PowerShell/ActiveDirectory/Get-UnresolvableSIDsFromADObjectACLAccessRules/Get-UnresolvableSIDsFromADObjectACLAccessRules.ps1 at main · tomstryhn/PowerShell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
#Requires -Modules ActiveDirectory

<#PSScriptInfo

.DESCRIPTION Lists all the unique Unresolvable SID(s) in the ACL Access Rules from an ADObject

.VERSION 1.0.1.0

.GUID f5dc7e97-143b-443e-afa1-e83ee1bc93ed

.AUTHOR Tom Stryhn

.COMPANYNAME Tom Stryhn

.COPYRIGHT 2022 (c) Tom Stryhn

.TAGS Microsoft Active Directory ACL Access Rule Rules ADObject SID Unresolvable Unknown

.LICENSEURI https://github.com/tomstryhn/PowerShell/blob/main/LICENSE

.PROJECTURI https://github.com/tomstryhn/PowerShell/ActiveDirectory/Get-UnresolvableSIDsFromADObjectACLAccessRules/

#>

function Get-UnresolvableSIDsFromADObjectACLAccessRules {

<#
.SYNOPSIS
    Lists all the unique Unresolvable SID(s) in the ACL Access Rules from an ADObject.

.DESCRIPTION
    Lists all the unique Unresolvable SID(s) in the ACL Access Rules from an ADObject,
    using -Verbose will additionally output statistics, useful when using pipeline
    input to the function.

.PARAMETER DistinguishedName
    The DistinguishedName of the targeted ADObject

.EXAMPLE
    PS C:\> Get-UnresolvableSIDsFromADObjectACLAccessRules -DistinguishedName 'OU=TestOU,DC=Dev,DC=local'

    DistinguishedName         UnresolvableSIDs
    -----------------         ----------------
    OU=TestOU,DC=Dev,DC=local S-1-5-21-1234567890-1234567890-1234567890-12345

.EXAMPLE
    PS C:\> Get-ADObject -SearchBase 'OU=TestOU,DC=Dev,DC=local' -Filter * | Get-UnresolvableSIDsFromADObjectACLAccessRules -Verbose

    DistinguishedName                              UnresolvableSIDs
    -----------------                              ----------------
    CN=TestUser,OU=Users,OU=TestOU,DC=dev,DC=local S-1-5-21-1234567890-1234567890-1234567890-12345

    VERBOSE: Total ADObject(s) processed:               [              174 ]
    VERBOSE: ACL Access Rules Processed:                [            26358 ]
    VERBOSE: ACL Access Rules with Unresolvable SID(s): [               23 ]

.NOTES
    FUNCTION: Get-UnresolvableSIDsFromADObjectACLAccessRules
    AUTHOR:   Tom Stryhn
    GITHUB:   https://github.com/tomstryhn/

.INPUTS
    System.String

.OUTPUTS
    System.Management.Automation.PSCustomObject

#>

    [CmdletBinding()]
    param (
        # DistinguishedName of AD Object
        [Parameter(ValueFromPipelineByPropertyName, Mandatory)]
        [String]
        $DistinguishedName
    )

    begin {

        $objectsProcessed                   = 0
        $aclRulesProcessed                  = 0
        $aclRulesWithUnresolvableSIDsFound  = 0

    }

    process {

        try {
            $objectsProcessed++
            $objectPath = "ActiveDirectory:://RootDSE/" + $DistinguishedName
            $objectACL  = Get-Acl -Path $objectPath
        }
        catch {
            Write-Verbose -Message "Error reading ACLs on: [$objectPath]"
        }

        $unresolvedSIDs = @()

        foreach($ACL in $objectACL.Access) {

            $aclRulesProcessed++

            if($ACL.IdentityReference -match "^(?'SID'S-1-5-21(-\d{1,10}){1,10})$") {

                $isUnresolved = $false

                try {
                    $adObject = [ADSI]"LDAP://<SID=$($Matches.SID)>"
                    if(-not $adObject.DistinguishedName) {
                        $isUnresolved = $true
                    }
                }
                catch {
                    $isUnresolved = $true
                }

                if($isUnresolved) {
                    $aclRulesWithUnresolvableSIDsFound++
                    $unresolvedSIDs += $ACL.IdentityReference
                }
            }
        }

        if($unresolvedSIDs) {
            $unresolvedSIDs = $unresolvedSIDs | Sort-Object Value -Unique
            [PSCustomObject]@{
                DistinguishedName = $DistinguishedName
                UnresolvableSIDs  = $unresolvedSIDs
            }
        }
    }

    end {

        "Total ADObject(s) processed:               [ $("{0,16}" -f $objectsProcessed) ]"              | Write-Verbose
        "ACL Access Rules Processed:                [ $("{0,16}" -f $aclRulesProcessed) ]"             | Write-Verbose
        "ACL Access Rules with Unresolvable SID(s): [ $("{0,16}" -f $aclRulesWithUnresolvableSIDsFound) ]`n" | Write-Verbose

    }
}