TestimoX

API Reference

Class

GpoAclExposureRecord

Namespace ADPlayground.Gpo
Assembly ADPlayground
Modifiers sealed

Represents a single risky ACL assignment detected on a GPO.

Inheritance

  • Object
  • GpoAclExposureRecord

Constructors

Properties

public String DomainName { get; set; } #

Domain containing the GPO.

public String GpoName { get; set; } #

Display name of the GPO.

public String Identity { get; set; } #

Resolved identity (distinguished name or SID).

public String DisplayName { get; set; } #

Friendly account label when available.

public String Sid { get; set; } #

SID that received the permission.

public String Rights { get; set; } #

Granted Active Directory rights.

public Boolean IsInherited { get; set; } #

Indicates whether the ACE is inherited.

public Boolean IsApplyGroupPolicy { get; set; } #

Indicates whether the ACE grants the Apply Group Policy extended right.

public IdentityType IdentityType { get; set; } #

Resolved identity type when available.

public AclOperationKind OperationKind { get; set; } #

Coarse-grained operation classification derived from the ACE (write vs apply-only etc.).

public Boolean HasWrite { get; set; } #

True when the underlying ACE conveys any write-like capability.

public String ObjectTypeGuid { get; set; } #

Optional objectType GUID (schema attribute or extended right) targeted by the ACE.

public String ObjectTypeName { get; set; } #

Friendly name for ObjectTypeGuid when resolvable from schema/extended rights.

public String WriteRights { get; set; } #

Write-only subset of rights for clearer display (excludes GenericRead/ReadProperty/Apply-only).

public String GpmcPermission { get; set; } #

GPMC-style permission label synthesized from the ACE (e.g., "Edit settings", "Edit settings, delete", "Edit settings, delete, modify security", or "Read"/"Read (from Security Filtering)" for Apply-only/read-only cases).

public AdministrativeIdentityType AdministrativeType { get; set; } #

Administrative classification of the trustee identity (e.g., WellKnownAdministrative, Administrative, NotAdministrative).

public Boolean IsPrivileged { get; set; } #

True when the trustee is a privileged/builtin identity (e.g., Domain Admins, Enterprise Admins, BUILTIN\\Administrators, Enterprise Domain Controllers).

public AclRiskLevel RiskLevel { get; set; } #

Risk level classification for this ACE.

public String RiskReason { get; set; } #

Short explanation for RiskLevel.

public Boolean IsCreatorOwner { get; set; } #

True when the trustee SID is CREATOR OWNER (S-1-3-0).

public String GpoDistinguishedName { get; set; } #

GPO distinguished name.

public String OwnerSid { get; set; } #

Owner SID of the GPO object.

public String OwnerName { get; set; } #

Owner friendly name of the GPO object.

public Boolean OwnerTrusted { get; set; } #

True when the owner is trusted/expected (Domain Admins/GPCO/Administrators).