From 521548557175d30ed84a6910e4b9a21174b04188 Mon Sep 17 00:00:00 2001 From: Jim Sykora <14374121+JimSycurity@users.noreply.github.com> Date: Thu, 18 Dec 2025 13:06:59 -0600 Subject: [PATCH 1/3] feat: add membership property set BED-7069 --- src/CommonLib/Processors/ACEGuids.cs | 1 + src/CommonLib/Processors/ACLProcessor.cs | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/CommonLib/Processors/ACEGuids.cs b/src/CommonLib/Processors/ACEGuids.cs index ebb0e5b11..73cf31a17 100644 --- a/src/CommonLib/Processors/ACEGuids.cs +++ b/src/CommonLib/Processors/ACEGuids.cs @@ -8,6 +8,7 @@ public class ACEGuids public const string UserForceChangePassword = "00299570-246d-11d0-a768-00aa006e0529"; public const string AllGuid = "00000000-0000-0000-0000-000000000000"; public const string WriteMember = "bf9679c0-0de6-11d0-a285-00aa003049e2"; + public const string WriteMembership = "bc0ac240-79a9-11d0-9020-00c04fc2d4cf"; // property set https://learn.microsoft.com/en-us/windows/win32/adschema/r-membership public const string WriteAllowedToAct = "3f78c3e5-f79a-46bd-a0b8-9d18116ddc79"; public const string WriteSPN = "f3a64788-5306-11d1-a9c5-0000f80367c1"; public const string AddKeyPrincipal = "5b47d60f-6090-40b2-9f37-2a4de88f3063"; diff --git a/src/CommonLib/Processors/ACLProcessor.cs b/src/CommonLib/Processors/ACLProcessor.cs index 383b69aff..2876ce5a1 100644 --- a/src/CommonLib/Processors/ACLProcessor.cs +++ b/src/CommonLib/Processors/ACLProcessor.cs @@ -584,7 +584,7 @@ public async IAsyncEnumerable ProcessACL(byte[] ntSecurityDescriptor, strin if (aceRights.HasFlag(ActiveDirectoryRights.Self) && !aceRights.HasFlag(ActiveDirectoryRights.WriteProperty) && !aceRights.HasFlag(ActiveDirectoryRights.GenericWrite) && objectType == Label.Group && - aceType is ACEGuids.WriteMember or ACEGuids.AllGuid) + aceType is ACEGuids.WriteMember or ACEGuids.WriteMembership or ACEGuids.AllGuid) yield return new ACE { PrincipalType = resolvedPrincipal.ObjectType, PrincipalSID = resolvedPrincipal.ObjectIdentifier, @@ -786,7 +786,7 @@ or Label.NTAuthStore IsPermissionForOwnerRightsSid = isPermissionForOwnerRightsSid, IsInheritedPermissionForOwnerRightsSid = isInheritedPermissionForOwnerRightsSid, }; - else if (objectType == Label.Group && aceType == ACEGuids.WriteMember) + else if (objectType == Label.Group && (aceType == ACEGuids.WriteMember || aceType == ACEGuids.WriteMembership)) yield return new ACE { PrincipalType = resolvedPrincipal.ObjectType, PrincipalSID = resolvedPrincipal.ObjectIdentifier, From f205a92ad591fabfb0762e5a5d19090ba3526adb Mon Sep 17 00:00:00 2001 From: Jim Sykora <14374121+JimSycurity@users.noreply.github.com> Date: Thu, 18 Dec 2025 13:07:59 -0600 Subject: [PATCH 2/3] fix logic BED-7069 --- src/CommonLib/Processors/ACLProcessor.