/// <summary>
/// Check if user canot change password.
/// @param sddl SSDL.
/// @return <tt>true</tt> if user cannot change password: <tt>false</tt> otherwise.
/// </summary>
public static bool IsUserCannotChangePassword(Sddl sddl)
{
var res = false;
List <Ace> aces = sddl.GetDacl().GetAces();
for (var i = 0; !res && i < aces.Count; i++)
{
Ace ace = aces[i];
if (ace.GetAceType() == AceType.AccessDeniedObjectAceType &&
ace.GetObjectFlags().GetFlags().Contains(AceObjectFlags.Flag.AceObjectTypePresent))
{
if (ace.GetObjectType() == ucpObjectGuid)
{
SID sid = ace.GetSid();
if (sid.GetSubAuthorities().Count == 1)
{
if (sid.GetIdentifierAuthority().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }) &&
sid.GetSubAuthorities().First().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x00 }) ||
sid.GetIdentifierAuthority().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x05 }) &&
sid.GetSubAuthorities().First().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x0a }))
{
res = true;
}
}
}
}
}
return(res);
}
/// <summary>
/// Set "User Cannot Change Password ACL".
/// @param sddl SDDL.
/// @param cannot <tt>true</tt> to set the ACL; <tt>false</tt> to unset.
/// @return updated SDDL.
/// </summary>
public static Sddl UserCannotChangePassword(Sddl sddl, bool cannot)
{
AceType type = cannot ? AceType.AccessDeniedObjectAceType : AceType.AccessAllowedObjectAceType;
Ace self = null;
Ace all = null;
List <Ace> aces = sddl.GetDacl().GetAces();
for (var i = 0; (all == null || self == null) && i < aces.Count; i++)
{
Ace ace = aces[i];
if ((ace.GetAceType() == AceType.AccessAllowedObjectAceType ||
ace.GetAceType() == AceType.AccessDeniedObjectAceType) &&
ace.GetObjectFlags().GetFlags().Contains(AceObjectFlags.Flag.AceObjectTypePresent))
{
if (ace.GetObjectType() == ucpObjectGuid)
{
SID sid = ace.GetSid();
if (sid.GetSubAuthorities().Count == 1)
{
if (self == null &&
sid.GetIdentifierAuthority().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }) &&
sid.GetSubAuthorities().First().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x00 }))
{
self = ace;
self.SetType(type);
}
else if (all == null &&
sid.GetIdentifierAuthority().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x05 }) &&
sid.GetSubAuthorities().First().SequenceEqual(new byte[] { 0x00, 0x00, 0x00, 0x0a }))
{
all = ace;
all.SetType(type);
}
}
}
}
}
if (self == null)
{
// prepare aces
self = Ace.NewInstance(type);
self.SetObjectFlags(new AceObjectFlags(AceObjectFlags.Flag.AceObjectTypePresent));
self.SetObjectType(ucpObjectGuid);
self.SetRights(new AceRights().AddOjectRight(AceRights.ObjectRight.Cr));
SID sid = SID.NewInstance(NumberFacility.GetBytes(0x000000000001, 6));
sid.AddSubAuthority(NumberFacility.GetBytes(0));
self.SetSid(sid);
sddl.GetDacl().GetAces().Add(self);
}
if (all == null)
{
all = Ace.NewInstance(type);
all.SetObjectFlags(new AceObjectFlags(AceObjectFlags.Flag.AceObjectTypePresent));
all.SetObjectType(ucpObjectGuid);
all.SetRights(new AceRights().AddOjectRight(AceRights.ObjectRight.Cr));
SID sid = SID.NewInstance(NumberFacility.GetBytes(0x000000000005, 6));
sid.AddSubAuthority(NumberFacility.GetBytes(0x0A));
all.SetSid(sid);
sddl.GetDacl().GetAces().Add(all);
}
return(sddl);
}