Skip to content

Commit 82d21f0

Browse files
FriedrichWeinmannFriedrichWeinmann
authored
Merge pull request #65 from ActiveDirectoryManagementFramework/development
1.13.108
2 parents b4d3d01 + 9bc9415 commit 82d21f0

File tree

65 files changed

+74358
-40
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+74358
-40
lines changed

‎ADMF/ADMF.psd1

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
RootModule = 'ADMF.psm1'
44

55
# Version number of this module.
6-
ModuleVersion = '1.13.103'
6+
ModuleVersion = '1.13.108'
77

88
# ID used to uniquely identify this module
99
GUID = '43f2a890-942f-4dd7-bad0-b774b44ea849'
@@ -28,13 +28,13 @@
2828
RequiredModules = @(
2929
@{ ModuleName = 'PSFramework'; ModuleVersion = '1.12.346' }
3030
@{ ModuleName = 'ADSec'; ModuleVersion = '1.0.1' }
31-
@{ ModuleName = 'string'; ModuleVersion = '1.1.3' }
31+
@{ ModuleName = 'string'; ModuleVersion = '1.1.5' }
3232
@{ ModuleName = 'ResolveString'; ModuleVersion = '1.0.0' }
3333
@{ ModuleName = 'Principal'; ModuleVersion = '1.0.0' }
3434
@{ ModuleName = 'ADMF.Core'; ModuleVersion = '1.1.9' }
3535
@{ ModuleName = 'DCManagement'; ModuleVersion = '1.2.25' }
36-
@{ ModuleName = 'DomainManagement'; ModuleVersion = '1.9.210' }
37-
@{ ModuleName = 'ForestManagement'; ModuleVersion = '1.5.78' }
36+
@{ ModuleName = 'DomainManagement'; ModuleVersion = '1.9.218' }
37+
@{ ModuleName = 'ForestManagement'; ModuleVersion = '1.5.79' }
3838
)
3939

4040
# Assemblies that must be loaded prior to importing this module

‎ADMF/changelog.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
# Changelog
22

3+
## 1.13.108 (2025-05-28)
4+
5+
- New: DefaultGroupMemberships - Added default groupmemberships as a Component
6+
- Upd: DefaultExchangeSplitPermission - Updated Exchange Split Permission default permissions, to match Exchange 2019 CU 15
7+
- Upd: DefaultAccessRules - Added default rules for contents of the system container, removing the need to exempt it from the domain content mode.
8+
- Upd: DefaultAccessRules - Made domain root "everyone deny delete children" undefined, making it tolerated if present but no longer creating it.
9+
- Fix: Invoke-AdmfItem - Broken WhatIf & Confirm message
10+
311
## 1.13.103 (2024-12-13)
412

513
- Upd: New-AdmfContext - added `-Components` parameter for adding extra content to newly created Contexts.

‎ADMF/functions/Invoke-AdmfItem.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@
136136
#region Execute Test Results
137137
try {
138138
foreach ($resultItem in $resultGroup.Group) {
139-
if (-not (Test-PSFShouldProcess -Target $resultItem -ActionString 'Invoke-AdmfItem.Processing.ShouldProcess' -ActionStringValues $resultItem.Server, $resultItem.ObjectType, $resultItem.Type, $resultItem.Identity -PSCmdlet $PSCmdlet)) {
139+
if (-not (Test-PSFShouldProcess -Target $resultItem -ActionString 'ADMF.Invoke-AdmfItem.Processing.ShouldProcess' -ActionStringValues $resultItem.Server, $resultItem.ObjectType, $resultItem.Type, $resultItem.Identity -PSCmdlet $PSCmdlet)) {
140140
continue
141141
}
142142
Write-PSFMessage -Level Host -String 'Invoke-AdmfItem.Processing' -Target $resultItem -StringValues $resultItem.Server, $resultItem.ObjectType, $resultItem.Type, $resultItem.Identity -PSCmdlet $PSCmdlet

