API Reference
GpoAclExposureRecord
Represents a single risky ACL assignment detected on a GPO.
Inheritance
- Object
- GpoAclExposureRecord
Constructors
public GpoAclExposureRecord() #Inherited Methods
Properties
public String DomainName { get; set; } #Domain containing the GPO.
public String GpoName { get; set; } #Display name of the GPO.
public String Identity { get; set; } #Resolved identity (distinguished name or SID).
public String DisplayName { get; set; } #Friendly account label when available.
public String Sid { get; set; } #SID that received the permission.
public String Rights { get; set; } #Granted Active Directory rights.
public Boolean IsInherited { get; set; } #Indicates whether the ACE is inherited.
public Boolean IsApplyGroupPolicy { get; set; } #Indicates whether the ACE grants the Apply Group Policy extended right.
public IdentityType IdentityType { get; set; } #Resolved identity type when available.
public AclOperationKind OperationKind { get; set; } #Coarse-grained operation classification derived from the ACE (write vs apply-only etc.).
public Boolean HasWrite { get; set; } #True when the underlying ACE conveys any write-like capability.
public String ObjectTypeGuid { get; set; } #Optional objectType GUID (schema attribute or extended right) targeted by the ACE.
public String ObjectTypeName { get; set; } #Friendly name for ObjectTypeGuid when resolvable from schema/extended rights.
public String WriteRights { get; set; } #Write-only subset of rights for clearer display (excludes GenericRead/ReadProperty/Apply-only).
public String GpmcPermission { get; set; } #GPMC-style permission label synthesized from the ACE (e.g., "Edit settings", "Edit settings, delete", "Edit settings, delete, modify security", or "Read"/"Read (from Security Filtering)" for Apply-only/read-only cases).
public AdministrativeIdentityType AdministrativeType { get; set; } #Administrative classification of the trustee identity (e.g., WellKnownAdministrative, Administrative, NotAdministrative).
public Boolean IsPrivileged { get; set; } #True when the trustee is a privileged/builtin identity (e.g., Domain Admins, Enterprise Admins, BUILTIN\\Administrators, Enterprise Domain Controllers).
public AclRiskLevel RiskLevel { get; set; } #Risk level classification for this ACE.
public String RiskReason { get; set; } #Short explanation for RiskLevel.
public Boolean IsCreatorOwner { get; set; } #True when the trustee SID is CREATOR OWNER (S-1-3-0).
public String GpoDistinguishedName { get; set; } #GPO distinguished name.
public String OwnerSid { get; set; } #Owner SID of the GPO object.
public String OwnerName { get; set; } #Owner friendly name of the GPO object.
public Boolean OwnerTrusted { get; set; } #True when the owner is trusted/expected (Domain Admins/GPCO/Administrators).