Incident Response و Remediation

شناسایی Hidden Objects

برای یافتن objects با Deny ACL های مشکوک:

# جستجوی objects با Deny rules غیرمعمول
$DomainDN = (Get-ADDomain).DistinguishedName
Get-ADObject -Filter * -SearchBase $DomainDN -Properties nTSecurityDescriptor | ForEach-Object {
    $acl = $_.nTSecurityDescriptor.Access
    $denyRules = $acl | Where-Object {$_.AccessControlType -eq "Deny" -and $_.IdentityReference -eq "Everyone"}
    if ($denyRules) {
        [PSCustomObject]@{
            Object = $_.DistinguishedName
            DenyRules = $denyRules.Count
        }
    }
}

حذف Hidden User

برای حذف user مخفی، باید از Distinguished Name دقیق استفاده کنید:

# باید از DN صریح استفاده شود
$UserDN = "CN=RestrictedUser,OU=RestrictedOU,DC=certipied,DC=local"

# گرفتن Ownership به عنوان Domain Admin
$acl = Get-Acl "AD:\$UserDN"
$acl.SetOwner([System.Security.Principal.NTAccount]"CERTIPIED\Administrator")
Set-Acl "AD:\$UserDN" $acl

# حذف Deny rules
$acl = Get-Acl "AD:\$UserDN"
$acl.Access | Where-Object {$_.AccessControlType -eq "Deny"} | ForEach-Object {
    $acl.RemoveAccessRule($_)
}
Set-Acl "AD:\$UserDN" $acl

# حذف user
Remove-ADUser -Identity $UserDN -Confirm:$false

حذف Hidden OU

$OUDN = "OU=RestrictedOU,DC=certipied,DC=local"

# اصلاح permissions OU
$acl = Get-Acl "AD:\$OUDN"
$acl.Access | Where-Object {$_.AccessControlType -eq "Deny"} | ForEach-Object {
    $acl.RemoveAccessRule($_)
}
Set-Acl "AD:\$OUDN" $acl

# حذف OU (باید خالی باشد)
Remove-ADOrganizationalUnit -Identity $OUDN -Confirm:$false

Script جامع Cleanup:

# پاکسازی کامل تمام hidden objects
function Remove-HiddenADObjects {
    param([string]$SearchBase)
    
    # یافتن تمام objects با Deny ACL
    $hiddenObjects = Get-ADObject -Filter * -SearchBase $SearchBase -Properties nTSecurityDescriptor | 
        Where-Object {
            $_.nTSecurityDescriptor.Access | 
            Where-Object {$_.AccessControlType -eq "Deny" -and $_.IdentityReference -eq "Everyone"}
        }
    
    foreach ($obj in $hiddenObjects) {
        Write-Host "Processing: $($obj.DistinguishedName)"
        
        # گرفتن ownership
        $acl = Get-Acl "AD:\$($obj.DistinguishedName)"
        $acl.SetOwner([System.Security.Principal.NTAccount]"$env:USERDOMAIN\Administrator")
        Set-Acl "AD:\$($obj.DistinguishedName)" $acl
        
        # حذف Deny rules
        $acl = Get-Acl "AD:\$($obj.DistinguishedName)"
        $acl.Access | Where-Object {$_.AccessControlType -eq "Deny"} | ForEach-Object {
            $acl.RemoveAccessRule($_) | Out-Null
        }
        Set-Acl "AD:\$($obj.DistinguishedName)" $acl
        
        # حذف object
        Remove-ADObject -Identity $obj.DistinguishedName -Confirm:$false -Recursive
    }
}

# اجرا
Remove-HiddenADObjects -SearchBase (Get-ADDomain).DistinguishedName