WindowsAccessControl.psd1
|
# # Module manifest for module 'WindowsAccessControl' # # Generated by: WindowsAccessControl contributors # # Generated on: 7/25/2026 # @{ # Script module or binary module file associated with this manifest. RootModule = 'WindowsAccessControl.psm1' # Version number of this module. ModuleVersion = '0.2.0' # Supported PSEditions CompatiblePSEditions = @('Desktop', 'Core') # ID used to uniquely identify this module GUID = '9979f8e0-a9d0-4bf0-a84e-a2f3084c7e0c' # Author of this module Author = 'WindowsAccessControl contributors' # Company or vendor of this module CompanyName = 'WindowsAccessControl contributors' # Copyright statement for this module Copyright = '(c) WindowsAccessControl contributors. Licensed under the MIT License.' # Description of the functionality provided by this module Description = 'Pipeline-first Windows security descriptor management for PowerShell.' # Minimum version of the PowerShell engine required by this module PowerShellVersion = '5.1' # Name of the PowerShell host required by this module # PowerShellHostName = '' # Minimum version of the PowerShell host required by this module # PowerShellHostVersion = '' # Minimum version of Microsoft .NET Framework required by this module. This prerequisite is valid for the PowerShell Desktop edition only. # DotNetFrameworkVersion = '' # Minimum version of the common language runtime (CLR) required by this module. This prerequisite is valid for the PowerShell Desktop edition only. # ClrVersion = '' # Processor architecture (None, X86, Amd64) required by this module # ProcessorArchitecture = '' # Modules that must be imported into the global environment prior to importing this module RequiredModules = @() # Assemblies that must be loaded prior to importing this module # RequiredAssemblies = @() # Script files (.ps1) that are run in the caller's environment prior to importing this module. # ScriptsToProcess = @() # Type files (.ps1xml) to be loaded when importing this module # TypesToProcess = @() # Format files (.ps1xml) to be loaded when importing this module FormatsToProcess = @('WindowsAccessControl.Format.ps1xml') # Modules to import as nested modules of the module specified in RootModule/ModuleToProcess # NestedModules = @() # Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export. FunctionsToExport = @('Add-ADObjectAccessRule','Add-CertificatePrivateKeyAccessRule','Add-NTFSAccessRule','Add-NTFSAuditRule','Add-ProcessAccessRule','Add-ProcessAuditRule','Add-RegistryKeyAccessRule','Add-RegistryKeyAuditRule','Add-ScheduledTaskAccessRule','Add-ServiceAccessRule','Add-ServiceAuditRule','Add-SmbShareAccessRule','Add-TaskFolderAccessRule','Backup-NTFSItemSecurityDescriptor','Backup-WindowsSecurityDescriptor','Clear-ADObjectAccessRule','Clear-NTFSAccessRule','Clear-NTFSAuditRule','Clear-ProcessAccessRule','Clear-ProcessAuditRule','Clear-RegistryKeyAccessRule','Clear-RegistryKeyAuditRule','Clear-ServiceAccessRule','Clear-ServiceAuditRule','Copy-NTFSItemSecurityDescriptor','Disable-NTFSItemInheritance','Disable-RegistryKeyInheritance','Disable-WindowsPrivilege','Edit-NTFSItemSecurityDescriptor','Edit-RegistryKeySecurityDescriptor','Enable-NTFSItemInheritance','Enable-RegistryKeyInheritance','Enable-WindowsPrivilege','Get-ADObjectAccessRule','Get-ADObjectCallerEffectiveAccess','Get-ADObjectSchemaDefaultAccessRule','Get-ADObjectSecurityDescriptor','Get-CertificatePrivateKeyAccessRule','Get-CertificatePrivateKeySecurityDescriptor','Get-NTFSAccessRule','Get-NTFSAuditRule','Get-NTFSItemEffectiveAccess','Get-NTFSItemInheritance','Get-NTFSItemOwner','Get-NTFSItemSecurityDescriptor','Get-ProcessAccessRule','Get-ProcessAuditRule','Get-ProcessSecurityDescriptor','Get-RegistryKeyAccessRule','Get-RegistryKeyAuditRule','Get-RegistryKeyInheritance','Get-RegistryKeySecurityDescriptor','Get-ScheduledTaskAccessRule','Get-ScheduledTaskSecurityDescriptor','Get-ServiceAccessRule','Get-ServiceAuditRule','Get-ServiceSecurityDescriptor','Get-SmbShareAccessRule','Get-SmbShareEffectiveAccess','Get-SmbShareSecurityDescriptor','Get-TaskFolderAccessRule','Get-TaskFolderSecurityDescriptor','Get-WindowsAccessControlMetric','Get-WindowsPrivilege','Invoke-WindowsAccessControl','New-NTFSAccessRule','New-NTFSAuditRule','Remove-ADObjectAccessRule','Remove-CertificatePrivateKeyAccessRule','Remove-NTFSAccessRule','Remove-NTFSAuditRule','