Skip to content

Commit 021ac9a

Browse files
MichaelGrafnetterMichaelGrafnetter
committed
Improved offline UAC modification
1 parent 2867c53 commit 021ac9a

File tree

13 files changed

+1412
-100
lines changed

13 files changed

+1412
-100
lines changed

‎Documentation/PowerShell/Disable-ADDBAccount.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,4 +191,5 @@ This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable
191191
192192
[Enable-ADDBAccount](Enable-ADDBAccount.md)
193193
[Unlock-ADDBAccount](Unlock-ADDBAccount.md)
194+
[Set-ADDBAccountControl](Set-ADDBAccountControl.md)
194195
[Get-ADDBAccount](Get-ADDBAccount.md)

‎Documentation/PowerShell/Enable-ADDBAccount.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,4 +191,5 @@ This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable
191191
192192
[Disable-ADDBAccount](Disable-ADDBAccount.md)
193193
[Unlock-ADDBAccount](Unlock-ADDBAccount.md)
194+
[Set-ADDBAccountControl](Set-ADDBAccountControl.md)
194195
[Get-ADDBAccount](Get-ADDBAccount.md)

‎Documentation/PowerShell/Readme.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,9 @@ Disables an Active Directory account in an offline ntds.dit file.
3939
### [Unlock-ADDBAccount](Unlock-ADDBAccount.md#unlock-addbaccount)
4040
Unlocks an Active Directory account in an offline ntds.dit file.
4141

42+
### [Set-ADDBAccountControl](Set-ADDBAccountControl.md#set-addbaccountcontrol)
43+
Modifies user account control (UAC) values for an Active Directory account in an offline ntds.dit file.
44+
4245
### [Add-ADDBSidHistory](Add-ADDBSidHistory.md#add-addbsidhistory)
4346
Adds one or more values to the sIDHistory attribute of an object in a ntds.dit file.
4447

