:py:mod:`dissect.database.ese.ntds.objects.object`
==================================================

.. py:module:: dissect.database.ese.ntds.objects.object




Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.database.ese.ntds.objects.object.Object




.. py:class:: Object(db: dissect.database.ese.ntds.database.Database, record: dissect.database.ese.record.Record)

   Base class for all objects in the NTDS database.

   Within NTDS, this would be the "top" class, but we just call it "Object" here for clarity.

   :param db: The database instance associated with this object.
   :param record: The :class:`Record` instance representing this object.

   .. rubric:: References

   - https://learn.microsoft.com/en-us/windows/win32/adschema/c-top
   - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adsc/041c6068-c710-4c74-968f-3040e4208701


   .. py:attribute:: __object_class__
      :type:  str


   .. py:attribute:: __known_classes__
      :type:  ClassVar[dict[str, type[Object]]]


   .. py:attribute:: db


   .. py:attribute:: record


   .. py:method:: __init_subclass__()
      :classmethod:



   .. py:method:: __repr__() -> str


   .. py:method:: __repr_body__() -> str


   .. py:method:: __repr_suffix__() -> str


   .. py:method:: __getattr__(name: str) -> Any


   .. py:method:: from_record(db: dissect.database.ese.ntds.database.Database, record: dissect.database.ese.record.Record) -> Object
      :classmethod:


      Create an Object instance from a database record.

      :param db: The database instance associated with this object.
      :param record: The :class:`Record` instance representing this object.



   .. py:method:: get(name: str, *, raw: bool = False) -> Any

      Get an attribute value by name. Decodes the value based on the schema.

      :param name: The attribute name to retrieve.
      :param raw: Whether to return the raw value without decoding.



   .. py:method:: as_dict() -> dict[str, Any]

      Return the object's attributes as a dictionary.



   .. py:method:: parent() -> Object | None

      Return the parent object of this object, if any.



   .. py:method:: partition() -> Object | None

      Return the naming context (partition) object of this object, if any.



   .. py:method:: ancestors() -> collections.abc.Iterator[Object]


   .. py:method:: child(name: str) -> Object | None

      Return a child object by name, if it exists.

      :param name: The name of the child object to retrieve.



   .. py:method:: children() -> collections.abc.Iterator[Object]

      Yield all child objects of this object.



   .. py:method:: links() -> collections.abc.Iterator[tuple[str, Object]]

      Yield all objects linked to this object.



   .. py:method:: backlinks() -> collections.abc.Iterator[tuple[str, Object]]

      Yield all objects that link to this object.



   .. py:property:: dnt
      :type: int


      Return the object's Directory Number Tag (DNT).


   .. py:property:: pdnt
      :type: int


      Return the object's Parent Directory Number Tag (PDNT).


   .. py:property:: ncdnt
      :type: int | None


      Return the object's Naming Context Directory Number Tag (NCDNT).


   .. py:property:: name
      :type: str | None


      Return the object's name.


   .. py:property:: cn
      :type: str | None


      Return the object's Common Name (CN).


   .. py:property:: object_category
      :type: str | None


      Return the object's objectCategory.


   .. py:property:: object_class
      :type: list[str] | None


      Return the object's objectClass.


   .. py:property:: sid
      :type: str | None


      Return the object's Security Identifier (SID).


   .. py:property:: rid
      :type: int | None


      Return the object's Relative Identifier (RID).


   .. py:property:: guid
      :type: str | None


      Return the object's GUID.


   .. py:property:: is_deleted
      :type: bool


      Return whether the object is marked as deleted.


   .. py:property:: is_local
      :type: bool


      Return whether the object is local to this domain.


   .. py:property:: is_phantom
      :type: bool


      Return whether the object is a phantom (cross-domain reference).


   .. py:property:: when_created
      :type: datetime.datetime | None


      Return the object's creation time.


   .. py:property:: when_changed
      :type: datetime.datetime | None


      Return the object's last modification time.


   .. py:property:: instance_type
      :type: dissect.database.ese.ntds.util.InstanceType | None


      Return the object's instance type.


   .. py:property:: system_flags
      :type: dissect.database.ese.ntds.util.SystemFlags | None


      Return the object's system flags.


   .. py:property:: is_head_of_naming_context
      :type: bool


      Return whether the object is a head of naming context.


   .. py:property:: distinguished_name
      :type: dissect.database.ese.ntds.util.DN | None


      Return the fully qualified Distinguished Name (DN) for this object.


   .. py:attribute:: dn


   .. py:property:: sd
      :type: dissect.database.ese.ntds.sd.SecurityDescriptor | None


      Return the Security Descriptor for this object.


   .. py:property:: well_known_objects
      :type: list[Object]


      Return the list of well-known objects.


   .. py:property:: other_well_known_objects
      :type: list[Object]


      Return the list of other well-known objects.