‎ADMF/functions/New-AdmfContext.ps1

Lines changed: 12 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -121,14 +121,10 @@
121121
[string[]]
122122
$MutuallyExclusive = @(),
123123

124-
[ValidateSet(
125-
'DefaultAccessRules',
126-
'DefaultSchemaAttributes',
127-
'ExchangeDefaultAccessRules',
128-
'ExchangeSplitPermissionAccessRules'
129-
)]
124+
[PSFArgumentCompleter('ADMF.Components')]
125+
[PsfValidateSet(TabCompletion = 'ADMF.Components')]
130126
[string[]]
131-
$Components,
127+
$Components = @(),
132128

133129
[switch]
134130
$DefaultAccessRules,
@@ -169,6 +165,11 @@
169165
}
170166
$resolvedPath = Resolve-PSFPath -Provider FileSystem -Path $storeObject.Path -SingleItem
171167
}
168+
169+
if ($DefaultAccessRules) { $Components += 'DefaultAccessRules' }
170+
if ($ExchangeAccessRules -eq 'Default') { $Components += 'ExchangeDefaults' }
171+
if ($ExchangeAccessRules -eq 'SplitPermission') { $Components += 'ExchangeSPDefaults' }
172+
$Components = $Components | Remove-PSFNull -Enumerate | Sort-Object -Unique
172173
}
173174
process
174175
{
@@ -180,32 +181,12 @@
180181
$contextFolder = New-Item -Path $resolvedPath -Name $Name -ItemType Directory
181182
$contextVersionFolder = New-Item -Path $contextFolder.FullName -Name '1.0.0' -ItemType Directory
182183
Copy-Item -Path "$script:ModuleRoot\internal\data\context\*" -Destination "$($contextVersionFolder.FullName)\" -Recurse
183-
184-
#region Default Access Rules
185-
if ($DefaultAccessRules -or $Components -contains 'DefaultAccessRules'){
186-
Copy-Item -Path "$script:ModuleRoot\internal\data\domainDefaults\accessRules\*.json" -Destination "$($contextVersionFolder.FullName)\domain\accessrules\"
187-
Copy-Item -Path "$script:ModuleRoot\internal\data\domainDefaults\objectCategories\*.psd1" -Destination "$($contextVersionFolder.FullName)\domain\objectcategories\"
188-
Copy-Item -Path "$script:ModuleRoot\internal\data\domainDefaults\gppermissions\*.json" -Destination "$($contextVersionFolder.FullName)\domain\gppermissions\"
189-
Copy-Item -Path "$script:ModuleRoot\internal\data\domainDefaults\gppermissionfilters\*.json" -Destination "$($contextVersionFolder.FullName)\domain\gppermissionfilters\"
190-
191-
Copy-Item -Path "$script:ModuleRoot\internal\data\forestDefaults\schemaDefaultPermissions\*.json" -Destination "$($contextVersionFolder.FullName)\forest\schemaDefaultPermissions\"
192-
}
193-
#endregion Default Access Rules
194184

195-
#region Default Schema Attributes
196-
if ($Components -contains 'DefaultSchemaAttributes') {
197-
Copy-Item -Path "$script:ModuleRoot\internal\data\forestDefaults\schema\*.json" -Destination "$($contextVersionFolder.FullName)\forest\schema\"
198-
}
199-
#endregion Default Schema Attributes
200-
201-
#region Exchange Access Rules
202-
if ($ExchangeAccessRules -eq 'SplitPermission' -or $Components -contains 'ExchangeSplitPermissionAccessRules') {
203-
Copy-Item -Path "$script:ModuleRoot\internal\data\exchangeSPDefaults\accessRules\*.json" -Destination "$($contextVersionFolder.FullName)\domain\accessrules\"
204-
}
205-
elseif ($ExchangeAccessRules -eq 'Default' -or $Components -contains 'ExchangeDefaultAccessRules') {
206-
Copy-Item -Path "$script:ModuleRoot\internal\data\exchangeDefaults\accessRules\*.json" -Destination "$($contextVersionFolder.FullName)\domain\accessrules\"
185+
#region Process Components
186+
foreach ($component in $Components) {
187+
Copy-Item -Path "$script:ModuleRoot\internal\components\$component\*" -Destination "$($contextVersionFolder.FullName)" -Recurse -Force
207188
}
208-
#endregion Exchange Access Rules
189+
#endregion Process Components
209190

