API Reference
Class
DcSyncPermissionChecker
Searches for accounts granted replication permissions that allow DCSync operations.
Inheritance
- Object
- DcSyncPermissionChecker
Constructors
public DcSyncPermissionChecker(Func<String, IEnumerable<ActiveDirectoryAccessRule>> fetchAcl = null, Func<String, String> domainToDistinguishedName = null, Func<IEnumerable<String>> enumerateDomains = null) #Initializes a new instance of the DcSyncPermissionChecker class.
Parameters
- fetchAcl System.Func{System.String,System.Collections.Generic.IEnumerable{System.DirectoryServices.ActiveDirectoryAccessRule}} = null
- Optional delegate retrieving ACLs from a distinguished name.
- domainToDistinguishedName System.Func{System.String,System.String} = null
- Optional delegate converting domain name to distinguished name.
- enumerateDomains System.Func{System.Collections.Generic.IEnumerable{System.String}} = null
- Optional delegate returning domain names in the forest.
Methods
public Void Check() #Returns:
VoidSearches every domain in the current forest for replication permissions.
public Void CheckDomain(String domainName = null) #Returns:
VoidSearches a domain for accounts granted replication permissions and logs warnings.
Parameters
- domainName System.String = null
- Domain name or distinguished name. When null, the current domain is used.
public IEnumerable<ActiveDirectoryAccessRule> GetDcSyncAces(String dn) #Returns:
IEnumerable<ActiveDirectoryAccessRule>Retrieves ACEs granting replication permissions used by DCSync.
Parameters
- dn System.String
- Distinguished name to query.
Returns
Collection of matching access rules.
Inherited Methods
Properties
public static Guid GetChangesGuid { get; } #Gets the GUID for the DS-Replication-Get-Changes extended right.