Add LIAM permission validation script
This commit is contained in:
Meik
265
Sonstiges/Set-LiamTestDelegation.ps1
Normal file
265
Sonstiges/Set-LiamTestDelegation.ps1
Normal file
@@ -0,0 +1,265 @@
|
|||||||
|
<#
|
||||||
|
.SYNOPSIS
|
||||||
|
Creates or uses a dedicated LIAM test account and delegates limited AD and NTFS rights for validation.
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
Use this script to verify whether the reduced LIAM service-user permissions are sufficient.
|
||||||
|
Run with -WhatIf first, then without -WhatIf, configure the account in LIAM, and execute the relevant workflows.
|
||||||
|
|
||||||
|
Requirements:
|
||||||
|
- RSAT ActiveDirectory module
|
||||||
|
- Run as an account allowed to create users and edit ACLs on the target OU and NTFS paths
|
||||||
|
#>
|
||||||
|
|
||||||
|
[CmdletBinding(SupportsShouldProcess = $true)]
|
||||||
|
param(
|
||||||
|
[Parameter(Mandatory = $true)]
|
||||||
|
[string]$SamAccountName,
|
||||||
|
|
||||||
|
[Parameter(Mandatory = $true)]
|
||||||
|
[string]$TargetGroupOuDN,
|
||||||
|
|
||||||
|
[string[]]$ReadSearchBaseDNs = @(),
|
||||||
|
|
||||||
|
[string[]]$NtfsReadAclPaths = @(),
|
||||||
|
|
||||||
|
[string[]]$NtfsManageAclPaths = @(),
|
||||||
|
|
||||||
|
[string[]]$NtfsCreateParentPaths = @(),
|
||||||
|
|
||||||
|
[switch]$CreateUser,
|
||||||
|
|
||||||
|
[switch]$GrantDeleteGroupObjects
|
||||||
|
)
|
||||||
|
|
||||||
|
Set-StrictMode -Version Latest
|
||||||
|
$ErrorActionPreference = "Stop"
|
||||||
|
|
||||||
|
Import-Module ActiveDirectory -ErrorAction Stop
|
||||||
|
|
||||||
|
function Get-SchemaGuid {
|
||||||
|
param(
|
||||||
|
[Parameter(Mandatory = $true)]
|
||||||
|
[string]$LdapDisplayName
|
||||||
|
)
|
||||||
|
|
||||||
|
$schemaNc = (Get-ADRootDSE).schemaNamingContext
|
||||||
|
$object = Get-ADObject -SearchBase $schemaNc `
|
||||||
|
-LDAPFilter "(lDAPDisplayName=$LdapDisplayName)" `
|
||||||
|
-Properties schemaIDGUID
|
||||||
|
|
||||||
|
if (-not $object) {
|
||||||
|
throw "Schema object not found: $LdapDisplayName"
|
||||||
|
}
|
||||||
|
|
||||||
|
return [Guid]::new([byte[]]$object.schemaIDGUID)
|
||||||
|
}
|
||||||
|
|
||||||
|
function Add-LiamAdAccessRule {
|
||||||
|
param(
|
||||||
|
[Parameter(Mandatory = $true)]
|
||||||
|
[string]$TargetDN,
|
||||||
|
|
||||||
|
[Parameter(Mandatory = $true)]
|
||||||
|
[System.Security.Principal.IdentityReference]$Identity,
|
||||||
|
|
||||||
|
[Parameter(Mandatory = $true)]
|
||||||
|
[System.DirectoryServices.ActiveDirectoryRights]$Rights,
|
||||||
|
|
||||||
|
[Parameter(Mandatory = $true)]
|
||||||
|
[System.Security.AccessControl.AccessControlType]$AccessType,
|
||||||
|
|
||||||
|
[Guid]$ObjectType = [Guid]::Empty,
|
||||||
|
|
||||||
|
[System.DirectoryServices.ActiveDirectorySecurityInheritance]$Inheritance = [System.DirectoryServices.ActiveDirectorySecurityInheritance]::None,
|
||||||
|
|
||||||
|
[Guid]$InheritedObjectType = [Guid]::Empty
|
||||||
|
)
|
||||||
|
|
||||||
|
$entry = [ADSI]"LDAP://$TargetDN"
|
||||||
|
$acl = $entry.ObjectSecurity
|
||||||
|
|
||||||
|
if ($InheritedObjectType -ne [Guid]::Empty) {
|
||||||
|
$rule = [System.DirectoryServices.ActiveDirectoryAccessRule]::new(
|
||||||
