:py:mod:`dissect.database.ese.ntds.database` ============================================ .. py:module:: dissect.database.ese.ntds.database Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.database.ese.ntds.database.Database dissect.database.ese.ntds.database.DataTable dissect.database.ese.ntds.database.LinkTable dissect.database.ese.ntds.database.SecurityDescriptorTable .. py:class:: Database(fh: BinaryIO) Interact with an NTDS.dit Active Directory Domain Services (AD DS) database. The main purpose of this class is to group interaction with the various tables and remove some clutter from the NTDS class. .. py:attribute:: ese .. py:attribute:: data .. py:attribute:: link .. py:attribute:: sd .. py:class:: DataTable(db: Database) Represents the ``datatable`` in the NTDS database. .. py:attribute:: db .. py:attribute:: table .. py:attribute:: hiddentable .. py:attribute:: hiddeninfo .. py:attribute:: schema .. py:attribute:: get .. py:method:: dsa() -> dissect.database.ese.ntds.objects.NTDSDSA Return the Directory System Agent (DSA) object. .. py:method:: dmd() -> dissect.database.ese.ntds.objects.DMD Return the Directory Management Domain (DMD) object, a.k.a. the schema container. .. py:method:: root() -> dissect.database.ese.ntds.objects.Top Return the top-level object in the NTDS database. .. py:method:: root_domain() -> dissect.database.ese.ntds.objects.DomainDNS | None Return the root domain object in the NTDS database. For AD LDS, this will return ``None``. .. py:property:: pek :type: dissect.database.ese.ntds.pek.PEK | None Return the PEK. .. py:method:: walk() -> collections.abc.Iterator[dissect.database.ese.ntds.objects.Object] Walk through all objects in the NTDS database. .. py:method:: iter() -> collections.abc.Iterator[dissect.database.ese.ntds.objects.Object] Iterate over all objects in the NTDS database. .. py:method:: lookup(**kwargs) -> dissect.database.ese.ntds.objects.Object Retrieve an object by a single indexed attribute. :param \*\*kwargs: Single keyword argument specifying the attribute and value. .. py:method:: query(query: str, *, optimize: bool = True) -> collections.abc.Iterator[dissect.database.ese.ntds.objects.Object] Execute an LDAP query against the NTDS database. :param query: The LDAP query string to execute. :param optimize: Whether to optimize the query, default is ``True``. :Yields: Object instances matching the query. Objects are cast to more specific types when possible. .. py:method:: search(**kwargs: str) -> collections.abc.Iterator[dissect.database.ese.ntds.objects.Object] Perform an attribute-value query. If multiple attributes are provided, it will be treated as an "AND" query. :param \*\*kwargs: Keyword arguments specifying the attributes and values. :Yields: Object instances matching the attribute-value pair. .. py:method:: child_of(dnt: int, name: str) -> dissect.database.ese.ntds.objects.Object | None Get a specific child object by name for a given Directory Number Tag (DNT). :param dnt: The DNT to retrieve the child object for. :param name: The name of the child object to retrieve. .. py:method:: children_of(dnt: int) -> collections.abc.Iterator[dissect.database.ese.ntds.objects.Object] Get all child objects of a given Directory Number Tag (DNT). :param dnt: The DNT to retrieve child objects for. .. py:class:: LinkTable(db: Database) Represents the ``link_table`` in the NTDS database. This table contains link records representing relationships between directory objects. .. py:attribute:: db .. py:attribute:: table .. py:method:: links(dnt: int, name: str | None = None) -> collections.abc.Iterator[dissect.database.ese.ntds.objects.Object] Get all linked objects for a given Directory Number Tag (DNT). :param dnt: The DNT to retrieve linked objects for. :param name: An optional link name to filter the linked objects. .. py:method:: all_links(dnt: int) -> collections.abc.Iterator[tuple[str, dissect.database.ese.ntds.objects.Object]] Get all linked objects along with their link names for a given Directory Number Tag (DNT). :param dnt: The DNT to retrieve linked objects for. .. py:method:: backlinks(dnt: int, name: str | None = None) -> collections.abc.Iterator[dissect.database.ese.ntds.objects.Object] Get all backlink objects for a given Directory Number Tag (DNT). :param dnt: The DNT to retrieve backlink objects for. :param name: An optional link name to filter the backlink objects. .. py:method:: all_backlinks(dnt: int) -> collections.abc.Iterator[tuple[str, dissect.database.ese.ntds.objects.Object]] Get all backlink objects along with their link names for a given Directory Number Tag (DNT). :param dnt: The DNT to retrieve backlink objects for. .. py:method:: has_link(link_dnt: int, name: str, backlink_dnt: int) -> bool Check if a specific link exists between two DNTs and a given link name. :param link_dnt: The DNT of the link object. :param name: The link name to check against. :param backlink_dnt: The DNT of the backlink object. .. py:method:: has_backlink(backlink_dnt: int, name: str, link_dnt: int) -> bool Check if a specific backlink exists between two DNTs and a given link name. :param backlink_dnt: The DNT of the backlink object. :param name: The link name to check against. :param link_dnt: The DNT of the link object. .. py:class:: SecurityDescriptorTable(db: Database) Represents the ``sd_table`` in the NTDS database. This table contains security descriptors associated with directory objects. .. py:attribute:: db .. py:attribute:: table .. py:method:: sd(id: int) -> dissect.database.ese.ntds.sd.SecurityDescriptor | None Get the Discretionary Access Control List (DACL), if available. :param id: The ID of the security descriptor.