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/CommonLib/Processors/ACLProcessor.cs b/src/CommonLib/Processors/ACLProcessor.cs index 2876ce5a1..34bac4af0 100644 --- a/src/CommonLib/Processors/ACLProcessor.cs +++ b/src/CommonLib/Processors/ACLProcessor.cs @@ -786,7 +786,7 @@ or Label.NTAuthStore IsPermissionForOwnerRightsSid = isPermissionForOwnerRightsSid, IsInheritedPermissionForOwnerRightsSid = isInheritedPermissionForOwnerRightsSid, }; - else if (objectType == Label.Group && (aceType == ACEGuids.WriteMember || aceType == ACEGuids.WriteMembership)) + else if (objectType == Label.Group && (aceType is ACEGuids.WriteMember or ACEGuids.WriteMembership)) yield return new ACE { PrincipalType = resolvedPrincipal.ObjectType, PrincipalSID = resolvedPrincipal.ObjectIdentifier, From c31b3b96e8e62877aea9f94f3956e0391623489c Mon Sep 17 00:00:00 2001 From: Jim Sykora <14374121+JimSycurity@users.noreply.github.com> Date: Thu, 18 Dec 2025 19:52:44 -0600 Subject: [PATCH 3/3] chore: better name for property set BED-7069 --- src/CommonLib/Processors/ACEGuids.cs | 2 +- src/CommonLib/Processors/ACLProcessor.cs | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/CommonLib/Processors/ACEGuids.cs b/src/CommonLib/Processors/ACEGuids.cs index 73cf31a17..fb205d7a1 100644 --- a/src/CommonLib/Processors/ACEGuids.cs +++ b/src/CommonLib/Processors/ACEGuids.cs @@ -8,7 +8,7 @@ public class ACEGuids public const string UserForceChangePassword = "00299570-246d-11d0-a768-00aa006e0529"; public const string AllGuid = "00000000-0000-0000-0000-000000000000"; public const string WriteMember = "bf9679c0-0de6-11d0-a285-00aa003049e2"; - public const string WriteMembership = "bc0ac240-79a9-11d0-9020-00c04fc2d4cf"; // property set https://learn.microsoft.com/en-us/windows/win32/adschema/r-membership + public const string MembershipPropertySet = "bc0ac240-79a9-11d0-9020-00c04fc2d4cf"; // property set https://learn.microsoft.com/en-us/windows/win32/adschema/r-membership public const string WriteAllowedToAct = "3f78c3e5-f79a-46bd-a0b8-9d18116ddc79"; public const string WriteSPN = "f3a64788-5306-11d1-a9c5-0000f80367c1"; public const string AddKeyPrincipal = "5b47d60f-6090-40b2-9f37-2a4de88f3063"; diff --git a/src/CommonLib/Processors/ACLProcessor.cs b/src/CommonLib/Processors/ACLProcessor.cs index 34bac4af0..da3a615b4 100644 --- a/src/CommonLib/Processors/ACLProcessor.cs +++ b/src/CommonLib/Processors/ACLProcessor.cs @@ -584,7 +584,7 @@ public async IAsyncEnumerable ProcessACL(byte[] ntSecurityDescriptor, strin if (aceRights.HasFlag(ActiveDirectoryRights.Self) && !aceRights.HasFlag(ActiveDirectoryRights.WriteProperty) && !aceRights.HasFlag(ActiveDirectoryRights.GenericWrite) && objectType == Label.Group && - aceType is ACEGuids.WriteMember or ACEGuids.WriteMembership or ACEGuids.AllGuid) + aceType is ACEGuids.WriteMember or ACEGuids.MembershipPropertySet or ACEGuids.AllGuid) yield return new ACE { PrincipalType = resolvedPrincipal.ObjectType, PrincipalSID = resolvedPrincipal.ObjectIdentifier, @@ -786,7 +786,7 @@ or Label.NTAuthStore IsPermissionForOwnerRightsSid = isPermissionForOwnerRightsSid, IsInheritedPermissionForOwnerRightsSid = isInheritedPermissionForOwnerRightsSid, }; - else if (objectType == Label.Group && (aceType is ACEGuids.WriteMember or ACEGuids.WriteMembership)) + else if (objectType == Label.Group && (aceType is ACEGuids.WriteMember or ACEGuids.MembershipPropertySet)) yield return new ACE { PrincipalType = resolvedPrincipal.ObjectType, PrincipalSID = resolvedPrincipal.ObjectIdentifier,