Provide all users with ability to edit their own specific attributes in Active Directory - powershell

I've been working on a project that allows users in our domain to edit 3 Active Directory Attributes on their own Object, this has been written in Python and the only issue I have now is user permissions on these attributes.
Two of these are custom, the third is the Location(physicalOfficeDeliveryAddress).
I have looked everywhere and only found documentation on how to give permission for users in a group for these attributes but for ALL users or limited by group.
I'm looking to apply the permission under the Identity Reference: NT AUTHORITY\SELF so that users may only edit their own attributes.
In less words, I'm looking to write a script that will delegate permissions for three specific attributes to ALL users in the domain but only for themselves(NT AUTH\SELF).
I have a loop that will perform it for each user, I just have hit a brick wall in what to include in the loop..
Any help would be appreciated.


NT AUTHORITY\SELF is one of Windows' well-known SIDs, with a SID of S-1-5-10.
So you do it the same way you would for any other account, but grant the permissions to S-1-5-10 instead.
If you show us the code you're working with, we might be able to help you with where to plug in that value, if you need.

Related

How to secure resources with Casbin based on multiple groups membership

What is the best option to implement such security in Casbin?
I have several folders, each of them has its own security (i.e. the users allowed to accede it)
But that's not enough, the action a user is allowed to performed in a folder depends on user's group
As an example:
alice can be admin for folder1 so she can read and write within it
alice can be user for folder2 so she can only read
I was thinking of using 1 group per role (user, admin) and 1 group per folder, however this is not fine because once a user is assigned a role, he cannot change
I looked at RBAC with domains and this can work until I duplicate all my policies for each folder (yeah, all users will always have the same rights in folder...) because domain must be part of the policy itself
Do you have any suggestion on how to achieve this?
Thanks

How to Manage Spammers on Facebook Group?

I'm the admin of a few Facebook groups and I would like to know how I could do the following:
I would like to know how I could search the current and pending members in the group to see if their name matches with names on a text file of blacklisted members that I have?
There is no way to do this with Facebook itself unless there are ways with Developer access?
It is also impossible to see all the members easily as they have no list mode, only large thumbnails are shown next to each name which makes it difficult to try to copy and paste the names to another text file.

Steps to adding Group permissions to a File in box

I'm using Box.com with both JWT and OAuth and I can't seem to figure out how to add group level permissions to files or folders. Can anyone tell me where I go to get at that? I've looked in the UI seemingly every where and I can't seem to find the Group permissions stuff.
All I can seem to find is how to Invite emails to the file.
In the edit group/create group area i found a way to assign folders to the group. perhaps that is the maximum of the fine-grainness of the security?

Here's info about Box File-Level Collaboration that you can only do through the api.
https://community.box.com/t5/Developer-Forum/New-file-level-collaboration-support/m-p/27106#M1297

Sitecore - Is there a way to reset all Access Rights in User Manager or Security Editor?

I currently have a user whose Access Rights are messed up and I'd like to reset them. I could be blind but does anyone know of a way to do this?

I am not aware of a way to reset the user rights.
The only way I can think of is deleting the user and create a new one, or write a script that loops to the tree or retrieves al items that the current user has rights on and resets the rights for this user.

Security of an item is stored within the __security field on the item itself. Furthermore, security is stored by the name of the user or role, not by an ID. Deleting a user/role will not modify any item that references that user/role so you effectively get orphaned access rights.
I had created a script years ago that will report on (and reset) the security of items. It is available from my blog post and I referenced it within this similar question. You should be able to modify that script to remove a single user's rights.