Remove-ProcessAccessRule','Remove-ProcessAuditRule','Remove-RegistryKeyAccessRule','Remove-RegistryKeyAuditRule','Remove-ScheduledTaskAccessRule','Remove-ServiceAccessRule','Remove-ServiceAuditRule','Remove-SmbShareAccessRule','Remove-TaskFolderAccessRule','Resolve-WindowsIdentity','Restore-NTFSItemSecurityDescriptor','Restore-WindowsSecurityDescriptor','Set-ADObjectAccessRule','Set-ADObjectSecurityDescriptor','Set-CertificatePrivateKeySecurityDescriptor','Set-NTFSAccessRule','Set-NTFSAuditRule','Set-NTFSItemOwner','Set-NTFSItemSecurityDescriptor','Set-ProcessAccessRule','Set-ProcessAuditRule','Set-ProcessSecurityDescriptor','Set-RegistryKeyAccessRule','Set-RegistryKeyAuditRule','Set-RegistryKeySecurityDescriptor','Set-ScheduledTaskSecurityDescriptor','Set-ServiceAccessRule','Set-ServiceAuditRule','Set-ServiceSecurityDescriptor','Set-SmbShareSecurityDescriptor','Set-TaskFolderSecurityDescriptor','Test-CertificatePrivateKeyCriticalBinding','Test-NTFSItemAcl','Test-WindowsPrivilege') # Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export. CmdletsToExport = @() # Variables to export from this module VariablesToExport = @() # Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export. AliasesToExport = @() # DSC resources to export from this module DscResourcesToExport = @('WindowsAccessControlNtfsSecurityDescriptor','WindowsAccessControlRegistryKeySecurityDescriptor','WindowsAccessControlServiceSecurityDescriptor','WindowsAccessControlServiceControlManagerSecurityDescriptor','WindowsAccessControlProcessSecurityDescriptor','WindowsAccessControlSmbShareSecurityDescriptor','WindowsAccessControlADObjectSecurityDescriptor','WindowsAccessControlTaskFolderSecurityDescriptor','WindowsAccessControlScheduledTaskSecurityDescriptor','WindowsAccessControlCertificatePrivateKeySecurityDescriptor','WindowsAccessControlNtfsAccessRule','WindowsAccessControlRegistryKeyAccessRule','WindowsAccessControlServiceAccessRule','WindowsAccessControlServiceControlManagerAccessRule','WindowsAccessControlProcessAccessRule','WindowsAccessControlSmbShareAccessRule','WindowsAccessControlADObjectAccessRule','WindowsAccessControlTaskFolderAccessRule','WindowsAccessControlScheduledTaskAccessRule','WindowsAccessControlCertificatePrivateKeyAccessRule') # List of all modules packaged with this module # ModuleList = @() # List of all files packaged with this module # FileList = @() # Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell. PrivateData = @{ PSData = @{ # Tags applied to this module. These help with module discovery in online galleries. Tags = @( 'NTFS' 'Registry' 'Service' 'Process' 'TaskScheduler' 'Certificate' 'CNG' 'Permissions' 'ACL' 'Security' 'DSC' 'Windows' ) # A URL to the license for this module. LicenseUri = 'https://github.com/raandree/WindowsAccessControl/blob/main/LICENSE' # A URL to the main website for this project. ProjectUri = 'https://github.com/raandree/WindowsAccessControl' # A URL to an icon representing this module. IconUri = 'https://raw.githubusercontent.com/raandree/WindowsAccessControl/main/assets/icon-256.png' # ReleaseNotes of this module ReleaseNotes = '## [0.2.0-preview0001] - 2026-09-06 ### Added - Allow domain-lab acceptance runs to reuse the payload already on the management domain controller with `-SkipPayloadDeployment`. The existing `-SkipPayload` spelling remains an alias, and `-SkipDeployment` provides a concise equivalent. The confirmation action now describes only the acceptance run when payload deployment is skipped - Add `Get-ADObjectCallerEffectiveAccess`, which reports the effective write access a domain controller computes for the calling identity on a directory object. It reads `allowedAttributesEffective`, `allowedChildClassesEffective`, and `sDRightsEffective` in one base-scope request and formats them, with the section mask reported both raw and as `WindowsSecurityDescriptorSection`. The module computes nothing: these are constructed attributes the controller evaluates in the security context of the LDAP bind, which is also why the command exposes no `Account` parameter and why `Credential` is the only way to evaluate another principal. ADR 0022 still defers a general directory effective-access claim, and its consequences already allowed this reader; specification 0018 records the contract and the four limits the three attributes carry, chief among them that