API Reference
Finding (DangerousExtendedRightsService)
Describes a single dangerous right detected on a sensitive object.
Inheritance
- Object
- Finding
Constructors
public Finding(String targetDn, String targetCategory, String principalSid, String principalName, String right) #Creates a new finding.
Parameters
- targetDn System.String
- Distinguished name of the object where the right was found.
- targetCategory System.String
- Logical category of the target (DomainRoot, AdminSDHolder, krbtgt, MasterKey, Other).
- principalSid System.String
- SID of the principal holding the right.
- principalName System.String
- Resolved account name for the SID.
- right System.String
- Right label (e.g., WriteDacl, GenericAll, ExtendedRight(Replication)).
Methods
Inherited Methods
Properties
public String TargetDn { get; set; } #Distinguished name of the target object.
public String TargetCategory { get; set; } #Logical category of the target.
public String PrincipalSid { get; set; } #SID of the principal holding the right.
public String PrincipalName { get; set; } #Resolved name for the SID.
public String Right { get; set; } #Right label (e.g., WriteDacl, GenericAll, ExtendedRight(Replication)).
public AclOperationKind OperationKind { get; set; } #Derived operation for the ACE (Write/ModifyDacl/ModifyOwner/CreateOrDeleteChild/Delete/Read/ApplyGroupPolicy).
public Boolean HasWrite { get; set; } #True when the ACE conveys write/control capabilities (excludes Apply Group Policy only and read-only).
public AclRiskLevel RiskLevel { get; set; } #Risk level classification for this ACE.
public String RiskReason { get; set; } #Short reason for RiskLevel.
public Nullable<Guid> ObjectTypeGuid { get; set; } #ObjectType GUID targeted by the ACE, when any (attribute/extended right).
public String ObjectTypeName { get; set; } #Friendly name for ObjectTypeGuid when resolvable.
public ActiveDirectorySecurityInheritance Inheritance { get; set; } #Inheritance scope of the ACE.
public Boolean IsInherited { get; set; } #True if the ACE is inherited.
public IdentityType IdentityType { get; set; } #Best-effort identity kind (User/Group/Computer/Unknown).
public Boolean IsPrivileged { get; set; } #True when the trustee is privileged (built-in or core admin groups in the domain).
public String WriteRights { get; set; } #Display-friendly subset of write rights for UI.