mirror of https://github.com/raandree/NTFSSecurity
Browse Source
The suite runner removes its stage on a machine after it has copied the results back; after an early stop, the stage stays for the diagnosis. The end-state check counts the items in the stage folders and the scheduled tasks and standard users of the kit, and -Mode Repair removes what is left of the stage and the tasks. Probe-AccountRecreation.ps1 deletes an account and creates it again with the same name in a loop, logs the user on with Kerberos S4U on the domain controller, the client, and the file server, and asks Get-NTFSEffectiveAccess of each module under test. It shows that Windows returns the old SID and groups, whichever version of the module asks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: AI Assistant <ai@example.com>pull/119/head
Raimund Andree
2 days ago
3 changed files with 177 additions and 5 deletions
@ -0,0 +1,151 @@ |
|||
[CmdletBinding()] |
|||
param ( |
|||
[Parameter(Mandatory)] [string[]] $ModulePath, |
|||
[Parameter(Mandatory)] [string] $OutFile, |
|||
[string] $Client = 'OSWin11E', |
|||
[string] $DomainController = 'OSDC1', |
|||
[string] $FileServer = 'OSFile22', |
|||
[ValidateRange(2, 20)] [int] $Rounds = 4, |
|||
[string] $LabName = 'NtfsSecurityOsMatrixLab' |
|||
) |
|||
|
|||
# Probe of the groups that a computer reports for an account that was deleted and created again with the same name (Decision 24). In each |
|||
# round it creates a user in a group that is in another group, with the same names and new SIDs, and a folder on the file server whose DACL |
|||
# grants the outer group ReadAndExecute. Then it logs the user on with Kerberos S4U, like the oracle of the live tests does, on the domain |
|||
# controller, the client, and the file server, and asks from the client, in a new process for each module, for the effective access of the |
|||
# account on the folder by name and by SID, with the default server name and with the name of the file server. -ModulePath takes module |
|||
# folders as label=path, such as baseline=C:\Build\NTFSSecurity. From the second round on, a computer that still holds the deleted account |
|||
# reports its SID, and every module reports no access (Synchronize only), whichever its version. The probe removes everything it created; the |
|||
# accounts, the folder, and the files on the client are named NtfsProbe*, so Test-MatrixCleanup.ps1 reports a leftover. The password of the |
|||
# user is random and exists only in memory. Windows PowerShell 5.1 on the Hyper-V host, with AutomatedLab. |
|||
& { |
|||
$ErrorActionPreference = 'Stop' |
|||
# -File passes an array as one string, so a list may arrive as 'A,B'. |
|||
$modules = @( |
|||
foreach ($entry in @($ModulePath | ForEach-Object -Process { $_ -split ',' } | Where-Object -FilterScript { $_ })) { |
|||
$label, $path = $entry -split '=', 2 |
|||
if (-not $path -or -not (Test-Path -LiteralPath (Join-Path -Path $path -ChildPath 'NTFSSecurity.psd1'))) { throw "-ModulePath takes label=folder with a module; '$entry' has none." } |
|||
[pscustomobject]@{ Label = $label; Path = $path } |
|||
} |
|||
) |
|||
Import-Module -Name AutomatedLab -ErrorAction Stop |
|||
Import-Lab -Name $LabName -NoValidation -NoDisplay |
|||
$domainName = (Get-Lab).Domains[0].Name |
|||
$netBiosName = $domainName.Split('.')[0].ToUpperInvariant() |
|||
$dcSession = New-LabPSSession -ComputerName $DomainController |
|||
$clientSession = New-LabPSSession -ComputerName $Client |
|||
$serverSession = New-LabPSSession -ComputerName $FileServer |
|||
$machines = [ordered]@{ $DomainController = $dcSession; $Client = $clientSession; $FileServer = $serverSession } |
|||
$userName = 'NtfsProbeSubject' |
|||
$innerName = 'NtfsProbeInner' |
|||
$outerName = 'NtfsProbeOuter' |
|||
$folderName = 'NtfsProbeRecreation' |
|||
$stageName = 'C:\NtfsProbeModules' |
|||
$report = New-Object -TypeName 'System.Collections.Generic.List[string]' |
