API Reference
Class
AccountTakeoverDetector
Provides methods to detect potential account takeover activity.
Inheritance
- Object
- AccountTakeoverDetector
Constructors
public AccountTakeoverDetector(Func<String, DateTime, IEnumerable<String>> passwordResets = null, Func<String, DateTime, IEnumerable<AdObjectOwnershipInfo>> ownerChanges = null, Func<String, DateTime, IEnumerable<String>> adminSdHolderChanges = null, Func<String, IEnumerable<String>, Boolean> isMemberOf = null) #Initializes a new instance of the AccountTakeoverDetector class.
Parameters
- passwordResets System.Func{System.String,System.DateTime,System.Collections.Generic.IEnumerable{System.String}} = null
- Delegate retrieving accounts with recent password resets.
- ownerChanges System.Func{System.String,System.DateTime,System.Collections.Generic.IEnumerable{ADPlayground.Acl.AdObjectOwnershipInfo}} = null
- Delegate retrieving objects with owner changes.
- adminSdHolderChanges System.Func{System.String,System.DateTime,System.Collections.Generic.IEnumerable{System.String}} = null
- Delegate retrieving objects recently protected by AdminSDHolder.
- isMemberOf System.Func{System.String,System.Collections.Generic.IEnumerable{System.String},System.Boolean} = null
- Delegate determining membership in provided groups.
Methods
public IEnumerable<String> GetAccountsModifiedOutsideAdmins(String domainName, DateTime since, IEnumerable<String> adminGroupDns) #Returns:
IEnumerable<String>Enumerates accounts modified since the specified date whose membership does not include allowed admin groups.
Parameters
- domainName System.String
- since System.DateTime
- adminGroupDns System.Collections.Generic.IEnumerable{System.String}
public IEnumerable<String> GetAdminSdHolderChanges(String domainName, DateTime since) #Returns:
IEnumerable<String>Returns accounts that became AdminSDHolder protected on or after the specified date.
Parameters
- domainName System.String
- since System.DateTime
public IEnumerable<AdObjectOwnershipInfo> GetOwnerChanges(String domainName, DateTime since) #Returns:
IEnumerable<AdObjectOwnershipInfo>Returns objects whose owner was changed on or after the specified date and is not an administrator.
Parameters
- domainName System.String
- since System.DateTime
public IEnumerable<String> GetPasswordResets(String domainName, DateTime since) #Returns:
IEnumerable<String>Returns accounts that had passwords reset on or after the specified date.
Parameters
- domainName System.String
- since System.DateTime