`dissect.database.ese.ntds.objects.object`¶

Module Contents¶

Classes¶

Base class for all objects in the NTDS database.

class dissect.database.ese.ntds.objects.object.Object(db: dissect.database.ese.ntds.database.Database, record: dissect.database.ese.record.Record)¶

Base class for all objects in the NTDS database.

Within NTDS, this would be the “top” class, but we just call it “Object” here for clarity.

Parameters:

db – The database instance associated with this object.
record – The Record instance representing this object.

References

__object_class__: str¶

__known_classes__: ClassVar[dict[str, type[Object]]]¶

db¶

record¶

classmethod __init_subclass__()¶

__repr__() → str¶

__repr_body__() → str¶

__repr_suffix__() → str¶

__getattr__(name: str) → Any¶

classmethod from_record(db: dissect.database.ese.ntds.database.Database, record: dissect.database.ese.record.Record) → Object¶

Create an Object instance from a database record.

Parameters:

db – The database instance associated with this object.
record – The Record instance representing this object.

get(name: str, *, raw: bool = False) → Any¶

Get an attribute value by name. Decodes the value based on the schema.

Parameters:

name – The attribute name to retrieve.
raw – Whether to return the raw value without decoding.

as_dict() → dict[str, Any]¶: Return the object’s attributes as a dictionary.

parent() → Object | None¶: Return the parent object of this object, if any.

partition() → Object | None¶: Return the naming context (partition) object of this object, if any.

ancestors() → collections.abc.Iterator[Object]¶

child(name: str) → Object | None¶

Return a child object by name, if it exists.

Parameters:: name – The name of the child object to retrieve.

children() → collections.abc.Iterator[Object]¶: Yield all child objects of this object.

links() → collections.abc.Iterator[tuple[str, Object]]¶: Yield all objects linked to this object.

backlinks() → collections.abc.Iterator[tuple[str, Object]]¶: Yield all objects that link to this object.

property dnt: int¶: Return the object’s Directory Number Tag (DNT).

property pdnt: int¶: Return the object’s Parent Directory Number Tag (PDNT).

property ncdnt: int | None¶: Return the object’s Naming Context Directory Number Tag (NCDNT).

property name: str | None¶: Return the object’s name.

property cn: str | None¶: Return the object’s Common Name (CN).

property object_category: str | None¶: Return the object’s objectCategory.

property object_class: list[str] | None¶: Return the object’s objectClass.

property sid: str | None¶: Return the object’s Security Identifier (SID).

property rid: int | None¶: Return the object’s Relative Identifier (RID).

property guid: str | None¶: Return the object’s GUID.

property is_deleted: bool¶: Return whether the object is marked as deleted.

property is_local: bool¶: Return whether the object is local to this domain.

property is_phantom: bool¶: Return whether the object is a phantom (cross-domain reference).

property when_created: datetime.datetime | None¶: Return the object’s creation time.

property when_changed: datetime.datetime | None¶: Return the object’s last modification time.

property instance_type: dissect.database.ese.ntds.util.InstanceType | None¶: Return the object’s instance type.

property system_flags: dissect.database.ese.ntds.util.SystemFlags | None¶: Return the object’s system flags.

property is_head_of_naming_context: bool¶: Return whether the object is a head of naming context.

property distinguished_name: dissect.database.ese.ntds.util.DN | None¶: Return the fully qualified Distinguished Name (DN) for this object.

dn¶

property sd: dissect.database.ese.ntds.sd.SecurityDescriptor | None¶: Return the Security Descriptor for this object.

property well_known_objects: list[Object]¶: Return the list of well-known objects.

property other_well_known_objects: list[Object]¶: Return the list of other well-known objects.