|
$Identity,
|
||||||
|
$Rights,
|
||||||
|
$AccessType,
|
||||||
|
$ObjectType,
|
||||||
|
$Inheritance,
|
||||||
|
$InheritedObjectType
|
||||||
|
)
|
||||||
|
}
|
||||||
|
elseif ($ObjectType -ne [Guid]::Empty) {
|
||||||
|
$rule = [System.DirectoryServices.ActiveDirectoryAccessRule]::new(
|
||||||
|
$Identity,
|
||||||
|
$Rights,
|
||||||
|
$AccessType,
|
||||||
|
$ObjectType
|
||||||
|
)
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
$rule = [System.DirectoryServices.ActiveDirectoryAccessRule]::new(
|
||||||
|
$Identity,
|
||||||
|
$Rights,
|
||||||
|
$AccessType,
|
||||||
|
$Inheritance
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
$acl.AddAccessRule($rule)
|
||||||
|
|
||||||
|
if ($PSCmdlet.ShouldProcess($TargetDN, "Add AD ACL: $Rights / $ObjectType / $Inheritance")) {
|
||||||
|
$entry.ObjectSecurity = $acl
|
||||||
|
$entry.CommitChanges()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function Grant-LiamNtfsRights {
|
||||||
|
param(
|
||||||
|
[Parameter(Mandatory = $true)]
|
||||||
|
[string]$Path,
|
||||||
|
|
||||||
|
[Parameter(Mandatory = $true)]
|
||||||
|
[string]$Account,
|
||||||
|
|
||||||
|
[Parameter(Mandatory = $true)]
|
||||||
|
[System.Security.AccessControl.FileSystemRights]$Rights,
|
||||||
|
|
||||||
|
[System.Security.AccessControl.InheritanceFlags]$InheritanceFlags = "ContainerInherit,ObjectInherit",
|
||||||
|
|
||||||
|
[System.Security.AccessControl.PropagationFlags]$PropagationFlags = "None"
|
||||||
|
)
|
||||||
|
|
||||||
|
if (-not (Test-Path -LiteralPath $Path)) {
|
||||||
|
throw "Path not found: $Path"
|
||||||
|
}
|
||||||
|
|
||||||
|
$acl = Get-Acl -LiteralPath $Path
|
||||||
|
$rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
|
||||||
|
$Account,
|
||||||
|
$Rights,
|
||||||
|
$InheritanceFlags,
|
||||||
|
$PropagationFlags,
|
||||||
|
[System.Security.AccessControl.AccessControlType]::Allow
|
||||||
|
)
|
||||||
|
|
||||||
|
$acl.AddAccessRule($rule)
|
||||||
|
|
||||||
|
if ($PSCmdlet.ShouldProcess($Path, "Grant NTFS rights '$Rights' to '$Account'")) {
|
||||||
|
Set-Acl -LiteralPath $Path -AclObject $acl
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$domain = Get-ADDomain
|
||||||
|
$netbiosName = $domain.NetBIOSName
|
||||||
|
$accountName = "$netbiosName\$SamAccountName"
|
||||||
|
|
||||||
|
if ($CreateUser) {
|
||||||
|
$existingUser = Get-ADUser -LDAPFilter "(sAMAccountName=$SamAccountName)" -ErrorAction SilentlyContinue
|
||||||
|
if (-not $existingUser) {
|
||||||
|
$password = Read-Host "Password for $SamAccountName" -AsSecureString
|
||||||
|
|
||||||
|
if ($PSCmdlet.ShouldProcess($SamAccountName, "Create AD user")) {
|
||||||
|
New-ADUser `
|
||||||
|
-SamAccountName $SamAccountName `
|
||||||
|
-Name $SamAccountName `
|
||||||
|
-AccountPassword $password `
|
||||||
|
-Enabled $true `
|
||||||
|
-PasswordNeverExpires $true `
|
||||||
|
-ChangePasswordAtLogon $false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$user = Get-ADUser -Identity $SamAccountName
|
||||||
|
$identity = $user.SID
|
||||||
|
|
||||||
|
$groupClassGuid = Get-SchemaGuid "group"
|
||||||
|
$attributeNames = @(
|
||||||
|
"cn",
|
||||||
|
"sAMAccountName",
|
||||||
|
"displayName",
|
||||||
|