none of them reports read access - Split the usage guide into a navigable set of task pages under `docs/usage/` and give `docs/` its own `README.md` index. The guide had grown to roughly a thousand lines covering ten object families in one file, so a reader who managed one of them had to scroll past the other nine, and the `docs/` folder itself listed four unexplained files. The guide is now the entry point: it keeps the workflow table, a map of every page, the shape every family shares, and the module''s boundaries, and links to seventeen pages that each stand on their own. New material the single file never carried includes a page per object family, the verb semantics that separate `Add` from `Set`, a support matrix of what each family exposes, a command reference grouped by family, the rights enumerations, and an extended troubleshooting page - Document the certificate private-key mutation, portability, and desired-state surface in the usage guide. The guide still described the family as read-only, which specification 0015 superseded, so the commands that grant a service account access to a key, the gates that refuse a write, the key-addressed parameter set, and the two DSC resources were undocumented outside comment-based help - Document `Get-ADObjectSchemaDefaultAccessRule` and the `ExcludeSchemaDefault` filter in the usage guide, which is how an operator separates the delegation they configured from the entries a schema class applies to every new object - Document the twenty DSC resources in the wiki, and ship their conceptual help inside the module. The resources were the one part of the public surface a reader could not look up anywhere: the wiki carried a page per command and nothing for the resources, and `Get-Help about_WindowsAccessControlNtfsAccessRule` returned nothing. Each class now carries comment-based help for its synopsis, its description, and all 125 DSC properties, which is what both generators read. `Generate_Markdown_For_DSC_Resources` writes one wiki page per resource with a parameter table that states each property''s attribute, data type, description, and allowed values, and `Generate_Conceptual_Help` writes the matching `about_<ResourceName>.help.txt` into the built module. The pages are filed under their own `DSC resources` sidebar category rather than the generator''s `General` default - Ship a MAML external help file with the module. `Get-Help` for a public command had only the comment-based help compiled into the merged module, so `-Full` and `-Online` behaved differently from every other shipped module. `Generate_External_Help_File_For_Public_Commands` now converts the generated markdown into `en-US/WindowsAccessControl-help.xml` - Generate and publish the repository wiki from the build. A reader arriving from the PowerShell Gallery had no browsable reference: the only per-command documentation was the comment-based help, which has to be installed and run to be read. The `docs` workflow now writes one wiki page per public command from that same help through `platyPS`, packages it as `WikiContent.zip`, and attaches it to the GitHub release, and the publish stage pushes it to the wiki - Add the GitHub community files a public repository is read through: issue templates for a problem, a proposal, and a general question, a pull request template whose task list names this repository''s own gates, `CODEOWNERS`, and a Dependabot configuration that keeps the pinned action versions in the build workflow current. `CONTRIBUTING.md` already told a contributor to open an issue first, but the issue form asked for nothing, so a report could arrive without the module version, the PowerShell edition, or the object family, which are three of the facts a descriptor defect cannot be reproduced without. Blank issues are disabled and the chooser links the private security route, so a vulnerability is not filed in public by accident, and the specifications, so a recorded refusal is not filed as a defect. The layout follows the DSC Community repositories this project already follows - Add the status badges to the README: the build, the Gallery preview version, the Gallery stable version, the download count, and the license. A reader arriving from the PowerShell Gallery could not see whether the module builds, and a reader arriving from the repository could not see which version is