:py:mod:`dissect.database.ese.ntds.util` ======================================== .. py:module:: dissect.database.ese.ntds.util Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.database.ese.ntds.util.InstanceType dissect.database.ese.ntds.util.SystemFlags dissect.database.ese.ntds.util.UserAccountControl dissect.database.ese.ntds.util.SAMAccountType dissect.database.ese.ntds.util.SearchFlags dissect.database.ese.ntds.util.DN Functions ~~~~~~~~~ .. autoapisummary:: :nosignatures: dissect.database.ese.ntds.util.encode_value dissect.database.ese.ntds.util.decode_value Attributes ~~~~~~~~~~ .. autoapisummary:: dissect.database.ese.ntds.util.ATTRIBUTE_ENCODE_DECODE_MAP dissect.database.ese.ntds.util.ATTRIBUTE_LIST_ENCODE_DECODE_MAP dissect.database.ese.ntds.util.SYNTAX_ENCODE_DECODE_MAP .. py:class:: InstanceType Bases: :py:obj:`enum.IntFlag` Support for integer-based Flags .. py:attribute:: HeadOfNamingContext :value: 1 .. py:attribute:: ReplicaNotInstantiated :value: 2 .. py:attribute:: Writable :value: 4 .. py:attribute:: ParentNamingContextHeld :value: 8 .. py:attribute:: NamingContextUnderConstruction :value: 16 .. py:attribute:: NamingContextDeleting :value: 32 .. py:class:: SystemFlags Bases: :py:obj:`enum.IntFlag` Support for integer-based Flags .. py:attribute:: NotReplicated :value: 1 .. py:attribute:: ReplicatedToGlobalCatalog :value: 2 .. py:attribute:: Constructed :value: 4 .. py:attribute:: BaseSchema :value: 16 .. py:attribute:: DeletedImmediately :value: 33554432 .. py:attribute:: CannotBeMoved :value: 67108864 .. py:attribute:: CannotBeRenamed :value: 134217728 .. py:attribute:: ConfigurationCanBeMovedWithRestrictions :value: 268435456 .. py:attribute:: ConfigurationCanBeMoved :value: 536870912 .. py:attribute:: ConfigurationCanBeRenamedWithRestrictions :value: 1073741824 .. py:attribute:: CannotBeDeleted :value: 2147483648 .. py:class:: UserAccountControl Bases: :py:obj:`enum.IntFlag` Support for integer-based Flags .. py:attribute:: SCRIPT :value: 1 .. py:attribute:: ACCOUNTDISABLE :value: 2 .. py:attribute:: HOMEDIR_REQUIRED :value: 8 .. py:attribute:: LOCKOUT :value: 16 .. py:attribute:: PASSWD_NOTREQD :value: 32 .. py:attribute:: PASSWD_CANT_CHANGE :value: 64 .. py:attribute:: ENCRYPTED_TEXT_PASSWORD_ALLOWED :value: 128 .. py:attribute:: TEMP_DUPLICATE_ACCOUNT :value: 256 .. py:attribute:: NORMAL_ACCOUNT :value: 512 .. py:attribute:: INTERDOMAIN_TRUST_ACCOUNT :value: 2048 .. py:attribute:: WORKSTATION_TRUST_ACCOUNT :value: 4096 .. py:attribute:: SERVER_TRUST_ACCOUNT :value: 8192 .. py:attribute:: DONT_EXPIRE_PASSWORD :value: 65536 .. py:attribute:: MNS_LOGON_ACCOUNT :value: 131072 .. py:attribute:: SMARTCARD_REQUIRED :value: 262144 .. py:attribute:: TRUSTED_FOR_DELEGATION :value: 524288 .. py:attribute:: NOT_DELEGATED :value: 1048576 .. py:attribute:: USE_DES_KEY_ONLY :value: 2097152 .. py:attribute:: DONT_REQUIRE_PREAUTH :value: 4194304 .. py:attribute:: PASSWORD_EXPIRED :value: 8388608 .. py:attribute:: TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION :value: 16777216 .. py:class:: SAMAccountType Bases: :py:obj:`enum.IntEnum` Enum where members are also (and must be) ints .. py:attribute:: SAM_DOMAIN_OBJECT :value: 0 .. py:attribute:: SAM_GROUP_OBJECT :value: 268435456 .. py:attribute:: SAM_NON_SECURITY_GROUP_OBJECT :value: 268435457 .. py:attribute:: SAM_ALIAS_OBJECT :value: 536870912 .. py:attribute:: SAM_NON_SECURITY_ALIAS_OBJECT :value: 536870913 .. py:attribute:: SAM_USER_OBJECT :value: 805306368 .. py:attribute:: SAM_MACHINE_ACCOUNT :value: 805306369 .. py:attribute:: SAM_TRUST_ACCOUNT :value: 805306370 .. py:attribute:: SAM_APP_BASIC_GROUP :value: 1073741824 .. py:attribute:: SAM_APP_QUERY_GROUP :value: 1073741825 .. py:class:: SearchFlags Bases: :py:obj:`enum.IntFlag` Support for integer-based Flags .. py:attribute:: Indexed :value: 1 .. py:attribute:: ContainerIndexed :value: 2 .. py:attribute:: Anr :value: 4 .. py:attribute:: PreserveTombstone :value: 8 .. py:attribute:: CopyWithObject :value: 16 .. py:attribute:: TupleIndexed :value: 32 .. py:attribute:: VlvIndexed :value: 64 .. py:attribute:: Confidential :value: 128 .. py:data:: ATTRIBUTE_ENCODE_DECODE_MAP :type: dict[str, tuple[collections.abc.Callable[[dissect.database.ese.ntds.database.Database, Any], Any] | None, collections.abc.Callable[[dissect.database.ese.ntds.database.Database, Any], Any] | None]] .. py:data:: ATTRIBUTE_LIST_ENCODE_DECODE_MAP :type: dict[str, tuple[collections.abc.Callable[[dissect.database.ese.ntds.database.Database, list[Any]], list[Any]], collections.abc.Callable[[dissect.database.ese.ntds.database.Database, list[Any]], list[Any]]]] .. py:class:: DN Bases: :py:obj:`str` A distinguished name (DN) string wrapper. Presents the DN as a string but also retains the underlying object. .. py:attribute:: __slots__ :value: ('object', 'parent') .. py:data:: SYNTAX_ENCODE_DECODE_MAP :type: dict[int, tuple[collections.abc.Callable[[dissect.database.ese.ntds.database.Database, Any], Any] | None, collections.abc.Callable[[dissect.database.ese.ntds.database.Database, Any], Any] | None]] .. py:function:: encode_value(db: dissect.database.ese.ntds.database.Database, schema: dissect.database.ese.ntds.schema.AttributeEntry, value: str) -> int | bytes | str Encode a string value according to the attribute's type. :param db: The associated NTDS database instance. :param schema: The LDAP attribute schema. :param value: The string value to encode. :returns: The encoded value in the appropriate type for the attribute. .. py:function:: decode_value(db: dissect.database.ese.ntds.database.Database, schema: dissect.database.ese.ntds.schema.AttributeEntry, value: Any) -> Any Decode a value according to the attribute's type. :param db: The associated NTDS database instance. :param schema: The LDAP attribute schema. :param value: The value to decode. :returns: The decoded value in the appropriate Python type for the attribute.