So far, the only way I've been able to do this is to go into the Security Editor, select the user, then open every item in the tree and unset every access right manually to the default setting of Inherited.
For instance, there are at least a Read/Write/Rename/Create/Delete/Administer/Inheritance permission on just the Home item alone. Each permission has one of the following states: Inherited/Allowed/Denied/Item vs. Descendant Right/Protected/Not Applicable. If any of those are set, manually unset it. So, if it were set to Allowed, you'd click the green check mark which would unset it from Allowed (I guess you could argue I'm setting it to Inherited).
To get back to square one, everything should be set back to Inherited.

user account "effective permissions" with powershell

I need to compare AD users permissions (one user can "unset" an attribute and another cannot, both can change it).
How can I dump/compare user account "effective permissions" which I find when I go to user account > Security > Advanced > Effective Permissions (and select an user account) with powershell?

Using Quest Free PowerShell Commands for Active Directory is simple:
Get-QadPermission useraccountname -Inherited
or better way:
Get-QADUser -Name useraccountname -SecurityMask DACL | Get-QADPermission -Inherited -SchemaDefault
This return all effective permission Inherited or Explicit assigned for the user 'useraccountname'
The comparison can be made with compare-object.
A very simple example:
compare-object (Get-QADPermission userA -Inherited | select Rights) (Get-QADPermission userB -Inherited | select rights)

We were in a similar situation once and needed to know who all could delete one of our main OUs, so we figured that maybe we should dump the ACL on the OU and look for everyone who had delete permissions on the object. Of course dsacls was very helpful in this regard and we could dump the ACL on it easily.
But then, as we started looking at the ACL, we found that it had almost 60 permission entries, including about half a dozen deny entries, some of which were direct and others inherited. We initially didn't consider the denies and came up with a list of about 200 users who could delete the OU, but that did not seem right (; it seemed too high.) Then, we realized that we had to intersect the denies with the allows!
So we flattened all deny permissions, and all allow permissions, but then we had to figure out which of these denies would apply, since some of them were inherited, and I believe the inherited ones don't negate any direct allows, so that took some more pain-staking work, and while doing it we realized that some of those inherited permissions did not apply to the object, so we had to start from scratch!
Finally, we almost gave up, and when I asked one of our Enterprise Admins, he said what we needed to do was determine Effective Permissions on our OU, and he pointed us to the Effective Permissions Tab in the Active Directory Users and Computers snap-in.
So we launched ADUC and navigated to the Effective Permissions Tab, and figured it would be a matter of clicking OK somewhere. However, we soon realized that it needed us to enter each person's name individually. Now, we have almost 2000 people in our environment, so there was no way we could put in 2000 people's names one by one. The other thing was that even for a single person, it would show us all the effective permissions for that person, and in technical terms, which we would have to further refine.
We then figured we'd give Powershell a shot, and looked at many options to do this using Powerhsell, but there was no easy to determine effective permissions in AD using Powershell, which was disappointing. In particular, we tried Quest's free PowerShell commands Get-QadPermission useraccountname and Get-QADUser -Name useraccountname, but we were disappointed to see that this only retrieved the list of all permissions specified for a given user. It did not reveal the Effective Permissions granted to a user. We found ourselves having to start with the results it brought back to then manually try and determine effective permissions, which was not worth our time.
So, we had almost given up hope, but before quitting we thought we would just Google "Active Directory Effective Permissions Tool" with the hope that there must be something out there that could do this for us. I am glad we did because we found a tool that could do exactly what we needed: figure out effective permissions on our OU and give us the ability to export these effective permissions -
http://www.paramountdefenses.com/goldfinger_capabilities_true_effective_permissions_for_active_directory.html
We found that this tool (called Gold Finger for AD) has the ability to determine Effective Permissions on Active Directory objects, and provide the output such that we could easily see the list of all users who had "effective permissions" for a specific right on an object. For instance, we were able to use it to determine and enumerate the list of all admins who had "effective delete access" rights on the OU we were interested in.
It has turned out to be quite helpful for us, and maybe it could be of help to you too. I just thought I would share this because I've been the dsacls route and I wouldn't want you to go through the same pain we did in trying to manually do this. Its just too painful to do do manually.