
IsInherited           : False
InheritanceFlags      : ContainerInherit
PropagationFlags      : None

But that’s as far as I can get being a n00b. The only thing Ive been able to extract out of that list is the value itself and im not even sure which item if any of these might contain the items/values I want. Am I even in the right place?

Thanks in advance,

Richard

1 Answer 1

1

So here's the thing, the PowerShell ACL is only going to show you some of the things in that list. Here's what you can do to figure that bit out:

From what you have it looks like the ActiveDirectoryRights property is what's going to tell you what rights the given rule is affecting. Let's look at what that property's type is to see if we can get a list of what it considers to be valid values. We can run the .GetType() method on the property to see that it is the type [ActiveDirectoryRights], but that's not sufficient to get what we want. We'll want the full name, which we can get like this:

$acl.Audit[0].ActiveDirectoryRights.GetType()|Format-List

So the important things here are the BaseType and FullName properties. The BaseType is System.Enum, and the FullName is System.DirectoryServices.ActiveDirectoryRights. From that we can use the [Enum] base type to get the names associated with our type.

[enum]::GetNames([System.DirectoryServices.ActiveDirectoryRights])

That gets us this list of values:

CreateChild
DeleteChild
ListChildren
Self
ReadProperty
WriteProperty
DeleteTree
ListObject
ExtendedRight
Delete
ReadControl
GenericExecute
GenericWrite
GenericRead
WriteDacl
WriteOwner
GenericAll
Synchronize
AccessSystemSecurity

These can also be found here. That site also tells you what each means, and for things like GenericAll what other rights that groups together.

This is the info you're going to get from PowerShell, so if that's sufficient then awesome, you've got what you're looking for. If you expect to get all of the fine grained permissions for each object type listed I don't think you're going to want to use PowerShell for that. Yes, they're listed, but you're going to have to translate object type GUIDs. The only way I know of to do that is query AD for all of your classes that have a schemaIDGUID, and basically build a hashtable out of them that you can reference later when you're looking up all of these accesses. This bit you only have to do once, then just reference $GUIDHT when you need to lookup a GUID.

For example:

#Connect to ADDS and get a list of all objects with a schemaIDGUID
$root = Get-ADRootDSE
$schemaContext = $root.schemaNamingContext
$schemaObjects = Get-ADObject -SearchBase $schemaContext -Filter 'schemaIDGUID -like "*"' -Properties 'Name', 'schemaIDGUID', 'objectClass'
#Create hashtable with generic 'All' entry for all zero guids
$GUIDHT = @{[System.Guid]'00000000-0000-0000-0000-000000000000'=@{Name='All'}}
#Populate the hashtable with all of the GUIDs we found in AD
$schemaObjects|ForEach-Object{ $GUIDHT[$_.ObjectGUID]=$_ }

#Find the friendly name for a specific audit rule listing
$GUIDHT[$acl.Audit[0].ObjectType].Name

Then things start to get confusing for PropagationFlags vs InheritanceFlags. InheritanceFlags determine what kind of objects can inherit the rule. PropagationFlags determine if the rule applies to only the object, only the children of the object, or both.

2
  • Thanks for the thorough step-through.
    – RichardX
    Sep 28, 2020 at 14:27
  • Dont know why this saved and posted before I was finished - either way - the step through was perfect. I am however, not going to be able to just get a tick-or-not-ticked- report on what items are there and being audited. Bummer, but life goes on :)
    – RichardX
    Sep 28, 2020 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.