검사는 OU가 실수로 삭제 내가 OU의 작업을했다

Question

로부터 보호 그냥

OU가 실수로 삭제로부터 보호할지 여부를 제가 확인할 수있는 방법이 있나요 알아 내려고하면?

나는 봤지만 해결책을 찾지 못했습니다.

C#으로 스크립팅하지 않는 솔루션을 찾고 있습니다.

미리 감사드립니다.

Answer 1

systemFlags 속성을 확인하십시오. ADS_SYSTEMFLAG_ENUM에있는 MS 페이지에는 C++ 예제가 있으므로 C#에 맞게 쉽게 작성해야합니다.

Answer 2

개체 (ntSecurityDescriptor 특성)에 대한 ACL을 열고 Everyone Deny (거부)를 찾아야합니다. ActiveDirectorySecurity 클래스는 이것을 관리하는 래퍼를 제공합니다 (http://msdn.microsoft.com/en-us/library/system.directoryservices.activedirectorysecurity.aspx).

Answer 3

활성 디렉토리 cmdlet을 사용하여 powershell에서 간단한 행을 사용할 수 있습니다. Get-ADObject -Filter * -Properties ProtectedFromAccidentalDeletion | 여기서 {$ _. ProtectedFromAccidentalDeletion -eq $ true}

그리고 나중에 변경하려면 파이프를 | Set-ADObject -ProtectedFromAccidentalDeletion : $ false

Answer 4

다음은 실수로 삭제되지 않도록 보호되는지 확인하기 위해 OU를 가져오고 ACL을 찾는 코드 조각입니다.
이 [System.Security.AccessControl]의 [System.DirectoryServices]을 사용하고 [System.Security.Principal] 네임 스페이스

bool? protected = null; 
DirectoryEntry de = new DirectoryEntry("LDAP://OU=TestOu,DC=Test,DC=Local", "Username", "Password"); 
ActiveDirectorySecurity ads = de.ObjectSecurity; 
AuthorizationRuleCollection rules = ads.GetAccessRules(true, true, typeof(NTAccount); 
foreach (ActiveDirectoryAccessRule rule in rules) 
    if (rule.AccessControlType == AccessControlType.Deny) 
     if (rule.ActiveDirectoryRights == (ActiveDirectoryRights.DeleteChild | ActiveDirectoryRights.DeleteTree | ActiveDirectoryRights.Delete)) 
      protected = true; 
     else 
      protected = false; 

ACL을 적용 (150)을 통해 내가 가진 OU에 내 루트 중 하나에 대해이 작업을 실행

및 그것은 두 번째 또는 두 번째로 대답을 되 돌렸다.

Answer 5

AD 개체를 보호하려면 두 개의 ACE가 필요합니다. 하나는 "Delete + DeleteTree 거부"로, 보호 할 개체에 설정해야합니다. 두 번째 "DeleteChild 거부"는 부모 개체에 설정해야합니다. 보호를 제거해야하는 경우 개체의 ACE 만 삭제해야합니다. 동일한 OU의 다른 개체가 더 이상 보호되지 않기 때문에 상위 개체의 ACE가 유지되어야합니다! 내가 위에서 아무것도 못하고 있어요

//using System.Security.Principal 
    //using System.DirectoryServices; 


    public static void SetProtectADObject(DirectoryEntry ent, bool Protect = true) 
    { 
     //get parent object 
     var parentEnt = new DirectoryEntry(ent.Parent.Path); 

     //refresh objects 
     ent.RefreshCache(); 
     parentEnt.RefreshCache(); 

     if (Protect) 
     { 
      #region Protect 
      try 
      { 
       IdentityReference everyOneAccount = new NTAccount("Everyone").Translate(typeof(SecurityIdentifier)); //S-1-1-0 
       var objAce = new ActiveDirectoryAccessRule(everyOneAccount, ActiveDirectoryRights.Delete | ActiveDirectoryRights.DeleteTree, AccessControlType.Deny); 
       var parentAce = new ActiveDirectoryAccessRule(everyOneAccount, ActiveDirectoryRights.DeleteChild, AccessControlType.Deny); 

       //check if ace present on object 
       var objACL = ent.ObjectSecurity; 
       bool acePresent = false; 
       foreach (ActiveDirectoryAccessRule ace in objACL.GetAccessRules(true, false, typeof(NTAccount))) 
       { 
        if (ace.IdentityReference.Value == "Everyone") 
        { 
         if (ace.ActiveDirectoryRights == (ActiveDirectoryRights.DeleteTree | ActiveDirectoryRights.Delete)) { acePresent = true; break; } 
         else if (ace.ActiveDirectoryRights == (ActiveDirectoryRights.DeleteChild | ActiveDirectoryRights.DeleteTree | ActiveDirectoryRights.Delete)) { acePresent = true; break; } 
        } 
       } 

       if (!acePresent) 
       { 
        //set ace to object 
        objACL.AddAccessRule(objAce); 