‎Documentation/PowerShell/Set-ADDBAccountControl.md‎

Lines changed: 291 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,291 @@
1+
---
2+
external help file: DSInternals.PowerShell.dll-Help.xml
3+
Module Name: DSInternals
4+
online version: https://github.com/MichaelGrafnetter/DSInternals/blob/master/Documentation/PowerShell/Set-ADDBAccountControl.md
5+
schema: 2.0.0
6+
---
7+
8+
# Set-ADDBAccountControl
9+
10+
## SYNOPSIS
11+
Modifies user account control (UAC) values for an Active Directory account in an offline ntds.dit file.
12+
13+
## SYNTAX
14+
15+
### ByName
16+
```
17+
Set-ADDBAccountControl [-Enabled <Boolean>] [-CannotChangePassword <Boolean>] [-PasswordNeverExpires <Boolean>]
18+
[-SmartcardLogonRequired <Boolean>] [-UseDESKeyOnly <Boolean>] [-HomedirRequired <Boolean>] [-SkipMetaUpdate]
19+
[-Force] [-SamAccountName] <String> -DatabasePath <String> [-LogPath <String>] [<CommonParameters>]
20+
```
21+
22+
### BySID
23+
```
24+
Set-ADDBAccountControl [-Enabled <Boolean>] [-CannotChangePassword <Boolean>] [-PasswordNeverExpires <Boolean>]
25+
[-SmartcardLogonRequired <Boolean>] [-UseDESKeyOnly <Boolean>] [-HomedirRequired <Boolean>] [-SkipMetaUpdate]
26+
[-Force] -ObjectSid <SecurityIdentifier> -DatabasePath <String> [-LogPath <String>] [<CommonParameters>]
27+
```
28+
29+
### ByDN
30+
```
31+
Set-ADDBAccountControl [-Enabled <Boolean>] [-CannotChangePassword <Boolean>] [-PasswordNeverExpires <Boolean>]
32+
[-SmartcardLogonRequired <Boolean>] [-UseDESKeyOnly <Boolean>] [-HomedirRequired <Boolean>] [-SkipMetaUpdate]
33+
[-Force] -DistinguishedName <String> -DatabasePath <String> [-LogPath <String>] [<CommonParameters>]
34+
```
35+
36+
### ByGuid
37+
```
38+
Set-ADDBAccountControl [-Enabled <Boolean>] [-CannotChangePassword <Boolean>] [-PasswordNeverExpires <Boolean>]
39+
[-SmartcardLogonRequired <Boolean>] [-UseDESKeyOnly <Boolean>] [-HomedirRequired <Boolean>] [-SkipMetaUpdate]
40+
[-Force] -ObjectGuid <Guid> -DatabasePath <String> [-LogPath <String>] [<CommonParameters>]
41+
```
42+
43+
## DESCRIPTION
44+
Finds an account in Active Directory database file and modifies the appropriate bit(s) in its *userAccountControl* attribute.
45+
46+
## EXAMPLES
47+
48+
### Example 1
49+
```powershell
50+
PS C:\> Set-ADDBAccountControl -SamAccountName john -SmartcardLogonRequired $false -PasswordNeverExpires $true -DatabasePath .\ntds.dit
51+
```
52+
53+
Finds an account with name *john*, disables the smart card logon requirement, and unexpires its password.
54+
55+
## PARAMETERS
56+
57+
### -CannotChangePassword
58+
Indicates whether the account can change its password.
59+
60+
```yaml
61+
Type: Boolean
62+
Parameter Sets: (All)
63+
Aliases:
64+
65+
Required: False
66+
Position: Named
67+
Default value: None
68+
Accept pipeline input: False
69+
Accept wildcard characters: False
70+
```
71+
72+
### -DatabasePath
73+
Specifies the path to a domain database, for instance, C:\Windows\NTDS\ntds.dit.
74+
75+
```yaml
76+
Type: String
77+
Parameter Sets: (All)
78+
Aliases: Database, DBPath, DatabaseFilePath, DBFilePath
79+
80+
Required: True
81+
Position: Named
82+
Default value: None
83+
Accept pipeline input: False
84+
Accept wildcard characters: False
85+
```
86+
87+
### -DistinguishedName
88+
Specifies the identifier of an account on which to perform this operation.
89+
90+
```yaml
91+
Type: String
92+
Parameter Sets: ByDN
93+
Aliases: dn
94+
95+
Required: True
96+
Position: Named
97+
Default value: None
98+
Accept pipeline input: True (ByPropertyName)
99+
Accept wildcard characters: False
100+
```
101+
102+
### -Enabled
103+
Indicates whether the account is enabled.
104+
105+
```yaml
106+
Type: Boolean
107+
Parameter Sets: (All)
108+
Aliases:
109+
110+
Required: False
111+
Position: Named
112+
Default value: None
113+
Accept pipeline input: False
114+
Accept wildcard characters: False
115+
```
116+
117+
### -Force
118+
Forces the cmdlet to perform the desired operation.
119+
120+
```yaml
121+
Type: SwitchParameter
122+
Parameter Sets: (All)
123+
Aliases:
124+
125+
Required: False
126+
Position: Named
127+
Default value: None
128+
Accept pipeline input: False
129+
Accept wildcard characters: False
130+
```
131+
132+
### -HomedirRequired
133+
Indicates whether a home directory is required for the account.
134+
135+
```yaml
136+
Type: Boolean
137+
Parameter Sets: (All)
138+
Aliases:
139+
140+
Required: False
141+
Position: Named
142+
Default value: None
143+
Accept pipeline input: False
144+
Accept wildcard characters: False
145+
```
146+
147+
### -LogPath
148+
Specifies the path to a directory where the transaction log files are located. For instance, C:\Windows\NTDS. The default log directory is the one that contains the database file itself.
149+
150+
```yaml
151+
Type: String
152+
Parameter Sets: (All)
153+
Aliases: Log, TransactionLogPath
154+
155+
Required: False
156+
Position: Named
157+
Default value: None
158+
Accept pipeline input: False
159+
Accept wildcard characters: False
160+
```
161+
162+
### -ObjectGuid
163+
Specifies the identifier of an account on which to perform this operation.
164+
165+
```yaml
166+
Type: Guid
167+
Parameter Sets: ByGuid
168+
Aliases: Guid
169+
170+
Required: True
171+
Position: Named
172+
Default value: None
173+
Accept pipeline input: True (ByPropertyName)
174+
Accept wildcard characters: False
175+
```
176+
177+
### -ObjectSid
178+
Specifies the identifier of an account on which to perform this operation.
179+
180+
```yaml
181+
Type: SecurityIdentifier
182+
Parameter Sets: BySID
183+
Aliases: Sid
184+
185+
Required: True
186+
Position: Named
187+
Default value: None
188+
Accept pipeline input: True (ByPropertyName)
189+
Accept wildcard characters: False
190+
```
191+
192+
### -PasswordNeverExpires
193+
Indicates whether the password of the account can expire.
194+
195+
```yaml
196+
Type: Boolean
197+
Parameter Sets: (All)
198+
Aliases:
199+
200+
Required: False
201+
Position: Named
202+
Default value: None
203+
Accept pipeline input: False
204+
Accept wildcard characters: False
205+
```
206+
207+
### -SamAccountName
208+
Specifies the identifier of an account on which to perform this operation.
209+
210+
```yaml
211+
Type: String
212+
Parameter Sets: ByName
213+
Aliases: Login, sam
214+
215+
Required: True
216+
Position: 0
217+
Default value: None
218+
Accept pipeline input: True (ByPropertyName)
219+
Accept wildcard characters: False
220+
```
221+
222+
### -SkipMetaUpdate
223+
Indicates that the replication metadata of the affected object should not be updated.
224+
225+
```yaml
226+
Type: SwitchParameter
227+
Parameter Sets: (All)
228+
Aliases: SkipMeta, NoMetaUpdate, NoMeta, SkipObjMeta, NoObjMeta, SkipMetaDataUpdate, NoMetaDataUpdate
229+
230+
Required: False
231+
Position: Named
232+
Default value: None
233+
Accept pipeline input: False
234+
Accept wildcard characters: False
235+
```
236+
237+
### -SmartcardLogonRequired
238+
Indicates whether a smart card is required to logon.
239+
240+
```yaml
241+
Type: Boolean
242+
Parameter Sets: (All)
243+
Aliases:
244+
245+
Required: False
246+
Position: Named
247+
Default value: None
248+
Accept pipeline input: False
249+
Accept wildcard characters: False
250+
```
251+
252+
### -UseDESKeyOnly
253+
Indicates whether the account is restricted to use only Data Encryption Standard (DES) encryption types for keys.
254+
255+
```yaml
256+
Type: Boolean
257+
Parameter Sets: (All)
258+
Aliases:
259+
260+
Required: False
261+
Position: Named
262+
Default value: None
263+
Accept pipeline input: False
264+
Accept wildcard characters: False
265+
```
266+
267+
### CommonParameters
268+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
269+
270+
## INPUTS
271+
272+
### System.String
273+
274+
### System.Security.Principal.SecurityIdentifier
275+
276+
### System.Guid
277+
278+
## OUTPUTS
279+
280+
### None
281+
282+
## NOTES
283+
284+
## RELATED LINKS
285+
286+
[Set-ADDBAccountPassword](Set-ADDBAccountPassword.md)
287+
[Set-ADDBAccountPasswordHash](Set-ADDBAccountPasswordHash.md)
288+
[Enable-ADDBAccount](Enable-ADDBAccount.md)
289+
[Disable-ADDBAccount](Disable-ADDBAccount.md)
290+
[Unlock-ADDBAccount](Unlock-ADDBAccount.md)
291+
[Get-ADDBAccount](Get-ADDBAccount.md)

