Become an invisible admin

Invoke-T0SecurityPrincipalHiding -T0HideGroup T0-Hide -TargetOU OU=Accounts,OU=Tier0,OU=ESAE,DC=cloud-hybrid,DC=de

Invoke-T0SecurityPrincipalHiding -T0HideGroup T0-Hide -TargetOU OU=Accounts,OU=Tier0,OU=ESAE,DC=cloud-hybrid,DC=de -Undo

. .\T0-HideSecurityPrincipals.ps1

. C:\temp\T0-HideSecurityPrincipals.ps1

<# .SYNOPSIS Hides sensitive T0 objects .DESCRIPTION Security sensitive T0 objects from view of almost everyone by using the list object mode (LOM) in Active Directory. The dSHeuristics will be changed to 001 (if needed). 001 in the dSHeuristics activates the list object mode. Other changes to the attribute dSHeuristics will not be touched. Once implemented (first run of this script) will leave the LOM in place. It does not turn it off afterwards. The users container in Active Directory will be altered in it's DACL. The stated group will receive a DENY for ListChildren (List contents in the GUI). The object AdminSDHolder will be altered in it's DACL as well by stating a DENY for the given group for ListObject (List object in the GUI). The DACLs of AdminSDHolder will be propagated to all T0 objects in Active Directory every hour by the PDC-E. To make LOM work the permission DENY on ListChildren (List contents in the GUI) has to be set on every parent object of a T0 object. This would normally be a OU. Once those two permissions meet (DENY ListChilden at parent object + DENY ListObject at T0 objects) the T0 object will not be seen by a member of the T0HideGroup. Typically the T1-Allow, T2-Allow and other user specified groups will be nested in the T0HideGroup. The scipt has to runs as a member of the "Enterprise Admins" to alter the attribute dSHeuristics. CAREFULLY: DO NOT NEST "Domain Users" OR "Authenticated Users" IN THE T0HideGroup. .EXAMPLE This example hide the T0 object from members of the group "T0-Hide" at the OU 'OU=Accounts,OU=Tier0,OU=ESAE,DC=cloud-hybrid,DC=de' Invoke-T0SecurityPrincipalHiding -T0HideGroup T0-Hide -TargetOU OU=Accounts,OU=Tier0,OU=ESAE,DC=cloud-hybrid,DC=de .EXAMPLE This example hide the T0 object from members of the group "T0-Hide" at the OU 'OU=Accounts,OU=Tier0,OU=ESAE,DC=cloud-hybrid,DC=de' Invoke-T0SecurityPrincipalHiding -T0HideGroup T0-Hide -TargetOU OU=Accounts,OU=Tier0,OU=ESAE,DC=cloud-hybrid,DC=de .EXAMPLE This example hide the T0 object from members of the group "T0-Hide" at the OU 'OU=Accounts,OU=Tier0,OU=ESAE,DC=cloud-hybrid,DC=de' by using the alias HideT0 and the parameter positions HideT0 T0-Hide 'OU=Accounts,OU=Tier0,OU=ESAE,DC=cloud-hybrid,DC=de' .EXAMPLE This example hide the T0 object from members of the group "T0-Hide" at the OU 'OU=Accounts,OU=Tier0,OU=ESAE,DC=cloud-hybrid,DC=de' by using the alias StealthT0 and the parameter positions StealthT0 T0-Hide 'OU=Accounts,OU=Tier0,OU=ESAE,DC=cloud-hybrid,DC=de' .NOTES Version 1.0.0 - 2021/05/12 - Martin Handl - initial Version 1.0.1 - 2025/02/18 - Martin Handl - Bug with writing ACLs fixed + force ACL update on protected users .LINK https://iqunit.com/essential-active-directory-2025-workshop/ #>
function Invoke-T0SecurityPrincipalHiding
{
	[CmdletBinding()]
	[Alias("HideT0","StealthT0")]
	param (
		[Parameter(Position = 0, Mandatory = $true)]
		[System.String]$T0HideGroup,
		[Parameter(Position = 1, Mandatory = $false)]
		[Switch]$Undo
	)DynamicParam
	{
		# Set the dynamic parameters' name
		$ParameterName = 'TargetOU'
		
		# Create the dictionary 
		$RuntimeParameterDictionary = New-Object System.Management.Automation.RuntimeDefinedParameterDictionary
		
		# Create the collection of attributes
		$AttributeCollection = New-Object System.Collections.ObjectModel.Collection[System.Attribute]
		
		# Create and set the parameters' attributes
		$ParameterAttribute = New-Object System.Management.Automation.ParameterAttribute
		$ParameterAttribute.Mandatory = $true
		$ParameterAttribute.Position = 1
		
		# Add the attributes to the attributes collection
		$AttributeCollection.Add($ParameterAttribute)
		
		# Generate and set the ValidateSet 
		$arrSet = (Get-ADOrganizationalUnit -Filter { name -like "*" } -SearchBase (Get-ADDomain).distinguishedname -SearchScope Subtree).distinguishedname
		$ValidateSetAttribute = New-Object System.Management.Automation.ValidateSetAttribute($arrSet)
		
		# Add the ValidateSet to the attributes collection
		$AttributeCollection.Add($ValidateSetAttribute)
		
		# Create and return the dynamic parameter
		$RuntimeParameter = New-Object System.Management.Automation.RuntimeDefinedParameter($ParameterName, [string], $AttributeCollection)
		$RuntimeParameterDictionary.Add($ParameterName, $RuntimeParameter)
		return $RuntimeParameterDictionary
	}
	begin
	{
		# Probing Group
		Write-Verbose "Probing Group..."
		$T0HideGroup = Get-ADGroup -Identity $T0HideGroup -ErrorVariable GroupDoesNotExist -ErrorAction SilentlyContinue
		if ($GroupDoesNotExist.length -gt 0) { Write-Host -ForegroundColor Yellow -BackgroundColor Black "The AD group $T0HideGroup was not found in AD. `nTerminating script."; Break }
		
