WindowsAccessControl

Author(s)

• WindowsAccessControl contributors

Tags

NTFS Registry Service Process TaskScheduler Certificate CNG Permissions ACL Security DSC Windows

Functions

Add-ADObjectAccessRule Add-CertificatePrivateKeyAccessRule Add-NTFSAccessRule Add-NTFSAuditRule Add-ProcessAccessRule Add-ProcessAuditRule Add-RegistryKeyAccessRule Add-RegistryKeyAuditRule Add-ScheduledTaskAccessRule Add-ServiceAccessRule Add-ServiceAuditRule Add-SmbShareAccessRule Add-TaskFolderAccessRule Backup-NTFSItemSecurityDescriptor Backup-WindowsSecurityDescriptor Clear-ADObjectAccessRule Clear-NTFSAccessRule Clear-NTFSAuditRule Clear-ProcessAccessRule Clear-ProcessAuditRule Clear-RegistryKeyAccessRule Clear-RegistryKeyAuditRule Clear-ServiceAccessRule Clear-ServiceAuditRule Copy-NTFSItemSecurityDescriptor Disable-NTFSItemInheritance Disable-RegistryKeyInheritance Disable-WindowsPrivilege Edit-NTFSItemSecurityDescriptor Edit-RegistryKeySecurityDescriptor Enable-NTFSItemInheritance Enable-RegistryKeyInheritance Enable-WindowsPrivilege Get-ADObjectAccessRule Get-ADObjectCallerEffectiveAccess Get-ADObjectSchemaDefaultAccessRule Get-ADObjectSecurityDescriptor Get-CertificatePrivateKeyAccessRule Get-CertificatePrivateKeySecurityDescriptor Get-NTFSAccessRule Get-NTFSAuditRule Get-NTFSItemEffectiveAccess Get-NTFSItemInheritance Get-NTFSItemOwner Get-NTFSItemSecurityDescriptor Get-ProcessAccessRule Get-ProcessAuditRule Get-ProcessSecurityDescriptor Get-RegistryKeyAccessRule Get-RegistryKeyAuditRule Get-RegistryKeyInheritance Get-RegistryKeySecurityDescriptor Get-ScheduledTaskAccessRule Get-ScheduledTaskSecurityDescriptor Get-ServiceAccessRule Get-ServiceAuditRule Get-ServiceSecurityDescriptor Get-SmbShareAccessRule Get-SmbShareEffectiveAccess Get-SmbShareSecurityDescriptor Get-TaskFolderAccessRule Get-TaskFolderSecurityDescriptor Get-WindowsAccessControlMetric Get-WindowsPrivilege Invoke-WindowsAccessControl New-NTFSAccessRule New-NTFSAuditRule Remove-ADObjectAccessRule Remove-CertificatePrivateKeyAccessRule Remove-NTFSAccessRule Remove-NTFSAuditRule Remove-ProcessAccessRule Remove-ProcessAuditRule Remove-RegistryKeyAccessRule Remove-RegistryKeyAuditRule Remove-ScheduledTaskAccessRule Remove-ServiceAccessRule Remove-ServiceAuditRule Remove-SmbShareAccessRule Remove-TaskFolderAccessRule Resolve-WindowsIdentity Restore-NTFSItemSecurityDescriptor Restore-WindowsSecurityDescriptor Set-ADObjectAccessRule Set-ADObjectSecurityDescriptor Set-CertificatePrivateKeySecurityDescriptor Set-NTFSAccessRule Set-NTFSAuditRule Set-NTFSItemOwner Set-NTFSItemSecurityDescriptor Set-ProcessAccessRule Set-ProcessAuditRule Set-ProcessSecurityDescriptor Set-RegistryKeyAccessRule Set-RegistryKeyAuditRule Set-RegistryKeySecurityDescriptor Set-ScheduledTaskSecurityDescriptor Set-ServiceAccessRule Set-ServiceAuditRule Set-ServiceSecurityDescriptor Set-SmbShareSecurityDescriptor Set-TaskFolderSecurityDescriptor Test-CertificatePrivateKeyCriticalBinding Test-NTFSItemAcl Test-WindowsPrivilege

