Active Directory Delegated Permissions Audit

Sicherheitsberechtigungen in Active Directory sind ein spannendes Thema.
Speziell bei gewachsenen Umgebungen ist es oft schwer nicht den Überblick zu verlieren.

Das folgende Script durchsucht alle Domains im Forest nach den konfigurierten Berechtigungen. Delegationen kann man auf jedem AD Objekt setzen. Per default durchsucht mein Script aber nur OUs.

# diese Berechtigungen werden im Audit erfasst
$ExtendedRightsReference = 
'00299570-246d-11d0-a768-00aa006e0529', # computer Object - User-Force-Change-Password
'ab721a54-1e2f-11d0-9819-00aa0040529b', # computer Object - Send-As
'ab721a53-1e2f-11d0-9819-00aa0040529b', # computer Object - User-Change-Password
'bf967aba-0de6-11d0-a285-00aa003049e2', # CreateChild, DeleteChild
'00000000-0000-0000-0000-000000000000', # GenericAll
'1131f6ad-9c07-11d1-f79f-00c04fc2dcd2', # DCSync attack - Replication Directory Changes
'1131f6aa-9c07-11d1-f79f-00c04fc2dcd2'  # DCSync attack - Replication Directory Changes All

# diese Benutzer werden beim Audit ignoriert
$ExcludeAccounts = @(
'Domain Admins',
'S-1-5-32-548',
'ENTERPRISE DOMAIN CONTROLLERS',
'Authenticated Users',
'RTCHSUniversalServices',
'RTCUniversalServerAdmins',
'RTCUniversalServerReadOnlyGroup',
'RTCUniversalUserReadOnlyGroup',
'Exchange Trusted Subsystem',
'NT AUTHORITY\\SYSTEM',
'Organization Management'
)

$LdapFilter = "(|(objectClass=organizationalUnit))"

# alle DCs im Forest
$ADForest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
$ADDomains = $ADForest.ApplicationPartitions.SecurityReferenceDomain | Select -Unique

$output = @()
foreach ($OU in $ADDomains){

    $Domain = $OU -replace ('DC=','') -replace (',','.')

    $LdapPath = "LDAP://$OU"
    $bSearch = New-Object System.DirectoryServices.DirectoryEntry($LDAPPath)
    $dSearch = New-Object System.DirectoryServices.DirectorySearcher($bSearch)
    $dSearch.SearchRoot = $bSearch
    $dSearch.PageSize = 1000
    $dSearch.Filter = $LdapFilter #comment out to look at all object types
    $dSearch.SearchScope = "Subtree"

    FOREACH ($objResult in $dSearch.FindAll()){
        $obj = $objResult.GetDirectoryEntry()
        Write-Host "Searching... $Domain -" $obj.distinguishedName
        $permissions = $obj.PsBase.ObjectSecurity.GetAccessRules($true,$false,[Security.Principal.NTAccount]) 
        $output += $permissions | Where-Object { `
            $_.AccessControlType -eq 'Allow' -and $_.ObjectType -in $ExtendedRightsReference -and $_.IdentityReference -notmatch ($ExcludeAccounts -join "|") `
        } | Select-Object @{n='Domain'; e={$Domain}}, @{n='Sort'; e={$($obj.distinguishedName).split(',').count}}, @{n='Object'; e={$obj.distinguishedName}}, @{n='Account'; e={$_.IdentityReference}}, @{n='Permission'; e={$_.ActiveDirectoryRights}}, ObjectType

    }
}

$output | Sort-Object Domain,Sort,Object | Select Object, Account, Permission