|||
$bytes = New-Object -TypeName 'byte[]' -ArgumentList 24 |
|||
$generator = [Security.Cryptography.RandomNumberGenerator]::Create() |
|||
try { $generator.GetBytes($bytes) } finally { $generator.Dispose() } |
|||
# Base64 has upper case and lower case letters and digits; the suffix adds the other classes of a domain's complexity rules. |
|||
$secret = New-Object -TypeName 'System.Security.SecureString' |
|||
foreach ($character in ([Convert]::ToBase64String($bytes) + '!a1Z').ToCharArray()) { $secret.AppendChar($character) } |
|||
$secret.MakeReadOnly() |
|||
|
|||
$removeOnDcScript = { |
|||
param ($User, $Inner, $Outer) |
|||
Import-Module -Name ActiveDirectory |
|||
foreach ($name in $User) { Get-ADUser -Filter "SamAccountName -eq '$name'" | Remove-ADUser -Confirm:$false } |
|||
foreach ($name in $Inner, $Outer) { Get-ADGroup -Filter "SamAccountName -eq '$name'" | Remove-ADGroup -Confirm:$false } |
|||
} |
|||
$createOnDcScript = { |
|||
param ($User, $Inner, $Outer, [securestring] $Secret) |
|||
Import-Module -Name ActiveDirectory |
|||
$null = New-ADGroup -Name $Outer -SamAccountName $Outer -GroupScope Global |
|||
$null = New-ADGroup -Name $Inner -SamAccountName $Inner -GroupScope Global |
|||
Add-ADGroupMember -Identity $Outer -Members $Inner |
|||
$null = New-ADUser -Name $User -SamAccountName $User -UserPrincipalName ('{0}@{1}' -f $User, (Get-ADDomain).DNSRoot) -AccountPassword $Secret -Enabled $true |
|||
Add-ADGroupMember -Identity $Inner -Members $User |
|||
[pscustomobject]@{ User = (Get-ADUser -Identity $User).SID.Value; Outer = (Get-ADGroup -Identity $Outer).SID.Value } |
|||
} |
|||
$setFolderScript = { |
|||
param ($Folder, $OuterSid) |
|||
$path = Join-Path -Path $env:SystemDrive -ChildPath $Folder |
|||
if (-not (Test-Path -LiteralPath $path)) { $null = New-Item -ItemType Directory -Path $path } |
|||
$acl = New-Object -TypeName 'System.Security.AccessControl.DirectorySecurity' |
|||
$acl.SetAccessRuleProtection($true, $false) |
|||
foreach ($entry in @(@('S-1-5-32-544', 'FullControl'), @('S-1-5-18', 'FullControl'), @($OuterSid, 'ReadAndExecute'))) { |
|||
$acl.AddAccessRule((New-Object -TypeName 'System.Security.AccessControl.FileSystemAccessRule' -ArgumentList ([Security.Principal.SecurityIdentifier] $entry[0]), $entry[1], 'ContainerInherit,ObjectInherit', 'None', 'Allow')) |
|||
} |
|||
|
|||
Set-Acl -LiteralPath $path -AclObject $acl |
|||
} |
|||
$tokenScript = { |
|||
param ($User, $Domain, $UserSid, $OuterSid) |
|||
try { |
|||
$identity = New-Object -TypeName 'System.Security.Principal.WindowsIdentity' -ArgumentList ('{0}@{1}' -f $User, $Domain) |
|||
$groups = @($identity.Groups | ForEach-Object -Process { $_.Value }) |
|||
'S4U token of the {0} account, outer group {1}' -f $(if ($identity.User.Value -eq $UserSid) { 'CURRENT' } else { 'OLD' }), ($groups -contains $OuterSid) |
|||
} |
|||
catch { 'S4U logon failed: ' + $_.Exception.Message } |
|||
} |
|||
$effectiveScript = { |
|||
param ($ModuleFolder, $Folder, $Server, $Domain, $NetBios, $User, $UserSid) |
|||
Import-Module -Name (Join-Path -Path $ModuleFolder -ChildPath 'NTFSSecurity.psd1') -Force |
|||
$unc = '\\{0}.{1}\C$\{2}' -f $Server, $Domain, $Folder |
|||
$name = '{0}\{1}' -f $NetBios, $User |
|||
function Measure-Answer { |
|||
param ([hashtable] $Arguments) |
|||
$result = @(Get-NTFSEffectiveAccess @Arguments -WarningAction SilentlyContinue -ErrorAction SilentlyContinue -ErrorVariable failures) |
|||
$value = if ($result.Count) { '0x{0:X}' -f ([long] $result[0].AccessRights) } else { 'none' } |
|||
if (@($failures).Count) { $value += ' ERR ' + $failures[0].Exception.Message } |
|||
$value |
|||
} |
|||
|
|||
$serverName = '{0}.{1}' -f $Server, $Domain |
|||
'effective access by name {0}, by name and server {1}, by SID {2}, by SID and server {3}' -f |
|||
(Measure-Answer -Arguments @{ Path = $unc; Account = $name }), |
|||
(Measure-Answer -Arguments @{ Path = $unc; Account = $name; ServerName = $serverName }), |