		# Bind the parameter to a friendly variable - result of the dynamic parameter
		$TargetOU = $PsBoundParameters[$ParameterName]
		
		# Building domain parameters
		$RootDSE = (Get-ADRootDSE)
		$Configuration = $RootDSE.configurationNamingContext
		$Domain = Get-ADDomain
		$DirectoryServiceDN = "CN=Directory Service,CN=Windows NT,CN=Services," + $Configuration
		$dSHeuristics = (Get-ADObject -Identity $DirectoryServiceDN -Properties dSHeuristics).dSHeuristics
		$T0HideGroupSID = New-Object System.Security.Principal.SecurityIdentifier (Get-ADGroup -Identity $T0HideGroup).sid
		$ParentACL = Get-Acl -Path $('AD:\' + $TargetOU)
		$UsersContainerACL = Get-Acl -Path $('AD:\CN=Users,' + $domain.DistinguishedName)
		$BuiltinContainerACL = Get-Acl -Path $('AD:\CN=Builtin,' + $domain.DistinguishedName)
		$AdminSDHolderACL = Get-Acl -Path $('AD:\CN=AdminSDHolder,CN=System,' + $Domain.DistinguishedName)
		$ProtectedObjects = (Get-ADObject -Filter { admincount -eq 2 }).DistinguishedName
	}
	process
	{
		switch ($Undo)
		{
			false{
				if ($null -ne $dSHeuristics)
				{
					
					$LOMStatus = $dSHeuristics[2]
					if ($LOMStatus -match 0)
					{
						$NewdSHeuristics = $($dSHeuristics.Substring(0, 2)) + $($dSHeuristics.Substring(2, 1).replace("0", "1")) + $($dSHeuristics.Substring(3, $($dSHeuristics.Length - 3)))
						Set-ADObject -Identity $DirectoryServiceDN -Replace @{ 'dSHeuristics' = $NewdSHeuristics }
					}
				}
				else
				{
					Set-ADObject -Identity $DirectoryServiceDN -Replace @{ 'dSHeuristics' = '001' }
				}
				$AdminSDHolderACL.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $T0HideGroupSID, "ListObject", "Deny"))
				Set-Acl -AclObject $AdminSDHolderACL -Path $('AD:\CN=AdminSDHolder,CN=System,' + $Domain.DistinguishedName)
				$ParentACL.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $T0HideGroupSID, "ListChildren", "Deny"))
				Set-Acl -AclObject $ParentACL -Path $('AD:\' + $TargetOU)
				$UsersContainerACL.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $T0HideGroupSID, "ListChildren", "Deny"))
				Set-Acl -AclObject $UsersContainerACL -Path $('AD:\CN=Users,' + $domain.DistinguishedName)
				$BuiltinContainerACL.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $T0HideGroupSID, "ListChildren", "Deny"))
				Set-Acl -AclObject $BuiltinContainerACL -Path $('AD:\CN=Builtin,' + $domain.DistinguishedName)
				$ProtectedObjects.foreach{
					Set-Acl -AclObject $AdminSDHolderACL -Path $_
				}			
			} true {
				if ($null -ne $dSHeuristics)
				{
					
					$LOMStatus = $dSHeuristics[2]
					if ($LOMStatus -match 0)
					{
						$NewdSHeuristics = $($dSHeuristics.Substring(0, 2)) + $($dSHeuristics.Substring(2, 1).replace("0", "1")) + $($dSHeuristics.Substring(3, $($dSHeuristics.Length - 3)))
						Set-ADObject -Identity $DirectoryServiceDN -Replace @{ 'dSHeuristics' = $NewdSHeuristics }
					}
				}
				else
				{
					Set-ADObject -Identity $DirectoryServiceDN -Replace @{ 'dSHeuristics' = '001' }
				}
				$AdminSDHolderACL.RemoveAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $T0HideGroupSID, "ListObject", "Deny")) | Out-Null
				Set-Acl -AclObject $AdminSDHolderACL -Path $('AD:\CN=AdminSDHolder,CN=System,' + $Domain.DistinguishedName)
				$ParentACL.RemoveAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $T0HideGroupSID, "ListChildren", "Deny")) | Out-Null
				Set-Acl -AclObject $ParentACL -Path $('AD:\' + $TargetOU)
				$UsersContainerACL.RemoveAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $T0HideGroupSID, "ListChildren", "Deny")) | Out-Null
				Set-Acl -AclObject $UsersContainerACL -Path $('AD:\CN=Users,' + $domain.DistinguishedName)
				$BuiltinContainerACL.RemoveAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule $T0HideGroupSID, "ListChildren", "Deny")) | Out-Null
				Set-Acl -AclObject $BuiltinContainerACL -Path $('AD:\CN=Builtin,' + $domain.DistinguishedName)
				$ProtectedObjects.foreach{
					Set-Acl -AclObject $AdminSDHolderACL -Path $_
				}	
			}
		}
	}
	
	end
	{
		switch ($Undo)
		{
			false {
				Write-Host "T0-Objects will not be seen by members of the group $((Get-ADObject -Identity $T0HideGroup).Name)."
			} true {
				Write-Host "T0-Objects will be seen by members of the group $((Get-ADObject -Identity $T0HideGroup).Name) and every else authenticated user."
			}
		}
	}
}