Access Control Model

• Enables control on the ability of a process to access objects and other resources in active directory based on:

  • Access Tokens (security context of a process – identity and privs of user)
  • Security Descriptors (SID of the owner, Discretionary ACL (DACL) and System ACL (SACL))

  

• It is a list of Access Control Entries (ACE) – ACE corresponds to individual permission or audits access. Who has permission and what can be done on an object?

  • Two types:
    • DACL – Defines the permissions trustees (a user or group) have on an object.
    • SACL – Logs success and failure audit messages when an object is accessed.
    • ACLs are vital to security architecture of AD.

• Get the ACLs associated with a specified object

Get-DomainObjectAcl -Identity studentuser47 –ResolveGUIDs

Get-DomainObjectAcl -Identity studentuser47 -ResolveGUIDs | select SecurityIdentifier , ActiveDirectoryRights, ObjectDN, AceType

• Get the ACLs associated with the specified LDAP path to be used for search

Get-DomainObjectAcl -Searchbase "LDAP://CN=Domain Admins,CN=Users,DC=us,DC=techcorp,DC=local" -ResolveGUIDs

Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs

Get-DomainObjectAcl -Searchbase "LDAP://CN=Domain Admins,CN=Users,DC=us,DC=techcorp,DC=local" -ResolveGUIDs | select SecurityIdentifier , ActiveDirectoryRights, ObjectDN, AceType

• We can also enumerate ACLs using the ActiveDirectory module but without resolving GUIDs

(Get-Acl 'AD:\CN=Administrator,CN=Users,DC=us,DC=techcorp,DC=local').Access