210191
$contextJson = [pscustomobject]@{
211192
Version = '1.0.0'

‎ADMF/internal/components/DefaultAccessRules/domain/accessRules/addefault_adminSDHolder.json

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,201 @@
1+
[
2+
{
3+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
4+
"ActiveDirectoryRights": "CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, Delete, GenericRead, WriteDacl, WriteOwner",
5+
"InheritanceType": "None",
6+
"ObjectType": "<All>",
7+
"InheritedObjectType": "<All>",
8+
"AccessControlType": "Allow",
9+
"Identity": "S-1-5-32-544"
10+
},
11+
{
12+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
13+
"ActiveDirectoryRights": "CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner",
14+
"InheritanceType": "None",
15+
"ObjectType": "<All>",
16+
"InheritedObjectType": "<All>",
17+
"AccessControlType": "Allow",
18+
"Identity": "%DomainSID%-512"
19+
},
20+
{
21+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
22+
"ActiveDirectoryRights": "GenericAll",
23+
"InheritanceType": "None",
24+
"ObjectType": "<All>",
25+
"InheritedObjectType": "<All>",
26+
"AccessControlType": "Allow",
27+
"Identity": "%DomainSID%-512",
28+
"Present": "false"
29+
},
30+
{
31+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
32+
"ActiveDirectoryRights": "CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner",
33+
"InheritanceType": "None",
34+
"ObjectType": "<All>",
35+
"InheritedObjectType": "<All>",
36+
"AccessControlType": "Allow",
37+
"Identity": "%RootDomainSID%-519"
38+
},
39+
{
40+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
41+
"ActiveDirectoryRights": "ExtendedRight",
42+
"InheritanceType": "None",
43+
"ObjectType": "ab721a53-1e2f-11d0-9819-00aa0040529b",
44+
"InheritedObjectType": "00000000-0000-0000-0000-000000000000",
45+
"AccessControlType": "Allow",
46+
"Identity": "S-1-1-0"
47+
},
48+
{
49+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
50+
"ActiveDirectoryRights": "ReadProperty, WriteProperty, ExtendedRight",
51+
"InheritanceType": "All",
52+
"ObjectType": "Private-Information",
53+
"InheritedObjectType": "<All>",
54+
"AccessControlType": "Allow",
55+
"Identity": "S-1-5-10"
56+
},
57+
{
58+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
59+
"ActiveDirectoryRights": "ExtendedRight",
60+
"InheritanceType": "None",
61+
"ObjectType": "User-Change-Password",
62+
"InheritedObjectType": "<All>",
63+
"AccessControlType": "Allow",
64+
"Identity": "S-1-5-10"
65+
},
66+
{
67+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
68+
"ActiveDirectoryRights": "ReadProperty",
69+
"InheritanceType": "None",
70+
"ObjectType": "RAS-Information",
71+
"InheritedObjectType": "<All>",
72+
"AccessControlType": "Allow",
73+
"Identity": "S-1-5-32-554"
74+
},
75+
{
76+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
77+
"ActiveDirectoryRights": "ReadProperty",
78+
"InheritanceType": "None",
79+
"ObjectType": "RAS-Information",
80+
"InheritedObjectType": "<All>",
81+
"AccessControlType": "Allow",
82+
"Identity": "S-1-5-32-554"
83+
},
84+
{
85+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
86+
"ActiveDirectoryRights": "ReadProperty",
87+
"InheritanceType": "None",
88+
"ObjectType": "User-Account-Restrictions",
89+
"InheritedObjectType": "<All>",
90+
"AccessControlType": "Allow",
91+
"Identity": "S-1-5-32-554"
92+
},
93+
{
94+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
95+
"ActiveDirectoryRights": "ReadProperty",
96+
"InheritanceType": "None",
