private SecurityDescriptorTarget ConvertToTarget(ComputerPrincipalMapping computer, HashSet <SecurityIdentifier> admins)
{
this.logger.LogTrace("Creating new target for computer {computer} with the following principals\r\n{admins}", computer.PrincipalName, string.Join(", ", admins));
SecurityDescriptorTarget target = new SecurityDescriptorTarget()
{
AuthorizationMode = AuthorizationMode.SecurityDescriptor,
Description = settings.RuleDescription?.Replace("{targetName}", computer.PrincipalName, StringComparison.OrdinalIgnoreCase),
Target = computer.Sid.ToString(),
Type = TargetType.Computer,
Id = Guid.NewGuid().ToString(),
Notifications = settings.Notifications,
Jit = new SecurityDescriptorTargetJitDetails()
{
AuthorizingGroup = settings.JitAuthorizingGroup,
ExpireAfter = settings.JitExpireAfter
},
Laps = new SecurityDescriptorTargetLapsDetails()
{
ExpireAfter = settings.LapsExpireAfter
}
};
AccessMask mask = 0;
mask |= settings.AllowLaps ? AccessMask.LocalAdminPassword : 0;
mask |= settings.AllowJit ? AccessMask.Jit : 0;
mask |= settings.AllowLapsHistory ? AccessMask.LocalAdminPasswordHistory : 0;
mask |= settings.AllowBitLocker ? AccessMask.BitLocker : 0;
DiscretionaryAcl acl = new DiscretionaryAcl(false, false, admins.Count);
foreach (var sid in admins)
{
acl.AddAccess(AccessControlType.Allow, sid, (int)mask, InheritanceFlags.None, PropagationFlags.None);
}
CommonSecurityDescriptor sd = new CommonSecurityDescriptor(false, false, ControlFlags.DiscretionaryAclPresent, new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null), null, null, acl);
target.SecurityDescriptor = sd.GetSddlForm(AccessControlSections.All);
return(target);
}
private void PerformComputerDiscovery(OUPrincipalMapping ou, IComputerPrincipalProvider principalProvider, List <DiscoveryError> discoveryErrors)
{
settings.CancellationToken.ThrowIfCancellationRequested();
foreach (SearchResult computer in this.GetComputersFromOU(ou.AdsPath, false, principalProvider))
{
settings.CancellationToken.ThrowIfCancellationRequested();
string computerName = computer.GetPropertyString("msDS-PrincipalName");
try
{
this.OnItemProcessStart?.Invoke(this, new ImportProcessingEventArgs(computerName));
if (this.ShouldFilterComputer(computer))
{
this.logger.LogTrace("Filtering computer {computer}", computerName);
continue;
}
this.logger.LogTrace("Found computer {computer} in ou {ou}", computerName, ou.OUName);
ComputerPrincipalMapping ce = new ComputerPrincipalMapping(computer, ou);
ou.Computers.Add(ce);
try
{
HashSet <SecurityIdentifier> principalsForComputer = new HashSet <SecurityIdentifier>(principalProvider.GetPrincipalsForComputer(computer, settings.FilterLocalAccounts));
this.logger.LogTrace("Got {number} principals from computer {computer}", principalsForComputer.Count, computerName);
foreach (var principal in principalsForComputer)
{
settings.CancellationToken.ThrowIfCancellationRequested();
if (this.ShouldFilter(principal, out DiscoveryError filterReason))
{
if (filterReason != null)
{
filterReason.Target = computerName;
ce.DiscoveryErrors.Add(filterReason);
this.logger.LogTrace("Filtering principal {principal} with reason: {reason}", principal.ToString(), filterReason);
}
}
else
{
ce.Principals.Add(principal);
}
}
}
catch (OperationCanceledException)
{
return;
}
catch (Exception ex)
{
this.logger.LogTrace(ex, "Failed to get principals from computer {computer}", computerName);
ce.HasError = true;
ce.Exception = ex;
ce.IsMissing = ex is ObjectNotFoundException;
ce.DiscoveryErrors.Add(new DiscoveryError()
{
Target = computerName, Message = ex.Message, Type = DiscoveryErrorType.Error
});
}
if (ce.DiscoveryErrors.Count > 0)
{
discoveryErrors.AddRange(ce.DiscoveryErrors);
}
}
finally
{
this.OnItemProcessFinish?.Invoke(this, new ImportProcessingEventArgs(computerName));
}
}
foreach (var childOU in this.GetOUs(ou.AdsPath, false))
{
settings.CancellationToken.ThrowIfCancellationRequested();
this.logger.LogTrace("Found ou {ou}", childOU.GetPropertyString("distinguishedName"));
OUPrincipalMapping childou = new OUPrincipalMapping(childOU, ou);
ou.DescendantOUs.Add(childou);
this.PerformComputerDiscovery(childou, principalProvider, discoveryErrors);
}
}