DSCResources

WindowsAccessControlNtfsSecurityDescriptor WindowsAccessControlRegistryKeySecurityDescriptor WindowsAccessControlServiceSecurityDescriptor WindowsAccessControlServiceControlManagerSecurityDescriptor WindowsAccessControlProcessSecurityDescriptor WindowsAccessControlSmbShareSecurityDescriptor WindowsAccessControlADObjectSecurityDescriptor WindowsAccessControlTaskFolderSecurityDescriptor WindowsAccessControlScheduledTaskSecurityDescriptor WindowsAccessControlCertificatePrivateKeySecurityDescriptor WindowsAccessControlNtfsAccessRule WindowsAccessControlRegistryKeyAccessRule WindowsAccessControlServiceAccessRule WindowsAccessControlServiceControlManagerAccessRule WindowsAccessControlProcessAccessRule WindowsAccessControlSmbShareAccessRule WindowsAccessControlADObjectAccessRule WindowsAccessControlTaskFolderAccessRule WindowsAccessControlScheduledTaskAccessRule WindowsAccessControlCertificatePrivateKeyAccessRule

PSEditions

Desktop Core

Dependencies

This module has no dependencies.

Release Notes

## [0.2.0-preview0001] - 2026-09-06

### Added

- Allow domain-lab acceptance runs to reuse the payload already on the
   management domain controller with `-SkipPayloadDeployment`. The existing
   `-SkipPayload` spelling remains an alias, and `-SkipDeployment` provides a
   concise equivalent. The confirmation action now describes only the
   acceptance run when payload deployment is skipped
- Add `Get-ADObjectCallerEffectiveAccess`, which reports the effective write
   access a domain controller computes for the calling identity on a directory
   object. It reads `allowedAttributesEffective`,
   `allowedChildClassesEffective`, and `sDRightsEffective` in one base-scope
   request and formats them, with the section mask reported both raw and as
   `WindowsSecurityDescriptorSection`. The module computes nothing: these are
   constructed attributes the controller evaluates in the security context of
   the LDAP bind, which is also why the command exposes no `Account` parameter
   and why `Credential` is the only way to evaluate another principal. ADR 0022
   still defers a general directory effective-access claim, and its
   consequences already allowed this reader; specification 0018 records the
   contract and the four limits the three attributes carry, chief among them
   that none of them reports read access
- Split the usage guide into a navigable set of task pages under `docs/usage/`
   and give `docs/` its own `README.md` index. The guide had grown to roughly a
   thousand lines covering ten object families in one file, so a reader who
   managed one of them had to scroll past the other nine, and the `docs/`
   folder itself listed four unexplained files. The guide is now the entry
   point: it keeps the workflow table, a map of every page, the shape every
   family shares, and the module's boundaries, and links to seventeen pages
   that each stand on their own. New material the single file never carried
   includes a page per object family, the verb semantics that separate `Add`
   from `Set`, a support matrix of what each family exposes, a command
   reference grouped by family, the rights enumerations, and an extended
   troubleshooting page
- Document the certificate private-key mutation, portability, and desired-state
   surface in the usage guide. The guide still described the family as
   read-only, which specification 0015 superseded, so the commands that grant a
   service account access to a key, the gates that refuse a write, the
   key-addressed parameter set, and the two DSC resources were undocumented
   outside comment-based help
- Document `Get-ADObjectSchemaDefaultAccessRule` and the `ExcludeSchemaDefault`
   filter in the usage guide, which is how an operator separates the
   delegation they configured from the entries a schema class applies to every
   new object
- Document the twenty DSC resources in the wiki, and ship their conceptual help
   inside the module. The resources were the one part of the public surface a
   reader could not look up anywhere: the wiki carried a page per command and
   nothing for the resources, and `Get-Help about_WindowsAccessControlNtfsAccessRule`
   returned nothing. Each class now carries comment-based help for its synopsis,
   its description, and all 125 DSC properties, which is what both generators
   read. `Generate_Markdown_For_DSC_Resources` writes one wiki page per resource
   with a parameter table that states each property's attribute, data type,
   description, and allowed values, and `Generate_Conceptual_Help` writes the
   matching `about_<ResourceName>.help.txt` into the built module. The pages are
   filed under their own `DSC resources` sidebar category rather than the
   generator's `General` default
- Ship a MAML external help file with the module. `Get-Help` for a public command
   had only the comment-based help compiled into the merged module, so `-Full`
   and `-Online` behaved differently from every other shipped module.
   `Generate_External_Help_File_For_Public_Commands` now converts the generated
   markdown into `en-US/WindowsAccessControl-help.xml`