|||
(Measure-Answer -Arguments @{ Path = $unc; Account = $UserSid }), |
|||
(Measure-Answer -Arguments @{ Path = $unc; Account = $UserSid; ServerName = $serverName }) |
|||
} |
|||
$runEffectiveScript = { |
|||
param ($Stage, $ModuleLabel, $ScriptText, $Folder, $Server, $Domain, $NetBios, $User, $UserSid) |
|||
$block = [scriptblock]::Create($ScriptText) |
|||
$powershell = Join-Path -Path $env:SystemRoot -ChildPath 'System32\WindowsPowerShell\v1.0\powershell.exe' |
|||
& $powershell -NoProfile -ExecutionPolicy Bypass -Command $block -args (Join-Path -Path $Stage -ChildPath $ModuleLabel), $Folder, $Server, $Domain, $NetBios, $User, $UserSid |
|||
} |
|||
try { |
|||
Invoke-Command -Session $dcSession -ScriptBlock $removeOnDcScript -ArgumentList $userName, $innerName, $outerName |
|||
Invoke-Command -Session $clientSession -ArgumentList $stageName -ScriptBlock { param ($Stage) if (Test-Path -LiteralPath $Stage) { Remove-Item -LiteralPath $Stage -Recurse -Force }; $null = New-Item -ItemType Directory -Path $Stage -Force } |
|||
foreach ($module in $modules) { |
|||
Invoke-Command -Session $clientSession -ArgumentList (Join-Path -Path $stageName -ChildPath $module.Label) -ScriptBlock { param ($Path) $null = New-Item -ItemType Directory -Path $Path -Force } |
|||
Copy-Item -Path (Join-Path -Path $module.Path -ChildPath '*') -Destination (Join-Path -Path $stageName -ChildPath $module.Label) -ToSession $clientSession -Recurse -Force |
|||
} |
|||
|
|||
for ($round = 1; $round -le $Rounds; $round++) { |
|||
$created = Invoke-Command -Session $dcSession -ScriptBlock $createOnDcScript -ArgumentList $userName, $innerName, $outerName, $secret |
|||
Invoke-Command -Session $serverSession -ScriptBlock $setFolderScript -ArgumentList $folderName, $created.Outer |
|||
$report.Add(('round {0} at {1:HH:mm:ss}Z: subject {2}, outer group {3}' -f $round, [DateTime]::UtcNow, $created.User, $created.Outer)) |
|||
foreach ($machine in $machines.Keys) { |
|||
$report.Add((' {0}: {1}' -f $machine, (Invoke-Command -Session $machines[$machine] -ScriptBlock $tokenScript -ArgumentList $userName, $domainName, $created.User, $created.Outer))) |
|||
} |
|||
|
|||
# The order of the modules alternates, so that the module that asks first is not always the same. |
|||
$ordered = if ($round % 2) { $modules } else { @($modules)[($modules.Count - 1)..0] } |
|||
foreach ($module in $ordered) { |
|||
$answer = Invoke-Command -Session $clientSession -ArgumentList $stageName, $module.Label, $effectiveScript.ToString(), $folderName, $FileServer, $domainName, $netBiosName, $userName, $created.User -ScriptBlock $runEffectiveScript |
|||
$report.Add((' {0} on {1}: {2}' -f $module.Label, $Client, (@($answer) -join ' '))) |
|||
} |
|||
|
|||
Invoke-Command -Session $dcSession -ScriptBlock $removeOnDcScript -ArgumentList $userName, $innerName, $outerName |
|||
} |
|||
} |
|||
finally { |
|||
try { Invoke-Command -Session $dcSession -ScriptBlock $removeOnDcScript -ArgumentList $userName, $innerName, $outerName } catch { $report.Add("cleanup on the domain controller failed: $($_.Exception.Message)") } |
|||
try { Invoke-Command -Session $serverSession -ArgumentList $folderName -ScriptBlock { param ($Folder) Remove-Item -LiteralPath (Join-Path -Path $env:SystemDrive -ChildPath $Folder) -Recurse -Force -ErrorAction SilentlyContinue } } catch { $report.Add("cleanup on the file server failed: $($_.Exception.Message)") } |
|||
try { Invoke-Command -Session $clientSession -ArgumentList $stageName -ScriptBlock { param ($Stage) Remove-Item -LiteralPath $Stage -Recurse -Force -ErrorAction SilentlyContinue } } catch { $report.Add("cleanup on the client failed: $($_.Exception.Message)") } |
|||
$report | Set-Content -LiteralPath $OutFile -Encoding utf8 |
|||
Remove-PSSession -Session @($machines.Values) -ErrorAction SilentlyContinue |
|||
} |
|||
|
|||
'done' |
|||
} |
|||
Loading…
Reference in new issue