API Reference
AceView (AdminSdHolderAclDriftEvaluator)
Enriched ACE view for reporting (identity, classification and risk included).
Inheritance
- Object
- AceView
Constructors
public AceView() #Methods
Inherited Methods
Properties
public String DisplayName { get; set; } #Friendly identity label for display (resolved name or SID/account name).
public AdministrativeIdentityType AdministrativeType { get; set; } #Administrative identity classification (e.g., Tier0/Privileged/Unknown).
public AclOperationKind OperationKind { get; set; } #Operation/rule kind inferred from the ACE (e.g., Write, Read, Control).
public Boolean HasWrite { get; set; } #True when the ACE grants any write/control capability.
public AclRiskLevel RiskLevel { get; set; } #Computed risk level for this ACE based on rights/object targeting.
public String Identity { get; set; } #Raw identity string (domain\name or SID).
public String Sid { get; set; } #Security identifier (SID) of the trustee on the ACE.
public IdentityType IdentityType { get; set; } #Identity kind (User, Group, Computer, WellKnownSid, etc.).
public String WriteRights { get; set; } #Subset of write/control rights when HasWrite is true (e.g., WriteDacl).
public String Rights { get; set; } #Full rights mask for the ACE.
public String RiskReason { get; set; } #Short explanation for the assigned RiskLevel.
public String ObjectTypeName { get; set; } #Well-known name for ObjectTypeGuid when applicable (e.g., user-Change-Password).
public Nullable<Guid> ObjectTypeGuid { get; set; } #Object type GUID targeted by the ACE when present.
public String Inheritance { get; set; } #Inheritance scope description (None, This object only, Children, etc.).
public Boolean IsInherited { get; set; } #True when the ACE is inherited rather than explicit.
public Int32 DaysSinceModification { get; set; } #Days since the ACE was modified (based on nTSecurityDescriptor timestamps).
public Boolean IsExpectedAdministrativeAddition { get; set; } #True when the ACE is treated as expected because it belongs to a core administrative trustee.
public Boolean IsExpectedDirectoryDefault { get; set; } #True when the ACE matches a built-in Active Directory protected-object default delegation.
public Boolean IsAllowedByOverride { get; set; } #True when the ACE matches an explicit trustee allow-pattern override.
public Boolean IsExpectedApplicationDelegation { get; set; } #True when the ACE matches a known platform/application-specific expected delegation profile.
public Boolean IsOptionalDelegation { get; set; } #True when the ACE matches a known optional role/product delegation profile.
public Boolean RequiresReview { get; set; } #True when the ACE still requires review after applying default expectations and overrides.
public String ReviewDisposition { get; set; } #Short disposition string describing why the ACE is or is not a review candidate.
public String ReviewReason { get; set; } #Short reason describing the applied review policy.
public String ExpectedDelegationProfile { get; set; } #Name of the recognized expected delegation profile, when applicable.