- Generate and publish the repository wiki from the build. A reader arriving
   from the PowerShell Gallery had no browsable reference: the only per-command
   documentation was the comment-based help, which has to be installed and run
   to be read. The `docs` workflow now writes one wiki page per public command
   from that same help through `platyPS`, packages it as `WikiContent.zip`, and
   attaches it to the GitHub release, and the publish stage pushes it to the
   wiki
- Add the GitHub community files a public repository is read through: issue
   templates for a problem, a proposal, and a general question, a pull request
   template whose task list names this repository's own gates, `CODEOWNERS`,
   and a Dependabot configuration that keeps the pinned action versions in the
   build workflow current. `CONTRIBUTING.md` already told a contributor to open
   an issue first, but the issue form asked for nothing, so a report could
   arrive without the module version, the PowerShell edition, or the object
   family, which are three of the facts a descriptor defect cannot be
   reproduced without. Blank issues are disabled and the chooser links the
   private security route, so a vulnerability is not filed in public by
   accident, and the specifications, so a recorded refusal is not filed as a
   defect. The layout follows the DSC Community repositories this project
   already follows
- Add the status badges to the README: the build, the Gallery preview version,
   the Gallery stable version, the download count, and the license. A reader
   arriving from the PowerShell Gallery could not see whether the module
   builds, and a reader arriving from the repository could not see which
   version is published. A `Releases` section states why there are two Gallery
   badges: every merge to `main` publishes a preview and a stable release comes
   from its own tag
- Add `CONTRIBUTING.md` and `CODE_OF_CONDUCT.md`, modelled on the DSC Community
   repositories this project already follows. The contributing guide records
   what is specific here rather than repeating the common guidelines: that a
   behavior change starts in a specification because several apparent gaps are
   accepted refusals, what belongs in each test folder, why coverage is
   asserted over the executable scope, that the domain lab is not required for
   a pull request, and that the commit message decides the next version. The
   code of conduct is the Contributor Covenant 2.1 with a reporting route that
   also works when the report concerns the maintainer
- Add `LICENSE`, so the module can be distributed and the PowerShell Gallery can
   show the terms it is offered under. The manifest carried
   `All rights reserved`, which contradicts publishing it, and the Gallery
   entry would have shown no license and no project link. The copyright
   statement now names the MIT License, and `LicenseUri` and `ProjectUri` are
   set
- Add `SECURITY.md`. This module writes security descriptors, so a defect in it
   can grant access an operator did not intend, and there was no private route
   to report one. It names the reporting route, the supported version, and what
   is in scope, and separates a defect from the behavior the specifications
   deliberately refuse
- Add an install section to the README. It documented building from source only,
   so a reader arriving from the Gallery had no supported way to install the
   published package
- Add the project's brand assets under `assets/`, and float the wordmark to the
   left of the README intro through a `<picture>` element, so the header follows
   the reader's GitHub theme and the first paragraph fills the space beside the
   mark rather than starting below a centred block. The wordmark stands in for
   the title, which is the layout the sibling `ShellPilot` and `DeskPilot`
   repositories already use. A float rather than a table, because github.com
   draws a border on every table cell and strips the style that would remove
   it. The package also had no icon, because `IconUri` was commented out, so a
   Gallery entry that now carries a license and a project link would still have
   shown the default placeholder. The wordmark and the glyph are supplied for a
   light and a dark surface, the dark-surface pair is recoloured from the
   near-black original rather than redrawn, and `assets/README.md` records the
   palette, the rule for choosing a variant, and how every derived file was
   produced
- Add live evidence for concurrent Active Directory writers. Two access control
   entries written from one baseline through the two writable domain
   controllers converge to exactly one surviving entry, because the security
   descriptor is a single replicated attribute and the losing write is
   discarded whole rather than merged entry by entry. The same suite proves the
   two mechanisms a caller has: `ConcurrencyToken` is a hash of the sections
   that were read, so one converged descriptor reports one token through both
   controllers and a write on the other controller changes it; and two writes
   serialized through one pinned controller both survive. Specification 0016
   records the contract, including why no directory command offers
   `RequireUnchanged`
- Add live evidence for a key-reusing certificate renewal. The lab deployment
   now publishes an enterprise template at schema version 4 that issues a CNG
   key and requires the same key on renewal, and the acceptance enrolls a
   machine certificate from it and renews it. The renewal produces a different
   thumbprint over the same key container, the canonical target is unchanged,
   and a portability record captured before the renewal still relocates the key
   and restores its DACL although the thum