‎Documentation/PowerShell/Set-ADDBAccountPassword.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,9 @@ This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable
228228
229229
[Set-ADDBAccountPasswordHash](Set-ADDBAccountPasswordHash.md)
230230
[Set-SamAccountPasswordHash](Set-SamAccountPasswordHash.md)
231+
[Enable-ADDBAccount](Enable-ADDBAccount.md)
232+
[Disable-ADDBAccount](Disable-ADDBAccount.md)
233+
[Set-ADDBAccountControl](Set-ADDBAccountControl.md)
231234
[Unlock-ADDBAccount](Unlock-ADDBAccount.md)
232235
[Get-BootKey](Get-BootKey.md)
233236
[Get-ADDBAccount](Get-ADDBAccount.md)

‎Documentation/PowerShell/Set-ADDBAccountPasswordHash.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,9 @@ This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable
250250
251251
[Set-ADDBAccountPassword](Set-ADDBAccountPassword.md)
252252
[Set-SamAccountPasswordHash](Set-SamAccountPasswordHash.md)
253+
[Enable-ADDBAccount](Enable-ADDBAccount.md)
254+
[Disable-ADDBAccount](Disable-ADDBAccount.md)
255+
[Set-ADDBAccountControl](Set-ADDBAccountControl.md)
253256
[Unlock-ADDBAccount](Unlock-ADDBAccount.md)
254257
[Get-BootKey](Get-BootKey.md)
255258
[Get-ADDBAccount](Get-ADDBAccount.md)

‎Src/DSInternals.Common/Data/Principals/UserAccountControl.cs‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,4 +113,22 @@ public enum UserAccountControl : int
113113
/// </summary>
114114
TrustedToAuthenticateForDelegation = 0x01000000
115115
}
116-
}
116+
117+
public static class UserAccountControlExtensions
118+
{
119+
public static void SetFlags(ref this UserAccountControl uac, UserAccountControl flag, bool? status)
120+
{
121+
if(status == true)
122+
{
123+
// Set the flag
124+
uac |= flag;
125+
}
126+
else if(status == false)
127+
{
128+
// Clear the flag
129+
uac &= ~flag;
130+
}
131+
// If status is null, keep the original flags
132+
}
133+
}
134+
}

0 commit comments

Comments
 (0)