"groupType",
|
||||||
|
"description",
|
||||||
|
"managedBy",
|
||||||
|
"member"
|
||||||
|
)
|
||||||
|
|
||||||
|
$attributeGuids = @{}
|
||||||
|
foreach ($name in $attributeNames) {
|
||||||
|
$attributeGuids[$name] = Get-SchemaGuid $name
|
||||||
|
}
|
||||||
|
|
||||||
|
Add-LiamAdAccessRule `
|
||||||
|
-TargetDN $TargetGroupOuDN `
|
||||||
|
-Identity $identity `
|
||||||
|
-Rights ([System.DirectoryServices.ActiveDirectoryRights]"ListChildren,ReadProperty") `
|
||||||
|
-AccessType Allow `
|
||||||
|
-Inheritance All
|
||||||
|
|
||||||
|
Add-LiamAdAccessRule `
|
||||||
|
-TargetDN $TargetGroupOuDN `
|
||||||
|
-Identity $identity `
|
||||||
|
-Rights CreateChild `
|
||||||
|
-AccessType Allow `
|
||||||
|
-ObjectType $groupClassGuid
|
||||||
|
|
||||||
|
if ($GrantDeleteGroupObjects) {
|
||||||
|
Add-LiamAdAccessRule `
|
||||||
|
-TargetDN $TargetGroupOuDN `
|
||||||
|
-Identity $identity `
|
||||||
|
-Rights DeleteChild `
|
||||||
|
-AccessType Allow `
|
||||||
|
-ObjectType $groupClassGuid
|
||||||
|
}
|
||||||
|
|
||||||
|
foreach ($attributeName in $attributeNames) {
|
||||||
|
Add-LiamAdAccessRule `
|
||||||
|
-TargetDN $TargetGroupOuDN `
|
||||||
|
-Identity $identity `
|
||||||
|
-Rights WriteProperty `
|
||||||
|
-AccessType Allow `
|
||||||
|
-ObjectType $attributeGuids[$attributeName] `
|
||||||
|
-Inheritance Descendents `
|
||||||
|
-InheritedObjectType $groupClassGuid
|
||||||
|
}
|
||||||
|
|
||||||
|
foreach ($readBase in $ReadSearchBaseDNs) {
|
||||||
|
Add-LiamAdAccessRule `
|
||||||
|
-TargetDN $readBase `
|
||||||
|
-Identity $identity `
|
||||||
|
-Rights ([System.DirectoryServices.ActiveDirectoryRights]"ListChildren,ReadProperty") `
|
||||||
|
-AccessType Allow `
|
||||||
|
-Inheritance All
|
||||||
|
}
|
||||||
|
|
||||||
|
foreach ($path in $NtfsReadAclPaths) {
|
||||||
|
Grant-LiamNtfsRights `
|
||||||
|
-Path $path `
|
||||||
|
-Account $accountName `
|
||||||
|
-Rights ([System.Security.AccessControl.FileSystemRights]"ReadAndExecute,ReadPermissions")
|
||||||
|
}
|
||||||
|
|
||||||
|
foreach ($path in $NtfsManageAclPaths) {
|
||||||
|
Grant-LiamNtfsRights `
|
||||||
|
-Path $path `
|
||||||
|
-Account $accountName `
|
||||||
|
-Rights ([System.Security.AccessControl.FileSystemRights]"ReadAndExecute,ReadPermissions,ChangePermissions")
|
||||||
|
}
|
||||||
|
|
||||||
|
foreach ($path in $NtfsCreateParentPaths) {
|
||||||
|
Grant-LiamNtfsRights `
|
||||||
|
-Path $path `
|
||||||
|
-Account $accountName `
|
||||||
|
-Rights ([System.Security.AccessControl.FileSystemRights]"ReadAndExecute,ReadPermissions,CreateDirectories") `
|
||||||
|
-InheritanceFlags None `
|
||||||
|
-PropagationFlags None
|
||||||
|
}
|
||||||
|
|
||||||
|
Write-Host "Delegation finished for $accountName"
|
||||||
|
Write-Host "Suggested validation:"
|
||||||
|
Write-Host "1. Configure this account as the LIAM provider credential."
|
||||||
|
Write-Host "2. Create AD service groups and add members."
|
||||||
|
Write-Host "3. Read NTFS data areas."
|
||||||
|
Write-Host "4. Ensure missing NTFS permission groups and ACL entries."
|
||||||
|
Write-Host "5. Verify that AD deletes and writes outside the target OU fail."
|
||||||
Reference in New Issue
Block a user