        //commit changes 
        ent.CommitChanges(); 
       } 

       //check if ace present on parent object 
       var parentACL = parentEnt.ObjectSecurity; 
       bool parentAcePresent = false; 
       foreach (ActiveDirectoryAccessRule ace in parentACL.GetAccessRules(true, false, typeof(NTAccount))) 
       { 
        if (ace.IdentityReference.Value == "Everyone") 
        { 
         if (ace.ActiveDirectoryRights == (ActiveDirectoryRights.DeleteChild)) { parentAcePresent = true; break; } 
         else if (ace.ActiveDirectoryRights == (ActiveDirectoryRights.DeleteChild | ActiveDirectoryRights.DeleteTree | ActiveDirectoryRights.Delete)) { parentAcePresent = true; break; } 
        } 
       } 

       if (!parentAcePresent) 
       { 
        //set ace to parent object 
        parentACL.AddAccessRule(parentAce); 

        //commit changes 
        parentEnt.CommitChanges(); 
       } 
      } 
      catch (Exception ex) 
      { 
       throw new Exception(string.Format("Error protecting object {0}", ent.Path), ex); 
      } 
      #endregion 
     } 
     else 
     { 
      #region Unprotect 
      //to remove the protection we remove only the ACE from the object, not from the parent. 
      //The ACE on the parent must be in place because otherwise other objects on the same level will not protected anymore! 

      try 
      { 
       IdentityReference everyOneAccount = new NTAccount("Everyone").Translate(typeof(SecurityIdentifier)); //S - 1 - 1 - 0 
       var objAce = new ActiveDirectoryAccessRule(everyOneAccount, ActiveDirectoryRights.Delete | ActiveDirectoryRights.DeleteTree, AccessControlType.Deny); 

       //check if ace present on object 
       var objACL = ent.ObjectSecurity; 
       bool acePresent = false; 
       foreach (ActiveDirectoryAccessRule ace in objACL.GetAccessRules(true, false, typeof(NTAccount))) 
       { 
        if (ace.IdentityReference.Value == "Everyone") 
        { 
         if (ace.ActiveDirectoryRights == (ActiveDirectoryRights.DeleteTree | ActiveDirectoryRights.Delete)) { acePresent = true; break; } 
         else if (ace.ActiveDirectoryRights == (ActiveDirectoryRights.DeleteChild | ActiveDirectoryRights.DeleteTree | ActiveDirectoryRights.Delete)) { acePresent = true; break; } 
        } 
       } 

       //set ace to object 
       if (acePresent) 
       { 
        ent.ObjectSecurity.RemoveAccessRule(objAce); 
        ent.CommitChanges(); 
       } 
      } 
      catch (Exception ex) 
      { 
       throw new Exception(string.Format("Error unprotecting object {0}", ent.Path), ex); 
      } 
      #endregion 
     } 
    } 

    public static bool IsADObjectProtected(DirectoryEntry ent) 
    { 
     //get parent object 
     var parentEnt = new DirectoryEntry(ent.Parent.Path); 

     //refresh objects 
     ent.RefreshCache(); 
     parentEnt.RefreshCache(); 

     //get current ACLs 
     ActiveDirectorySecurity acl = ent.ObjectSecurity; 
     ActiveDirectorySecurity parentAcl = ent.Parent.ObjectSecurity; 
     AuthorizationRuleCollection rules = acl.GetAccessRules(true, true, typeof(NTAccount)); 
     AuthorizationRuleCollection parentRules = parentAcl.GetAccessRules(true, false, typeof(NTAccount)); 

     //check object acl 
     bool acePresent = false; 
     foreach (ActiveDirectoryAccessRule ace in rules) 
     { 
      Console.WriteLine(ace.AccessControlType.ToString()); 
      if (ace.AccessControlType == AccessControlType.Deny) 
      { 
       if (ace.ActiveDirectoryRights == (ActiveDirectoryRights.DeleteTree | ActiveDirectoryRights.Delete)) { acePresent = true; break; } 
       else if (ace.ActiveDirectoryRights == (ActiveDirectoryRights.DeleteChild | ActiveDirectoryRights.DeleteTree | ActiveDirectoryRights.Delete)) { acePresent = true; break; } 
      } 
     } 

     //check parent acl 
     bool parentAcePresent = false; 
     foreach (ActiveDirectoryAccessRule ace in parentRules) 
     { 
      if (ace.AccessControlType == AccessControlType.Deny) 
      { 
       if (ace.ActiveDirectoryRights == (ActiveDirectoryRights.DeleteChild)) { parentAcePresent = true; break; } 
       else if (ace.ActiveDirectoryRights == (ActiveDirectoryRights.DeleteChild | ActiveDirectoryRights.DeleteTree | ActiveDirectoryRights.Delete)) { parentAcePresent = true; break; } 
      } 
     } 

     return parentAcePresent && acePresent; 
    }