97+
"ObjectType": "General-Information",
98+
"InheritedObjectType": "<All>",
99+
"AccessControlType": "Allow",
100+
"Identity": "S-1-5-32-554"
101+
},
102+
{
103+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
104+
"ActiveDirectoryRights": "ReadProperty",
105+
"InheritanceType": "None",
106+
"ObjectType": "Membership",
107+
"InheritedObjectType": "<All>",
108+
"AccessControlType": "Allow",
109+
"Identity": "S-1-5-32-554"
110+
},
111+
{
112+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
113+
"ActiveDirectoryRights": "ReadProperty",
114+
"InheritanceType": "None",
115+
"ObjectType": "Membership",
116+
"InheritedObjectType": "<All>",
117+
"AccessControlType": "Allow",
118+
"Identity": "S-1-5-32-554"
119+
},
120+
{
121+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
122+
"ActiveDirectoryRights": "GenericRead",
123+
"InheritanceType": "None",
124+
"ObjectType": "<All>",
125+
"InheritedObjectType": "<All>",
126+
"AccessControlType": "Allow",
127+
"Identity": "S-1-5-32-554"
128+
},
129+
{
130+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
131+
"ActiveDirectoryRights": "GenericRead",
132+
"InheritanceType": "None",
133+
"ObjectType": "<All>",
134+
"InheritedObjectType": "<All>",
135+
"AccessControlType": "Allow",
136+
"Identity": "S-1-5-32-554"
137+
},
138+
{
139+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
140+
"ActiveDirectoryRights": "ReadProperty",
141+
"InheritanceType": "None",
142+
"ObjectType": "General-Information",
143+
"InheritedObjectType": "<All>",
144+
"AccessControlType": "Allow",
145+
"Identity": "S-1-5-32-554"
146+
},
147+
{
148+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
149+
"ActiveDirectoryRights": "ReadProperty",
150+
"InheritanceType": "None",
151+
"ObjectType": "User-Logon",
152+
"InheritedObjectType": "<All>",
153+
"AccessControlType": "Allow",
154+
"Identity": "S-1-5-32-554"
155+
},
156+
{
157+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
158+
"ActiveDirectoryRights": "ReadProperty",
159+
"InheritanceType": "None",
160+
"ObjectType": "User-Account-Restrictions",
161+
"InheritedObjectType": "<All>",
162+
"AccessControlType": "Allow",
163+
"Identity": "S-1-5-32-554"
164+
},
165+
{
166+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
167+
"ActiveDirectoryRights": "ReadProperty",
168+
"InheritanceType": "None",
169+
"ObjectType": "Token-Groups-Global-And-Universal",
170+
"InheritedObjectType": "<All>",
171+
"AccessControlType": "Allow",
172+
"Identity": "S-1-5-32-560"
173+
},
174+
{
175+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
176+
"ActiveDirectoryRights": "ReadProperty, WriteProperty",
177+
"InheritanceType": "None",
178+
"ObjectType": "Terminal-Server",
179+
"InheritedObjectType": "<All>",
180+
"AccessControlType": "Allow",
181+
"Identity": "S-1-5-32-561"
182+
},
183+
{
184+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
185+
"ActiveDirectoryRights": "ReadProperty, WriteProperty",
186+
"InheritanceType": "None",
187+
"ObjectType": "Terminal-Server-License-Server",
188+
"InheritedObjectType": "<All>",
189+
"AccessControlType": "Allow",
190+
"Identity": "S-1-5-32-561"
191+
},
192+
{
193+
"Path": "CN=AdminSDHolder,CN=System,%DomainDN%",
194+
"ActiveDirectoryRights": "ReadProperty, WriteProperty",
195+
"InheritanceType": "None",
196+
"ObjectType": "X509-Cert",
197+
"InheritedObjectType": "<All>",
198+
"AccessControlType": "Allow",
199+
"Identity": "%DomainSID%-517"
200+
}
201+
]

0 commit comments

Comments
 (0)