예제 #1
0
        /// <summary>
        ///     Check if user canot change password.
        ///     @param sddl SSDL.
        ///     @return <tt>true</tt> if user cannot change password: <tt>false</tt> otherwise.
        /// </summary>
        public static bool IsUserCannotChangePassword(Sddl sddl)
        {
            var res = false;

            List <Ace> aces = sddl.GetDacl().GetAces();

            for (var i = 0; !res && i < aces.Count; i++)
            {
                Ace ace = aces[i];

                if (ace.GetAceType() == AceType.AccessDeniedObjectAceType &&
                    ace.GetObjectFlags().GetFlags().Contains(AceObjectFlags.Flag.AceObjectTypePresent))
                {
                    if (ace.GetObjectType() == ucpObjectGuid)
                    {
                        SID sid = ace.GetSid();
                        if (sid.GetSubAuthorities().Count == 1)
                        {
                            if (sid.GetIdentifierAuthority().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }) &&
                                sid.GetSubAuthorities().First().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x00 }) ||
                                sid.GetIdentifierAuthority().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x05 }) &&
                                sid.GetSubAuthorities().First().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x0a }))
                            {
                                res = true;
                            }
                        }
                    }
                }
            }

            return(res);
        }
예제 #2
0
        /// <summary>
        ///     Set "User Cannot Change Password ACL".
        ///     @param sddl SDDL.
        ///     @param cannot <tt>true</tt> to set the ACL; <tt>false</tt> to unset.
        ///     @return updated SDDL.
        /// </summary>
        public static Sddl UserCannotChangePassword(Sddl sddl, bool cannot)
        {
            AceType type = cannot ? AceType.AccessDeniedObjectAceType : AceType.AccessAllowedObjectAceType;

            Ace self = null;
            Ace all  = null;

            List <Ace> aces = sddl.GetDacl().GetAces();

            for (var i = 0; (all == null || self == null) && i < aces.Count; i++)
            {
                Ace ace = aces[i];

                if ((ace.GetAceType() == AceType.AccessAllowedObjectAceType ||
                     ace.GetAceType() == AceType.AccessDeniedObjectAceType) &&
                    ace.GetObjectFlags().GetFlags().Contains(AceObjectFlags.Flag.AceObjectTypePresent))
                {
                    if (ace.GetObjectType() == ucpObjectGuid)
                    {
                        SID sid = ace.GetSid();
                        if (sid.GetSubAuthorities().Count == 1)
                        {
                            if (self == null &&
                                sid.GetIdentifierAuthority().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }) &&
                                sid.GetSubAuthorities().First().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x00 }))
                            {
                                self = ace;
                                self.SetType(type);
                            }
                            else if (all == null &&
                                     sid.GetIdentifierAuthority().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x05 }) &&
                                     sid.GetSubAuthorities().First().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x0a }))
                            {
                                all = ace;
                                all.SetType(type);
                            }
                        }
                    }
                }
            }

            if (self == null)
            {
                // prepare aces
                self = Ace.NewInstance(type);
                self.SetObjectFlags(new AceObjectFlags(AceObjectFlags.Flag.AceObjectTypePresent));
                self.SetObjectType(ucpObjectGuid);
                self.SetRights(new AceRights().AddOjectRight(AceRights.ObjectRight.Cr));
                SID sid = SID.NewInstance(NumberFacility.GetBytes(0x000000000001, 6));
                sid.AddSubAuthority(NumberFacility.GetBytes(0));
                self.SetSid(sid);
                sddl.GetDacl().GetAces().Add(self);
            }

            if (all == null)
            {
                all = Ace.NewInstance(type);
                all.SetObjectFlags(new AceObjectFlags(AceObjectFlags.Flag.AceObjectTypePresent));
                all.SetObjectType(ucpObjectGuid);
                all.SetRights(new AceRights().AddOjectRight(AceRights.ObjectRight.Cr));
                SID sid = SID.NewInstance(NumberFacility.GetBytes(0x000000000005, 6));
                sid.AddSubAuthority(NumberFacility.GetBytes(0x0A));
                all.SetSid(sid);
                sddl.GetDacl().GetAces().Add(all);
            }

            return(sddl);
        }