published. A `Releases` section states why there are two Gallery badges: every merge to `main` publishes a preview and a stable release comes from its own tag - Add `CONTRIBUTING.md` and `CODE_OF_CONDUCT.md`, modelled on the DSC Community repositories this project already follows. The contributing guide records what is specific here rather than repeating the common guidelines: that a behavior change starts in a specification because several apparent gaps are accepted refusals, what belongs in each test folder, why coverage is asserted over the executable scope, that the domain lab is not required for a pull request, and that the commit message decides the next version. The code of conduct is the Contributor Covenant 2.1 with a reporting route that also works when the report concerns the maintainer - Add `LICENSE`, so the module can be distributed and the PowerShell Gallery can show the terms it is offered under. The manifest carried `All rights reserved`, which contradicts publishing it, and the Gallery entry would have shown no license and no project link. The copyright statement now names the MIT License, and `LicenseUri` and `ProjectUri` are set - Add `SECURITY.md`. This module writes security descriptors, so a defect in it can grant access an operator did not intend, and there was no private route to report one. It names the reporting route, the supported version, and what is in scope, and separates a defect from the behavior the specifications deliberately refuse - Add an install section to the README. It documented building from source only, so a reader arriving from the Gallery had no supported way to install the published package - Add the project''s brand assets under `assets/`, and float the wordmark to the left of the README intro through a `<picture>` element, so the header follows the reader''s GitHub theme and the first paragraph fills the space beside the mark rather than starting below a centred block. The wordmark stands in for the title, which is the layout the sibling `ShellPilot` and `DeskPilot` repositories already use. A float rather than a table, because github.com draws a border on every table cell and strips the style that would remove it. The package also had no icon, because `IconUri` was commented out, so a Gallery entry that now carries a license and a project link would still have shown the default placeholder. The wordmark and the glyph are supplied for a light and a dark surface, the dark-surface pair is recoloured from the near-black original rather than redrawn, and `assets/README.md` records the palette, the rule for choosing a variant, and how every derived file was produced - Add live evidence for concurrent Active Directory writers. Two access control entries written from one baseline through the two writable domain controllers converge to exactly one surviving entry, because the security descriptor is a single replicated attribute and the losing write is discarded whole rather than merged entry by entry. The same suite proves the two mechanisms a caller has: `ConcurrencyToken` is a hash of the sections that were read, so one converged descriptor reports one token through both controllers and a write on the other controller changes it; and two writes serialized through one pinned controller both survive. Specification 0016 records the contract, including why no directory command offers `RequireUnchanged` - Add live evidence for a key-reusing certificate renewal. The lab deployment now publishes an enterprise template at schema version 4 that issues a CNG key and requires the same key on renewal, and the acceptance enrolls a machine certificate from it and renews it. The renewal produces a different thumbprint over the same key container, the canonical target is unchanged, and a portability record captured before the renewal still relocates the key and restores its DACL although the thum' # Prerelease string of this module Prerelease = 'preview0001' # Flag to indicate whether the module requires explicit user acceptance for install/update/save # RequireLicenseAcceptance = $false # External dependent modules of this module # ExternalModuleDependencies = @() } # End of PSData hashtable } # End of PrivateData hashtable # HelpInfo URI of this module # HelpInfoURI = '' # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix. # DefaultCommandPrefix = '' } |